diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index b1a2941..0551b7f 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -134,7 +134,7 @@ jobs:
 
       - uses: taiki-e/install-action@v2
         with:
-          tool: wasmtime-cli@39.0.1
+          tool: wasmtime-cli@41.0.3
 
       - uses: actions/setup-python@v5
         with:
diff --git a/Cargo.lock b/Cargo.lock
index a28a64f..8bfb5fe 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -94,29 +94,29 @@ dependencies = [
 
 [[package]]
 name = "anstyle-query"
-version = "1.1.4"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e231f6134f61b71076a3eab506c379d4f36122f2af15a9ff04415ea4c3339e2"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
 dependencies = [
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "anstyle-wincon"
-version = "3.0.10"
+version = "3.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e0633414522a32ffaac8ac6cc8f748e090c5717661fddeea04219e2344f5f2a"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
 dependencies = [
  "anstyle",
  "once_cell_polyfill",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "anyhow"
-version = "1.0.100"
+version = "1.0.101"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a23eb6b1614318a8071c9b2521f36b424b2c83db5eb3a0fead4a6c0809af6e61"
+checksum = "5f0e0fee31ef5ed1ba1316088939cea399010ed7731dba877ed44aeb407a75ea"
 dependencies = [
  "backtrace",
 ]
@@ -129,9 +129,9 @@ checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1"
 
 [[package]]
 name = "assert_cmd"
-version = "2.1.1"
+version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bcbb6924530aa9e0432442af08bbcafdad182db80d2e560da42a6d442535bf85"
+checksum = "9c5bcfa8749ac45dd12cb11055aeeb6b27a3895560d60d71e3c23bf979e60514"
 dependencies = [
  "anstyle",
  "bstr",
@@ -144,13 +144,12 @@ dependencies = [
 
 [[package]]
 name = "async-compression"
-version = "0.4.32"
+version = "0.4.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a89bce6054c720275ac2432fbba080a66a2106a44a1b804553930ca6909f4e0"
+checksum = "82da0ea54ea533ec09d949717c6386a1c34f2d9b51c1fcc7eef8b9ce0b690a3e"
 dependencies = [
  "compression-codecs",
  "compression-core",
- "futures-core",
  "pin-project-lite",
  "tokio",
 ]
@@ -293,18 +292,18 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.19.0"
+version = "3.19.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43"
+checksum = "5dd9dc738b7a8311c7ade152424974d8115f2cdad61e8dab8dac9f2362298510"
 dependencies = [
  "allocator-api2",
 ]
 
 [[package]]
 name = "bytes"
-version = "1.10.1"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
+checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
 
 [[package]]
 name = "cap-fs-ext"
@@ -326,7 +325,7 @@ checksum = "20a158160765c6a7d0d8c072a53d772e4cb243f38b04bfcf6b4939cfbe7482e7"
 dependencies = [
  "cap-primitives",
  "cap-std",
- "rustix 1.1.2",
+ "rustix 1.1.3",
  "smallvec",
 ]
 
@@ -342,7 +341,7 @@ dependencies = [
  "io-lifetimes",
  "ipnet",
  "maybe-owned",
- "rustix 1.1.2",
+ "rustix 1.1.3",
  "rustix-linux-procfs",
  "windows-sys 0.59.0",
  "winx",
@@ -367,7 +366,7 @@ dependencies = [
  "cap-primitives",
  "io-extras",
  "io-lifetimes",
- "rustix 1.1.2",
+ "rustix 1.1.3",
 ]
 
 [[package]]
@@ -380,15 +379,15 @@ dependencies = [
  "cap-primitives",
  "iana-time-zone",
  "once_cell",
- "rustix 1.1.2",
+ "rustix 1.1.3",
  "winx",
 ]
 
 [[package]]
 name = "cc"
-version = "1.2.43"
+version = "1.2.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "739eb0f94557554b3ca9a86d2d37bebd49c5e6d0c1d2bda35ba5bdac830befc2"
+checksum = "47b26a0954ae34af09b50f0de26458fa95369a0d478d8236d3f93082b219bd29"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -410,9 +409,9 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
 [[package]]
 name = "clap"
-version = "4.5.51"
+version = "4.5.57"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c26d721170e0295f191a69bd9a1f93efcdb0aff38684b61ab5750468972e5f5"
+checksum = "6899ea499e3fb9305a65d5ebf6e3d2248c5fab291f300ad0a704fbe142eae31a"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -420,9 +419,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.51"
+version = "4.5.57"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75835f0c7bf681bfd05abe44e965760fea999a5286c6eb2d59883634fd02011a"
+checksum = "7b12c8b680195a62a8364d16b8447b01b6c2c8f9aaf68bee653be34d4245e238"
 dependencies = [
  "anstream",
  "anstyle",
@@ -432,11 +431,11 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.5.49"
+version = "4.5.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a0b5487afeab2deb2ff4e03a807ad1a03ac532ff5a2cee5d86884440c7f7671"
+checksum = "a92793da1a46a5f2a02a6f4c46c6496b28c43638adea8306fcb0caa1634f24e5"
 dependencies = [
- "heck 0.5.0",
+ "heck",
  "proc-macro2",
  "quote",
  "syn",
@@ -444,9 +443,9 @@ dependencies = [
 
 [[package]]
 name = "clap_lex"
-version = "0.7.6"
+version = "0.7.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1d728cc89cf3aee9ff92b05e62b19ee65a02b5702cff7d5a377e32c6ae29d8d"
+checksum = "c3e64b0cc0439b12df2fa678eae89a1c56a529fd067a9115f7827f1fffd22b32"
 
 [[package]]
 name = "cobs"
@@ -454,7 +453,7 @@ version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fa961b519f0b462e3a3b4a34b64d119eeaca1d59af726fe450bbba07a9fc0a1"
 dependencies = [
- "thiserror 2.0.17",
+ "thiserror 2.0.18",
 ]
 
 [[package]]
@@ -466,19 +465,19 @@ checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
 [[package]]
 name = "component-init-transform"
 version = "0.2.0"
-source = "git+https://github.com/dicej/component-init?rev=2d965957#2d96595716615426e26b4346003a29f557e2f31b"
+source = "git+https://github.com/dicej/component-init?rev=1de5906c#1de5906ca8c5f7093eaa9f6565f1dde5fc9608d3"
 dependencies = [
  "anyhow",
  "async-trait",
  "futures",
- "wasm-encoder 0.240.0 (git+https://github.com/bytecodealliance/wasm-tools?rev=b1d8ff59)",
- "wasm-metadata 0.240.0 (git+https://github.com/bytecodealliance/wasm-tools?rev=b1d8ff59)",
- "wasmparser 0.240.0 (git+https://github.com/bytecodealliance/wasm-tools?rev=b1d8ff59)",
+ "wasm-encoder 0.244.0",
+ "wasm-metadata",
+ "wasmparser 0.244.0",
 ]
 
 [[package]]
 name = "componentize-py"
-version = "0.19.3"
+version = "0.20.0"
 dependencies = [
  "anyhow",
  "assert_cmd",
@@ -491,7 +490,7 @@ dependencies = [
  "flate2",
  "fs_extra",
  "futures",
- "heck 0.5.0",
+ "heck",
  "hex",
  "im-rc",
  "indexmap",
@@ -508,13 +507,13 @@ dependencies = [
  "test-generator",
  "tokio",
  "toml 0.8.23",
- "wasm-encoder 0.240.0 (git+https://github.com/bytecodealliance/wasm-tools?rev=e2bb0a24)",
- "wasmparser 0.240.0 (git+https://github.com/bytecodealliance/wasm-tools?rev=e2bb0a24)",
+ "wasm-encoder 0.244.0",
+ "wasmparser 0.244.0",
  "wasmtime",
  "wasmtime-wasi",
- "wit-component 0.240.0",
+ "wit-component",
  "wit-dylib",
- "wit-parser 0.240.0 (git+https://github.com/bytecodealliance/wasm-tools?rev=e2bb0a24)",
+ "wit-parser 0.244.0",
  "zstd",
 ]
 
@@ -526,16 +525,15 @@ dependencies = [
  "num-bigint",
  "once_cell",
  "pyo3",
- "wit-bindgen 0.40.0",
- "wit-bindgen-rt",
+ "wit-bindgen 0.52.0",
  "wit-dylib-ffi",
 ]
 
 [[package]]
 name = "compression-codecs"
-version = "0.4.31"
+version = "0.4.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef8a506ec4b81c460798f572caead636d57d3d7e940f998160f52bd254bf2d23"
+checksum = "00828ba6fd27b45a448e57dbfe84f1029d4c9f26b368157e9a448a5f49a2ec2a"
 dependencies = [
  "brotli",
  "compression-core",
@@ -547,9 +545,9 @@ dependencies = [
 
 [[package]]
 name = "compression-core"
-version = "0.4.29"
+version = "0.4.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e47641d3deaf41fb1538ac1f54735925e275eaf3bf4d55c81b137fba797e5cbb"
+checksum = "75984efb6ed102a0d42db99afb6c1948f0380d1d91808d5529916e6c08b49d8d"
 
 [[package]]
 name = "core-foundation-sys"
@@ -577,36 +575,36 @@ dependencies = [
 
 [[package]]
 name = "cranelift-assembler-x64"
-version = "0.126.0"
+version = "0.128.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf7631e609c97f063f9777aae405e8492abf9bf92336d7aa3f875403dd4ffd7d"
+checksum = "0377b13bf002a0774fcccac4f1102a10f04893d24060cf4b7350c87e4cbb647c"
 dependencies = [
  "cranelift-assembler-x64-meta",
 ]
 
 [[package]]
 name = "cranelift-assembler-x64-meta"
-version = "0.126.0"
+version = "0.128.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c030edccdc4a5bbf28fbfe7701b5cd1f9854b4445184dd34af2a7e8f8db6f45"
+checksum = "cfa027979140d023b25bf7509fb7ede3a54c3d3871fb5ead4673c4b633f671a2"
 dependencies = [
  "cranelift-srcgen",
 ]
 
 [[package]]
 name = "cranelift-bforest"
-version = "0.126.0"
+version = "0.128.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb544c1242d0ca98baf01873ebba96c79d5df155d5108d9bb699aefc741f5e6d"
+checksum = "618e4da87d9179a70b3c2f664451ca8898987aa6eb9f487d16988588b5d8cc40"
 dependencies = [
  "cranelift-entity",
 ]
 
 [[package]]
 name = "cranelift-bitset"
-version = "0.126.0"
+version = "0.128.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0325aecbafec053d3d3f082edfdca7937e2945e7f09c5ff9672e05198312282"
+checksum = "db53764b5dad233b37b8f5dc54d3caa9900c54579195e00f17ea21f03f71aaa7"
 dependencies = [
  "serde",
  "serde_derive",
@@ -614,9 +612,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-codegen"
-version = "0.126.0"
+version = "0.128.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "abb3236fd319ae897ba00c8a25105081de5c1348576def0e96c062ad259f87a7"
+checksum = "4ae927f1d8c0abddaa863acd201471d56e7fc6c3925104f4861ed4dc3e28b421"
 dependencies = [
  "bumpalo",
  "cranelift-assembler-x64",
@@ -641,37 +639,37 @@ dependencies = [
 
 [[package]]
 name = "cranelift-codegen-meta"
-version = "0.126.0"
+version = "0.128.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b8791c911a361c539130ace34fb726b16aca4216470ec75d75264b1495c8a3a"
+checksum = "d3fcf1e3e6757834bd2584f4cbff023fcc198e9279dcb5d684b4bb27a9b19f54"
 dependencies = [
  "cranelift-assembler-x64-meta",
  "cranelift-codegen-shared",
  "cranelift-srcgen",
- "heck 0.5.0",
+ "heck",
  "pulley-interpreter",
 ]
 
 [[package]]
 name = "cranelift-codegen-shared"
-version = "0.126.0"
+version = "0.128.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12ead718c2a10990870c19b2497b5a04b8aae6024485e33da25b5d02e35819e0"
+checksum = "205dcb9e6ccf9d368b7466be675ff6ee54a63e36da6fe20e72d45169cf6fd254"
 
 [[package]]
 name = "cranelift-control"
-version = "0.126.0"
+version = "0.128.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0a57fc972b5651047efddccb99440d103d9d8c13393ccebde15ddd5b6a1181b"
+checksum = "108eca9fcfe86026054f931eceaf57b722c1b97464bf8265323a9b5877238817"
 dependencies = [
  "arbitrary",
 ]
 
 [[package]]
 name = "cranelift-entity"
-version = "0.126.0"
+version = "0.128.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5aae980b4a1678b601eab2f52e372ed0b3c9565a31c17f380008cb97b3a699c5"
+checksum = "a0d96496910065d3165f84ff8e1e393916f4c086f88ac8e1b407678bc78735aa"
 dependencies = [
  "cranelift-bitset",
  "serde",
@@ -680,9 +678,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-frontend"
-version = "0.126.0"
+version = "0.128.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a78877016b607982ca1708c0dd4ce23bde04581a39854c9b43a1dca43625b54c"
+checksum = "e303983ad7e23c850f24d9c41fc3cb346e1b930f066d3966545e4c98dac5c9fb"
 dependencies = [
  "cranelift-codegen",
  "log",
@@ -692,15 +690,15 @@ dependencies = [
 
 [[package]]
 name = "cranelift-isle"
-version = "0.126.0"
+version = "0.128.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5dc46a68b46d4f53f9f2f02ab8d3a34b00f03a21c124a7a965b8cbf5fdb6773b"
+checksum = "24b0cf8d867d891245836cac7abafb0a5b0ea040a019d720702b3b8bcba40bfa"
 
 [[package]]
 name = "cranelift-native"
-version = "0.126.0"
+version = "0.128.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03faa07ec8cf373250a8252eb773d098ff88259fa1c19ee1ecde8012839f4097"
+checksum = "e24b641e315443e27807b69c440fe766737d7e718c68beb665a2d69259c77bf3"
 dependencies = [
  "cranelift-codegen",
  "libc",
@@ -709,9 +707,9 @@ dependencies = [
 
 [[package]]
 name = "cranelift-srcgen"
-version = "0.126.0"
+version = "0.128.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0484cb32c527a742e1bba09ef174acac0afb1dcf623ef1adda42849200edcd2e"
+checksum = "a4e378a54e7168a689486d67ee1f818b7e5356e54ae51a1d7a53f4f13f7f8b7a"
 
 [[package]]
 name = "crc32fast"
@@ -749,9 +747,9 @@ checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
 
 [[package]]
 name = "crypto-common"
-version = "0.1.6"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
 dependencies = [
  "generic-array",
  "typenum",
@@ -889,27 +887,26 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ce92ff622d6dadf7349484f42c93271a0d49b7cc4d466a936405bacbe10aa78"
 dependencies = [
  "cfg-if",
- "rustix 1.1.2",
+ "rustix 1.1.3",
  "windows-sys 0.59.0",
 ]
 
 [[package]]
 name = "filetime"
-version = "0.2.26"
+version = "0.2.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc0505cd1b6fa6580283f6bdf70a73fcf4aba1184038c90902b92b3dd0df63ed"
+checksum = "f98844151eee8917efc50bd9e8318cb963ae8b297431495d3f758616ea5c57db"
 dependencies = [
  "cfg-if",
  "libc",
  "libredox",
- "windows-sys 0.60.2",
 ]
 
 [[package]]
 name = "find-msvc-tools"
-version = "0.1.4"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52051878f80a721bb68ebfbc930e07b65ba72f2da88968ea5c06fd6ca3d3a127"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
 
 [[package]]
 name = "fixedbitset"
@@ -919,9 +916,9 @@ checksum = "0ce7134b9999ecaf8bcd65542e436736ef32ddca1b3e06094cb6ec5755203b80"
 
 [[package]]
 name = "flate2"
-version = "1.1.5"
+version = "1.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfe33edd8e85a12a67454e37f8c75e730830d83e313556ab9ebf9ee7fbeb3bfb"
+checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
 dependencies = [
  "crc32fast",
  "miniz_oxide",
@@ -964,7 +961,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94e7099f6313ecacbe1256e8ff9d617b75d1bcb16a6fddef94866d225a01a14a"
 dependencies = [
  "io-lifetimes",
- "rustix 1.1.2",
+ "rustix 1.1.3",
  "windows-sys 0.59.0",
 ]
 
@@ -1079,9 +1076,9 @@ dependencies = [
 
 [[package]]
 name = "generic-array"
-version = "0.14.9"
+version = "0.14.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4bb6743198531e02858aeaea5398fcc883e71851fcbcb5a2f773e2fb6cb1edf2"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
 dependencies = [
  "typenum",
  "version_check",
@@ -1089,9 +1086,9 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.16"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "335ff9f135e4384c8150d6f27c6daed433577f86b4750418338c01a1a2528592"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
 dependencies = [
  "cfg-if",
  "js-sys",
@@ -1137,15 +1134,9 @@ dependencies = [
 
 [[package]]
 name = "hashbrown"
-version = "0.16.0"
+version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5419bdc4f6a9207fbeba6d11b604d481addf78ecd10c11ad51e76c2f6482748d"
-
-[[package]]
-name = "heck"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
 
 [[package]]
 name = "heck"
@@ -1167,12 +1158,11 @@ checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
 [[package]]
 name = "http"
-version = "1.3.1"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4a85d31aea989eead29a3aaf9e1115a180df8282431156e533de47660892565"
+checksum = "e3ba2a386d7f85a81f119ad7498ebe444d2e22c2af0b86b069416ace48b3311a"
 dependencies = [
  "bytes",
- "fnv",
  "itoa",
 ]
 
@@ -1213,9 +1203,9 @@ checksum = "135b12329e5e3ce057a9f972339ea52bc954fe1e9358ef27f95e89716fbc5424"
 
 [[package]]
 name = "hyper"
-version = "1.7.0"
+version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb3aa54a13a0dfe7fbe3a59e0c76093041720fdc77b110cc0fc260fafb4dc51e"
+checksum = "2ab2d4f250c3d7b1c9fcdff1cece94ea4e2dfbec68614f7b87cb205f24ca9d11"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -1251,14 +1241,13 @@ dependencies = [
 
 [[package]]
 name = "hyper-util"
-version = "0.1.17"
+version = "0.1.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c6995591a8f1380fcb4ba966a252a4b29188d51d2b89e3a252f5305be65aea8"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
 dependencies = [
  "base64",
  "bytes",
  "futures-channel",
- "futures-core",
  "futures-util",
  "http",
  "http-body",
@@ -1275,9 +1264,9 @@ dependencies = [
 
 [[package]]
 name = "iana-time-zone"
-version = "0.1.64"
+version = "0.1.65"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33e57f83510bb73707521ebaffa789ec8caf86f9657cad665b092b581d40e9fb"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
 dependencies = [
  "android_system_properties",
  "core-foundation-sys",
@@ -1345,9 +1334,9 @@ checksum = "7aedcccd01fc5fe81e6b489c15b247b8b0690feb23304303a9e560f37efc560a"
 
 [[package]]
 name = "icu_properties"
-version = "2.1.1"
+version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e93fcd3157766c0c8da2f8cff6ce651a31f0810eaa1c51ec363ef790bbb5fb99"
+checksum = "020bfc02fe870ec3a66d93e677ccca0562506e5872c650f893269e08615d74ec"
 dependencies = [
  "icu_collections",
  "icu_locale_core",
@@ -1359,9 +1348,9 @@ dependencies = [
 
 [[package]]
 name = "icu_properties_data"
-version = "2.1.1"
+version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02845b3647bb045f1100ecd6480ff52f34c35f82d9880e029d329c21d1054899"
+checksum = "616c294cf8d725c6afcd8f55abc17c56464ef6211f9ed59cccffe534129c77af"
 
 [[package]]
 name = "icu_provider"
@@ -1380,9 +1369,9 @@ dependencies = [
 
 [[package]]
 name = "id-arena"
-version = "2.2.1"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25a2bc672d1148e28034f176e01fffebb08b35768468cc954630da77a1449005"
+checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
 
 [[package]]
 name = "idna"
@@ -1421,12 +1410,12 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.12.0"
+version = "2.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6717a8d2a5a929a1a2eb43a12812498ed141a0bcfb7e8f7844fbdbe4303bba9f"
+checksum = "7714e70437a7dc3ac8eb7e6f8df75fd8eb422675fc7678aff7364301092b1017"
 dependencies = [
  "equivalent",
- "hashbrown 0.16.0",
+ "hashbrown 0.16.1",
  "serde",
  "serde_core",
 ]
@@ -1464,9 +1453,9 @@ checksum = "469fb0b9cefa57e3ef31275ee7cacb78f2fdca44e4765491884a2b119d4eb130"
 
 [[package]]
 name = "iri-string"
-version = "0.7.8"
+version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbc5ebe9c3a1a7a5127f920a418f7585e9e758e911d0466ed004f393b0e380b2"
+checksum = "c91338f0783edbd6195decb37bae672fd3b165faffb89bf7b9e6942f8b1a731a"
 dependencies = [
  "memchr",
  "serde",
@@ -1500,9 +1489,9 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "1.0.15"
+version = "1.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
+checksum = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2"
 
 [[package]]
 name = "ittapi"
@@ -1536,9 +1525,9 @@ dependencies = [
 
 [[package]]
 name = "js-sys"
-version = "0.3.82"
+version = "0.3.85"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b011eec8cc36da2aab2d5cff675ec18454fad408585853910a202391cf9f8e65"
+checksum = "8c942ebf8e95485ca0d52d97da7c5a2c387d0e7f0ba4c35e93bfcaee045955b3"
 dependencies = [
  "once_cell",
  "wasm-bindgen",
@@ -1558,21 +1547,21 @@ checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
 
 [[package]]
 name = "libc"
-version = "0.2.177"
+version = "0.2.180"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976"
+checksum = "bcc35a38544a891a5f7c865aca548a982ccb3b8650a5b06d0fd33a10283c56fc"
 
 [[package]]
 name = "libm"
-version = "0.2.15"
+version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9fbbcab51052fe104eb5e5d351cf728d30a5be1fe14d9be8a3b097481fb97de"
+checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
 
 [[package]]
 name = "libredox"
-version = "0.1.10"
+version = "0.1.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "416f7e718bdb06000964960ffa43b4335ad4012ae8b99060261aa4a8088d5ccb"
+checksum = "3d0b95e02c851351f877147b7deea7b1afb1df71b63aa5f8270716e0c5720616"
 dependencies = [
  "bitflags",
  "libc",
@@ -1599,9 +1588,9 @@ checksum = "6373607a59f0be73a39b6fe456b8192fcc3585f602af20751600e974dd455e77"
 
 [[package]]
 name = "log"
-version = "0.4.28"
+version = "0.4.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34080505efa8e45a4b816c349525ebe327ceaa8559756f0356cba97ef3bf7432"
+checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
 
 [[package]]
 name = "lru-slab"
@@ -1636,7 +1625,7 @@ version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ad38eb12aea514a0466ea40a80fd8cc83637065948eb4a426e4aa46261175227"
 dependencies = [
- "rustix 1.1.2",
+ "rustix 1.1.3",
 ]
 
 [[package]]
@@ -1660,9 +1649,9 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "1.1.0"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69d83b0086dc8ecf3ce9ae2874b2d1290252e2a30720bea58a5c6639b0092873"
+checksum = "a69bcab0ad47271a0234d9422b131806bf3968021e5dc9328caf2d4cd58557fc"
 dependencies = [
  "libc",
  "wasi",
@@ -1763,9 +1752,9 @@ checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
 
 [[package]]
 name = "portable-atomic"
-version = "1.11.1"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f84267b20a16ea918e43c6a88433c2d54fa145c92a811b5b047ccbe153674483"
+checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
 
 [[package]]
 name = "postcard"
@@ -1849,18 +1838,18 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.103"
+version = "1.0.106"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ee95bc4ef87b8d5ba32e8b7714ccc834865276eab0aed5c9958d00ec45f49e8"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "proptest"
-version = "1.9.0"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bee689443a2bd0a16ab0348b52ee43e3b2d1b1f931c8aa5c9f8de4c86fbe8c40"
+checksum = "37566cb3fdacef14c0737f9546df7cfeadbfbc9fef10991038bf5015d0c80532"
 dependencies = [
  "bit-set",
  "bit-vec",
@@ -1877,9 +1866,9 @@ dependencies = [
 
 [[package]]
 name = "pulley-interpreter"
-version = "39.0.0"
+version = "41.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bc616e1513d22922fd69ef8294f243f9b268790a1bf6c2f4dbd0fefb82badaf"
+checksum = "01051a5b172e07f9197b85060e6583b942aec679dac08416647bf7e7dc916b65"
 dependencies = [
  "cranelift-bitset",
  "log",
@@ -1889,9 +1878,9 @@ dependencies = [
 
 [[package]]
 name = "pulley-macros"
-version = "39.0.0"
+version = "41.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7416ec5b280e7c12c457452d8d1569591ff29136f12fa699e848b9cc77de2845"
+checksum = "2cf194f5b1a415ef3a44ee35056f4009092cc4038a9f7e3c7c1e392f48ee7dbb"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1953,7 +1942,7 @@ version = "0.26.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "100246c0ecf400b475341b8455a9213344569af29a3c841d29270e53102e0fcf"
 dependencies = [
- "heck 0.5.0",
+ "heck",
  "proc-macro2",
  "pyo3-build-config",
  "quote",
@@ -1980,7 +1969,7 @@ dependencies = [
  "rustc-hash",
  "rustls",
  "socket2",
- "thiserror 2.0.17",
+ "thiserror 2.0.18",
  "tokio",
  "tracing",
  "web-time",
@@ -2001,7 +1990,7 @@ dependencies = [
  "rustls",
  "rustls-pki-types",
  "slab",
- "thiserror 2.0.17",
+ "thiserror 2.0.18",
  "tinyvec",
  "tracing",
  "web-time",
@@ -2023,9 +2012,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.41"
+version = "1.0.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce25767e7b499d1b604768e7cde645d14cc8584231ea6b295e9c9eb22c02e1d1"
+checksum = "21b2ebcf727b7760c461f091f9f0f539b77b8e87f2fd88131e7f1b433b3cece4"
 dependencies = [
  "proc-macro2",
 ]
@@ -2054,7 +2043,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
 dependencies = [
  "rand_chacha 0.9.0",
- "rand_core 0.9.3",
+ "rand_core 0.9.5",
 ]
 
 [[package]]
@@ -2074,7 +2063,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
 dependencies = [
  "ppv-lite86",
- "rand_core 0.9.3",
+ "rand_core 0.9.5",
 ]
 
 [[package]]
@@ -2083,14 +2072,14 @@ version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
 dependencies = [
- "getrandom 0.2.16",
+ "getrandom 0.2.17",
 ]
 
 [[package]]
 name = "rand_core"
-version = "0.9.3"
+version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
 dependencies = [
  "getrandom 0.3.4",
 ]
@@ -2101,7 +2090,7 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "513962919efc330f829edb2535844d1b912b0fbe2ca165d613e4e8788bb05a5a"
 dependencies = [
- "rand_core 0.9.3",
+ "rand_core 0.9.5",
 ]
 
 [[package]]
@@ -2135,9 +2124,9 @@ dependencies = [
 
 [[package]]
 name = "redox_syscall"
-version = "0.5.18"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+checksum = "49f3fe0889e69e2ae9e41f4d6c4c0181701d00e4697b356fb1f74173a5e0ee27"
 dependencies = [
  "bitflags",
 ]
@@ -2148,16 +2137,16 @@ version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ba009ff324d1fc1b900bd1fdb31564febe58a8ccc8a6fdbb93b543d33b13ca43"
 dependencies = [
- "getrandom 0.2.16",
+ "getrandom 0.2.17",
  "libredox",
  "thiserror 1.0.69",
 ]
 
 [[package]]
 name = "regalloc2"
-version = "0.13.2"
+version = "0.13.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "efd8138ce7c3d7c13be4f61893154b5d711bd798d2d7be3ecb8dcc7e7a06ca98"
+checksum = "08effbc1fa53aaebff69521a5c05640523fab037b34a4a2c109506bc938246fa"
 dependencies = [
  "allocator-api2",
  "bumpalo",
@@ -2169,9 +2158,9 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.12.2"
+version = "1.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "843bc0191f75f3e22651ae5f1e72939ab2f72a4bc30fa80a066bd66edefc24d4"
+checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -2181,9 +2170,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.13"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5276caf25ac86c8d810222b3dbb938e512c55c6831a10f3e6ed1c93b84041f1c"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -2192,17 +2181,16 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.8"
+version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58"
+checksum = "a96887878f22d7bad8a3b6dc5b7440e0ada9a245242924394987b21cf2210a4c"
 
 [[package]]
 name = "reqwest"
-version = "0.12.24"
+version = "0.12.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d0946410b9f7b082a427e4ef5c8ff541a88b357bc6c637c40db3a68ac70a36f"
+checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
 dependencies = [
- "async-compression",
  "base64",
  "bytes",
  "futures-channel",
@@ -2227,7 +2215,6 @@ dependencies = [
  "sync_wrapper",
  "tokio",
  "tokio-rustls",
- "tokio-util",
  "tower",
  "tower-http",
  "tower-service",
@@ -2246,7 +2233,7 @@ checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
 dependencies = [
  "cc",
  "cfg-if",
- "getrandom 0.2.16",
+ "getrandom 0.2.17",
  "libc",
  "untrusted",
  "windows-sys 0.52.0",
@@ -2254,9 +2241,9 @@ dependencies = [
 
 [[package]]
 name = "rustc-demangle"
-version = "0.1.26"
+version = "0.1.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56f7d92ca342cea22a06f2121d944b4fd82af56988c270852495420f961d4ace"
+checksum = "b50b8869d9fc858ce7266cce0194bd74df58b9d0e3f6df3a9fc8eb470d95c09d"
 
 [[package]]
 name = "rustc-hash"
@@ -2279,9 +2266,9 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "1.1.2"
+version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd15f8a2c5551a84d56efdc1cd049089e409ac19a3072d5037a17fd70719ff3e"
+checksum = "146c9e247ccc180c1f61615433868c99f3de3ae256a30a43b49f67c2d9171f34"
 dependencies = [
  "bitflags",
  "errno",
@@ -2297,14 +2284,14 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2fc84bf7e9aa16c4f2c758f27412dc9841341e16aa682d9c7ac308fe3ee12056"
 dependencies = [
  "once_cell",
- "rustix 1.1.2",
+ "rustix 1.1.3",
 ]
 
 [[package]]
 name = "rustls"
-version = "0.23.34"
+version = "0.23.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a9586e9ee2b4f8fab52a0048ca7334d7024eef48e2cb9407e3497bb7cab7fa7"
+checksum = "c665f33d38cea657d9614f766881e4d510e0eda4239891eea56b4cadcf01801b"
 dependencies = [
  "once_cell",
  "ring",
@@ -2316,9 +2303,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-pki-types"
-version = "1.13.0"
+version = "1.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94182ad936a0c91c324cd46c6511b9510ed16af436d7b5bab34beab0afd55f7a"
+checksum = "be040f8b0a225e40375822a563fa9524378b9d63112f53e19ffff34df5d33fdd"
 dependencies = [
  "web-time",
  "zeroize",
@@ -2326,9 +2313,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.8"
+version = "0.103.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ffdfa2f5286e2247234e03f680868ac2815974dc39e00ea15adc445d0aafe52"
+checksum = "d7df23109aa6c1567d1c575b9952556388da57401e4ace1d15f79eedad0d8f53"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -2355,9 +2342,9 @@ dependencies = [
 
 [[package]]
 name = "ryu"
-version = "1.0.20"
+version = "1.0.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
+checksum = "a50f4cf475b65d88e057964e0e9bb1f0aa9bbb2036dc65c64596b42932536984"
 
 [[package]]
 name = "semver"
@@ -2401,15 +2388,15 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.145"
+version = "1.0.149"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "402a6f66d8c709116cf22f558eab210f5a50187f702eb4d7e5ef38d9a7f1c79c"
+checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
 dependencies = [
  "itoa",
  "memchr",
- "ryu",
  "serde",
  "serde_core",
+ "zmij",
 ]
 
 [[package]]
@@ -2423,9 +2410,9 @@ dependencies = [
 
 [[package]]
 name = "serde_spanned"
-version = "1.0.3"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e24345aa0fe688594e73770a5f6d1b216508b4f93484c0026d521acd30134392"
+checksum = "f8bbf91e5a4d6315eee45e704372590b30e260ee83af6639d64557f51b067776"
 dependencies = [
  "serde_core",
 ]
@@ -2474,9 +2461,9 @@ checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
 
 [[package]]
 name = "simd-adler32"
-version = "0.3.7"
+version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d66dc143e6b11c1eddc06d5c423cfc97062865baf299914ab64caa38182078fe"
+checksum = "e320a6c5ad31d271ad523dcf3ad13e2767ad8b1cb8f047f75a8aeaf8da139da2"
 
 [[package]]
 name = "sized-chunks"
@@ -2490,9 +2477,9 @@ dependencies = [
 
 [[package]]
 name = "slab"
-version = "0.4.11"
+version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a2ae44ef20feb57a68b23d846850f861394c2e02dc425a50098ae8c90267589"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
 [[package]]
 name = "smallvec"
@@ -2505,9 +2492,9 @@ dependencies = [
 
 [[package]]
 name = "socket2"
-version = "0.6.1"
+version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17129e116933cf371d018bb80ae557e889637989d8638274fb25622827b03881"
+checksum = "86f4aa3ad99f2088c990dfa82d367e19cb29268ed67c574d10d0a4bfe71f07e0"
 dependencies = [
  "libc",
  "windows-sys 0.60.2",
@@ -2542,9 +2529,9 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
 [[package]]
 name = "syn"
-version = "2.0.108"
+version = "2.0.114"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da58917d35242480a05c2897064da0a80589a2a0476c9a3f2fdc83b53502e917"
+checksum = "d4d107df263a3013ef9b1879b0df87d706ff80f65a86ea879bd9c31f9b307c2a"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2600,20 +2587,20 @@ dependencies = [
 
 [[package]]
 name = "target-lexicon"
-version = "0.13.3"
+version = "0.13.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df7f62577c25e07834649fc3b39fafdc597c0a3527dc1c60129201ccfcbaa50c"
+checksum = "b1dd07eb858a2067e2f3c7155d54e929265c264e6f37efe3ee7a8d1b5a1dd0ba"
 
 [[package]]
 name = "tempfile"
-version = "3.23.0"
+version = "3.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d31c77bdf42a745371d260a26ca7163f1e0924b64afa0b688e61b5a9fa02f16"
+checksum = "655da9c7eb6305c55742045d5a8d2037996d61d8de95806335c7c86ce0f82e9c"
 dependencies = [
  "fastrand",
  "getrandom 0.3.4",
  "once_cell",
- "rustix 1.1.2",
+ "rustix 1.1.3",
  "windows-sys 0.61.2",
 ]
 
@@ -2637,7 +2624,7 @@ name = "test-generator"
 version = "0.1.0"
 dependencies = [
  "anyhow",
- "getrandom 0.2.16",
+ "getrandom 0.2.17",
  "hex",
  "proptest",
 ]
@@ -2653,11 +2640,11 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "2.0.17"
+version = "2.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f63587ca0f12b72a0600bcba1d40081f830876000bb46dd2337a3051618f4fc8"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
 dependencies = [
- "thiserror-impl 2.0.17",
+ "thiserror-impl 2.0.18",
 ]
 
