@secure-exec/core 0.2.0-rc.1 → 0.2.0-rc.2

package/dist/isolate-runtime/setup-dynamic-import.js

@@ -31,6 +31,7 @@
   var __dynamicImportConfig = globalThis.__runtimeDynamicImportConfig ?? {};
   var __fallbackReferrer = typeof __dynamicImportConfig.referrerPath === "string" && __dynamicImportConfig.referrerPath.length > 0 ? __dynamicImportConfig.referrerPath : "/";
   var __dynamicImportCache = /* @__PURE__ */ new Map();
+  var __pathToFileURL = typeof globalThis.require === "function" ? globalThis.require("node:url").pathToFileURL ?? null : null;
   var __resolveDynamicImportPath = function(request, referrer) {
     if (!request.startsWith("./") && !request.startsWith("../") && !request.startsWith("/")) {
       return request;
@@ -88,5 +89,35 @@
     __dynamicImportCache.set(cacheKey, namespaceFallback);
     return Promise.resolve(namespaceFallback);
   };
+  var __importMetaResolveHandler = function(specifier, fromPath) {
+    const request = String(specifier);
+    const referrer = typeof fromPath === "string" && fromPath.length > 0 ? fromPath : __fallbackReferrer;
+    let resolved = null;
+    if (typeof globalThis._resolveModuleSync !== "undefined") {
+      resolved = globalThis._resolveModuleSync.applySync(
+        void 0,
+        [request, referrer, "import"]
+      );
+    }
+    if (resolved === null || resolved === void 0) {
+      resolved = globalThis._resolveModule.applySyncPromise(
+        void 0,
+        [request, referrer, "import"]
+      );
+    }
+    if (resolved === null) {
+      const err = new Error("Cannot find module '" + request + "'");
+      err.code = "MODULE_NOT_FOUND";
+      throw err;
+    }
+    if (resolved.startsWith("node:")) {
+      return resolved;
+    }
+    if (__pathToFileURL && resolved.startsWith("/")) {
+      return __pathToFileURL(resolved).href;
+    }
+    return resolved;
+  };
   __runtimeExposeCustomGlobal("__dynamicImport", __dynamicImportHandler);
+  __runtimeExposeCustomGlobal("__importMetaResolve", __importMetaResolveHandler);
 })();

package/dist/kernel/file-lock.js

@@ -12,7 +12,6 @@ export const LOCK_SH = 1;
 export const LOCK_EX = 2;
 export const LOCK_UN = 8;
 export const LOCK_NB = 4;
-const FLOCK_WAIT_TIMEOUT_MS = 30_000;
 export class FileLockManager {
     /** path -> lock state */
     locks = new Map();
@@ -40,8 +39,8 @@ export class FileLockManager {
             if (nonBlocking) {
                 throw new KernelError("EAGAIN", "resource temporarily unavailable");
             }
-            // Bound each wait so callers can re-check lock state without hanging forever.
-            const handle = state.waiters.enqueue(FLOCK_WAIT_TIMEOUT_MS);
+            // Wait indefinitely until an unlock wakes this waiter.
+            const handle = state.waiters.enqueue();
             try {
                 await handle.wait();
             }

package/dist/kernel/kernel.js

@@ -80,8 +80,10 @@ class KernelImpl {
         this.userManager = new UserManager();
         this.socketTable = new SocketTable({
             vfs: this.vfs,
+            networkCheck: options.permissions?.network,
             hostAdapter: options.hostNetworkAdapter,
             getSignalState: (pid) => this.processTable.getSignalState(pid),
+            processExists: (pid) => this.processTable.get(pid) !== undefined,
         });
         this.timerTable = new TimerTable();
         // Clean up FD table and sockets when a process exits
@@ -387,16 +389,11 @@ class KernelImpl {
             const outputHandler = options?.onData
                 ?? ((data) => { stdout.write(data); });
             shell.onData = outputHandler;
-            // Handle terminal resize
-            onResize = () => {
-                shell.resize(stdout.columns || 80, stdout.rows || 24);
-            };
-            if (stdout.isTTY)
-                stdout.on("resize", onResize);
-            // Set initial terminal size
-            if (stdout.isTTY) {
-                shell.resize(stdout.columns || 80, stdout.rows || 24);
-            }
+            // PTY resize forwarding is currently unsafe for Wasm shell sessions:
+            // an early resize can terminate the shell before the first prompt.
+            // Keep interactive stdin/stdout working and leave resize disabled
+            // until the PTY/SIGWINCH path is fixed end-to-end.
+            onResize = undefined;
             return await shell.wait();
         }
         finally {

