@ai-ecoverse/slicc-kernel 1.123.1 → 1.124.0

package/dist/types/kernel/fd-table.d.ts

@@ -2,7 +2,7 @@ import type { ClipboardChannel } from './clipboard.js';
 import type { PtyPair } from './pty.js';
 import type { SealedChannel } from './sealed.js';
 import type { KernelTty } from './tty.js';
-export type KernelErrno = 'EBADF' | 'EDEADLK' | 'ENOLCK' | 'EEXIST' | 'ELOOP' | 'EOVERFLOW' | 'ENAMETOOLONG' | 'EPIPE' | 'EMFILE' | 'EINVAL' | 'ENOENT' | 'ENOTDIR' | 'ENOEXEC' | 'ECHILD' | 'ENOSYS' | 'ESPIPE' | 'ENOSPC' | 'EINTR' | 'ESRCH' | 'ENOTTY' | 'ENXIO' | 'EPERM' | 'EIO' | 'EACCES' | 'EAGAIN' | 'ENOTSOCK' | 'EAFNOSUPPORT' | 'EPROTONOSUPPORT' | 'EPROTOTYPE' | 'EOPNOTSUPP' | 'EADDRINUSE' | 'EADDRNOTAVAIL' | 'ENETUNREACH' | 'ECONNREFUSED' | 'EINPROGRESS' | 'EISCONN' | 'ENOTCONN' | 'EROFS' | 'EFBIG' | 'EALREADY' | 'ETIMEDOUT' | 'ECONNABORTED' | 'EHOSTUNREACH' | 'ECONNRESET' | 'EMSGSIZE' | 'EDESTADDRREQ' | 'ENOPROTOOPT' | 'ENOTSUP' | 'EILSEQ';
+export type KernelErrno = 'EBADF' | 'EPROTO' | 'EDEADLK' | 'ENOLCK' | 'EEXIST' | 'ELOOP' | 'EOVERFLOW' | 'ENAMETOOLONG' | 'EPIPE' | 'EMFILE' | 'EINVAL' | 'ENOENT' | 'ENOTDIR' | 'ENOEXEC' | 'ECHILD' | 'ENOSYS' | 'ESPIPE' | 'ENOSPC' | 'EINTR' | 'ESRCH' | 'ENOTTY' | 'ENXIO' | 'EPERM' | 'EIO' | 'EACCES' | 'EAGAIN' | 'ENOTSOCK' | 'EAFNOSUPPORT' | 'EPROTONOSUPPORT' | 'EPROTOTYPE' | 'EOPNOTSUPP' | 'EADDRINUSE' | 'EADDRNOTAVAIL' | 'ENETUNREACH' | 'ECONNREFUSED' | 'EINPROGRESS' | 'EISCONN' | 'ENOTCONN' | 'EROFS' | 'EFBIG' | 'EALREADY' | 'ETIMEDOUT' | 'ECONNABORTED' | 'EHOSTUNREACH' | 'ECONNRESET' | 'EMSGSIZE' | 'EDESTADDRREQ' | 'ENOPROTOOPT' | 'ENOTSUP' | 'EILSEQ';
 export declare class KernelError extends Error {
     readonly code: KernelErrno;
     readonly detail?: string;

package/dist/types/kernel/host-ops.d.ts

@@ -13,6 +13,7 @@ export type HostSyscall = {
 } | {
     op: 'unlock';
     path: string;
+    fd?: number;
 } | ({
     op: 'lk-set';
     kind: LockKind | 'unlock';

package/dist/types/kernel/lock-service.d.ts

@@ -24,6 +24,8 @@ export interface KernelLocks {
     dropFile(key: string, owner: number): void;
     release(pid: number): void;
     lock(pid: number, path: string, exclusive: boolean, fd: number): boolean;
+    wholeFree?(pid: number, path: string, exclusive: boolean): boolean;
+    flockFree?(key: string, owner: object, kind: FlockKind): boolean;
     unlock(pid: number, path: string): void;
     closed(pid: number, fd: number): void;
 }
@@ -92,6 +94,8 @@ export declare class LockService implements KernelLocks {
     private flockWait;
     private flockDrop;
     lock(pid: number, path: string, exclusive: boolean, fd: number): boolean;
+    wholeFree(pid: number, path: string, exclusive: boolean): boolean;
+    flockFree(key: string, owner: object, kind: FlockKind): boolean;
     unlock(pid: number, path: string): void;
     closed(pid: number, fd: number): void;
 }

