@secure-exec/core 0.2.1 → 0.3.0-rc.2

package/dist/kernel/user.js

@@ -1,35 +0,0 @@
-/**
- * User/group identity manager.
- *
- * Provides configurable uid/gid and passwd-entry generation for the kernel.
- * OS-level concern — lives in the kernel so all runtimes share the same identity.
- */
-export class UserManager {
-    uid;
-    gid;
-    euid;
-    egid;
-    username;
-    homedir;
-    shell;
-    gecos;
-    constructor(config) {
-        this.uid = config?.uid ?? 1000;
-        this.gid = config?.gid ?? 1000;
-        this.euid = config?.euid ?? this.uid;
-        this.egid = config?.egid ?? this.gid;
-        this.username = config?.username ?? "user";
-        this.homedir = config?.homedir ?? "/home/user";
-        this.shell = config?.shell ?? "/bin/sh";
-        this.gecos = config?.gecos ?? "";
-    }
-    /** Generate a passwd-format string for the given uid. */
-    getpwuid(uid) {
-        if (uid === this.uid) {
-            return `${this.username}:x:${this.uid}:${this.gid}:${this.gecos}:${this.homedir}:${this.shell}`;
-        }
-        // Generic entry for unknown uids
-        const name = `user${uid}`;
-        return `${name}:x:${uid}:${uid}::/home/${name}:/bin/sh`;
-    }
-}

package/dist/kernel/vfs.d.ts

@@ -1,82 +0,0 @@
-/**
- * Virtual Filesystem interface.
- *
- * POSIX-complete interface that all filesystem backends must implement.
- * The primary implementation is ChunkedVFS, which composes an FsMetadataStore
- * (directory tree, inodes, chunk mapping) with an FsBlockStore (key-value blob
- * store) to provide tiered storage with optional write buffering and versioning.
- *
- * Error behavior (KernelError codes):
- * - ENOENT: path does not exist (readFile, stat, pread, pwrite, truncate, readlink, etc.)
- * - EISDIR: operation targets a directory when a file is expected (readFile, pread, pwrite)
- * - ENOTDIR: intermediate path component is not a directory
- * - EEXIST: target already exists (createDir without recursive, link to existing)
- * - ELOOP: symlink resolution exceeds 40 levels
- * - ENOTEMPTY: removeDir on non-empty directory
- * - EPERM: link to directory
- * - EXDEV: cross-mount copy (raised by MountTable, not VFS directly)
- *
- * Optional methods (fsync, copy, readDirStat) may be absent. The kernel and
- * MountTable use optional chaining and provide fallbacks where needed.
- *
- * Usage: create via `createChunkedVfs()` from `./vfs/chunked-vfs.ts`, or use
- * `createInMemoryFileSystem()` from the package root for the default in-memory VFS.
- */
-export interface VirtualDirEntry {
-    name: string;
-    isDirectory: boolean;
-    isSymbolicLink?: boolean;
-    ino?: number;
-}
-export interface VirtualDirStatEntry extends VirtualDirEntry {
-    stat: VirtualStat;
-}
-export interface VirtualStat {
-    mode: number;
-    size: number;
-    isDirectory: boolean;
-    isSymbolicLink: boolean;
-    atimeMs: number;
-    mtimeMs: number;
-    ctimeMs: number;
-    birthtimeMs: number;
-    ino: number;
-    nlink: number;
-    uid: number;
-    gid: number;
-}
-export interface VirtualFileSystem {
-    readFile(path: string): Promise<Uint8Array>;
-    readTextFile(path: string): Promise<string>;
-    readDir(path: string): Promise<string[]>;
-    readDirWithTypes(path: string): Promise<VirtualDirEntry[]>;
-    writeFile(path: string, content: string | Uint8Array): Promise<void>;
-    createDir(path: string): Promise<void>;
-    mkdir(path: string, options?: {
-        recursive?: boolean;
-    }): Promise<void>;
-    exists(path: string): Promise<boolean>;
-    stat(path: string): Promise<VirtualStat>;
-    removeFile(path: string): Promise<void>;
-    removeDir(path: string): Promise<void>;
-    rename(oldPath: string, newPath: string): Promise<void>;
-    realpath(path: string): Promise<string>;
-    symlink(target: string, linkPath: string): Promise<void>;
-    readlink(path: string): Promise<string>;
-    lstat(path: string): Promise<VirtualStat>;
-    link(oldPath: string, newPath: string): Promise<void>;
-    chmod(path: string, mode: number): Promise<void>;
-    chown(path: string, uid: number, gid: number): Promise<void>;
-    utimes(path: string, atime: number, mtime: number): Promise<void>;
-    truncate(path: string, length: number): Promise<void>;
-    /** Read a range from a file without loading the entire file into memory. */
-    pread(path: string, offset: number, length: number): Promise<Uint8Array>;
-    /** Write data at a specific offset without replacing the entire file. */
-    pwrite(path: string, offset: number, data: Uint8Array): Promise<void>;
-    /** Flush buffered writes for the given path to durable storage. */
-    fsync?(path: string): Promise<void>;
-    /** Copy a file within the same filesystem. */
-    copy?(srcPath: string, dstPath: string): Promise<void>;
-    /** Combined readdir + stat. Avoids N+1 queries for directory listings. */
-    readDirStat?(path: string): Promise<VirtualDirStatEntry[]>;
-}

