kobako 0.14.0 → 0.15.0

data/lib/kobako/codec/state.rb

@@ -0,0 +1,98 @@
+# frozen_string_literal: true
+
+module Kobako
+  module Codec
+    # Codec-internal, per-thread state of the operation in flight: the
+    # ext-envelope nesting depth and whether a Capability Handle crossed
+    # the current decode. Thread scoping is what makes plain instance
+    # variables sound — host codec calls run synchronously on their
+    # owning thread, and a nested decode (an ext 0x02 Fault re-entering
+    # through its +details+) reuses the same thread instance, so the
+    # depth counter accumulates across the re-entry instead of resetting.
+    class State
+      # An ext 0x02 (Fault) envelope nests through its +details+ field, and
+      # each level re-enters the codec with a fresh +MessagePack+ unpacker
+      # whose built-in stack guard resets — so ext-envelope depth is tracked
+      # here instead. The cap matches the wire's overall nesting bound and
+      # keeps a nested chain from exhausting the native stack: an over-deep
+      # chain fails as a clean wire error, never a stack-level trap.
+      MAX_EXT_DEPTH = 128
+      private_constant :MAX_EXT_DEPTH
+
+      # Thread-local slot holding the calling thread's State.
+      STATE_KEY = :__kobako_codec_state__
+      private_constant :STATE_KEY
+
+      # The calling thread's State, built on first use so the mutable
+      # state stays isolated to the thread that runs the codec call.
+      def self.current
+        Thread.current[STATE_KEY] ||= new
+      end
+      private_class_method :new
+
+      def initialize
+        @ext_depth = 0
+        @carried_handle = false
+        @faults_forbidden = false
+      end
+
+      # Bracket a decode and return the block's result together with
+      # whether the decoded tree carried an ext 0x01 Capability Handle.
+      # ExtTypes#unpack_handle is the sole chokepoint every Handle passes
+      # through, so one decode pass records the whole tree and a caller
+      # can skip an all-identity Handle-resolution walk when none was
+      # present.
+      def track_handles
+        @carried_handle = false
+        result = yield
+        [result, @carried_handle]
+      end
+
+      # Record that an ext 0x01 Capability Handle crossed the current
+      # decode; #track_handles reports it to the bracketing caller.
+      def record_handle!
+        @carried_handle = true
+      end
+
+      # Bracket a codec operation in a payload position, where an ext 0x02
+      # Fault envelope has no legal wire representation: the fault field of
+      # an error Response is its only home. The ext-type conversions
+      # consult #faults_forbidden? and refuse the envelope in both
+      # directions while the bracket is open. Save/restore keeps a nested
+      # legal operation on the same thread unaffected.
+      def forbid_faults
+        previous = @faults_forbidden
+        @faults_forbidden = true
+        yield
+      ensure
+        @faults_forbidden = previous
+      end
+
+      # Whether the operation in flight sits inside a #forbid_faults
+      # bracket — i.e. in a payload position where ext 0x02 is a wire
+      # violation.
+      def faults_forbidden?
+        @faults_forbidden
+      end
+
+      # Track ext-envelope re-entry depth and refuse a chain past
+      # MAX_EXT_DEPTH, raising +over_limit+ so the failure lands in the
+      # caller's existing wire-error class. The next depth is checked before
+      # it is committed, so an over-deep rejection leaves the counter
+      # untouched, and the +ensure+ restores the entry value on the way out.
+      def within_ext_frame(over_limit)
+        depth = @ext_depth + 1
+        raise over_limit, "ext envelope nesting exceeds #{MAX_EXT_DEPTH} levels" if depth > MAX_EXT_DEPTH
+
+        @ext_depth = depth
+        begin
+          yield
+        ensure
+          @ext_depth = depth - 1
+        end
+      end
+    end
+
+    private_constant :State
+  end
+end

data/lib/kobako/codec/utils.rb

@@ -10,7 +10,7 @@ module Kobako
     #   - UTF-8 assertion at the codec boundary
     #     ({docs/wire-codec.md}[link:../../../docs/wire-codec.md]
     #     § str/bin Encoding Rules and § Ext Types → ext 0x00). Used by
-    #     Decoder when walking +str+ family payloads and by Factory
+    #     Decoder when walking +str+ family payloads and by ExtTypes
     #     when validating the +ext 0x00+ Symbol payload.
     #   - +ArgumentError+ translation at the codec boundary
     #     (#with_boundary) so the public taxonomy stays
@@ -38,7 +38,7 @@ module Kobako
       #
       # Reach for this only where a value object is constructed outside a
       # Decoder.decode block, whose rescue already performs the same
-      # mapping (worked example: Factory#unpack_handle building
+      # mapping (worked example: ExtTypes#unpack_handle building
       # +Handle.restore+ from a raw fixext payload). Do not use it for
       # general-purpose validation outside the codec boundary —
       # host-layer +ArgumentError+ values should propagate unchanged.