 [[package]]
@@ -2673,9 +2660,9 @@ dependencies = [
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.17"
+version = "2.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ff15c8ecd7de3849db632e14d18d2571fa09dfc5ed93479bc4485c7a517c913"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2709,9 +2696,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.48.0"
+version = "1.49.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff360e02eab121e0bc37a2d3b4d4dc622e6eda3a8e5253d5435ecf5bd4c68408"
+checksum = "72a2903cd7736441aac9df9d7688bd0ce48edccaadf181c3b90be801e81d3d86"
 dependencies = [
  "bytes",
  "libc",
@@ -2745,9 +2732,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-util"
-version = "0.7.16"
+version = "0.7.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14307c986784f72ef81c89db7d9e28d6ac26d16213b109ea501696195e6e3ce5"
+checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
 dependencies = [
  "bytes",
  "futures-core",
@@ -2770,14 +2757,14 @@ dependencies = [
 
 [[package]]
 name = "toml"
-version = "0.9.8"
+version = "0.9.11+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0dc8b1fb61449e27716ec0e1bdf0f6b8f3e8f6b05391e8497b8b6d7804ea6d8"
+checksum = "f3afc9a848309fe1aaffaed6e1546a7a14de1f935dc9d89d32afd9a44bab7c46"
 dependencies = [
  "indexmap",
  "serde_core",
- "serde_spanned 1.0.3",
- "toml_datetime 0.7.3",
+ "serde_spanned 1.0.4",
+ "toml_datetime 0.7.5+spec-1.1.0",
  "toml_parser",
  "toml_writer",
  "winnow",
@@ -2794,9 +2781,9 @@ dependencies = [
 
 [[package]]
 name = "toml_datetime"
-version = "0.7.3"
+version = "0.7.5+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2cdb639ebbc97961c51720f858597f7f24c4fc295327923af55b74c3c724533"
+checksum = "92e1cfed4a3038bc5a127e35a2d360f145e1f4b971b551a2ba5fd7aedf7e1347"
 dependencies = [
  "serde_core",
 ]
@@ -2817,9 +2804,9 @@ dependencies = [
 
 [[package]]
 name = "toml_parser"
-version = "1.0.4"
+version = "1.0.6+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0cbe268d35bdb4bb5a56a2de88d0ad0eb70af5384a99d648cd4b3d04039800e"
+checksum = "a3198b4b0a8e11f09dd03e133c0280504d0801269e9afa46362ffde1cbeebf44"
 dependencies = [
  "winnow",
 ]
@@ -2832,9 +2819,9 @@ checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
 
 [[package]]
 name = "toml_writer"
-version = "1.0.4"
+version = "1.0.6+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df8b2b54733674ad286d16267dcfc7a71ed5c776e4ac7aa3c3e2561f7c637bf2"
+checksum = "ab16f14aed21ee8bfd8ec22513f7287cd4a91aa92e44edfe2c17ddd004e92607"
 
 [[package]]
 name = "topological-sort"
@@ -2844,9 +2831,9 @@ checksum = "ea68304e134ecd095ac6c3574494fc62b909f416c4fca77e440530221e549d3d"
 
 [[package]]
 name = "tower"
-version = "0.5.2"
+version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d039ad9159c98b70ecfd540b2573b97f7f52c3e8d9f8ad57a24b916a536975f9"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
 dependencies = [
  "futures-core",
  "futures-util",
@@ -2859,17 +2846,22 @@ dependencies = [
 
 [[package]]
 name = "tower-http"
-version = "0.6.6"
+version = "0.6.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "adc82fd73de2a9722ac5da747f12383d2bfdb93591ee6c58486e0097890f05f2"
+checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
 dependencies = [
+ "async-compression",
  "bitflags",
  "bytes",
+ "futures-core",
  "futures-util",
  "http",
  "http-body",
+ "http-body-util",
  "iri-string",
  "pin-project-lite",
+ "tokio",
+ "tokio-util",
  "tower",
  "tower-layer",
  "tower-service",
@@ -2889,9 +2881,9 @@ checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
 
 [[package]]
 name = "tracing"
-version = "0.1.41"
+version = "0.1.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "784e0ac535deb450455cbfa28a6f0df145ea1bb7ae51b821cf5e7927fdcfbdd0"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
 dependencies = [
  "pin-project-lite",
  "tracing-attributes",
@@ -2900,9 +2892,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-attributes"
-version = "0.1.30"
+version = "0.1.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81383ab64e72a7a8b8e13130c49e3dab29def6d0c7d76a03087b3cf71c5c6903"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2911,9 +2903,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-core"
-version = "0.1.34"
+version = "0.1.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9d12581f227e93f094d3af2ae690a574abb8a2b9b7a96e7cfe9647b2b617678"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
 dependencies = [
  "once_cell",
 ]
@@ -2938,9 +2930,9 @@ checksum = "eaea85b334db583fe3274d12b4cd1880032beab409c0d774be044d4480ab9a94"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.20"
+version = "1.0.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "462eeb75aeb73aea900253ce739c8e18a67423fadf006037cd3ff27e82748a06"
+checksum = "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5"
 
 [[package]]
 name = "unicode-width"
@@ -2974,9 +2966,9 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
 [[package]]
 name = "url"
-version = "2.5.7"
+version = "2.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08bc136a29a3d1758e07a9cca267be308aeebf5cfd5a10f3f67ab2097683ef5b"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
 dependencies = [
  "form_urlencoded",
  "idna",
@@ -2998,9 +2990,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
-version = "1.18.1"
+version = "1.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f87b8aa10b915a06587d0dec516c282ff295b475d94abf425d62b57710070a2"
+checksum = "ee48d38b119b0cd71fe4141b30f5ba9c7c5d9f4e7a3a8b4a674e4b6ef789976f"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -3038,18 +3030,18 @@ checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
 [[package]]
 name = "wasip2"
-version = "1.0.1+wasi-0.2.4"
+version = "1.0.2+wasi-0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0562428422c63773dad2c345a1882263bbf4d65cf3f42e90921f787ef5ad58e7"
+checksum = "9517f9239f02c069db75e65f174b3da828fe5f5b945c4dd26bd25d89c03ebcf5"
 dependencies = [
- "wit-bindgen 0.46.0",
+ "wit-bindgen 0.51.0",
 ]
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.105"
+version = "0.2.108"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da95793dfc411fbbd93f5be7715b0578ec61fe87cb1a42b12eb625caa5c5ea60"
+checksum = "64024a30ec1e37399cf85a7ffefebdb72205ca1c972291c51512360d90bd8566"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -3060,11 +3052,12 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.55"
+version = "0.4.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "551f88106c6d5e7ccc7cd9a16f312dd3b5d36ea8b4954304657d5dfba115d4a0"
+checksum = "70a6e77fd0ae8029c9ea0063f87c46fde723e7d887703d74ad2616d792e51e6f"
 dependencies = [
  "cfg-if",
+ "futures-util",
  "js-sys",
  "once_cell",
  "wasm-bindgen",
@@ -3073,9 +3066,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.105"
+version = "0.2.108"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04264334509e04a7bf8690f2384ef5265f05143a4bff3889ab7a3269adab59c2"
+checksum = "008b239d9c740232e71bd39e8ef6429d27097518b6b30bdf9086833bd5b6d608"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -3083,9 +3076,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.105"
+version = "0.2.108"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "420bc339d9f322e562942d52e115d57e950d12d88983a14c79b86859ee6c7ebc"
+checksum = "5256bae2d58f54820e6490f9839c49780dff84c65aeab9e772f15d5f0e913a55"
 dependencies = [
  "bumpalo",
  "proc-macro2",
@@ -3096,21 +3089,21 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.105"
+version = "0.2.108"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76f218a38c84bcb33c25ec7059b07847d465ce0e0a76b995e134a45adcb6af76"
+checksum = "1f01b580c9ac74c8d8f0c0e4afb04eeef2acf145458e52c03845ee9cd23e3d12"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "wasm-compose"
-version = "0.240.0"
+version = "0.243.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "feeb9a231e63bd5d5dfe07e9f8daa53d5c85e4f7de5ef756d3b4e6a5f501c578"
+checksum = "af801b6f36459023eaec63fdbaedad2fd5a4ab7dc74ecc110a8b5d375c5775e4"
 dependencies = [
  "anyhow",
- "heck 0.4.1",
+ "heck",
  "im-rc",
  "indexmap",
  "log",
@@ -3119,72 +3112,36 @@ dependencies = [
  "serde_derive",
  "serde_yaml",
  "smallvec",
- "wasm-encoder 0.240.0 (registry+https://github.com/rust-lang/crates.io-index)",
- "wasmparser 0.240.0 (registry+https://github.com/rust-lang/crates.io-index)",
+ "wasm-encoder 0.243.0",
+ "wasmparser 0.243.0",
  "wat",
 ]
 
 [[package]]
 name = "wasm-encoder"
-version = "0.227.1"
+version = "0.243.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "80bb72f02e7fbf07183443b27b0f3d4144abf8c114189f2e088ed95b696a7822"
+checksum = "c55db9c896d70bd9fa535ce83cd4e1f2ec3726b0edd2142079f594fc3be1cb35"
 dependencies = [
  "leb128fmt",
- "wasmparser 0.227.1",
+ "wasmparser 0.243.0",
 ]
 
 [[package]]
 name = "wasm-encoder"
-version = "0.240.0"
+version = "0.244.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06d642d8c5ecc083aafe9ceb32809276a304547a3a6eeecceb5d8152598bc71f"
-dependencies = [
- "leb128fmt",
- "wasmparser 0.240.0 (registry+https://github.com/rust-lang/crates.io-index)",
-]
-
-[[package]]
-name = "wasm-encoder"
-version = "0.240.0"
-source = "git+https://github.com/bytecodealliance/wasm-tools?rev=b1d8ff59#b1d8ff591bcb8c052b54c3c17495bbbef401897c"
-dependencies = [
- "leb128fmt",
- "wasmparser 0.240.0 (git+https://github.com/bytecodealliance/wasm-tools?rev=b1d8ff59)",
-]
-
-[[package]]
-name = "wasm-encoder"
-version = "0.240.0"
-source = "git+https://github.com/bytecodealliance/wasm-tools?rev=e2bb0a24#e2bb0a249b038c54e404394f60411f4e8aa914c4"
+checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
 dependencies = [
  "leb128fmt",
- "wasmparser 0.240.0 (git+https://github.com/bytecodealliance/wasm-tools?rev=e2bb0a24)",
+ "wasmparser 0.244.0",
 ]
 
 [[package]]
 name = "wasm-metadata"
-version = "0.227.1"
+version = "0.244.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce1ef0faabbbba6674e97a56bee857ccddf942785a336c8b47b42373c922a91d"
-dependencies = [
- "anyhow",
- "auditable-serde",
- "flate2",
- "indexmap",
- "serde",
- "serde_derive",
- "serde_json",
- "spdx",
- "url",
- "wasm-encoder 0.227.1",
- "wasmparser 0.227.1",
-]
-
-[[package]]
-name = "wasm-metadata"
-version = "0.240.0"
-source = "git+https://github.com/bytecodealliance/wasm-tools?rev=b1d8ff59#b1d8ff591bcb8c052b54c3c17495bbbef401897c"
+checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
 dependencies = [
  "anyhow",
  "auditable-serde",
@@ -3195,50 +3152,15 @@ dependencies = [
  "serde_json",
  "spdx",
  "url",
- "wasm-encoder 0.240.0 (git+https://github.com/bytecodealliance/wasm-tools?rev=b1d8ff59)",
- "wasmparser 0.240.0 (git+https://github.com/bytecodealliance/wasm-tools?rev=b1d8ff59)",
-]
-
-[[package]]
-name = "wasm-metadata"
-version = "0.240.0"
-source = "git+https://github.com/bytecodealliance/wasm-tools?rev=e2bb0a24#e2bb0a249b038c54e404394f60411f4e8aa914c4"
-dependencies = [
- "anyhow",
- "indexmap",
- "wasm-encoder 0.240.0 (git+https://github.com/bytecodealliance/wasm-tools?rev=e2bb0a24)",
- "wasmparser 0.240.0 (git+https://github.com/bytecodealliance/wasm-tools?rev=e2bb0a24)",
-]
-
-[[package]]
-name = "wasmparser"
-version = "0.227.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f51cad774fb3c9461ab9bccc9c62dfb7388397b5deda31bf40e8108ccd678b2"
-dependencies = [
- "bitflags",
- "hashbrown 0.15.5",
- "indexmap",
- "semver",
+ "wasm-encoder 0.244.0",
+ "wasmparser 0.244.0",
 ]
 
 [[package]]
 name = "wasmparser"
-version = "0.240.0"
+version = "0.243.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b722dcf61e0ea47440b53ff83ccb5df8efec57a69d150e4f24882e4eba7e24a4"
-dependencies = [
- "bitflags",
- "hashbrown 0.15.5",
- "indexmap",
- "semver",
- "serde",
-]
-
-[[package]]
-name = "wasmparser"
-version = "0.240.0"
-source = "git+https://github.com/bytecodealliance/wasm-tools?rev=b1d8ff59#b1d8ff591bcb8c052b54c3c17495bbbef401897c"
+checksum = "f6d8db401b0528ec316dfbe579e6ab4152d61739cfe076706d2009127970159d"
 dependencies = [
  "bitflags",
  "hashbrown 0.15.5",
@@ -3249,8 +3171,9 @@ dependencies = [
 
 [[package]]
 name = "wasmparser"
-version = "0.240.0"
-source = "git+https://github.com/bytecodealliance/wasm-tools?rev=e2bb0a24#e2bb0a249b038c54e404394f60411f4e8aa914c4"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
 dependencies = [
  "bitflags",
  "hashbrown 0.15.5",
@@ -3261,20 +3184,20 @@ dependencies = [
 
 [[package]]
 name = "wasmprinter"
-version = "0.240.0"
+version = "0.243.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a84d6e25c198da67d0150ee7c2c62d33d784f0a565d1e670bdf1eeccca8158bc"
+checksum = "eb2b6035559e146114c29a909a3232928ee488d6507a1504d8934e8607b36d7b"
 dependencies = [
  "anyhow",
  "termcolor",
- "wasmparser 0.240.0 (registry+https://github.com/rust-lang/crates.io-index)",
+ "wasmparser 0.243.0",
 ]
 
 [[package]]
 name = "wasmtime"
-version = "39.0.0"
+version = "41.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa8756404ba797b1df7e4bbb1b9b9261d48c0b4c9ae8b511b9f0050f2982f7c7"
+checksum = "a19f56cece843fa95dd929f5568ff8739c7e3873b530ceea9eda2aa02a0b4142"
 dependencies = [
  "addr2line",
  "anyhow",
@@ -3300,7 +3223,7 @@ dependencies = [
  "postcard",
  "pulley-interpreter",
  "rayon",
- "rustix 1.1.2",
+ "rustix 1.1.3",
  "semver",
  "serde",
  "serde_derive",
@@ -3309,8 +3232,8 @@ dependencies = [
  "target-lexicon",
  "tempfile",
  "wasm-compose",
- "wasm-encoder 0.240.0 (registry+https://github.com/rust-lang/crates.io-index)",
- "wasmparser 0.240.0 (registry+https://github.com/rust-lang/crates.io-index)",
+ "wasm-encoder 0.243.0",
+ "wasmparser 0.243.0",
  "wasmtime-environ",
  "wasmtime-internal-cache",
  "wasmtime-internal-component-macro",
@@ -3325,14 +3248,14 @@ dependencies = [
  "wasmtime-internal-versioned-export-macros",
  "wasmtime-internal-winch",
  "wat",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "wasmtime-environ"
-version = "39.0.0"
+version = "41.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbe588bc688673cbd4085cbb82db681a6591c87538dce6aa44c0057a3c82bbca"
+checksum = "3bf9dff572c950258548cbbaf39033f68f8dcd0b43b22e80def9fe12d532d3e5"
 dependencies = [
  "anyhow",
  "cpp_demangle",
@@ -3349,37 +3272,37 @@ dependencies = [
  "serde_derive",
  "smallvec",
  "target-lexicon",
- "wasm-encoder 0.240.0 (registry+https://github.com/rust-lang/crates.io-index)",
- "wasmparser 0.240.0 (registry+https://github.com/rust-lang/crates.io-index)",
+ "wasm-encoder 0.243.0",
+ "wasmparser 0.243.0",
  "wasmprinter",
  "wasmtime-internal-component-util",
 ]
 
 [[package]]
 name = "wasmtime-internal-cache"
-version = "39.0.0"
+version = "41.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6883ad2840d15d463f3bf6a4e2f276074c9ff580f290fe57301ba7d9e41ae20"
+checksum = "7f52a985f5b5dae53147fc596f3a313c334e2c24fd1ba708634e1382f6ecd727"
 dependencies = [
- "anyhow",
  "base64",
  "directories-next",
  "log",
  "postcard",
- "rustix 1.1.2",
+ "rustix 1.1.3",
  "serde",
  "serde_derive",
  "sha2",
- "toml 0.9.8",
- "windows-sys 0.60.2",
+ "toml 0.9.11+spec-1.1.0",
+ "wasmtime-environ",
+ "windows-sys 0.61.2",
  "zstd",
 ]
 
 [[package]]
 name = "wasmtime-internal-component-macro"
-version = "39.0.0"
+version = "41.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "784eacadc1ce66d111c2e2b80eb1cef0ba6f9a47e40cf1ec51bb60d7e3c7b8eb"
+checksum = "7920dc7dcb608352f5fe93c52582e65075b7643efc5dac3fc717c1645a8d29a0"
 dependencies = [
  "anyhow",
  "proc-macro2",
@@ -3387,22 +3310,21 @@ dependencies = [
  "syn",
  "wasmtime-internal-component-util",
  "wasmtime-internal-wit-bindgen",
- "wit-parser 0.240.0 (registry+https://github.com/rust-lang/crates.io-index)",
+ "wit-parser 0.243.0",
 ]
 
 [[package]]
 name = "wasmtime-internal-component-util"
-version = "39.0.0"
+version = "41.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0864d5af4d2689c1fd7f279bd548de614da9667428914a5655237b55e5a0e8c"
+checksum = "066f5aed35aa60580a2ac0df145c0f0d4b04319862fee1d6036693e1cca43a12"
 
 [[package]]
 name = "wasmtime-internal-cranelift"
-version = "39.0.0"
+version = "41.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7da9085c89bd382e95e5bddedb95f6304ef7866b04f84d2bb3ac7d46d9e6219"
+checksum = "afb8002dc415b7773d7949ee360c05ee8f91627ec25a7a0b01ee03831bdfdda1"
 dependencies = [
- "anyhow",
  "cfg-if",
  "cranelift-codegen",
  "cranelift-control",
@@ -3416,8 +3338,8 @@ dependencies = [
  "pulley-interpreter",
  "smallvec",
  "target-lexicon",
- "thiserror 2.0.17",
- "wasmparser 0.240.0 (registry+https://github.com/rust-lang/crates.io-index)",
+ "thiserror 2.0.18",
+ "wasmparser 0.243.0",
  "wasmtime-environ",
  "wasmtime-internal-math",
  "wasmtime-internal-unwinder",
@@ -3426,76 +3348,76 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-fiber"
-version = "39.0.0"
+version = "41.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e9c0146a0cb1de6f8f1539f7ce95b4464f57940b2b608db730b43407f09902f"
+checksum = "7f9c562c5a272bc9f615d8f0c085a4360bafa28eef9aa5947e63d204b1129b22"
 dependencies = [
- "anyhow",
  "cc",
  "cfg-if",
  "libc",
- "rustix 1.1.2",
+ "rustix 1.1.3",
+ "wasmtime-environ",
  "wasmtime-internal-versioned-export-macros",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "wasmtime-internal-jit-debug"
-version = "39.0.0"
+version = "41.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "774ed19958d2fe67bdb817501aad9d399be50ee5752f63fdb866e061fc034186"
+checksum = "db673148f26e1211db3913c12c75594be9e3858a71fa297561e9162b1a49cfb0"
 dependencies = [
  "cc",
  "object",
- "rustix 1.1.2",
+ "rustix 1.1.3",
  "wasmtime-internal-versioned-export-macros",
 ]
 
 [[package]]
 name = "wasmtime-internal-jit-icache-coherence"
-version = "39.0.0"
+version = "41.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f67986f5c499274ae5b2ba5b173bba0b95d1381f5ca70d8eec657f2392117d8"
+checksum = "bada5ca1cc47df7d14100e2254e187c2486b426df813cea2dd2553a7469f7674"
 dependencies = [
  "anyhow",
  "cfg-if",
  "libc",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "wasmtime-internal-math"
-version = "39.0.0"
+version = "41.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a681733e9b5d5d8804ee6cacd59f92c0d87ba2274f42ee1d4e5a943828d0075d"
+checksum = "cf6f615d528eda9adc6eefb062135f831b5215c348f4c3ec3e143690c730605b"
 dependencies = [
  "libm",
 ]
 
 [[package]]
 name = "wasmtime-internal-slab"
-version = "39.0.0"
+version = "41.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f70d4cccc4e7947fee614e939c88495b97234b15932d0f1e547ed333cb45b8f2"
+checksum = "da169d4f789b586e1b2612ba8399c653ed5763edf3e678884ba785bb151d018f"
 
 [[package]]
 name = "wasmtime-internal-unwinder"
-version = "39.0.0"
+version = "41.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "268719806a64beed50c571066c8d809e99118d03cc7a3f2a2112776540387b04"
+checksum = "4888301f3393e4e8c75c938cce427293fade300fee3fc8fd466fdf3e54ae068e"
 dependencies = [
- "anyhow",
  "cfg-if",
  "cranelift-codegen",
  "log",
  "object",
+ "wasmtime-environ",
 ]
 
 [[package]]
 name = "wasmtime-internal-versioned-export-macros"
-version = "39.0.0"
+version = "41.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f159bbb87a078b67f1bfd75d2acb9d2e47c2177044bcccb20d031addbc6245c3"
+checksum = "63ba3124cc2cbcd362672f9f077303ccc4cd61daa908f73447b7fdaece75ff9f"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3504,17 +3426,16 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-winch"
-version = "39.0.0"
+version = "41.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "398c815d9bd313e9f3e768c1c39859f02c89cbbacccbc9fdb1943937b588c0a3"
+checksum = "90a4182515dabba776656de4ebd62efad03399e261cf937ecccb838ce8823534"
 dependencies = [
- "anyhow",
  "cranelift-codegen",
  "gimli",
  "log",
  "object",
  "target-lexicon",
- "wasmparser 0.240.0 (registry+https://github.com/rust-lang/crates.io-index)",
+ "wasmparser 0.243.0",
  "wasmtime-environ",
  "wasmtime-internal-cranelift",
  "winch-codegen",
@@ -3522,22 +3443,22 @@ dependencies = [
 
 [[package]]
 name = "wasmtime-internal-wit-bindgen"
-version = "39.0.0"
+version = "41.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ee6e4341cf80f6f2b50923553a92d14a0aa9f921fbf4370b3bde367db90f3e6"
+checksum = "87acbd416227cdd279565ba49e57cf7f08d112657c3b3f39b70250acdfd094fe"
 dependencies = [
  "anyhow",
  "bitflags",
- "heck 0.5.0",
+ "heck",
  "indexmap",
- "wit-parser 0.240.0 (registry+https://github.com/rust-lang/crates.io-index)",
+ "wit-parser 0.243.0",
 ]
 
 [[package]]
 name = "wasmtime-wasi"
-version = "39.0.0"
+version = "41.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4364e3dbe9b4586a7ebf4e4e520ba30b305f1b616de7aa451e2bb70e620b357"
+checksum = "d9a1bdb4948463ed22559a640e687fed0df50b66353144aa6a9496c041ecd927"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -3552,23 +3473,23 @@ dependencies = [
  "futures",
  "io-extras",
  "io-lifetimes",
- "rustix 1.1.2",
+ "rustix 1.1.3",
  "system-interface",
- "thiserror 2.0.17",
+ "thiserror 2.0.18",
  "tokio",
  "tracing",
  "url",
  "wasmtime",
  "wasmtime-wasi-io",
  "wiggle",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "wasmtime-wasi-io"
-version = "39.0.0"
+version = "41.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0ca2b0297ee1f1ebb0466f6eaa559d50befe9a6e06fc52cf070e56475544e0d"
+checksum = "d7873d8b990d3cf1105ef491abf2b3cf1e19ff6722d24d5ca662026ea082cdff"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -3588,31 +3509,31 @@ dependencies = [
 
 [[package]]
 name = "wast"
-version = "240.0.0"
+version = "244.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0efe1c93db4ac562b9733e3dca19ed7fc878dba29aef22245acf84f13da4a19"
+checksum = "b2e7b9f9e23311275920e3d6b56d64137c160cf8af4f84a7283b36cfecbf4acb"
 dependencies = [
  "bumpalo",
  "leb128fmt",
  "memchr",
  "unicode-width",
- "wasm-encoder 0.240.0 (registry+https://github.com/rust-lang/crates.io-index)",
+ "wasm-encoder 0.244.0",
 ]
 
 [[package]]
 name = "wat"
-version = "1.240.0"
+version = "1.244.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ec9b6eab7ecd4d639d78515e9ea491c9bacf494aa5eda10823bd35992cf8c1e"
+checksum = "bbf35b87ed352f9ab6cd0732abde5a67dd6153dfd02c493e61459218b19456fa"
 dependencies = [
- "wast 240.0.0",
+ "wast 244.0.0",
 ]
 
 [[package]]
 name = "web-sys"
-version = "0.3.82"
+version = "0.3.85"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a1f95c0d03a47f4ae1f7a64643a6bb97465d9b740f0fa8f90ea33915c99a9a1"
+checksum = "312e32e551d92129218ea9a2452120f4aabc03529ef03e4d0d82fb2780608598"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -3630,22 +3551,22 @@ dependencies = [
 
 [[package]]
 name = "webpki-roots"
-version = "1.0.3"
+version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32b130c0d2d49f8b6889abc456e795e82525204f27c42cf767cf0d7734e089b8"
+checksum = "22cfaf3c063993ff62e73cb4311efde4db1efb31ab78a3e5c457939ad5cc0bed"
 dependencies = [
  "rustls-pki-types",
 ]
 
 [[package]]
 name = "wiggle"
-version = "39.0.0"
+version = "41.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ca9dcd24f64c200aa0618c5e595e044226aa169fc287b4267709a926d929e0f"
+checksum = "1f05d2a9932ca235984248dc98471ae83d1985e095682d049af4c296f54f0fb4"
 dependencies = [
  "anyhow",
  "bitflags",
- "thiserror 2.0.17",
+ "thiserror 2.0.18",
  "tracing",
  "wasmtime",
  "wiggle-macro",
@@ -3653,12 +3574,12 @@ dependencies = [
 
 [[package]]
 name = "wiggle-generate"
-version = "39.0.0"
+version = "41.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9836f1ccbbfea133c07a7a0a0ce54162be6e338982adb8ae893e5eafc9e25c3a"
+checksum = "57f773d51c1696bd7d028aa35c884d9fc58f48d79a1176dfbad6c908de314235"
 dependencies = [
  "anyhow",
- "heck 0.5.0",
+ "heck",
  "proc-macro2",
  "quote",
  "syn",
@@ -3667,9 +3588,9 @@ dependencies = [
 
 [[package]]
 name = "wiggle-macro"
-version = "39.0.0"
+version = "41.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c251c6a9c6022d22777d71a938d6970e45f59665ffdd1cce3bebfe77e23f9f3"
+checksum = "0e976fe0cecd60041f66b15ad45ebc997952af13da9bf9d90261c7b025057edc"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3710,9 +3631,9 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "winch-codegen"
-version = "39.0.0"
+version = "41.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae842e40a6f06efc8882a3c175f6331dceb0d6275d48072944e1bb3ee93177a7"
+checksum = "a4f31dcfdfaf9d6df9e1124d7c8ee6fc29af5b99b89d11ae731c138e0f5bd77b"
 dependencies = [
  "anyhow",
  "cranelift-assembler-x64",
@@ -3721,8 +3642,8 @@ dependencies = [
  "regalloc2",
  "smallvec",
  "target-lexicon",
- "thiserror 2.0.17",
- "wasmparser 0.240.0 (registry+https://github.com/rust-lang/crates.io-index)",
+ "thiserror 2.0.18",
+ "wasmparser 0.243.0",
  "wasmtime-environ",
  "wasmtime-internal-cranelift",
  "wasmtime-internal-math",
@@ -3954,9 +3875,9 @@ checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
 
 [[package]]
 name = "winnow"
-version = "0.7.13"
+version = "0.7.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21a0236b59786fed61e2a80582dd500fe61f18b5dca67a4a067d0bc9039339cf"
+checksum = "5a5364e9d77fcdeeaa6062ced926ee3381faa2ee02d3eb83a5c27a8825540829"
 dependencies = [
  "memchr",
 ]
@@ -3973,61 +3894,51 @@ dependencies = [
 
 [[package]]
 name = "wit-bindgen"
-version = "0.40.0"
+version = "0.51.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e7091ed6c9abfa4e0a2ef3b39d0539da992d841fcf32c255f64fb98764ffee5"
-dependencies = [
- "wit-bindgen-rt",
- "wit-bindgen-rust-macro",
-]
+checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
 
 [[package]]
 name = "wit-bindgen"
-version = "0.46.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f17a85883d4e6d00e8a97c586de764dabcc06133f7f1d55dce5cdc070ad7fe59"
-
-[[package]]
-name = "wit-bindgen-core"
-version = "0.40.0"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "398c650cec1278cfb72e214ba26ef3440ab726e66401bd39c04f465ee3979e6b"
+checksum = "4e048f41ef90f0b5dd61f1059c35f5636252e56813bf616d0803aa3739867230"
 dependencies = [
- "anyhow",
- "heck 0.5.0",
- "wit-parser 0.227.1",
+ "wit-bindgen-rust-macro",
 ]
 
 [[package]]
-name = "wit-bindgen-rt"
-version = "0.40.0"
+name = "wit-bindgen-core"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68faed92ae696b93ea9a7b67ba6c37bf09d72c6d9a70fa824a743c3020212f11"
+checksum = "c15e7a56641cc9040480a26526a3229cbc4e8065adf98c9755d21c4c9b446c4c"
 dependencies = [
- "bitflags",
+ "anyhow",
+ "heck",
+ "wit-parser 0.244.0",
 ]
 
 [[package]]
 name = "wit-bindgen-rust"
-version = "0.40.0"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83903c8dcd8084a8a67ae08190122cf0e25dc37bdc239070a00f47e22d3f0aae"
+checksum = "bd81b0ae1ec492bfe91683f1da6db6492ebc682e72d4f2715619dba783b066ca"
 dependencies = [
  "anyhow",
- "heck 0.5.0",
+ "heck",
  "indexmap",
  "prettyplease",
  "syn",
- "wasm-metadata 0.227.1",
+ "wasm-metadata",
  "wit-bindgen-core",
- "wit-component 0.227.1",
+ "wit-component",
 ]
 
 [[package]]
 name = "wit-bindgen-rust-macro"
-version = "0.40.0"
+version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7bf7f20495bcc7dc9f24c5fbcac9e919ca5ebdb7a1b1841d74447d3c8dd0c60"
+checksum = "54e6ce04c549e7149b66a70d34fc5a2a01b374bf49ca61db65d16e3ae922866e"
 dependencies = [
  "anyhow",
  "prettyplease",
@@ -4040,27 +3951,9 @@ dependencies = [
 
 [[package]]
 name = "wit-component"
-version = "0.227.1"
+version = "0.244.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "635c3adc595422cbf2341a17fb73a319669cc8d33deed3a48368a841df86b676"
-dependencies = [
- "anyhow",
- "bitflags",
- "indexmap",
- "log",
- "serde",
- "serde_derive",
- "serde_json",
- "wasm-encoder 0.227.1",
- "wasm-metadata 0.227.1",
- "wasmparser 0.227.1",
- "wit-parser 0.227.1",
-]
-
-[[package]]
-name = "wit-component"
-version = "0.240.0"
-source = "git+https://github.com/bytecodealliance/wasm-tools?rev=e2bb0a24#e2bb0a249b038c54e404394f60411f4e8aa914c4"
+checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
 dependencies = [
  "anyhow",
  "bitflags",
@@ -4069,21 +3962,22 @@ dependencies = [
  "serde",
  "serde_derive",
  "serde_json",
- "wasm-encoder 0.240.0 (git+https://github.com/bytecodealliance/wasm-tools?rev=e2bb0a24)",
- "wasm-metadata 0.240.0 (git+https://github.com/bytecodealliance/wasm-tools?rev=e2bb0a24)",
- "wasmparser 0.240.0 (git+https://github.com/bytecodealliance/wasm-tools?rev=e2bb0a24)",
- "wit-parser 0.240.0 (git+https://github.com/bytecodealliance/wasm-tools?rev=e2bb0a24)",
+ "wasm-encoder 0.244.0",
+ "wasm-metadata",
+ "wasmparser 0.244.0",
+ "wit-parser 0.244.0",
 ]
 
 [[package]]
 name = "wit-dylib"
-version = "0.240.0"
-source = "git+https://github.com/bytecodealliance/wasm-tools?rev=e2bb0a24#e2bb0a249b038c54e404394f60411f4e8aa914c4"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf3ed23ad7d72a88d566eaaae4d2b6bc2c3b86a6af92d0b0d6a5511ca6e9b6c9"
 dependencies = [
  "anyhow",
  "indexmap",
- "wasm-encoder 0.240.0 (git+https://github.com/bytecodealliance/wasm-tools?rev=e2bb0a24)",
- "wit-parser 0.240.0 (git+https://github.com/bytecodealliance/wasm-tools?rev=e2bb0a24)",
+ "wasm-encoder 0.244.0",
+ "wit-parser 0.244.0",
 ]
 
 [[package]]
@@ -4093,9 +3987,9 @@ source = "git+https://github.com/dicej/wasm-tools?rev=b072b0ca#b072b0caa83077795
 
 [[package]]
 name = "wit-parser"
-version = "0.227.1"
+version = "0.243.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddf445ed5157046e4baf56f9138c124a0824d4d1657e7204d71886ad8ce2fc11"
+checksum = "df983a8608e513d8997f435bb74207bf0933d0e49ca97aa9d8a6157164b9b7fc"
 dependencies = [
  "anyhow",
  "id-arena",
@@ -4106,31 +4000,14 @@ dependencies = [
  "serde_derive",
  "serde_json",
  "unicode-xid",
- "wasmparser 0.227.1",
+ "wasmparser 0.243.0",
 ]
 
 [[package]]
 name = "wit-parser"
-version = "0.240.0"
+version = "0.244.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9875ea3fa272f57cc1fc50f225a7b94021a7878c484b33792bccad0d93223439"
-dependencies = [
- "anyhow",
- "id-arena",
- "indexmap",
- "log",
- "semver",
- "serde",
- "serde_derive",
- "serde_json",
- "unicode-xid",
- "wasmparser 0.240.0 (registry+https://github.com/rust-lang/crates.io-index)",
-]
-
-[[package]]
-name = "wit-parser"
-version = "0.240.0"
-source = "git+https://github.com/bytecodealliance/wasm-tools?rev=e2bb0a24#e2bb0a249b038c54e404394f60411f4e8aa914c4"
+checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
 dependencies = [
  "anyhow",
  "id-arena",
@@ -4141,7 +4018,7 @@ dependencies = [
  "serde_derive",
  "serde_json",
  "unicode-xid",
- "wasmparser 0.240.0 (git+https://github.com/bytecodealliance/wasm-tools?rev=e2bb0a24)",
+ "wasmparser 0.244.0",
 ]
 
 [[package]]
@@ -4169,7 +4046,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32e45ad4206f6d2479085147f02bc2ef834ac85886624a23575ae137c8aa8156"
 dependencies = [
  "libc",
- "rustix 1.1.2",
+ "rustix 1.1.3",
 ]
 
 [[package]]
@@ -4197,18 +4074,18 @@ dependencies = [
 
 [[package]]
 name = "zerocopy"
-version = "0.8.27"
+version = "0.8.39"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0894878a5fa3edfd6da3f88c4805f4c8558e2b996227a3d864f47fe11e38282c"
+checksum = "db6d35d663eadb6c932438e763b262fe1a70987f9ae936e60158176d710cae4a"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.27"
+version = "0.8.39"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88d2b8d9c68ad2b9e4340d7832716a4d21a22a1154777ad56ea55c51a9cf3831"
+checksum = "4122cd3169e94605190e77839c9a40d40ed048d305bfdc146e7df40ab0f3e517"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4275,6 +4152,12 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "zmij"
+version = "1.0.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ff05f8caa9038894637571ae6b9e29466c1f4f829d26c9b28f869a29cbe3445"
+
 [[package]]
 name = "zstd"
 version = "0.13.3"
diff --git a/Cargo.toml b/Cargo.toml
index 78a141a..1a8745e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "componentize-py"
-version = "0.19.3"
+version = "0.20.0"
 edition = "2024"
 exclude = ["cpython"]
 
@@ -14,18 +14,11 @@ clap = { version = "4.5.20", features = ["derive"] }
 tar = "0.4.42"
 tempfile = "3.13.0"
 zstd = "0.13.2"
-# TODO: switch to wasm-tools release once
-# https://github.com/bytecodealliance/wasm-tools/pull/2367,
-# https://github.com/bytecodealliance/wasm-tools/pull/2371, and
-# https://github.com/bytecodealliance/wasm-tools/pull/2375 have been released,
-# but note that https://github.com/bytecodealliance/wasm-tools/pull/2376 broke
-# ABI compatibilty, so we'll also need to upgrade to Wasmtime 40+ to get
-# everything aligned.
-wasm-encoder = { git = "https://github.com/bytecodealliance/wasm-tools", rev = "e2bb0a24", features = ["wasmparser"] }
-wit-dylib = { git = "https://github.com/bytecodealliance/wasm-tools", rev = "e2bb0a24" }
-wit-parser = { git = "https://github.com/bytecodealliance/wasm-tools", rev = "e2bb0a24" }
-wit-component = { git = "https://github.com/bytecodealliance/wasm-tools", rev = "e2bb0a24" }
-wasmparser = { git = "https://github.com/bytecodealliance/wasm-tools", rev = "e2bb0a24" }
+wasm-encoder = { version = "0.244.0", features = ["wasmparser"] }
+wit-dylib = "0.244.0"
+wit-parser = "0.244.0"
+wit-component = "0.244.0"
+wasmparser = "0.244.0"
 indexmap = "2.6.0"
 bincode = "1.3.3"
 heck = "0.5.0"
@@ -33,10 +26,10 @@ pyo3 = { version = "0.26.0", features = [
     "abi3-py39",
     "extension-module",
 ], optional = true }
-wasmtime = "39.0.0"
-wasmtime-wasi = { version = "39.0.0", features = [ "p3" ] }
+wasmtime = "41.0.3"
+wasmtime-wasi = { version = "41.0.3", features = [ "p3" ] }
 once_cell = "1.20.2"
-component-init-transform = { git = "https://github.com/dicej/component-init", rev = "2d965957" }
+component-init-transform = { git = "https://github.com/dicej/component-init", rev = "1de5906c" }
 async-trait = "0.1.83"
 futures = "0.3.31"
 tokio = { version = "1.41.0", features = [
diff --git a/examples/cli/README.md b/examples/cli/README.md
index 5a1e4df..9925154 100644
--- a/examples/cli/README.md
+++ b/examples/cli/README.md
@@ -10,7 +10,7 @@ run a Python-based component targetting the [wasi-cli] `command` world.
 ## Prerequisites
 
 * `Wasmtime` 38.0.0 or later
-* `componentize-py` 0.19.3
+* `componentize-py` 0.20.0
 
 Below, we use [Rust](https://rustup.rs/)'s `cargo` to install `Wasmtime`.  If
 you don't have `cargo`, you can download and install from
@@ -18,7 +18,7 @@ https://github.com/bytecodealliance/wasmtime/releases/tag/v38.0.0.
 
 ```
 cargo install --version 38.0.0 wasmtime-cli
-pip install componentize-py==0.19.3
+pip install componentize-py==0.20.0
 ```
 
 ## Running the demo
diff --git a/examples/http-p3/README.md b/examples/http-p3/README.md
index 75d058e..9fc9d56 100644
--- a/examples/http-p3/README.md
+++ b/examples/http-p3/README.md
@@ -1,8 +1,8 @@
 # Example: `http-p3`
 
 This is an example of how to use [componentize-py] and [Wasmtime] to build and
-run a Python-based component targetting version `0.3.0-rc-2025-09-16` of the
-[wasi-http] `proxy` world.
+run a Python-based component targetting version `0.3.0-rc-2026-01-06` of the
+[wasi-http] `service` world.
 
