@ai-ecoverse/slicc-kernel 1.152.2 → 1.153.0

package/dist/types/client/attach.d.ts

@@ -2,6 +2,7 @@ import type { CdpHook } from '../cdp/types.js';
 import type { FacadeHook } from '../facade/types.js';
 import type { FsStat, UsersMode } from '../fs/types.js';
 import type { WatchChange } from '../fs/watch.js';
+import { type EmbedderHook } from '../kernel/embedder.js';
 import type { RealmTransport, RealmTransportRequest, RealmTransportResponse, RealmTransportTraits } from '../kernel/net/transport.js';
 import type { MountEntry, MountSpec } from '../mount/mount-fs.js';
 import { type DialledSocket, type DialOptions } from './dial-stream.js';
@@ -19,6 +20,7 @@ export declare class KernelCallError extends Error {
 export interface AttachOptions {
     timeoutMs?: number;
     locks?: LockManagerLike | null;
+    requests?: EmbedderHook;
 }
 export interface SpawnOptions {
     cwd?: string;

package/dist/types/client/protocol.d.ts

@@ -7,6 +7,10 @@ export declare const PROTOCOL: readonly [number, number];
 export interface ClientHello {
     protocol: readonly [number, number];
     lock?: string;
+    requests?: Record<string, {
+        group?: string;
+        users?: Array<string | number>;
+    }>;
 }
 export interface KernelHello {
     protocol: readonly [number, number];

package/dist/types/client/serve-client.d.ts

@@ -10,6 +10,8 @@ export interface ClientHost {
     signal?: (name: string) => number;
     user?: string | number;
     tag?: string;
+    session?: number;
+    attachRequests?: boolean;
 }
 export interface ServedClient {
     detach(kill?: boolean): void;

package/dist/types/embedder-relay.d.ts

@@ -0,0 +1,58 @@
+import type { EmbedderHook, EmbedderKindPolicy, EmbedderStamp } from './kernel/embedder.js';
+export interface EmbedderPort {
+    postMessage(message: unknown, transfer?: Transferable[]): void;
+}
+type Kinds = Readonly<Record<string, EmbedderKindPolicy>>;
+export interface EmbedderAsk {
+    id: number;
+    client: number;
+    kind: string;
+    options: Record<string, unknown>;
+    stamp: EmbedderStamp;
+}
+export type EmbedderToPage = {
+    ask: EmbedderAsk;
+} | {
+    id: number;
+    body: Uint8Array;
+} | {
+    id: number;
+    bodyEnd: true;
+} | {
+    id: number;
+    pull: true;
+} | {
+    id: number;
+    cancel: string;
+};
+export type EmbedderToKernel = {
+    id: number;
+    ready: true;
+} | {
+    id: number;
+    chunk: Uint8Array;
+} | {
+    id: number;
+    done: true;
+} | {
+    id: number;
+    error: {
+        name: string;
+        message: string;
+    };
+} | {
+    id: number;
+    progress: string;
+} | {
+    id: number;
+    bodyPull: true;
+};
+export declare function embedderAsker(port: EmbedderPort): {
+    hookFor: (client: number, kinds: Kinds) => EmbedderHook;
+    answer: (message: EmbedderToKernel) => void;
+};
+export declare function embedderAnswerer(port: EmbedderPort, hookFor: (client: number) => EmbedderHook | undefined): {
+    handle(data: unknown): boolean;
+};
+export declare function embedderReplyOf(data: unknown): EmbedderToKernel | undefined;
+export {};