package/dist/types/kernel/locks.d.ts

@@ -20,6 +20,7 @@ export declare class FlockTable {
     private readonly held;
     private readonly keys;
     private readonly wakers;
+    isFree(key: string, owner: object, kind: FlockKind): boolean;
     private free;
     set(key: string, owner: object, kind: FlockKind | 'unlock'): boolean;
     wait(key: string, owner: object, kind: FlockKind, blocking: () => AbortSignal): Promise<void>;
@@ -45,6 +46,8 @@ export declare class LockTable {
     entries(): Array<[string, RecordLock[]]>;
     holds(owner: number): boolean;
     dropFile(key: string, owner: number): void;
+    wholeFree(pid: number, path: string, exclusive: boolean): boolean;
+    flockFree(key: string, owner: object, kind: FlockKind): boolean;
     lock(pid: number, path: string, exclusive: boolean, fd: number): boolean;
     unlock(pid: number, path: string): void;
     closed(pid: number, fd: number): void;

package/dist/types/kernel/net/network.d.ts

@@ -13,9 +13,11 @@ export declare function missingTransport(): RealmTransport;
 export declare function memoryCaStore(): CaStore;
 export declare function caStore(name: string | false): CaStore;
 export declare function packageTlsEngine(fs: KernelFs, modules: string): () => Promise<TlsEngineModule>;
+export declare function packageTlsRoots(fs: KernelFs, modules: string): () => Promise<Uint8Array>;
 export interface NetworkOptions {
     transport?: RealmTransport;
     engine: () => Promise<TlsEngine>;
+    roots?: () => Promise<Uint8Array>;
     ca: () => Promise<RealmCa>;
     now?: () => number;
 }

package/dist/types/kernel/net/switch-conn.d.ts

@@ -0,0 +1,28 @@
+import type { UplinkConn } from './uplink.js';
+export declare class SwitchConn implements UplinkConn {
+    private readonly raw;
+    private readonly box;
+    private pulling;
+    private waiters;
+    private switching;
+    private secure;
+    private failed;
+    constructor(raw: UplinkConn);
+    get localAddr(): string;
+    get remoteAddr(): string;
+    get upgraded(): boolean;
+    private wake;
+    private changed;
+    private pull;
+    private take;
+    private rawRead;
+    read(): Promise<Uint8Array | null>;
+    private settled;
+    write(bytes: Uint8Array): Promise<number>;
+    closeWrite(): void;
+    close(): void;
+    upgrade<T>(make: (raw: UplinkConn) => Promise<{
+        conn: UplinkConn;
+        info: T;
+    }>): Promise<T>;
+}

package/dist/types/kernel/net/tls-client.d.ts

@@ -0,0 +1,22 @@
+import { type TlsEngine, type TlsStore } from './tls-engine.js';
+import type { UplinkConn } from './uplink.js';
+export declare function verifyCode(flags: number): string | undefined;
+export interface TlsClientInfo {
+    protocol: 'TLSv1.2' | 'TLSv1.3';
+    alpnProtocol: string | false;
+    authorized: boolean;
+    authorizationError?: string;
+    authorizationText?: string;
+    peerCertificates: Uint8Array[];
+}
+export interface TlsClientOptions {
+    engine: TlsEngine;
+    store: TlsStore | undefined;
+    servername: string;
+    alpn: readonly string[];
+    insecure: boolean;
+}
+export declare function tlsClient(conn: UplinkConn, o: TlsClientOptions, taken?: Uint8Array): Promise<{
+    conn: UplinkConn;
+    info: TlsClientInfo;
+}>;

