Add -sNODERAWSOCKETS backend for real TCP & UDP on Node.js

This adds a new `-sNODERAWSOCKETS` setting that for supporting direct full sockets on Node.js via the `node:net` for TCP and `node:dgram` for UDP modules, without needing `ws`, an external proxy process, or pthreads.

* Full support for both outgoing and incoming TCP, using the `node:net` APIs.
* Full support for UDP using the `node:dgram` APIs
* Support for threading, with tests
* Support for IPV6

To support these embeddings without JSPI being mandatory requires using `process.binding('tcp_wrap')` and `process.binding('udp_wrap')` in Node.js, which are used here to support older versions of Node.js.

Further, to avoid having to rely on private APIs in modern Node.js I actually implemented upstream Node.js PRs to make public API surface area available for the full embedding in the following:

* nodejs/node#63838
* nodejs/node#63932
* nodejs/node#63951
* nodejs/node#63825

Then this PR conditionally checks these features and uses the public APIs as defined by them when it is able to, falling back to `tcp_wrap` and `udp_wrap` only when not supported. While Node.js with these features has not yet been released, as soon as all three have landed, we can rely on this surface area for modern 26+ versions of Node.js compat.

Author: guybedford

ChangeLog.md

@@ -20,6 +20,11 @@ See docs/process.md for more on how version tagging works.
 
 6.0.2 (in development)
 ----------------------
+- New `-sNODERAWSOCKETS` setting that backs the POSIX sockets API with real TCP
+  (`node:net`) and UDP (`node:dgram`) sockets on Node.js, with no `ws`, proxy
+  process, or pthreads required. Supports incoming and outgoing TCP, UDP, IPv6,
+  and `-pthread` with `PROXY_TO_PTHREAD`. Uses the public node APIs where
+  available, falling back to `tcp_wrap`/`udp_wrap` on older Node.js. (#27080)
 
 6.0.1 - 06/22/26
 ----------------

site/source/docs/tools_reference/settings_reference.rst

@@ -588,6 +588,35 @@ sockets calls from browser to native world.
 
 Default value: false
 
+.. _noderawsockets:
+
+NODERAWSOCKETS
+==============
+
+If enabled, the POSIX sockets API is backed by Node.js's ``node:net``
+module, giving real non-blocking outgoing TCP sockets with no WebSockets,
+proxy process or pthreads. This is the sockets counterpart to
+:ref:`NODERAWFS`: where :ref:`NODERAWFS` gives direct access to the host
+filesystem, this gives direct access to host sockets. It only works under
+node and is ignored elsewhere.
+
+It supports full TCP (outgoing connect plus bind, listen and accept for
+servers) and UDP. TCP clients use the public ``node:net`` API when possible,
+falling back to the private ``tcp_wrap``/``udp_wrap`` handles on older
+Node.js.
+
+It is event-driven. Socket readiness comes through the same
+``emscripten_set_socket_*_callback`` hooks the WebSocket backend uses, so it
+works with existing readiness reactors. It cannot be combined with the
+WebSocket emulation, :ref:`PROXY_POSIX_SOCKETS` or :ref:`SOCKET_WEBRTC`.
+
+It works under -pthread with :ref:`PROXY_TO_PTHREAD`, where main() and every socket
+syscall run on a single worker alongside the node handles and their event
+loop. As with the WebSocket backend, sharing a socket across threads under a
+plain -pthread build (without PROXY_TO_PTHREAD) is not supported.
+
+Default value: false
+
 .. _websocket_subprotocol:
 
 WEBSOCKET_SUBPROTOCOL

src/lib/libsigs.js

@@ -271,6 +271,7 @@ sigs = {
   __syscall_rmdir__sig: 'ip',
   __syscall_sendmsg__sig: 'iipiiii',
   __syscall_sendto__sig: 'iippipi',
+  __syscall_setsockopt__sig: 'iiiipii',
   __syscall_shutdown__sig: 'iiiiiii',
   __syscall_socket__sig: 'iiiiiii',
   __syscall_stat64__sig: 'ipp',

src/lib/libsockfs.js

@@ -8,7 +8,11 @@ addToLibrary({
   $SOCKFS__postset: () => {
     addAtInit('SOCKFS.root = FS.mount(SOCKFS, {}, null);');
   },
-  $SOCKFS__deps: ['$FS'],
+  $SOCKFS__deps: ['$FS',
+#if NODERAWSOCKETS
+    '$nodeSockOps',
+#endif
+  ],
   $SOCKFS: {
 #if expectToReceiveOnModule('websocket')
     websocketArgs: {},
@@ -44,8 +48,12 @@ addToLibrary({
       return FS.createNode(null, '/', {{{ cDefs.S_IFDIR | 0o777 }}}, 0);
     },
     createSocket(family, type, protocol) {
-      // Emscripten only supports AF_INET
-      if (family != {{{ cDefs.AF_INET }}}) {
+      if (family != {{{ cDefs.AF_INET }}}
+#if NODERAWSOCKETS
+          // The node:net backend supports IPv6; other backends are IPv4 only.
+          && family != {{{ cDefs.AF_INET6 }}}
+#endif
+         ) {
         throw new FS.ErrnoError({{{ cDefs.EAFNOSUPPORT }}});
       }
       type &= ~{{{ cDefs.SOCK_CLOEXEC | cDefs.SOCK_NONBLOCK }}}; // Some applications may pass it; it makes no sense for a single process.
@@ -69,6 +77,8 @@ addToLibrary({
         pending: [],
         recv_queue: [],
 #if SOCKET_WEBRTC
+#elif NODERAWSOCKETS
+        sock_ops: nodeSockOps
 #else
         sock_ops: SOCKFS.websocket_sock_ops
 #endif
@@ -726,7 +736,7 @@ addToLibrary({
 
         return res;
       }
-    }
+    },
   },
 
   /*