package/dist/kernel/socket-table.d.ts

@@ -93,6 +93,7 @@ export declare class SocketTable {
     private readonly hostAdapter?;
     private readonly vfs?;
     private readonly getSignalState?;
+    private readonly processExists?;
     /** Bound/listening address → socket ID. Used for EADDRINUSE and TCP routing. */
     private listeners;
     /** Bound UDP address → socket ID. Separate from TCP listeners. */
@@ -103,7 +104,9 @@ export declare class SocketTable {
         hostAdapter?: HostNetworkAdapter;
         vfs?: VirtualFileSystem;
         getSignalState?: (pid: number) => ProcessSignalState;
+        processExists?: (pid: number) => boolean;
     });
+    hasHostNetworkAdapter(): boolean;
     /**
      * Create a new socket owned by the given process.
      * Returns the kernel socket ID.
@@ -279,6 +282,10 @@ export declare class SocketTable {
     private startAcceptPump;
     /** Look up a listening socket by exact address key. */
     private getListeningSocket;
+    /** Replay stored socket options onto a host-backed connection. */
+    private applySocketOptionsToHostSocket;
+    /** Best-effort option forwarding for host-backed sockets. */
+    private applySocketOptionToHostSocket;
     /** Peek up to maxBytes from a socket's readBuffer without consuming. */
     private peekFromBuffer;
     /** Consume up to maxBytes from a socket's readBuffer. */

