@ai-ecoverse/slicc-kernel 1.148.0 → 1.149.0

package/dist/process-worker.js

@@ -2964,7 +2964,7 @@ var KERNEL_VERSION, OS_RELEASE;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    KERNEL_VERSION = true ? "1.148.0" : "0.0.0-dev";
+    KERNEL_VERSION = true ? "1.149.0" : "0.0.0-dev";
     OS_RELEASE = "6.0.0-slicc";
   }
 });
@@ -7912,7 +7912,9 @@ var init_js_kernel = __esm({
       "fd-open-clipboard",
       "net-ws-ready",
       "sock-tls",
-      "sock-tls-upgrade"
+      "sock-tls-upgrade",
+      "sock-tls-serve",
+      "sock-tls-listen"
     ]);
     JsKernel = class {
       header;
@@ -16598,22 +16600,44 @@ function caList(ca) {
   }
   return out;
 }
-function keyText(key) {
+function keyText(key, what) {
   if (key instanceof Uint8Array) return toBase64(key);
   if (typeof key === "string") return toBase64(new TextEncoder().encode(key));
-  throw new JsCallError("EINVAL", "connect", "ERR_INVALID_ARG_TYPE: key must be a string or bytes");
+  throw new JsCallError("EINVAL", what, "ERR_INVALID_ARG_TYPE: key must be a string or bytes");
 }
-function clientCert(tls) {
+function serveRequest(tls) {
+  const own = clientCert(tls, "listen").clientCert;
+  if (!own)
+    throw new JsCallError("EINVAL", "listen", "ERR_INVALID_ARG_VALUE: a server needs cert and key");
+  return {
+    cert: own,
+    ...tls.ca !== void 0 ? { ca: caList(tls.ca) } : {},
+    ...tls.requestCert ? { requestCert: true } : {},
+    ...tls.rejectUnauthorized === false ? { rejectUnauthorized: false } : {},
+    ...tls.alpn ? { alpn: [...tls.alpn] } : {},
+    ...tls.handshakeTimeout !== void 0 ? { handshakeTimeout: tls.handshakeTimeout } : {}
+  };
+}
+function servedOf(r) {
+  const { authorizationError, ...rest2 } = r;
+  return Object.freeze({
+    ...rest2,
+    path: "kernel",
+    ...authorizationError ? { authorizationError } : {},
+    peerCertificates: Object.freeze(r.peerCertificates.map(fromBase64))
+  });
+}
+function clientCert(tls, what = "connect") {
   if (tls.pfx !== void 0) {
-    throw new JsCallError("ENOTSUP", "connect", "pfx is not supported: pass cert and key");
+    throw new JsCallError("ENOTSUP", what, "pfx is not supported: pass cert and key");
   }
   if (tls.cert === void 0 && tls.key === void 0) return {};
   const chain3 = tls.cert === void 0 ? [] : caList(tls.cert);
   if (chain3.length === 0 || tls.key === void 0) {
-    throw new JsCallError("EINVAL", "connect", "ERR_INVALID_ARG_VALUE: cert and key go together");
+    throw new JsCallError("EINVAL", what, "ERR_INVALID_ARG_VALUE: cert and key go together");
   }
   const passphrase = tls.passphrase === void 0 ? {} : { passphrase: String(tls.passphrase) };
-  return { clientCert: { chain: chain3, key: keyText(tls.key), ...passphrase } };
+  return { clientCert: { chain: chain3, key: keyText(tls.key, what), ...passphrase } };
 }
 function tlsRequest(tls) {
   return {
@@ -16688,6 +16712,118 @@ function port(n) {
   if (!Number.isInteger(n) || n < 0 || n > 65535) throw new JsCallError("EINVAL", `port ${n}`);
   return n;
 }
+async function serveOn(kernel, conn, req, signal = NEVER) {
+  const r = await secureCall(
+    () => kernel.blocking({ op: "sock-tls-serve", fd: conn.fd, ...req }, signal),
+    "accept"
+  );
+  const wire = r.ok && r.kind === "json" ? r.json : {};
+  return Object.assign(Object.create(conn), { tls: servedOf(wire) });
+}
+function changeOf(waiters, signal) {
+  return new Promise((resolve) => {
+    const done = () => {
+      waiters.delete(done);
