@ai-ecoverse/slicc-kernel 1.135.7 → 1.136.1

package/dist/types/kernel/net/sealed-anchor.d.ts

@@ -0,0 +1,9 @@
+import type { TlsEngine } from './tls-engine.js';
+export declare const ANCHORS_MAX = 64;
+export declare const ANCHOR_BYTES_MAX: number;
+export interface Anchors {
+    anchors: Uint8Array[];
+    pins: string[];
+}
+export declare function anchorsOf(reply: unknown): Anchors | undefined;
+export declare function anchorFor(engine: TlsEngine, chain: readonly Uint8Array[], host: string, found: Anchors): Promise<string | undefined>;

package/dist/types/kernel/net/sealed-conn.d.ts

@@ -1,4 +1,5 @@
 import type { SealedBroker, SealedCaller } from '../sealed.js';
+import type { Anchors } from './sealed-anchor.js';
 import type { UplinkConn } from './uplink.js';
 export declare const HEAD_IDLE_MS = 2000;
 export interface SealedSession {
@@ -11,6 +12,7 @@ export interface SealedSession {
     verified: boolean;
     handshakeAt: number;
     alpn: string | false;
+    anchoring?: (found: Anchors) => Promise<string | undefined>;
 }
 export declare function substitutes(s: SealedSession): boolean;
 export declare function sealedConn(conn: UplinkConn, s: SealedSession): UplinkConn;

package/dist/types/kernel/net/tls-chain.d.ts

@@ -1,3 +1,4 @@
+export declare function spkiOf(der: Uint8Array): Uint8Array | undefined;
 export declare function selfSigned(der: Uint8Array | undefined): Promise<boolean>;
 export interface ChainShape {
     leafSelfSigned: boolean;

package/dist/types/kernel/net/tls-engine.d.ts

@@ -1,6 +1,6 @@
 type TlsExport = 'malloc' | 'free' | 'tls_last_error' | 'tls_strerror' | 'tls_leaf_new' | 'tls_leaf_spki' | 'tls_leaf_add_cert' | 'tls_leaf_free' | 'tls_session_new' | 'tls_feed' | 'tls_feed_eof' | 'tls_in_room' | 'tls_read' | 'tls_write' | 'tls_out_size' | 'tls_out_take' | 'tls_close' | 'tls_alpn_http11' | 'tls_session_free';
 type TlsClientExport = 'tls_ca_new' | 'tls_ca_add_der' | 'tls_ca_add_bundle' | 'tls_ca_free' | 'tls_client_new' | 'tls_handshake' | 'tls_verify_result' | 'tls_verify_info' | 'tls_alpn' | 'tls_version' | 'tls_peer_count' | 'tls_peer_der';
-type TlsSessionExport = 'tls_client_cert' | 'tls_ciphersuite' | 'tls_name_mismatch' | 'tls_last_alert';
+type TlsSessionExport = 'tls_client_cert' | 'tls_ciphersuite' | 'tls_name_mismatch' | 'tls_last_alert' | 'tls_chain_verify';
 export type TlsEngineModule = {
     readonly HEAPU8: Uint8Array;
 } & {
@@ -37,6 +37,8 @@ export declare class TlsEngine {
     private clientModule;
     store(): TlsStore;
     clientSession(store: TlsStore | undefined, servername: string, alpn: readonly string[], flags: number): TlsSession;
+    get chainVerify(): boolean;
+    chainFlags(store: TlsStore, chain: readonly Uint8Array[], hostname: string): number | undefined;
     verifyInfo(flags: number): string;
 }
 export declare class TlsStore {

package/dist/types/kernel/net/tls-uplink.d.ts

@@ -37,6 +37,7 @@ export interface SecureSession {
     path: 'kernel';
     substitutes: boolean;
     verified: boolean;
+    verifiedBy: 'bundled' | 'none';
     protocol: TlsClientInfo['protocol'];
     alpnProtocol: string | false;
     authorized: boolean;