package/dist/kernel/socket-table.js

@@ -68,6 +68,7 @@ export class SocketTable {
     hostAdapter;
     vfs;
     getSignalState;
+    processExists;
     /** Bound/listening address → socket ID. Used for EADDRINUSE and TCP routing. */
     listeners = new Map();
     /** Bound UDP address → socket ID. Separate from TCP listeners. */
@@ -78,6 +79,10 @@ export class SocketTable {
         this.hostAdapter = options?.hostAdapter;
         this.vfs = options?.vfs;
         this.getSignalState = options?.getSignalState;
+        this.processExists = options?.processExists;
+    }
+    hasHostNetworkAdapter() {
+        return this.hostAdapter !== undefined;
     }
     /**
      * Create a new socket owned by the given process.
@@ -87,6 +92,9 @@ export class SocketTable {
         if (this.sockets.size >= this.maxSockets) {
             throw new KernelError("EMFILE", "too many open sockets");
         }
+        if (this.processExists && !this.processExists(pid)) {
+            throw new KernelError("ESRCH", `cannot create socket for unknown pid ${pid}`);
+        }
         const id = this.nextSocketId++;
         const socket = {
             id,
@@ -196,19 +204,26 @@ export class SocketTable {
             throw new KernelError("EINVAL", "socket must be bound before listen");
         }
         socket.backlogLimit = Math.max(0, backlogSize);
-        // Permission check for listen
-        if (this.networkCheck) {
+        // AF_UNIX listeners stay entirely in-kernel, so host-network policy
+        // only applies to inet listeners.
+        if (socket.localAddr && isInetAddr(socket.localAddr)) {
             this.checkNetworkPermission("listen", socket.localAddr);
         }
         // External listen — delegate to host adapter
-        if (options?.external && this.hostAdapter && socket.localAddr && isInetAddr(socket.localAddr)) {
+        if (options?.external &&
+            this.hostAdapter &&
+            socket.localAddr &&
+            isInetAddr(socket.localAddr)) {
             const hostListener = await this.hostAdapter.tcpListen(socket.localAddr.host, socket.requestedEphemeralPort ? 0 : socket.localAddr.port);
             socket.hostListener = hostListener;
             socket.external = true;
             // Update port for ephemeral (port 0) bindings
             if (socket.requestedEphemeralPort || socket.localAddr.port === 0) {
                 const oldKey = addrKey(socket.localAddr);
-                socket.localAddr = { host: socket.localAddr.host, port: hostListener.port };
+                socket.localAddr = {
+                    host: socket.localAddr.host,
+                    port: hostListener.port,
+                };
                 // Re-register in listeners map with actual port
                 this.listeners.delete(oldKey);
                 this.listeners.set(addrKey(socket.localAddr), socketId);
@@ -266,7 +281,9 @@ export class SocketTable {
      */
     shutdown(socketId, how) {
         const socket = this.requireSocket(socketId);
-        if (socket.state !== "connected" && socket.state !== "write-closed" && socket.state !== "read-closed") {
+        if (socket.state !== "connected" &&
+            socket.state !== "write-closed" &&
+            socket.state !== "read-closed") {
             throw new KernelError("ENOTCONN", "socket is not connected");
         }
         // Propagate half-close/full-close semantics to real host sockets so
@@ -341,6 +358,7 @@ export class SocketTable {
     setsockopt(socketId, level, optname, optval) {
         const socket = this.requireSocket(socketId);
         socket.options.set(optKey(level, optname), optval);
+        this.applySocketOptionToHostSocket(socket, level, optname, optval);
     }
     /** Toggle non-blocking behavior for an existing socket. */
     setNonBlocking(socketId, nonBlocking) {
@@ -395,16 +413,17 @@ export class SocketTable {
         }
         // Unix domain sockets: check VFS for socket file existence
         if (isUnixAddr(addr) && this.vfs) {
-            if (!await this.vfs.exists(addr.path)) {
+            if (!(await this.vfs.exists(addr.path))) {
                 throw new KernelError("ECONNREFUSED", `connection refused: ${addr.path}`);
             }
         }
         const listener = this.findListener(addr);
         if (!listener) {
-            // External connection — check permission (throws EACCES if denied)
-            if (this.networkCheck) {
-                this.checkNetworkPermission("connect", addr);
+            if (isUnixAddr(addr)) {
+                throw new KernelError("ECONNREFUSED", `connection refused: ${addr.path}`);
             }
+            // Check external connections through the deny-by-default network policy.
+            this.checkNetworkPermission("connect", addr);
             // Route through host adapter if available
             if (this.hostAdapter && isInetAddr(addr)) {
                 if (socket.nonBlocking) {
@@ -418,6 +437,7 @@ export class SocketTable {
                 socket.external = true;
                 socket.remoteAddr = addr;
                 socket.hostSocket = hostSocket;
+                this.applySocketOptionsToHostSocket(socket);
                 this.startReadPump(socket);
                 return;
             }
@@ -467,8 +487,9 @@ export class SocketTable {
         if (socket.state !== "connected" && socket.state !== "read-closed") {