+      signal.removeEventListener("abort", done);
+      resolve();
+    };
+    waiters.add(done);
+    signal.addEventListener("abort", done, { once: true });
+  });
+}
+function securedAccepts(plain2, serve, stop, cap) {
+  const ready = [];
+  const waiters = /* @__PURE__ */ new Set();
+  let failure;
+  let pumping = false;
+  let inFlight = 0;
+  const wake = () => {
+    for (const w of [...waiters]) w();
+  };
+  const handshake = (conn) => {
+    inFlight++;
+    serve(conn, stop).then(
+      (secured) => {
+        if (stop.aborted) void secured.close();
+        else ready.push(secured);
+      },
+      () => conn.close()
+    ).finally(() => {
+      inFlight--;
+      wake();
+    });
+  };
+  const pump2 = async () => {
+    for (; ; ) {
+      try {
+        while (inFlight + ready.length >= cap) {
+          stop.throwIfAborted();
+          await changeOf(waiters, stop);
+        }
+        handshake(await plain2(stop));
+      } catch (err) {
+        failure = err;
+        for (const left of ready.splice(0)) void left.close();
+        wake();
+        return;
+      }
+    }
+  };
+  return async (signal) => {
+    if (!pumping) {
+      pumping = true;
+      void pump2();
+    }
+    for (; ; ) {
+      if (stop.aborted) throw stop.reason;
+      const next2 = ready.shift();
+      if (next2) {
+        wake();
+        return next2;
+      }
+      if (failure !== void 0) throw failure;
+      signal.throwIfAborted();
+      await changeOf(waiters, signal);
+    }
+  };
+}
+function listenerOf(ops, fd, at, handshakes) {
+  const { kernel, io, connection, serve } = ops;
+  const stop = new AbortController();
+  const acceptPlain = async (signal) => {
+    for (; ; ) {
+      signal.throwIfAborted();
+      const r = await kernel.raw({ op: "sock-accept", fd, nonblock: true });
+      if (r.ok) return connection((r.kind === "json" ? r.json : {}).fd);
+      if (r.errno !== "EAGAIN") throw new JsCallError(r.errno, "accept");
+      await kernel.blocking({ op: "fd-select", read: [fd], write: [], timeoutMs: -1 }, signal);
+    }
+  };
+  const next2 = handshakes > 0 ? securedAccepts(acceptPlain, (c, s) => serve(c, { from: fd }, s), stop.signal, handshakes) : acceptPlain;
+  const accept = (options = {}) => next2(AbortSignal.any([options.signal ?? NEVER, stop.signal]));
+  return {
+    fd,
+    ...at,
+    accept,
+    async close() {
+      stop.abort(new JsCallError("EBADF", "listener closed"));
+      await io.close(fd);
+    },
+    async *[Symbol.asyncIterator]() {
+      for (; ; ) {
+        try {
+          yield await accept();
+        } catch (err) {
+          if (stop.signal.aborted) return;
+          throw err;
+        }
+      }
+    }
+  };
+}
+function capOf(options, tls) {
+  return tls ? Math.max(1, Math.min(options.backlog ?? 128, HANDSHAKES_MAX)) : 0;
+}
 function netOps(kernel, io, sync) {
   const name2 = async (fd, peer) => addressOf(await kernel.json({ op: "sock-name", fd, peer }));
   const connection = async (fd) => {
@@ -16735,53 +16871,58 @@ function netOps(kernel, io, sync) {
       throw err;
     }
   };
-  const listener = (fd, at) => {
-    const stop = new AbortController();
-    const accept = async (options = {}) => {
-      const signal = AbortSignal.any([options.signal ?? NEVER, stop.signal]);
-      for (; ; ) {
-        signal.throwIfAborted();
-        const r = await kernel.raw({ op: "sock-accept", fd, nonblock: true });
-        if (r.ok) return connection((r.kind === "json" ? r.json : {}).fd);