package/dist/types/kernel/sealed-session.d.ts

@@ -27,7 +27,29 @@ export interface SessionFields {
     placeholders?: string[];
     head?: SessionHead;
     scram?: SessionScram;
+    verifiedBy?: 'roots' | 'anchored';
+    anchor?: string;
 }
+export interface SessionAnchorFields {
+    stamp: SealedCaller;
+    session: string;
+    host: string;
+    port: number;
+    protocol: SessionProtocol;
+    exit: string;
+}
+export declare function anchorsAskable(f: SessionAnchorFields): boolean;
+export declare function anchorsRequest(f: SessionAnchorFields): {
+    v: 1;
+    op: string;
+    caller: SealedCaller;
+    stamp: SealedCaller;
+    session: string;
+    host: string;
+    port: number;
+    protocol: SessionProtocol;
+    exit: string;
+};
 export declare function boundHost(servername: string): string;
 export declare function sessionAskable(f: SessionFields, now: number): boolean;
 export declare function sessionRequest(f: SessionFields): {
@@ -41,6 +63,8 @@ export declare function sessionRequest(f: SessionFields): {
     protocol: SessionProtocol;
     position: string;
     verified: boolean;
+    verifiedBy: "anchored" | "roots";
+    anchor?: string | undefined;
     handshakeAt: number;
     exit: string;
     placeholders?: string[] | undefined;

package/dist/types/kernel/sealed.d.ts

@@ -2,8 +2,9 @@ import type { UsersMode } from '../fs/types.js';
 import type { Cred } from './cred.js';
 import { TicketBook } from './exec-ticket.js';
 import { type OpenAccess, OpenFile, type PollState } from './fd-table.js';
+import { type Anchors } from './net/sealed-anchor.js';
 import { SessionScrubs } from './net/sealed-scrubs.js';
-import { type SessionFields } from './sealed-session.js';
+import { type SessionAnchorFields, type SessionFields } from './sealed-session.js';
 export declare const SEALED_PATH = "/dev/sealed";
 export declare const SEALED_MAX_BYTES: number;
 export declare const SEALED_TIMEOUT_MS = 10000;
@@ -73,6 +74,7 @@ export declare class SealedBroker {
     }, cred: Readonly<Cred>, tag: string | undefined): Promise<SealedCaller>;
     consume(fields: ConsumeFields): Promise<Swap | undefined>;
     sessionMaterialize(fields: SessionFields, now?: number): Promise<Record<string, string> | undefined>;
+    sessionAnchors(fields: SessionAnchorFields): Promise<Anchors | undefined>;
     private ask;
     open(access?: OpenAccess): OpenFile;
 }

package/dist/types/process/js/js-net.d.ts

@@ -7,6 +7,7 @@ export interface JsTlsSession {
     readonly path: 'transport' | 'kernel';
     readonly substitutes: boolean;
     readonly verified?: boolean;
+    readonly verifiedBy?: 'bundled' | 'none';
     readonly protocol: 'transport' | 'TLSv1.2' | 'TLSv1.3';
     readonly alpnProtocol: string | false;
     readonly authorized: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-kernel",
-  "version": "1.135.7",
+  "version": "1.136.1",
   "description": "SLICC's wasm-realm kernel: run Emscripten programs in the browser against OPFS, with fork, spawn, pipes and waitpid",
   "type": "module",
   "license": "Apache-2.0",
@@ -74,10 +74,10 @@
     "@ai-ecoverse/wasi-zig": "0.16.0-17",
     "@ai-ecoverse/wasix-python": "3.15.0-3",
     "@ai-ecoverse/wasm-bash": "5.3.0-21",
-    "@ai-ecoverse/wasm-coreutils": "9.12.0-10",
+    "@ai-ecoverse/wasm-coreutils": "9.12.0-11",
     "@ai-ecoverse/wasm-curl": "8.22.0-7",
     "@ai-ecoverse/wasm-git": "2.55.0-17",
-    "@ai-ecoverse/wasm-gmake": "4.4.1-7",
+    "@ai-ecoverse/wasm-gmake": "4.4.1-8",
     "@ai-ecoverse/wasm-procps": "4.0.7-4",
     "@ai-ecoverse/wasm-sqlite3": "3.54.0-6",
     "@ai-ecoverse/wasm-tar": "1.35.0-8",