@ai-ecoverse/slicc-kernel 1.150.0 → 1.151.0

package/dist/node.js

@@ -3362,7 +3362,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.150.0" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.151.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -14792,8 +14792,10 @@ async function tlsServer(conn, session, clientCerts) {
     await serverHandshake(conn, session, inbox, () => first);
     const chain2 = session.peerChain();
     const code = clientCerts ? verifyCode(session.verifyResult) : void 0;
+    const protocol = session.version === 772 ? "TLSv1.3" : "TLSv1.2";
     const info = {
-      protocol: session.version === 772 ? "TLSv1.3" : "TLSv1.2",
+      protocol,
+      cipher: cipherOf(session.ciphersuite, protocol),
       alpnProtocol: session.alpn ?? false,
       servername: session.sni,
       authorized: clientCerts && chain2.length > 0 && code === void 0,
@@ -15487,9 +15489,9 @@ function compile(secrets, options = {}) {
 var SCRUB_IDLE_MS = 50;
 var SCRUB_NONBLOCK_MAX = 64 * 1024;
 var encoder6 = new TextEncoder();
-function scrubberOf(secrets) {
+function scrubberOf(secrets, sameLength = false) {
   const usable2 = secrets.filter((s) => encoder6.encode(s.value).length >= MIN_VALUE);
-  return usable2.length > 0 ? compile(usable2, { idleMs: SCRUB_IDLE_MS }) : void 0;
+  return usable2.length > 0 ? compile(usable2, { idleMs: SCRUB_IDLE_MS, sameLength }) : void 0;
 }
 async function writeAll2(file, bytes) {
   const write = file.write;
@@ -15677,7 +15679,7 @@ function addTo(tree2, host, secrets) {
 function scrubOf(tree2, host) {
   const entry = tree2?.get(host);
   if (!entry) return void 0;
-  entry.scrubber ??= scrubberOf(entry.secrets);
+  entry.scrubber ??= scrubberOf(entry.secrets, true);
   return entry.scrubber ? { version: entry.version, scrubber: entry.scrubber } : void 0;
 }
 var SessionScrubs = class {
@@ -17992,9 +17994,8 @@ function storeOf(engine, ca) {
     throw new KernelError("EINVAL", `ERR_INVALID_ARG_VALUE: ca: ${err.message}`);
   }
 }
-function flagsOf(req, store) {
+function flagsOf(req) {
   if (!req.requestCert) return 0;
-  if (!store) throw new KernelError("EINVAL", "ERR_INVALID_ARG_VALUE: requestCert needs a ca");
   return req.rejectUnauthorized === false ? TLS_SERVER_REQUEST_CERT : TLS_SERVER_REQUIRE_CERT;
 }
 function timeoutOf(req) {
@@ -18030,10 +18031,11 @@ async function serverOf(proc, req) {
     throw err;
   }
   const leaf = leafOf(engine, cert);
-  let store;
+  let mine;
   try {
-    store = req.ca && req.ca.length > 0 ? storeOf(engine, req.ca) : void 0;
-    const flags2 = flagsOf(req, store);
+    mine = req.ca && req.ca.length > 0 ? storeOf(engine, req.ca) : void 0;
+    const flags2 = flagsOf(req);
+    const store = mine ?? (flags2 ? await defaultStore(engine, supportOf(proc.net).roots) : void 0);
     return {
       engine,
       leaf,
@@ -18043,12 +18045,12 @@ async function serverOf(proc, req) {
       timeoutMs: timeoutOf(req),
       release() {
         leaf.release();
-        store?.release();
+        mine?.release();
       }
     };
   } catch (err) {
     leaf.release();
-    store?.release();
+    mine?.release();
     throw err;
   }
 }
@@ -18077,7 +18079,8 @@ async function serveSecure(proc, socket, req) {
       servername: info.servername,
       authorized: info.authorized,
       ...info.authorizationError ? { authorizationError: info.authorizationError } : {},
-      peerCertificates: info.peerCertificates.map(encode)
+      peerCertificates: info.peerCertificates.map(encode),
+      cipher: info.cipher
     };
   } finally {
     if (!shared) server.release();