package/dist/kernel/vfs.js

@@ -1,25 +0,0 @@
-/**
- * Virtual Filesystem interface.
- *
- * POSIX-complete interface that all filesystem backends must implement.
- * The primary implementation is ChunkedVFS, which composes an FsMetadataStore
- * (directory tree, inodes, chunk mapping) with an FsBlockStore (key-value blob
- * store) to provide tiered storage with optional write buffering and versioning.
- *
- * Error behavior (KernelError codes):
- * - ENOENT: path does not exist (readFile, stat, pread, pwrite, truncate, readlink, etc.)
- * - EISDIR: operation targets a directory when a file is expected (readFile, pread, pwrite)
- * - ENOTDIR: intermediate path component is not a directory
- * - EEXIST: target already exists (createDir without recursive, link to existing)
- * - ELOOP: symlink resolution exceeds 40 levels
- * - ENOTEMPTY: removeDir on non-empty directory
- * - EPERM: link to directory
- * - EXDEV: cross-mount copy (raised by MountTable, not VFS directly)
- *
- * Optional methods (fsync, copy, readDirStat) may be absent. The kernel and
- * MountTable use optional chaining and provide fallbacks where needed.
- *
- * Usage: create via `createChunkedVfs()` from `./vfs/chunked-vfs.ts`, or use
- * `createInMemoryFileSystem()` from the package root for the default in-memory VFS.
- */
-export {};

package/dist/kernel/wait.d.ts

@@ -1,45 +0,0 @@
-/**
- * Unified blocking I/O wait system.
- *
- * Provides WaitHandle and WaitQueue primitives for all kernel subsystems
- * (pipes, sockets, flock, poll) to share the same wait/wake mechanism.
- * Promise-based — no Atomics.
- */
-/**
- * A single wait/wake handle. Callers await wait(), producers call wake().
- * Each handle resolves exactly once (either by wake or timeout).
- */
-export declare class WaitHandle {
-    private resolve;
-    private timer;
-    private settled;
-    readonly promise: Promise<void>;
-    /** True if the handle resolved via timeout rather than wake(). */
-    timedOut: boolean;
-    constructor(timeoutMs?: number);
-    /** Suspend until woken or timed out. */
-    wait(): Promise<void>;
-    /** Wake this handle. No-op if already settled. */
-    wake(): void;
-    /** Whether this handle has already been resolved. */
-    get isSettled(): boolean;
-}
-/**
- * A FIFO queue of WaitHandles. Subsystems enqueue waiters and producers
- * wake them one-at-a-time or all-at-once.
- */
-export declare class WaitQueue {
-    private waiters;
-    /** Create and enqueue a new WaitHandle. */
-    enqueue(timeoutMs?: number): WaitHandle;
-    /** Remove a waiter from the queue without waking it. */
-    remove(handle: WaitHandle): void;
-    /** Wake exactly one waiter (FIFO order). Returns true if a waiter was woken. */
-    wakeOne(): boolean;
-    /** Wake all enqueued waiters. Returns the number woken. */
-    wakeAll(): number;
-    /** Number of pending (unsettled) waiters. */
-    get pending(): number;
-    /** Remove all waiters without waking them. */
-    clear(): void;
-}

