@ai-ecoverse/slicc-kernel 1.124.12 → 1.125.0

package/dist/types/fs/unlinked.d.ts

@@ -16,6 +16,7 @@ export interface UnlinkHolder {
     isKept(path: string): boolean;
     keep(path: string, file: KeptFile): void;
     unkeep(path: string, file: KeptFile): void;
+    moving?(path: string): () => void;
 }
 export interface UnlinkOwner {
     readonly id: string;

package/dist/types/fs/watch.d.ts

@@ -4,12 +4,27 @@ export type WatchChange = {
 } | {
     overflow: true;
 };
+export type WatchEventType = 'rename' | 'change';
+export type WatchNote = {
+    type: WatchEventType;
+    filename: string;
+} | {
+    overflow: true;
+} | {
+    ended: true;
+};
+export interface TypedWatch {
+    next(signal: AbortSignal): Promise<WatchNote[]>;
+    close(): void;
+}
+export declare const WATCH_NOTES_LIMIT = 1000;
 export interface WatchOptions {
     recursive?: boolean;
 }
 export declare const WATCH_BATCH_LIMIT = 1000;
 export declare class FsWatchers {
     private readonly watchers;
+    private readonly typed;
     private readonly taps;
     private readonly reals;
     private readonly reshapes;
@@ -17,7 +32,11 @@ export declare class FsWatchers {
     reshaped(): void;
     tap(listener: (paths: string[]) => void): void;
     watch(paths: string[], options: WatchOptions, notify: (change: WatchChange) => void): () => void;
+    typedWatch(root: string, recursive: boolean, alias?: string): TypedWatch;
+    private covers;
+    private emit;
     changed(...paths: string[]): void;
+    private report;
     private flush;
     wrap(fs: KernelFs): KernelFs;
 }

package/dist/types/index.d.ts

@@ -36,7 +36,7 @@ export type { ProcessMountPolicy, ProcessMountRequest } from './mount/syscall.js
 export type { JsChild, JsExited, JsSpawnOptions, JsStdio } from './process/js/js-children.js';
 export type { JsCrontabAnswer, JsCrontabCall, JsFdStatus, JsFdType, JsFile, JsOpenOptions, JsProgramContext, JsSignal, JsSudoAnswer, } from './process/js/js-context.js';
 export type { JsStatFs } from './process/js/js-io.js';
-export type { JsAddress, JsConnection, JsConnectOptions, JsListener, JsListenOptions, JsNet, JsResolveOptions, JsTlsOptions, JsTlsSession, } from './process/js/js-net.js';
+export type { JsAddress, JsConnection, JsConnectOptions, JsListener, JsListenOptions, JsNet, JsResolveOptions, JsTlsCipher, JsTlsOptions, JsTlsSession, } from './process/js/js-net.js';
 export type { JsRunOptions, JsRunResult, JsRunStdio } from './process/js/js-run.js';
 export type { JsCred, JsSyncContext, JsSyncFile } from './process/js/js-sync.js';
 export type { JsTermios, JsTty, JsTtySize } from './process/js/js-tty.js';

package/dist/types/kernel/fd-table.d.ts

@@ -12,6 +12,7 @@ export interface PollState {
     readable: boolean;
     writable: boolean;
     hangup: boolean;
+    nread?: number;
     rdhup?: boolean;
     error?: boolean;
 }

package/dist/types/kernel/host.d.ts

@@ -90,6 +90,7 @@ export interface SpawnWasmOptions {
     locks?: KernelLocks;
     fifos?: FifoTable;
     sems?: SemTable;
+    watches?: WasmProcessOptions['watches'];
     onReap?: (pid: number) => void;
     resolver?: Resolver;
 }

package/dist/types/kernel/net/tls-ciphers.d.ts

@@ -0,0 +1,6 @@
+export interface TlsCipher {
+    name: string;
+    standardName: string;
+    version: 'TLSv1.0' | 'TLSv1.2' | 'TLSv1.3';
+}
+export declare function cipherOf(id: number, protocol: TlsCipher['version']): TlsCipher;