 [componentize-py]: https://github.com/bytecodealliance/componentize-py
 [Wasmtime]: https://github.com/bytecodealliance/wasmtime
@@ -10,16 +10,16 @@ run a Python-based component targetting version `0.3.0-rc-2025-09-16` of the
 
 ## Prerequisites
 
-* `Wasmtime` 39.0.1
-* `componentize-py` 0.19.3
+* `Wasmtime` 41.0.3
+* `componentize-py` 0.20.0
 
 Below, we use [Rust](https://rustup.rs/)'s `cargo` to install `Wasmtime`.  If
 you don't have `cargo`, you can download and install from
-https://github.com/bytecodealliance/wasmtime/releases/tag/v39.0.1.
+https://github.com/bytecodealliance/wasmtime/releases/tag/v41.0.3.
 
 ```
-cargo install --version 39.0.1 wasmtime-cli
-pip install componentize-py==0.19.3
+cargo install --version 41.0.3 wasmtime-cli
+pip install componentize-py==0.20.0
 ```
 
 ## Running the demo
@@ -27,7 +27,7 @@ pip install componentize-py==0.19.3
 First, build the app and run it:
 
 ```
-componentize-py -d ../../wit -w wasi:http/proxy@0.3.0-rc-2025-09-16 componentize app -o http.wasm
+componentize-py -d ../../wit -w wasi:http/service@0.3.0-rc-2026-01-06 componentize app -o http.wasm
 wasmtime serve -Sp3,common -Wcomponent-model-async http.wasm
 ```
 
diff --git a/examples/http-p3/app.py b/examples/http-p3/app.py
index 0e2b267..d65fdc0 100644
--- a/examples/http-p3/app.py
+++ b/examples/http-p3/app.py
@@ -15,7 +15,7 @@
 from componentize_py_async_support.streams import ByteStreamWriter
 from componentize_py_async_support.futures import FutureReader
 from wit_world import exports
-from wit_world.imports import handler
+from wit_world.imports import client
 from wit_world.imports.wasi_http_types import (
     Method_Get,
     Method_Post,
@@ -110,7 +110,7 @@ async def sha256(url: str) -> tuple[str, str]:
     request.set_authority(url_parsed.netloc)
     request.set_path_with_query(url_parsed.path)
 
-    response = await handler.handle(request)
+    response = await client.send(request)
     status = response.get_status_code()
     if status < 200 or status > 299:
         return url, f"unexpected status: {status}"
diff --git a/examples/http/README.md b/examples/http/README.md
index 8f4a99b..3681c9e 100644
--- a/examples/http/README.md
+++ b/examples/http/README.md
@@ -10,7 +10,7 @@ run a Python-based component targetting the [wasi-http] `proxy` world.
 ## Prerequisites
 
 * `Wasmtime` 38.0.0 or later
-* `componentize-py` 0.19.3
+* `componentize-py` 0.20.0
 
 Below, we use [Rust](https://rustup.rs/)'s `cargo` to install `Wasmtime`.  If
 you don't have `cargo`, you can download and install from
@@ -18,7 +18,7 @@ https://github.com/bytecodealliance/wasmtime/releases/tag/v38.0.0.
 
 ```
 cargo install --version 38.0.0 wasmtime-cli
-pip install componentize-py==0.19.3
+pip install componentize-py==0.20.0
 ```
 
 ## Running the demo
diff --git a/examples/matrix-math/README.md b/examples/matrix-math/README.md
index 31b6bbe..9cf60dd 100644
--- a/examples/matrix-math/README.md
+++ b/examples/matrix-math/README.md
@@ -11,7 +11,7 @@ within a guest component.
 ## Prerequisites
 
 * `wasmtime` 38.0.0 or later
-* `componentize-py` 0.19.3
+* `componentize-py` 0.20.0
 * `NumPy`, built for WASI
 
 Note that we use an unofficial build of NumPy since the upstream project does
@@ -23,7 +23,7 @@ https://github.com/bytecodealliance/wasmtime/releases/tag/v38.0.0.
 
 ```
 cargo install --version 38.0.0 wasmtime-cli
-pip install componentize-py==0.19.3
+pip install componentize-py==0.20.0
 curl -OL https://github.com/dicej/wasi-wheels/releases/download/v0.0.2/numpy-wasi.tar.gz
 tar xf numpy-wasi.tar.gz
 ```
diff --git a/examples/sandbox/README.md b/examples/sandbox/README.md
index cbecd2a..6f803f1 100644
--- a/examples/sandbox/README.md
+++ b/examples/sandbox/README.md
@@ -8,10 +8,10 @@ sandboxed Python code snippets from within a Python app.
 ## Prerequisites
 
 * `wasmtime-py` 38.0.0 or later
-* `componentize-py` 0.19.3
+* `componentize-py` 0.20.0
 
 ```
-pip install componentize-py==0.19.3 wasmtime==38.0.0
+pip install componentize-py==0.20.0 wasmtime==38.0.0
 ```
 
 ## Running the demo
diff --git a/examples/tcp/README.md b/examples/tcp/README.md
index a0f6e72..5dc13c8 100644
--- a/examples/tcp/README.md
+++ b/examples/tcp/README.md
@@ -11,7 +11,7 @@ making an outbound TCP request using `wasi-sockets`.
 ## Prerequisites
 
 * `Wasmtime` 38.0.0 or later
-* `componentize-py` 0.19.3
+* `componentize-py` 0.20.0
 
 Below, we use [Rust](https://rustup.rs/)'s `cargo` to install `Wasmtime`.  If
 you don't have `cargo`, you can download and install from
@@ -19,7 +19,7 @@ https://github.com/bytecodealliance/wasmtime/releases/tag/v38.0.0.
 
 ```
 cargo install --version 38.0.0 wasmtime-cli
-pip install componentize-py==0.19.3
+pip install componentize-py==0.20.0
 ```
 
 ## Running the demo
diff --git a/pyproject.toml b/pyproject.toml
index 4ac8b6a..0a4a5e0 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -7,7 +7,7 @@ features = ["pyo3/extension-module"]
 
 [project]
 name = "componentize-py"
-version = "0.19.3"
+version = "0.20.0"
 description = "Tool to package Python applications as WebAssembly components"
 readme = "README.md"
 license = { file = "LICENSE" }
diff --git a/runtime/Cargo.toml b/runtime/Cargo.toml
index bbb31af..c6d491f 100644
--- a/runtime/Cargo.toml
+++ b/runtime/Cargo.toml
@@ -11,8 +11,7 @@ anyhow = "1.0.91"
 once_cell = "1.20.2"
 pyo3 = { version="0.26.0", features = ["abi3-py312", "num-bigint"] }
 num-bigint = "0.4.6"
-wit-bindgen = { version = "0.40.0", default-features = false, features = ["macros", "realloc"] }
-wit-bindgen-rt = { version = "0.40.0" }
+wit-bindgen = { version = "0.52.0", default-features = false, features = ["macros", "realloc"] }
 # TODO: switch to a release when available:
 wit-dylib-ffi = { git = "https://github.com/dicej/wasm-tools", rev = "b072b0ca", features = ["async-raw"] }
 
diff --git a/runtime/src/lib.rs b/runtime/src/lib.rs
index b61c8a6..de9ad47 100644
--- a/runtime/src/lib.rs
+++ b/runtime/src/lib.rs
@@ -40,10 +40,6 @@ use {
     },
 };
 
-#[expect(
-    unsafe_op_in_unsafe_fn,
-    reason = "wit_bindgen::generate produces code that does this"
-)]
 mod bindings {
     wit_bindgen::generate!({
         world: "init",
diff --git a/src/lib.rs b/src/lib.rs
index 69db874..1af8f2a 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -33,8 +33,8 @@ use {
     wit_component::metadata,
     wit_dylib::DylibOpts,
     wit_parser::{
-        CloneMaps, Package, PackageName, Resolve, Stability, TypeDefKind, UnresolvedPackageGroup,
-        World, WorldId, WorldItem, WorldKey,
+        CloneMaps, FunctionKind, Package, PackageName, Resolve, Stability, TypeDefKind,
+        UnresolvedPackageGroup, World, WorldId, WorldItem, WorldKey,
     },
     zstd::Decoder,
 };
@@ -68,12 +68,6 @@ pub struct Ctx {
     table: ResourceTable,
 }
 
-pub struct Library {
-    name: String,
-    module: Vec<u8>,
-    dl_openable: bool,
-}
-
 impl WasiView for Ctx {
     fn ctx(&mut self) -> WasiCtxView<'_> {
         WasiCtxView {
@@ -83,6 +77,12 @@ impl WasiView for Ctx {
     }
 }
 
+pub struct Library {
+    name: String,
+    module: Vec<u8>,
+    dl_openable: bool,
+}
+
 #[derive(Deserialize)]
 struct RawComponentizePyConfig {
     bindings: Option<String>,
@@ -766,7 +766,7 @@ fn add_wasi_and_stubs(
     wasmtime_wasi::p2::add_to_linker_async(linker)?;
 
     enum Stub<'a> {
-        Function(&'a String),
+        Function(&'a String, &'a FunctionKind),
         Resource(&'a String),
     }
 
@@ -781,11 +781,11 @@ fn add_wasi_and_stubs(
                     };
 
                     let interface = &resolve.interfaces[*id];
-                    for function_name in interface.functions.keys() {
+                    for (function_name, function) in &interface.functions {
                         stubs
                             .entry(Some(interface_name.clone()))
                             .or_default()
-                            .push(Stub::Function(function_name));
+                            .push(Stub::Function(function_name, &function.kind));
                     }
 
                     for (type_name, id) in interface.types.iter() {
@@ -801,7 +801,7 @@ fn add_wasi_and_stubs(
                     stubs
                         .entry(None)
                         .or_default()
-                        .push(Stub::Function(&function.name));
+                        .push(Stub::Function(&function.name, &function.kind));
                 }
                 WorldItem::Type(id) => {
                     let ty = &resolve.types[*id];
@@ -828,12 +828,31 @@ fn add_wasi_and_stubs(
                 for stub in stubs {
                     let interface_name = interface_name.clone();
                     match stub {
-                        Stub::Function(name) => instance.func_new(name, {
-                            let name = name.clone();
-                            move |_, _, _, _| {
-                                Err(anyhow!("called trapping stub: {interface_name}#{name}"))
+                        Stub::Function(name, kind) => {
+                            if kind.is_async() {
+                                instance.func_new_concurrent(name, {
+                                    let name = name.clone();
+                                    move |_, _, _, _| {
+                                        let interface_name = interface_name.clone();
+                                        let name = name.clone();
+                                        Box::pin(async move {
+                                            Err(anyhow!(
+                                                "called trapping stub: {interface_name}#{name}"
+                                            ))
+                                        })
+                                    }
+                                })
+                            } else {
+                                instance.func_new(name, {
+                                    let name = name.clone();
+                                    move |_, _, _, _| {
+                                        Err(anyhow!(
+                                            "called trapping stub: {interface_name}#{name}"
+                                        ))
+                                    }
+                                })
                             }
-                        }),
+                        }
                         Stub::Resource(name) => instance
                             .resource(name, ResourceType::host::<()>(), {
                                 let name = name.clone();
@@ -849,10 +868,24 @@ fn add_wasi_and_stubs(
             let mut instance = linker.root();
             for stub in stubs {
                 match stub {
-                    Stub::Function(name) => instance.func_new(name, {
-                        let name = name.clone();
-                        move |_, _, _, _| Err(anyhow!("called trapping stub: {name}"))
-                    }),
+                    Stub::Function(name, kind) => {
+                        if kind.is_async() {
+                            instance.func_new_concurrent(name, {
+                                let name = name.clone();
+                                move |_, _, _, _| {
+                                    let name = name.clone();
+                                    Box::pin(
+                                        async move { Err(anyhow!("called trapping stub: {name}")) },
+                                    )
+                                }
+                            })
+                        } else {
+                            instance.func_new(name, {
+                                let name = name.clone();
+                                move |_, _, _, _| Err(anyhow!("called trapping stub: {name}"))
+                            })
+                        }
+                    }
                     Stub::Resource(name) => instance
                         .resource(name, ResourceType::host::<()>(), {
                             let name = name.clone();
diff --git a/src/stubwasi.rs b/src/stubwasi.rs
index 106336b..70366f6 100644
--- a/src/stubwasi.rs
+++ b/src/stubwasi.rs
@@ -5,7 +5,7 @@ use wasm_encoder::{
     CodeSection, ExportKind, ExportSection, Function, FunctionSection, Instruction as Ins, Module,
     TypeSection,
 };
-use wasmparser::{FuncType, Parser, Payload, TypeRef};
+use wasmparser::{FuncType, Imports, Parser, Payload, TypeRef};
 
 use crate::Library;
 
@@ -81,19 +81,22 @@ fn add_wasi_imports<'a>(
 
             Payload::ImportSection(reader) => {
                 for import in reader {
-                    let import = import?;
-
-                    if import.module == "wasi_snapshot_preview1"
-                        || import.module.starts_with("wasi:")
-                    {
-                        if let TypeRef::Func(ty) = import.ty {
-                            imports
-                                .entry(import.module)
-                                .or_default()
-                                .insert(import.name, types[usize::try_from(ty).unwrap()].clone());
-                        } else {
-                            bail!("encountered non-function import from WASI namespace")
+                    match import? {
+                        Imports::Single(_, import) => {
+                            if import.module == "wasi_snapshot_preview1"
+                                || import.module.starts_with("wasi:")
+                            {
+                                if let TypeRef::Func(ty) = import.ty {
+                                    imports.entry(import.module).or_default().insert(
+                                        import.name,
+                                        types[usize::try_from(ty).unwrap()].clone(),
+                                    );
+                                } else {
+                                    bail!("encountered non-function import from WASI namespace")
+                                }
+                            }
                         }
+                        Imports::Compact1 { .. } | Imports::Compact2 { .. } => todo!(),
                     }
                 }
                 break;
diff --git a/src/summary.rs b/src/summary.rs
index 62755f4..8b0576f 100644
--- a/src/summary.rs
+++ b/src/summary.rs
@@ -864,13 +864,9 @@ impl<'a> Summary<'a> {
     ) -> String {
         match kind {
             wit_parser::FunctionKind::Freestanding => name.to_snake_case().escape(),
-            wit_parser::FunctionKind::AsyncFreestanding => format!(
-                "{async_start_prefix}{}",
-                name.strip_prefix("[async]")
-                    .unwrap()
-                    .to_snake_case()
-                    .escape()
-            ),
+            wit_parser::FunctionKind::AsyncFreestanding => {
+                format!("{async_start_prefix}{}", name.to_snake_case().escape())
+            }
             wit_parser::FunctionKind::Constructor(_) => "__init__".into(),
             wit_parser::FunctionKind::Method(id) => name
                 .strip_prefix(&format!(
@@ -883,7 +879,7 @@ impl<'a> Summary<'a> {
             wit_parser::FunctionKind::AsyncMethod(id) => format!(
                 "{async_start_prefix}{}",
                 name.strip_prefix(&format!(
-                    "[async method]{}.",
+                    "[method]{}.",
                     self.resolve.types[*id].name.as_deref().unwrap()
                 ))
                 .unwrap()
@@ -901,7 +897,7 @@ impl<'a> Summary<'a> {
             wit_parser::FunctionKind::AsyncStatic(id) => format!(
                 "{async_start_prefix}{}",
                 name.strip_prefix(&format!(
-                    "[async static]{}.",
+                    "[static]{}.",
                     self.resolve.types[*id].name.as_deref().unwrap()
                 ))
                 .unwrap()
diff --git a/src/test/tests.rs b/src/test/tests.rs
index 93cf2c6..c7665fa 100644
--- a/src/test/tests.rs
+++ b/src/test/tests.rs
@@ -1270,7 +1270,7 @@ fn test_short_reads(delay: bool) -> Result<()> {
                 .await??;
 
             for it in received_things {
-                it.resource_drop_async::<()>(&mut store).await?;
+                it.resource_drop_async(&mut store).await?;
             }
 
             anyhow::Ok(())
@@ -1416,7 +1416,7 @@ fn test_dropped_future_reader(delay: bool) -> Result<()> {
                 })
                 .await??;
 
-            it.resource_drop_async::<()>(&mut store).await?;
+            it.resource_drop_async(&mut store).await?;
 
             anyhow::Ok(())
         })?;
diff --git a/tests/bindings.rs b/tests/bindings.rs
index ead51be..2b583d8 100644
--- a/tests/bindings.rs
+++ b/tests/bindings.rs
@@ -70,7 +70,7 @@ fn lint_http_p3_bindings() -> anyhow::Result<()> {
     )?;
     let path = dir.path().join("http-p3");
 
-    generate_bindings(&path, "wasi:http/proxy@0.3.0-rc-2025-09-16")?;
+    generate_bindings(&path, "wasi:http/service@0.3.0-rc-2026-01-06")?;
 
     assert!(predicate::path::is_dir().eval(&path.join("wit_world")));
 
diff --git a/tests/componentize.rs b/tests/componentize.rs
index 66d03b7..e1fa63c 100644
--- a/tests/componentize.rs
+++ b/tests/componentize.rs
@@ -55,7 +55,7 @@ fn http_example() -> anyhow::Result<()> {
 
 #[test]
 fn http_p3_example() -> anyhow::Result<()> {
-    test_http_example("http-p3", "wasi:http/proxy@0.3.0-rc-2025-09-16", 8081)
+    test_http_example("http-p3", "wasi:http/service@0.3.0-rc-2026-01-06", 8081)
 }
 
