@ai-ecoverse/slicc-kernel 1.177.0 → 1.178.0

package/dist/process-worker.js

@@ -3180,7 +3180,7 @@ var init_version = __esm({
   "src/version.ts"() {
     "use strict";
     init_captured_globals();
-    KERNEL_VERSION = true ? "1.177.0" : "0.0.0-dev";
+    KERNEL_VERSION = true ? "1.178.0" : "0.0.0-dev";
     OS_RELEASE = "6.0.0-slicc";
   }
 });

package/dist/types/index.d.ts

@@ -30,6 +30,7 @@ export type { RouteTable } from './kernel/net/routes.js';
 export { SEALED_FETCH_VERSION, type SealedFetchHook, type SealedFetchRequest, type SealedOption, } from './kernel/net/sealed-fetch.js';
 export type { NetworkUplink, ResolveAnswer, ResolveFamily, UplinkTraits, } from './kernel/net/uplink.js';
 export type { SealedAbortReason, SealedCaller, SealedHook, SealedRequest, SealedRequester, } from './kernel/sealed.js';
+export type { SealedOAuthConfig, SealedOAuthError, SealedOAuthIdentity, SealedOAuthReply, SealedOAuthRequest, SealedOAuthState, SealedOAuthStatus, } from './kernel/sealed-oauth.js';
 export type { ConnectorStamp } from './kernel/socket.js';
 export type { HostfsEvent, HostfsGrant, HostfsGrantHook, HostfsPortGrant, HostfsTransport, } from './mount/hostfs.js';
 export { serveHostfsPort } from './mount/hostfs.js';

package/dist/types/kernel/sealed-oauth.d.ts

@@ -0,0 +1,74 @@
+export declare const SEALED_OAUTH_TIMEOUT_MS = 45000;
+export declare const SEALED_OAUTH_OPS: ReadonlySet<string>;
+export interface SealedOAuthIdentity {
+    name: string;
+    provider: string;
+    account: string;
+}
+export interface SealedOAuthConfig {
+    tokenUrl: string;
+    clientId: string;
+    authMethod: 'none';
+    scope?: string;
+    resource?: string;
+}
+export type SealedOAuthRequest = {
+    v: 1;
+} & ({
+    op: 'capabilities';
+} | (SealedOAuthIdentity & {
+    op: 'oauthGrant';
+    accessToken: string;
+    refreshToken?: string;
+    tokenType?: string;
+    expiresAt?: number;
+    oauth: SealedOAuthConfig;
+}) | (SealedOAuthIdentity & {
+    op: 'oauthStatus' | 'oauthRefresh' | 'oauthRemove';
+}));
+export type SealedOAuthState = 'ready' | 'refreshing' | 'expired' | 'reauth-required' | 'removed' | 'locked';
+export interface SealedOAuthStatus {
+    v: 1;
+    placeholder: string;
+    state: SealedOAuthState;
+    expiresAt: number | null;
+    refreshable: boolean;
+}
+declare const MESSAGES: {
+    readonly EINVAL: 'Invalid OAuth request';
+    readonly ENOENT: 'OAuth credential not found';
+    readonly EEXIST: 'OAuth credential identity conflicts';
+    readonly EACCES: 'OAuth operation refused';
+    readonly EAGAIN: 'OAuth credential changed; try again';
+    readonly ENOTSUP: 'OAuth operation is not supported';
+    readonly ENOTCONN: 'Vault is unavailable';
+    readonly ETIMEDOUT: 'Vault request timed out';
+    readonly EIO: 'Invalid vault reply';
+};
+declare const CAUSES: {
+    readonly 'vault-locked': 'Vault is locked';
+    readonly 'oauth-reauth-required': 'OAuth sign-in is required';
+    readonly 'oauth-refresh-failed': 'OAuth refresh failed';
+};
+export interface SealedOAuthError {
+    v: 1;
+    error: {
+        code: keyof typeof MESSAGES;
+        cause?: keyof typeof CAUSES;
+        message: string;
+    };
+}
+export type SealedOAuthReply = SealedOAuthStatus | {
+    v: 1;
+    removed: true;
+} | {
+    v: 1;
+    capabilities: {
+        kernelOAuth?: 1;
+    };
+} | SealedOAuthError;
+export declare function sealedOAuthOperation(op: string): boolean;
+export declare function validateSealedOAuth(req: Record<string, unknown>): void;
+export declare function sealedOAuthError(code?: keyof typeof MESSAGES, cause?: keyof typeof CAUSES): SealedOAuthError;
+export declare function sealedOAuthReply(op: string, value: unknown): SealedOAuthReply;
+export {};

package/dist/types/kernel/sealed.d.ts

@@ -89,6 +89,7 @@ export declare class SealedBroker {
     readonly tickets: TicketBook;
     readonly sessions: SessionScrubs;
     askTimeoutMs: number;
+    oauthTimeoutMs: number;
     userOf: (uid: number) => Promise<string | undefined>;
     factsOf: (pid: number) => Promise<SealedProcessFacts | undefined>;
     constructor(hook: SealedHook | undefined, users: UsersMode, timeoutMs?: number, tagOf?: (pid: number) => readonly string[] | undefined);

package/dist/types/node.d.ts

@@ -29,6 +29,7 @@ export type { ClipboardHook, ClipboardStamp } from './kernel/clipboard.js';
 export type { EmbedderHook, EmbedderKindPolicy, EmbedderReply, EmbedderRequest, EmbedderStamp, } from './kernel/embedder.js';
 export { SEALED_FETCH_VERSION, type SealedFetchHook, type SealedFetchRequest, type SealedOption, } from './kernel/net/sealed-fetch.js';
 export type { SealedAbortReason, SealedCaller, SealedHook, SealedRequest, SealedRequester, } from './kernel/sealed.js';
+export type { SealedOAuthConfig, SealedOAuthError, SealedOAuthIdentity, SealedOAuthReply, SealedOAuthRequest, SealedOAuthState, SealedOAuthStatus, } from './kernel/sealed-oauth.js';
 export type { ConnectorStamp } from './kernel/socket.js';
 export type { HostfsEvent, HostfsGrant, HostfsGrantHook, HostfsPortGrant, HostfsTransport, } from './mount/hostfs.js';
 export { serveHostfsPort } from './mount/hostfs.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-kernel",
-  "version": "1.177.0",
+  "version": "1.178.0",
   "description": "SLICC's wasm-realm kernel: run Emscripten programs in the browser against OPFS, with fork, spawn, pipes and waitpid",
   "type": "module",
   "license": "Apache-2.0",
@@ -70,7 +70,7 @@
   },
   "devDependencies": {
     "@ai-ecoverse/py-numpy": "2.5.4-4",
-    "@ai-ecoverse/slicc-cdp": "1.47.2",
+    "@ai-ecoverse/slicc-cdp": "1.47.4",
     "@ai-ecoverse/slicc-scrub": "1.1.0",
     "@ai-ecoverse/slicc-shared-web": "2.13.10",
     "@ai-ecoverse/wasi-cargo": "0.99.0-6",