@ai-ecoverse/slicc-kernel 1.170.4 → 1.172.0

package/dist/types/launcher.d.ts

@@ -5,7 +5,7 @@ import type { CronClock } from './cron/clock.js';
 import { CronService } from './cron/service.js';
 import { FacadeHosts } from './facade/hosts.js';
 import type { FacadeSpecs } from './facade/types.js';
-import { type Attestation } from './fs/attest.js';
+import { type Attestation, type AttestOptions, type AttestTombstone } from './fs/attest.js';
 import { Dac, type DenialHook } from './fs/dac.js';
 import { type Protection } from './fs/protect.js';
 import type { KernelFs, UsersMode } from './fs/types.js';
@@ -24,6 +24,7 @@ import { type WasmWorkerLike } from './kernel/host.js';
 import type { CaStore } from './kernel/net/realm-ca.js';
 import { Resolver } from './kernel/net/resolver.js';
 import { Routes, type RouteTable } from './kernel/net/routes.js';
+import { type SealedFetchHook } from './kernel/net/sealed-fetch.js';
 import type { RealmTransport } from './kernel/net/transport.js';
 import type { NetworkUplink } from './kernel/net/uplink.js';
 import { type ProcessInfo } from './kernel/proc-info.js';
@@ -69,6 +70,7 @@ export interface LauncherOptions {
     };
     onDenial?: DenialHook;
     sealed?: SealedHook;
+    sealedFetch?: SealedFetchHook;
     clipboard?: ClipboardHook;
     embedder?: EmbedderHook;
     approve?: ApproveHook;
@@ -255,6 +257,9 @@ export declare class Launcher {
     readonly usersMode: UsersMode;
     readonly dac: Dac | undefined;
     private readonly sealed;
+    private fill;
+    private readonly fills;
+    private placeholders;
     private readonly scrubs;
     private readonly clipboard;
     readonly embedder: EmbedderBroker;
@@ -350,6 +355,8 @@ export declare class Launcher {
     private packageRoots;
     private loadedUnder;
     groupSession(pgid: number): number | undefined;
+    private floored;
+    private httpFor;
     private loopbackFor;
     private sourceCheck;
     private treeScrubs;
@@ -387,6 +394,9 @@ export declare class Launcher {
     private childGroup;
     private undecided;
     connectorStamp(pid: number): Promise<SealedCaller>;
+    liveStamp(pid: number): Promise<SealedCaller | undefined>;
+    setPlaceholders(list: readonly string[]): void;
+    endFills(): void;
     private identityOf;
     private running;
     private decide;
@@ -416,7 +426,7 @@ export declare class Launcher {
     private driver;
     private fsaDriver;
     revokeIntegrity(path?: string): Promise<void>;
-    attest(path: string): Promise<Attestation>;
+    attest(path: string, options?: AttestOptions): Promise<Attestation | AttestTombstone>;
     private watchSource;
     watchFiles(paths: readonly string[], notify: (path: string) => void): Promise<() => void>;
     mount(spec: MountSpec): Promise<MountEntry>;

package/dist/types/node/follow.d.ts

@@ -0,0 +1,4 @@
+import type { RealmTransportRequest, RealmTransportResponse } from '../kernel/net/transport.js';
+type Send = (request: RealmTransportRequest) => Promise<RealmTransportResponse>;
+export declare function followRedirects(send: Send, request: RealmTransportRequest): Promise<RealmTransportResponse>;
+export {};