package/dist/types/index.d.ts

@@ -7,6 +7,7 @@ import type { DenialHook } from './fs/dac.js';
 import { type Protection } from './fs/protect.js';
 import { type UsersMode } from './fs/types.js';
 import type { ClipboardHook } from './kernel/clipboard.js';
+import { type EmbedderHook } from './kernel/embedder.js';
 import type { RouteTable } from './kernel/net/routes.js';
 import { type NetworkUplink } from './kernel/net/uplink.js';
 import type { SealedHook } from './kernel/sealed.js';
@@ -24,6 +25,7 @@ export type { FacadeConnection, FacadeHook, FacadeInfo, FacadeSpec, FacadeSpecs,
 export type { Attestation, AttestedDir } from './fs/attest.js';
 export type { Denial, DenialHook } from './fs/dac.js';
 export type { ClipboardHook, ClipboardStamp } from './kernel/clipboard.js';
+export type { EmbedderHook, EmbedderKindPolicy, EmbedderReply, EmbedderRequest, EmbedderStamp, } from './kernel/embedder.js';
 export type { RouteTable } from './kernel/net/routes.js';
 export type { NetworkUplink, ResolveAnswer, ResolveFamily, UplinkTraits, } from './kernel/net/uplink.js';
 export type { SealedAbortReason, SealedCaller, SealedHook, SealedRequest, } from './kernel/sealed.js';
@@ -73,6 +75,7 @@ export interface KernelOptions {
     onDenial?: DenialHook;
     sealed?: SealedHook;
     clipboard?: ClipboardHook;
+    requests?: EmbedderHook;
     approve?: ApproveHook;
     protect?: Protection;
 }
@@ -99,6 +102,7 @@ export interface RunResult {
 export interface ConnectOptions {
     user?: string | number;
     tag?: string;
+    requests?: EmbedderHook | 'attach';
 }
 export interface KernelGroups {
     list(): Promise<Group[]>;

package/dist/types/kernel/embedder.d.ts

@@ -0,0 +1,100 @@
+import type { UsersMode } from '../fs/types.js';
+import { KernelError, type OpenAccess, OpenFile, type PollState } from './fd-table.js';
+export declare const EMBEDDER_PATH = "/dev/embedder";
+export declare const EMBEDDER_MINOR = 252;
+export declare const EMBEDDER_HEADER_MAX: number;
+export declare const EMBEDDER_WINDOW: number;
+export declare const EMBEDDER_BUDGET: number;
+export declare const EMBEDDER_PER_PROCESS = 16;
+export declare const EMBEDDER_PROGRESS_PER_SECOND = 4;
+export interface EmbedderStamp {
+    pid: number;
+    uid: number;
+    gid: number;
+    groups: number[];
+    users: UsersMode;
+    kind: string;
+    tag?: string;
+    tags?: string[];
+}
+export interface EmbedderKindPolicy {
+    group?: string;
+    users?: Array<string | number>;
+}
+export type EmbedderReply = ReadableStream<Uint8Array> | Uint8Array | string | undefined | void;
+export interface EmbedderRequest {
+    kind: string;
+    options: Record<string, unknown>;
+    body: ReadableStream<Uint8Array>;
+    stamp: EmbedderStamp;
+    signal: AbortSignal;
+    progress(line: string): void;
+}
+export interface EmbedderHook {
+    kinds: Readonly<Record<string, EmbedderKindPolicy>>;
+    handle(request: EmbedderRequest): Promise<EmbedderReply>;
+}
+export interface EmbedderCaller {
+    pid: number;
+    shownPid: number;
+    euid: number;
+    egid: number;
+    groups: number[];
+    sessionUid: number;
+    client: number;
+    tags: readonly string[] | undefined;
+    progress(line: string): void;
+    closing(): AbortSignal;
+}
+export interface EmbedderLookup {
+    groupId(name: string): Promise<number | undefined>;
+    userId(name: string): Promise<number | undefined>;
+}
+export declare function embedderFailure(err: unknown): KernelError;
+export declare class EmbedderChannel {
+    readonly access: OpenAccess;
+    readonly owner: number;
+    caller: EmbedderCaller;
+    private readonly broker;
+    private header;
+    private body;
+    private reply;
+    private replied;
+    private rest;
+    private done;
+    private failure;
+    private reported;
+    private readonly abort;
+    private closed;
+    private readonly throttle;
+    constructor(broker: EmbedderBroker, access: OpenAccess, caller: EmbedderCaller);
+    get dispatched(): boolean;
+    private fail;
+    private report;
+    private dispatch;
+    write(bytes: Uint8Array, signal?: AbortSignal): Promise<number>;
+    private writeBody;
+    private readerOf;
+    read(max: number, signal?: AbortSignal): Promise<Uint8Array>;
+    private next;
+    poll(): PollState;
+    cancel(reason: 'interrupted' | 'closed'): void;
+    close(): Promise<void>;
+    private drain;
+}
+export declare class EmbedderBroker {
+    readonly users: UsersMode;
+    private readonly lookup;
+    private readonly hooks;
+    private readonly budget;
+    private readonly open;
+    readonly tagsOf: (pid: number) => readonly string[] | undefined;
+    constructor(users: UsersMode, lookup: EmbedderLookup, tagsOf?: (pid: number) => readonly string[] | undefined, budget?: number);
+    register(client: number, hook: EmbedderHook | undefined): () => void;
+    hookFor(client: number): EmbedderHook | undefined;
+    private allowed;
+    admit(kind: string, caller: EmbedderCaller): Promise<EmbedderStamp>;
+    channel(access: OpenAccess, caller: EmbedderCaller): OpenFile;
+    release(channel: EmbedderChannel): void;
+}
+export declare function kindsOf(hook: EmbedderHook): Record<string, EmbedderKindPolicy>;

