@ai-ecoverse/slicc-kernel 1.52.0 → 1.53.1

package/dist/node-process-worker.js

@@ -42,19 +42,35 @@ function hide(target, names) {
     }
   }
 }
+function vacate(target, names) {
+  for (const name2 of names) {
+    for (let at = target; at && at !== Object.prototype; ) {
+      if (Object.getOwnPropertyDescriptor(at, name2)?.configurable) Reflect.deleteProperty(at, name2);
+      at = Object.getPrototypeOf(at);
+    }
+    Reflect.defineProperty(target, name2, {
+      value: void 0,
+      writable: true,
+      enumerable: false,
+      configurable: true
+    });
+    if (Reflect.get(target, name2) !== void 0) {
+      throw new Error(`slicc-kernel: cannot withhold ${name2} from a JS program`);
+    }
+  }
+}
 function lockdown(scope2 = globalThis) {
   hide(scope2, BLOCKED_GLOBALS);
+  vacate(scope2, OPEN_SLOTS);
   const navigator = scope2.navigator;
   if (navigator && typeof navigator === "object") hide(navigator, BLOCKED_NAVIGATOR);
 }
-var BLOCKED_GLOBALS, BLOCKED_NAVIGATOR;
+var BLOCKED_GLOBALS, BLOCKED_NAVIGATOR, OPEN_SLOTS;
 var init_lockdown = __esm({
   "src/process/js/lockdown.ts"() {
     "use strict";
     BLOCKED_GLOBALS = [
-      "fetch",
       "XMLHttpRequest",
-      "WebSocket",
       "WebSocketStream",
       "WebTransport",
       "EventSource",
@@ -69,6 +85,7 @@ var init_lockdown = __esm({
       "close"
     ];
     BLOCKED_NAVIGATOR = ["storage", "locks", "serviceWorker"];
+    OPEN_SLOTS = ["fetch", "WebSocket"];
   }
 });
 
@@ -8044,8 +8061,11 @@ var init_procfs = __esm({
 });
 
 // src/process/realm-user.ts
-function ownByCaller(Fs, cred) {
-  const owner = { uid: cred?.euid ?? 0, gid: cred?.egid ?? 0 };
+function credAbi(glue) {
+  return CRED_ABI.test(glue);
+}
+function ownByCaller(Fs, cred, abi = true) {
+  const owner = abi ? { uid: cred?.euid ?? 0, gid: cred?.egid ?? 0 } : { ...LEGACY_OWNER };
   const { stat, fstat } = Fs;
   const owned = (attr2) => ({ ...attr2, uid: owner.uid, gid: owner.gid });
   if (typeof stat === "function") {
@@ -8054,9 +8074,12 @@ function ownByCaller(Fs, cred) {
   if (typeof fstat === "function") Fs.fstat = (fd) => owned(fstat.call(Fs, fd));
   return owner;
 }
+var LEGACY_OWNER, CRED_ABI;
 var init_realm_user = __esm({
   "src/process/realm-user.ts"() {
     "use strict";
+    LEGACY_OWNER = Object.freeze({ uid: 1e3, gid: 1e3 });
+    CRED_ABI = /\bslicc_cred_js\b/;
   }
 });
 
@@ -8425,7 +8448,7 @@ async function runWasmProcess(init, port3, deps = {}) {
     describeFork: () => describeForFork(running.FS, sys, streams, livePath),
     inherit: (actions) => describeInherited(running.FS, sys, streams, livePath, actions),
     stdioPromoter: () => vfsPromoter(running.FS, sys, streams, livePath),
-    owner: ownByCaller(running.FS, init.cred)
+    owner: ownByCaller(running.FS, init.cred, credAbi(init.program.glue))
   });
   running.sliccKernel.http = createHttpKernel(transport);
   running.sliccKernel.hostname = hostnameOf(init.env);
@@ -11302,23 +11325,6 @@ var NODE_SLOTS = [
   "setImmediate",
   "clearImmediate"
 ];
-function vacate(target, names) {
-  for (const name2 of names) {
-    for (let at = target; at && at !== Object.prototype; ) {
-      if (Object.getOwnPropertyDescriptor(at, name2)?.configurable) Reflect.deleteProperty(at, name2);
-      at = Object.getPrototypeOf(at);
-    }
-    Reflect.defineProperty(target, name2, {
-      value: void 0,
-      writable: true,
-      enumerable: false,
-      configurable: true
-    });
-    if (Reflect.get(target, name2) !== void 0) {
-      throw new Error(`slicc-kernel: cannot withhold ${name2} from a JS program`);
-    }
-  }
-}
 function refused(specifier) {
   return Object.assign(new Error(`slicc-kernel: a JS program cannot import ${specifier}`), {
     code: "ERR_ACCESS_DENIED"