@ai-ecoverse/slicc-kernel 1.148.1 → 1.149.1

package/dist/types/kernel/net/tls-client.d.ts

@@ -38,3 +38,15 @@ export declare function tlsClient(conn: UplinkConn, o: TlsClientOptions, taken?:
     conn: UplinkConn;
     info: TlsClientInfo;
 }>;
+export interface TlsServerInfo {
+    protocol: 'TLSv1.2' | 'TLSv1.3';
+    alpnProtocol: string | false;
+    servername: string;
+    authorized: boolean;
+    authorizationError?: string;
+    peerCertificates: Uint8Array[];
+}
+export declare function tlsServer(conn: UplinkConn, session: TlsSession, clientCerts: boolean): Promise<{
+    conn: UplinkConn;
+    info: TlsServerInfo;
+}>;

package/dist/types/kernel/net/tls-engine.d.ts

@@ -1,6 +1,6 @@
 type TlsExport = 'malloc' | 'free' | 'tls_last_error' | 'tls_strerror' | 'tls_leaf_new' | 'tls_leaf_spki' | 'tls_leaf_add_cert' | 'tls_leaf_free' | 'tls_session_new' | 'tls_feed' | 'tls_feed_eof' | 'tls_in_room' | 'tls_read' | 'tls_write' | 'tls_out_size' | 'tls_out_take' | 'tls_close' | 'tls_alpn_http11' | 'tls_session_free';
 type TlsClientExport = 'tls_ca_new' | 'tls_ca_add_der' | 'tls_ca_add_bundle' | 'tls_ca_free' | 'tls_client_new' | 'tls_handshake' | 'tls_verify_result' | 'tls_verify_info' | 'tls_alpn' | 'tls_version' | 'tls_peer_count' | 'tls_peer_der';
-type TlsSessionExport = 'tls_client_cert' | 'tls_ciphersuite' | 'tls_name_mismatch' | 'tls_last_alert' | 'tls_chain_verify';
+type TlsSessionExport = 'tls_leaf_import' | 'tls_server_new' | 'tls_sni' | 'tls_client_cert' | 'tls_ciphersuite' | 'tls_name_mismatch' | 'tls_last_alert' | 'tls_chain_verify';
 export type TlsEngineModule = {
     readonly HEAPU8: Uint8Array;
 } & {
@@ -16,6 +16,8 @@ type TlsClientModule = TlsEngineModule & {
 export declare const TLS_CLIENT_INSECURE_SKIP_VERIFY = 1;
 export declare const TLS_CLIENT_NO_SNI = 2;
 export declare const TLS_CLIENT_VERIFY_CHAIN_ONLY = 4;
+export declare const TLS_SERVER_REQUEST_CERT = 1;
+export declare const TLS_SERVER_REQUIRE_CERT = 2;
 export declare class TlsError extends Error {
     readonly code: number;
     constructor(code: number, message: string);
@@ -29,6 +31,9 @@ export declare class TlsEngine {
     error(code: number, what: string): TlsError;
     leaf(): TlsLeaf;
     session(leaf: TlsLeaf, host: string): TlsSession;
+    get serverSessions(): boolean;
+    importLeaf(chain: Uint8Array, key: Uint8Array, pass: Uint8Array): TlsLeaf;
+    serverSession(leaf: TlsLeaf, alpn: readonly string[], clientCa: TlsStore | undefined, flags: number): TlsSession;
     withBytes<T>(bytes: Uint8Array, fn: (ptr: number) => T): T;
     withSecret<T>(bytes: Uint8Array, fn: (ptr: number) => T): T;
     intoScratch(fn: (ptr: number, max: number) => number): number | Uint8Array;
@@ -75,6 +80,7 @@ export declare class TlsSession {
     handshake(): boolean;
     get verifyResult(): number;
     get version(): number;
+    get sni(): string;
     get alpn(): string | undefined;
     ownCert(chain: Uint8Array, key: Uint8Array, pass: Uint8Array): void;
     get ciphersuite(): number;