package/dist/types/node.d.ts

@@ -2,15 +2,16 @@ import { type MessagePort, type Worker } from 'node:worker_threads';
 import type { CdpHook } from './cdp/types.js';
 import type { CronClock } from './cron/clock.js';
 import type { FacadeSpecs } from './facade/types.js';
+import type { Attestation, AttestTombstone } from './fs/attest.js';
 import type { DenialHook } from './fs/dac.js';
 import type { Protection } from './fs/protect.js';
 import { type UsersMode } from './fs/types.js';
-import type { ConnectOptions, KernelGroups, KernelIntegrity, KernelUsers, RunOptions, RunResult, Terminal, TerminalOptions } from './index.js';
+import type { ConnectOptions, KernelGroups, KernelIntegrity, KernelSealed, KernelUsers, RunOptions, RunResult, Terminal, TerminalOptions } from './index.js';
 import type { ClipboardHook } from './kernel/clipboard.js';
 import { type EmbedderHook } from './kernel/embedder.js';
 import type { RouteTable } from './kernel/net/routes.js';
+import { type SealedOption } from './kernel/net/sealed-fetch.js';
 import type { NetworkUplink } from './kernel/net/uplink.js';
-import type { SealedHook } from './kernel/sealed.js';
 import type { FetchLike, HostfsGrantHook } from './mount/hostfs.js';
 import type { MountEntry, MountSpec } from './mount/mount-fs.js';
 import type { ProcessMountPolicy } from './mount/syscall.js';
@@ -21,16 +22,19 @@ import { type NetworkTransport } from './transport.js';
 export type { CdpConnection, CdpHook, CdpRequest } from './cdp/types.js';
 export { type AttachOptions, attachKernel, type ClientEnded, type ClientFetchRequest, type ClientFs, type ClientRunOptions, type ClientRunResult, type ClientTerminal, type ClientTerminalOptions, KernelCallError, type KernelClient, KernelGoneError, type ProcessEntry, type SpawnedProcess, type SpawnOptions, type WatchChange, } from './client/attach.js';
 export type { FacadeConnection, FacadeHook, FacadeInfo, FacadeSpec, FacadeSpecs, } from './facade/types.js';
+export type { Attestation, AttestedDir, AttestOptions, AttestTombstone } from './fs/attest.js';
 export type { Denial, DenialHook } from './fs/dac.js';
-export type { ConnectOptions, Ended, KernelGroups, KernelIntegrity, KernelUsers, NetworkUplink, ResolveAnswer, ResolveFamily, RouteTable, RunOptions, RunResult, Terminal, TerminalOptions, TerminalSignal, } from './index.js';
+export type { ConnectOptions, Ended, KernelGroups, KernelIntegrity, KernelSealed, KernelUsers, NetworkUplink, ResolveAnswer, ResolveFamily, RouteTable, RunOptions, RunResult, Terminal, TerminalOptions, TerminalSignal, } from './index.js';
 export type { ClipboardHook, ClipboardStamp } from './kernel/clipboard.js';
 export type { EmbedderHook, EmbedderKindPolicy, EmbedderReply, EmbedderRequest, EmbedderStamp, } from './kernel/embedder.js';
+export { SEALED_FETCH_VERSION, type SealedFetchHook, type SealedFetchRequest, type SealedOption, } from './kernel/net/sealed-fetch.js';
 export type { SealedAbortReason, SealedCaller, SealedHook, SealedRequest, } from './kernel/sealed.js';
 export type { ConnectorStamp } from './kernel/socket.js';
 export type { HostfsEvent, HostfsGrant, HostfsGrantHook, HostfsPortGrant, HostfsTransport, } from './mount/hostfs.js';
 export { serveHostfsPort } from './mount/hostfs.js';
 export type { MountEntry, MountSpec } from './mount/mount-fs.js';
 export type { ApproveHook, SudoAnswer, SudoRequest } from './sudo.js';
+export type { NetworkRedirectPolicy } from './transport.js';
 export { fetchTransport, type NetworkTransport } from './transport.js';
 export { memoryRoot };
 export interface NodeKernelOptions {
@@ -57,7 +61,7 @@ export interface NodeKernelOptions {
     hostname?: string;
     users?: UsersMode;
     onDenial?: DenialHook;
-    sealed?: SealedHook;
+    sealed?: SealedOption;
     clipboard?: ClipboardHook;
     requests?: EmbedderHook;
     approve?: ApproveHook;
@@ -83,6 +87,11 @@ export interface NodeKernel {
     readFile(path: string): Promise<Uint8Array>;
     chmod(path: string, mode: number): Promise<void>;
     readonly integrity: KernelIntegrity;
+    readonly sealed: KernelSealed;
+    attest(path: string): Promise<Attestation>;
+    attest(path: string, options: {
+        absent: 'allow';
+    }): Promise<Attestation | AttestTombstone>;
     connect(options?: ConnectOptions): Promise<MessagePort>;
     readonly users: KernelUsers;
     readonly groups: KernelGroups;

package/dist/types/sealed-relay.d.ts

@@ -1,6 +1,7 @@
+import { type SealedFetchHook, type SealedFetchRequest } from './kernel/net/sealed-fetch.js';
 import type { SealedHook, SealedRequest } from './kernel/sealed.js';
 export interface SealedPort {
-    postMessage(message: unknown): void;
+    postMessage(message: unknown, transfer?: Transferable[]): void;
 }
 export interface SealedAsk {
     id: number;
@@ -15,12 +16,21 @@ export interface SealedAbort {
     id: number;
     reason: unknown;
 }
+type WireRequest = Omit<SealedFetchRequest, 'bodyStream'> & {
+    streamed?: true;
+};
+export interface SealedFetchAsk {
+    req: WireRequest;
+    port: MessagePort;
+}
 export declare function sealedAsker(port: SealedPort): {
     hook: SealedHook;
+    fetch: SealedFetchHook;
     answer(reply: SealedReply): void;
 };
 export interface SealedAnswerer {
     handle(data: unknown): boolean;
     close(): void;
 }
-export declare function sealedAnswerer(port: SealedPort, hook: SealedHook | undefined): SealedAnswerer;
+export declare function sealedAnswerer(port: SealedPort, hook: SealedHook | undefined, fetchHook?: SealedFetchHook): SealedAnswerer;
+export {};

