@bytecodealliance/jco 1.33.0 → 1.34.0

package/lib/wit/builtin/jco-node-0.1.0/dgram.wit

@@ -0,0 +1,142 @@
+package jco:node@0.1.0;
+
+/// Explicit UDP capability. Guest-owned callbacks deliver DNS results, send
+/// completions and datagrams between component entry tasks. No Node objects,
+/// descriptors, or implicit networking authority cross this interface.
+interface dgram {
+    variant errno {
+        number(s64),
+        symbolic(string),
+    }
+
+    record buffer-error-info {
+        errno: f64,
+        code: string,
+        message: string,
+        syscall: string,
+    }
+
+    record error {
+        name: string,
+        message: string,
+        code: option<string>,
+        errno: option<errno>,
+        syscall: option<string>,
+        address: option<string>,
+        port: option<u16>,
+        info: option<buffer-error-info>,
+    }
+
+    enum socket-type {
+        udp4,
+        udp6,
+    }
+
+    record options {
+        %type: socket-type,
+        reuse-addr: bool,
+        reuse-port: bool,
+        ipv6-only: bool,
+    }
+
+    record address-info {
+        address: string,
+        family: string,
+        port: u16,
+    }
+
+    variant socket-option {
+        broadcast(bool),
+        multicast-loopback(bool),
+        ttl(f64),
+        multicast-ttl(f64),
+        recv-buffer(u32),
+        send-buffer(u32),
+        multicast-interface(string),
+    }
+
+    enum socket-query {
+        recv-buffer,
+        send-buffer,
+        send-queue-size,
+        send-queue-count,
+    }
+
+    enum membership-action {
+        add,
+        drop,
+        add-source,
+        drop-source,
+    }
+
+    create-socket: func(options: options, listener: u32) -> result<socket, error>;
+
+    resource socket {
+        /// Bind/connect only accept resolved addresses and complete synchronously.
+        bind: func(address: string, port: u16) -> result<address-info, error>;
+
+        connect: func(address: string, port: u16) -> result<_, error>;
+
+        disconnect: func() -> result<_, error>;
+
+        resolve: func(address: string, id: u32);
+
+        send: func(
+            data: list<u8>,
+            port: option<u16>,
+            address: option<string>,
+            callback: option<u32>,
+        ) -> result<_, error>;
+
+        address: func(remote: bool) -> result<address-info, error>;
+
+        set-option: func(%option: socket-option) -> result<_, error>;
+
+        query: func(query: socket-query) -> result<f64, error>;
+
+        membership: func(
+            action: membership-action,
+            group: string,
+            source: option<string>,
+            iface: option<string>,
+        ) -> result<_, error>;
+
+        close: func();
+
+        set-ref: func(%ref: bool);
+    }
+}
+
+/// Each component instance owns and redeems its listeners. Providers must serialize
+/// callback entry and drops, never re-enter while a guest import is on the stack.
+interface dgram-callbacks {
+    use dgram.{error, address-info};
+
+    record message {
+        data: list<u8>,
+        remote: address-info,
+    }
+
+    record resolved {
+        id: u32,
+        %result: result<string, error>,
+    }
+
+    record sent {
+        id: u32,
+        %result: result<u32, error>,
+    }
+
+    variant socket-event {
+        message(message),
+        error(error),
+        resolved(resolved),
+        sent(sent),
+    }
+
+    resource socket-listener {
+        event: func(event: socket-event);
+    }
+
+    take-socket-listener: func(id: u32) -> option<socket-listener>;
+}

package/lib/wit/builtin/jco-node-0.1.0/http.wit

@@ -81,6 +81,8 @@ interface http {
     connect-timeout-ms: option<u32>,
     first-byte-timeout-ms: option<u32>,
     between-bytes-timeout-ms: option<u32>,
+    /// Set only for `https` requests that carry TLS options.
+    tls: option<tls-options>,
   }
 
   record response {
@@ -91,6 +93,9 @@ interface http {
     body: list<u8>,
   }
 
+  /// Configuration issued by the same jco:node/tls provider bound to this HTTP host.
+  record tls-options { context-id: u32 }
+
   record server-options {
     request-timeout: option<u32>,
     headers-timeout: option<u32>,
@@ -105,6 +110,8 @@ interface http {
     keep-alive-initial-delay: option<u32>,
     reject-non-standard-body-writes: option<bool>,
     optimize-empty-requests: option<bool>,
+    /// Present for every `node:https` server, even when empty: the host terminates TLS.
+    tls: option<tls-options>,
   }
 
   record listen-options {

package/lib/wit/builtin/jco-node-0.1.0/http2.wit

@@ -32,6 +32,7 @@ interface http2-callbacks {
 
   record outgoing-response {
     headers: list<header>,
+    trailers: list<header>,
     body: list<u8>,
   }
 
