@ai-ecoverse/slicc-kernel 1.151.0 → 1.152.0

package/dist/node-process-worker.js

@@ -2414,7 +2414,9 @@ var init_js_kernel = __esm({
       "sock-tls",
       "sock-tls-upgrade",
       "sock-tls-serve",
-      "sock-tls-listen"
+      "sock-tls-listen",
+      "sock-tls-context",
+      "sock-tls-select"
     ]);
     JsKernel = class {
       header;
@@ -7187,7 +7189,7 @@ var KERNEL_VERSION, OS_RELEASE;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    KERNEL_VERSION = true ? "1.151.0" : "0.0.0-dev";
+    KERNEL_VERSION = true ? "1.152.0" : "0.0.0-dev";
     OS_RELEASE = "6.0.0-slicc";
   }
 });
@@ -8019,10 +8021,13 @@ function keyText(key, what) {
 }
 function serveRequest(tls) {
   const own = clientCert(tls, "listen").clientCert;
-  if (!own)
+  if (tls.select !== void 0 && typeof tls.select !== "function")
+    throw new JsCallError("EINVAL", "listen", "ERR_INVALID_ARG_TYPE: select must be a function");
+  if (!own && !tls.select)
     throw new JsCallError("EINVAL", "listen", "ERR_INVALID_ARG_VALUE: a server needs cert and key");
   return {
-    cert: own,
+    ...own ? { cert: own } : {},
+    ...tls.select ? { select: true } : {},
     ...tls.ca !== void 0 ? { ca: caList(tls.ca) } : {},
     ...tls.requestCert ? { requestCert: true } : {},
     ...tls.rejectUnauthorized === false ? { rejectUnauthorized: false } : {},
@@ -8125,12 +8130,50 @@ function port(n) {
   if (!Number.isInteger(n) || n < 0 || n > 65535) throw new JsCallError("EINVAL", `port ${n}`);
   return n;
 }
-async function serveOn(kernel, conn, req, signal = NEVER) {
-  const r = await secureCall(
-    () => kernel.blocking({ op: "sock-tls-serve", fd: conn.fd, ...req }, signal),
-    "accept"
-  );
-  const wire = r.ok && r.kind === "json" ? r.json : {};
+function choiceWire(choice) {
+  if (!choice) return {};
+  const { context, alpn, refuse: refuse2 } = choice;
+  return {
+    ...context === void 0 ? {} : { context: typeof context === "number" ? context : context.fd },
+    ...alpn === void 0 ? {} : { alpn: String(alpn) },
+    ...refuse2 === void 0 ? {} : { refuse: ALERTS[String(refuse2)] ?? Number(refuse2) }
+  };
+}
+function expiry(ms) {
+  let timer;
+  const late = new Promise((_, reject) => {
+    timer = setTimeout(
+      () => reject(new JsCallError("ERR_TLS_HANDSHAKE_TIMEOUT", "accept", "ERR_TLS_HANDSHAKE_TIMEOUT")),
+      ms
+    );
+  });
+  late.catch(() => void 0);
+  return { late, clear: () => clearTimeout(timer) };
+}
+async function selected(pick, offer, ms) {
+  const limit2 = expiry(ms);
+  try {
+    if (!pick) return { wire: {} };
+    const choice = await Promise.race([pick(Object.freeze({ ...offer })), limit2.late]);
+    return { wire: choiceWire(choice) };
+  } catch (thrown) {
+    return { wire: { refuse: ALERTS.handshake_failure }, thrown };
+  } finally {
+    limit2.clear();
+  }
+}
+async function serveOn(kernel, conn, req, signal = NEVER, pick, ms = HANDSHAKE_TIMEOUT_MS) {
+  const call2 = (body) => secureCall(async () => {
+    const r = await kernel.blocking(body, signal);
+    return r.ok && r.kind === "json" ? r.json : {};
+  }, "accept");
+  let wire = await call2({ op: "sock-tls-serve", fd: conn.fd, ...req });
+  while (wire.select) {
+    const { wire: choice, thrown } = await selected(pick, wire.select, ms);
+    wire = await call2({ op: "sock-tls-select", fd: conn.fd, ...choice }).catch((err) => {
+      throw thrown ?? err;
+    });
+  }
   return Object.assign(Object.create(conn), { tls: servedOf(wire) });
 }
 function changeOf(waiters, signal) {
@@ -8200,7 +8243,7 @@ function securedAccepts(plain2, serve, stop, cap) {
     }
   };
 }
-function listenerOf(ops, fd, at, handshakes) {
+function listenerOf(ops, fd, at, handshakes, tls) {
   const { kernel, io, connection, serve } = ops;
   const stop = new AbortController();
   const acceptPlain = async (signal) => {
@@ -8212,7 +8255,12 @@ function listenerOf(ops, fd, at, handshakes) {