-        if (r.errno !== "EAGAIN") throw new JsCallError(r.errno, "accept");
-        await kernel.blocking({ op: "fd-select", read: [fd], write: [], timeoutMs: -1 }, signal);
-      }
-    };
-    return {
-      fd,
-      ...at,
-      accept,
-      async close() {
-        stop.abort(new JsCallError("EBADF", "listener closed"));
-        await io.close(fd);
-      },
-      async *[Symbol.asyncIterator]() {
-        for (; ; ) {
-          try {
-            yield await accept();
-          } catch (err) {
-            if (stop.signal.aborted) return;
-            throw err;
-          }
-        }
-      }
+  const serve = (conn, req, signal) => serveOn(kernel, conn, req, signal);
+  const ops = { kernel, io, connection, serve };
+  const listener = (fd, at, handshakes = 0) => listenerOf(ops, fd, at, handshakes);
+  const connect = async (options) => {
+    const signal = options.signal ?? NEVER;
+    const host = options.host ?? "127.0.0.1";
+    if (host.includes(":")) throw new JsCallError("EADDRNOTAVAIL", host);
+    const addr = {
+      family: "inet",
+      host: await resolve(host, signal),
+      port: port(options.port)
     };
+    return opened2(async (fd) => {
+      const r = await kernel.raw({ op: "sock-connect", fd, addr, nonblock: true });
+      if (!r.ok && r.errno !== "EINPROGRESS") throw new JsCallError(r.errno, "connect");
+      await kernel.blocking({ op: "fd-select", read: [], write: [fd], timeoutMs: -1 }, signal);
+      const failed5 = await kernel.json({
+        op: "sock-getopt",
+        fd,
+        level: SOL_SOCKET2,
+        name: SO_ERROR2
+      });
+      if (failed5 !== 0) throw new JsCallError(errnoName(failed5), "connect");
+      return connection(fd);
+    });
   };
   const tlsConnect = async (options, tls) => {
+    const host = options.host ?? "localhost";
+    if (!options.socket && LOOPBACK3.test(host)) {
+      const { tls: _, ...plain2 } = options;
+      const socket = await connect({ ...plain2, host });
+      return tlsConnect({ ...plain2, host, socket }, tls).catch(async (err) => {
+        await socket.close();
+        throw err;
+      });
+    }
     const common = tlsRequest(
       options.socket && !tls.servername && options.host ? { ...tls, servername: options.host } : tls
     );
-    const r = await secureCall(
-      () => kernel.json(
-        options.socket ? { op: "sock-tls-upgrade", fd: options.socket.fd, ...common } : {
+    const r = await secureCall(async () => {
+      if (!options.socket)
+        return kernel.json({
           op: "sock-tls",
-          host: options.host ?? "localhost",
+          host,
           port: port(options.port),
           ...common,
           ...tls.path ? { path: tls.path } : {}
-        }
-      )
-    );
+        });
+      const req = { op: "sock-tls-upgrade", fd: options.socket.fd, ...common };
+      const done = await kernel.blocking(req, options.signal ?? NEVER);
+      return done.ok && done.kind === "json" ? done.json : void 0;
+    });
     const session = sessionOf(r);
     if (options.socket) return Object.assign(Object.create(options.socket), { tls: session });
     return Object.assign(await connection(r.fd), { tls: session });
@@ -16811,11 +16952,14 @@ function netOps(kernel, io, sync) {
   const listenSync = (options = {}) => {
     const lane = sync;
     const addr = inetAt(options);
+    const tls = options.tls ? serveRequest(options.tls) : void 0;