 fn test_http_example(name: &str, world: &str, port: u16) -> anyhow::Result<()> {
diff --git a/wit/deps/cli-0.3.0-rc-2025-09-16/command.wit b/wit/deps/cli-0.3.0-rc-2025-09-16/command.wit
deleted file mode 100644
index f2f613e..0000000
--- a/wit/deps/cli-0.3.0-rc-2025-09-16/command.wit
+++ /dev/null
@@ -1,10 +0,0 @@
-package wasi:cli@0.3.0-rc-2025-09-16;
-
-@since(version = 0.3.0-rc-2025-09-16)
-world command {
-  @since(version = 0.3.0-rc-2025-09-16)
-  include imports;
-
-  @since(version = 0.3.0-rc-2025-09-16)
-  export run;
-}
diff --git a/wit/deps/cli-0.3.0-rc-2025-09-16/environment.wit b/wit/deps/cli-0.3.0-rc-2025-09-16/environment.wit
deleted file mode 100644
index 3763f2f..0000000
--- a/wit/deps/cli-0.3.0-rc-2025-09-16/environment.wit
+++ /dev/null
@@ -1,22 +0,0 @@
-@since(version = 0.3.0-rc-2025-09-16)
-interface environment {
-  /// Get the POSIX-style environment variables.
-  ///
-  /// Each environment variable is provided as a pair of string variable names
-  /// and string value.
-  ///
-  /// Morally, these are a value import, but until value imports are available
-  /// in the component model, this import function should return the same
-  /// values each time it is called.
-  @since(version = 0.3.0-rc-2025-09-16)
-  get-environment: func() -> list<tuple<string, string>>;
-
-  /// Get the POSIX-style arguments to the program.
-  @since(version = 0.3.0-rc-2025-09-16)
-  get-arguments: func() -> list<string>;
-
-  /// Return a path that programs should use as their initial current working
-  /// directory, interpreting `.` as shorthand for this.
-  @since(version = 0.3.0-rc-2025-09-16)
-  get-initial-cwd: func() -> option<string>;
-}
diff --git a/wit/deps/cli-0.3.0-rc-2025-09-16/exit.wit b/wit/deps/cli-0.3.0-rc-2025-09-16/exit.wit
deleted file mode 100644
index 1efba7d..0000000
--- a/wit/deps/cli-0.3.0-rc-2025-09-16/exit.wit
+++ /dev/null
@@ -1,17 +0,0 @@
-@since(version = 0.3.0-rc-2025-09-16)
-interface exit {
-  /// Exit the current instance and any linked instances.
-  @since(version = 0.3.0-rc-2025-09-16)
-  exit: func(status: result);
-
-  /// Exit the current instance and any linked instances, reporting the
-  /// specified status code to the host.
-  ///
-  /// The meaning of the code depends on the context, with 0 usually meaning
-  /// "success", and other values indicating various types of failure.
-  ///
-  /// This function does not return; the effect is analogous to a trap, but
-  /// without the connotation that something bad has happened.
-  @unstable(feature = cli-exit-with-code)
-  exit-with-code: func(status-code: u8);
-}
diff --git a/wit/deps/cli-0.3.0-rc-2025-09-16/imports.wit b/wit/deps/cli-0.3.0-rc-2025-09-16/imports.wit
deleted file mode 100644
index 660a2dd..0000000
--- a/wit/deps/cli-0.3.0-rc-2025-09-16/imports.wit
+++ /dev/null
@@ -1,34 +0,0 @@
-package wasi:cli@0.3.0-rc-2025-09-16;
-
-@since(version = 0.3.0-rc-2025-09-16)
-world imports {
-  @since(version = 0.3.0-rc-2025-09-16)
-  include wasi:clocks/imports@0.3.0-rc-2025-09-16;
-  @since(version = 0.3.0-rc-2025-09-16)
-  include wasi:filesystem/imports@0.3.0-rc-2025-09-16;
-  @since(version = 0.3.0-rc-2025-09-16)
-  include wasi:sockets/imports@0.3.0-rc-2025-09-16;
-  @since(version = 0.3.0-rc-2025-09-16)
-  include wasi:random/imports@0.3.0-rc-2025-09-16;
-
-  @since(version = 0.3.0-rc-2025-09-16)
-  import environment;
-  @since(version = 0.3.0-rc-2025-09-16)
-  import exit;
-  @since(version = 0.3.0-rc-2025-09-16)
-  import stdin;
-  @since(version = 0.3.0-rc-2025-09-16)
-  import stdout;
-  @since(version = 0.3.0-rc-2025-09-16)
-  import stderr;
-  @since(version = 0.3.0-rc-2025-09-16)
-  import terminal-input;
-  @since(version = 0.3.0-rc-2025-09-16)
-  import terminal-output;
-  @since(version = 0.3.0-rc-2025-09-16)
-  import terminal-stdin;
-  @since(version = 0.3.0-rc-2025-09-16)
-  import terminal-stdout;
-  @since(version = 0.3.0-rc-2025-09-16)
-  import terminal-stderr;
-}
diff --git a/wit/deps/cli-0.3.0-rc-2025-09-16/run.wit b/wit/deps/cli-0.3.0-rc-2025-09-16/run.wit
deleted file mode 100644
index 631441a..0000000
--- a/wit/deps/cli-0.3.0-rc-2025-09-16/run.wit
+++ /dev/null
@@ -1,6 +0,0 @@
-@since(version = 0.3.0-rc-2025-09-16)
-interface run {
-  /// Run the program.
-  @since(version = 0.3.0-rc-2025-09-16)
-  run: async func() -> result;
-}
diff --git a/wit/deps/cli-0.3.0-rc-2025-09-16/stdio.wit b/wit/deps/cli-0.3.0-rc-2025-09-16/stdio.wit
deleted file mode 100644
index 51e5ae4..0000000
--- a/wit/deps/cli-0.3.0-rc-2025-09-16/stdio.wit
+++ /dev/null
@@ -1,65 +0,0 @@
-@since(version = 0.3.0-rc-2025-09-16)
-interface types {
-  @since(version = 0.3.0-rc-2025-09-16)
-  enum error-code {
-    /// Input/output error
-    io,
-    /// Invalid or incomplete multibyte or wide character
-    illegal-byte-sequence,
-    /// Broken pipe
-    pipe,
-  }
-}
-
-@since(version = 0.3.0-rc-2025-09-16)
-interface stdin {
-  use types.{error-code};
-
-  /// Return a stream for reading from stdin.
-  ///
-  /// This function returns a stream which provides data read from stdin,
-  /// and a future to signal read results.
-  ///
-  /// If the stream's readable end is dropped the future will resolve to success.
-  ///
-  /// If the stream's writable end is dropped the future will either resolve to
-  /// success if stdin was closed by the writer or to an error-code if reading
-  /// failed for some other reason.
-  ///
-  /// Multiple streams may be active at the same time. The behavior of concurrent
-  /// reads is implementation-specific.
-  @since(version = 0.3.0-rc-2025-09-16)
-  read-via-stream: func() -> tuple<stream<u8>, future<result<_, error-code>>>;
-}
-
-@since(version = 0.3.0-rc-2025-09-16)
-interface stdout {
-  use types.{error-code};
-
-  /// Write the given stream to stdout.
-  ///
-  /// If the stream's writable end is dropped this function will either return
-  /// success once the entire contents of the stream have been written or an
-  /// error-code representing a failure.
-  ///
-  /// Otherwise if there is an error the readable end of the stream will be
-  /// dropped and this function will return an error-code.
-  @since(version = 0.3.0-rc-2025-09-16)
-  write-via-stream: async func(data: stream<u8>) -> result<_, error-code>;
-}
-
-@since(version = 0.3.0-rc-2025-09-16)
-interface stderr {
-  use types.{error-code};
-
-  /// Write the given stream to stderr.
-  ///
-  /// If the stream's writable end is dropped this function will either return
-  /// success once the entire contents of the stream have been written or an
-  /// error-code representing a failure.
-  ///
-  /// Otherwise if there is an error the readable end of the stream will be
-  /// dropped and this function will return an error-code.
-  @since(version = 0.3.0-rc-2025-09-16)
-  write-via-stream: async func(data: stream<u8>) -> result<_, error-code>;
-}
diff --git a/wit/deps/cli-0.3.0-rc-2025-09-16/terminal.wit b/wit/deps/cli-0.3.0-rc-2025-09-16/terminal.wit
deleted file mode 100644
index 74c1769..0000000
--- a/wit/deps/cli-0.3.0-rc-2025-09-16/terminal.wit
+++ /dev/null
@@ -1,62 +0,0 @@
-/// Terminal input.
-///
-/// In the future, this may include functions for disabling echoing,
-/// disabling input buffering so that keyboard events are sent through
-/// immediately, querying supported features, and so on.
-@since(version = 0.3.0-rc-2025-09-16)
-interface terminal-input {
-    /// The input side of a terminal.
-    @since(version = 0.3.0-rc-2025-09-16)
-    resource terminal-input;
-}
-
-/// Terminal output.
-///
-/// In the future, this may include functions for querying the terminal
-/// size, being notified of terminal size changes, querying supported
-/// features, and so on.
-@since(version = 0.3.0-rc-2025-09-16)
-interface terminal-output {
-    /// The output side of a terminal.
-    @since(version = 0.3.0-rc-2025-09-16)
-    resource terminal-output;
-}
-
-/// An interface providing an optional `terminal-input` for stdin as a
-/// link-time authority.
-@since(version = 0.3.0-rc-2025-09-16)
-interface terminal-stdin {
-    @since(version = 0.3.0-rc-2025-09-16)
-    use terminal-input.{terminal-input};
-
-    /// If stdin is connected to a terminal, return a `terminal-input` handle
-    /// allowing further interaction with it.
-    @since(version = 0.3.0-rc-2025-09-16)
-    get-terminal-stdin: func() -> option<terminal-input>;
-}
-
-/// An interface providing an optional `terminal-output` for stdout as a
-/// link-time authority.
-@since(version = 0.3.0-rc-2025-09-16)
-interface terminal-stdout {
-    @since(version = 0.3.0-rc-2025-09-16)
-    use terminal-output.{terminal-output};
-
-    /// If stdout is connected to a terminal, return a `terminal-output` handle
-    /// allowing further interaction with it.
-    @since(version = 0.3.0-rc-2025-09-16)
-    get-terminal-stdout: func() -> option<terminal-output>;
-}
-
-/// An interface providing an optional `terminal-output` for stderr as a
-/// link-time authority.
-@since(version = 0.3.0-rc-2025-09-16)
-interface terminal-stderr {
-    @since(version = 0.3.0-rc-2025-09-16)
-    use terminal-output.{terminal-output};
-
-    /// If stderr is connected to a terminal, return a `terminal-output` handle
-    /// allowing further interaction with it.
-    @since(version = 0.3.0-rc-2025-09-16)
-    get-terminal-stderr: func() -> option<terminal-output>;
-}
diff --git a/wit/deps/cli-0.3.0-rc-2026-01-06.wit b/wit/deps/cli-0.3.0-rc-2026-01-06.wit
new file mode 100644
index 0000000..0f987bf
--- /dev/null
+++ b/wit/deps/cli-0.3.0-rc-2026-01-06.wit
@@ -0,0 +1,256 @@
+package wasi:cli@0.3.0-rc-2026-01-06;
+
+@since(version = 0.3.0-rc-2026-01-06)
+interface environment {
+  /// Get the POSIX-style environment variables.
+  ///
+  /// Each environment variable is provided as a pair of string variable names
+  /// and string value.
+  ///
+  /// Morally, these are a value import, but until value imports are available
+  /// in the component model, this import function should return the same
+  /// values each time it is called.
+  @since(version = 0.3.0-rc-2026-01-06)
+  get-environment: func() -> list<tuple<string, string>>;
+
+  /// Get the POSIX-style arguments to the program.
+  @since(version = 0.3.0-rc-2026-01-06)
+  get-arguments: func() -> list<string>;
+
+  /// Return a path that programs should use as their initial current working
+  /// directory, interpreting `.` as shorthand for this.
+  @since(version = 0.3.0-rc-2026-01-06)
+  get-initial-cwd: func() -> option<string>;
+}
+
+@since(version = 0.3.0-rc-2026-01-06)
+interface exit {
+  /// Exit the current instance and any linked instances.
+  @since(version = 0.3.0-rc-2026-01-06)
+  exit: func(status: result);
+
+  /// Exit the current instance and any linked instances, reporting the
+  /// specified status code to the host.
+  ///
+  /// The meaning of the code depends on the context, with 0 usually meaning
+  /// "success", and other values indicating various types of failure.
+  ///
+  /// This function does not return; the effect is analogous to a trap, but
+  /// without the connotation that something bad has happened.
+  @unstable(feature = cli-exit-with-code)
+  exit-with-code: func(status-code: u8);
+}
+
+@since(version = 0.3.0-rc-2026-01-06)
+interface run {
+  /// Run the program.
+  @since(version = 0.3.0-rc-2026-01-06)
+  run: async func() -> result;
+}
+
+@since(version = 0.3.0-rc-2026-01-06)
+interface types {
+  @since(version = 0.3.0-rc-2026-01-06)
+  enum error-code {
+    /// Input/output error
+    io,
+    /// Invalid or incomplete multibyte or wide character
+    illegal-byte-sequence,
+    /// Broken pipe
+    pipe,
+  }
+}
+
+@since(version = 0.3.0-rc-2026-01-06)
+interface stdin {
+  use types.{error-code};
+
+  /// Return a stream for reading from stdin.
+  ///
+  /// This function returns a stream which provides data read from stdin,
+  /// and a future to signal read results.
+  ///
+  /// If the stream's readable end is dropped the future will resolve to success.
+  ///
+  /// If the stream's writable end is dropped the future will either resolve to
+  /// success if stdin was closed by the writer or to an error-code if reading
+  /// failed for some other reason.
+  ///
+  /// Multiple streams may be active at the same time. The behavior of concurrent
+  /// reads is implementation-specific.
+  @since(version = 0.3.0-rc-2026-01-06)
+  read-via-stream: func() -> tuple<stream<u8>, future<result<_, error-code>>>;
+}
+
+@since(version = 0.3.0-rc-2026-01-06)
+interface stdout {
+  use types.{error-code};
+
+  /// Write the given stream to stdout.
+  ///
+  /// If the stream's writable end is dropped this function will either return
+  /// success once the entire contents of the stream have been written or an
+  /// error-code representing a failure.
+  ///
+  /// Otherwise if there is an error the readable end of the stream will be
+  /// dropped and this function will return an error-code.
+  @since(version = 0.3.0-rc-2026-01-06)
+  write-via-stream: async func(data: stream<u8>) -> result<_, error-code>;
+}
+
+@since(version = 0.3.0-rc-2026-01-06)
+interface stderr {
+  use types.{error-code};
+
+  /// Write the given stream to stderr.
+  ///
+  /// If the stream's writable end is dropped this function will either return
+  /// success once the entire contents of the stream have been written or an
+  /// error-code representing a failure.
+  ///
+  /// Otherwise if there is an error the readable end of the stream will be
+  /// dropped and this function will return an error-code.
+  @since(version = 0.3.0-rc-2026-01-06)
+  write-via-stream: async func(data: stream<u8>) -> result<_, error-code>;
+}
+
+/// Terminal input.
+///
+/// In the future, this may include functions for disabling echoing,
+/// disabling input buffering so that keyboard events are sent through
+/// immediately, querying supported features, and so on.
+@since(version = 0.3.0-rc-2026-01-06)
+interface terminal-input {
+  /// The input side of a terminal.
+  @since(version = 0.3.0-rc-2026-01-06)
+  resource terminal-input;
+}
+
+/// Terminal output.
+///
+/// In the future, this may include functions for querying the terminal
+/// size, being notified of terminal size changes, querying supported
+/// features, and so on.
+@since(version = 0.3.0-rc-2026-01-06)
+interface terminal-output {
+  /// The output side of a terminal.
+  @since(version = 0.3.0-rc-2026-01-06)
+  resource terminal-output;
+}
+
+/// An interface providing an optional `terminal-input` for stdin as a
+/// link-time authority.
+@since(version = 0.3.0-rc-2026-01-06)
+interface terminal-stdin {
+  @since(version = 0.3.0-rc-2026-01-06)
+  use terminal-input.{terminal-input};
+
+  /// If stdin is connected to a terminal, return a `terminal-input` handle
+  /// allowing further interaction with it.
+  @since(version = 0.3.0-rc-2026-01-06)
+  get-terminal-stdin: func() -> option<terminal-input>;
+}
+
+/// An interface providing an optional `terminal-output` for stdout as a
+/// link-time authority.
+@since(version = 0.3.0-rc-2026-01-06)
+interface terminal-stdout {
+  @since(version = 0.3.0-rc-2026-01-06)
+  use terminal-output.{terminal-output};
+
+  /// If stdout is connected to a terminal, return a `terminal-output` handle
+  /// allowing further interaction with it.
+  @since(version = 0.3.0-rc-2026-01-06)
+  get-terminal-stdout: func() -> option<terminal-output>;
+}
+
+/// An interface providing an optional `terminal-output` for stderr as a
+/// link-time authority.
+@since(version = 0.3.0-rc-2026-01-06)
+interface terminal-stderr {
+  @since(version = 0.3.0-rc-2026-01-06)
+  use terminal-output.{terminal-output};
+
+  /// If stderr is connected to a terminal, return a `terminal-output` handle
+  /// allowing further interaction with it.
+  @since(version = 0.3.0-rc-2026-01-06)
+  get-terminal-stderr: func() -> option<terminal-output>;
+}
+
+@since(version = 0.3.0-rc-2026-01-06)
+world imports {
+  @since(version = 0.3.0-rc-2026-01-06)
+  import environment;
+  @since(version = 0.3.0-rc-2026-01-06)
+  import exit;
+  @since(version = 0.3.0-rc-2026-01-06)
+  import types;
+  @since(version = 0.3.0-rc-2026-01-06)
+  import stdin;
+  @since(version = 0.3.0-rc-2026-01-06)
+  import stdout;
+  @since(version = 0.3.0-rc-2026-01-06)
+  import stderr;
+  @since(version = 0.3.0-rc-2026-01-06)
+  import terminal-input;
+  @since(version = 0.3.0-rc-2026-01-06)
+  import terminal-output;
+  @since(version = 0.3.0-rc-2026-01-06)
+  import terminal-stdin;
+  @since(version = 0.3.0-rc-2026-01-06)
+  import terminal-stdout;
+  @since(version = 0.3.0-rc-2026-01-06)
+  import terminal-stderr;
+  import wasi:clocks/types@0.3.0-rc-2026-01-06;
+  import wasi:clocks/monotonic-clock@0.3.0-rc-2026-01-06;
+  import wasi:clocks/system-clock@0.3.0-rc-2026-01-06;
+  @unstable(feature = clocks-timezone)
+  import wasi:clocks/timezone@0.3.0-rc-2026-01-06;
+  import wasi:filesystem/types@0.3.0-rc-2026-01-06;
+  import wasi:filesystem/preopens@0.3.0-rc-2026-01-06;
+  import wasi:sockets/types@0.3.0-rc-2026-01-06;
+  import wasi:sockets/ip-name-lookup@0.3.0-rc-2026-01-06;
+  import wasi:random/random@0.3.0-rc-2026-01-06;
+  import wasi:random/insecure@0.3.0-rc-2026-01-06;
+  import wasi:random/insecure-seed@0.3.0-rc-2026-01-06;
+}
+@since(version = 0.3.0-rc-2026-01-06)
+world command {
+  @since(version = 0.3.0-rc-2026-01-06)
+  import environment;
+  @since(version = 0.3.0-rc-2026-01-06)
+  import exit;
+  @since(version = 0.3.0-rc-2026-01-06)
+  import types;
+  @since(version = 0.3.0-rc-2026-01-06)
+  import stdin;
+  @since(version = 0.3.0-rc-2026-01-06)
+  import stdout;
+  @since(version = 0.3.0-rc-2026-01-06)
+  import stderr;
+  @since(version = 0.3.0-rc-2026-01-06)
+  import terminal-input;
+  @since(version = 0.3.0-rc-2026-01-06)
+  import terminal-output;
+  @since(version = 0.3.0-rc-2026-01-06)
+  import terminal-stdin;
+  @since(version = 0.3.0-rc-2026-01-06)
+  import terminal-stdout;
+  @since(version = 0.3.0-rc-2026-01-06)
+  import terminal-stderr;
+  import wasi:clocks/types@0.3.0-rc-2026-01-06;
+  import wasi:clocks/monotonic-clock@0.3.0-rc-2026-01-06;
+  import wasi:clocks/system-clock@0.3.0-rc-2026-01-06;
+  @unstable(feature = clocks-timezone)
+  import wasi:clocks/timezone@0.3.0-rc-2026-01-06;
+  import wasi:filesystem/types@0.3.0-rc-2026-01-06;
+  import wasi:filesystem/preopens@0.3.0-rc-2026-01-06;
+  import wasi:sockets/types@0.3.0-rc-2026-01-06;
+  import wasi:sockets/ip-name-lookup@0.3.0-rc-2026-01-06;
+  import wasi:random/random@0.3.0-rc-2026-01-06;
+  import wasi:random/insecure@0.3.0-rc-2026-01-06;
+  import wasi:random/insecure-seed@0.3.0-rc-2026-01-06;
+
+  @since(version = 0.3.0-rc-2026-01-06)
+  export run;
+}
diff --git a/wit/deps/clocks-0.3.0-rc-2025-09-16/monotonic-clock.wit b/wit/deps/clocks-0.3.0-rc-2025-09-16/monotonic-clock.wit
deleted file mode 100644
index a91d495..0000000
--- a/wit/deps/clocks-0.3.0-rc-2025-09-16/monotonic-clock.wit
+++ /dev/null
@@ -1,48 +0,0 @@
-package wasi:clocks@0.3.0-rc-2025-09-16;
-/// WASI Monotonic Clock is a clock API intended to let users measure elapsed
-/// time.
-///
-/// It is intended to be portable at least between Unix-family platforms and
-/// Windows.
-///
-/// A monotonic clock is a clock which has an unspecified initial value, and
-/// successive reads of the clock will produce non-decreasing values.
-@since(version = 0.3.0-rc-2025-09-16)
-interface monotonic-clock {
-    use types.{duration};
-
-    /// An instant in time, in nanoseconds. An instant is relative to an
-    /// unspecified initial value, and can only be compared to instances from
-    /// the same monotonic-clock.
-    @since(version = 0.3.0-rc-2025-09-16)
-    type instant = u64;
-
-    /// Read the current value of the clock.
-    ///
-    /// The clock is monotonic, therefore calling this function repeatedly will
-    /// produce a sequence of non-decreasing values.
-    ///
-    /// For completeness, this function traps if it's not possible to represent
-    /// the value of the clock in an `instant`. Consequently, implementations
-    /// should ensure that the starting time is low enough to avoid the
-    /// possibility of overflow in practice.
-    @since(version = 0.3.0-rc-2025-09-16)
-    now: func() -> instant;
-
-    /// Query the resolution of the clock. Returns the duration of time
-    /// corresponding to a clock tick.
-    @since(version = 0.3.0-rc-2025-09-16)
-    get-resolution: func() -> duration;
-
-    /// Wait until the specified instant has occurred.
-    @since(version = 0.3.0-rc-2025-09-16)
-    wait-until: async func(
-        when: instant,
-    );
-
-    /// Wait for the specified duration to elapse.
-    @since(version = 0.3.0-rc-2025-09-16)
-    wait-for: async func(
-        how-long: duration,
-    );
-}
diff --git a/wit/deps/clocks-0.3.0-rc-2025-09-16/timezone.wit b/wit/deps/clocks-0.3.0-rc-2025-09-16/timezone.wit
deleted file mode 100644
index ab8f5c0..0000000
--- a/wit/deps/clocks-0.3.0-rc-2025-09-16/timezone.wit
+++ /dev/null
@@ -1,55 +0,0 @@
-package wasi:clocks@0.3.0-rc-2025-09-16;
-
-@unstable(feature = clocks-timezone)
-interface timezone {
-    @unstable(feature = clocks-timezone)
-    use wall-clock.{datetime};
-
-    /// Return information needed to display the given `datetime`. This includes
-    /// the UTC offset, the time zone name, and a flag indicating whether
-    /// daylight saving time is active.
-    ///
-    /// If the timezone cannot be determined for the given `datetime`, return a
-    /// `timezone-display` for `UTC` with a `utc-offset` of 0 and no daylight
-    /// saving time.
-    @unstable(feature = clocks-timezone)
-    display: func(when: datetime) -> timezone-display;
-
-    /// The same as `display`, but only return the UTC offset.
-    @unstable(feature = clocks-timezone)
-    utc-offset: func(when: datetime) -> s32;
-
-    /// Information useful for displaying the timezone of a specific `datetime`.
-    ///
-    /// This information may vary within a single `timezone` to reflect daylight
-    /// saving time adjustments.
-    @unstable(feature = clocks-timezone)
-    record timezone-display {
-        /// The number of seconds difference between UTC time and the local
-        /// time of the timezone.
-        ///
-        /// The returned value will always be less than 86400 which is the
-        /// number of seconds in a day (24*60*60).
-        ///
-        /// In implementations that do not expose an actual time zone, this
-        /// should return 0.
-        utc-offset: s32,
-
-        /// The abbreviated name of the timezone to display to a user. The name
-        /// `UTC` indicates Coordinated Universal Time. Otherwise, this should
-        /// reference local standards for the name of the time zone.
-        ///
-        /// In implementations that do not expose an actual time zone, this
-        /// should be the string `UTC`.
-        ///
-        /// In time zones that do not have an applicable name, a formatted
-        /// representation of the UTC offset may be returned, such as `-04:00`.
-        name: string,
-
-        /// Whether daylight saving time is active.
-        ///
-        /// In implementations that do not expose an actual time zone, this
-        /// should return false.
-        in-daylight-saving-time: bool,
-    }
-}
diff --git a/wit/deps/clocks-0.3.0-rc-2025-09-16/types.wit b/wit/deps/clocks-0.3.0-rc-2025-09-16/types.wit
deleted file mode 100644
index aff7c2a..0000000
--- a/wit/deps/clocks-0.3.0-rc-2025-09-16/types.wit
+++ /dev/null
@@ -1,8 +0,0 @@
-package wasi:clocks@0.3.0-rc-2025-09-16;
-/// This interface common types used throughout wasi:clocks.
-@since(version = 0.3.0-rc-2025-09-16)
-interface types {
-    /// A duration of time, in nanoseconds.
-    @since(version = 0.3.0-rc-2025-09-16)
-    type duration = u64;
-}
diff --git a/wit/deps/clocks-0.3.0-rc-2025-09-16/wall-clock.wit b/wit/deps/clocks-0.3.0-rc-2025-09-16/wall-clock.wit
deleted file mode 100644
index ea94050..0000000
--- a/wit/deps/clocks-0.3.0-rc-2025-09-16/wall-clock.wit
+++ /dev/null
@@ -1,46 +0,0 @@
-package wasi:clocks@0.3.0-rc-2025-09-16;
-/// WASI Wall Clock is a clock API intended to let users query the current
-/// time. The name "wall" makes an analogy to a "clock on the wall", which
-/// is not necessarily monotonic as it may be reset.
-///
-/// It is intended to be portable at least between Unix-family platforms and
-/// Windows.
-///
-/// A wall clock is a clock which measures the date and time according to
-/// some external reference.
-///
-/// External references may be reset, so this clock is not necessarily
-/// monotonic, making it unsuitable for measuring elapsed time.
-///
-/// It is intended for reporting the current date and time for humans.
-@since(version = 0.3.0-rc-2025-09-16)
-interface wall-clock {
-    /// A time and date in seconds plus nanoseconds.
-    @since(version = 0.3.0-rc-2025-09-16)
-    record datetime {
-        seconds: u64,
-        nanoseconds: u32,
-    }
-
-    /// Read the current value of the clock.
-    ///
-    /// This clock is not monotonic, therefore calling this function repeatedly
-    /// will not necessarily produce a sequence of non-decreasing values.
-    ///
-    /// The returned timestamps represent the number of seconds since
-    /// 1970-01-01T00:00:00Z, also known as [POSIX's Seconds Since the Epoch],
-    /// also known as [Unix Time].
-    ///
-    /// The nanoseconds field of the output is always less than 1000000000.
-    ///
-    /// [POSIX's Seconds Since the Epoch]: https://pubs.opengroup.org/onlinepubs/9699919799/xrat/V4_xbd_chap04.html#tag_21_04_16
-    /// [Unix Time]: https://en.wikipedia.org/wiki/Unix_time
-    @since(version = 0.3.0-rc-2025-09-16)
-    now: func() -> datetime;
-
-    /// Query the resolution of the clock.
-    ///
-    /// The nanoseconds field of the output is always less than 1000000000.
-    @since(version = 0.3.0-rc-2025-09-16)
-    get-resolution: func() -> datetime;
-}
diff --git a/wit/deps/clocks-0.3.0-rc-2025-09-16/world.wit b/wit/deps/clocks-0.3.0-rc-2025-09-16/world.wit
deleted file mode 100644
index a6b885f..0000000
--- a/wit/deps/clocks-0.3.0-rc-2025-09-16/world.wit
+++ /dev/null
@@ -1,11 +0,0 @@
-package wasi:clocks@0.3.0-rc-2025-09-16;
-
-@since(version = 0.3.0-rc-2025-09-16)
-world imports {
-    @since(version = 0.3.0-rc-2025-09-16)
-    import monotonic-clock;
-    @since(version = 0.3.0-rc-2025-09-16)
-    import wall-clock;
-    @unstable(feature = clocks-timezone)
-    import timezone;
-}
diff --git a/wit/deps/clocks-0.3.0-rc-2026-01-06.wit b/wit/deps/clocks-0.3.0-rc-2026-01-06.wit
new file mode 100644
index 0000000..fc59f5a
--- /dev/null
+++ b/wit/deps/clocks-0.3.0-rc-2026-01-06.wit
@@ -0,0 +1,161 @@
+package wasi:clocks@0.3.0-rc-2026-01-06;
+
+/// This interface common types used throughout wasi:clocks.
+@since(version = 0.3.0-rc-2026-01-06)
+interface types {
+  /// A duration of time, in nanoseconds.
+  @since(version = 0.3.0-rc-2026-01-06)
+  type duration = u64;
+}
+
+/// WASI Monotonic Clock is a clock API intended to let users measure elapsed
+/// time.
+///
+/// It is intended to be portable at least between Unix-family platforms and
+/// Windows.
+///
+/// A monotonic clock is a clock which has an unspecified initial value, and
+/// successive reads of the clock will produce non-decreasing values.
+@since(version = 0.3.0-rc-2026-01-06)
+interface monotonic-clock {
+  use types.{duration};
+
+  /// A mark on a monotonic clock is a number of nanoseconds since an
+  /// unspecified initial value, and can only be compared to instances from
+  /// the same monotonic-clock.
+  @since(version = 0.3.0-rc-2026-01-06)
+  type mark = u64;
+
+  /// Read the current value of the clock.
+  ///
+  /// The clock is monotonic, therefore calling this function repeatedly will
+  /// produce a sequence of non-decreasing values.
+  ///
+  /// For completeness, this function traps if it's not possible to represent
+  /// the value of the clock in a `mark`. Consequently, implementations
+  /// should ensure that the starting time is low enough to avoid the
+  /// possibility of overflow in practice.
+  @since(version = 0.3.0-rc-2026-01-06)
+  now: func() -> mark;
+
+  /// Query the resolution of the clock. Returns the duration of time
+  /// corresponding to a clock tick.
+  @since(version = 0.3.0-rc-2026-01-06)
+  get-resolution: func() -> duration;
+
+  /// Wait until the specified mark has occurred.
+  @since(version = 0.3.0-rc-2026-01-06)
+  wait-until: async func(when: mark);
+
+  /// Wait for the specified duration to elapse.
+  @since(version = 0.3.0-rc-2026-01-06)
+  wait-for: async func(how-long: duration);
+}
+
+/// WASI System Clock is a clock API intended to let users query the current
+/// time. The clock is not necessarily monotonic as it may be reset.
+///
+/// It is intended to be portable at least between Unix-family platforms and
+/// Windows.
+///
+/// External references may be reset, so this clock is not necessarily
+/// monotonic, making it unsuitable for measuring elapsed time.
+///
+/// It is intended for reporting the current date and time for humans.
+@since(version = 0.3.0-rc-2026-01-06)
+interface system-clock {
+  use types.{duration};
+
+  /// An "instant", or "exact time", is a point in time without regard to any
+  /// time zone: just the time since a particular external reference point,
+  /// often called an "epoch".
+  ///
+  /// Here, the epoch is 1970-01-01T00:00:00Z, also known as
+  /// [POSIX's Seconds Since the Epoch], also known as [Unix Time].
+  ///
+  /// Note that even if the seconds field is negative, incrementing
+  /// nanoseconds always represents moving forwards in time.
+  /// For example, `{ -1 seconds, 999999999 nanoseconds }` represents the
+  /// instant one nanosecond before the epoch.
+  /// For more on various different ways to represent time, see
+  /// https://tc39.es/proposal-temporal/docs/timezone.html
+  ///
+  /// [POSIX's Seconds Since the Epoch]: https://pubs.opengroup.org/onlinepubs/9699919799/xrat/V4_xbd_chap04.html#tag_21_04_16
+  /// [Unix Time]: https://en.wikipedia.org/wiki/Unix_time
+  @since(version = 0.3.0-rc-2026-01-06)
+  record instant {
+    seconds: s64,
+    nanoseconds: u32,
+  }
+
+  /// Read the current value of the clock.
+  ///
+  /// This clock is not monotonic, therefore calling this function repeatedly
+  /// will not necessarily produce a sequence of non-decreasing values.
+  ///
+  /// The nanoseconds field of the output is always less than 1000000000.
+  @since(version = 0.3.0-rc-2026-01-06)
+  now: func() -> instant;
+
+  /// Query the resolution of the clock. Returns the smallest duration of time
+  /// that the implementation permits distinguishing.
+  @since(version = 0.3.0-rc-2026-01-06)
+  get-resolution: func() -> duration;
+}
+
+@unstable(feature = clocks-timezone)
+interface timezone {
+  @unstable(feature = clocks-timezone)
+  use system-clock.{instant};
+
+  /// Return the IANA identifier of the currently configured timezone. This
+  /// should be an identifier from the IANA Time Zone Database.
+  ///
+  /// For displaying to a user, the identifier should be converted into a
+  /// localized name by means of an internationalization API.
+  ///
+  /// If the implementation does not expose an actual timezone, or is unable
+  /// to provide mappings from times to deltas between the configured timezone
+  /// and UTC, or determining the current timezone fails, or the timezone does
+  /// not have an IANA identifier, this returns nothing.
+  @unstable(feature = clocks-timezone)
+  iana-id: func() -> option<string>;
+
+  /// The number of nanoseconds difference between UTC time and the local
+  /// time of the currently configured timezone, at the exact time of
+  /// `instant`.
+  ///
+  /// The magnitude of the returned value will always be less than
+  /// 86,400,000,000,000 which is the number of nanoseconds in a day
+  /// (24*60*60*1e9).
+  ///
+  /// If the implementation does not expose an actual timezone, or is unable
+  /// to provide mappings from times to deltas between the configured timezone
+  /// and UTC, or determining the current timezone fails, this returns
+  /// nothing.
+  @unstable(feature = clocks-timezone)
+  utc-offset: func(when: instant) -> option<s64>;
+
+  /// Returns a string that is suitable to assist humans in debugging whether
+  /// any timezone is available, and if so, which. This may be the same string
+  /// as `iana-id`, or a formatted representation of the UTC offset such as
+  /// `-04:00`, or something else.
+  ///
+  /// WARNING: The returned string should not be consumed mechanically! It may
+  /// change across platforms, hosts, or other implementation details. Parsing
+  /// this string is a major platform-compatibility hazard.
+  @unstable(feature = clocks-timezone)
+  to-debug-string: func() -> string;
+}
+
+@since(version = 0.3.0-rc-2026-01-06)
+world imports {
+  @since(version = 0.3.0-rc-2026-01-06)
+  import types;
+  @since(version = 0.3.0-rc-2026-01-06)
+  import monotonic-clock;
+  @since(version = 0.3.0-rc-2026-01-06)
+  import system-clock;
+  @unstable(feature = clocks-timezone)
+  import timezone;
+}
diff --git a/wit/deps/filesystem-0.3.0-rc-2025-09-16/preopens.wit b/wit/deps/filesystem-0.3.0-rc-2025-09-16/preopens.wit
deleted file mode 100644
index 9036e90..0000000
--- a/wit/deps/filesystem-0.3.0-rc-2025-09-16/preopens.wit
+++ /dev/null
@@ -1,11 +0,0 @@
-package wasi:filesystem@0.3.0-rc-2025-09-16;
-
-@since(version = 0.3.0-rc-2025-09-16)
-interface preopens {
-    @since(version = 0.3.0-rc-2025-09-16)
-    use types.{descriptor};
-
-    /// Return the set of preopened directories, and their paths.
-    @since(version = 0.3.0-rc-2025-09-16)
-    get-directories: func() -> list<tuple<descriptor, string>>;
-}
diff --git a/wit/deps/filesystem-0.3.0-rc-2025-09-16/types.wit b/wit/deps/filesystem-0.3.0-rc-2025-09-16/types.wit
deleted file mode 100644
index 41d91be..0000000
--- a/wit/deps/filesystem-0.3.0-rc-2025-09-16/types.wit
+++ /dev/null
@@ -1,636 +0,0 @@
-package wasi:filesystem@0.3.0-rc-2025-09-16;
-/// WASI filesystem is a filesystem API primarily intended to let users run WASI
-/// programs that access their files on their existing filesystems, without
-/// significant overhead.
-///
-/// It is intended to be roughly portable between Unix-family platforms and
-/// Windows, though it does not hide many of the major differences.
-///
-/// Paths are passed as interface-type `string`s, meaning they must consist of
-/// a sequence of Unicode Scalar Values (USVs). Some filesystems may contain
-/// paths which are not accessible by this API.
-///
-/// The directory separator in WASI is always the forward-slash (`/`).
-///
-/// All paths in WASI are relative paths, and are interpreted relative to a
-/// `descriptor` referring to a base directory. If a `path` argument to any WASI
-/// function starts with `/`, or if any step of resolving a `path`, including
-/// `..` and symbolic link steps, reaches a directory outside of the base
-/// directory, or reaches a symlink to an absolute or rooted path in the
-/// underlying filesystem, the function fails with `error-code::not-permitted`.
-///
-/// For more information about WASI path resolution and sandboxing, see
-/// [WASI filesystem path resolution].
-///
-/// [WASI filesystem path resolution]: https://github.com/WebAssembly/wasi-filesystem/blob/main/path-resolution.md
-@since(version = 0.3.0-rc-2025-09-16)
-interface types {
-    @since(version = 0.3.0-rc-2025-09-16)
-    use wasi:clocks/wall-clock@0.3.0-rc-2025-09-16.{datetime};
-
-    /// File size or length of a region within a file.
-    @since(version = 0.3.0-rc-2025-09-16)
-    type filesize = u64;
-
-    /// The type of a filesystem object referenced by a descriptor.
-    ///
-    /// Note: This was called `filetype` in earlier versions of WASI.
-    @since(version = 0.3.0-rc-2025-09-16)
-    enum descriptor-type {
-        /// The type of the descriptor or file is unknown or is different from
-        /// any of the other types specified.
-        unknown,
-        /// The descriptor refers to a block device inode.
-        block-device,
-        /// The descriptor refers to a character device inode.
-        character-device,
-        /// The descriptor refers to a directory inode.
-        directory,
-        /// The descriptor refers to a named pipe.
-        fifo,
-        /// The file refers to a symbolic link inode.
-        symbolic-link,
-        /// The descriptor refers to a regular file inode.
-        regular-file,
-        /// The descriptor refers to a socket.
-        socket,
-    }
-
-    /// Descriptor flags.
-    ///
-    /// Note: This was called `fdflags` in earlier versions of WASI.
-    @since(version = 0.3.0-rc-2025-09-16)
-    flags descriptor-flags {
-        /// Read mode: Data can be read.
-        read,
-        /// Write mode: Data can be written to.
-        write,
-        /// Request that writes be performed according to synchronized I/O file
-        /// integrity completion. The data stored in the file and the file's
-        /// metadata are synchronized. This is similar to `O_SYNC` in POSIX.
-        ///
-        /// The precise semantics of this operation have not yet been defined for
-        /// WASI. At this time, it should be interpreted as a request, and not a
-        /// requirement.
-        file-integrity-sync,
-        /// Request that writes be performed according to synchronized I/O data
-        /// integrity completion. Only the data stored in the file is
-        /// synchronized. This is similar to `O_DSYNC` in POSIX.
-        ///
-        /// The precise semantics of this operation have not yet been defined for
-        /// WASI. At this time, it should be interpreted as a request, and not a
-        /// requirement.
-        data-integrity-sync,
-        /// Requests that reads be performed at the same level of integrity
-        /// requested for writes. This is similar to `O_RSYNC` in POSIX.
-        ///
-        /// The precise semantics of this operation have not yet been defined for
-        /// WASI. At this time, it should be interpreted as a request, and not a
-        /// requirement.
-        requested-write-sync,
-        /// Mutating directories mode: Directory contents may be mutated.
-        ///
-        /// When this flag is unset on a descriptor, operations using the
-        /// descriptor which would create, rename, delete, modify the data or
-        /// metadata of filesystem objects, or obtain another handle which
-        /// would permit any of those, shall fail with `error-code::read-only` if
-        /// they would otherwise succeed.
-        ///
-        /// This may only be set on directories.
-        mutate-directory,
-    }
-
-    /// File attributes.
-    ///
-    /// Note: This was called `filestat` in earlier versions of WASI.
-    @since(version = 0.3.0-rc-2025-09-16)
-    record descriptor-stat {
-        /// File type.
-        %type: descriptor-type,
-        /// Number of hard links to the file.
-        link-count: link-count,
-        /// For regular files, the file size in bytes. For symbolic links, the
-        /// length in bytes of the pathname contained in the symbolic link.
-        size: filesize,
-        /// Last data access timestamp.
-        ///
-        /// If the `option` is none, the platform doesn't maintain an access
-        /// timestamp for this file.
-        data-access-timestamp: option<datetime>,
-        /// Last data modification timestamp.
-        ///
-        /// If the `option` is none, the platform doesn't maintain a
-        /// modification timestamp for this file.
-        data-modification-timestamp: option<datetime>,
-        /// Last file status-change timestamp.
-        ///
-        /// If the `option` is none, the platform doesn't maintain a
-        /// status-change timestamp for this file.
-        status-change-timestamp: option<datetime>,
-    }
-
-    /// Flags determining the method of how paths are resolved.
-    @since(version = 0.3.0-rc-2025-09-16)
-    flags path-flags {
-        /// As long as the resolved path corresponds to a symbolic link, it is
-        /// expanded.
-        symlink-follow,
-    }
-
-    /// Open flags used by `open-at`.
-    @since(version = 0.3.0-rc-2025-09-16)
-    flags open-flags {
-        /// Create file if it does not exist, similar to `O_CREAT` in POSIX.
-        create,
-        /// Fail if not a directory, similar to `O_DIRECTORY` in POSIX.
-        directory,
-        /// Fail if file already exists, similar to `O_EXCL` in POSIX.
-        exclusive,
-        /// Truncate file to size 0, similar to `O_TRUNC` in POSIX.
-        truncate,
-    }
-
-    /// Number of hard links to an inode.
-    @since(version = 0.3.0-rc-2025-09-16)
-    type link-count = u64;
-
-    /// When setting a timestamp, this gives the value to set it to.
-    @since(version = 0.3.0-rc-2025-09-16)
-    variant new-timestamp {
-        /// Leave the timestamp set to its previous value.
-        no-change,
-        /// Set the timestamp to the current time of the system clock associated
-        /// with the filesystem.
-        now,
-        /// Set the timestamp to the given value.
-        timestamp(datetime),
-    }
-
-    /// A directory entry.
-    record directory-entry {
-        /// The type of the file referred to by this directory entry.
-        %type: descriptor-type,
-
-        /// The name of the object.
-        name: string,
-    }
-
-    /// Error codes returned by functions, similar to `errno` in POSIX.
-    /// Not all of these error codes are returned by the functions provided by this
-    /// API; some are used in higher-level library layers, and others are provided
-    /// merely for alignment with POSIX.
-    enum error-code {
-        /// Permission denied, similar to `EACCES` in POSIX.
-        access,
-        /// Connection already in progress, similar to `EALREADY` in POSIX.
-        already,
-        /// Bad descriptor, similar to `EBADF` in POSIX.
-        bad-descriptor,
-        /// Device or resource busy, similar to `EBUSY` in POSIX.
-        busy,
-        /// Resource deadlock would occur, similar to `EDEADLK` in POSIX.
-        deadlock,
-        /// Storage quota exceeded, similar to `EDQUOT` in POSIX.
-        quota,
-        /// File exists, similar to `EEXIST` in POSIX.
-        exist,
-        /// File too large, similar to `EFBIG` in POSIX.
-        file-too-large,
-        /// Illegal byte sequence, similar to `EILSEQ` in POSIX.
-        illegal-byte-sequence,
-        /// Operation in progress, similar to `EINPROGRESS` in POSIX.
-        in-progress,
-        /// Interrupted function, similar to `EINTR` in POSIX.
-        interrupted,
-        /// Invalid argument, similar to `EINVAL` in POSIX.
-        invalid,
-        /// I/O error, similar to `EIO` in POSIX.
-        io,
-        /// Is a directory, similar to `EISDIR` in POSIX.
-        is-directory,
-        /// Too many levels of symbolic links, similar to `ELOOP` in POSIX.
-        loop,
-        /// Too many links, similar to `EMLINK` in POSIX.
-        too-many-links,
-        /// Message too large, similar to `EMSGSIZE` in POSIX.
-        message-size,
-        /// Filename too long, similar to `ENAMETOOLONG` in POSIX.
-        name-too-long,
-        /// No such device, similar to `ENODEV` in POSIX.
-        no-device,
-        /// No such file or directory, similar to `ENOENT` in POSIX.
-        no-entry,
-        /// No locks available, similar to `ENOLCK` in POSIX.
-        no-lock,
-        /// Not enough space, similar to `ENOMEM` in POSIX.
-        insufficient-memory,
-        /// No space left on device, similar to `ENOSPC` in POSIX.
-        insufficient-space,
-        /// Not a directory or a symbolic link to a directory, similar to `ENOTDIR` in POSIX.
-        not-directory,
-        /// Directory not empty, similar to `ENOTEMPTY` in POSIX.
-        not-empty,
-        /// State not recoverable, similar to `ENOTRECOVERABLE` in POSIX.
-        not-recoverable,
-        /// Not supported, similar to `ENOTSUP` and `ENOSYS` in POSIX.
-        unsupported,
-        /// Inappropriate I/O control operation, similar to `ENOTTY` in POSIX.
-        no-tty,
-        /// No such device or address, similar to `ENXIO` in POSIX.
-        no-such-device,
-        /// Value too large to be stored in data type, similar to `EOVERFLOW` in POSIX.
-        overflow,
-        /// Operation not permitted, similar to `EPERM` in POSIX.
-        not-permitted,
-        /// Broken pipe, similar to `EPIPE` in POSIX.
-        pipe,
-        /// Read-only file system, similar to `EROFS` in POSIX.
-        read-only,
-        /// Invalid seek, similar to `ESPIPE` in POSIX.
-        invalid-seek,
-        /// Text file busy, similar to `ETXTBSY` in POSIX.
-        text-file-busy,
-        /// Cross-device link, similar to `EXDEV` in POSIX.
-        cross-device,
-    }
-
-    /// File or memory access pattern advisory information.
-    @since(version = 0.3.0-rc-2025-09-16)
-    enum advice {
-        /// The application has no advice to give on its behavior with respect
-        /// to the specified data.
-        normal,
-        /// The application expects to access the specified data sequentially
-        /// from lower offsets to higher offsets.
-        sequential,
-        /// The application expects to access the specified data in a random
-        /// order.
-        random,
-        /// The application expects to access the specified data in the near
-        /// future.
-        will-need,
-        /// The application expects that it will not access the specified data
