@ai-ecoverse/slicc-kernel 1.151.1 → 1.152.0

package/dist/types/index.d.ts

@@ -36,7 +36,7 @@ export type { ProcessMountPolicy, ProcessMountRequest } from './mount/syscall.js
 export type { JsChild, JsExited, JsSpawnOptions, JsStdio } from './process/js/js-children.js';
 export type { JsCrontabAnswer, JsCrontabCall, JsFdStatus, JsFdType, JsFile, JsOpenOptions, JsProgramContext, JsSelected, JsSelectSets, JsSignal, JsSudoAnswer, JsWriteOptions, } from './process/js/js-context.js';
 export type { JsStatFs } from './process/js/js-io.js';
-export type { JsAddress, JsConnection, JsConnectOptions, JsListener, JsListenOptions, JsNet, JsResolveOptions, JsTlsCipher, JsTlsOptions, JsTlsSession, } from './process/js/js-net.js';
+export type { JsAddress, JsConnection, JsConnectOptions, JsListener, JsListenOptions, JsNet, JsResolveOptions, JsTlsChoice, JsTlsCipher, JsTlsContext, JsTlsContextOptions, JsTlsOffer, JsTlsOptions, JsTlsSelect, JsTlsServerSession, JsTlsSession, } from './process/js/js-net.js';
 export type { JsRunOptions, JsRunResult, JsRunStdio } from './process/js/js-run.js';
 export type { JsCred, JsSyncContext, JsSyncFile } from './process/js/js-sync.js';
 export type { JsThread, JsThreadContext, JsThreadSpawnOptions } from './process/js/js-thread.js';

package/dist/types/kernel/net/tls-client.d.ts

@@ -1,5 +1,5 @@
 import { type TlsCipher } from './tls-ciphers.js';
-import { type TlsEngine, type TlsSession, type TlsStore } from './tls-engine.js';
+import { type TlsEngine, type TlsLeaf, type TlsSession, type TlsStore } from './tls-engine.js';
 import type { UplinkConn } from './uplink.js';
 export declare function verifyCode(flags: number): string | undefined;
 export interface TlsClientInfo {
@@ -47,7 +47,18 @@ export interface TlsServerInfo {
     peerCertificates: Uint8Array[];
     cipher: TlsCipher;
 }
-export declare function tlsServer(conn: UplinkConn, session: TlsSession, clientCerts: boolean): Promise<{
+export interface ServerOffer {
+    servername: string;
+    protocols: string[];
+}
+export interface ServerChoice {
+    leaf?: TlsLeaf;
+    alpn?: string;
+    refuse?: number;
+    done?: () => void;
+}
+export type ServerSelect = (offer: ServerOffer) => Promise<ServerChoice>;
+export declare function tlsServer(conn: UplinkConn, session: TlsSession, clientCerts: boolean, select?: ServerSelect): Promise<{
     conn: UplinkConn;
     info: TlsServerInfo;
 }>;

package/dist/types/kernel/net/tls-engine.d.ts

@@ -1,6 +1,6 @@
 type TlsExport = 'malloc' | 'free' | 'tls_last_error' | 'tls_strerror' | 'tls_leaf_new' | 'tls_leaf_spki' | 'tls_leaf_add_cert' | 'tls_leaf_free' | 'tls_session_new' | 'tls_feed' | 'tls_feed_eof' | 'tls_in_room' | 'tls_read' | 'tls_write' | 'tls_out_size' | 'tls_out_take' | 'tls_close' | 'tls_alpn_http11' | 'tls_session_free';
 type TlsClientExport = 'tls_ca_new' | 'tls_ca_add_der' | 'tls_ca_add_bundle' | 'tls_ca_free' | 'tls_client_new' | 'tls_handshake' | 'tls_verify_result' | 'tls_verify_info' | 'tls_alpn' | 'tls_version' | 'tls_peer_count' | 'tls_peer_der';
-type TlsSessionExport = 'tls_leaf_import' | 'tls_server_new' | 'tls_sni' | 'tls_client_cert' | 'tls_ciphersuite' | 'tls_name_mismatch' | 'tls_last_alert' | 'tls_chain_verify';
+type TlsSessionExport = 'tls_leaf_import' | 'tls_server_new' | 'tls_sni' | 'tls_server_select' | 'tls_server_refuse' | 'tls_client_alpn' | 'tls_client_cert' | 'tls_ciphersuite' | 'tls_name_mismatch' | 'tls_last_alert' | 'tls_chain_verify';
 export type TlsEngineModule = {
     readonly HEAPU8: Uint8Array;
 } & {
@@ -18,6 +18,8 @@ export declare const TLS_CLIENT_NO_SNI = 2;
 export declare const TLS_CLIENT_VERIFY_CHAIN_ONLY = 4;
 export declare const TLS_SERVER_REQUEST_CERT = 1;
 export declare const TLS_SERVER_REQUIRE_CERT = 2;
+export declare const TLS_SERVER_SELECT = 4;
+export declare const TLS_HANDSHAKE_SELECT = 2;
 export declare class TlsError extends Error {
     readonly code: number;
     constructor(code: number, message: string);
@@ -33,7 +35,8 @@ export declare class TlsEngine {
     session(leaf: TlsLeaf, host: string): TlsSession;
     get serverSessions(): boolean;
     importLeaf(chain: Uint8Array, key: Uint8Array, pass: Uint8Array): TlsLeaf;
-    serverSession(leaf: TlsLeaf, alpn: readonly string[], clientCa: TlsStore | undefined, flags: number): TlsSession;
+    get serverSelect(): boolean;
+    serverSession(leaf: TlsLeaf | undefined, alpn: readonly string[], clientCa: TlsStore | undefined, flags: number): TlsSession;
     withBytes<T>(bytes: Uint8Array, fn: (ptr: number) => T): T;
     withSecret<T>(bytes: Uint8Array, fn: (ptr: number) => T): T;
     intoScratch(fn: (ptr: number, max: number) => number): number | Uint8Array;
@@ -78,6 +81,10 @@ export declare class TlsSession {
     free(): void;
     private get c();
     handshake(): boolean;
+    step(): number;
+    clientAlpn(): string[];
+    select(leaf: TlsLeaf | undefined, alpn: string | undefined): void;
+    refuse(alert: number): void;
     get verifyResult(): number;
     get version(): number;
     get sni(): string;