             throw new KernelError("ENOTCONN", "socket is not connected");
         }
-        // Permission check for external sockets
-        if (socket.external && this.networkCheck) {
+        // Re-check outbound external writes so pre-existing host sockets still
+        // honor deny-by-default network policy.
+        if (socket.external) {
             this.checkNetworkPermission("connect", socket.remoteAddr);
         }
         // External socket: write to host socket
@@ -480,16 +501,12 @@ export class SocketTable {
             return data.length;
         }
         if (socket.peerId === undefined) {
-            throw new KernelError("EPIPE", nosignal
-                ? "broken pipe (MSG_NOSIGNAL)"
-                : "broken pipe: peer closed");
+            throw new KernelError("EPIPE", nosignal ? "broken pipe (MSG_NOSIGNAL)" : "broken pipe: peer closed");
         }
         const peer = this.sockets.get(socket.peerId);
         if (!peer) {
             socket.peerId = undefined;
-            throw new KernelError("EPIPE", nosignal
-                ? "broken pipe (MSG_NOSIGNAL)"
-                : "broken pipe: peer closed");
+            throw new KernelError("EPIPE", nosignal ? "broken pipe (MSG_NOSIGNAL)" : "broken pipe: peer closed");
         }
         // Enforce SO_RCVBUF on the peer's receive buffer
         const rcvBuf = peer.options.get(optKey(SOL_SOCKET, SO_RCVBUF));
@@ -524,7 +541,9 @@ export class SocketTable {
             return this.consumeFromBuffer(socket, maxBytes);
         }
         // Buffer empty — check for EOF (peer gone or peer shut down write)
-        if (socket.peerId === undefined || !this.sockets.has(socket.peerId) || socket.peerWriteClosed) {
+        if (socket.peerId === undefined ||
+            !this.sockets.has(socket.peerId) ||
+            socket.peerWriteClosed) {
             return null;
         }
         // No data available
@@ -570,10 +589,10 @@ export class SocketTable {
         }
         // External routing via host adapter
         if (socket.hostUdpSocket && this.hostAdapter && isInetAddr(destAddr)) {
-            if (this.networkCheck) {
-                this.checkNetworkPermission("connect", destAddr);
-            }
-            this.hostAdapter.udpSend(socket.hostUdpSocket, new Uint8Array(data), destAddr.host, destAddr.port).catch(() => { });
+            this.checkNetworkPermission("connect", destAddr);
+            this.hostAdapter
+                .udpSend(socket.hostUdpSocket, new Uint8Array(data), destAddr.host, destAddr.port)
+                .catch(() => { });
             return data.length;
         }
         // No loopback target, no host adapter — silently drop (UDP semantics)
@@ -647,12 +666,12 @@ export class SocketTable {
         if (socket.state !== "bound") {
             throw new KernelError("EINVAL", "socket must be bound before external UDP bind");
         }
-        if (!this.hostAdapter || !socket.localAddr || !isInetAddr(socket.localAddr)) {
+        if (!this.hostAdapter ||
+            !socket.localAddr ||
+            !isInetAddr(socket.localAddr)) {
             throw new KernelError("EINVAL", "host adapter and inet address required");
         }
-        if (this.networkCheck) {
-            this.checkNetworkPermission("listen", socket.localAddr);
-        }
+        this.checkNetworkPermission("listen", socket.localAddr);
         const hostUdpSocket = await this.hostAdapter.udpBind(socket.localAddr.host, socket.localAddr.port);
         socket.hostUdpSocket = hostUdpSocket;
         socket.external = true;
@@ -680,10 +699,11 @@ export class SocketTable {
         const closed = socket.state === "closed";
         const readClosed = socket.state === "read-closed";
         const writeClosed = socket.state === "write-closed";
+        const pendingAccept = socket.state === "listening" && socket.backlog.length > 0;
         // UDP: readable when datagramQueue has data
         const readable = socket.type === SOCK_DGRAM
             ? socket.datagramQueue.length > 0 || closed
-            : socket.readBuffer.length > 0 || closed || readClosed;
+            : socket.readBuffer.length > 0 || pendingAccept || closed || readClosed;
         const writable = socket.state === "connected" ||
             socket.state === "created" ||
             socket.state === "read-closed" ||
@@ -756,6 +776,15 @@ export class SocketTable {
         }
     }
     destroySocket(socket) {
+        // Tear down queued-but-unaccepted connections with the listener so they
+        // cannot leak detached server-side sockets after the listening endpoint closes.
+        for (const pendingId of [...socket.backlog]) {
+            const pending = this.sockets.get(pendingId);
+            if (pending) {
+                this.destroySocket(pending);
+            }
+        }
+        socket.backlog.length = 0;
         // Propagate EOF to peer: clear peer link and wake readers
         if (socket.peerId !== undefined) {
             const peer = this.sockets.get(socket.peerId);
@@ -829,7 +858,9 @@ export class SocketTable {
     startExternalConnect(socket, addr) {
         if (!this.hostAdapter)
             return;
-        this.hostAdapter.tcpConnect(addr.host, addr.port).then(hostSocket => {
+        this.hostAdapter
+            .tcpConnect(addr.host, addr.port)