package/dist/types/kernel/net/tls-server.d.ts

@@ -0,0 +1,34 @@
+import type { KernelSocket } from '../socket.js';
+import { type TlsEngine, type TlsLeaf, type TlsStore } from './tls-engine.js';
+import { type ClientCertRequest, type SecureProcess } from './tls-uplink.js';
+export interface ServeRequest {
+    cert?: ClientCertRequest;
+    ca?: string[];
+    requestCert?: boolean;
+    rejectUnauthorized?: boolean;
+    alpn?: string[];
+    handshakeTimeout?: number;
+    listener?: KernelSocket;
+}
+export interface ServedSession {
+    path: 'kernel';
+    protocol: 'TLSv1.2' | 'TLSv1.3';
+    alpnProtocol: string | false;
+    servername: string;
+    authorized: boolean;
+    authorizationError?: string;
+    peerCertificates: string[];
+}
+interface Server {
+    engine: TlsEngine;
+    leaf: TlsLeaf;
+    store: TlsStore | undefined;
+    alpn: string[];
+    flags: number;
+    timeoutMs: number;
+    release(): void;
+}
+export declare function serverOf(proc: SecureProcess, req: ServeRequest): Promise<Server>;
+export declare function listenSecure(proc: SecureProcess, socket: KernelSocket, req: ServeRequest): Promise<void>;
+export declare function serveSecure(proc: SecureProcess, socket: KernelSocket, req: ServeRequest): Promise<ServedSession>;
+export {};

package/dist/types/kernel/net/tls-uplink.d.ts

@@ -31,9 +31,13 @@ export interface SecureProcess {
         pid: number;
     };
     blocking(): AbortSignal;
+    cancelled?: AbortSignal;
     resolve(name: string, family: ResolveFamily, blocking: () => AbortSignal): Promise<string[]>;
 }
+export declare const handshakeAbort: (proc: SecureProcess) => AbortSignal;
 export declare function serverName(name: string): string;
+export declare function base64Der(text: string): Uint8Array;
+export declare function encode(bytes: Uint8Array): string;
 export interface SecureSession {
     path: 'kernel';
     substitutes: boolean;
@@ -60,8 +64,14 @@ declare function takeCert(req: SecureRequest): {
     key: Uint8Array<ArrayBufferLike>;
     pass: Uint8Array<ArrayBuffer>;
 } | undefined;
-type ClientCert = NonNullable<ReturnType<typeof takeCert>>;
+export declare function certBytes(cert: ClientCertRequest): {
+    chain: Uint8Array<ArrayBuffer>;
+    key: Uint8Array<ArrayBufferLike>;
+    pass: Uint8Array<ArrayBuffer>;
+};
+export type ClientCert = NonNullable<ReturnType<typeof takeCert>>;
 export declare function withCert(session: TlsSession, cert: ClientCert | undefined): void;
+export declare function wipe(cert: ClientCert | undefined): void;
 export interface Seal {
     proc: SecureProcess;
     port: number;

package/dist/types/kernel/socket-syscalls.d.ts

@@ -81,6 +81,16 @@ export type SocketSyscall = {
     sni?: false;
     checkHostname?: false;
     clientCert?: ClientCertRequest;
+} | {
+    op: 'sock-tls-serve' | 'sock-tls-listen';
+    fd: number;
+    from?: number;
+    cert?: ClientCertRequest;
+    ca?: string[];
+    requestCert?: boolean;
+    rejectUnauthorized?: boolean;
+    alpn?: string[];
+    handshakeTimeout?: number;
 } | {
     op: 'sock-recvfrom';
     fd: number;
@@ -93,6 +103,7 @@ export interface SocketProcess {
     fds: FdTable;
     net: LoopbackNet;
     blocking(): AbortSignal;
+    cancelled?: AbortSignal;
     resolve(name: string, family: ResolveFamily, blocking: () => AbortSignal): Promise<string[]>;
     cred?(): PeerCred;
     stamp?(): Promise<ConnectorStamp>;