data/lib/kobako/codec.rb

@@ -3,7 +3,8 @@
 require_relative "codec/error"
 require_relative "codec/utils"
 require_relative "codec/handle_walk"
-require_relative "codec/factory"
+require_relative "codec/state"
+require_relative "codec/ext_types"
 require_relative "codec/encoder"
 require_relative "codec/decoder"
 
@@ -18,14 +19,30 @@ module Kobako
   # the kobako root so the codec can register them without depending
   # upward on Transport.
   #
-  # Backed by the official +msgpack+ gem via Factory; Encoder and
-  # Decoder are thin wrappers that register the three kobako-specific
-  # ext types (0x00 Symbol, 0x01 Capability Handle, 0x02 Exception
-  # envelope) on a single +MessagePack::Factory+ instance. The Rust side
+  # Backed by the official +msgpack+ gem: ExtTypes registers the three
+  # kobako-specific ext types (0x00 Symbol, 0x01 Capability Handle,
+  # 0x02 Exception envelope) on one process-wide +MessagePack::Factory+,
+  # and Encoder / Decoder are thin wrappers over it. The Rust side
   # mirrors this layer as the +codec+ module in the +kobako-codec+ crate;
-  # the ext-code constants live as module-private values on Factory
+  # the ext-code constants live as module-private values on ExtTypes
   # alongside +codec::EXT_SYMBOL+ / +codec::EXT_HANDLE+ /
   # +codec::EXT_ERRENV+ on that side.
   module Codec
+    # Bracket a decode and return the block's result together with whether
+    # the decoded tree carried an ext 0x01 Capability Handle — the signal a
+    # dispatch path uses to skip an all-identity Handle-resolution walk.
+    # The tracking state is codec-internal; this is its only readout.
+    def self.track_handles(&block)
+      State.current.track_handles(&block)
+    end
+
+    # Bracket a codec operation in a payload position: an ext 0x02 Fault
+    # envelope is only legal in the Response fault field, so the envelope
+    # layers open this bracket around every other encode / decode and the
+    # ext-type conversions refuse the envelope while it is open — a wire
+    # violation on decode, no wire representation on encode.
+    def self.forbid_faults(&block)
+      State.current.forbid_faults(&block)
+    end
   end
 end

data/lib/kobako/fault.rb

@@ -5,7 +5,7 @@ module Kobako
   #
   # Top-level shared wire primitive: like +Kobako::Handle+ (ext 0x01),
   # +Fault+ is a MessagePack ext-type leaf registered by
-  # +Kobako::Codec::Factory+ and rides nested inside other envelopes (a
+  # +Kobako::Codec::ExtTypes+ and rides nested inside other envelopes (a
   # +Kobako::Transport::Response+ error payload, or another Fault's
   # +details+). It lives at the kobako root rather than under +Transport+
   # because the Codec layer must register it, and Codec must not depend

data/lib/kobako/handle.rb

@@ -18,7 +18,7 @@ module Kobako
   # constructor — is removed for the same reason: a legitimate Handle
   # must not derive a sibling with a caller-chosen id. The Host Gem itself constructs
   # Handles through +.restore+, which exists at exactly two call
-  # sites: +Kobako::Codec::Factory#unpack_handle+ (wire decode) and
+  # sites: +Kobako::Codec::ExtTypes#unpack_handle+ (wire decode) and
   # +Kobako::Codec::HandleWalk.deep_wrap+ / +Kobako::Transport::Dispatcher#wrap_as_handle+
   # (allocator paths). Both live inside +lib/kobako/+ and are not part
   # of any public surface.

data/lib/kobako/outcome.rb

@@ -70,7 +70,9 @@ module Kobako
     # "Symbol payload must be …" wording, but operators triaging a
     # corrupted Sandbox runtime still need it.
     def decode_value(body)
-      Kobako::Codec::Decoder.decode(body)
+      # The Result envelope is a payload position: an ext 0x02 Fault in it
+      # is a wire violation routed into the invalid-result rescue below.
+      Kobako::Codec.forbid_faults { Kobako::Codec::Decoder.decode(body) }
     rescue Kobako::Codec::Error => e
       raise build_transport_error(
         "Sandbox produced an invalid result value",
@@ -99,13 +101,17 @@ module Kobako
     # through the decoder boundary; the message itself is never user-
     # facing — it lands in +details+ via the rescue chain above.
     def build_panic_record(body)
-      Kobako::Codec::Decoder.decode(body) do |map|
-        raise Kobako::Codec::InvalidType, "panic body must be a map, got #{map.class}" unless map.is_a?(Hash)
+      # The Panic envelope is a payload position: an ext 0x02 Fault in its
+      # +details+ is a wire violation routed into the invalid-panic rescue.
+      Kobako::Codec.forbid_faults do
+        Kobako::Codec::Decoder.decode(body) do |map|
+          raise Kobako::Codec::InvalidType, "panic body must be a map, got #{map.class}" unless map.is_a?(Hash)
 