+            .then((hostSocket) => {
             const current = this.sockets.get(socket.id);
             if (!current || current !== socket || current.state === "closed") {
                 hostSocket.close().catch(() => { });
@@ -839,8 +870,10 @@ export class SocketTable {
             current.external = true;
             current.remoteAddr = addr;
             current.hostSocket = hostSocket;
+            this.applySocketOptionsToHostSocket(current);
             this.startReadPump(current);
-        }).catch(() => {
+        })
+            .catch(() => {
             const current = this.sockets.get(socket.id);
             if (!current || current !== socket || current.state === "closed") {
                 return;
@@ -859,7 +892,8 @@ export class SocketTable {
         const hostListener = socket.hostListener;
         const pump = async () => {
             try {
-                while (socket.state === "listening" && socket.hostListener === hostListener) {
+                while (socket.state === "listening" &&
+                    socket.hostListener === hostListener) {
                     const hostSocket = await hostListener.accept();
                     if (socket.backlog.length >= socket.backlogLimit) {
                         hostSocket.close().catch(() => { });
@@ -872,6 +906,7 @@ export class SocketTable {
                     connSock.external = true;
                     connSock.hostSocket = hostSocket;
                     connSock.localAddr = socket.localAddr;
+                    this.applySocketOptionsToHostSocket(connSock);
                     // Start read pump for the accepted socket
                     this.startReadPump(connSock);
                     // Queue in listener's backlog
@@ -895,6 +930,27 @@ export class SocketTable {
             return null;
         return sock;
     }
+    /** Replay stored socket options onto a host-backed connection. */
+    applySocketOptionsToHostSocket(socket) {
+        for (const [key, value] of socket.options.entries()) {
+            const [level, optname] = key.split(":").map(Number);
+            if (Number.isNaN(level) || Number.isNaN(optname))
+                continue;
+            this.applySocketOptionToHostSocket(socket, level, optname, value);
+        }
+    }
+    /** Best-effort option forwarding for host-backed sockets. */
+    applySocketOptionToHostSocket(socket, level, optname, optval) {
+        if (!socket.external || !socket.hostSocket) {
+            return;
+        }
+        try {
+            socket.hostSocket.setOption(level, optname, optval);
+        }
+        catch {
+            // Host adapters may not support every kernel-tracked option.
+        }
+    }
     /** Peek up to maxBytes from a socket's readBuffer without consuming. */
     peekFromBuffer(socket, maxBytes) {
         const chunks = [];
@@ -972,7 +1028,9 @@ export class SocketTable {
         if (socket.external) {
             return !socket.peerWriteClosed;
         }
-        return socket.peerId !== undefined && this.sockets.has(socket.peerId) && !socket.peerWriteClosed;
+        return (socket.peerId !== undefined &&
+            this.sockets.has(socket.peerId) &&
+            !socket.peerWriteClosed);
     }
     /** Wait for socket readiness or an interrupting signal. */
     async waitForSocketWake(waiters, pid, op) {
@@ -1048,7 +1106,8 @@ export class SocketTable {
                 continue;
             if (existing.localAddr.port !== addr.port)
                 continue;
-            const existingIsWildcard = existing.localAddr.host === "0.0.0.0" || existing.localAddr.host === "::";
+            const existingIsWildcard = existing.localAddr.host === "0.0.0.0" ||
+                existing.localAddr.host === "::";
             if (isWildcard || existingIsWildcard)
                 return true;
         }
@@ -1061,12 +1120,16 @@ export class SocketTable {
         const hostUdpSocket = socket.hostUdpSocket;
         const pump = async () => {
             try {
-                while (socket.state !== "closed" && socket.hostUdpSocket === hostUdpSocket) {
+                while (socket.state !== "closed" &&
+                    socket.hostUdpSocket === hostUdpSocket) {
                     const result = await hostUdpSocket.recv();
                     if (socket.datagramQueue.length < MAX_UDP_QUEUE_DEPTH) {
                         socket.datagramQueue.push({
                             data: result.data,
-                            srcAddr: { host: result.remoteAddr.host, port: result.remoteAddr.port },
+                            srcAddr: {
+                                host: result.remoteAddr.host,
+                                port: result.remoteAddr.port,
+                            },
                         });
                         socket.readWaiters.wakeOne();
                     }
@@ -1097,7 +1160,8 @@ export class SocketTable {
                 continue;
             if (existing.localAddr.port !== addr.port)
                 continue;
-            const existingIsWildcard = existing.localAddr.host === "0.0.0.0" || existing.localAddr.host === "::";
+            const existingIsWildcard = existing.localAddr.host === "0.0.0.0" ||
+                existing.localAddr.host === "::";
             if (isWildcard || existingIsWildcard)
                 return true;
         }