     const fd = lane.json({ op: "sock-open", domain: "inet" });
     try {
       lane.call({ op: "sock-bind", fd, addr });
       lane.call({ op: "sock-listen", fd, backlog: options.backlog ?? 128 });
-      return listener(fd, addressOf(lane.json({ op: "sock-name", fd, peer: false })));
+      if (tls) lane.call({ op: "sock-tls-listen", fd, ...tls });
+      const at = addressOf(lane.json({ op: "sock-name", fd, peer: false }));
+      return listener(fd, at, capOf(options, tls));
     } catch (err) {
       lane.raw({ op: "fd-close", fd });
       throw err;
@@ -16824,40 +16968,28 @@ function netOps(kernel, io, sync) {
   return {
     sync: { listen: listenSync },
     resolve: lookup2,
-    listen: (options = {}) => opened2(async (fd) => {
-      const addr = inetAt(options);
-      await kernel.call({ op: "sock-bind", fd, addr });
-      await kernel.call({ op: "sock-listen", fd, backlog: options.backlog ?? 128 });
-      return listener(fd, await name2(fd, false));
-    }),
-    connect: async (options) => {
-      const signal = options.signal ?? NEVER;
-      signal.throwIfAborted();
-      if (options.tls) return tlsConnect(options, options.tls);
-      const host = options.host ?? "127.0.0.1";
-      if (host.includes(":")) throw new JsCallError("EADDRNOTAVAIL", host);
-      const addr = {
-        family: "inet",
-        host: await resolve(host, signal),
-        port: port(options.port)
-      };
+    listen: async (options = {}) => {
+      const tls = options.tls ? serveRequest(options.tls) : void 0;
       return opened2(async (fd) => {
-        const r = await kernel.raw({ op: "sock-connect", fd, addr, nonblock: true });
-        if (!r.ok && r.errno !== "EINPROGRESS") throw new JsCallError(r.errno, "connect");
-        await kernel.blocking({ op: "fd-select", read: [], write: [fd], timeoutMs: -1 }, signal);
-        const failed5 = await kernel.json({
-          op: "sock-getopt",
-          fd,
-          level: SOL_SOCKET2,
-          name: SO_ERROR2
-        });
-        if (failed5 !== 0) throw new JsCallError(errnoName(failed5), "connect");
-        return connection(fd);
+        const addr = inetAt(options);
+        await kernel.call({ op: "sock-bind", fd, addr });
+        await kernel.call({ op: "sock-listen", fd, backlog: options.backlog ?? 128 });
+        if (tls)
+          await secureCall(() => kernel.call({ op: "sock-tls-listen", fd, ...tls }), "listen");
+        return listener(fd, await name2(fd, false), capOf(options, tls));
       });
+    },
+    secure: async (conn, tls) => {
+      if (tls.server !== true) return tlsConnect({ socket: conn }, tls);
+      return serve(conn, serveRequest(tls));
+    },
+    connect: (options) => {
+      (options.signal ?? NEVER).throwIfAborted();
+      return options.tls ? tlsConnect(options, options.tls) : connect(options);
     }
   };
 }
-var PEM, TLS_CODE, ALERT, SHUT_RD, SHUT_WR, IPV4, NEVER, SOL_SOCKET2, SO_ERROR2;
+var PEM, TLS_CODE, ALERT, SHUT_RD, SHUT_WR, LOOPBACK3, IPV4, NEVER, SOL_SOCKET2, SO_ERROR2, HANDSHAKES_MAX;
 var init_js_net = __esm({
   "src/process/js/js-net.ts"() {
     "use strict";
@@ -16868,10 +17000,12 @@ var init_js_net = __esm({
     ALERT = / \(alert (\d+)\)$/;
     SHUT_RD = 0;
     SHUT_WR = 1;
+    LOOPBACK3 = /^(localhost|127\.\d{1,3}\.\d{1,3}\.\d{1,3})$/;
     IPV4 = /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
     NEVER = new AbortController().signal;
     SOL_SOCKET2 = 1;
     SO_ERROR2 = 4;
+    HANDSHAKES_MAX = 64;
   }
 });