@ai-ecoverse/slicc-kernel 1.124.12 → 1.124.13

package/dist/types/fs/unlinked.d.ts

@@ -16,6 +16,7 @@ export interface UnlinkHolder {
     isKept(path: string): boolean;
     keep(path: string, file: KeptFile): void;
     unkeep(path: string, file: KeptFile): void;
+    moving?(path: string): () => void;
 }
 export interface UnlinkOwner {
     readonly id: string;

package/dist/types/index.d.ts

@@ -36,7 +36,7 @@ export type { ProcessMountPolicy, ProcessMountRequest } from './mount/syscall.js
 export type { JsChild, JsExited, JsSpawnOptions, JsStdio } from './process/js/js-children.js';
 export type { JsCrontabAnswer, JsCrontabCall, JsFdStatus, JsFdType, JsFile, JsOpenOptions, JsProgramContext, JsSignal, JsSudoAnswer, } from './process/js/js-context.js';
 export type { JsStatFs } from './process/js/js-io.js';
-export type { JsAddress, JsConnection, JsConnectOptions, JsListener, JsListenOptions, JsNet, JsResolveOptions, JsTlsOptions, JsTlsSession, } from './process/js/js-net.js';
+export type { JsAddress, JsConnection, JsConnectOptions, JsListener, JsListenOptions, JsNet, JsResolveOptions, JsTlsCipher, JsTlsOptions, JsTlsSession, } from './process/js/js-net.js';
 export type { JsRunOptions, JsRunResult, JsRunStdio } from './process/js/js-run.js';
 export type { JsCred, JsSyncContext, JsSyncFile } from './process/js/js-sync.js';
 export type { JsTermios, JsTty, JsTtySize } from './process/js/js-tty.js';

package/dist/types/kernel/net/tls-ciphers.d.ts

@@ -0,0 +1,6 @@
+export interface TlsCipher {
+    name: string;
+    standardName: string;
+    version: 'TLSv1.0' | 'TLSv1.2' | 'TLSv1.3';
+}
+export declare function cipherOf(id: number, protocol: TlsCipher['version']): TlsCipher;

package/dist/types/kernel/net/tls-client.d.ts

@@ -1,4 +1,5 @@
-import { type TlsEngine, type TlsStore } from './tls-engine.js';
+import { type TlsCipher } from './tls-ciphers.js';
+import { type TlsEngine, type TlsSession, type TlsStore } from './tls-engine.js';
 import type { UplinkConn } from './uplink.js';
 export declare function verifyCode(flags: number): string | undefined;
 export interface TlsClientInfo {
@@ -8,6 +9,11 @@ export interface TlsClientInfo {
     authorizationError?: string;
     authorizationText?: string;
     peerCertificates: Uint8Array[];
+    cipher?: TlsCipher;
+    clientCertificate?: boolean;
+    sni?: boolean;
+    hostnameChecked?: boolean;
+    hostnameMatches?: boolean;
 }
 export interface TlsClientOptions {
     engine: TlsEngine;
@@ -15,7 +21,13 @@ export interface TlsClientOptions {
     servername: string;
     alpn: readonly string[];
     insecure: boolean;
+    sni?: boolean;
+    checkHostname?: boolean;
+    session?: TlsSession;
+    clientCertificate?: boolean;
 }
+export declare function clientFlags(o: TlsClientOptions): number;
+export declare function openSession(o: TlsClientOptions): TlsSession;
 export declare function tlsClient(conn: UplinkConn, o: TlsClientOptions, taken?: Uint8Array): Promise<{
     conn: UplinkConn;
     info: TlsClientInfo;