package/dist/types/kernel/fd-table.d.ts

@@ -1,4 +1,5 @@
 import type { ClipboardChannel } from './clipboard.js';
+import type { EmbedderChannel } from './embedder.js';
 import type { PtyPair } from './pty.js';
 import type { SealedChannel } from './sealed.js';
 import type { KernelTty } from './tty.js';
@@ -39,6 +40,7 @@ export interface KernelFile {
     pty?: PtyPair;
     sealed?: SealedChannel;
     clipboard?: ClipboardChannel;
+    embedder?: EmbedderChannel;
     held?: true;
     heldMeta?: HeldMeta;
     identity?: object;
@@ -78,7 +80,7 @@ export declare function nullFile(): OpenFile;
 export declare function deviceAt(path: string): KernelDevice | undefined;
 export declare function deviceFile(device: KernelDevice, access?: DeviceAccess): OpenFile;
 export declare function heldFile(meta?: HeldMeta): OpenFile;
-export type KernelFdKind = 'tty' | 'stream' | 'file' | 'socket' | 'held' | 'device' | 'sealed' | 'clipboard';
+export type KernelFdKind = 'tty' | 'stream' | 'file' | 'socket' | 'held' | 'device' | 'sealed' | 'clipboard' | 'embedder';
 export declare function kernelFdKind(file: KernelFile): Exclude<KernelFdKind, 'socket'>;
 export interface ForkedHandles {
     fork(): ForkedHandles;

package/dist/types/kernel/host.d.ts

@@ -7,6 +7,7 @@ import type { ChildForker, ChildSpawner } from './children.js';
 import type { ClipboardBroker } from './clipboard.js';
 import { type CpuTimes } from './cpu-clock.js';
 import { type Cred } from './cred.js';
+import type { EmbedderBroker } from './embedder.js';
 import { type FdTable, type OpenFile } from './fd-table.js';
 import type { FifoTable } from './fifo.js';
 import { type CwdAnswer, type HeldCwdReply } from './held-cwd.js';
@@ -54,6 +55,13 @@ export interface SpawnWasmOptions {
     sealed?: SealedBroker;
     outputFilter?: (file: OpenFile) => OpenFile;
     clipboard?: ClipboardBroker;
+    embedder?: {
+        broker: EmbedderBroker;
+        session: () => {
+            client: number;
+            uid: number;
+        };
+    };
     readonlyAt?: (path: string) => boolean;
     dac?: Dac;
     identity?: () => Promise<{