package/dist/types/kernel/net/tls-client.d.ts

@@ -1,4 +1,5 @@
-import { type TlsEngine, type TlsStore } from './tls-engine.js';
+import { type TlsCipher } from './tls-ciphers.js';
+import { type TlsEngine, type TlsSession, type TlsStore } from './tls-engine.js';
 import type { UplinkConn } from './uplink.js';
 export declare function verifyCode(flags: number): string | undefined;
 export interface TlsClientInfo {
@@ -8,6 +9,11 @@ export interface TlsClientInfo {
     authorizationError?: string;
     authorizationText?: string;
     peerCertificates: Uint8Array[];
+    cipher?: TlsCipher;
+    clientCertificate?: boolean;
+    sni?: boolean;
+    hostnameChecked?: boolean;
+    hostnameMatches?: boolean;
 }
 export interface TlsClientOptions {
     engine: TlsEngine;
@@ -15,7 +21,13 @@ export interface TlsClientOptions {
     servername: string;
     alpn: readonly string[];
     insecure: boolean;
+    sni?: boolean;
+    checkHostname?: boolean;
+    session?: TlsSession;
+    clientCertificate?: boolean;
 }
+export declare function clientFlags(o: TlsClientOptions): number;
+export declare function openSession(o: TlsClientOptions): TlsSession;
 export declare function tlsClient(conn: UplinkConn, o: TlsClientOptions, taken?: Uint8Array): Promise<{
     conn: UplinkConn;
     info: TlsClientInfo;

package/dist/types/kernel/net/tls-engine.d.ts

@@ -1,16 +1,21 @@
 type TlsExport = 'malloc' | 'free' | 'tls_last_error' | 'tls_strerror' | 'tls_leaf_new' | 'tls_leaf_spki' | 'tls_leaf_add_cert' | 'tls_leaf_free' | 'tls_session_new' | 'tls_feed' | 'tls_feed_eof' | 'tls_in_room' | 'tls_read' | 'tls_write' | 'tls_out_size' | 'tls_out_take' | 'tls_close' | 'tls_alpn_http11' | 'tls_session_free';
 type TlsClientExport = 'tls_ca_new' | 'tls_ca_add_der' | 'tls_ca_add_bundle' | 'tls_ca_free' | 'tls_client_new' | 'tls_handshake' | 'tls_verify_result' | 'tls_verify_info' | 'tls_alpn' | 'tls_version' | 'tls_peer_count' | 'tls_peer_der';
+type TlsSessionExport = 'tls_client_cert' | 'tls_ciphersuite' | 'tls_name_mismatch';
 export type TlsEngineModule = {
     readonly HEAPU8: Uint8Array;
 } & {
     readonly [K in TlsExport as `_${K}`]: (...args: number[]) => number;
 } & {
     readonly [K in TlsClientExport as `_${K}`]?: (...args: number[]) => number;
+} & {
+    readonly [K in TlsSessionExport as `_${K}`]?: (...args: number[]) => number;
 };
 type TlsClientModule = TlsEngineModule & {
     readonly [K in TlsClientExport as `_${K}`]: (...args: number[]) => number;
 };
 export declare const TLS_CLIENT_INSECURE_SKIP_VERIFY = 1;
+export declare const TLS_CLIENT_NO_SNI = 2;
+export declare const TLS_CLIENT_VERIFY_CHAIN_ONLY = 4;
 export declare class TlsError extends Error {
     readonly code: number;
     constructor(code: number, message: string);
@@ -25,7 +30,9 @@ export declare class TlsEngine {
     leaf(): TlsLeaf;
     session(leaf: TlsLeaf, host: string): TlsSession;
     withBytes<T>(bytes: Uint8Array, fn: (ptr: number) => T): T;
+    withSecret<T>(bytes: Uint8Array, fn: (ptr: number) => T): T;
     intoScratch(fn: (ptr: number, max: number) => number): number | Uint8Array;
+    get sessionControls(): boolean;
     get client(): TlsClientModule | undefined;
     private clientModule;
     store(): TlsStore;
@@ -67,6 +74,9 @@ export declare class TlsSession {
     get verifyResult(): number;
     get version(): number;
     get alpn(): string | undefined;
+    ownCert(chain: Uint8Array, key: Uint8Array, pass: Uint8Array): void;
+    get ciphersuite(): number;
+    get nameMismatch(): boolean;
     peerChain(): Uint8Array[];
 }
 export declare function loadTlsEngine(load: () => Promise<TlsEngineModule>): Promise<TlsEngine>;