package/dist/types/kernel/net/tls-engine.d.ts

@@ -1,16 +1,21 @@
 type TlsExport = 'malloc' | 'free' | 'tls_last_error' | 'tls_strerror' | 'tls_leaf_new' | 'tls_leaf_spki' | 'tls_leaf_add_cert' | 'tls_leaf_free' | 'tls_session_new' | 'tls_feed' | 'tls_feed_eof' | 'tls_in_room' | 'tls_read' | 'tls_write' | 'tls_out_size' | 'tls_out_take' | 'tls_close' | 'tls_alpn_http11' | 'tls_session_free';
 type TlsClientExport = 'tls_ca_new' | 'tls_ca_add_der' | 'tls_ca_add_bundle' | 'tls_ca_free' | 'tls_client_new' | 'tls_handshake' | 'tls_verify_result' | 'tls_verify_info' | 'tls_alpn' | 'tls_version' | 'tls_peer_count' | 'tls_peer_der';
+type TlsSessionExport = 'tls_client_cert' | 'tls_ciphersuite' | 'tls_name_mismatch';
 export type TlsEngineModule = {
     readonly HEAPU8: Uint8Array;
 } & {
     readonly [K in TlsExport as `_${K}`]: (...args: number[]) => number;
 } & {
     readonly [K in TlsClientExport as `_${K}`]?: (...args: number[]) => number;
+} & {
+    readonly [K in TlsSessionExport as `_${K}`]?: (...args: number[]) => number;
 };
 type TlsClientModule = TlsEngineModule & {
     readonly [K in TlsClientExport as `_${K}`]: (...args: number[]) => number;
 };
 export declare const TLS_CLIENT_INSECURE_SKIP_VERIFY = 1;
+export declare const TLS_CLIENT_NO_SNI = 2;
+export declare const TLS_CLIENT_VERIFY_CHAIN_ONLY = 4;
 export declare class TlsError extends Error {
     readonly code: number;
     constructor(code: number, message: string);
@@ -25,7 +30,9 @@ export declare class TlsEngine {
     leaf(): TlsLeaf;
     session(leaf: TlsLeaf, host: string): TlsSession;
     withBytes<T>(bytes: Uint8Array, fn: (ptr: number) => T): T;
+    withSecret<T>(bytes: Uint8Array, fn: (ptr: number) => T): T;
     intoScratch(fn: (ptr: number, max: number) => number): number | Uint8Array;
+    get sessionControls(): boolean;
     get client(): TlsClientModule | undefined;
     private clientModule;
     store(): TlsStore;
@@ -67,6 +74,9 @@ export declare class TlsSession {
     get verifyResult(): number;
     get version(): number;
     get alpn(): string | undefined;
+    ownCert(chain: Uint8Array, key: Uint8Array, pass: Uint8Array): void;
+    get ciphersuite(): number;
+    get nameMismatch(): boolean;
     peerChain(): Uint8Array[];
 }
 export declare function loadTlsEngine(load: () => Promise<TlsEngineModule>): Promise<TlsEngine>;

package/dist/types/kernel/net/tls-uplink.d.ts

@@ -1,6 +1,6 @@
 import type { KernelSocket, LoopbackNet } from '../socket.js';
 import { type TlsClientInfo } from './tls-client.js';
-import type { TlsEngine } from './tls-engine.js';
+import { type TlsEngine } from './tls-engine.js';
 import type { ResolveFamily } from './uplink.js';
 export interface TlsClientSupport {
     engine: () => Promise<TlsEngine>;
@@ -11,6 +11,14 @@ export interface SecureRequest {
     alpn?: string[];
     ca?: true | string[];
     insecure?: boolean;
+    sni?: false;
+    checkHostname?: false;
+    clientCert?: ClientCertRequest;
+}
+export interface ClientCertRequest {
+    chain: string[];
+    key: string;
+    passphrase?: string;
 }
 export interface SecureProcess {
     net: LoopbackNet;
@@ -28,6 +36,11 @@ export interface SecureSession {
     authorizationText?: string;
     servername: string;
     peerCertificates: string[];
+    cipher?: TlsClientInfo['cipher'];
+    clientCertificate?: boolean;
+    sni?: boolean;
+    hostnameChecked?: boolean;
+    hostnameMatches?: boolean;
 }
 export declare function supportOf(net: LoopbackNet): TlsClientSupport;
 export declare function uplinkAddress(proc: SecureProcess, host: string): Promise<string>;

package/dist/types/kernel/net/uplink-socket.d.ts

@@ -8,4 +8,4 @@ export declare function hostPort(text: string): {
     host: string;
     port: number;
 } | undefined;
-export declare function uplinkLink(conn: UplinkConn, onReset: () => void): UplinkLink;
+export declare function uplinkLink(conn: UplinkConn, onReset: (err: unknown) => void): UplinkLink;

package/dist/types/kernel/socket-syscalls.d.ts

@@ -1,5 +1,6 @@
 import type { SyncFsResult } from '../realm/sync-fs-wire.js';
 import { type FdTable } from './fd-table.js';
+import { type ClientCertRequest } from './net/tls-uplink.js';
 import type { ResolveFamily } from './net/uplink.js';
 import { type ConnectorStamp, type LoopbackNet, type PeerCred, type SockAddr, type SocketDomain } from './socket.js';
 import { type SocketNames } from './socket-nodes.js';
@@ -65,6 +66,9 @@ export type SocketSyscall = {
     alpn?: string[];
     ca?: true | string[];
     insecure?: boolean;
+    sni?: false;
+    checkHostname?: false;
+    clientCert?: ClientCertRequest;
     path?: 'kernel' | 'transport';
 } | {
     op: 'sock-tls-upgrade';
@@ -73,6 +77,9 @@ export type SocketSyscall = {
     alpn?: string[];
     ca?: true | string[];
     insecure?: boolean;
+    sni?: false;
+    checkHostname?: false;
+    clientCert?: ClientCertRequest;
 } | {
     op: 'sock-recvfrom';
     fd: number;