package/dist/types/kernel/process.d.ts

@@ -10,6 +10,7 @@ import type { SudoCall, SudoResult } from '../sudo.js';
 import { type ChildForker, type ChildSpawner, type ChildStdio, type InheritedSlot } from './children.js';
 import type { ClipboardBroker } from './clipboard.js';
 import { type Cred, type CredChange } from './cred.js';
+import { type EmbedderBroker } from './embedder.js';
 import { type EpollSyscall } from './epoll.js';
 import { type DeviceAccess, type FdTable, type HeldMeta, type KernelFdKind, type OpenFile } from './fd-table.js';
 import type { FifoTable } from './fifo.js';
@@ -230,6 +231,9 @@ export type WasmSyscall = {
 } | {
     op: 'fd-clipboard-abort';
     fd: number;
+} | {
+    op: 'fd-open-embedder';
+    flags: number;
 } | {
     op: 'tty-get';
     fd: number;
@@ -370,6 +374,12 @@ export interface WasmProcessOptions {
     outputFilter?: (file: OpenFile) => OpenFile;
     clipboard?: ClipboardBroker;
     clipboardName?: string;
+    embedder?: EmbedderBroker;
+    embedderSession?: () => {
+        client: number;
+        uid: number;
+    };
+    embedderName?: string;
     readonlyAt?: (path: string) => boolean;
     guard?: {
         dac: Dac;
@@ -504,6 +514,13 @@ export declare class WasmProcess {
     private cancelSignal;
     private read;
     private readClipboard;
+    private readEmbedder;
+    private writeEmbedder;
+    private deviceComplaint;
+    private complainLine;
+    private embedderCaller;
+    private closeFd;
+    private openEmbedder;
     complain(line: string): Promise<boolean>;
     private clipboardComplaint;
     private write;

package/dist/types/launcher.d.ts

@@ -12,6 +12,11 @@ import type { KernelFs, UsersMode } from './fs/types.js';
 import { type UnlinkOwner } from './fs/unlinked.js';
 import { FsWatchers } from './fs/watch.js';
 import { type ClipboardHook } from './kernel/clipboard.js';
+import { EmbedderBroker, type EmbedderHook } from './kernel/embedder.js';
+type EmbedderSession = {
+    client: number;
+    uid: number;
+};
 import type { CpuTimes } from './kernel/cpu-clock.js';
 import { type Cred } from './kernel/cred.js';
 import { CwdTable } from './kernel/held-cwd.js';
@@ -65,6 +70,7 @@ export interface LauncherOptions {
     onDenial?: DenialHook;
     sealed?: SealedHook;
     clipboard?: ClipboardHook;
+    embedder?: EmbedderHook;
     approve?: ApproveHook;
     sudoTimeoutMs?: number;
     protect?: Protection;
@@ -101,6 +107,7 @@ export interface RunOptions {
     tags?: readonly string[];
     tagBase?: number;
     login?: boolean;
+    session?: number;
 }
 export interface TerminalOptions {
     cwd?: string;
@@ -111,6 +118,7 @@ export interface TerminalOptions {
     tag?: string;
     tags?: readonly string[];
     tagBase?: number;
+    session?: number;
     onData: (bytes: Uint8Array) => void;
 }
 export interface TerminalSession {
@@ -186,6 +194,7 @@ export declare class Launcher {
     private readonly described;
     private readonly creds;
     private readonly tags;
+    private readonly sessions;
     private readonly tagBases;
     private readonly links;
     private readonly freshModules;
@@ -243,6 +252,7 @@ export declare class Launcher {
     private readonly sealed;
     private readonly scrubs;
     private readonly clipboard;
+    readonly embedder: EmbedderBroker;
     private readonly rootFs;
     private fileWatches;
     private nextPid;
@@ -376,6 +386,9 @@ export declare class Launcher {
     private umaskOf;
     private imageOf;
     credOf(pid: number): Cred;
+    private wireSealed;
+    private embedderBroker;
+    sessionOf(pid: number): EmbedderSession;
     tagOf(pid: number): string | undefined;
     tagsOf(pid: number): readonly string[] | undefined;
     private wireDac;