package/dist/kernel/wait.js

@@ -1,112 +0,0 @@
-/**
- * Unified blocking I/O wait system.
- *
- * Provides WaitHandle and WaitQueue primitives for all kernel subsystems
- * (pipes, sockets, flock, poll) to share the same wait/wake mechanism.
- * Promise-based — no Atomics.
- */
-/**
- * A single wait/wake handle. Callers await wait(), producers call wake().
- * Each handle resolves exactly once (either by wake or timeout).
- */
-export class WaitHandle {
-    resolve = null;
-    timer = null;
-    settled = false;
-    promise;
-    /** True if the handle resolved via timeout rather than wake(). */
-    timedOut = false;
-    constructor(timeoutMs) {
-        this.promise = new Promise((resolve) => {
-            this.resolve = resolve;
-        });
-        if (timeoutMs !== undefined && timeoutMs >= 0) {
-            this.timer = setTimeout(() => {
-                if (!this.settled) {
-                    this.timedOut = true;
-                    this.settled = true;
-                    this.resolve();
-                    this.resolve = null;
-                }
-            }, timeoutMs);
-        }
-    }
-    /** Suspend until woken or timed out. */
-    wait() {
-        return this.promise;
-    }
-    /** Wake this handle. No-op if already settled. */
-    wake() {
-        if (this.settled)
-            return;
-        this.settled = true;
-        if (this.timer !== null) {
-            clearTimeout(this.timer);
-            this.timer = null;
-        }
-        this.resolve();
-        this.resolve = null;
-    }
-    /** Whether this handle has already been resolved. */
-    get isSettled() {
-        return this.settled;
-    }
-}
-/**
- * A FIFO queue of WaitHandles. Subsystems enqueue waiters and producers
- * wake them one-at-a-time or all-at-once.
- */
-export class WaitQueue {
-    waiters = [];
-    /** Create and enqueue a new WaitHandle. */
-    enqueue(timeoutMs) {
-        const handle = new WaitHandle(timeoutMs);
-        this.waiters.push(handle);
-        return handle;
-    }
-    /** Remove a waiter from the queue without waking it. */
-    remove(handle) {
-        const index = this.waiters.indexOf(handle);
-        if (index >= 0) {
-            this.waiters.splice(index, 1);
-        }
-    }
-    /** Wake exactly one waiter (FIFO order). Returns true if a waiter was woken. */
-    wakeOne() {
-        while (this.waiters.length > 0) {
-            const handle = this.waiters.shift();
-            if (!handle.isSettled) {
-                handle.wake();
-                return true;
-            }
-            // Skip already-settled handles (timed out)
-        }
-        return false;
-    }
-    /** Wake all enqueued waiters. Returns the number woken. */
-    wakeAll() {
-        let count = 0;
-        for (const handle of this.waiters) {
-            if (!handle.isSettled) {
-                handle.wake();
-                count++;
-            }
-        }
-        this.waiters.length = 0;
-        return count;
-    }
-    /** Number of pending (unsettled) waiters. */
-    get pending() {
-        // Compact settled handles while counting
-        let count = 0;
-        for (const handle of this.waiters) {
-            if (!handle.isSettled)
-                count++;
-        }
-        return count;
-    }
-    /** Remove all waiters without waking them. */
-    clear() {
-        this.waiters.length = 0;
-    }
-}