package/dist/types/kernel/vfs-file.d.ts

@@ -69,6 +69,7 @@ export declare class VfsNode {
     revoke(): void;
     private prepare;
     keep(): Promise<void>;
+    readonly moving: Set<Promise<void>>;
     load(): Promise<Uint8Array>;
     holds(): boolean;
     reread(): void;
@@ -136,6 +137,7 @@ export declare class VfsNodes implements UnlinkHolder {
     owns(): boolean;
     isKept(): boolean;
     keep(path: string, file: KeptFile): void;
+    moving(path: string): () => void;
     unkeep(path: string, file: KeptFile): void;
     rewritten(path: string): void;
     flush(path: string): Promise<void>;

package/dist/types/process/js/js-dev.d.ts

@@ -6,6 +6,7 @@ import type { JsSyncFile } from './js-sync.js';
 export type DevStep<T> = Generator<SyncSabRequestBody, T, unknown>;
 export declare const DEV_READ_MAX: number;
 export declare function inDev(abs: string): boolean;
+export declare function devFdStat(fd: number): DevStep<SyncFsBridgeStat>;
 export declare function devStat(abs: string, follow: boolean): DevStep<SyncFsBridgeStat>;
 export declare function devExists(abs: string): DevStep<boolean>;
 export declare function devReadlink(abs: string): DevStep<string>;

package/dist/types/process/js/js-net.d.ts

@@ -12,6 +12,16 @@ export interface JsTlsSession {
     readonly authorizationError?: string;
     readonly servername: string;
     readonly peerCertificates?: readonly Uint8Array[];
+    readonly cipher?: JsTlsCipher;
+    readonly clientCertificate?: boolean;
+    readonly sni?: boolean;
+    readonly hostnameChecked?: boolean;
+    readonly hostnameMatches?: boolean;
+}
+export interface JsTlsCipher {
+    readonly name: string;
+    readonly standardName: string;
+    readonly version: 'TLSv1.0' | 'TLSv1.2' | 'TLSv1.3';
 }
 export interface JsTlsOptions {
     servername?: string;
@@ -19,6 +29,12 @@ export interface JsTlsOptions {
     rejectUnauthorized?: boolean;
     ca?: unknown;
     path?: 'kernel' | 'transport';
+    cert?: unknown;
+    key?: unknown;
+    passphrase?: string;
+    pfx?: unknown;
+    sni?: boolean;
+    checkHostname?: boolean;
 }
 export interface JsConnection {
     readonly fd: number;

package/dist/types/process/process-fds.d.ts

@@ -93,5 +93,5 @@ export declare function kernelAccess(imports: WebAssembly.Imports, fs: () => Pro
 export declare function kernelLink(imports: WebAssembly.Imports, fs: () => ProcessFs | undefined, memory: () => WebAssembly.Memory | undefined, glue?: KernelImports): void;
 export declare function devCreations(imports: WebAssembly.Imports, fs: () => ProcessFs | undefined, memory: () => WebAssembly.Memory | undefined, glue?: KernelImports): void;
 export declare function kernelUname(imports: WebAssembly.Imports, hostname: string, memory: () => WebAssembly.Memory | undefined, glue?: KernelImports): void;
-export declare function linuxDevices(Fs: ProcessFs): void;
+export declare function linuxDevices(Fs: ProcessFs, owners?: boolean): void;
 export {};

package/dist/types/process/wasi/wasi-host.d.ts

@@ -104,6 +104,7 @@ export declare class WasiHost {
     private sized;
     private statOrphanable;
     private synthetic;
+    private devChar;
     private resolveForDev;
     private writeSiginfo;
     private fdAlias;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-kernel",
-  "version": "1.124.12",
+  "version": "1.124.13",
   "description": "SLICC's wasm-realm kernel: run Emscripten programs in the browser against OPFS, with fork, spawn, pipes and waitpid",
   "type": "module",
   "license": "Apache-2.0",
@@ -68,7 +68,7 @@
     "@ai-ecoverse/slicc-scrub": "1.0.0",
     "@ai-ecoverse/slicc-shared-web": "1.23.3",
     "@ai-ecoverse/wasi-cargo": "0.99.0-3",
-    "@ai-ecoverse/wasi-pnpm": "12.9.1-9",
+    "@ai-ecoverse/wasi-pnpm": "12.9.1-10",
     "@ai-ecoverse/wasi-ripgrep": "15.2.0-5",
     "@ai-ecoverse/wasi-rustc": "1.98.1-5",
     "@ai-ecoverse/wasi-zig": "0.16.0-16",
@@ -81,7 +81,7 @@
     "@ai-ecoverse/wasm-procps": "4.0.7-3",
     "@ai-ecoverse/wasm-sqlite3": "3.54.0-5",
     "@ai-ecoverse/wasm-tar": "1.35.0-7",
-    "@ai-ecoverse/wasm-tls-engine": "4.2.0-2",
+    "@ai-ecoverse/wasm-tls-engine": "4.2.0-3",
     "@ai-ecoverse/wasm-tree": "2.3.2-4",
     "@ai-ecoverse/wasm-util-linux": "2.42.4-3",
     "@biomejs/biome": "2.5.15",