@@ -89,9 +90,8 @@ interface http2 {
 
   record client-options {
     settings: http2-settings,
-    reject-unauthorized: option<bool>,
-    server-name: option<string>,
-    ca: option<list<u8>>,
+    /// One-use configuration issued by the shared jco:node/tls provider.
+    tls-context: option<u32>,
   }
 
   record request-options {
@@ -126,8 +126,7 @@ interface http2 {
 
   record server-options {
     secure: bool,
-    key: option<list<u8>>,
-    cert: option<list<u8>>,
+    tls-context: option<u32>,
     settings: http2-settings,
     allow-http1: option<bool>,
     strict-field-whitespace-validation: option<bool>,

package/lib/wit/builtin/jco-node-0.1.0/process.wit

@@ -0,0 +1,245 @@
+package jco:node@0.1.0;
+
+/// Explicit access to the embedding process. No capability is granted by default.
+/// The Node provider affects the embedding Node process, not a virtual WASI process.
+interface process {
+  variant errno {
+    number(s64),
+    symbolic(string)
+  }
+
+  record error {
+    name: string,
+    message: string,
+    code: option<string>,
+    errno: option<errno>,
+    syscall: option<string>,
+    path: option<string>
+  }
+
+  record process-metadata {
+    arch: string,
+    platform: string,
+    pid: u32,
+    ppid: u32,
+    argv: list<string>,
+    argv0: string,
+    exec-argv: list<string>,
+    exec-path: string,
+    version: string,
+    versions: list<tuple<string, string>>,
+    release-json: string,
+    config-json: string,
+    features-json: string,
+    has-permission: bool,
+  }
+
+  enum flag {
+    no-deprecation,
+    throw-deprecation,
+    trace-deprecation,
+    trace-process-warnings
+  }
+
+  variant exit-code {
+    number(f64),
+    text(string)
+  }
+
+  record state {
+    title: string,
+    debug-port: f64,
+    exit-code: option<exit-code>,
+    no-deprecation: option<bool>,
+    throw-deprecation: option<bool>,
+    trace-deprecation: option<bool>,
+    trace-process-warnings: option<bool>,
+    source-maps-enabled: bool,
+    connected: option<bool>,
+  }
+
+  enum identity {
+    uid,
+    euid,
+    gid,
+    egid
+  }
+
+  variant id {
+    number(u32),
+    name(string)
+  }
+
+  variant signal {
+    number(s32),
+    name(string)
+  }
+
+  variant mask {
+    number(u32),
+    text(string)
+  }
+
+  variant path {
+    text(string),
+    url(string),
+    bytes(list<u8>)
+  }
+
+  record warning {
+    name: string,
+    message: string,
+    stack: option<string>,
+    code: option<string>,
+    detail: option<string>
+  }
+
+  record report-options {
+    compact: bool,
+    directory: string,
+    filename: string,
+    signal: string,
+    report-on-fatal-error: bool,
+    report-on-signal: bool,
+    report-on-uncaught-exception: bool,
+    exclude-env: bool,
+    exclude-network: bool,
+  }
+
+  enum report-option {
+    compact,
+    directory,
+    filename,
+    signal,
+    report-on-fatal-error,
+    report-on-signal,
+    report-on-uncaught-exception,
+    exclude-env,
+    exclude-network
+  }
+
+  variant report-value {
+    boolean(bool),
+    text(string)
+  }
+
+  record cpu-usage-record {
+    user: f64,
+    system: f64
+  }
+
+  record memory-usage-record {
+    rss: f64,
+    heap-total: f64,
+    heap-used: f64,
+    external: f64,
+    array-buffers: f64
+  }
+