package/dist/types/serve.d.ts

@@ -1,4 +1,5 @@
 import { type LockManagerLike } from './client/protocol.js';
+import type { AttestOptions } from './fs/attest.js';
 import { type MetaStore } from './fs/meta.js';
 import { type ProtectInit } from './fs/protect.js';
 import { type UsersMode } from './fs/types.js';
@@ -42,6 +43,7 @@ export interface InitRequest {
     protect?: ProtectInit;
     denials?: boolean;
     sealed?: boolean;
+    sealedFetch?: boolean;
     clipboard?: boolean;
     requests?: Record<string, EmbedderKindPolicy>;
     approve?: boolean;
@@ -148,6 +150,7 @@ export type AttestRequest = {
     id: number;
     op: 'attest';
     path: string;
+    options?: AttestOptions;
 } | {
     id: number;
     op: 'chmod';
@@ -172,7 +175,11 @@ export interface FileChanged {
         path: string;
     };
 }
-export type KernelRequest = AttestRequest | InitRequest | RunRequest | OpenTerminalRequest | TerminalRequest | ConnectRequest | UsersRequest | MountRequest | DialRequest | RoutesRequest | TraitsRequest;
+export type KernelRequest = {
+    id: number;
+    op: 'sealed-placeholders';
+    list: readonly string[];
+} | AttestRequest | InitRequest | RunRequest | OpenTerminalRequest | TerminalRequest | ConnectRequest | UsersRequest | MountRequest | DialRequest | RoutesRequest | TraitsRequest;
 type WithoutId<T> = T extends unknown ? Omit<T, 'id'> : never;
 export type KernelCall = WithoutId<KernelRequest>;
 export declare function inOpfs(deps: ServeDeps, root: FileSystemDirectoryHandle): Promise<boolean>;

package/dist/types/testing.d.ts

@@ -1,7 +1,10 @@
 import type { RouteTable } from './kernel/net/routes.js';
 import { type NetworkUplink, type ResolveAnswer, type ResolveFamily, type UplinkConn, type UplinkDatagram, type UplinkDial, type UplinkMessage, type UplinkUdp, type UplinkUdpOpen, type UplinkUnreachable } from './kernel/net/uplink.js';
 export { type CronClock, type FakeCronClock, fakeCronClock } from './cron/clock.js';
+export { placeholderFloor } from './kernel/net/placeholder-floor.js';
+export { sealedFetcher } from './kernel/net/sealed-fetch.js';
 export { setTestSyscallHook, type TestSyscall, type TestSyscallHook, } from './kernel/test-hooks.js';
+export { sealedAnswerer, sealedAsker } from './sealed-relay.js';
 export type { NetworkUplink, ResolveAnswer, ResolveFamily, RouteTable, UplinkConn, UplinkDatagram, UplinkDial, UplinkMessage, UplinkUdp, UplinkUdpOpen, UplinkUnreachable, };
 export type FakeDatagramPeer = (bytes: Uint8Array) => Uint8Array | readonly Uint8Array[] | {
     error: string;

package/dist/types/transport.d.ts

@@ -1,7 +1,7 @@
 import type { TransportCall, TransportReply } from './kernel/net/remote-transport.js';
-import type { HeaderList, RealmRedirectHop, RealmTransport, RealmTransportExit, RealmTransportRequest, RealmTransportResponse, RealmTransportTraits, RealmWebSocket, RealmWebSocketRequest } from './kernel/net/transport.js';
+import type { HeaderList, RealmRedirectHop, RealmRedirectPolicy, RealmTransport, RealmTransportExit, RealmTransportRequest, RealmTransportResponse, RealmTransportTraits, RealmWebSocket, RealmWebSocketRequest } from './kernel/net/transport.js';
 import { type WebSocketConstructor } from './websocket-transport.js';
-export type { HeaderList, RealmRedirectHop as NetworkRedirectHop, RealmTransport as NetworkTransport, RealmTransportExit as NetworkExit, RealmTransportRequest as NetworkRequest, RealmTransportResponse as NetworkResponse, RealmTransportTraits as NetworkTraits, RealmWebSocket as NetworkWebSocket, RealmWebSocketRequest as NetworkWebSocketRequest, };
+export type { HeaderList, RealmRedirectHop as NetworkRedirectHop, RealmRedirectPolicy as NetworkRedirectPolicy, RealmTransport as NetworkTransport, RealmTransportExit as NetworkExit, RealmTransportRequest as NetworkRequest, RealmTransportResponse as NetworkResponse, RealmTransportTraits as NetworkTraits, RealmWebSocket as NetworkWebSocket, RealmWebSocketRequest as NetworkWebSocketRequest, };
 export interface FetchTransportOptions {
     fetch?: typeof globalThis.fetch;
     maxRequestBody?: number;
@@ -21,6 +21,7 @@ export interface TransportServer {
     answer(call: TransportCall): void;
     close(): void;
 }
-export declare function serveTransport(peer: TransportPeer, transport: RealmTransport, { closeWaitMs }?: {
+export declare function serveTransport(peer: TransportPeer, transport: RealmTransport, { closeWaitMs, attributed, }?: {
     closeWaitMs?: number;
+    attributed?: boolean;
 }): TransportServer;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-kernel",
-  "version": "1.170.4",
+  "version": "1.172.0",
   "description": "SLICC's wasm-realm kernel: run Emscripten programs in the browser against OPFS, with fork, spawn, pipes and waitpid",
   "type": "module",
   "license": "Apache-2.0",