package/dist/types/kernel/net/tls-engine.d.ts

@@ -1,9 +1,16 @@
 type TlsExport = 'malloc' | 'free' | 'tls_last_error' | 'tls_strerror' | 'tls_leaf_new' | 'tls_leaf_spki' | 'tls_leaf_add_cert' | 'tls_leaf_free' | 'tls_session_new' | 'tls_feed' | 'tls_feed_eof' | 'tls_in_room' | 'tls_read' | 'tls_write' | 'tls_out_size' | 'tls_out_take' | 'tls_close' | 'tls_alpn_http11' | 'tls_session_free';
+type TlsClientExport = 'tls_ca_new' | 'tls_ca_add_der' | 'tls_ca_add_bundle' | 'tls_ca_free' | 'tls_client_new' | 'tls_handshake' | 'tls_verify_result' | 'tls_verify_info' | 'tls_alpn' | 'tls_version' | 'tls_peer_count' | 'tls_peer_der';
 export type TlsEngineModule = {
     readonly HEAPU8: Uint8Array;
 } & {
     readonly [K in TlsExport as `_${K}`]: (...args: number[]) => number;
+} & {
+    readonly [K in TlsClientExport as `_${K}`]?: (...args: number[]) => number;
+};
+type TlsClientModule = TlsEngineModule & {
+    readonly [K in TlsClientExport as `_${K}`]: (...args: number[]) => number;
 };
+export declare const TLS_CLIENT_INSECURE_SKIP_VERIFY = 1;
 export declare class TlsError extends Error {
     readonly code: number;
     constructor(code: number, message: string);
@@ -19,6 +26,20 @@ export declare class TlsEngine {
     session(leaf: TlsLeaf, host: string): TlsSession;
     withBytes<T>(bytes: Uint8Array, fn: (ptr: number) => T): T;
     intoScratch(fn: (ptr: number, max: number) => number): number | Uint8Array;
+    get client(): TlsClientModule | undefined;
+    private clientModule;
+    store(): TlsStore;
+    clientSession(store: TlsStore | undefined, servername: string, alpn: readonly string[], flags: number): TlsSession;
+    verifyInfo(flags: number): string;
+}
+export declare class TlsStore {
+    private readonly engine;
+    private readonly m;
+    readonly ptr: number;
+    constructor(engine: TlsEngine, m: TlsClientModule, ptr: number);
+    add(der: Uint8Array): void;
+    addBundle(bytes: Uint8Array): number;
+    release(): void;
 }
 export declare class TlsLeaf {
     private readonly engine;
@@ -41,6 +62,12 @@ export declare class TlsSession {
     take(): Uint8Array;
     close(): void;
     free(): void;
+    private get c();
+    handshake(): boolean;
+    get verifyResult(): number;
+    get version(): number;
+    get alpn(): string | undefined;
+    peerChain(): Uint8Array[];
 }
 export declare function loadTlsEngine(load: () => Promise<TlsEngineModule>): Promise<TlsEngine>;
 export {};

package/dist/types/kernel/net/tls-uplink.d.ts

@@ -0,0 +1,35 @@
+import type { KernelSocket, LoopbackNet } from '../socket.js';
+import { type TlsClientInfo } from './tls-client.js';
+import type { TlsEngine } from './tls-engine.js';
+import type { ResolveFamily } from './uplink.js';
+export interface TlsClientSupport {
+    engine: () => Promise<TlsEngine>;
+    roots: () => Promise<Uint8Array>;
+}
+export interface SecureRequest {
+    servername?: string;
+    alpn?: string[];
+    ca?: true | string[];
+    insecure?: boolean;
+}
+export interface SecureProcess {
+    net: LoopbackNet;
+    blocking(): AbortSignal;
+    resolve(name: string, family: ResolveFamily, blocking: () => AbortSignal): Promise<string[]>;
+}
+export declare function serverName(name: string): string;
+export interface SecureSession {
+    path: 'kernel';
+    substitutes: false;
+    protocol: TlsClientInfo['protocol'];
+    alpnProtocol: string | false;
+    authorized: boolean;
+    authorizationError?: string;
+    authorizationText?: string;
+    servername: string;
+    peerCertificates: string[];
+}
+export declare function supportOf(net: LoopbackNet): TlsClientSupport;
+export declare function uplinkAddress(proc: SecureProcess, host: string): Promise<string>;
+export declare function connectSecure(proc: SecureProcess, socket: KernelSocket, host: string, port: number, req: SecureRequest): Promise<SecureSession>;
+export declare function upgradeSecure(proc: SecureProcess, socket: KernelSocket, req: SecureRequest): Promise<SecureSession>;

package/dist/types/kernel/socket-syscalls.d.ts

@@ -63,7 +63,16 @@ export type SocketSyscall = {
     port: number;
     servername?: string;
     alpn?: string[];
-    ca?: boolean;
+    ca?: true | string[];
+    insecure?: boolean;
+    path?: 'kernel' | 'transport';
+} | {
+    op: 'sock-tls-upgrade';
+    fd: number;
+    servername?: string;
+    alpn?: string[];
+    ca?: true | string[];
+    insecure?: boolean;
 } | {
     op: 'sock-recvfrom';
     fd: number;