package/dist/types/kernel/socket.d.ts

@@ -91,6 +91,15 @@ export declare class KernelSocket implements KernelFile {
     connectSecure(addr: Extract<SockAddr, {
         family: 'inet';
     }>, route: UplinkRoute, secure: (conn: SwitchConn) => Promise<void>): Promise<void>;
+    serving: {
+        release(): void;
+    } | undefined;
+    private served;
+    get loopbackLinked(): boolean;
+    secureLink<T>(make: (raw: UplinkConn) => Promise<{
+        conn: UplinkConn;
+        info: T;
+    }>, signal?: AbortSignal): Promise<T>;
     upgradeSecure<T>(make: (raw: UplinkConn) => Promise<{
         conn: UplinkConn;
         info: T;

package/dist/types/process/js/js-net.d.ts

@@ -39,6 +39,18 @@ export interface JsTlsOptions {
     pfx?: unknown;
     sni?: boolean;
     checkHostname?: boolean;
+    server?: boolean;
+    requestCert?: boolean;
+    handshakeTimeout?: number;
+}
+export interface JsTlsServerSession {
+    readonly path: 'kernel';
+    readonly protocol: 'TLSv1.2' | 'TLSv1.3';
+    readonly alpnProtocol: string | false;
+    readonly servername: string;
+    readonly authorized: boolean;
+    readonly authorizationError?: string;
+    readonly peerCertificates: readonly Uint8Array[];
 }
 export interface JsConnection {
     readonly fd: number;
@@ -62,6 +74,7 @@ export interface JsListenOptions {
     port?: number;
     host?: string;
     backlog?: number;
+    tls?: JsTlsOptions;
 }
 export interface JsConnectOptions {
     host?: string;
@@ -77,6 +90,7 @@ export interface JsResolveOptions {
 export interface JsNet {
     listen(options?: JsListenOptions): Promise<JsListener>;
     connect(options: JsConnectOptions): Promise<JsConnection>;
+    secure(conn: JsConnection, tls: JsTlsOptions): Promise<JsConnection>;
     resolve(name: string, options?: JsResolveOptions): Promise<string[]>;
 }
 export interface NetIo {
@@ -87,6 +101,8 @@ export interface NetIo {
 export interface JsSyncNet {
     listen(options?: JsListenOptions): JsListener;
 }
+export declare const HANDSHAKES_MAX = 64;
+export declare function securedAccepts(plain: (signal: AbortSignal) => Promise<JsConnection>, serve: (conn: JsConnection, signal: AbortSignal) => Promise<JsConnection>, stop: AbortSignal, cap: number): (signal: AbortSignal) => Promise<JsConnection>;
 export declare function netOps(kernel: JsKernel, io: NetIo, sync?: JsSyncKernel): JsNet & {
     sync: JsSyncNet;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-kernel",
-  "version": "1.148.1",
+  "version": "1.149.1",
   "description": "SLICC's wasm-realm kernel: run Emscripten programs in the browser against OPFS, with fork, spawn, pipes and waitpid",
   "type": "module",
   "license": "Apache-2.0",
@@ -64,10 +64,10 @@
   },
   "devDependencies": {
     "@ai-ecoverse/py-numpy": "2.5.4-4",
-    "@ai-ecoverse/slicc-cdp": "1.32.7",
+    "@ai-ecoverse/slicc-cdp": "1.33.1",
     "@ai-ecoverse/slicc-node": "2.5.2",
     "@ai-ecoverse/slicc-scrub": "1.0.0",
-    "@ai-ecoverse/slicc-shared-web": "2.11.0",
+    "@ai-ecoverse/slicc-shared-web": "2.11.1",
     "@ai-ecoverse/wasi-cargo": "0.99.0-6",
     "@ai-ecoverse/wasi-pnpm": "12.9.1-21",
     "@ai-ecoverse/wasi-ripgrep": "15.2.0-5",