package/dist/types/kernel/net/tls-uplink.d.ts

@@ -1,6 +1,6 @@
 import type { KernelSocket, LoopbackNet } from '../socket.js';
 import { type TlsClientInfo } from './tls-client.js';
-import type { TlsEngine } from './tls-engine.js';
+import { type TlsEngine } from './tls-engine.js';
 import type { ResolveFamily } from './uplink.js';
 export interface TlsClientSupport {
     engine: () => Promise<TlsEngine>;
@@ -11,6 +11,14 @@ export interface SecureRequest {
     alpn?: string[];
     ca?: true | string[];
     insecure?: boolean;
+    sni?: false;
+    checkHostname?: false;
+    clientCert?: ClientCertRequest;
+}
+export interface ClientCertRequest {
+    chain: string[];
+    key: string;
+    passphrase?: string;
 }
 export interface SecureProcess {
     net: LoopbackNet;
@@ -28,6 +36,11 @@ export interface SecureSession {
     authorizationText?: string;
     servername: string;
     peerCertificates: string[];
+    cipher?: TlsClientInfo['cipher'];
+    clientCertificate?: boolean;
+    sni?: boolean;
+    hostnameChecked?: boolean;
+    hostnameMatches?: boolean;
 }
 export declare function supportOf(net: LoopbackNet): TlsClientSupport;
 export declare function uplinkAddress(proc: SecureProcess, host: string): Promise<string>;

package/dist/types/kernel/net/uplink-socket.d.ts

@@ -8,4 +8,4 @@ export declare function hostPort(text: string): {
     host: string;
     port: number;
 } | undefined;
-export declare function uplinkLink(conn: UplinkConn, onReset: () => void): UplinkLink;
+export declare function uplinkLink(conn: UplinkConn, onReset: (err: unknown) => void): UplinkLink;

package/dist/types/kernel/process.d.ts

@@ -29,6 +29,7 @@ import { LoopbackNet } from './socket.js';
 import { type SocketSyscall } from './socket-syscalls.js';
 import type { Termios } from './tty.js';
 import { type VersionPin, type VfsFileFs, VfsNodes } from './vfs-file.js';
+import { type WatchSource, type WatchSyscall } from './watch-ops.js';
 export type WasmSyscall = {
     op: 'fd-read';
     fd: number;
@@ -334,7 +335,7 @@ export type WasmSyscall = {
     tid?: number;
 } | {
     op: 'sig-pause';
-} | SocketSyscall | EpollSyscall | SemSyscall | HttpSyscall | PtySyscall | HostSyscall;
+} | SocketSyscall | EpollSyscall | SemSyscall | HttpSyscall | PtySyscall | HostSyscall | WatchSyscall;
 export interface FdInfo {
     tty: boolean;
     kind: KernelFdKind;
@@ -397,6 +398,7 @@ export interface WasmProcessOptions {
     dl?: DlState;
     raise?: (sig: number, info?: SigInfo) => void;
     exitNow?: (status: number) => void;
+    watches?: WatchSource | undefined;
     exitSignal?: (sig: number) => void;
     onReap?: (pid: number) => void;
     jobs?: JobTable;
@@ -412,6 +414,7 @@ export type StateListener = (state: 'stopped' | 'continued', sig: number) => voi
 export type SignalOutcome = DefaultAction | 'deliver' | 'forward';
 export declare class WasmProcess {
     private exited;
+    private readonly watches;
     private readonly children;
     private readonly deathSignals;
     private caught;