package/dist/kernel/wstatus.d.ts

@@ -1,21 +0,0 @@
-/**
- * POSIX wstatus encoding/decoding.
- *
- * Encodes how a process terminated into a single integer matching
- * the layout expected by WIFEXITED / WEXITSTATUS / WIFSIGNALED / WTERMSIG.
- *
- *   Normal exit:  (exitCode & 0xFF) << 8  (bits 8-15 = exit code, bits 0-6 = 0)
- *   Signal death: signalNumber & 0x7F     (bits 0-6 = signal, bits 8-15 = 0)
- */
-/** Encode a normal exit into POSIX wstatus. */
-export declare function encodeExitStatus(exitCode: number): number;
-/** Encode a signal death into POSIX wstatus. */
-export declare function encodeSignalStatus(signal: number): number;
-/** True if process exited normally (not killed by a signal). */
-export declare function WIFEXITED(status: number): boolean;
-/** Extract exit code (only valid when WIFEXITED is true). */
-export declare function WEXITSTATUS(status: number): number;
-/** True if process was killed by a signal. */
-export declare function WIFSIGNALED(status: number): boolean;
-/** Extract signal number (only valid when WIFSIGNALED is true). */
-export declare function WTERMSIG(status: number): number;

package/dist/kernel/wstatus.js

@@ -1,33 +0,0 @@
-/**
- * POSIX wstatus encoding/decoding.
- *
- * Encodes how a process terminated into a single integer matching
- * the layout expected by WIFEXITED / WEXITSTATUS / WIFSIGNALED / WTERMSIG.
- *
- *   Normal exit:  (exitCode & 0xFF) << 8  (bits 8-15 = exit code, bits 0-6 = 0)
- *   Signal death: signalNumber & 0x7F     (bits 0-6 = signal, bits 8-15 = 0)
- */
-/** Encode a normal exit into POSIX wstatus. */
-export function encodeExitStatus(exitCode) {
-    return (exitCode & 0xff) << 8;
-}
-/** Encode a signal death into POSIX wstatus. */
-export function encodeSignalStatus(signal) {
-    return signal & 0x7f;
-}
-/** True if process exited normally (not killed by a signal). */
-export function WIFEXITED(status) {
-    return (status & 0x7f) === 0;
-}
-/** Extract exit code (only valid when WIFEXITED is true). */
-export function WEXITSTATUS(status) {
-    return (status >> 8) & 0xff;
-}
-/** True if process was killed by a signal. */
-export function WIFSIGNALED(status) {
-    return (status & 0x7f) !== 0;
-}
-/** Extract signal number (only valid when WIFSIGNALED is true). */
-export function WTERMSIG(status) {
-    return status & 0x7f;
-}

package/dist/module-resolver.d.ts

@@ -1,29 +0,0 @@
-/**
- * @deprecated Canonical source moved to @secure-exec/nodejs (US-003).
- * This copy is retained for backward compatibility during phased migration.
- * Will be removed in US-005 when kernel merges into core.
- *
- * Module classification and resolution helpers.
- *
- * Node built-ins are split into three tiers:
- * - Bridge modules: fully polyfilled by the bridge (fs, process, http, etc.)
- * - Deferred core modules: known but not yet bridge-supported; surfaced via
- *   deferred stubs in require paths and polyfills/wrappers in ESM paths
- * - Unsupported core modules: known but intentionally unimplemented
- *
- * Everything else falls through to node-stdlib-browser polyfills or node_modules.
- */
-/**
- * Known named exports for each built-in module. Used by the ESM wrapper
- * generator to create `export const X = _builtin.X;` re-exports so that
- * `import { readFile } from 'fs'` works inside the isolate.
- */
-export declare const BUILTIN_NAMED_EXPORTS: Record<string, string[]>;
-/**
- * Normalize a module specifier to its canonical form if it's a known built-in.
- * Returns null for non-builtin specifiers.
- * Preserves the `node:` prefix when present, strips it otherwise.
- */
-export declare function normalizeBuiltinSpecifier(request: string): string | null;
-/** Extract the directory portion of a path (lightweight dirname without node:path). */
-export declare function getPathDir(path: string): string;