package/dist/types/node.d.ts

@@ -7,6 +7,7 @@ import type { Protection } from './fs/protect.js';
 import { type UsersMode } from './fs/types.js';
 import type { ConnectOptions, KernelGroups, KernelIntegrity, KernelUsers, RunOptions, RunResult, Terminal, TerminalOptions } from './index.js';
 import type { ClipboardHook } from './kernel/clipboard.js';
+import { type EmbedderHook } from './kernel/embedder.js';
 import type { RouteTable } from './kernel/net/routes.js';
 import type { NetworkUplink } from './kernel/net/uplink.js';
 import type { SealedHook } from './kernel/sealed.js';
@@ -23,6 +24,7 @@ export type { FacadeConnection, FacadeHook, FacadeInfo, FacadeSpec, FacadeSpecs,
 export type { Denial, DenialHook } from './fs/dac.js';
 export type { ConnectOptions, Ended, KernelGroups, KernelIntegrity, KernelUsers, NetworkUplink, ResolveAnswer, ResolveFamily, RouteTable, RunOptions, RunResult, Terminal, TerminalOptions, TerminalSignal, } from './index.js';
 export type { ClipboardHook, ClipboardStamp } from './kernel/clipboard.js';
+export type { EmbedderHook, EmbedderKindPolicy, EmbedderReply, EmbedderRequest, EmbedderStamp, } from './kernel/embedder.js';
 export type { SealedAbortReason, SealedCaller, SealedHook, SealedRequest, } from './kernel/sealed.js';
 export type { ConnectorStamp } from './kernel/socket.js';
 export type { HostfsEvent, HostfsGrant, HostfsGrantHook, HostfsPortGrant, HostfsTransport, } from './mount/hostfs.js';
@@ -57,6 +59,7 @@ export interface NodeKernelOptions {
     onDenial?: DenialHook;
     sealed?: SealedHook;
     clipboard?: ClipboardHook;
+    requests?: EmbedderHook;
     approve?: ApproveHook;
     protect?: Protection;
     cron?: {

package/dist/types/process/kernel-streams.d.ts

@@ -64,6 +64,7 @@ export interface ProcessSys {
     openSealed?(flags: number): number;
     openClipboard?(flags: number): number;
     clipboardAbort?(fd: number): void;
+    openEmbedder?(flags: number): number;
     procList?(): ProcessListing;
     mountList?(): MountLine[];
 }
@@ -156,7 +157,7 @@ export declare class KernelStreams {
     socketStream(flags: number): ProcessStream;
     nameTerminal(stream: ProcessStream): void;
     private nameStream;
-    nameDevice(stream: ProcessStream, kind: 'sealed' | 'clipboard'): void;
+    nameDevice(stream: ProcessStream, kind: 'sealed' | 'clipboard' | 'embedder'): void;
     private listSealed;
     private openNode;
     private readonly reporting;

package/dist/types/process/wasi/wasi-fds.d.ts

@@ -28,6 +28,7 @@ export type WasiForkFd = {
 };
 export declare const SEALED_PATH = "/dev/sealed";
 export declare const CLIPBOARD_PATH = "/dev/clipboard";
+export declare const EMBEDDER_PATH = "/dev/embedder";
 export declare function deviceOf(path: string): Device | undefined;
 export declare class WasiFds {
     private readonly table;

package/dist/types/serve.d.ts

@@ -2,6 +2,7 @@ import { type LockManagerLike } from './client/protocol.js';
 import { type MetaStore } from './fs/meta.js';
 import { type ProtectInit } from './fs/protect.js';
 import { type UsersMode } from './fs/types.js';
+import type { EmbedderKindPolicy } from './kernel/embedder.js';
 import type { WasmWorkerLike } from './kernel/host.js';
 import type { RouteTable } from './kernel/net/routes.js';
 import type { RealmTransportTraits } from './kernel/net/transport.js';
@@ -42,6 +43,7 @@ export interface InitRequest {
     denials?: boolean;
     sealed?: boolean;
     clipboard?: boolean;
+    requests?: Record<string, EmbedderKindPolicy>;
     approve?: boolean;
     processMounts?: boolean | 'ask';
     cdp?: boolean;
@@ -85,6 +87,7 @@ export interface ConnectRequest {
     op: 'connect';
     user?: string | number;
     tag?: string;
+    requests?: Record<string, EmbedderKindPolicy> | 'attach';
 }
 export type UsersRequest = {
     id: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-kernel",
-  "version": "1.152.2",
+  "version": "1.153.0",
   "description": "SLICC's wasm-realm kernel: run Emscripten programs in the browser against OPFS, with fork, spawn, pipes and waitpid",
   "type": "module",
   "license": "Apache-2.0",
@@ -64,7 +64,7 @@
   },
   "devDependencies": {
     "@ai-ecoverse/py-numpy": "2.5.4-4",
-    "@ai-ecoverse/slicc-cdp": "1.39.1",
+    "@ai-ecoverse/slicc-cdp": "1.39.2",
     "@ai-ecoverse/slicc-node": "2.5.2",
     "@ai-ecoverse/slicc-scrub": "1.1.0",
     "@ai-ecoverse/slicc-shared-web": "2.11.3",