package/dist/types/kernel/select.d.ts

@@ -3,5 +3,6 @@ export interface SelectResult {
     read: number[];
     write: number[];
     hangup?: number[];
+    nread?: Record<number, number>;
 }
 export declare function selectFds(fds: FdTable, read: readonly number[], write: readonly number[], timeoutMs: number, interrupt: AbortSignal): Promise<SelectResult>;

package/dist/types/kernel/socket-syscalls.d.ts

@@ -1,5 +1,6 @@
 import type { SyncFsResult } from '../realm/sync-fs-wire.js';
 import { type FdTable } from './fd-table.js';
+import { type ClientCertRequest } from './net/tls-uplink.js';
 import type { ResolveFamily } from './net/uplink.js';
 import { type ConnectorStamp, type LoopbackNet, type PeerCred, type SockAddr, type SocketDomain } from './socket.js';
 import { type SocketNames } from './socket-nodes.js';
@@ -65,6 +66,9 @@ export type SocketSyscall = {
     alpn?: string[];
     ca?: true | string[];
     insecure?: boolean;
+    sni?: false;
+    checkHostname?: false;
+    clientCert?: ClientCertRequest;
     path?: 'kernel' | 'transport';
 } | {
     op: 'sock-tls-upgrade';
@@ -73,6 +77,9 @@ export type SocketSyscall = {
     alpn?: string[];
     ca?: true | string[];
     insecure?: boolean;
+    sni?: false;
+    checkHostname?: false;
+    clientCert?: ClientCertRequest;
 } | {
     op: 'sock-recvfrom';
     fd: number;

package/dist/types/kernel/vfs-file.d.ts

@@ -69,6 +69,7 @@ export declare class VfsNode {
     revoke(): void;
     private prepare;
     keep(): Promise<void>;
+    readonly moving: Set<Promise<void>>;
     load(): Promise<Uint8Array>;
     holds(): boolean;
     reread(): void;
@@ -136,6 +137,7 @@ export declare class VfsNodes implements UnlinkHolder {
     owns(): boolean;
     isKept(): boolean;
     keep(path: string, file: KeptFile): void;
+    moving(path: string): () => void;
     unkeep(path: string, file: KeptFile): void;
     rewritten(path: string): void;
     flush(path: string): Promise<void>;

package/dist/types/kernel/watch-ops.d.ts

@@ -0,0 +1,30 @@
+import type { TypedWatch } from '../fs/watch.js';
+import type { SyncFsResult } from '../realm/sync-fs-wire.js';
+export type WatchSyscall = {
+    op: 'watch-open';
+    path: string;
+    recursive?: boolean;
+} | {
+    op: 'watch-next';
+    id: number;
+} | {
+    op: 'watch-close';
+    id: number;
+};
+export declare const WATCH_OPS: readonly ['watch-open', 'watch-next', 'watch-close'];
+export declare function isWatchSyscall(req: {
+    op: string;
+}): req is WatchSyscall;
+export declare const WATCHES_MAX = 8192;
+export declare function visibleTo(watch: TypedWatch, root: string, visible: (dir: string) => Promise<boolean>): TypedWatch;
+export interface WatchSource {
+    open(path: string, recursive: boolean): Promise<TypedWatch>;
+}
+export declare class ProcessWatches {
+    private readonly open;
+    private nextId;
+    private readonly source;
+    constructor(source: WatchSource | undefined);
+    syscall(req: WatchSyscall, cancelled: AbortSignal): Promise<SyncFsResult>;
+    closeAll(): void;
+}

package/dist/types/launcher.d.ts

@@ -360,6 +360,7 @@ export declare class Launcher {
     private fsaDriver;
     revokeIntegrity(path?: string): Promise<void>;
     attest(path: string): Promise<Attestation>;
+    private watchSource;
     watchFiles(paths: readonly string[], notify: (path: string) => void): Promise<() => void>;
     mount(spec: MountSpec): Promise<MountEntry>;
     private mountShm;