-        /// in the near future.
-        dont-need,
-        /// The application expects to access the specified data once and then
-        /// not reuse it thereafter.
-        no-reuse,
-    }
-
-    /// A 128-bit hash value, split into parts because wasm doesn't have a
-    /// 128-bit integer type.
-    @since(version = 0.3.0-rc-2025-09-16)
-    record metadata-hash-value {
-       /// 64 bits of a 128-bit hash value.
-       lower: u64,
-       /// Another 64 bits of a 128-bit hash value.
-       upper: u64,
-    }
-
-    /// A descriptor is a reference to a filesystem object, which may be a file,
-    /// directory, named pipe, special file, or other object on which filesystem
-    /// calls may be made.
-    @since(version = 0.3.0-rc-2025-09-16)
-    resource descriptor {
-        /// Return a stream for reading from a file.
-        ///
-        /// Multiple read, write, and append streams may be active on the same open
-        /// file and they do not interfere with each other.
-        ///
-        /// This function returns a `stream` which provides the data received from the
-        /// file, and a `future` providing additional error information in case an
-        /// error is encountered.
-        ///
-        /// If no error is encountered, `stream.read` on the `stream` will return
-        /// `read-status::closed` with no `error-context` and the future resolves to
-        /// the value `ok`. If an error is encountered, `stream.read` on the
-        /// `stream` returns `read-status::closed` with an `error-context` and the future
-        /// resolves to `err` with an `error-code`.
-        ///
-        /// Note: This is similar to `pread` in POSIX.
-        @since(version = 0.3.0-rc-2025-09-16)
-        read-via-stream: func(
-            /// The offset within the file at which to start reading.
-            offset: filesize,
-        ) -> tuple<stream<u8>, future<result<_, error-code>>>;
-
-        /// Return a stream for writing to a file, if available.
-        ///
-        /// May fail with an error-code describing why the file cannot be written.
-        ///
-        /// It is valid to write past the end of a file; the file is extended to the
-        /// extent of the write, with bytes between the previous end and the start of
-        /// the write set to zero.
-        ///
-        /// This function returns once either full contents of the stream are
-        /// written or an error is encountered.
-        ///
-        /// Note: This is similar to `pwrite` in POSIX.
-        @since(version = 0.3.0-rc-2025-09-16)
-        write-via-stream: async func(
-            /// Data to write
-            data: stream<u8>,
-            /// The offset within the file at which to start writing.
-            offset: filesize,
-        ) -> result<_, error-code>;
-
-        /// Return a stream for appending to a file, if available.
-        ///
-        /// May fail with an error-code describing why the file cannot be appended.
-        ///
-        /// This function returns once either full contents of the stream are
-        /// written or an error is encountered.
-        ///
-        /// Note: This is similar to `write` with `O_APPEND` in POSIX.
-        @since(version = 0.3.0-rc-2025-09-16)
-        append-via-stream: async func(data: stream<u8>) -> result<_, error-code>;
-
-        /// Provide file advisory information on a descriptor.
-        ///
-        /// This is similar to `posix_fadvise` in POSIX.
-        @since(version = 0.3.0-rc-2025-09-16)
-        advise: async func(
-            /// The offset within the file to which the advisory applies.
-            offset: filesize,
-            /// The length of the region to which the advisory applies.
-            length: filesize,
-            /// The advice.
-            advice: advice
-        ) -> result<_, error-code>;
-
-        /// Synchronize the data of a file to disk.
-        ///
-        /// This function succeeds with no effect if the file descriptor is not
-        /// opened for writing.
-        ///
-        /// Note: This is similar to `fdatasync` in POSIX.
-        @since(version = 0.3.0-rc-2025-09-16)
-        sync-data: async func() -> result<_, error-code>;
-
-        /// Get flags associated with a descriptor.
-        ///
-        /// Note: This returns similar flags to `fcntl(fd, F_GETFL)` in POSIX.
-        ///
-        /// Note: This returns the value that was the `fs_flags` value returned
-        /// from `fdstat_get` in earlier versions of WASI.
-        @since(version = 0.3.0-rc-2025-09-16)
-        get-flags: async func() -> result<descriptor-flags, error-code>;
-
-        /// Get the dynamic type of a descriptor.
-        ///
-        /// Note: This returns the same value as the `type` field of the `fd-stat`
-        /// returned by `stat`, `stat-at` and similar.
-        ///
-        /// Note: This returns similar flags to the `st_mode & S_IFMT` value provided
-        /// by `fstat` in POSIX.
-        ///
-        /// Note: This returns the value that was the `fs_filetype` value returned
-        /// from `fdstat_get` in earlier versions of WASI.
-        @since(version = 0.3.0-rc-2025-09-16)
-        get-type: async func() -> result<descriptor-type, error-code>;
-
-        /// Adjust the size of an open file. If this increases the file's size, the
-        /// extra bytes are filled with zeros.
-        ///
-        /// Note: This was called `fd_filestat_set_size` in earlier versions of WASI.
-        @since(version = 0.3.0-rc-2025-09-16)
-        set-size: async func(size: filesize) -> result<_, error-code>;
-
-        /// Adjust the timestamps of an open file or directory.
-        ///
-        /// Note: This is similar to `futimens` in POSIX.
-        ///
-        /// Note: This was called `fd_filestat_set_times` in earlier versions of WASI.
-        @since(version = 0.3.0-rc-2025-09-16)
-        set-times: async func(
-            /// The desired values of the data access timestamp.
-            data-access-timestamp: new-timestamp,
-            /// The desired values of the data modification timestamp.
-            data-modification-timestamp: new-timestamp,
-        ) -> result<_, error-code>;
-
-        /// Read directory entries from a directory.
-        ///
-        /// On filesystems where directories contain entries referring to themselves
-        /// and their parents, often named `.` and `..` respectively, these entries
-        /// are omitted.
-        ///
-        /// This always returns a new stream which starts at the beginning of the
-        /// directory. Multiple streams may be active on the same directory, and they
-        /// do not interfere with each other.
-        ///
-        /// This function returns a future, which will resolve to an error code if
-        /// reading full contents of the directory fails.
-        @since(version = 0.3.0-rc-2025-09-16)
-        read-directory: async func() -> tuple<stream<directory-entry>, future<result<_, error-code>>>;
-
-        /// Synchronize the data and metadata of a file to disk.
-        ///
-        /// This function succeeds with no effect if the file descriptor is not
-        /// opened for writing.
-        ///
-        /// Note: This is similar to `fsync` in POSIX.
-        @since(version = 0.3.0-rc-2025-09-16)
-        sync: async func() -> result<_, error-code>;
-
-        /// Create a directory.
-        ///
-        /// Note: This is similar to `mkdirat` in POSIX.
-        @since(version = 0.3.0-rc-2025-09-16)
-        create-directory-at: async func(
-            /// The relative path at which to create the directory.
-            path: string,
-        ) -> result<_, error-code>;
-
-        /// Return the attributes of an open file or directory.
-        ///
-        /// Note: This is similar to `fstat` in POSIX, except that it does not return
-        /// device and inode information. For testing whether two descriptors refer to
-        /// the same underlying filesystem object, use `is-same-object`. To obtain
-        /// additional data that can be used do determine whether a file has been
-        /// modified, use `metadata-hash`.
-        ///
-        /// Note: This was called `fd_filestat_get` in earlier versions of WASI.
-        @since(version = 0.3.0-rc-2025-09-16)
-        stat: async func() -> result<descriptor-stat, error-code>;
-
-        /// Return the attributes of a file or directory.
-        ///
-        /// Note: This is similar to `fstatat` in POSIX, except that it does not
-        /// return device and inode information. See the `stat` description for a
-        /// discussion of alternatives.
-        ///
-        /// Note: This was called `path_filestat_get` in earlier versions of WASI.
-        @since(version = 0.3.0-rc-2025-09-16)
-        stat-at: async func(
-            /// Flags determining the method of how the path is resolved.
-            path-flags: path-flags,
-            /// The relative path of the file or directory to inspect.
-            path: string,
-        ) -> result<descriptor-stat, error-code>;
-
-        /// Adjust the timestamps of a file or directory.
-        ///
-        /// Note: This is similar to `utimensat` in POSIX.
-        ///
-        /// Note: This was called `path_filestat_set_times` in earlier versions of
-        /// WASI.
-        @since(version = 0.3.0-rc-2025-09-16)
-        set-times-at: async func(
-            /// Flags determining the method of how the path is resolved.
-            path-flags: path-flags,
-            /// The relative path of the file or directory to operate on.
-            path: string,
-            /// The desired values of the data access timestamp.
-            data-access-timestamp: new-timestamp,
-            /// The desired values of the data modification timestamp.
-            data-modification-timestamp: new-timestamp,
-        ) -> result<_, error-code>;
-
-        /// Create a hard link.
-        ///
-        /// Fails with `error-code::no-entry` if the old path does not exist,
-        /// with `error-code::exist` if the new path already exists, and
-        /// `error-code::not-permitted` if the old path is not a file.
-        ///
-        /// Note: This is similar to `linkat` in POSIX.
-        @since(version = 0.3.0-rc-2025-09-16)
-        link-at: async func(
-            /// Flags determining the method of how the path is resolved.
-            old-path-flags: path-flags,
-            /// The relative source path from which to link.
-            old-path: string,
-            /// The base directory for `new-path`.
-            new-descriptor: borrow<descriptor>,
-            /// The relative destination path at which to create the hard link.
-            new-path: string,
-        ) -> result<_, error-code>;
-
-        /// Open a file or directory.
-        ///
-        /// If `flags` contains `descriptor-flags::mutate-directory`, and the base
-        /// descriptor doesn't have `descriptor-flags::mutate-directory` set,
-        /// `open-at` fails with `error-code::read-only`.
-        ///
-        /// If `flags` contains `write` or `mutate-directory`, or `open-flags`
-        /// contains `truncate` or `create`, and the base descriptor doesn't have
-        /// `descriptor-flags::mutate-directory` set, `open-at` fails with
-        /// `error-code::read-only`.
-        ///
-        /// Note: This is similar to `openat` in POSIX.
-        @since(version = 0.3.0-rc-2025-09-16)
-        open-at: async func(
-            /// Flags determining the method of how the path is resolved.
-            path-flags: path-flags,
-            /// The relative path of the object to open.
-            path: string,
-            /// The method by which to open the file.
-            open-flags: open-flags,
-            /// Flags to use for the resulting descriptor.
-            %flags: descriptor-flags,
-        ) -> result<descriptor, error-code>;
-
-        /// Read the contents of a symbolic link.
-        ///
-        /// If the contents contain an absolute or rooted path in the underlying
-        /// filesystem, this function fails with `error-code::not-permitted`.
-        ///
-        /// Note: This is similar to `readlinkat` in POSIX.
-        @since(version = 0.3.0-rc-2025-09-16)
-        readlink-at: async func(
-            /// The relative path of the symbolic link from which to read.
-            path: string,
-        ) -> result<string, error-code>;
-
-        /// Remove a directory.
-        ///
-        /// Return `error-code::not-empty` if the directory is not empty.
-        ///
-        /// Note: This is similar to `unlinkat(fd, path, AT_REMOVEDIR)` in POSIX.
-        @since(version = 0.3.0-rc-2025-09-16)
-        remove-directory-at: async func(
-            /// The relative path to a directory to remove.
-            path: string,
-        ) -> result<_, error-code>;
-
-        /// Rename a filesystem object.
-        ///
-        /// Note: This is similar to `renameat` in POSIX.
-        @since(version = 0.3.0-rc-2025-09-16)
-        rename-at: async func(
-            /// The relative source path of the file or directory to rename.
-            old-path: string,
-            /// The base directory for `new-path`.
-            new-descriptor: borrow<descriptor>,
-            /// The relative destination path to which to rename the file or directory.
-            new-path: string,
-        ) -> result<_, error-code>;
-
-        /// Create a symbolic link (also known as a "symlink").
-        ///
-        /// If `old-path` starts with `/`, the function fails with
-        /// `error-code::not-permitted`.
-        ///
-        /// Note: This is similar to `symlinkat` in POSIX.
-        @since(version = 0.3.0-rc-2025-09-16)
-        symlink-at: async func(
-            /// The contents of the symbolic link.
-            old-path: string,
-            /// The relative destination path at which to create the symbolic link.
-            new-path: string,
-        ) -> result<_, error-code>;
-
-        /// Unlink a filesystem object that is not a directory.
-        ///
-        /// Return `error-code::is-directory` if the path refers to a directory.
-        /// Note: This is similar to `unlinkat(fd, path, 0)` in POSIX.
-        @since(version = 0.3.0-rc-2025-09-16)
-        unlink-file-at: async func(
-            /// The relative path to a file to unlink.
-            path: string,
-        ) -> result<_, error-code>;
-
-        /// Test whether two descriptors refer to the same filesystem object.
-        ///
-        /// In POSIX, this corresponds to testing whether the two descriptors have the
-        /// same device (`st_dev`) and inode (`st_ino` or `d_ino`) numbers.
-        /// wasi-filesystem does not expose device and inode numbers, so this function
-        /// may be used instead.
-        @since(version = 0.3.0-rc-2025-09-16)
-        is-same-object: async func(other: borrow<descriptor>) -> bool;
-
-        /// Return a hash of the metadata associated with a filesystem object referred
-        /// to by a descriptor.
-        ///
-        /// This returns a hash of the last-modification timestamp and file size, and
-        /// may also include the inode number, device number, birth timestamp, and
-        /// other metadata fields that may change when the file is modified or
-        /// replaced. It may also include a secret value chosen by the
-        /// implementation and not otherwise exposed.
-        ///
-        /// Implementations are encouraged to provide the following properties:
-        ///
-        ///  - If the file is not modified or replaced, the computed hash value should
-        ///    usually not change.
-        ///  - If the object is modified or replaced, the computed hash value should
-        ///    usually change.
-        ///  - The inputs to the hash should not be easily computable from the
-        ///    computed hash.
-        ///
-        /// However, none of these is required.
-        @since(version = 0.3.0-rc-2025-09-16)
-        metadata-hash: async func() -> result<metadata-hash-value, error-code>;
-
-        /// Return a hash of the metadata associated with a filesystem object referred
-        /// to by a directory descriptor and a relative path.
-        ///
-        /// This performs the same hash computation as `metadata-hash`.
-        @since(version = 0.3.0-rc-2025-09-16)
-        metadata-hash-at: async func(
-            /// Flags determining the method of how the path is resolved.
-            path-flags: path-flags,
-            /// The relative path of the file or directory to inspect.
-            path: string,
-        ) -> result<metadata-hash-value, error-code>;
-    }
-}
diff --git a/wit/deps/filesystem-0.3.0-rc-2025-09-16/world.wit b/wit/deps/filesystem-0.3.0-rc-2025-09-16/world.wit
deleted file mode 100644
index 87fc727..0000000
--- a/wit/deps/filesystem-0.3.0-rc-2025-09-16/world.wit
+++ /dev/null
@@ -1,9 +0,0 @@
-package wasi:filesystem@0.3.0-rc-2025-09-16;
-
-@since(version = 0.3.0-rc-2025-09-16)
-world imports {
-    @since(version = 0.3.0-rc-2025-09-16)
-    import types;
-    @since(version = 0.3.0-rc-2025-09-16)
-    import preopens;
-}
diff --git a/wit/deps/filesystem-0.3.0-rc-2026-01-06.wit b/wit/deps/filesystem-0.3.0-rc-2026-01-06.wit
new file mode 100644
index 0000000..0ac149c
--- /dev/null
+++ b/wit/deps/filesystem-0.3.0-rc-2026-01-06.wit
@@ -0,0 +1,553 @@
+package wasi:filesystem@0.3.0-rc-2026-01-06;
+
+/// WASI filesystem is a filesystem API primarily intended to let users run WASI
+/// programs that access their files on their existing filesystems, without
+/// significant overhead.
+///
+/// It is intended to be roughly portable between Unix-family platforms and
+/// Windows, though it does not hide many of the major differences.
+///
+/// Paths are passed as interface-type `string`s, meaning they must consist of
+/// a sequence of Unicode Scalar Values (USVs). Some filesystems may contain
+/// paths which are not accessible by this API.
+///
+/// The directory separator in WASI is always the forward-slash (`/`).
+///
+/// All paths in WASI are relative paths, and are interpreted relative to a
+/// `descriptor` referring to a base directory. If a `path` argument to any WASI
+/// function starts with `/`, or if any step of resolving a `path`, including
+/// `..` and symbolic link steps, reaches a directory outside of the base
+/// directory, or reaches a symlink to an absolute or rooted path in the
+/// underlying filesystem, the function fails with `error-code::not-permitted`.
+///
+/// For more information about WASI path resolution and sandboxing, see
+/// [WASI filesystem path resolution].
+///
+/// [WASI filesystem path resolution]: https://github.com/WebAssembly/wasi-filesystem/blob/main/path-resolution.md
+@since(version = 0.3.0-rc-2026-01-06)
+interface types {
+  @since(version = 0.3.0-rc-2026-01-06)
+  use wasi:clocks/system-clock@0.3.0-rc-2026-01-06.{instant};
+
+  /// File size or length of a region within a file.
+  @since(version = 0.3.0-rc-2026-01-06)
+  type filesize = u64;
+
+  /// The type of a filesystem object referenced by a descriptor.
+  ///
+  /// Note: This was called `filetype` in earlier versions of WASI.
+  @since(version = 0.3.0-rc-2026-01-06)
+  enum descriptor-type {
+    /// The type of the descriptor or file is unknown or is different from
+    /// any of the other types specified.
+    unknown,
+    /// The descriptor refers to a block device inode.
+    block-device,
+    /// The descriptor refers to a character device inode.
+    character-device,
+    /// The descriptor refers to a directory inode.
+    directory,
+    /// The descriptor refers to a named pipe.
+    fifo,
+    /// The file refers to a symbolic link inode.
+    symbolic-link,
+    /// The descriptor refers to a regular file inode.
+    regular-file,
+    /// The descriptor refers to a socket.
+    socket,
+  }
+
+  /// Descriptor flags.
+  ///
+  /// Note: This was called `fdflags` in earlier versions of WASI.
+  @since(version = 0.3.0-rc-2026-01-06)
+  flags descriptor-flags {
+    /// Read mode: Data can be read.
+    read,
+    /// Write mode: Data can be written to.
+    write,
+    /// Request that writes be performed according to synchronized I/O file
+    /// integrity completion. The data stored in the file and the file's
+    /// metadata are synchronized. This is similar to `O_SYNC` in POSIX.
+    ///
+    /// The precise semantics of this operation have not yet been defined for
+    /// WASI. At this time, it should be interpreted as a request, and not a
+    /// requirement.
+    file-integrity-sync,
+    /// Request that writes be performed according to synchronized I/O data
+    /// integrity completion. Only the data stored in the file is
+    /// synchronized. This is similar to `O_DSYNC` in POSIX.
+    ///
+    /// The precise semantics of this operation have not yet been defined for
+    /// WASI. At this time, it should be interpreted as a request, and not a
+    /// requirement.
+    data-integrity-sync,
+    /// Requests that reads be performed at the same level of integrity
+    /// requested for writes. This is similar to `O_RSYNC` in POSIX.
+    ///
+    /// The precise semantics of this operation have not yet been defined for
+    /// WASI. At this time, it should be interpreted as a request, and not a
+    /// requirement.
+    requested-write-sync,
+    /// Mutating directories mode: Directory contents may be mutated.
+    ///
+    /// When this flag is unset on a descriptor, operations using the
+    /// descriptor which would create, rename, delete, modify the data or
+    /// metadata of filesystem objects, or obtain another handle which
+    /// would permit any of those, shall fail with `error-code::read-only` if
+    /// they would otherwise succeed.
+    ///
+    /// This may only be set on directories.
+    mutate-directory,
+  }
+
+  /// Flags determining the method of how paths are resolved.
+  @since(version = 0.3.0-rc-2026-01-06)
+  flags path-flags {
+    /// As long as the resolved path corresponds to a symbolic link, it is
+    /// expanded.
+    symlink-follow,
+  }
+
+  /// Open flags used by `open-at`.
+  @since(version = 0.3.0-rc-2026-01-06)
+  flags open-flags {
+    /// Create file if it does not exist, similar to `O_CREAT` in POSIX.
+    create,
+    /// Fail if not a directory, similar to `O_DIRECTORY` in POSIX.
+    directory,
+    /// Fail if file already exists, similar to `O_EXCL` in POSIX.
+    exclusive,
+    /// Truncate file to size 0, similar to `O_TRUNC` in POSIX.
+    truncate,
+  }
+
+  /// Number of hard links to an inode.
+  @since(version = 0.3.0-rc-2026-01-06)
+  type link-count = u64;
+
+  /// File attributes.
+  ///
+  /// Note: This was called `filestat` in earlier versions of WASI.
+  @since(version = 0.3.0-rc-2026-01-06)
+  record descriptor-stat {
+    /// File type.
+    %type: descriptor-type,
+    /// Number of hard links to the file.
+    link-count: link-count,
+    /// For regular files, the file size in bytes. For symbolic links, the
+    /// length in bytes of the pathname contained in the symbolic link.
+    size: filesize,
+    /// Last data access timestamp.
+    ///
+    /// If the `option` is none, the platform doesn't maintain an access
+    /// timestamp for this file.
+    data-access-timestamp: option<instant>,
+    /// Last data modification timestamp.
+    ///
+    /// If the `option` is none, the platform doesn't maintain a
+    /// modification timestamp for this file.
+    data-modification-timestamp: option<instant>,
+    /// Last file status-change timestamp.
+    ///
+    /// If the `option` is none, the platform doesn't maintain a
+    /// status-change timestamp for this file.
+    status-change-timestamp: option<instant>,
+  }
+
+  /// When setting a timestamp, this gives the value to set it to.
+  @since(version = 0.3.0-rc-2026-01-06)
+  variant new-timestamp {
+    /// Leave the timestamp set to its previous value.
+    no-change,
+    /// Set the timestamp to the current time of the system clock associated
+    /// with the filesystem.
+    now,
+    /// Set the timestamp to the given value.
+    timestamp(instant),
+  }
+
+  /// A directory entry.
+  record directory-entry {
+    /// The type of the file referred to by this directory entry.
+    %type: descriptor-type,
+    /// The name of the object.
+    name: string,
+  }
+
+  /// Error codes returned by functions, similar to `errno` in POSIX.
+  /// Not all of these error codes are returned by the functions provided by this
+  /// API; some are used in higher-level library layers, and others are provided
+  /// merely for alignment with POSIX.
+  enum error-code {
+    /// Permission denied, similar to `EACCES` in POSIX.
+    access,
+    /// Connection already in progress, similar to `EALREADY` in POSIX.
+    already,
+    /// Bad descriptor, similar to `EBADF` in POSIX.
+    bad-descriptor,
+    /// Device or resource busy, similar to `EBUSY` in POSIX.
+    busy,
+    /// Resource deadlock would occur, similar to `EDEADLK` in POSIX.
+    deadlock,
+    /// Storage quota exceeded, similar to `EDQUOT` in POSIX.
+    quota,
+    /// File exists, similar to `EEXIST` in POSIX.
+    exist,
+    /// File too large, similar to `EFBIG` in POSIX.
+    file-too-large,
+    /// Illegal byte sequence, similar to `EILSEQ` in POSIX.
+    illegal-byte-sequence,
+    /// Operation in progress, similar to `EINPROGRESS` in POSIX.
+    in-progress,
+    /// Interrupted function, similar to `EINTR` in POSIX.
+    interrupted,
+    /// Invalid argument, similar to `EINVAL` in POSIX.
+    invalid,
+    /// I/O error, similar to `EIO` in POSIX.
+    io,
+    /// Is a directory, similar to `EISDIR` in POSIX.
+    is-directory,
+    /// Too many levels of symbolic links, similar to `ELOOP` in POSIX.
+    loop,
+    /// Too many links, similar to `EMLINK` in POSIX.
+    too-many-links,
+    /// Message too large, similar to `EMSGSIZE` in POSIX.
+    message-size,
+    /// Filename too long, similar to `ENAMETOOLONG` in POSIX.
+    name-too-long,
+    /// No such device, similar to `ENODEV` in POSIX.
+    no-device,
+    /// No such file or directory, similar to `ENOENT` in POSIX.
+    no-entry,
+    /// No locks available, similar to `ENOLCK` in POSIX.
+    no-lock,
+    /// Not enough space, similar to `ENOMEM` in POSIX.
+    insufficient-memory,
+    /// No space left on device, similar to `ENOSPC` in POSIX.
+    insufficient-space,
+    /// Not a directory or a symbolic link to a directory, similar to `ENOTDIR` in POSIX.
+    not-directory,
+    /// Directory not empty, similar to `ENOTEMPTY` in POSIX.
+    not-empty,
+    /// State not recoverable, similar to `ENOTRECOVERABLE` in POSIX.
+    not-recoverable,
+    /// Not supported, similar to `ENOTSUP` and `ENOSYS` in POSIX.
+    unsupported,
+    /// Inappropriate I/O control operation, similar to `ENOTTY` in POSIX.
+    no-tty,
+    /// No such device or address, similar to `ENXIO` in POSIX.
+    no-such-device,
+    /// Value too large to be stored in data type, similar to `EOVERFLOW` in POSIX.
+    overflow,
+    /// Operation not permitted, similar to `EPERM` in POSIX.
+    not-permitted,
+    /// Broken pipe, similar to `EPIPE` in POSIX.
+    pipe,
+    /// Read-only file system, similar to `EROFS` in POSIX.
+    read-only,
+    /// Invalid seek, similar to `ESPIPE` in POSIX.
+    invalid-seek,
+    /// Text file busy, similar to `ETXTBSY` in POSIX.
+    text-file-busy,
+    /// Cross-device link, similar to `EXDEV` in POSIX.
+    cross-device,
+  }
+
+  /// File or memory access pattern advisory information.
+  @since(version = 0.3.0-rc-2026-01-06)
+  enum advice {
+    /// The application has no advice to give on its behavior with respect
+    /// to the specified data.
+    normal,
+    /// The application expects to access the specified data sequentially
+    /// from lower offsets to higher offsets.
+    sequential,
+    /// The application expects to access the specified data in a random
+    /// order.
+    random,
+    /// The application expects to access the specified data in the near
+    /// future.
+    will-need,
+    /// The application expects that it will not access the specified data
+    /// in the near future.
+    dont-need,
+    /// The application expects to access the specified data once and then
+    /// not reuse it thereafter.
+    no-reuse,
+  }
+
+  /// A 128-bit hash value, split into parts because wasm doesn't have a
+  /// 128-bit integer type.
+  @since(version = 0.3.0-rc-2026-01-06)
+  record metadata-hash-value {
+    /// 64 bits of a 128-bit hash value.
+    lower: u64,
+    /// Another 64 bits of a 128-bit hash value.
+    upper: u64,
+  }
+
+  /// A descriptor is a reference to a filesystem object, which may be a file,
+  /// directory, named pipe, special file, or other object on which filesystem
+  /// calls may be made.
+  @since(version = 0.3.0-rc-2026-01-06)
+  resource descriptor {
+    /// Return a stream for reading from a file.
+    ///
+    /// Multiple read, write, and append streams may be active on the same open
+    /// file and they do not interfere with each other.
+    ///
+    /// This function returns a `stream` which provides the data received from the
+    /// file, and a `future` providing additional error information in case an
+    /// error is encountered.
+    ///
+    /// If no error is encountered, `stream.read` on the `stream` will return
+    /// `read-status::closed` with no `error-context` and the future resolves to
+    /// the value `ok`. If an error is encountered, `stream.read` on the
+    /// `stream` returns `read-status::closed` with an `error-context` and the future
+    /// resolves to `err` with an `error-code`.
+    ///
+    /// Note: This is similar to `pread` in POSIX.
+    @since(version = 0.3.0-rc-2026-01-06)
+    read-via-stream: func(offset: filesize) -> tuple<stream<u8>, future<result<_, error-code>>>;
+    /// Return a stream for writing to a file, if available.
+    ///
+    /// May fail with an error-code describing why the file cannot be written.
+    ///
+    /// It is valid to write past the end of a file; the file is extended to the
+    /// extent of the write, with bytes between the previous end and the start of
+    /// the write set to zero.
+    ///
+    /// This function returns once either full contents of the stream are
+    /// written or an error is encountered.
+    ///
+    /// Note: This is similar to `pwrite` in POSIX.
+    @since(version = 0.3.0-rc-2026-01-06)
+    write-via-stream: async func(data: stream<u8>, offset: filesize) -> result<_, error-code>;
+    /// Return a stream for appending to a file, if available.
+    ///
+    /// May fail with an error-code describing why the file cannot be appended.
+    ///
+    /// This function returns once either full contents of the stream are
+    /// written or an error is encountered.
+    ///
+    /// Note: This is similar to `write` with `O_APPEND` in POSIX.
+    @since(version = 0.3.0-rc-2026-01-06)
+    append-via-stream: async func(data: stream<u8>) -> result<_, error-code>;
+    /// Provide file advisory information on a descriptor.
+    ///
+    /// This is similar to `posix_fadvise` in POSIX.
+    @since(version = 0.3.0-rc-2026-01-06)
+    advise: async func(offset: filesize, length: filesize, advice: advice) -> result<_, error-code>;
+    /// Synchronize the data of a file to disk.
+    ///
+    /// This function succeeds with no effect if the file descriptor is not
+    /// opened for writing.
+    ///
+    /// Note: This is similar to `fdatasync` in POSIX.
+    @since(version = 0.3.0-rc-2026-01-06)
+    sync-data: async func() -> result<_, error-code>;
+    /// Get flags associated with a descriptor.
+    ///
+    /// Note: This returns similar flags to `fcntl(fd, F_GETFL)` in POSIX.
+    ///
+    /// Note: This returns the value that was the `fs_flags` value returned
+    /// from `fdstat_get` in earlier versions of WASI.
+    @since(version = 0.3.0-rc-2026-01-06)
+    get-flags: async func() -> result<descriptor-flags, error-code>;
+    /// Get the dynamic type of a descriptor.
+    ///
+    /// Note: This returns the same value as the `type` field of the `fd-stat`
+    /// returned by `stat`, `stat-at` and similar.
+    ///
+    /// Note: This returns similar flags to the `st_mode & S_IFMT` value provided
+    /// by `fstat` in POSIX.
+    ///
+    /// Note: This returns the value that was the `fs_filetype` value returned
+    /// from `fdstat_get` in earlier versions of WASI.
+    @since(version = 0.3.0-rc-2026-01-06)
+    get-type: async func() -> result<descriptor-type, error-code>;
+    /// Adjust the size of an open file. If this increases the file's size, the
+    /// extra bytes are filled with zeros.
+    ///
+    /// Note: This was called `fd_filestat_set_size` in earlier versions of WASI.
+    @since(version = 0.3.0-rc-2026-01-06)
+    set-size: async func(size: filesize) -> result<_, error-code>;
+    /// Adjust the timestamps of an open file or directory.
+    ///
+    /// Note: This is similar to `futimens` in POSIX.
+    ///
+    /// Note: This was called `fd_filestat_set_times` in earlier versions of WASI.
+    @since(version = 0.3.0-rc-2026-01-06)
+    set-times: async func(data-access-timestamp: new-timestamp, data-modification-timestamp: new-timestamp) -> result<_, error-code>;
+    /// Read directory entries from a directory.
+    ///
+    /// On filesystems where directories contain entries referring to themselves
+    /// and their parents, often named `.` and `..` respectively, these entries
+    /// are omitted.
+    ///
+    /// This always returns a new stream which starts at the beginning of the
+    /// directory. Multiple streams may be active on the same directory, and they
+    /// do not interfere with each other.
+    ///
+    /// This function returns a future, which will resolve to an error code if
+    /// reading full contents of the directory fails.
+    @since(version = 0.3.0-rc-2026-01-06)
+    read-directory: async func() -> tuple<stream<directory-entry>, future<result<_, error-code>>>;
+    /// Synchronize the data and metadata of a file to disk.
+    ///
+    /// This function succeeds with no effect if the file descriptor is not
+    /// opened for writing.
+    ///
+    /// Note: This is similar to `fsync` in POSIX.
+    @since(version = 0.3.0-rc-2026-01-06)
+    sync: async func() -> result<_, error-code>;
+    /// Create a directory.
+    ///
+    /// Note: This is similar to `mkdirat` in POSIX.
+    @since(version = 0.3.0-rc-2026-01-06)
+    create-directory-at: async func(path: string) -> result<_, error-code>;
+    /// Return the attributes of an open file or directory.
+    ///
+    /// Note: This is similar to `fstat` in POSIX, except that it does not return
+    /// device and inode information. For testing whether two descriptors refer to
+    /// the same underlying filesystem object, use `is-same-object`. To obtain
+    /// additional data that can be used do determine whether a file has been
+    /// modified, use `metadata-hash`.
+    ///
+    /// Note: This was called `fd_filestat_get` in earlier versions of WASI.
+    @since(version = 0.3.0-rc-2026-01-06)
+    stat: async func() -> result<descriptor-stat, error-code>;
+    /// Return the attributes of a file or directory.
+    ///
+    /// Note: This is similar to `fstatat` in POSIX, except that it does not
+    /// return device and inode information. See the `stat` description for a
+    /// discussion of alternatives.
+    ///
+    /// Note: This was called `path_filestat_get` in earlier versions of WASI.
+    @since(version = 0.3.0-rc-2026-01-06)
+    stat-at: async func(path-flags: path-flags, path: string) -> result<descriptor-stat, error-code>;
+    /// Adjust the timestamps of a file or directory.
+    ///
+    /// Note: This is similar to `utimensat` in POSIX.
+    ///
+    /// Note: This was called `path_filestat_set_times` in earlier versions of
+    /// WASI.
+    @since(version = 0.3.0-rc-2026-01-06)
+    set-times-at: async func(path-flags: path-flags, path: string, data-access-timestamp: new-timestamp, data-modification-timestamp: new-timestamp) -> result<_, error-code>;
+    /// Create a hard link.
+    ///
+    /// Fails with `error-code::no-entry` if the old path does not exist,
+    /// with `error-code::exist` if the new path already exists, and
+    /// `error-code::not-permitted` if the old path is not a file.
+    ///
+    /// Note: This is similar to `linkat` in POSIX.
+    @since(version = 0.3.0-rc-2026-01-06)
+    link-at: async func(old-path-flags: path-flags, old-path: string, new-descriptor: borrow<descriptor>, new-path: string) -> result<_, error-code>;
+    /// Open a file or directory.
+    ///
+    /// If `flags` contains `descriptor-flags::mutate-directory`, and the base
+    /// descriptor doesn't have `descriptor-flags::mutate-directory` set,
+    /// `open-at` fails with `error-code::read-only`.
+    ///
+    /// If `flags` contains `write` or `mutate-directory`, or `open-flags`
+    /// contains `truncate` or `create`, and the base descriptor doesn't have
+    /// `descriptor-flags::mutate-directory` set, `open-at` fails with
+    /// `error-code::read-only`.
+    ///
+    /// Note: This is similar to `openat` in POSIX.
+    @since(version = 0.3.0-rc-2026-01-06)
+    open-at: async func(path-flags: path-flags, path: string, open-flags: open-flags, %flags: descriptor-flags) -> result<descriptor, error-code>;
+    /// Read the contents of a symbolic link.
+    ///
+    /// If the contents contain an absolute or rooted path in the underlying
+    /// filesystem, this function fails with `error-code::not-permitted`.
+    ///
+    /// Note: This is similar to `readlinkat` in POSIX.
+    @since(version = 0.3.0-rc-2026-01-06)
+    readlink-at: async func(path: string) -> result<string, error-code>;
+    /// Remove a directory.
+    ///
+    /// Return `error-code::not-empty` if the directory is not empty.
+    ///
+    /// Note: This is similar to `unlinkat(fd, path, AT_REMOVEDIR)` in POSIX.
+    @since(version = 0.3.0-rc-2026-01-06)
+    remove-directory-at: async func(path: string) -> result<_, error-code>;
+    /// Rename a filesystem object.
+    ///
+    /// Note: This is similar to `renameat` in POSIX.
+    @since(version = 0.3.0-rc-2026-01-06)
+    rename-at: async func(old-path: string, new-descriptor: borrow<descriptor>, new-path: string) -> result<_, error-code>;
+    /// Create a symbolic link (also known as a "symlink").
+    ///
+    /// If `old-path` starts with `/`, the function fails with
+    /// `error-code::not-permitted`.
+    ///
+    /// Note: This is similar to `symlinkat` in POSIX.
+    @since(version = 0.3.0-rc-2026-01-06)
+    symlink-at: async func(old-path: string, new-path: string) -> result<_, error-code>;
+    /// Unlink a filesystem object that is not a directory.
+    ///
+    /// Return `error-code::is-directory` if the path refers to a directory.
+    /// Note: This is similar to `unlinkat(fd, path, 0)` in POSIX.
+    @since(version = 0.3.0-rc-2026-01-06)
+    unlink-file-at: async func(path: string) -> result<_, error-code>;
+    /// Test whether two descriptors refer to the same filesystem object.
+    ///
+    /// In POSIX, this corresponds to testing whether the two descriptors have the
+    /// same device (`st_dev`) and inode (`st_ino` or `d_ino`) numbers.
+    /// wasi-filesystem does not expose device and inode numbers, so this function
+    /// may be used instead.
+    @since(version = 0.3.0-rc-2026-01-06)
+    is-same-object: async func(other: borrow<descriptor>) -> bool;
+    /// Return a hash of the metadata associated with a filesystem object referred
+    /// to by a descriptor.
+    ///
+    /// This returns a hash of the last-modification timestamp and file size, and
+    /// may also include the inode number, device number, birth timestamp, and
+    /// other metadata fields that may change when the file is modified or
+    /// replaced. It may also include a secret value chosen by the
+    /// implementation and not otherwise exposed.
+    ///
+    /// Implementations are encouraged to provide the following properties:
+    ///
+    ///  - If the file is not modified or replaced, the computed hash value should
+    ///    usually not change.
+    ///  - If the object is modified or replaced, the computed hash value should
+    ///    usually change.
+    ///  - The inputs to the hash should not be easily computable from the
+    ///    computed hash.
+    ///
+    /// However, none of these is required.
+    @since(version = 0.3.0-rc-2026-01-06)
+    metadata-hash: async func() -> result<metadata-hash-value, error-code>;
+    /// Return a hash of the metadata associated with a filesystem object referred
+    /// to by a directory descriptor and a relative path.
+    ///
+    /// This performs the same hash computation as `metadata-hash`.
+    @since(version = 0.3.0-rc-2026-01-06)
+    metadata-hash-at: async func(path-flags: path-flags, path: string) -> result<metadata-hash-value, error-code>;
+  }
+}
+
+@since(version = 0.3.0-rc-2026-01-06)
+interface preopens {
+  @since(version = 0.3.0-rc-2026-01-06)
+  use types.{descriptor};
+
+  /// Return the set of preopened directories, and their paths.
+  @since(version = 0.3.0-rc-2026-01-06)
+  get-directories: func() -> list<tuple<descriptor, string>>;
+}
+
+@since(version = 0.3.0-rc-2026-01-06)
+world imports {
+  @since(version = 0.3.0-rc-2026-01-06)
+  import wasi:clocks/types@0.3.0-rc-2026-01-06;
+  @since(version = 0.3.0-rc-2026-01-06)
+  import wasi:clocks/system-clock@0.3.0-rc-2026-01-06;
+  @since(version = 0.3.0-rc-2026-01-06)
+  import types;
+  @since(version = 0.3.0-rc-2026-01-06)
+  import preopens;
+}
diff --git a/wit/deps/http-0.3.0-rc-2025-09-16/handler.wit b/wit/deps/http-0.3.0-rc-2025-09-16/handler.wit
deleted file mode 100644
index e4446cb..0000000
--- a/wit/deps/http-0.3.0-rc-2025-09-16/handler.wit
+++ /dev/null
@@ -1,17 +0,0 @@
-/// This interface defines a handler of HTTP Requests.  It may be imported by
-/// components which wish to send HTTP Requests and also exported by components
-/// which can respond to HTTP Requests.  In addition, it may be used to pass
-/// a request from one component to another without any use of a network.
-interface handler {
-  use types.{request, response, error-code};
-
-  /// When exported, this function may be called with either an incoming
-  /// request read from the network or a request synthesized or forwarded by
-  /// another component.
-  ///
-  /// When imported, this function may be used to either send an outgoing
-  /// request over the network or pass it to another component.
-  handle: async func(
-    request: request,
-  ) -> result<response, error-code>;
-}
diff --git a/wit/deps/http-0.3.0-rc-2025-09-16/proxy.wit b/wit/deps/http-0.3.0-rc-2025-09-16/proxy.wit
deleted file mode 100644
index 223083e..0000000
--- a/wit/deps/http-0.3.0-rc-2025-09-16/proxy.wit
+++ /dev/null
@@ -1,44 +0,0 @@
-package wasi:http@0.3.0-rc-2025-09-16;
-
-/// The `wasi:http/imports` world imports all the APIs for HTTP proxies.
-/// It is intended to be `include`d in other worlds.
-world imports {
-  /// HTTP proxies have access to time and randomness.
-  include wasi:clocks/imports@0.3.0-rc-2025-09-16;
-  import wasi:random/random@0.3.0-rc-2025-09-16;
-
-  /// Proxies have standard output and error streams which are expected to
-  /// terminate in a developer-facing console provided by the host.
-  import wasi:cli/stdout@0.3.0-rc-2025-09-16;
-  import wasi:cli/stderr@0.3.0-rc-2025-09-16;
-
-  /// TODO: this is a temporary workaround until component tooling is able to
-  /// gracefully handle the absence of stdin. Hosts must return an eof stream
-  /// for this import, which is what wasi-libc + tooling will do automatically
-  /// when this import is properly removed.
-  import wasi:cli/stdin@0.3.0-rc-2025-09-16;
-
-  /// This is the default handler to use when user code simply wants to make an
-  /// HTTP request (e.g., via `fetch()`).
-  ///
-  /// This may also be used to pass synthesized or forwarded requests to another
-  /// component.
-  import handler;
-}
-
-/// The `wasi:http/proxy` world captures a widely-implementable intersection of
-/// hosts that includes HTTP forward and reverse proxies. Components targeting
-/// this world may concurrently stream in and out any number of incoming and
-/// outgoing HTTP requests.
-world proxy {
-  include imports;
-
-  /// The host delivers incoming HTTP requests to a component by calling the
-  /// `handle` function of this exported interface. A host may arbitrarily reuse
-  /// or not reuse component instance when delivering incoming HTTP requests and
-  /// thus a component must be able to handle 0..N calls to `handle`.
-  ///
-  /// This may also be used to receive synthesized or forwarded requests from
-  /// another component.
-  export handler;
-}
diff --git a/wit/deps/http-0.3.0-rc-2025-09-16/types.wit b/wit/deps/http-0.3.0-rc-2026-01-06.wit
similarity index 79%
rename from wit/deps/http-0.3.0-rc-2025-09-16/types.wit
rename to wit/deps/http-0.3.0-rc-2026-01-06.wit
index 8269eea..3860af7 100644
--- a/wit/deps/http-0.3.0-rc-2025-09-16/types.wit
+++ b/wit/deps/http-0.3.0-rc-2026-01-06.wit
@@ -1,7 +1,9 @@
+package wasi:http@0.3.0-rc-2026-01-06;
+
 /// This interface defines all of the types and methods for implementing HTTP
 /// Requests and Responses, as well as their headers, trailers, and bodies.
 interface types {
-  use wasi:clocks/monotonic-clock@0.3.0-rc-2025-09-16.{duration};
+  use wasi:clocks/types@0.3.0-rc-2026-01-06.{duration};
 