+  record resource-usage-record {
+    user-cpu-time: f64,
+    system-cpu-time: f64,
+    max-rss: f64,
+    shared-memory-size: f64,
+    unshared-data-size: f64,
+    unshared-stack-size: f64,
+    minor-page-fault: f64,
+    major-page-fault: f64,
+    swapped-out: f64,
+    fs-read: f64,
+    fs-write: f64,
+    ipc-sent: f64,
+    ipc-received: f64,
+    signals-count: f64,
+    voluntary-context-switches: f64,
+    involuntary-context-switches: f64
+  }
+
+  metadata: func() -> result<process-metadata, error>;
+
+  get-state: func() -> result<state, error>;
+
+  set-title: func(value: string) -> result<_, error>;
+
+  set-debug-port: func(value: f64) -> result<_, error>;
+
+  set-exit-code: func(value: option<exit-code>) -> result<_, error>;
+
+  set-flag: func(name: flag, value: bool) -> result<_, error>;
+
+  env-entries: func() -> result<list<tuple<string, string>>, error>;
+
+  env-get: func(name: string) -> result<option<string>, error>;
+
+  env-set: func(name: string, value: option<string>) -> result<_, error>;
+
+  cwd: func() -> result<string, error>;
+
+  chdir: func(directory: string) -> result<_, error>;
+
+  cpu-usage: func(previous: option<cpu-usage-record>) -> result<cpu-usage-record, error>;
+
+  thread-cpu-usage: func(previous: option<cpu-usage-record>) -> result<cpu-usage-record, error>;
+
+  memory-usage: func() -> result<memory-usage-record, error>;
+
+  rss: func() -> result<f64, error>;
+
+  resource-usage: func() -> result<resource-usage-record, error>;
+
+  /// Split the clock to avoid engines that lift WIT u64 as an imprecise JS number.
+  record clock-time {
+    seconds: f64,
+    nanoseconds: u32
+  }
+
+  hrtime: func() -> result<clock-time, error>;
+
+  uptime: func() -> result<f64, error>;
+
+  available-memory: func() -> result<f64, error>;
+
+  constrained-memory: func() -> result<f64, error>;
+
+  get-active-resources-info: func() -> result<list<string>, error>;
+
+  get-id: func(kind: identity) -> result<u32, error>;
+
+  set-id: func(kind: identity, value: id) -> result<_, error>;
+
+  getgroups: func() -> result<list<u32>, error>;
+
+  setgroups: func(groups: list<id>) -> result<_, error>;
+
+  initgroups: func(user: id, extra-group: id) -> result<_, error>;
+
+  kill: func(pid: s32, signal: signal) -> result<bool, error>;
+
+  umask: func(mask: mask) -> result<u32, error>;
+
+  exit: func(code: option<exit-code>) -> result<_, error>;
+
+  abort: func() -> result<_, error>;
+
+  execve: func(file: string, args: list<string>, env: option<list<tuple<string, string>>>) -> result<_, error>;
+
+  load-env-file: func(path: option<path>) -> result<_, error>;
+
+  set-source-maps-enabled: func(value: bool) -> result<_, error>;
+
+  emit-warning: func(warning: warning) -> result<_, error>;
+
+  permission-has: func(scope: string, reference: option<path>) -> result<bool, error>;
+
+  get-report: func(error: option<warning>) -> result<string, error>;
+
+  write-report: func(filename: option<string>, error: option<warning>) -> result<string, error>;
+
+  get-report-options: func() -> result<report-options, error>;
+
+  set-report-option: func(name: report-option, value: report-value) -> result<_, error>;
+
+  allowed-flags: func() -> result<list<string>, error>;
+
+  allowed-flag: func(value: string) -> result<bool, error>;
+}