package/dist/types/process/js/js-context.d.ts

@@ -5,6 +5,7 @@ import { type JsKernel } from './js-kernel.js';
 import { type JsNet } from './js-net.js';
 import { type JsSyncContext, type SyncCall } from './js-sync.js';
 import { type JsTty } from './js-tty.js';
+import { type JsWatcher, type JsWatchListener, type JsWatchOptions } from './js-watch.js';
 import { type JsWebSocket, type JsWebSocketOptions } from './js-websocket.js';
 export type { JsFdType, JsOpenOptions } from './js-io.js';
 export interface JsFile {
@@ -65,6 +66,7 @@ export interface JsProgramContext {
         writeFile(path: string, data: Uint8Array | string, options?: {
             mode?: number;
         }): Promise<void>;
+        watch(path: string, options: JsWatchOptions | JsWatchListener, listener?: JsWatchListener): Promise<JsWatcher>;
     };
     signals: {
         on(signal: JsSignal, handler: (signal: number) => void): Promise<void>;

package/dist/types/process/js/js-dev.d.ts

@@ -6,6 +6,7 @@ import type { JsSyncFile } from './js-sync.js';
 export type DevStep<T> = Generator<SyncSabRequestBody, T, unknown>;
 export declare const DEV_READ_MAX: number;
 export declare function inDev(abs: string): boolean;
+export declare function devFdStat(fd: number): DevStep<SyncFsBridgeStat>;
 export declare function devStat(abs: string, follow: boolean): DevStep<SyncFsBridgeStat>;
 export declare function devExists(abs: string): DevStep<boolean>;
 export declare function devReadlink(abs: string): DevStep<string>;

package/dist/types/process/js/js-net.d.ts

@@ -12,6 +12,16 @@ export interface JsTlsSession {
     readonly authorizationError?: string;
     readonly servername: string;
     readonly peerCertificates?: readonly Uint8Array[];
+    readonly cipher?: JsTlsCipher;
+    readonly clientCertificate?: boolean;
+    readonly sni?: boolean;
+    readonly hostnameChecked?: boolean;
+    readonly hostnameMatches?: boolean;
+}
+export interface JsTlsCipher {
+    readonly name: string;
+    readonly standardName: string;
+    readonly version: 'TLSv1.0' | 'TLSv1.2' | 'TLSv1.3';
 }
 export interface JsTlsOptions {
     servername?: string;
@@ -19,6 +29,12 @@ export interface JsTlsOptions {
     rejectUnauthorized?: boolean;
     ca?: unknown;
     path?: 'kernel' | 'transport';
+    cert?: unknown;
+    key?: unknown;
+    passphrase?: string;
+    pfx?: unknown;
+    sni?: boolean;
+    checkHostname?: boolean;
 }
 export interface JsConnection {
     readonly fd: number;

package/dist/types/process/js/js-sync.d.ts

@@ -5,6 +5,7 @@ import type { JsChild, JsSpawnOptions } from './js-children.js';
 import { type FdInfo, type JsOpenOptions, type JsStatFs } from './js-io.js';
 import { type JsKernel } from './js-kernel.js';
 import type { JsRunOptions, JsRunResult } from './js-run.js';
+import type { JsWatcher, JsWatchListener, JsWatchOptions } from './js-watch.js';
 export type SyncCall = (req: SyncSabRequestBody) => SyncFsResult;
 export interface JsSyncFile {
     readonly fd: number;
@@ -61,6 +62,7 @@ export interface JsSyncContext {
         writeFile(path: string, data: Uint8Array | string, options?: {
             mode?: number;
         }): void;
+        watch(path: string, options: JsWatchOptions | JsWatchListener, listener?: JsWatchListener): JsWatcher;
     };
 }
 export interface SyncShared {
@@ -83,4 +85,6 @@ export declare class JsSyncKernel {
     bytes(req: SyncSabRequestBody): Uint8Array;
     blocking(req: SyncSabRequestBody): SyncFsResult;
 }
-export declare function syncOps(kernel: JsSyncKernel, shared: SyncShared): Omit<JsSyncContext, 'run' | 'spawn' | 'exit' | 'kill' | 'cred' | 'setcred' | 'kernel' | 'umask'>;
+export declare function syncOps(kernel: JsSyncKernel, shared: SyncShared): Omit<JsSyncContext, 'run' | 'spawn' | 'exit' | 'kill' | 'cred' | 'setcred' | 'kernel' | 'umask' | 'fs'> & {
+    fs: Omit<JsSyncContext['fs'], 'watch'>;
+};

