@ai-ecoverse/slicc-kernel 1.123.1 → 1.124.0

package/dist/process-worker.js

@@ -2603,7 +2603,7 @@ var KERNEL_VERSION, OS_RELEASE;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    KERNEL_VERSION = true ? "1.123.1" : "0.0.0-dev";
+    KERNEL_VERSION = true ? "1.124.0" : "0.0.0-dev";
     OS_RELEASE = "6.0.0-slicc";
   }
 });
@@ -10552,6 +10552,7 @@ function importsContext({
     },
     tryLock(fd, exclusive) {
       const path = requirePath(fd);
+      host.fds.promote(fd);
       try {
         call2({ op: "lock", path, exclusive, fd });
       } catch (err) {
@@ -10561,7 +10562,7 @@ function importsContext({
       return E.SUCCESS;
     },
     unlock(fd) {
-      call2({ op: "unlock", path: requirePath(fd) });
+      call2({ op: "unlock", path: requirePath(fd), fd });
     }
   };
   const ctx = {
@@ -13723,7 +13724,9 @@ var init_js_kernel = __esm({
       "fd-write",
       "fd-close",
       "fd-open-clipboard",
-      "net-ws-ready"
+      "net-ws-ready",
+      "sock-tls",
+      "sock-tls-upgrade"
     ]);
     JsKernel = class {
       header;
@@ -15158,6 +15161,69 @@ var init_js_fetch = __esm({
 });
 
 // src/process/js/js-net.ts
+function fromBase64(text) {
+  const bin = atob(text);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
+function toBase64(bytes) {
+  let bin = "";
+  for (const b of bytes) bin += String.fromCharCode(b);
+  return btoa(bin);
+}
+function caList(ca) {
+  const items = Array.isArray(ca) ? ca : [ca];
+  const out = [];
+  for (const item of items) {
+    if (item instanceof Uint8Array && item[0] === 48) out.push(toBase64(item));
+    else {
+      const text = item instanceof Uint8Array ? new TextDecoder().decode(item) : String(item);
+      out.push(...[...text.matchAll(PEM)].map((m) => m[1].replace(/\s+/g, "")));
+    }
+  }
+  return out;
+}
+function tlsRequest(tls) {
+  return {
+    ...tls.servername ? { servername: tls.servername } : {},
+    ...tls.alpn ? { alpn: [...tls.alpn] } : {},
+    ...tls.ca !== void 0 ? { ca: caList(tls.ca) } : {},
+    ...tls.rejectUnauthorized === false ? { insecure: true } : {}
+  };
+}
+function sessionOf(r) {
+  if (r.path !== "kernel") {
+    return Object.freeze({
+      path: "transport",
+      substitutes: true,
+      protocol: "transport",
+      alpnProtocol: r.alpnProtocol,
+      authorized: true,
+      servername: r.servername
+    });
+  }
+  return Object.freeze({
+    path: "kernel",
+    substitutes: false,
+    protocol: r.protocol ?? "TLSv1.2",
+    alpnProtocol: r.alpnProtocol,
+    authorized: r.authorized === true,
+    ...r.authorizationError ? { authorizationError: r.authorizationError } : {},
+    servername: r.servername,
+    peerCertificates: Object.freeze((r.peerCertificates ?? []).map(fromBase64))
+  });
+}
+async function secureCall(call2) {
+  try {
+    return await call2();
+  } catch (err) {
+    const e = err;
+    const code2 = e.code === "EPROTO" && e.detail ? TLS_CODE.exec(e.detail)?.[1] : void 0;
+    if (code2) throw new JsCallError(code2, "connect", e.detail);
+    throw err;
+  }
+}
 function errnoName(errno2) {
   const found = Object.entries(E).find(([, n]) => n === errno2);
   return found ? `E${found[0]}` : "EIO";
@@ -15247,20 +15313,22 @@ function netOps(kernel, io) {
     };
   };
   const tlsConnect = async (options, tls) => {
-    const r = await kernel.json({
-      op: "sock-tls",
-      host: options.host ?? "localhost",
-      port: port(options.port),
-      ...tls.servername ? { servername: tls.servername } : {},
-      ...tls.alpn ? { alpn: [...tls.alpn] } : {},
-      ...tls.ca !== void 0 ? { ca: true } : {}
-    });
-    const session = Object.freeze({
-      protocol: "transport",
-      alpnProtocol: r.alpnProtocol,
-      authorized: true,
-      servername: r.servername
-    });
+    const common = tlsRequest(
+      options.socket && !tls.servername && options.host ? { ...tls, servername: options.host } : tls
+    );
+    const r = await secureCall(
+      () => kernel.json(
+        options.socket ? { op: "sock-tls-upgrade", fd: options.socket.fd, ...common } : {
+          op: "sock-tls",
+          host: options.host ?? "localhost",
+          port: port(options.port),
+          ...common,
+          ...tls.path ? { path: tls.path } : {}
+        }
+      )
+    );
+    const session = sessionOf(r);
+    if (options.socket) return Object.assign(Object.create(options.socket), { tls: session });
     return Object.assign(await connection(r.fd), { tls: session });
   };
   const lookup2 = async (name3, options = {}) => {
@@ -15317,12 +15385,14 @@ function netOps(kernel, io) {
     }
   };
 }
-var SHUT_RD, SHUT_WR, IPV4, NEVER, SOL_SOCKET2, SO_ERROR2;
+var PEM, TLS_CODE, SHUT_RD, SHUT_WR, IPV4, NEVER, SOL_SOCKET2, SO_ERROR2;
 var init_js_net = __esm({
   "src/process/js/js-net.ts"() {
     "use strict";
     init_wasi_abi();
     init_js_kernel();
+    PEM = /-----BEGIN CERTIFICATE-----([\s\S]*?)-----END CERTIFICATE-----/g;
+    TLS_CODE = /^([A-Z][A-Z0-9_]+): /;
     SHUT_RD = 0;
     SHUT_WR = 1;
     IPV4 = /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;