package/dist/types/kernel/socket.d.ts

@@ -1,7 +1,9 @@
 import type { Datagram, InetAddr, KernelDgram } from './dgram.js';
 import { type KernelFile, type PollState } from './fd-table.js';
 import { type Destination, Routes } from './net/routes.js';
-import type { NetworkUplink } from './net/uplink.js';
+import { SwitchConn } from './net/switch-conn.js';
+import type { TlsClientSupport } from './net/tls-uplink.js';
+import type { NetworkUplink, UplinkConn } from './net/uplink.js';
 import { KernelPipe } from './pipe.js';
 import type { SealedCaller } from './sealed.js';
 import type { UnixDgram } from './unix-dgram.js';
@@ -85,7 +87,16 @@ export declare class KernelSocket implements KernelFile {
     connect(addr: SockAddr, viaUplink?: boolean, cred?: PeerCred, stamp?: ConnectorStamp, waits?: boolean, name?: SocketName): Promise<void> | undefined;
     private join;
     private queued;
+    private switch;
+    connectSecure(addr: Extract<SockAddr, {
+        family: 'inet';
+    }>, route: UplinkRoute, secure: (conn: SwitchConn) => Promise<void>): Promise<void>;
+    upgradeSecure<T>(make: (raw: UplinkConn) => Promise<{
+        conn: UplinkConn;
+        info: T;
+    }>): Promise<T>;
     private dial;
+    private dialFailed;
     private unlink;
     shutdown(how: number): void;
     getOption(level: number, name: number): number;
@@ -109,6 +120,7 @@ export declare class LoopbackNet {
     useOrigins(serve: (conn: KernelSocket, origin: string) => Promise<void>): void;
     serveOrigin(conn: KernelSocket, origin: string): void;
     useUplink(route: UplinkRoute): void;
+    tlsClient: TlsClientSupport | undefined;
     uplinkFor(host: string): UplinkRoute | undefined;
     destination(host: string): Destination;
     bindDgram(socket: KernelDgram, addr: SockAddr, kernel?: boolean): InetAddr;

package/dist/types/process/js/js-net.d.ts

@@ -4,16 +4,21 @@ export interface JsAddress {
     port: number;
 }
 export interface JsTlsSession {
-    readonly protocol: 'transport';
-    readonly alpnProtocol: string;
-    readonly authorized: true;
+    readonly path: 'transport' | 'kernel';
+    readonly substitutes: boolean;
+    readonly protocol: 'transport' | 'TLSv1.2' | 'TLSv1.3';
+    readonly alpnProtocol: string | false;
+    readonly authorized: boolean;
+    readonly authorizationError?: string;
     readonly servername: string;
+    readonly peerCertificates?: readonly Uint8Array[];
 }
 export interface JsTlsOptions {
     servername?: string;
     alpn?: string[];
     rejectUnauthorized?: boolean;
     ca?: unknown;
+    path?: 'kernel' | 'transport';
 }
 export interface JsConnection {
     readonly fd: number;
@@ -40,9 +45,10 @@ export interface JsListenOptions {
 }
 export interface JsConnectOptions {
     host?: string;
-    port: number;
+    port?: number;
     signal?: AbortSignal;
     tls?: JsTlsOptions;
+    socket?: JsConnection;
 }
 export interface JsResolveOptions {
     family?: 0 | 4 | 6;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-kernel",
-  "version": "1.123.1",
+  "version": "1.124.0",
   "description": "SLICC's wasm-realm kernel: run Emscripten programs in the browser against OPFS, with fork, spawn, pipes and waitpid",
   "type": "module",
   "license": "Apache-2.0",
@@ -67,12 +67,12 @@
     "@ai-ecoverse/slicc-node": "2.5.1",
     "@ai-ecoverse/slicc-scrub": "1.0.0",
     "@ai-ecoverse/slicc-shared-web": "1.23.2",
-    "@ai-ecoverse/wasi-cargo": "0.99.0-2",
+    "@ai-ecoverse/wasi-cargo": "0.99.0-3",
     "@ai-ecoverse/wasi-pnpm": "12.9.1-9",
     "@ai-ecoverse/wasi-ripgrep": "15.2.0-5",
     "@ai-ecoverse/wasi-rustc": "1.98.1-4",
     "@ai-ecoverse/wasi-zig": "0.16.0-15",
-    "@ai-ecoverse/wasix-python": "3.14.2-25",
+    "@ai-ecoverse/wasix-python": "3.14.2-27",
     "@ai-ecoverse/wasm-bash": "5.3.0-19",
     "@ai-ecoverse/wasm-coreutils": "9.12.0-9",
     "@ai-ecoverse/wasm-curl": "8.22.0-6",
@@ -81,7 +81,7 @@
     "@ai-ecoverse/wasm-procps": "4.0.7-3",
     "@ai-ecoverse/wasm-sqlite3": "3.54.0-5",
     "@ai-ecoverse/wasm-tar": "1.35.0-7",
-    "@ai-ecoverse/wasm-tls-engine": "4.2.0-1",
+    "@ai-ecoverse/wasm-tls-engine": "4.2.0-2",
     "@ai-ecoverse/wasm-tree": "2.3.2-4",
     "@ai-ecoverse/wasm-util-linux": "2.42.4-3",
     "@biomejs/biome": "2.5.15",