package/dist/types/process/js/js-watch.d.ts

@@ -0,0 +1,17 @@
+import type { WatchNote } from '../../fs/watch.js';
+import type { JsKernel } from './js-kernel.js';
+export type JsWatchNote = WatchNote;
+export interface JsWatchOptions {
+    recursive?: boolean;
+}
+export interface JsWatcher {
+    close(): void;
+}
+export type JsWatchListener = (note: JsWatchNote) => void;
+export declare function watchRequest(path: string, options: JsWatchOptions | undefined): {
+    op: 'watch-open';
+    path: string;
+    recursive?: boolean | undefined;
+};
+export declare function watchArgs(options: JsWatchOptions | JsWatchListener | undefined, listener: JsWatchListener | undefined): [JsWatchOptions, JsWatchListener];
+export declare function follow(kernel: Pick<JsKernel, 'blocking' | 'call'>, id: number, onNote: JsWatchListener): JsWatcher;

package/dist/types/process/process-fds.d.ts

@@ -93,5 +93,5 @@ export declare function kernelAccess(imports: WebAssembly.Imports, fs: () => Pro
 export declare function kernelLink(imports: WebAssembly.Imports, fs: () => ProcessFs | undefined, memory: () => WebAssembly.Memory | undefined, glue?: KernelImports): void;
 export declare function devCreations(imports: WebAssembly.Imports, fs: () => ProcessFs | undefined, memory: () => WebAssembly.Memory | undefined, glue?: KernelImports): void;
 export declare function kernelUname(imports: WebAssembly.Imports, hostname: string, memory: () => WebAssembly.Memory | undefined, glue?: KernelImports): void;
-export declare function linuxDevices(Fs: ProcessFs): void;
+export declare function linuxDevices(Fs: ProcessFs, owners?: boolean): void;
 export {};

package/dist/types/process/wasi/wasi-host.d.ts

@@ -104,6 +104,7 @@ export declare class WasiHost {
     private sized;
     private statOrphanable;
     private synthetic;
+    private devChar;
     private resolveForDev;
     private writeSiginfo;
     private fdAlias;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-kernel",
-  "version": "1.124.12",
+  "version": "1.125.0",
   "description": "SLICC's wasm-realm kernel: run Emscripten programs in the browser against OPFS, with fork, spawn, pipes and waitpid",
   "type": "module",
   "license": "Apache-2.0",
@@ -66,9 +66,9 @@
     "@ai-ecoverse/py-numpy": "2.3.2-11",
     "@ai-ecoverse/slicc-node": "2.5.1",
     "@ai-ecoverse/slicc-scrub": "1.0.0",
-    "@ai-ecoverse/slicc-shared-web": "1.23.3",
+    "@ai-ecoverse/slicc-shared-web": "1.24.0",
     "@ai-ecoverse/wasi-cargo": "0.99.0-3",
-    "@ai-ecoverse/wasi-pnpm": "12.9.1-9",
+    "@ai-ecoverse/wasi-pnpm": "12.9.1-10",
     "@ai-ecoverse/wasi-ripgrep": "15.2.0-5",
     "@ai-ecoverse/wasi-rustc": "1.98.1-5",
     "@ai-ecoverse/wasi-zig": "0.16.0-16",
@@ -81,7 +81,7 @@
     "@ai-ecoverse/wasm-procps": "4.0.7-3",
     "@ai-ecoverse/wasm-sqlite3": "3.54.0-5",
     "@ai-ecoverse/wasm-tar": "1.35.0-7",
-    "@ai-ecoverse/wasm-tls-engine": "4.2.0-2",
+    "@ai-ecoverse/wasm-tls-engine": "4.2.0-4",
     "@ai-ecoverse/wasm-tree": "2.3.2-4",
     "@ai-ecoverse/wasm-util-linux": "2.42.4-3",
     "@biomejs/biome": "2.5.15",