   /// This type corresponds to HTTP standard Methods.
   variant method {
@@ -14,14 +16,32 @@ interface types {
     options,
     trace,
     patch,
-    other(string)
+    other(string),
   }
 
   /// This type corresponds to HTTP standard Related Schemes.
   variant scheme {
     HTTP,
     HTTPS,
-    other(string)
+    other(string),
+  }
+
+  /// Defines the case payload type for `DNS-error` above:
+  record DNS-error-payload {
+    rcode: option<string>,
+    info-code: option<u16>,
+  }
+
+  /// Defines the case payload type for `TLS-alert-received` above:
+  record TLS-alert-received-payload {
+    alert-id: option<u8>,
+    alert-message: option<string>,
+  }
+
+  /// Defines the case payload type for `HTTP-response-{header,trailer}-size` above:
+  record field-size-payload {
+    field-name: option<string>,
+    field-size: option<u32>,
   }
 
   /// These cases are inspired by the IANA HTTP Proxy Error Types:
@@ -70,25 +90,7 @@ interface types {
     /// unstructured description of the error. Users should not depend on the
     /// string for diagnosing errors, as it's not required to be consistent
     /// between implementations.
-    internal-error(option<string>)
-  }
-
-  /// Defines the case payload type for `DNS-error` above:
-  record DNS-error-payload {
-    rcode: option<string>,
-    info-code: option<u16>
-  }
-
-  /// Defines the case payload type for `TLS-alert-received` above:
-  record TLS-alert-received-payload {
-    alert-id: option<u8>,
-    alert-message: option<string>
-  }
-
-  /// Defines the case payload type for `HTTP-response-{header,trailer}-size` above:
-  record field-size-payload {
-    field-name: option<string>,
-    field-size: option<u32>
+    internal-error(option<string>),
   }
 
   /// This type enumerates the different kinds of errors that may occur when
@@ -98,11 +100,9 @@ interface types {
     /// syntactically invalid when used with an operation that sets headers in a
     /// `fields`.
     invalid-syntax,
-
     /// This error indicates that a forbidden `field-name` was used when trying
     /// to set a header in a `fields`.
     forbidden,
-
     /// This error indicates that the operation on the `fields` was not
     /// permitted because the fields are immutable.
     immutable,
@@ -113,7 +113,6 @@ interface types {
   variant request-options-error {
     /// Indicates the specified field is not supported by this implementation.
     not-supported,
-
     /// Indicates that the operation on the `request-options` was not permitted
     /// because it is immutable.
     immutable,
@@ -146,12 +145,10 @@ interface types {
   /// resource should use that original casing when serializing the fields for
   /// transport or when returning them from a method.
   resource fields {
-
     /// Construct an empty HTTP Fields.
     ///
     /// The resulting `fields` is mutable.
     constructor();
-
     /// Construct an HTTP Fields.
     ///
     /// The resulting `fields` is mutable.
@@ -167,32 +164,25 @@ interface types {
     ///
     /// An error result will be returned if any header or value was
     /// syntactically invalid, or if a header was forbidden.
-    from-list: static func(
-      entries: list<tuple<field-name,field-value>>
-    ) -> result<fields, header-error>;
-
+    from-list: static func(entries: list<tuple<field-name, field-value>>) -> result<fields, header-error>;
     /// Get all of the values corresponding to a name. If the name is not present
     /// in this `fields`, an empty list is returned. However, if the name is
     /// present but empty, this is represented by a list with one or more
     /// empty field-values present.
     get: func(name: field-name) -> list<field-value>;
-
     /// Returns `true` when the name is present in this `fields`. If the name is
     /// syntactically invalid, `false` is returned.
     has: func(name: field-name) -> bool;
-
     /// Set all of the values for a name. Clears any existing values for that
     /// name, if they have been set.
     ///
     /// Fails with `header-error.immutable` if the `fields` are immutable.
     set: func(name: field-name, value: list<field-value>) -> result<_, header-error>;
-
     /// Delete all values for a name. Does nothing if no values for the name
     /// exist.
     ///
     /// Fails with `header-error.immutable` if the `fields` are immutable.
     delete: func(name: field-name) -> result<_, header-error>;
-
     /// Delete all values for a name. Does nothing if no values for the name
     /// exist.
     ///
@@ -200,13 +190,11 @@ interface types {
     ///
     /// Fails with `header-error.immutable` if the `fields` are immutable.
     get-and-delete: func(name: field-name) -> result<list<field-value>, header-error>;
-
     /// Append a value for a name. Does not change or delete any existing
     /// values for that name.
     ///
     /// Fails with `header-error.immutable` if the `fields` are immutable.
     append: func(name: field-name, value: field-value) -> result<_, header-error>;
-
     /// Retrieve the full set of names and values in the Fields. Like the
     /// constructor, the list represents each name-value pair.
     ///
@@ -216,8 +204,7 @@ interface types {
     ///
     /// The names and values are always returned in the original casing and in
     /// the order in which they will be serialized for transport.
-    copy-all: func() -> list<tuple<field-name,field-value>>;
-
+    copy-all: func() -> list<tuple<field-name, field-value>>;
     /// Make a deep copy of the Fields. Equivalent in behavior to calling the
     /// `fields` constructor on the return value of `copy-all`. The resulting
     /// `fields` is mutable.
@@ -232,7 +219,6 @@ interface types {
 
   /// Represents an HTTP Request.
   resource request {
-
     /// Construct a new `request` with a default `method` of `GET`, and
     /// `none` values for `path-with-query`, `scheme`, and `authority`.
     ///
@@ -254,19 +240,12 @@ interface types {
     /// to reject invalid constructions of `request`.
     ///
     /// The returned future resolves to result of transmission of this request.
-    new: static func(
-      headers: headers,
-      contents: option<stream<u8>>,
-      trailers: future<result<option<trailers>, error-code>>,
-      options: option<request-options>
-    ) -> tuple<request, future<result<_, error-code>>>;
-
+    new: static func(headers: headers, contents: option<stream<u8>>, trailers: future<result<option<trailers>, error-code>>, options: option<request-options>) -> tuple<request, future<result<_, error-code>>>;
     /// Get the Method for the Request.
     get-method: func() -> method;
     /// Set the Method for the Request. Fails if the string present in a
     /// `method.other` argument is not a syntactically valid method.
     set-method: func(method: method) -> result;
-
     /// Get the combination of the HTTP Path and Query for the Request.  When
     /// `none`, this represents an empty Path and empty Query.
     get-path-with-query: func() -> option<string>;
@@ -274,7 +253,6 @@ interface types {
     /// `none`, this represents an empty Path and empty Query. Fails is the
     /// string given is not a syntactically valid path and query uri component.
     set-path-with-query: func(path-with-query: option<string>) -> result;
-
     /// Get the HTTP Related Scheme for the Request. When `none`, the
     /// implementation may choose an appropriate default scheme.
     get-scheme: func() -> option<scheme>;
@@ -282,7 +260,6 @@ interface types {
     /// implementation may choose an appropriate default scheme. Fails if the
     /// string given is not a syntactically valid uri scheme.
     set-scheme: func(scheme: option<scheme>) -> result;
-
     /// Get the authority of the Request's target URI. A value of `none` may be used
     /// with Related Schemes which do not require an authority. The HTTP and
     /// HTTPS schemes always require an authority.
@@ -292,7 +269,6 @@ interface types {
     /// HTTPS schemes always require an authority. Fails if the string given is
     /// not a syntactically valid URI authority.
     set-authority: func(authority: option<string>) -> result;
-
     /// Get the `request-options` to be associated with this request
     ///
     /// The returned `request-options` resource is immutable: `set-*` operations
@@ -302,13 +278,11 @@ interface types {
     /// the parent `request` is dropped, or its ownership is transferred to
     /// another component by e.g. `handler.handle`.
     get-options: func() -> option<request-options>;
-
     /// Get the headers associated with the Request.
     ///
     /// The returned `headers` resource is immutable: `set`, `append`, and
     /// `delete` operations will fail with `header-error.immutable`.
     get-headers: func() -> headers;
-
     /// Get body of the Request.
     ///
     /// Stream returned by this method represents the contents of the body.
@@ -333,32 +307,25 @@ interface types {
   resource request-options {
     /// Construct a default `request-options` value.
     constructor();
-
     /// The timeout for the initial connect to the HTTP Server.
     get-connect-timeout: func() -> option<duration>;
-
     /// Set the timeout for the initial connect to the HTTP Server. An error
     /// return value indicates that this timeout is not supported or that this
     /// handle is immutable.
     set-connect-timeout: func(duration: option<duration>) -> result<_, request-options-error>;
-
     /// The timeout for receiving the first byte of the Response body.
     get-first-byte-timeout: func() -> option<duration>;
-
     /// Set the timeout for receiving the first byte of the Response body. An
     /// error return value indicates that this timeout is not supported or that
     /// this handle is immutable.
     set-first-byte-timeout: func(duration: option<duration>) -> result<_, request-options-error>;
-
     /// The timeout for receiving subsequent chunks of bytes in the Response
     /// body stream.
     get-between-bytes-timeout: func() -> option<duration>;
-
     /// Set the timeout for receiving subsequent chunks of bytes in the Response
     /// body stream. An error return value indicates that this timeout is not
     /// supported or that this handle is immutable.
     set-between-bytes-timeout: func(duration: option<duration>) -> result<_, request-options-error>;
-
     /// Make a deep copy of the `request-options`.
     /// The resulting `request-options` is mutable.
     clone: func() -> request-options;
@@ -369,7 +336,6 @@ interface types {
 