       await kernel.blocking({ op: "fd-select", read: [fd], write: [], timeoutMs: -1 }, signal);
     }
   };
-  const next2 = handshakes > 0 ? securedAccepts(acceptPlain, (c, s) => serve(c, { from: fd }, s), stop.signal, handshakes) : acceptPlain;
+  const next2 = handshakes > 0 ? securedAccepts(
+    acceptPlain,
+    (c, s) => serve(c, { from: fd }, s, tls?.select, tls?.handshakeTimeout),
+    stop.signal,
+    handshakes
+  ) : acceptPlain;
   const accept = (options = {}) => next2(AbortSignal.any([options.signal ?? NEVER, stop.signal]));
   return {
     fd,
@@ -8234,6 +8282,27 @@ function listenerOf(ops, fd, at, handshakes) {
     }
   };
 }
+async function contextOf(kernel, io, options) {
+  const own = clientCert(options ?? {}, "tlsContext").clientCert;
+  if (!own)
+    throw new JsCallError(
+      "EINVAL",
+      "tlsContext",
+      "ERR_INVALID_ARG_VALUE: a context needs cert and key"
+    );
+  const fd = await secureCall(
+    () => kernel.json({ op: "sock-tls-context", cert: own }),
+    "tlsContext"
+  );
+  let closed;
+  return Object.freeze({
+    fd,
+    close: () => {
+      closed ??= io.close(fd);
+      return closed;
+    }
+  });
+}
 function capOf(options, tls) {
   return tls ? Math.max(1, Math.min(options.backlog ?? 128, HANDSHAKES_MAX)) : 0;
 }
@@ -8284,9 +8353,9 @@ function netOps(kernel, io, sync) {
       throw err;
     }
   };
-  const serve = (conn, req, signal) => serveOn(kernel, conn, req, signal);
+  const serve = (...args) => serveOn(kernel, ...args);
   const ops = { kernel, io, connection, serve };
-  const listener = (fd, at, handshakes = 0) => listenerOf(ops, fd, at, handshakes);
+  const listener = (fd, at, handshakes = 0, tls) => listenerOf(ops, fd, at, handshakes, tls);
   const connect = async (options) => {
     const signal = options.signal ?? NEVER;
     const host = options.host ?? "127.0.0.1";
@@ -8372,7 +8441,7 @@ function netOps(kernel, io, sync) {
       lane.call({ op: "sock-listen", fd, backlog: options.backlog ?? 128 });
       if (tls) lane.call({ op: "sock-tls-listen", fd, ...tls });
       const at = addressOf(lane.json({ op: "sock-name", fd, peer: false }));
-      return listener(fd, at, capOf(options, tls));
+      return listener(fd, at, capOf(options, tls), options.tls);
     } catch (err) {
       lane.raw({ op: "fd-close", fd });
       throw err;
@@ -8389,20 +8458,21 @@ function netOps(kernel, io, sync) {
         await kernel.call({ op: "sock-listen", fd, backlog: options.backlog ?? 128 });
         if (tls)
           await secureCall(() => kernel.call({ op: "sock-tls-listen", fd, ...tls }), "listen");
-        return listener(fd, await name2(fd, false), capOf(options, tls));
+        return listener(fd, await name2(fd, false), capOf(options, tls), options.tls);
       });
     },
     secure: async (conn, tls) => {
       if (tls.server !== true) return tlsConnect({ socket: conn }, tls);
-      return serve(conn, serveRequest(tls));
+      return serve(conn, serveRequest(tls), void 0, tls.select, tls.handshakeTimeout);
     },
+    tlsContext: (options) => contextOf(kernel, io, options),
     connect: (options) => {
       (options.signal ?? NEVER).throwIfAborted();
       return options.tls ? tlsConnect(options, options.tls) : connect(options);
     }
   };
 }
-var PEM, TLS_CODE, ALERT, SHUT_RD, SHUT_WR, LOOPBACK3, IPV4, NEVER, SOL_SOCKET2, SO_ERROR2, HANDSHAKES_MAX;
+var PEM, TLS_CODE, ALERT, SHUT_RD, SHUT_WR, LOOPBACK3, IPV4, NEVER, SOL_SOCKET2, SO_ERROR2, ALERTS, HANDSHAKE_TIMEOUT_MS, HANDSHAKES_MAX;
 var init_js_net = __esm({
   "src/process/js/js-net.ts"() {
     "use strict";
@@ -8418,6 +8488,14 @@ var init_js_net = __esm({
     NEVER = new AbortController().signal;
     SOL_SOCKET2 = 1;
     SO_ERROR2 = 4;
+    ALERTS = {
+      unrecognized_name: 112,
+      no_application_protocol: 120,
+      handshake_failure: 40,
+      access_denied: 49,
+      internal_error: 80
+    };
+    HANDSHAKE_TIMEOUT_MS = 12e4;
     HANDSHAKES_MAX = 64;
   }
 });