package/dist/shared/bridge-contract.d.ts

@@ -91,6 +91,7 @@ export declare const HOST_BRIDGE_GLOBAL_KEYS: {
     readonly networkHttp2StreamPushStreamRaw: "_networkHttp2StreamPushStreamRaw";
     readonly networkHttp2StreamWriteRaw: "_networkHttp2StreamWriteRaw";
     readonly networkHttp2StreamEndRaw: "_networkHttp2StreamEndRaw";
+    readonly networkHttp2StreamCloseRaw: "_networkHttp2StreamCloseRaw";
     readonly networkHttp2StreamPauseRaw: "_networkHttp2StreamPauseRaw";
     readonly networkHttp2StreamResumeRaw: "_networkHttp2StreamResumeRaw";
     readonly networkHttp2StreamRespondWithFileRaw: "_networkHttp2StreamRespondWithFileRaw";
@@ -124,6 +125,7 @@ export declare const HOST_BRIDGE_GLOBAL_KEYS: {
     readonly resolveModuleSync: "_resolveModuleSync";
     readonly loadFileSync: "_loadFileSync";
     readonly ptySetRawMode: "_ptySetRawMode";
+    readonly kernelStdinRead: "_kernelStdinRead";
     readonly processConfig: "_processConfig";
     readonly osConfig: "_osConfig";
     readonly log: "_log";
@@ -237,6 +239,7 @@ export declare const HOST_BRIDGE_GLOBAL_KEY_LIST: ValueOf<{
     readonly networkHttp2StreamPushStreamRaw: "_networkHttp2StreamPushStreamRaw";
     readonly networkHttp2StreamWriteRaw: "_networkHttp2StreamWriteRaw";
     readonly networkHttp2StreamEndRaw: "_networkHttp2StreamEndRaw";
+    readonly networkHttp2StreamCloseRaw: "_networkHttp2StreamCloseRaw";
     readonly networkHttp2StreamPauseRaw: "_networkHttp2StreamPauseRaw";
     readonly networkHttp2StreamResumeRaw: "_networkHttp2StreamResumeRaw";
     readonly networkHttp2StreamRespondWithFileRaw: "_networkHttp2StreamRespondWithFileRaw";
@@ -270,6 +273,7 @@ export declare const HOST_BRIDGE_GLOBAL_KEY_LIST: ValueOf<{
     readonly resolveModuleSync: "_resolveModuleSync";
     readonly loadFileSync: "_loadFileSync";
     readonly ptySetRawMode: "_ptySetRawMode";
+    readonly kernelStdinRead: "_kernelStdinRead";
     readonly processConfig: "_processConfig";
     readonly osConfig: "_osConfig";
     readonly log: "_log";
@@ -379,6 +383,7 @@ export declare const BRIDGE_GLOBAL_KEY_LIST: readonly (ValueOf<{
     readonly networkHttp2StreamPushStreamRaw: "_networkHttp2StreamPushStreamRaw";
     readonly networkHttp2StreamWriteRaw: "_networkHttp2StreamWriteRaw";
     readonly networkHttp2StreamEndRaw: "_networkHttp2StreamEndRaw";
+    readonly networkHttp2StreamCloseRaw: "_networkHttp2StreamCloseRaw";
     readonly networkHttp2StreamPauseRaw: "_networkHttp2StreamPauseRaw";
     readonly networkHttp2StreamResumeRaw: "_networkHttp2StreamResumeRaw";
     readonly networkHttp2StreamRespondWithFileRaw: "_networkHttp2StreamRespondWithFileRaw";
@@ -412,6 +417,7 @@ export declare const BRIDGE_GLOBAL_KEY_LIST: readonly (ValueOf<{
     readonly resolveModuleSync: "_resolveModuleSync";
     readonly loadFileSync: "_loadFileSync";
     readonly ptySetRawMode: "_ptySetRawMode";
+    readonly kernelStdinRead: "_kernelStdinRead";
     readonly processConfig: "_processConfig";
     readonly osConfig: "_osConfig";
     readonly log: "_log";
@@ -463,6 +469,7 @@ export interface BridgeApplySyncRef<TArgs extends unknown[], TResult> {