package/lib/wit/builtin/jco-node-0.1.0/sqlite.wit

@@ -0,0 +1,154 @@
+package jco:node@0.1.0;
+
+/// Explicit SQLite capability for Node-compatible synchronous database operations.
+/// The default provider denies access, including :memory:. Mapping a provider grants
+/// its database/file/extension authority; the guest's WASI filesystem is unrelated.
+/// No callbacks may re-enter the guest while a synchronous SQL import is active.
+interface sqlite {
+  record error {
+    name: string,
+    message: string,
+    code: option<string>,
+    errcode: option<s32>,
+    errstr: option<string>,
+  }
+
+  variant path { text(string), bytes(list<u8>), url(string) }
+
+  /// Numbers and bigints stay distinct; blobs are copied across the boundary.
+  variant value { null, number(f64), bigint(s64), text(string), blob(list<u8>) }
+
+  variant row { object(list<tuple<string, value>>), array(list<value>) }
+
+  record bindings { named: option<list<tuple<string, value>>>, positional: list<value> }
+
+  record changes { changes: value, last-insert-rowid: value }
+
+  record column {
+    column: option<string>, database: option<string>, name: string,
+    table: option<string>, %type: option<string>,
+  }
+
+  enum limit-name {
+    length, sql-length, column, expr-depth, compound-select, vdbe-op,
+    function-arg, attach, like-pattern-length, variable-number, trigger-depth,
+  }
+
+  record statement-options {
+    read-big-ints: option<bool>, return-arrays: option<bool>,
+    allow-bare-named-parameters: option<bool>, allow-unknown-named-parameters: option<bool>,
+  }
+
+  record database-options {
+    open: option<bool>, read-only: option<bool>,
+    enable-foreign-key-constraints: option<bool>, enable-double-quoted-string-literals: option<bool>,
+    allow-extension: option<bool>, timeout: option<f64>, defensive: option<bool>,
+    statement: statement-options, limits: list<tuple<limit-name, f64>>,
+  }
+
+  record session-options { table: option<string>, db: option<string> }
+
+  record backup-options { source: option<string>, target: option<string>, rate: option<f64> }
+
+  /// Creates a connection wrapper, possibly unopened. Native failures preserve error fields.
+  open-database: func(path: path, options: database-options) -> result<database, error>;
+
+  /// Asynchronous Node backup: map this import with JSPI. Borrow retains the source
+  /// for the whole backup; no callback or implicit access to the guest filesystem.
+  backup: func(source: borrow<database>, path: path, options: backup-options) -> result<f64, error>;
+
+  /// Drop closes the connection. close/open preserve the wrapper for explicit reopening.
+  resource database {
+    open: func() -> result<_, error>;
+
+    close: func() -> result<_, error>;
+
+    is-open: func() -> result<bool, error>;
+
+    is-transaction: func() -> result<bool, error>;
+
+    exec: func(sql: string) -> result<_, error>;
+
+    prepare: func(sql: string, options: statement-options) -> result<statement, error>;
+
+    location: func(db-name: option<string>) -> result<option<string>, error>;
+
+    get-limit: func(name: limit-name) -> result<f64, error>;
+
+    set-limit: func(name: limit-name, value: f64) -> result<_, error>;
+
+    serialize: func(db-name: option<string>) -> result<list<u8>, error>;
+
+    deserialize: func(bytes: list<u8>, db-name: option<string>) -> result<_, error>;
+
+    create-session: func(options: session-options) -> result<session, error>;
+
+    apply-changeset: func(bytes: list<u8>) -> result<bool, error>;
+
+    create-tag-store: func(capacity: f64) -> result<tag-store, error>;
+
+    enable-load-extension: func(allow: bool) -> result<_, error>;
+
+    enable-defensive: func(active: bool) -> result<_, error>;
+
+    load-extension: func(path: string, entry-point: option<string>) -> result<_, error>;
+  }
+
+  /// Drop releases the reference to the native statement. Database close/deserialize
+  /// invalidates every statement as in Node. No SQL or row materialization on drop.
+  resource statement {
+    all: func(parameters: bindings) -> result<list<row>, error>;
+
+    get: func(parameters: bindings) -> result<option<row>, error>;
+
+    run: func(parameters: bindings) -> result<changes, error>;
+
+    iterate: func(parameters: bindings) -> result<cursor, error>;
+
+    columns: func() -> result<list<column>, error>;
+
+    source-sql: func() -> result<string, error>;
+
+    expanded-sql: func() -> result<string, error>;
+
+    set-read-big-ints: func(enabled: bool) -> result<_, error>;
+
+    set-return-arrays: func(enabled: bool) -> result<_, error>;
+
+    set-allow-bare-named-parameters: func(enabled: bool) -> result<_, error>;
+
+    set-allow-unknown-named-parameters: func(enabled: bool) -> result<_, error>;
+  }
+
+  /// next steps exactly once. close and drop invoke iterator.return to release locks.
+  resource cursor {
+    next: func() -> result<option<row>, error>;
+
+    close: func() -> result<_, error>;
+  }
+
+  resource session {
+    changeset: func() -> result<list<u8>, error>;
+
+    patchset: func() -> result<list<u8>, error>;
+
+    close: func() -> result<_, error>;
+  }
+
+  /// Tagged SQL uses separate template strings and bound values, never concatenated values.
+  resource tag-store {
+    all: func(parts: list<string>, parameters: list<value>) -> result<list<row>, error>;
+
+    get: func(parts: list<string>, parameters: list<value>) -> result<option<row>, error>;
+
+    run: func(parts: list<string>, parameters: list<value>) -> result<changes, error>;
+
+    iterate: func(parts: list<string>, parameters: list<value>) -> result<cursor, error>;
+
+    size: func() -> result<f64, error>;
+
+    capacity: func() -> result<f64, error>;
+
+    clear: func() -> result<_, error>;
+  }
+}