   /// Represents an HTTP Response.
   resource response {
-
     /// Construct a new `response`, with a default `status-code` of `200`.
     /// If a different `status-code` is needed, it must be set via the
     /// `set-status-code` method.
@@ -383,25 +349,17 @@ interface types {
     /// will be closed immediately.
     ///
     /// The returned future resolves to result of transmission of this response.
-    new: static func(
-      headers: headers,
-      contents: option<stream<u8>>,
-      trailers: future<result<option<trailers>, error-code>>,
-    ) -> tuple<response, future<result<_, error-code>>>;
-
+    new: static func(headers: headers, contents: option<stream<u8>>, trailers: future<result<option<trailers>, error-code>>) -> tuple<response, future<result<_, error-code>>>;
     /// Get the HTTP Status Code for the Response.
     get-status-code: func() -> status-code;
-
     /// Set the HTTP Status Code for the Response. Fails if the status-code
     /// given is not a valid http status code.
     set-status-code: func(status-code: status-code) -> result;
-
     /// Get the headers associated with the Response.
     ///
     /// The returned `headers` resource is immutable: `set`, `append`, and
     /// `delete` operations will fail with `header-error.immutable`.
     get-headers: func() -> headers;
-
     /// Get body of the Response.
     ///
     /// Stream returned by this method represents the contents of the body.
@@ -417,3 +375,83 @@ interface types {
     consume-body: static func(this: response, res: future<result<_, error-code>>) -> tuple<stream<u8>, future<result<option<trailers>, error-code>>>;
   }
 }
+
+/// This interface defines a handler of HTTP Requests.
+///
+/// In a `wasi:http/service` this interface is exported to respond to an
+/// incoming HTTP Request with a Response.
+///
+/// In `wasi:http/middleware` this interface is both exported and imported as
+/// the "downstream" and "upstream" directions of the middleware chain.
+interface handler {
+  use types.{request, response, error-code};
+
+  /// This function may be called with either an incoming request read from the
+  /// network or a request synthesized or forwarded by another component.
+  handle: async func(request: request) -> result<response, error-code>;
+}
+
+/// This interface defines an HTTP client for sending "outgoing" requests.
+///
+/// Most components are expected to import this interface to provide the
+/// capability to send HTTP requests to arbitrary destinations on a network.
+///
+/// The type signature of `client.send` is the same as `handler.handle`. This
+/// duplication is currently necessary because some Component Model tooling
+/// (including WIT itself) is unable to represent a component importing two
+/// instances of the same interface. A `client.send` import may be linked
+/// directly to a `handler.handle` export to bypass the network.
+interface client {
+  use types.{request, response, error-code};
+
+  /// This function may be used to either send an outgoing request over the
+  /// network or to forward it to another component.
+  send: async func(request: request) -> result<response, error-code>;
+}
+
+/// The `wasi:http/service` world captures a broad category of HTTP services
+/// including web applications, API servers, and proxies. It may be `include`d
+/// in more specific worlds such as `wasi:http/middleware`.
+world service {
+  import wasi:cli/types@0.3.0-rc-2026-01-06;
+  import wasi:cli/stdout@0.3.0-rc-2026-01-06;
+  import wasi:cli/stderr@0.3.0-rc-2026-01-06;
+  import wasi:cli/stdin@0.3.0-rc-2026-01-06;
+  import wasi:clocks/types@0.3.0-rc-2026-01-06;
+  import types;
+  import client;
+  import wasi:clocks/monotonic-clock@0.3.0-rc-2026-01-06;
+  import wasi:clocks/system-clock@0.3.0-rc-2026-01-06;
+  @unstable(feature = clocks-timezone)
+  import wasi:clocks/timezone@0.3.0-rc-2026-01-06;
+  import wasi:random/random@0.3.0-rc-2026-01-06;
+  import wasi:random/insecure@0.3.0-rc-2026-01-06;
+  import wasi:random/insecure-seed@0.3.0-rc-2026-01-06;
+
+  export handler;
+}
+/// The `wasi:http/middleware` world captures HTTP services that forward HTTP
+/// Requests to another handler.
+///
+/// Components may implement this world to allow them to participate in handler
+/// "chains" where a `request` flows through handlers on its way to some terminal
+/// `service` and corresponding `response` flows in the opposite direction.
+world middleware {
+  import wasi:clocks/types@0.3.0-rc-2026-01-06;
+  import types;
+  import handler;
+  import wasi:cli/types@0.3.0-rc-2026-01-06;
+  import wasi:cli/stdout@0.3.0-rc-2026-01-06;
+  import wasi:cli/stderr@0.3.0-rc-2026-01-06;
+  import wasi:cli/stdin@0.3.0-rc-2026-01-06;
+  import client;
+  import wasi:clocks/monotonic-clock@0.3.0-rc-2026-01-06;
+  import wasi:clocks/system-clock@0.3.0-rc-2026-01-06;
+  @unstable(feature = clocks-timezone)
+  import wasi:clocks/timezone@0.3.0-rc-2026-01-06;
+  import wasi:random/random@0.3.0-rc-2026-01-06;
+  import wasi:random/insecure@0.3.0-rc-2026-01-06;
+  import wasi:random/insecure-seed@0.3.0-rc-2026-01-06;
+
+  export handler;
+}
diff --git a/wit/deps/random-0.3.0-rc-2025-09-16/insecure-seed.wit b/wit/deps/random-0.3.0-rc-2025-09-16/insecure-seed.wit
deleted file mode 100644
index 302151b..0000000
--- a/wit/deps/random-0.3.0-rc-2025-09-16/insecure-seed.wit
+++ /dev/null
@@ -1,27 +0,0 @@
-package wasi:random@0.3.0-rc-2025-09-16;
-/// The insecure-seed interface for seeding hash-map DoS resistance.
-///
-/// It is intended to be portable at least between Unix-family platforms and
-/// Windows.
-@since(version = 0.3.0-rc-2025-09-16)
-interface insecure-seed {
-    /// Return a 128-bit value that may contain a pseudo-random value.
-    ///
-    /// The returned value is not required to be computed from a CSPRNG, and may
-    /// even be entirely deterministic. Host implementations are encouraged to
-    /// provide pseudo-random values to any program exposed to
-    /// attacker-controlled content, to enable DoS protection built into many
-    /// languages' hash-map implementations.
-    ///
-    /// This function is intended to only be called once, by a source language
-    /// to initialize Denial Of Service (DoS) protection in its hash-map
-    /// implementation.
-    ///
-    /// # Expected future evolution
-    ///
-    /// This will likely be changed to a value import, to prevent it from being
-    /// called multiple times and potentially used for purposes other than DoS
-    /// protection.
-    @since(version = 0.3.0-rc-2025-09-16)
-    get-insecure-seed: func() -> tuple<u64, u64>;
-}
diff --git a/wit/deps/random-0.3.0-rc-2025-09-16/insecure.wit b/wit/deps/random-0.3.0-rc-2025-09-16/insecure.wit
deleted file mode 100644
index 39146e3..0000000
--- a/wit/deps/random-0.3.0-rc-2025-09-16/insecure.wit
+++ /dev/null
@@ -1,25 +0,0 @@
-package wasi:random@0.3.0-rc-2025-09-16;
-/// The insecure interface for insecure pseudo-random numbers.
-///
-/// It is intended to be portable at least between Unix-family platforms and
-/// Windows.
-@since(version = 0.3.0-rc-2025-09-16)
-interface insecure {
-    /// Return `len` insecure pseudo-random bytes.
-    ///
-    /// This function is not cryptographically secure. Do not use it for
-    /// anything related to security.
-    ///
-    /// There are no requirements on the values of the returned bytes, however
-    /// implementations are encouraged to return evenly distributed values with
-    /// a long period.
-    @since(version = 0.3.0-rc-2025-09-16)
-    get-insecure-random-bytes: func(len: u64) -> list<u8>;
-
-    /// Return an insecure pseudo-random `u64` value.
-    ///
-    /// This function returns the same type of pseudo-random data as
-    /// `get-insecure-random-bytes`, represented as a `u64`.
-    @since(version = 0.3.0-rc-2025-09-16)
-    get-insecure-random-u64: func() -> u64;
-}
diff --git a/wit/deps/random-0.3.0-rc-2025-09-16/random.wit b/wit/deps/random-0.3.0-rc-2025-09-16/random.wit
deleted file mode 100644
index fa1f111..0000000
--- a/wit/deps/random-0.3.0-rc-2025-09-16/random.wit
+++ /dev/null
@@ -1,29 +0,0 @@
-package wasi:random@0.3.0-rc-2025-09-16;
-/// WASI Random is a random data API.
-///
-/// It is intended to be portable at least between Unix-family platforms and
-/// Windows.
-@since(version = 0.3.0-rc-2025-09-16)
-interface random {
-    /// Return `len` cryptographically-secure random or pseudo-random bytes.
-    ///
-    /// This function must produce data at least as cryptographically secure and
-    /// fast as an adequately seeded cryptographically-secure pseudo-random
-    /// number generator (CSPRNG). It must not block, from the perspective of
-    /// the calling program, under any circumstances, including on the first
-    /// request and on requests for numbers of bytes. The returned data must
-    /// always be unpredictable.
-    ///
-    /// This function must always return fresh data. Deterministic environments
-    /// must omit this function, rather than implementing it with deterministic
-    /// data.
-    @since(version = 0.3.0-rc-2025-09-16)
-    get-random-bytes: func(len: u64) -> list<u8>;
-
-    /// Return a cryptographically-secure random or pseudo-random `u64` value.
-    ///
-    /// This function returns the same type of data as `get-random-bytes`,
-    /// represented as a `u64`.
-    @since(version = 0.3.0-rc-2025-09-16)
-    get-random-u64: func() -> u64;
-}
diff --git a/wit/deps/random-0.3.0-rc-2025-09-16/world.wit b/wit/deps/random-0.3.0-rc-2025-09-16/world.wit
deleted file mode 100644
index 08c5ed8..0000000
--- a/wit/deps/random-0.3.0-rc-2025-09-16/world.wit
+++ /dev/null
@@ -1,13 +0,0 @@
-package wasi:random@0.3.0-rc-2025-09-16;
-
-@since(version = 0.3.0-rc-2025-09-16)
-world imports {
-    @since(version = 0.3.0-rc-2025-09-16)
-    import random;
-
-    @since(version = 0.3.0-rc-2025-09-16)
-    import insecure;
-
-    @since(version = 0.3.0-rc-2025-09-16)
-    import insecure-seed;
-}
diff --git a/wit/deps/random-0.3.0-rc-2026-01-06.wit b/wit/deps/random-0.3.0-rc-2026-01-06.wit
new file mode 100644
index 0000000..8bb8731
--- /dev/null
+++ b/wit/deps/random-0.3.0-rc-2026-01-06.wit
@@ -0,0 +1,92 @@
+package wasi:random@0.3.0-rc-2026-01-06;
+
+/// The insecure-seed interface for seeding hash-map DoS resistance.
+///
+/// It is intended to be portable at least between Unix-family platforms and
+/// Windows.
+@since(version = 0.3.0-rc-2026-01-06)
+interface insecure-seed {
+  /// Return a 128-bit value that may contain a pseudo-random value.
+  ///
+  /// The returned value is not required to be computed from a CSPRNG, and may
+  /// even be entirely deterministic. Host implementations are encouraged to
+  /// provide pseudo-random values to any program exposed to
+  /// attacker-controlled content, to enable DoS protection built into many
+  /// languages' hash-map implementations.
+  ///
+  /// This function is intended to only be called once, by a source language
+  /// to initialize Denial Of Service (DoS) protection in its hash-map
+  /// implementation.
+  ///
+  /// # Expected future evolution
+  ///
+  /// This will likely be changed to a value import, to prevent it from being
+  /// called multiple times and potentially used for purposes other than DoS
+  /// protection.
+  @since(version = 0.3.0-rc-2026-01-06)
+  get-insecure-seed: func() -> tuple<u64, u64>;
+}
+
+/// The insecure interface for insecure pseudo-random numbers.
+///
+/// It is intended to be portable at least between Unix-family platforms and
+/// Windows.
+@since(version = 0.3.0-rc-2026-01-06)
+interface insecure {
+  /// Return `len` insecure pseudo-random bytes.
+  ///
+  /// This function is not cryptographically secure. Do not use it for
+  /// anything related to security.
+  ///
+  /// There are no requirements on the values of the returned bytes, however
+  /// implementations are encouraged to return evenly distributed values with
+  /// a long period.
+  @since(version = 0.3.0-rc-2026-01-06)
+  get-insecure-random-bytes: func(len: u64) -> list<u8>;
+
+  /// Return an insecure pseudo-random `u64` value.
+  ///
+  /// This function returns the same type of pseudo-random data as
+  /// `get-insecure-random-bytes`, represented as a `u64`.
+  @since(version = 0.3.0-rc-2026-01-06)
+  get-insecure-random-u64: func() -> u64;
+}
+
+/// WASI Random is a random data API.
+///
+/// It is intended to be portable at least between Unix-family platforms and
+/// Windows.
+@since(version = 0.3.0-rc-2026-01-06)
+interface random {
+  /// Return `len` cryptographically-secure random or pseudo-random bytes.
+  ///
+  /// This function must produce data at least as cryptographically secure and
+  /// fast as an adequately seeded cryptographically-secure pseudo-random
+  /// number generator (CSPRNG). It must not block, from the perspective of
+  /// the calling program, under any circumstances, including on the first
+  /// request and on requests for numbers of bytes. The returned data must
+  /// always be unpredictable.
+  ///
+  /// This function must always return fresh data. Deterministic environments
+  /// must omit this function, rather than implementing it with deterministic
+  /// data.
+  @since(version = 0.3.0-rc-2026-01-06)
+  get-random-bytes: func(len: u64) -> list<u8>;
+
+  /// Return a cryptographically-secure random or pseudo-random `u64` value.
+  ///
+  /// This function returns the same type of data as `get-random-bytes`,
+  /// represented as a `u64`.
+  @since(version = 0.3.0-rc-2026-01-06)
+  get-random-u64: func() -> u64;
+}
+
+@since(version = 0.3.0-rc-2026-01-06)
+world imports {
+  @since(version = 0.3.0-rc-2026-01-06)
+  import random;
+  @since(version = 0.3.0-rc-2026-01-06)
+  import insecure;
+  @since(version = 0.3.0-rc-2026-01-06)
+  import insecure-seed;
+}
diff --git a/wit/deps/sockets-0.3.0-rc-2025-09-16/ip-name-lookup.wit b/wit/deps/sockets-0.3.0-rc-2025-09-16/ip-name-lookup.wit
deleted file mode 100644
index 6a652ff..0000000
--- a/wit/deps/sockets-0.3.0-rc-2025-09-16/ip-name-lookup.wit
+++ /dev/null
@@ -1,62 +0,0 @@
-@since(version = 0.3.0-rc-2025-09-16)
-interface ip-name-lookup {
-    @since(version = 0.3.0-rc-2025-09-16)
-    use types.{ip-address};
-
-    /// Lookup error codes.
-    @since(version = 0.3.0-rc-2025-09-16)
-    enum error-code {
-        /// Unknown error
-        unknown,
-
-        /// Access denied.
-        ///
-        /// POSIX equivalent: EACCES, EPERM
-        access-denied,
-
-        /// `name` is a syntactically invalid domain name or IP address.
-        ///
-        /// POSIX equivalent: EINVAL
-        invalid-argument,
-
-        /// Name does not exist or has no suitable associated IP addresses.
-        ///
-        /// POSIX equivalent: EAI_NONAME, EAI_NODATA, EAI_ADDRFAMILY
-        name-unresolvable,
-
-        /// A temporary failure in name resolution occurred.
-        ///
-        /// POSIX equivalent: EAI_AGAIN
-        temporary-resolver-failure,
-
-        /// A permanent failure in name resolution occurred.
-        ///
-        /// POSIX equivalent: EAI_FAIL
-        permanent-resolver-failure,
-    }
-
-    /// Resolve an internet host name to a list of IP addresses.
-    ///
-    /// Unicode domain names are automatically converted to ASCII using IDNA encoding.
-    /// If the input is an IP address string, the address is parsed and returned
-    /// as-is without making any external requests.
-    ///
-    /// See the wasi-socket proposal README.md for a comparison with getaddrinfo.
-    ///
-    /// The results are returned in connection order preference.
-    ///
-    /// This function never succeeds with 0 results. It either fails or succeeds
-    /// with at least one address. Additionally, this function never returns
-    /// IPv4-mapped IPv6 addresses.
-    ///
-    /// The returned future will resolve to an error code in case of failure.
-    /// It will resolve to success once the returned stream is exhausted.
-    ///
-    /// # References:
-    /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/getaddrinfo.html>
-    /// - <https://man7.org/linux/man-pages/man3/getaddrinfo.3.html>
-    /// - <https://learn.microsoft.com/en-us/windows/win32/api/ws2tcpip/nf-ws2tcpip-getaddrinfo>
-    /// - <https://man.freebsd.org/cgi/man.cgi?query=getaddrinfo&sektion=3>
-    @since(version = 0.3.0-rc-2025-09-16)
-    resolve-addresses: async func(name: string) -> result<list<ip-address>, error-code>;
-}
diff --git a/wit/deps/sockets-0.3.0-rc-2025-09-16/types.wit b/wit/deps/sockets-0.3.0-rc-2025-09-16/types.wit
deleted file mode 100644
index 2ed1912..0000000
--- a/wit/deps/sockets-0.3.0-rc-2025-09-16/types.wit
+++ /dev/null
@@ -1,725 +0,0 @@
-@since(version = 0.3.0-rc-2025-09-16)
-interface types {
-    @since(version = 0.3.0-rc-2025-09-16)
-    use wasi:clocks/monotonic-clock@0.3.0-rc-2025-09-16.{duration};
-
-    /// Error codes.
-    ///
-    /// In theory, every API can return any error code.
-    /// In practice, API's typically only return the errors documented per API
-    /// combined with a couple of errors that are always possible:
-    /// - `unknown`
-    /// - `access-denied`
-    /// - `not-supported`
-    /// - `out-of-memory`
-    ///
-    /// See each individual API for what the POSIX equivalents are. They sometimes differ per API.
-    @since(version = 0.3.0-rc-2025-09-16)
-    enum error-code {
-        /// Unknown error
-        unknown,
-
-        /// Access denied.
-        ///
-        /// POSIX equivalent: EACCES, EPERM
-        access-denied,
-
-        /// The operation is not supported.
-        ///
-        /// POSIX equivalent: EOPNOTSUPP
-        not-supported,
-
-        /// One of the arguments is invalid.
-        ///
-        /// POSIX equivalent: EINVAL
-        invalid-argument,
-
-        /// Not enough memory to complete the operation.
-        ///
-        /// POSIX equivalent: ENOMEM, ENOBUFS, EAI_MEMORY
-        out-of-memory,
-
-        /// The operation timed out before it could finish completely.
-        timeout,
-
-        /// The operation is not valid in the socket's current state.
-        invalid-state,
-
-        /// A bind operation failed because the provided address is not an address that the `network` can bind to.
-        address-not-bindable,
-
-        /// A bind operation failed because the provided address is already in use or because there are no ephemeral ports available.
-        address-in-use,
-
-        /// The remote address is not reachable
-        remote-unreachable,
-
-
-        /// The TCP connection was forcefully rejected
-        connection-refused,
-
-        /// The TCP connection was reset.
-        connection-reset,
-
-        /// A TCP connection was aborted.
-        connection-aborted,
-
-
-        /// The size of a datagram sent to a UDP socket exceeded the maximum
-        /// supported size.
-        datagram-too-large,
-    }
-
-    @since(version = 0.3.0-rc-2025-09-16)
-    enum ip-address-family {
-        /// Similar to `AF_INET` in POSIX.
-        ipv4,
-
-        /// Similar to `AF_INET6` in POSIX.
-        ipv6,
-    }
-
-    @since(version = 0.3.0-rc-2025-09-16)
-    type ipv4-address = tuple<u8, u8, u8, u8>;
-    @since(version = 0.3.0-rc-2025-09-16)
-    type ipv6-address = tuple<u16, u16, u16, u16, u16, u16, u16, u16>;
-
-    @since(version = 0.3.0-rc-2025-09-16)
-    variant ip-address {
-        ipv4(ipv4-address),
-        ipv6(ipv6-address),
-    }
-
-    @since(version = 0.3.0-rc-2025-09-16)
-    record ipv4-socket-address {
-        /// sin_port
-        port: u16,
-        /// sin_addr
-        address: ipv4-address,
-    }
-
-    @since(version = 0.3.0-rc-2025-09-16)
-    record ipv6-socket-address {
-        /// sin6_port
-        port: u16,
-        /// sin6_flowinfo
-        flow-info: u32,
-        /// sin6_addr
-        address: ipv6-address,
-        /// sin6_scope_id
-        scope-id: u32,
-    }
-
-    @since(version = 0.3.0-rc-2025-09-16)
-    variant ip-socket-address {
-        ipv4(ipv4-socket-address),
-        ipv6(ipv6-socket-address),
-    }
-
-    /// A TCP socket resource.
-    ///
-    /// The socket can be in one of the following states:
-    /// - `unbound`
-    /// - `bound` (See note below)
-    /// - `listening`
-    /// - `connecting`
-    /// - `connected`
-    /// - `closed`
-    /// See <https://github.com/WebAssembly/wasi-sockets/blob/main/TcpSocketOperationalSemantics-0.3.0-draft.md>
-    /// for more information.
-    ///
-    /// Note: Except where explicitly mentioned, whenever this documentation uses
-    /// the term "bound" without backticks it actually means: in the `bound` state *or higher*.
-    /// (i.e. `bound`, `listening`, `connecting` or `connected`)
-    ///
-    /// In addition to the general error codes documented on the
-    /// `types::error-code` type, TCP socket methods may always return
-    /// `error(invalid-state)` when in the `closed` state.
-    @since(version = 0.3.0-rc-2025-09-16)
-    resource tcp-socket {
-
-        /// Create a new TCP socket.
-        ///
-        /// Similar to `socket(AF_INET or AF_INET6, SOCK_STREAM, IPPROTO_TCP)` in POSIX.
-        /// On IPv6 sockets, IPV6_V6ONLY is enabled by default and can't be configured otherwise.
-        ///
-        /// Unlike POSIX, WASI sockets have no notion of a socket-level
-        /// `O_NONBLOCK` flag. Instead they fully rely on the Component Model's
-        /// async support.
-        ///
-        /// # References
-        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/socket.html>
-        /// - <https://man7.org/linux/man-pages/man2/socket.2.html>
-        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-wsasocketw>
-        /// - <https://man.freebsd.org/cgi/man.cgi?query=socket&sektion=2>
-        @since(version = 0.3.0-rc-2025-09-16)
-        create: static func(address-family: ip-address-family) -> result<tcp-socket, error-code>;
-
-        /// Bind the socket to the provided IP address and port.
-        ///
-        /// If the IP address is zero (`0.0.0.0` in IPv4, `::` in IPv6), it is left to the implementation to decide which
-        /// network interface(s) to bind to.
-        /// If the TCP/UDP port is zero, the socket will be bound to a random free port.
-        ///
-        /// Bind can be attempted multiple times on the same socket, even with
-        /// different arguments on each iteration. But never concurrently and
-        /// only as long as the previous bind failed. Once a bind succeeds, the
-        /// binding can't be changed anymore.
-        ///
-        /// # Typical errors
-        /// - `invalid-argument`:          The `local-address` has the wrong address family. (EAFNOSUPPORT, EFAULT on Windows)
-        /// - `invalid-argument`:          `local-address` is not a unicast address. (EINVAL)
-        /// - `invalid-argument`:          `local-address` is an IPv4-mapped IPv6 address. (EINVAL)
-        /// - `invalid-state`:             The socket is already bound. (EINVAL)
-        /// - `address-in-use`:            No ephemeral ports available. (EADDRINUSE, ENOBUFS on Windows)
-        /// - `address-in-use`:            Address is already in use. (EADDRINUSE)
-        /// - `address-not-bindable`:      `local-address` is not an address that can be bound to. (EADDRNOTAVAIL)
-        /// 
-        /// # Implementors note
-        /// When binding to a non-zero port, this bind operation shouldn't be affected by the TIME_WAIT
-        /// state of a recently closed socket on the same local address. In practice this means that the SO_REUSEADDR 
-        /// socket option should be set implicitly on all platforms, except on Windows where this is the default behavior
-        /// and SO_REUSEADDR performs something different entirely.
-        ///
-        /// # References
-        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/bind.html>
-        /// - <https://man7.org/linux/man-pages/man2/bind.2.html>
-        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock/nf-winsock-bind>
-        /// - <https://man.freebsd.org/cgi/man.cgi?query=bind&sektion=2&format=html>
-        @since(version = 0.3.0-rc-2025-09-16)
-        bind: func(local-address: ip-socket-address) -> result<_, error-code>;
-
-        /// Connect to a remote endpoint.
-        ///
-        /// On success, the socket is transitioned into the `connected` state and this function returns a connection resource.
-        ///
-        /// After a failed connection attempt, the socket will be in the `closed`
-        /// state and the only valid action left is to `drop` the socket. A single
-        /// socket can not be used to connect more than once.
-        ///
-        /// # Typical errors
-        /// - `invalid-argument`:          The `remote-address` has the wrong address family. (EAFNOSUPPORT)
-        /// - `invalid-argument`:          `remote-address` is not a unicast address. (EINVAL, ENETUNREACH on Linux, EAFNOSUPPORT on MacOS)
-        /// - `invalid-argument`:          `remote-address` is an IPv4-mapped IPv6 address. (EINVAL, EADDRNOTAVAIL on Illumos)
-        /// - `invalid-argument`:          The IP address in `remote-address` is set to INADDR_ANY (`0.0.0.0` / `::`). (EADDRNOTAVAIL on Windows)
-        /// - `invalid-argument`:          The port in `remote-address` is set to 0. (EADDRNOTAVAIL on Windows)
-        /// - `invalid-state`:             The socket is already in the `connecting` state. (EALREADY)
-        /// - `invalid-state`:             The socket is already in the `connected` state. (EISCONN)
-        /// - `invalid-state`:             The socket is already in the `listening` state. (EOPNOTSUPP, EINVAL on Windows)
-        /// - `timeout`:                   Connection timed out. (ETIMEDOUT)
-        /// - `connection-refused`:        The connection was forcefully rejected. (ECONNREFUSED)
-        /// - `connection-reset`:          The connection was reset. (ECONNRESET)
-        /// - `connection-aborted`:        The connection was aborted. (ECONNABORTED)
-        /// - `remote-unreachable`:        The remote address is not reachable. (EHOSTUNREACH, EHOSTDOWN, ENETUNREACH, ENETDOWN, ENONET)
-        /// - `address-in-use`:            Tried to perform an implicit bind, but there were no ephemeral ports available. (EADDRINUSE, EADDRNOTAVAIL on Linux, EAGAIN on BSD)
-        ///
-        /// # References
-        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/connect.html>
-        /// - <https://man7.org/linux/man-pages/man2/connect.2.html>
-        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-connect>
-        /// - <https://man.freebsd.org/cgi/man.cgi?connect>
-        @since(version = 0.3.0-rc-2025-09-16)
-        connect: async func(remote-address: ip-socket-address) -> result<_, error-code>;
-
-        /// Start listening and return a stream of new inbound connections.
-        ///
-        /// Transitions the socket into the `listening` state. This can be called
-        /// at most once per socket.
-        ///
-        /// If the socket is not already explicitly bound, this function will
-        /// implicitly bind the socket to a random free port.
-        ///
-        /// Normally, the returned sockets are bound, in the `connected` state
-        /// and immediately ready for I/O. Though, depending on exact timing and
-        /// circumstances, a newly accepted connection may already be `closed`
-        /// by the time the server attempts to perform its first I/O on it. This
-        /// is true regardless of whether the WASI implementation uses
-        /// "synthesized" sockets or not (see Implementors Notes below).
-        ///
-        /// The following properties are inherited from the listener socket:
-        /// - `address-family`
-        /// - `keep-alive-enabled`
-        /// - `keep-alive-idle-time`
-        /// - `keep-alive-interval`
-        /// - `keep-alive-count`
-        /// - `hop-limit`
-        /// - `receive-buffer-size`
-        /// - `send-buffer-size`
-        ///
-        /// # Typical errors
-        /// - `invalid-state`:             The socket is already in the `connected` state. (EISCONN, EINVAL on BSD)
-        /// - `invalid-state`:             The socket is already in the `listening` state.
-        /// - `address-in-use`:            Tried to perform an implicit bind, but there were no ephemeral ports available. (EADDRINUSE)
-        ///
-        /// # Implementors note
-        /// This method returns a single perpetual stream that should only close
-        /// on fatal errors (if any). Yet, the POSIX' `accept` function may also
-        /// return transient errors (e.g. ECONNABORTED). The exact details differ
-        /// per operation system. For example, the Linux manual mentions:
-        ///
-        /// > Linux accept() passes already-pending network errors on the new
-        /// > socket as an error code from accept(). This behavior differs from
-        /// > other BSD socket implementations. For reliable operation the
-        /// > application should detect the network errors defined for the
-        /// > protocol after accept() and treat them like EAGAIN by retrying.
-        /// > In the case of TCP/IP, these are ENETDOWN, EPROTO, ENOPROTOOPT,
-        /// > EHOSTDOWN, ENONET, EHOSTUNREACH, EOPNOTSUPP, and ENETUNREACH.
-        /// Source: https://man7.org/linux/man-pages/man2/accept.2.html
-        ///
-        /// WASI implementations have two options to handle this:
-        /// - Optionally log it and then skip over non-fatal errors returned by
-        ///   `accept`. Guest code never gets to see these failures. Or:
-        /// - Synthesize a `tcp-socket` resource that exposes the error when
-        ///   attempting to send or receive on it. Guest code then sees these
-        ///   failures as regular I/O errors.
-        ///
-        /// In either case, the stream returned by this `listen` method remains
-        /// operational.
-        ///
-        /// # References
-        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/listen.html>
-        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/accept.html>
-        /// - <https://man7.org/linux/man-pages/man2/listen.2.html>
-        /// - <https://man7.org/linux/man-pages/man2/accept.2.html>
-        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-listen>
-        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-accept>
-        /// - <https://man.freebsd.org/cgi/man.cgi?query=listen&sektion=2>
-        /// - <https://man.freebsd.org/cgi/man.cgi?query=accept&sektion=2>
-        @since(version = 0.3.0-rc-2025-09-16)
-        listen: func() -> result<stream<tcp-socket>, error-code>;
-
-        /// Transmit data to peer.
-        ///
-        /// The caller should close the stream when it has no more data to send
-        /// to the peer. Under normal circumstances this will cause a FIN packet
-        /// to be sent out. Closing the stream is equivalent to calling
-        /// `shutdown(SHUT_WR)` in POSIX.
-        ///
-        /// This function may be called at most once and returns once the full
-        /// contents of the stream are transmitted or an error is encountered.
-        ///
-        /// # Typical errors
-        /// - `invalid-state`:             The socket is not in the `connected` state. (ENOTCONN)
-        /// - `connection-reset`:          The connection was reset. (ECONNRESET)
-        /// - `remote-unreachable`:        The remote address is not reachable. (EHOSTUNREACH, EHOSTDOWN, ENETUNREACH, ENETDOWN, ENONET)
-        ///
-        ///  # References
-        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/send.html>
-        /// - <https://man7.org/linux/man-pages/man2/send.2.html>
-        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-send>
-        /// - <https://man.freebsd.org/cgi/man.cgi?query=send&sektion=2>
-        @since(version = 0.3.0-rc-2025-09-16)
-        send: async func(data: stream<u8>) -> result<_, error-code>;
-
-        /// Read data from peer.
-        ///
-        /// This function returns a `stream` which provides the data received from the
-        /// socket, and a `future` providing additional error information in case the
-        /// socket is closed abnormally.
-        ///
-        /// If the socket is closed normally, `stream.read` on the `stream` will return
-        /// `read-status::closed` with no `error-context` and the future resolves to
-        /// the value `ok`. If the socket is closed abnormally, `stream.read` on the
-        /// `stream` returns `read-status::closed` with an `error-context` and the future
-        /// resolves to `err` with an `error-code`.
-        ///
-        /// `receive` is meant to be called only once per socket. If it is called more
-        /// than once, the subsequent calls return a new `stream` that fails as if it
-        /// were closed abnormally.
-        ///
-        /// If the caller is not expecting to receive any data from the peer,
-        /// they may drop the stream. Any data still in the receive queue
-        /// will be discarded. This is equivalent to calling `shutdown(SHUT_RD)`
-        /// in POSIX.
-        ///
-        /// # Typical errors
-        /// - `invalid-state`:             The socket is not in the `connected` state. (ENOTCONN)
-        /// - `connection-reset`:          The connection was reset. (ECONNRESET)
-        /// - `remote-unreachable`:        The remote address is not reachable. (EHOSTUNREACH, EHOSTDOWN, ENETUNREACH, ENETDOWN, ENONET)
-        ///
-        /// # References
-        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/recv.html>
-        /// - <https://man7.org/linux/man-pages/man2/recv.2.html>
-        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock/nf-winsock-recv>
-        /// - <https://man.freebsd.org/cgi/man.cgi?query=recv&sektion=2>
-        @since(version = 0.3.0-rc-2025-09-16)
-        receive: func() -> tuple<stream<u8>, future<result<_, error-code>>>;
-
-        /// Get the bound local address.
-        ///
-        /// POSIX mentions:
-        /// > If the socket has not been bound to a local name, the value
-        /// > stored in the object pointed to by `address` is unspecified.
-        ///
-        /// WASI is stricter and requires `get-local-address` to return `invalid-state` when the socket hasn't been bound yet.
-        ///
-        /// # Typical errors
-        /// - `invalid-state`: The socket is not bound to any local address.
-        ///
-        /// # References
-        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/getsockname.html>
-        /// - <https://man7.org/linux/man-pages/man2/getsockname.2.html>
-        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock/nf-winsock-getsockname>
-        /// - <https://man.freebsd.org/cgi/man.cgi?getsockname>
-        @since(version = 0.3.0-rc-2025-09-16)
-        get-local-address: func() -> result<ip-socket-address, error-code>;
-
-        /// Get the remote address.
-        ///
-        /// # Typical errors
-        /// - `invalid-state`: The socket is not connected to a remote address. (ENOTCONN)
-        ///
-        /// # References
-        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/getpeername.html>
-        /// - <https://man7.org/linux/man-pages/man2/getpeername.2.html>
-        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock/nf-winsock-getpeername>
-        /// - <https://man.freebsd.org/cgi/man.cgi?query=getpeername&sektion=2&n=1>
-        @since(version = 0.3.0-rc-2025-09-16)
-        get-remote-address: func() -> result<ip-socket-address, error-code>;
-
-        /// Whether the socket is in the `listening` state.
-        ///
-        /// Equivalent to the SO_ACCEPTCONN socket option.
-        @since(version = 0.3.0-rc-2025-09-16)
-        get-is-listening: func() -> bool;
-
-        /// Whether this is a IPv4 or IPv6 socket.
-        ///
-        /// This is the value passed to the constructor.
-        ///
-        /// Equivalent to the SO_DOMAIN socket option.
-        @since(version = 0.3.0-rc-2025-09-16)
-        get-address-family: func() -> ip-address-family;
-
-        /// Hints the desired listen queue size. Implementations are free to ignore this.
-        ///
-        /// If the provided value is 0, an `invalid-argument` error is returned.
-        /// Any other value will never cause an error, but it might be silently clamped and/or rounded.
-        ///
-        /// # Typical errors
-        /// - `not-supported`:        (set) The platform does not support changing the backlog size after the initial listen.
-        /// - `invalid-argument`:     (set) The provided value was 0.
-        /// - `invalid-state`:        (set) The socket is in the `connecting` or `connected` state.
-        @since(version = 0.3.0-rc-2025-09-16)
-        set-listen-backlog-size: func(value: u64) -> result<_, error-code>;
-
-        /// Enables or disables keepalive.
-        ///
-        /// The keepalive behavior can be adjusted using:
-        /// - `keep-alive-idle-time`
-        /// - `keep-alive-interval`
-        /// - `keep-alive-count`
-        /// These properties can be configured while `keep-alive-enabled` is false, but only come into effect when `keep-alive-enabled` is true.
-        ///
-        /// Equivalent to the SO_KEEPALIVE socket option.
-        @since(version = 0.3.0-rc-2025-09-16)
-        get-keep-alive-enabled: func() -> result<bool, error-code>;
-        @since(version = 0.3.0-rc-2025-09-16)
-        set-keep-alive-enabled: func(value: bool) -> result<_, error-code>;
-
-        /// Amount of time the connection has to be idle before TCP starts sending keepalive packets.
-        ///
-        /// If the provided value is 0, an `invalid-argument` error is returned.
-        /// Any other value will never cause an error, but it might be silently clamped and/or rounded.
-        /// I.e. after setting a value, reading the same setting back may return a different value.
-        ///
-        /// Equivalent to the TCP_KEEPIDLE socket option. (TCP_KEEPALIVE on MacOS)
-        ///
-        /// # Typical errors
-        /// - `invalid-argument`:     (set) The provided value was 0.
-        @since(version = 0.3.0-rc-2025-09-16)
-        get-keep-alive-idle-time: func() -> result<duration, error-code>;
-        @since(version = 0.3.0-rc-2025-09-16)
-        set-keep-alive-idle-time: func(value: duration) -> result<_, error-code>;
-
-        /// The time between keepalive packets.
-        ///
-        /// If the provided value is 0, an `invalid-argument` error is returned.
-        /// Any other value will never cause an error, but it might be silently clamped and/or rounded.
-        /// I.e. after setting a value, reading the same setting back may return a different value.
-        ///
-        /// Equivalent to the TCP_KEEPINTVL socket option.
-        ///
-        /// # Typical errors
-        /// - `invalid-argument`:     (set) The provided value was 0.
-        @since(version = 0.3.0-rc-2025-09-16)
-        get-keep-alive-interval: func() -> result<duration, error-code>;
-        @since(version = 0.3.0-rc-2025-09-16)
-        set-keep-alive-interval: func(value: duration) -> result<_, error-code>;
-
-        /// The maximum amount of keepalive packets TCP should send before aborting the connection.
-        ///
-        /// If the provided value is 0, an `invalid-argument` error is returned.
-        /// Any other value will never cause an error, but it might be silently clamped and/or rounded.
-        /// I.e. after setting a value, reading the same setting back may return a different value.
-        ///
-        /// Equivalent to the TCP_KEEPCNT socket option.
-        ///
-        /// # Typical errors
-        /// - `invalid-argument`:     (set) The provided value was 0.
-        @since(version = 0.3.0-rc-2025-09-16)
-        get-keep-alive-count: func() -> result<u32, error-code>;
-        @since(version = 0.3.0-rc-2025-09-16)
-        set-keep-alive-count: func(value: u32) -> result<_, error-code>;
-
-        /// Equivalent to the IP_TTL & IPV6_UNICAST_HOPS socket options.
-        ///
-        /// If the provided value is 0, an `invalid-argument` error is returned.
-        ///
-        /// # Typical errors
-        /// - `invalid-argument`:     (set) The TTL value must be 1 or higher.
-        @since(version = 0.3.0-rc-2025-09-16)
-        get-hop-limit: func() -> result<u8, error-code>;
-        @since(version = 0.3.0-rc-2025-09-16)
-        set-hop-limit: func(value: u8) -> result<_, error-code>;
-
-        /// The kernel buffer space reserved for sends/receives on this socket.
-        ///
-        /// If the provided value is 0, an `invalid-argument` error is returned.
-        /// Any other value will never cause an error, but it might be silently clamped and/or rounded.
-        /// I.e. after setting a value, reading the same setting back may return a different value.
-        ///
-        /// Equivalent to the SO_RCVBUF and SO_SNDBUF socket options.
-        ///
-        /// # Typical errors
-        /// - `invalid-argument`:     (set) The provided value was 0.
-        @since(version = 0.3.0-rc-2025-09-16)
-        get-receive-buffer-size: func() -> result<u64, error-code>;
-        @since(version = 0.3.0-rc-2025-09-16)
-        set-receive-buffer-size: func(value: u64) -> result<_, error-code>;
-        @since(version = 0.3.0-rc-2025-09-16)
-        get-send-buffer-size: func() -> result<u64, error-code>;
-        @since(version = 0.3.0-rc-2025-09-16)
-        set-send-buffer-size: func(value: u64) -> result<_, error-code>;
-    }
-
-    /// A UDP socket handle.
-    @since(version = 0.3.0-rc-2025-09-16)
-    resource udp-socket {
-
-        /// Create a new UDP socket.
-        ///
-        /// Similar to `socket(AF_INET or AF_INET6, SOCK_DGRAM, IPPROTO_UDP)` in POSIX.
-        /// On IPv6 sockets, IPV6_V6ONLY is enabled by default and can't be configured otherwise.
-        ///
-        /// Unlike POSIX, WASI sockets have no notion of a socket-level
-        /// `O_NONBLOCK` flag. Instead they fully rely on the Component Model's
-        /// async support.
-        ///
-        /// # References:
-        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/socket.html>
-        /// - <https://man7.org/linux/man-pages/man2/socket.2.html>
-        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-wsasocketw>
-        /// - <https://man.freebsd.org/cgi/man.cgi?query=socket&sektion=2>
-        @since(version = 0.3.0-rc-2025-09-16)
-        create: static func(address-family: ip-address-family) -> result<udp-socket, error-code>;
-
-        /// Bind the socket to the provided IP address and port.
-        ///
-        /// If the IP address is zero (`0.0.0.0` in IPv4, `::` in IPv6), it is left to the implementation to decide which
-        /// network interface(s) to bind to.
-        /// If the port is zero, the socket will be bound to a random free port.
-        ///
-        /// # Typical errors
-        /// - `invalid-argument`:          The `local-address` has the wrong address family. (EAFNOSUPPORT, EFAULT on Windows)
-        /// - `invalid-state`:             The socket is already bound. (EINVAL)
-        /// - `address-in-use`:            No ephemeral ports available. (EADDRINUSE, ENOBUFS on Windows)
-        /// - `address-in-use`:            Address is already in use. (EADDRINUSE)
-        /// - `address-not-bindable`:      `local-address` is not an address that can be bound to. (EADDRNOTAVAIL)
-        ///
-        /// # References
-        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/bind.html>
-        /// - <https://man7.org/linux/man-pages/man2/bind.2.html>
-        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock/nf-winsock-bind>
-        /// - <https://man.freebsd.org/cgi/man.cgi?query=bind&sektion=2&format=html>
-        @since(version = 0.3.0-rc-2025-09-16)
-        bind: func(local-address: ip-socket-address) -> result<_, error-code>;
-
-        /// Associate this socket with a specific peer address.
-        ///
-        /// On success, the `remote-address` of the socket is updated.
-        /// The `local-address` may be updated as well, based on the best network
-        /// path to `remote-address`. If the socket was not already explicitly
-        /// bound, this function will implicitly bind the socket to a random
-        /// free port.
-        ///
-        /// When a UDP socket is "connected", the `send` and `receive` methods
-        /// are limited to communicating with that peer only:
-        /// - `send` can only be used to send to this destination.
-        /// - `receive` will only return datagrams sent from the provided `remote-address`.
-        ///
-        /// The name "connect" was kept to align with the existing POSIX
-        /// terminology. Other than that, this function only changes the local
-        /// socket configuration and does not generate any network traffic.
-        /// The peer is not aware of this "connection".
-        ///
-        /// This method may be called multiple times on the same socket to change
-        /// its association, but only the most recent one will be effective.
-        ///
-        /// # Typical errors
-        /// - `invalid-argument`:          The `remote-address` has the wrong address family. (EAFNOSUPPORT)
-        /// - `invalid-argument`:          The IP address in `remote-address` is set to INADDR_ANY (`0.0.0.0` / `::`). (EDESTADDRREQ, EADDRNOTAVAIL)
-        /// - `invalid-argument`:          The port in `remote-address` is set to 0. (EDESTADDRREQ, EADDRNOTAVAIL)
-        /// - `address-in-use`:            Tried to perform an implicit bind, but there were no ephemeral ports available. (EADDRINUSE, EADDRNOTAVAIL on Linux, EAGAIN on BSD)
-        ///
-        /// # Implementors note
-        /// If the socket is already connected, some platforms (e.g. Linux)
-        /// require a disconnect before connecting to a different peer address.
-        ///
-        /// # References
-        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/connect.html>
-        /// - <https://man7.org/linux/man-pages/man2/connect.2.html>
-        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-connect>
-        /// - <https://man.freebsd.org/cgi/man.cgi?connect>
-        @since(version = 0.3.0-rc-2025-09-16)
-        connect: func(remote-address: ip-socket-address) -> result<_, error-code>;
-
-        /// Dissociate this socket from its peer address.
-        ///
-        /// After calling this method, `send` & `receive` are free to communicate
-        /// with any address again.
-        ///
-        /// The POSIX equivalent of this is calling `connect` with an `AF_UNSPEC` address.
-        ///
-        /// # Typical errors