 export interface BridgeApplySyncPromiseRef<TArgs extends unknown[], TResult> {
     applySyncPromise(ctx: undefined, args: TArgs): TResult;
 }
+export type ModuleLoadMode = "require" | "import";
 export type DynamicImportBridgeRef = BridgeApplyRef<[
     string,
     string
@@ -471,13 +478,20 @@ export type LoadPolyfillBridgeRef = BridgeApplyRef<[string], string | null>;
 export type ResolveModuleBridgeRef = BridgeApplySyncPromiseRef<[
     string,
     string
-], string | null>;
-export type LoadFileBridgeRef = BridgeApplySyncPromiseRef<[string], string | null>;
+] | [string, string, ModuleLoadMode], string | null>;
+export type LoadFileBridgeRef = BridgeApplySyncPromiseRef<[
+    string
+] | [string, ModuleLoadMode], string | null>;
 export type RequireFromBridgeFn = (request: string, dirname: string) => unknown;
 export type ModuleCacheBridgeRecord = Record<string, unknown>;
 export type ProcessLogBridgeRef = BridgeApplySyncRef<[string], void>;
 export type ProcessErrorBridgeRef = BridgeApplySyncRef<[string], void>;
 export type ScheduleTimerBridgeRef = BridgeApplyRef<[number], void>;
+export type KernelStdinReadBridgeRef = BridgeApplyRef<[
+], {
+    done: boolean;
+    dataBase64?: string;
+}>;
 export type CryptoRandomFillBridgeRef = BridgeApplySyncRef<[number], string>;
 export type CryptoRandomUuidBridgeRef = BridgeApplySyncRef<[], string>;
 export type CryptoHashDigestBridgeRef = BridgeApplySyncRef<[string, string], string>;
@@ -678,7 +692,7 @@ export type NetworkHttp2StreamRespondRawBridgeRef = BridgeApplySyncRef<[
     number,
     string
 ], void>;
-export type NetworkHttp2StreamPushStreamRawBridgeRef = BridgeApplySyncPromiseRef<[
+export type NetworkHttp2StreamPushStreamRawBridgeRef = BridgeApplySyncRef<[
     number,
     string,
     string
@@ -691,6 +705,10 @@ export type NetworkHttp2StreamEndRawBridgeRef = BridgeApplySyncRef<[
     number,
     string | null
 ], void>;
+export type NetworkHttp2StreamCloseRawBridgeRef = BridgeApplySyncRef<[
+    number,
+    number | null
+], void>;
 export type NetworkHttp2StreamPauseRawBridgeRef = BridgeApplySyncRef<[number], void>;
 export type NetworkHttp2StreamResumeRawBridgeRef = BridgeApplySyncRef<[number], void>;
 export type NetworkHttp2StreamRespondWithFileRawBridgeRef = BridgeApplySyncRef<[

package/dist/shared/bridge-contract.js

@@ -93,6 +93,7 @@ export const HOST_BRIDGE_GLOBAL_KEYS = {
     networkHttp2StreamPushStreamRaw: "_networkHttp2StreamPushStreamRaw",
     networkHttp2StreamWriteRaw: "_networkHttp2StreamWriteRaw",
     networkHttp2StreamEndRaw: "_networkHttp2StreamEndRaw",
+    networkHttp2StreamCloseRaw: "_networkHttp2StreamCloseRaw",
     networkHttp2StreamPauseRaw: "_networkHttp2StreamPauseRaw",
     networkHttp2StreamResumeRaw: "_networkHttp2StreamResumeRaw",
     networkHttp2StreamRespondWithFileRaw: "_networkHttp2StreamRespondWithFileRaw",
@@ -126,6 +127,7 @@ export const HOST_BRIDGE_GLOBAL_KEYS = {
     resolveModuleSync: "_resolveModuleSync",
     loadFileSync: "_loadFileSync",
     ptySetRawMode: "_ptySetRawMode",
+    kernelStdinRead: "_kernelStdinRead",
     processConfig: "_processConfig",
     osConfig: "_osConfig",
     log: "_log",