package/dist/types/kernel/net/tls-server.d.ts

@@ -1,5 +1,7 @@
+import { type FdTable } from '../fd-table.js';
 import type { KernelSocket } from '../socket.js';
 import type { TlsCipher } from './tls-ciphers.js';
+import { type ServerOffer } from './tls-client.js';
 import { type TlsEngine, type TlsLeaf, type TlsStore } from './tls-engine.js';
 import { type ClientCertRequest, type SecureProcess } from './tls-uplink.js';
 export interface ServeRequest {
@@ -9,8 +11,14 @@ export interface ServeRequest {
     rejectUnauthorized?: boolean;
     alpn?: string[];
     handshakeTimeout?: number;
+    select?: boolean;
     listener?: KernelSocket;
 }
+export interface SelectRequest {
+    context?: number;
+    alpn?: string;
+    refuse?: number;
+}
 export interface ServedSession {
     path: 'kernel';
     protocol: 'TLSv1.2' | 'TLSv1.3';
@@ -23,7 +31,7 @@ export interface ServedSession {
 }
 interface Server {
     engine: TlsEngine;
-    leaf: TlsLeaf;
+    leaf: TlsLeaf | undefined;
     store: TlsStore | undefined;
     alpn: string[];
     flags: number;
@@ -32,5 +40,12 @@ interface Server {
 }
 export declare function serverOf(proc: SecureProcess, req: ServeRequest): Promise<Server>;
 export declare function listenSecure(proc: SecureProcess, socket: KernelSocket, req: ServeRequest): Promise<void>;
-export declare function serveSecure(proc: SecureProcess, socket: KernelSocket, req: ServeRequest): Promise<ServedSession>;
+export declare function serveSecure(proc: SecureProcess, socket: KernelSocket, req: ServeRequest): Promise<ServedSession | {
+    select: ServerOffer;
+}>;
+export declare const TLS_CONTEXTS_MAX = 64;
+export declare function contextSecure(proc: SecureProcess & {
+    fds: FdTable;
+}, cert: ClientCertRequest | undefined): Promise<number>;
+export declare function selectSecure(fds: FdTable, socket: KernelSocket, req: SelectRequest): Promise<ServedSession>;
 export {};

package/dist/types/kernel/socket-syscalls.d.ts

@@ -91,6 +91,16 @@ export type SocketSyscall = {
     rejectUnauthorized?: boolean;
     alpn?: string[];
     handshakeTimeout?: number;
+    select?: boolean;
+} | {
+    op: 'sock-tls-context';
+    cert?: ClientCertRequest;
+} | {
+    op: 'sock-tls-select';
+    fd: number;
+    context?: number;
+    alpn?: string;
+    refuse?: number;
 } | {
     op: 'sock-recvfrom';
     fd: number;

package/dist/types/kernel/socket.d.ts

@@ -94,6 +94,7 @@ export declare class KernelSocket implements KernelFile {
     serving: {
         release(): void;
     } | undefined;
+    pending: (() => void) | undefined;
     private served;
     get loopbackLinked(): boolean;
     secureLink<T>(make: (raw: UplinkConn) => Promise<{

package/dist/types/process/js/js-net.d.ts

@@ -42,6 +42,26 @@ export interface JsTlsOptions {
     server?: boolean;
     requestCert?: boolean;
     handshakeTimeout?: number;
+    select?: JsTlsSelect;
+}
+export interface JsTlsOffer {
+    servername: string;
+    protocols: string[];
+}
+export interface JsTlsChoice {
+    context?: JsTlsContext | number;
+    alpn?: string;
+    refuse?: string | number;
+}
+export type JsTlsSelect = (offer: JsTlsOffer) => JsTlsChoice | undefined | Promise<JsTlsChoice | undefined>;
+export interface JsTlsContext {
+    readonly fd: number;
+    close(): Promise<void>;
+}
+export interface JsTlsContextOptions {
+    cert: unknown;
+    key: unknown;
+    passphrase?: string;
 }
 export interface JsTlsServerSession {
     readonly path: 'kernel';
@@ -92,6 +112,7 @@ export interface JsNet {
     listen(options?: JsListenOptions): Promise<JsListener>;
     connect(options: JsConnectOptions): Promise<JsConnection>;
     secure(conn: JsConnection, tls: JsTlsOptions): Promise<JsConnection>;
+    tlsContext(options: JsTlsContextOptions): Promise<JsTlsContext>;
     resolve(name: string, options?: JsResolveOptions): Promise<string[]>;
 }
 export interface NetIo {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-kernel",
-  "version": "1.151.1",
+  "version": "1.152.0",
   "description": "SLICC's wasm-realm kernel: run Emscripten programs in the browser against OPFS, with fork, spawn, pipes and waitpid",
   "type": "module",
   "license": "Apache-2.0",