-        /// - `invalid-state`:           The socket is not connected.
-        ///
-        /// # References
-        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/connect.html>
-        /// - <https://man7.org/linux/man-pages/man2/connect.2.html>
-        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-connect>
-        /// - <https://man.freebsd.org/cgi/man.cgi?connect>
-        @since(version = 0.3.0-rc-2025-09-16)
-        disconnect: func() -> result<_, error-code>;
-
-        /// Send a message on the socket to a particular peer.
-        ///
-        /// If the socket is connected, the peer address may be left empty. In
-        /// that case this is equivalent to `send` in POSIX. Otherwise it is
-        /// equivalent to `sendto`.
-        ///
-        /// Additionally, if the socket is connected, a `remote-address` argument
-        /// _may_ be provided but then it must be identical to the address
-        /// passed to `connect`.
-        ///
-        /// Implementations may trap if the `data` length exceeds 64 KiB.
-        ///
-        /// # Typical errors
-        /// - `invalid-argument`:        The `remote-address` has the wrong address family. (EAFNOSUPPORT)
-        /// - `invalid-argument`:        The IP address in `remote-address` is set to INADDR_ANY (`0.0.0.0` / `::`). (EDESTADDRREQ, EADDRNOTAVAIL)
-        /// - `invalid-argument`:        The port in `remote-address` is set to 0. (EDESTADDRREQ, EADDRNOTAVAIL)
-        /// - `invalid-argument`:        The socket is in "connected" mode and `remote-address` is `some` value that does not match the address passed to `connect`. (EISCONN)
-        /// - `invalid-argument`:        The socket is not "connected" and no value for `remote-address` was provided. (EDESTADDRREQ)
-        /// - `remote-unreachable`:      The remote address is not reachable. (ECONNRESET, ENETRESET on Windows, EHOSTUNREACH, EHOSTDOWN, ENETUNREACH, ENETDOWN, ENONET)
-        /// - `connection-refused`:      The connection was refused. (ECONNREFUSED)
-        /// - `datagram-too-large`:      The datagram is too large. (EMSGSIZE)
-        ///
-        /// # References
-        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/sendto.html>
-        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/sendmsg.html>
-        /// - <https://man7.org/linux/man-pages/man2/send.2.html>
-        /// - <https://man7.org/linux/man-pages/man2/sendmmsg.2.html>
-        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-send>
-        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-sendto>
-        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-wsasendmsg>
-        /// - <https://man.freebsd.org/cgi/man.cgi?query=send&sektion=2>
-        @since(version = 0.3.0-rc-2025-09-16)
-        send: async func(data: list<u8>, remote-address: option<ip-socket-address>) -> result<_, error-code>;
-
-        /// Receive a message on the socket.
-        ///
-        /// On success, the return value contains a tuple of the received data
-        /// and the address of the sender. Theoretical maximum length of the
-        /// data is 64 KiB. Though in practice, it will typically be less than
-        /// 1500 bytes.
-        ///
-        /// If the socket is connected, the sender address is guaranteed to
-        /// match the remote address passed to `connect`.
-        ///
-        /// # Typical errors
-        /// - `invalid-state`:        The socket has not been bound yet.
-        /// - `remote-unreachable`:   The remote address is not reachable. (ECONNRESET, ENETRESET on Windows, EHOSTUNREACH, EHOSTDOWN, ENETUNREACH, ENETDOWN, ENONET)
-        /// - `connection-refused`:   The connection was refused. (ECONNREFUSED)
-        ///
-        /// # References
-        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/recvfrom.html>
-        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/recvmsg.html>
-        /// - <https://man7.org/linux/man-pages/man2/recv.2.html>
-        /// - <https://man7.org/linux/man-pages/man2/recvmmsg.2.html>
-        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock/nf-winsock-recvfrom>
-        /// - <https://learn.microsoft.com/en-us/windows/win32/api/mswsock/nc-mswsock-lpfn_wsarecvmsg>
-        /// - <https://man.freebsd.org/cgi/man.cgi?query=recv&sektion=2>
-        @since(version = 0.3.0-rc-2025-09-16)
-        receive: async func() -> result<tuple<list<u8>, ip-socket-address>, error-code>;
-
-        /// Get the current bound address.
-        ///
-        /// POSIX mentions:
-        /// > If the socket has not been bound to a local name, the value
-        /// > stored in the object pointed to by `address` is unspecified.
-        ///
-        /// WASI is stricter and requires `get-local-address` to return `invalid-state` when the socket hasn't been bound yet.
-        ///
-        /// # Typical errors
-        /// - `invalid-state`: The socket is not bound to any local address.
-        ///
-        /// # References
-        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/getsockname.html>
-        /// - <https://man7.org/linux/man-pages/man2/getsockname.2.html>
-        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock/nf-winsock-getsockname>
-        /// - <https://man.freebsd.org/cgi/man.cgi?getsockname>
-        @since(version = 0.3.0-rc-2025-09-16)
-        get-local-address: func() -> result<ip-socket-address, error-code>;
-
-        /// Get the address the socket is currently "connected" to.
-        ///
-        /// # Typical errors
-        /// - `invalid-state`: The socket is not "connected" to a specific remote address. (ENOTCONN)
-        ///
-        /// # References
-        /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/getpeername.html>
-        /// - <https://man7.org/linux/man-pages/man2/getpeername.2.html>
-        /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock/nf-winsock-getpeername>
-        /// - <https://man.freebsd.org/cgi/man.cgi?query=getpeername&sektion=2&n=1>
-        @since(version = 0.3.0-rc-2025-09-16)
-        get-remote-address: func() -> result<ip-socket-address, error-code>;
-
-        /// Whether this is a IPv4 or IPv6 socket.
-        ///
-        /// This is the value passed to the constructor.
-        ///
-        /// Equivalent to the SO_DOMAIN socket option.
-        @since(version = 0.3.0-rc-2025-09-16)
-        get-address-family: func() -> ip-address-family;
-
-        /// Equivalent to the IP_TTL & IPV6_UNICAST_HOPS socket options.
-        ///
-        /// If the provided value is 0, an `invalid-argument` error is returned.
-        ///
-        /// # Typical errors
-        /// - `invalid-argument`:     (set) The TTL value must be 1 or higher.
-        @since(version = 0.3.0-rc-2025-09-16)
-        get-unicast-hop-limit: func() -> result<u8, error-code>;
-        @since(version = 0.3.0-rc-2025-09-16)
-        set-unicast-hop-limit: func(value: u8) -> result<_, error-code>;
-
-        /// The kernel buffer space reserved for sends/receives on this socket.
-        ///
-        /// If the provided value is 0, an `invalid-argument` error is returned.
-        /// Any other value will never cause an error, but it might be silently clamped and/or rounded.
-        /// I.e. after setting a value, reading the same setting back may return a different value.
-        ///
-        /// Equivalent to the SO_RCVBUF and SO_SNDBUF socket options.
-        ///
-        /// # Typical errors
-        /// - `invalid-argument`:     (set) The provided value was 0.
-        @since(version = 0.3.0-rc-2025-09-16)
-        get-receive-buffer-size: func() -> result<u64, error-code>;
-        @since(version = 0.3.0-rc-2025-09-16)
-        set-receive-buffer-size: func(value: u64) -> result<_, error-code>;
-        @since(version = 0.3.0-rc-2025-09-16)
-        get-send-buffer-size: func() -> result<u64, error-code>;
-        @since(version = 0.3.0-rc-2025-09-16)
-        set-send-buffer-size: func(value: u64) -> result<_, error-code>;
-    }
-}
diff --git a/wit/deps/sockets-0.3.0-rc-2025-09-16/world.wit b/wit/deps/sockets-0.3.0-rc-2025-09-16/world.wit
deleted file mode 100644
index 44cc427..0000000
--- a/wit/deps/sockets-0.3.0-rc-2025-09-16/world.wit
+++ /dev/null
@@ -1,9 +0,0 @@
-package wasi:sockets@0.3.0-rc-2025-09-16;
-
-@since(version = 0.3.0-rc-2025-09-16)
-world imports {
-    @since(version = 0.3.0-rc-2025-09-16)
-    import types;
-    @since(version = 0.3.0-rc-2025-09-16)
-    import ip-name-lookup;
-}
diff --git a/wit/deps/sockets-0.3.0-rc-2026-01-06.wit b/wit/deps/sockets-0.3.0-rc-2026-01-06.wit
new file mode 100644
index 0000000..d7ebe15
--- /dev/null
+++ b/wit/deps/sockets-0.3.0-rc-2026-01-06.wit
@@ -0,0 +1,752 @@
+package wasi:sockets@0.3.0-rc-2026-01-06;
+
+@since(version = 0.3.0-rc-2026-01-06)
+interface types {
+  @since(version = 0.3.0-rc-2026-01-06)
+  use wasi:clocks/types@0.3.0-rc-2026-01-06.{duration};
+
+  /// Error codes.
+  ///
+  /// In theory, every API can return any error code.
+  /// In practice, API's typically only return the errors documented per API
+  /// combined with a couple of errors that are always possible:
+  /// - `unknown`
+  /// - `access-denied`
+  /// - `not-supported`
+  /// - `out-of-memory`
+  ///
+  /// See each individual API for what the POSIX equivalents are. They sometimes differ per API.
+  @since(version = 0.3.0-rc-2026-01-06)
+  enum error-code {
+    /// Unknown error
+    unknown,
+    /// Access denied.
+    ///
+    /// POSIX equivalent: EACCES, EPERM
+    access-denied,
+    /// The operation is not supported.
+    ///
+    /// POSIX equivalent: EOPNOTSUPP
+    not-supported,
+    /// One of the arguments is invalid.
+    ///
+    /// POSIX equivalent: EINVAL
+    invalid-argument,
+    /// Not enough memory to complete the operation.
+    ///
+    /// POSIX equivalent: ENOMEM, ENOBUFS, EAI_MEMORY
+    out-of-memory,
+    /// The operation timed out before it could finish completely.
+    timeout,
+    /// The operation is not valid in the socket's current state.
+    invalid-state,
+    /// A bind operation failed because the provided address is not an address that the `network` can bind to.
+    address-not-bindable,
+    /// A bind operation failed because the provided address is already in use or because there are no ephemeral ports available.
+    address-in-use,
+    /// The remote address is not reachable
+    remote-unreachable,
+    /// The TCP connection was forcefully rejected
+    connection-refused,
+    /// The TCP connection was reset.
+    connection-reset,
+    /// A TCP connection was aborted.
+    connection-aborted,
+    /// The size of a datagram sent to a UDP socket exceeded the maximum
+    /// supported size.
+    datagram-too-large,
+  }
+
+  @since(version = 0.3.0-rc-2026-01-06)
+  enum ip-address-family {
+    /// Similar to `AF_INET` in POSIX.
+    ipv4,
+    /// Similar to `AF_INET6` in POSIX.
+    ipv6,
+  }
+
+  @since(version = 0.3.0-rc-2026-01-06)
+  type ipv4-address = tuple<u8, u8, u8, u8>;
+
+  @since(version = 0.3.0-rc-2026-01-06)
+  type ipv6-address = tuple<u16, u16, u16, u16, u16, u16, u16, u16>;
+
+  @since(version = 0.3.0-rc-2026-01-06)
+  variant ip-address {
+    ipv4(ipv4-address),
+    ipv6(ipv6-address),
+  }
+
+  @since(version = 0.3.0-rc-2026-01-06)
+  record ipv4-socket-address {
+    /// sin_port
+    port: u16,
+    /// sin_addr
+    address: ipv4-address,
+  }
+
+  @since(version = 0.3.0-rc-2026-01-06)
+  record ipv6-socket-address {
+    /// sin6_port
+    port: u16,
+    /// sin6_flowinfo
+    flow-info: u32,
+    /// sin6_addr
+    address: ipv6-address,
+    /// sin6_scope_id
+    scope-id: u32,
+  }
+
+  @since(version = 0.3.0-rc-2026-01-06)
+  variant ip-socket-address {
+    ipv4(ipv4-socket-address),
+    ipv6(ipv6-socket-address),
+  }
+
+  /// A TCP socket resource.
+  ///
+  /// The socket can be in one of the following states:
+  /// - `unbound`
+  /// - `bound` (See note below)
+  /// - `listening`
+  /// - `connecting`
+  /// - `connected`
+  /// - `closed`
+  /// See <https://github.com/WebAssembly/wasi-sockets/blob/main/TcpSocketOperationalSemantics-0.3.0-draft.md>
+  /// for more information.
+  ///
+  /// Note: Except where explicitly mentioned, whenever this documentation uses
+  /// the term "bound" without backticks it actually means: in the `bound` state *or higher*.
+  /// (i.e. `bound`, `listening`, `connecting` or `connected`)
+  ///
+  /// In addition to the general error codes documented on the
+  /// `types::error-code` type, TCP socket methods may always return
+  /// `error(invalid-state)` when in the `closed` state.
+  @since(version = 0.3.0-rc-2026-01-06)
+  resource tcp-socket {
+    /// Create a new TCP socket.
+    ///
+    /// Similar to `socket(AF_INET or AF_INET6, SOCK_STREAM, IPPROTO_TCP)` in POSIX.
+    /// On IPv6 sockets, IPV6_V6ONLY is enabled by default and can't be configured otherwise.
+    ///
+    /// Unlike POSIX, WASI sockets have no notion of a socket-level
+    /// `O_NONBLOCK` flag. Instead they fully rely on the Component Model's
+    /// async support.
+    ///
+    /// # References
+    /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/socket.html>
+    /// - <https://man7.org/linux/man-pages/man2/socket.2.html>
+    /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-wsasocketw>
+    /// - <https://man.freebsd.org/cgi/man.cgi?query=socket&sektion=2>
+    @since(version = 0.3.0-rc-2026-01-06)
+    create: static func(address-family: ip-address-family) -> result<tcp-socket, error-code>;
+    /// Bind the socket to the provided IP address and port.
+    ///
+    /// If the IP address is zero (`0.0.0.0` in IPv4, `::` in IPv6), it is left to the implementation to decide which
+    /// network interface(s) to bind to.
+    /// If the TCP/UDP port is zero, the socket will be bound to a random free port.
+    ///
+    /// Bind can be attempted multiple times on the same socket, even with
+    /// different arguments on each iteration. But never concurrently and
+    /// only as long as the previous bind failed. Once a bind succeeds, the
+    /// binding can't be changed anymore.
+    ///
+    /// # Typical errors
+    /// - `invalid-argument`:          The `local-address` has the wrong address family. (EAFNOSUPPORT, EFAULT on Windows)
+    /// - `invalid-argument`:          `local-address` is not a unicast address. (EINVAL)
+    /// - `invalid-argument`:          `local-address` is an IPv4-mapped IPv6 address. (EINVAL)
+    /// - `invalid-state`:             The socket is already bound. (EINVAL)
+    /// - `address-in-use`:            No ephemeral ports available. (EADDRINUSE, ENOBUFS on Windows)
+    /// - `address-in-use`:            Address is already in use. (EADDRINUSE)
+    /// - `address-not-bindable`:      `local-address` is not an address that can be bound to. (EADDRNOTAVAIL)
+    ///
+    /// # Implementors note
+    /// When binding to a non-zero port, this bind operation shouldn't be affected by the TIME_WAIT
+    /// state of a recently closed socket on the same local address. In practice this means that the SO_REUSEADDR
+    /// socket option should be set implicitly on all platforms, except on Windows where this is the default behavior
+    /// and SO_REUSEADDR performs something different entirely.
+    ///
+    /// # References
+    /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/bind.html>
+    /// - <https://man7.org/linux/man-pages/man2/bind.2.html>
+    /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock/nf-winsock-bind>
+    /// - <https://man.freebsd.org/cgi/man.cgi?query=bind&sektion=2&format=html>
+    @since(version = 0.3.0-rc-2026-01-06)
+    bind: func(local-address: ip-socket-address) -> result<_, error-code>;
+    /// Connect to a remote endpoint.
+    ///
+    /// On success, the socket is transitioned into the `connected` state and this function returns a connection resource.
+    ///
+    /// After a failed connection attempt, the socket will be in the `closed`
+    /// state and the only valid action left is to `drop` the socket. A single
+    /// socket can not be used to connect more than once.
+    ///
+    /// # Typical errors
+    /// - `invalid-argument`:          The `remote-address` has the wrong address family. (EAFNOSUPPORT)
+    /// - `invalid-argument`:          `remote-address` is not a unicast address. (EINVAL, ENETUNREACH on Linux, EAFNOSUPPORT on MacOS)
+    /// - `invalid-argument`:          `remote-address` is an IPv4-mapped IPv6 address. (EINVAL, EADDRNOTAVAIL on Illumos)
+    /// - `invalid-argument`:          The IP address in `remote-address` is set to INADDR_ANY (`0.0.0.0` / `::`). (EADDRNOTAVAIL on Windows)
+    /// - `invalid-argument`:          The port in `remote-address` is set to 0. (EADDRNOTAVAIL on Windows)
+    /// - `invalid-state`:             The socket is already in the `connecting` state. (EALREADY)
+    /// - `invalid-state`:             The socket is already in the `connected` state. (EISCONN)
+    /// - `invalid-state`:             The socket is already in the `listening` state. (EOPNOTSUPP, EINVAL on Windows)
+    /// - `timeout`:                   Connection timed out. (ETIMEDOUT)
+    /// - `connection-refused`:        The connection was forcefully rejected. (ECONNREFUSED)
+    /// - `connection-reset`:          The connection was reset. (ECONNRESET)
+    /// - `connection-aborted`:        The connection was aborted. (ECONNABORTED)
+    /// - `remote-unreachable`:        The remote address is not reachable. (EHOSTUNREACH, EHOSTDOWN, ENETUNREACH, ENETDOWN, ENONET)
+    /// - `address-in-use`:            Tried to perform an implicit bind, but there were no ephemeral ports available. (EADDRINUSE, EADDRNOTAVAIL on Linux, EAGAIN on BSD)
+    ///
+    /// # References
+    /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/connect.html>
+    /// - <https://man7.org/linux/man-pages/man2/connect.2.html>
+    /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-connect>
+    /// - <https://man.freebsd.org/cgi/man.cgi?connect>
+    @since(version = 0.3.0-rc-2026-01-06)
+    connect: async func(remote-address: ip-socket-address) -> result<_, error-code>;
+    /// Start listening and return a stream of new inbound connections.
+    ///
+    /// Transitions the socket into the `listening` state. This can be called
+    /// at most once per socket.
+    ///
+    /// If the socket is not already explicitly bound, this function will
+    /// implicitly bind the socket to a random free port.
+    ///
+    /// Normally, the returned sockets are bound, in the `connected` state
+    /// and immediately ready for I/O. Though, depending on exact timing and
+    /// circumstances, a newly accepted connection may already be `closed`
+    /// by the time the server attempts to perform its first I/O on it. This
+    /// is true regardless of whether the WASI implementation uses
+    /// "synthesized" sockets or not (see Implementors Notes below).
+    ///
+    /// The following properties are inherited from the listener socket:
+    /// - `address-family`
+    /// - `keep-alive-enabled`
+    /// - `keep-alive-idle-time`
+    /// - `keep-alive-interval`
+    /// - `keep-alive-count`
+    /// - `hop-limit`
+    /// - `receive-buffer-size`
+    /// - `send-buffer-size`
+    ///
+    /// # Typical errors
+    /// - `invalid-state`:             The socket is already in the `connected` state. (EISCONN, EINVAL on BSD)
+    /// - `invalid-state`:             The socket is already in the `listening` state.
+    /// - `address-in-use`:            Tried to perform an implicit bind, but there were no ephemeral ports available. (EADDRINUSE)
+    ///
+    /// # Implementors note
+    /// This method returns a single perpetual stream that should only close
+    /// on fatal errors (if any). Yet, the POSIX' `accept` function may also
+    /// return transient errors (e.g. ECONNABORTED). The exact details differ
+    /// per operation system. For example, the Linux manual mentions:
+    ///
+    /// > Linux accept() passes already-pending network errors on the new
+    /// > socket as an error code from accept(). This behavior differs from
+    /// > other BSD socket implementations. For reliable operation the
+    /// > application should detect the network errors defined for the
+    /// > protocol after accept() and treat them like EAGAIN by retrying.
+    /// > In the case of TCP/IP, these are ENETDOWN, EPROTO, ENOPROTOOPT,
+    /// > EHOSTDOWN, ENONET, EHOSTUNREACH, EOPNOTSUPP, and ENETUNREACH.
+    /// Source: https://man7.org/linux/man-pages/man2/accept.2.html
+    ///
+    /// WASI implementations have two options to handle this:
+    /// - Optionally log it and then skip over non-fatal errors returned by
+    ///   `accept`. Guest code never gets to see these failures. Or:
+    /// - Synthesize a `tcp-socket` resource that exposes the error when
+    ///   attempting to send or receive on it. Guest code then sees these
+    ///   failures as regular I/O errors.
+    ///
+    /// In either case, the stream returned by this `listen` method remains
+    /// operational.
+    ///
+    /// # References
+    /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/listen.html>
+    /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/accept.html>
+    /// - <https://man7.org/linux/man-pages/man2/listen.2.html>
+    /// - <https://man7.org/linux/man-pages/man2/accept.2.html>
+    /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-listen>
+    /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-accept>
+    /// - <https://man.freebsd.org/cgi/man.cgi?query=listen&sektion=2>
+    /// - <https://man.freebsd.org/cgi/man.cgi?query=accept&sektion=2>
+    @since(version = 0.3.0-rc-2026-01-06)
+    listen: func() -> result<stream<tcp-socket>, error-code>;
+    /// Transmit data to peer.
+    ///
+    /// The caller should close the stream when it has no more data to send
+    /// to the peer. Under normal circumstances this will cause a FIN packet
+    /// to be sent out. Closing the stream is equivalent to calling
+    /// `shutdown(SHUT_WR)` in POSIX.
+    ///
+    /// This function may be called at most once and returns once the full
+    /// contents of the stream are transmitted or an error is encountered.
+    ///
+    /// # Typical errors
+    /// - `invalid-state`:             The socket is not in the `connected` state. (ENOTCONN)
+    /// - `connection-reset`:          The connection was reset. (ECONNRESET)
+    /// - `remote-unreachable`:        The remote address is not reachable. (EHOSTUNREACH, EHOSTDOWN, ENETUNREACH, ENETDOWN, ENONET)
+    ///
+    ///  # References
+    /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/send.html>
+    /// - <https://man7.org/linux/man-pages/man2/send.2.html>
+    /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-send>
+    /// - <https://man.freebsd.org/cgi/man.cgi?query=send&sektion=2>
+    @since(version = 0.3.0-rc-2026-01-06)
+    send: async func(data: stream<u8>) -> result<_, error-code>;
+    /// Read data from peer.
+    ///
+    /// This function returns a `stream` which provides the data received from the
+    /// socket, and a `future` providing additional error information in case the
+    /// socket is closed abnormally.
+    ///
+    /// If the socket is closed normally, `stream.read` on the `stream` will return
+    /// `read-status::closed` with no `error-context` and the future resolves to
+    /// the value `ok`. If the socket is closed abnormally, `stream.read` on the
+    /// `stream` returns `read-status::closed` with an `error-context` and the future
+    /// resolves to `err` with an `error-code`.
+    ///
+    /// `receive` is meant to be called only once per socket. If it is called more
+    /// than once, the subsequent calls return a new `stream` that fails as if it
+    /// were closed abnormally.
+    ///
+    /// If the caller is not expecting to receive any data from the peer,
+    /// they may drop the stream. Any data still in the receive queue
+    /// will be discarded. This is equivalent to calling `shutdown(SHUT_RD)`
+    /// in POSIX.
+    ///
+    /// # Typical errors
+    /// - `invalid-state`:             The socket is not in the `connected` state. (ENOTCONN)
+    /// - `connection-reset`:          The connection was reset. (ECONNRESET)
+    /// - `remote-unreachable`:        The remote address is not reachable. (EHOSTUNREACH, EHOSTDOWN, ENETUNREACH, ENETDOWN, ENONET)
+    ///
+    /// # References
+    /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/recv.html>
+    /// - <https://man7.org/linux/man-pages/man2/recv.2.html>
+    /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock/nf-winsock-recv>
+    /// - <https://man.freebsd.org/cgi/man.cgi?query=recv&sektion=2>
+    @since(version = 0.3.0-rc-2026-01-06)
+    receive: func() -> tuple<stream<u8>, future<result<_, error-code>>>;
+    /// Get the bound local address.
+    ///
+    /// POSIX mentions:
+    /// > If the socket has not been bound to a local name, the value
+    /// > stored in the object pointed to by `address` is unspecified.
+    ///
+    /// WASI is stricter and requires `get-local-address` to return `invalid-state` when the socket hasn't been bound yet.
+    ///
+    /// # Typical errors
+    /// - `invalid-state`: The socket is not bound to any local address.
+    ///
+    /// # References
+    /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/getsockname.html>
+    /// - <https://man7.org/linux/man-pages/man2/getsockname.2.html>
+    /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock/nf-winsock-getsockname>
+    /// - <https://man.freebsd.org/cgi/man.cgi?getsockname>
+    @since(version = 0.3.0-rc-2026-01-06)
+    get-local-address: func() -> result<ip-socket-address, error-code>;
+    /// Get the remote address.
+    ///
+    /// # Typical errors
+    /// - `invalid-state`: The socket is not connected to a remote address. (ENOTCONN)
+    ///
+    /// # References
+    /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/getpeername.html>
+    /// - <https://man7.org/linux/man-pages/man2/getpeername.2.html>
+    /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock/nf-winsock-getpeername>
+    /// - <https://man.freebsd.org/cgi/man.cgi?query=getpeername&sektion=2&n=1>
+    @since(version = 0.3.0-rc-2026-01-06)
+    get-remote-address: func() -> result<ip-socket-address, error-code>;
+    /// Whether the socket is in the `listening` state.
+    ///
+    /// Equivalent to the SO_ACCEPTCONN socket option.
+    @since(version = 0.3.0-rc-2026-01-06)
+    get-is-listening: func() -> bool;
+    /// Whether this is a IPv4 or IPv6 socket.
+    ///
+    /// This is the value passed to the constructor.
+    ///
+    /// Equivalent to the SO_DOMAIN socket option.
+    @since(version = 0.3.0-rc-2026-01-06)
+    get-address-family: func() -> ip-address-family;
+    /// Hints the desired listen queue size. Implementations are free to ignore this.
+    ///
+    /// If the provided value is 0, an `invalid-argument` error is returned.
+    /// Any other value will never cause an error, but it might be silently clamped and/or rounded.
+    ///
+    /// # Typical errors
+    /// - `not-supported`:        (set) The platform does not support changing the backlog size after the initial listen.
+    /// - `invalid-argument`:     (set) The provided value was 0.
+    /// - `invalid-state`:        (set) The socket is in the `connecting` or `connected` state.
+    @since(version = 0.3.0-rc-2026-01-06)
+    set-listen-backlog-size: func(value: u64) -> result<_, error-code>;
+    /// Enables or disables keepalive.
+    ///
+    /// The keepalive behavior can be adjusted using:
+    /// - `keep-alive-idle-time`
+    /// - `keep-alive-interval`
+    /// - `keep-alive-count`
+    /// These properties can be configured while `keep-alive-enabled` is false, but only come into effect when `keep-alive-enabled` is true.
+    ///
+    /// Equivalent to the SO_KEEPALIVE socket option.
+    @since(version = 0.3.0-rc-2026-01-06)
+    get-keep-alive-enabled: func() -> result<bool, error-code>;
+    @since(version = 0.3.0-rc-2026-01-06)
+    set-keep-alive-enabled: func(value: bool) -> result<_, error-code>;
+    /// Amount of time the connection has to be idle before TCP starts sending keepalive packets.
+    ///
+    /// If the provided value is 0, an `invalid-argument` error is returned.
+    /// Any other value will never cause an error, but it might be silently clamped and/or rounded.
+    /// I.e. after setting a value, reading the same setting back may return a different value.
+    ///
+    /// Equivalent to the TCP_KEEPIDLE socket option. (TCP_KEEPALIVE on MacOS)
+    ///
+    /// # Typical errors
+    /// - `invalid-argument`:     (set) The provided value was 0.
+    @since(version = 0.3.0-rc-2026-01-06)
+    get-keep-alive-idle-time: func() -> result<duration, error-code>;
+    @since(version = 0.3.0-rc-2026-01-06)
+    set-keep-alive-idle-time: func(value: duration) -> result<_, error-code>;
+    /// The time between keepalive packets.
+    ///
+    /// If the provided value is 0, an `invalid-argument` error is returned.
+    /// Any other value will never cause an error, but it might be silently clamped and/or rounded.
+    /// I.e. after setting a value, reading the same setting back may return a different value.
+    ///
+    /// Equivalent to the TCP_KEEPINTVL socket option.
+    ///
+    /// # Typical errors
+    /// - `invalid-argument`:     (set) The provided value was 0.
+    @since(version = 0.3.0-rc-2026-01-06)
+    get-keep-alive-interval: func() -> result<duration, error-code>;
+    @since(version = 0.3.0-rc-2026-01-06)
+    set-keep-alive-interval: func(value: duration) -> result<_, error-code>;
+    /// The maximum amount of keepalive packets TCP should send before aborting the connection.
+    ///
+    /// If the provided value is 0, an `invalid-argument` error is returned.
+    /// Any other value will never cause an error, but it might be silently clamped and/or rounded.
+    /// I.e. after setting a value, reading the same setting back may return a different value.
+    ///
+    /// Equivalent to the TCP_KEEPCNT socket option.
+    ///
+    /// # Typical errors
+    /// - `invalid-argument`:     (set) The provided value was 0.
+    @since(version = 0.3.0-rc-2026-01-06)
+    get-keep-alive-count: func() -> result<u32, error-code>;
+    @since(version = 0.3.0-rc-2026-01-06)
+    set-keep-alive-count: func(value: u32) -> result<_, error-code>;
+    /// Equivalent to the IP_TTL & IPV6_UNICAST_HOPS socket options.
+    ///
+    /// If the provided value is 0, an `invalid-argument` error is returned.
+    ///
+    /// # Typical errors
+    /// - `invalid-argument`:     (set) The TTL value must be 1 or higher.
+    @since(version = 0.3.0-rc-2026-01-06)
+    get-hop-limit: func() -> result<u8, error-code>;
+    @since(version = 0.3.0-rc-2026-01-06)
+    set-hop-limit: func(value: u8) -> result<_, error-code>;
+    /// The kernel buffer space reserved for sends/receives on this socket.
+    ///
+    /// If the provided value is 0, an `invalid-argument` error is returned.
+    /// Any other value will never cause an error, but it might be silently clamped and/or rounded.
+    /// I.e. after setting a value, reading the same setting back may return a different value.
+    ///
+    /// Equivalent to the SO_RCVBUF and SO_SNDBUF socket options.
+    ///
+    /// # Typical errors
+    /// - `invalid-argument`:     (set) The provided value was 0.
+    @since(version = 0.3.0-rc-2026-01-06)
+    get-receive-buffer-size: func() -> result<u64, error-code>;
+    @since(version = 0.3.0-rc-2026-01-06)
+    set-receive-buffer-size: func(value: u64) -> result<_, error-code>;
+    @since(version = 0.3.0-rc-2026-01-06)
+    get-send-buffer-size: func() -> result<u64, error-code>;
+    @since(version = 0.3.0-rc-2026-01-06)
+    set-send-buffer-size: func(value: u64) -> result<_, error-code>;
+  }
+
+  /// A UDP socket handle.
+  @since(version = 0.3.0-rc-2026-01-06)
+  resource udp-socket {
+    /// Create a new UDP socket.
+    ///
+    /// Similar to `socket(AF_INET or AF_INET6, SOCK_DGRAM, IPPROTO_UDP)` in POSIX.
+    /// On IPv6 sockets, IPV6_V6ONLY is enabled by default and can't be configured otherwise.
+    ///
+    /// Unlike POSIX, WASI sockets have no notion of a socket-level
+    /// `O_NONBLOCK` flag. Instead they fully rely on the Component Model's
+    /// async support.
+    ///
+    /// # References:
+    /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/socket.html>
+    /// - <https://man7.org/linux/man-pages/man2/socket.2.html>
+    /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-wsasocketw>
+    /// - <https://man.freebsd.org/cgi/man.cgi?query=socket&sektion=2>
+    @since(version = 0.3.0-rc-2026-01-06)
+    create: static func(address-family: ip-address-family) -> result<udp-socket, error-code>;
+    /// Bind the socket to the provided IP address and port.
+    ///
+    /// If the IP address is zero (`0.0.0.0` in IPv4, `::` in IPv6), it is left to the implementation to decide which
+    /// network interface(s) to bind to.
+    /// If the port is zero, the socket will be bound to a random free port.
+    ///
+    /// # Typical errors
+    /// - `invalid-argument`:          The `local-address` has the wrong address family. (EAFNOSUPPORT, EFAULT on Windows)
+    /// - `invalid-state`:             The socket is already bound. (EINVAL)
+    /// - `address-in-use`:            No ephemeral ports available. (EADDRINUSE, ENOBUFS on Windows)
+    /// - `address-in-use`:            Address is already in use. (EADDRINUSE)
+    /// - `address-not-bindable`:      `local-address` is not an address that can be bound to. (EADDRNOTAVAIL)
+    ///
+    /// # References
+    /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/bind.html>
+    /// - <https://man7.org/linux/man-pages/man2/bind.2.html>
+    /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock/nf-winsock-bind>
+    /// - <https://man.freebsd.org/cgi/man.cgi?query=bind&sektion=2&format=html>
+    @since(version = 0.3.0-rc-2026-01-06)
+    bind: func(local-address: ip-socket-address) -> result<_, error-code>;
+    /// Associate this socket with a specific peer address.
+    ///
+    /// On success, the `remote-address` of the socket is updated.
+    /// The `local-address` may be updated as well, based on the best network
+    /// path to `remote-address`. If the socket was not already explicitly
+    /// bound, this function will implicitly bind the socket to a random
+    /// free port.
+    ///
+    /// When a UDP socket is "connected", the `send` and `receive` methods
+    /// are limited to communicating with that peer only:
+    /// - `send` can only be used to send to this destination.
+    /// - `receive` will only return datagrams sent from the provided `remote-address`.
+    ///
+    /// The name "connect" was kept to align with the existing POSIX
+    /// terminology. Other than that, this function only changes the local
+    /// socket configuration and does not generate any network traffic.
+    /// The peer is not aware of this "connection".
+    ///
+    /// This method may be called multiple times on the same socket to change
+    /// its association, but only the most recent one will be effective.
+    ///
+    /// # Typical errors
+    /// - `invalid-argument`:          The `remote-address` has the wrong address family. (EAFNOSUPPORT)
+    /// - `invalid-argument`:          The IP address in `remote-address` is set to INADDR_ANY (`0.0.0.0` / `::`). (EDESTADDRREQ, EADDRNOTAVAIL)
+    /// - `invalid-argument`:          The port in `remote-address` is set to 0. (EDESTADDRREQ, EADDRNOTAVAIL)
+    /// - `address-in-use`:            Tried to perform an implicit bind, but there were no ephemeral ports available. (EADDRINUSE, EADDRNOTAVAIL on Linux, EAGAIN on BSD)
+    ///
+    /// # Implementors note
+    /// If the socket is already connected, some platforms (e.g. Linux)
+    /// require a disconnect before connecting to a different peer address.
+    ///
+    /// # References
+    /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/connect.html>
+    /// - <https://man7.org/linux/man-pages/man2/connect.2.html>
+    /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-connect>
+    /// - <https://man.freebsd.org/cgi/man.cgi?connect>
+    @since(version = 0.3.0-rc-2026-01-06)
+    connect: func(remote-address: ip-socket-address) -> result<_, error-code>;
+    /// Dissociate this socket from its peer address.
+    ///
+    /// After calling this method, `send` & `receive` are free to communicate
+    /// with any address again.
+    ///
+    /// The POSIX equivalent of this is calling `connect` with an `AF_UNSPEC` address.
+    ///
+    /// # Typical errors
+    /// - `invalid-state`:           The socket is not connected.
+    ///
+    /// # References
+    /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/connect.html>
+    /// - <https://man7.org/linux/man-pages/man2/connect.2.html>
+    /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-connect>
+    /// - <https://man.freebsd.org/cgi/man.cgi?connect>
+    @since(version = 0.3.0-rc-2026-01-06)
+    disconnect: func() -> result<_, error-code>;
+    /// Send a message on the socket to a particular peer.
+    ///
+    /// If the socket is connected, the peer address may be left empty. In
+    /// that case this is equivalent to `send` in POSIX. Otherwise it is
+    /// equivalent to `sendto`.
+    ///
+    /// Additionally, if the socket is connected, a `remote-address` argument
+    /// _may_ be provided but then it must be identical to the address
+    /// passed to `connect`.
+    ///
+    /// Implementations may trap if the `data` length exceeds 64 KiB.
+    ///
+    /// # Typical errors
+    /// - `invalid-argument`:        The `remote-address` has the wrong address family. (EAFNOSUPPORT)
+    /// - `invalid-argument`:        The IP address in `remote-address` is set to INADDR_ANY (`0.0.0.0` / `::`). (EDESTADDRREQ, EADDRNOTAVAIL)
+    /// - `invalid-argument`:        The port in `remote-address` is set to 0. (EDESTADDRREQ, EADDRNOTAVAIL)
+    /// - `invalid-argument`:        The socket is in "connected" mode and `remote-address` is `some` value that does not match the address passed to `connect`. (EISCONN)
+    /// - `invalid-argument`:        The socket is not "connected" and no value for `remote-address` was provided. (EDESTADDRREQ)
+    /// - `remote-unreachable`:      The remote address is not reachable. (ECONNRESET, ENETRESET on Windows, EHOSTUNREACH, EHOSTDOWN, ENETUNREACH, ENETDOWN, ENONET)
+    /// - `connection-refused`:      The connection was refused. (ECONNREFUSED)
+    /// - `datagram-too-large`:      The datagram is too large. (EMSGSIZE)
+    ///
+    /// # References
+    /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/sendto.html>
+    /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/sendmsg.html>
+    /// - <https://man7.org/linux/man-pages/man2/send.2.html>
+    /// - <https://man7.org/linux/man-pages/man2/sendmmsg.2.html>
+    /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-send>
+    /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-sendto>
+    /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-wsasendmsg>
+    /// - <https://man.freebsd.org/cgi/man.cgi?query=send&sektion=2>
+    @since(version = 0.3.0-rc-2026-01-06)
+    send: async func(data: list<u8>, remote-address: option<ip-socket-address>) -> result<_, error-code>;
+    /// Receive a message on the socket.
+    ///
+    /// On success, the return value contains a tuple of the received data
+    /// and the address of the sender. Theoretical maximum length of the
+    /// data is 64 KiB. Though in practice, it will typically be less than
+    /// 1500 bytes.
+    ///
+    /// If the socket is connected, the sender address is guaranteed to
+    /// match the remote address passed to `connect`.
+    ///
+    /// # Typical errors
+    /// - `invalid-state`:        The socket has not been bound yet.
+    /// - `remote-unreachable`:   The remote address is not reachable. (ECONNRESET, ENETRESET on Windows, EHOSTUNREACH, EHOSTDOWN, ENETUNREACH, ENETDOWN, ENONET)
+    /// - `connection-refused`:   The connection was refused. (ECONNREFUSED)
+    ///
+    /// # References
+    /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/recvfrom.html>
+    /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/recvmsg.html>
+    /// - <https://man7.org/linux/man-pages/man2/recv.2.html>
+    /// - <https://man7.org/linux/man-pages/man2/recvmmsg.2.html>
+    /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock/nf-winsock-recvfrom>
+    /// - <https://learn.microsoft.com/en-us/windows/win32/api/mswsock/nc-mswsock-lpfn_wsarecvmsg>
+    /// - <https://man.freebsd.org/cgi/man.cgi?query=recv&sektion=2>
+    @since(version = 0.3.0-rc-2026-01-06)
+    receive: async func() -> result<tuple<list<u8>, ip-socket-address>, error-code>;
+    /// Get the current bound address.
+    ///
+    /// POSIX mentions:
+    /// > If the socket has not been bound to a local name, the value
+    /// > stored in the object pointed to by `address` is unspecified.
+    ///
+    /// WASI is stricter and requires `get-local-address` to return `invalid-state` when the socket hasn't been bound yet.
+    ///
+    /// # Typical errors
+    /// - `invalid-state`: The socket is not bound to any local address.
+    ///
+    /// # References
+    /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/getsockname.html>
+    /// - <https://man7.org/linux/man-pages/man2/getsockname.2.html>
+    /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock/nf-winsock-getsockname>
+    /// - <https://man.freebsd.org/cgi/man.cgi?getsockname>
+    @since(version = 0.3.0-rc-2026-01-06)
+    get-local-address: func() -> result<ip-socket-address, error-code>;
+    /// Get the address the socket is currently "connected" to.
+    ///
+    /// # Typical errors
+    /// - `invalid-state`: The socket is not "connected" to a specific remote address. (ENOTCONN)
+    ///
+    /// # References
+    /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/getpeername.html>
+    /// - <https://man7.org/linux/man-pages/man2/getpeername.2.html>
+    /// - <https://learn.microsoft.com/en-us/windows/win32/api/winsock/nf-winsock-getpeername>
+    /// - <https://man.freebsd.org/cgi/man.cgi?query=getpeername&sektion=2&n=1>
+    @since(version = 0.3.0-rc-2026-01-06)
+    get-remote-address: func() -> result<ip-socket-address, error-code>;
+    /// Whether this is a IPv4 or IPv6 socket.
+    ///
+    /// This is the value passed to the constructor.
+    ///
+    /// Equivalent to the SO_DOMAIN socket option.
+    @since(version = 0.3.0-rc-2026-01-06)
+    get-address-family: func() -> ip-address-family;
+    /// Equivalent to the IP_TTL & IPV6_UNICAST_HOPS socket options.
+    ///
+    /// If the provided value is 0, an `invalid-argument` error is returned.
+    ///
+    /// # Typical errors
+    /// - `invalid-argument`:     (set) The TTL value must be 1 or higher.
+    @since(version = 0.3.0-rc-2026-01-06)
+    get-unicast-hop-limit: func() -> result<u8, error-code>;
+    @since(version = 0.3.0-rc-2026-01-06)
+    set-unicast-hop-limit: func(value: u8) -> result<_, error-code>;
+    /// The kernel buffer space reserved for sends/receives on this socket.
+    ///
+    /// If the provided value is 0, an `invalid-argument` error is returned.
+    /// Any other value will never cause an error, but it might be silently clamped and/or rounded.
+    /// I.e. after setting a value, reading the same setting back may return a different value.
+    ///
+    /// Equivalent to the SO_RCVBUF and SO_SNDBUF socket options.
+    ///
+    /// # Typical errors
+    /// - `invalid-argument`:     (set) The provided value was 0.
+    @since(version = 0.3.0-rc-2026-01-06)
+    get-receive-buffer-size: func() -> result<u64, error-code>;
+    @since(version = 0.3.0-rc-2026-01-06)
+    set-receive-buffer-size: func(value: u64) -> result<_, error-code>;
+    @since(version = 0.3.0-rc-2026-01-06)
+    get-send-buffer-size: func() -> result<u64, error-code>;
+    @since(version = 0.3.0-rc-2026-01-06)
+    set-send-buffer-size: func(value: u64) -> result<_, error-code>;
+  }
+}
+
+@since(version = 0.3.0-rc-2026-01-06)
+interface ip-name-lookup {
+  @since(version = 0.3.0-rc-2026-01-06)
+  use types.{ip-address};
+
+  /// Lookup error codes.
+  @since(version = 0.3.0-rc-2026-01-06)
+  enum error-code {
+    /// Unknown error
+    unknown,
+    /// Access denied.
+    ///
+    /// POSIX equivalent: EACCES, EPERM
+    access-denied,
+    /// `name` is a syntactically invalid domain name or IP address.
+    ///
+    /// POSIX equivalent: EINVAL
+    invalid-argument,
+    /// Name does not exist or has no suitable associated IP addresses.
+    ///
+    /// POSIX equivalent: EAI_NONAME, EAI_NODATA, EAI_ADDRFAMILY
+    name-unresolvable,
+    /// A temporary failure in name resolution occurred.
+    ///
+    /// POSIX equivalent: EAI_AGAIN
+    temporary-resolver-failure,
+    /// A permanent failure in name resolution occurred.
+    ///
+    /// POSIX equivalent: EAI_FAIL
+    permanent-resolver-failure,
+  }
+
+  /// Resolve an internet host name to a list of IP addresses.
+  ///
+  /// Unicode domain names are automatically converted to ASCII using IDNA encoding.
+  /// If the input is an IP address string, the address is parsed and returned
+  /// as-is without making any external requests.
+  ///
+  /// See the wasi-socket proposal README.md for a comparison with getaddrinfo.
+  ///
+  /// The results are returned in connection order preference.
+  ///
+  /// This function never succeeds with 0 results. It either fails or succeeds
+  /// with at least one address. Additionally, this function never returns
+  /// IPv4-mapped IPv6 addresses.
+  ///
+  /// The returned future will resolve to an error code in case of failure.
+  /// It will resolve to success once the returned stream is exhausted.
+  ///
+  /// # References:
+  /// - <https://pubs.opengroup.org/onlinepubs/9699919799/functions/getaddrinfo.html>
+  /// - <https://man7.org/linux/man-pages/man3/getaddrinfo.3.html>
+  /// - <https://learn.microsoft.com/en-us/windows/win32/api/ws2tcpip/nf-ws2tcpip-getaddrinfo>
+  /// - <https://man.freebsd.org/cgi/man.cgi?query=getaddrinfo&sektion=3>
+  @since(version = 0.3.0-rc-2026-01-06)
+  resolve-addresses: async func(name: string) -> result<list<ip-address>, error-code>;
+}
+
+@since(version = 0.3.0-rc-2026-01-06)
+world imports {
+  @since(version = 0.3.0-rc-2026-01-06)
+  import wasi:clocks/types@0.3.0-rc-2026-01-06;
+  @since(version = 0.3.0-rc-2026-01-06)
+  import types;
+  @since(version = 0.3.0-rc-2026-01-06)
+  import ip-name-lookup;
+}