package/lib/wit/builtin/jco-node-0.1.0/tls.wit

@@ -0,0 +1,108 @@
+package jco:node@0.1.0;
+
+/// Events are delivered after the initiating import returns, avoiding component reentrance.
+interface tls-callbacks {
+  record event {
+    target: u32,
+    name: string,
+    value: string,
+    data: list<u8>,
+  }
+
+  dispatch: func(event: event);
+}
+
+/// Primary TLS capability for Node APIs. Providers may delegate to wasi:tls.
+interface tls {
+  use wasi:io/streams@0.2.12.{input-stream, output-stream};
+  use wasi:tls/types@0.2.0-draft.{future-client-streams};
+
+  /// Optional TLS upgrade over existing WASI streams. Ownership passes to the provider.
+  is-available: func() -> bool;
+
+  start-tls: func(server-name: string, input: input-stream, output: output-stream) -> future-client-streams;
+
+  record error {
+    name: string,
+    message: string,
+    code: option<string>,
+  }
+
+  enum query-operation {
+    ciphers,
+    compression-algorithms,
+    ca-certificates,
+    check-identity,
+  }
+
+  enum socket-operation-kind {
+    state,
+    address,
+    certificate,
+    peer-certificate,
+    cipher,
+    ephemeral-key-info,
+    finished,
+    peer-finished,
+    protocol,
+    session,
+    shared-sigalgs,
+    tls-ticket,
+    session-reused,
+    export-keying-material,
+    disable-renegotiation,
+    enable-trace,
+    max-send-fragment,
+    key-cert,
+    timeout,
+    no-delay,
+    keep-alive,
+    ref,
+    unref,
+    resume,
+    pause,
+    destroy,
+    renegotiate,
+    set-session,
+    set-servername,
+  }
+
+  enum server-operation-kind {
+    state,
+    address,
+    listen,
+    close,
+    connections,
+    ref,
+    unref,
+    ticket-keys,
+    set-ticket-keys,
+    secure-context,
+    add-context,
+    max-connections,
+    drop-max-connection,
+  }
+
+  /// Options and inspection values use the documented TLS graph-data encoding.
+  query: func(operation: query-operation, args: string) -> result<string, error>;
+
+  set-default-ca: func(certs: string) -> result<_, error>;
+
+  create-context: func(options: string) -> result<u32, error>;
+
+  release-context: func(id: u32);
+
+  connect: func(id: u32, options: string) -> result<_, error>;
+
+  create-server: func(id: u32, options: string) -> result<_, error>;
+
+  socket-operation: func(id: u32, operation: socket-operation-kind, args: string) -> result<string, error>;
+
+  server-operation: func(id: u32, operation: server-operation-kind, args: string) -> result<string, error>;
+
+  write: func(id: u32, token: u32, data: list<u8>) -> result<_, error>;
+
+  end: func(id: u32, token: u32) -> result<_, error>;
+
+  release: func(id: u32);
+}