-        Panic.new(
-          origin: map["origin"], klass: map["class"], message: map["message"],
-          backtrace: map["backtrace"] || [], details: map["details"]
-        )
+          Panic.new(
+            origin: map["origin"], klass: map["class"], message: map["message"],
+            backtrace: map["backtrace"] || [], details: map["details"]
+          )
+        end
       end
     end
 

data/lib/kobako/pool.rb

@@ -24,7 +24,7 @@ module Kobako
     # seconds (+nil+ waits indefinitely); every other keyword is
     # forwarded verbatim to +Kobako::Sandbox.new+. The optional block
     # runs exactly once per constructed Sandbox — it is the setup window
-    # for +#define+ / +#preload+ before that Sandbox's first checkout.
+    # for +#bind+ / +#preload+ before that Sandbox's first checkout.
     # No Sandbox is constructed here. Raises +ArgumentError+ for an
     # invalid +slots+ / +checkout_timeout+.
     def initialize(slots:, checkout_timeout: DEFAULT_CHECKOUT_TIMEOUT_SECONDS, **sandbox_options, &setup)

data/lib/kobako/sandbox.rb

@@ -17,7 +17,7 @@ module Kobako
   #
   # The Sandbox owns the +Kobako::Runtime+, the per-Sandbox
   # +Kobako::Catalog::Handles+, the per-instance
-  # +Kobako::Catalog::Namespaces+ (which receives the +Catalog::Handles+ by
+  # +Kobako::Catalog::Services+ (which receives the +Catalog::Handles+ by
   # injection so guest→host dispatch and host→guest auto-wrap share one
   # allocator), and the dispatch +Proc+ / +yield_to_guest+ lambda installed
   # on the Runtime via +Runtime#on_dispatch=+. The underlying wasmtime Engine
@@ -100,21 +100,25 @@ module Kobako
       @wasm_path = wasm_path || Kobako::Runtime.default_path
       @options = SandboxOptions.new(**)
       @handler = Catalog::Handles.new
-      @services = Kobako::Catalog::Namespaces.new(handler: @handler)
+      @services = Kobako::Catalog::Services.new(handler: @handler)
       @snippets = Catalog::Snippets.new
       @runtime = build_runtime!
       install_dispatch_proc!
       reset_invocation_state!
     end
 
-    # Declare or retrieve the Namespace named +name+ on this Sandbox. +name+
-    # must be a Symbol or String in constant form. Returns the
-    # +Kobako::Namespace+.
+    # Bind +object+ as the Service reachable at +path+ — a Symbol or
+    # String of one or more +::+-separated constant-form segments
+    # (+"MyService::KV"+ or a top-level +"File"+). Returns +self+ for
+    # chaining.
     #
-    # Raises +ArgumentError+ when called after the first invocation, or
-    # when +name+ does not match the constant-name pattern.
-    def define(name)
-      @services.define(name)
+    # Raises +ArgumentError+ when a segment is malformed, when +path+
+    # collides with an existing binding (a name is a bound Service or a
+    # grouping prefix, never both), or when called after the first
+    # invocation has sealed Service registration.
+    def bind(path, object)
+      @services.bind(path, object)
+      self
     end
 
     # Register a snippet on this Sandbox in one of two forms:
@@ -175,15 +179,15 @@ module Kobako
     #
     # Source delivery uses the WASI stdin three-frame protocol
     # ({docs/wire-codec.md Invocation channels}[link:../../docs/wire-codec.md]):
-    # Frame 1 carries the msgpack-encoded preamble (Namespace / Member
-    # registry snapshot), Frame 2 carries the user source UTF-8 bytes, and
+    # Frame 1 carries the msgpack-encoded preamble (Service registry
+    # snapshot), Frame 2 carries the user source UTF-8 bytes, and
     # Frame 3 carries the snippet table registered via +#preload+.
     # Each frame is prefixed by a 4-byte big-endian u32 length; Frame 3 is
     # mandatory-presence — an empty snippet table sends an empty msgpack
     # array, never an absent frame.
     #
     # The first invocation seals the Service registry and snippet table;
-    # subsequent +#define+ / +#preload+ calls raise +ArgumentError+.
+    # subsequent +#bind+ / +#preload+ calls raise +ArgumentError+.
     #
     # Raises +Kobako::TrapError+ on a Wasm trap or wire-violation fallback;
     # +Kobako::SandboxError+ when the guest ran to completion but failed
@@ -318,7 +322,10 @@ module Kobako
       # token; restore it to the host object the guest referenced before
       # handing the value to the Host App. @handler still holds this
       # invocation's table — reset only happens at the next #begin_invocation!.
-      Codec::HandleWalk.deep_restore(Outcome.decode(return_bytes), @handler)
+      # A Handle-free result resolves to itself, so the restoration walk is
+      # skipped when the decode carried none.
+      value, carried_handle = Codec.track_handles { Outcome.decode(return_bytes) }
+      carried_handle ? Codec::HandleWalk.deep_restore(value, @handler) : value
     rescue Kobako::TrapError => e
       raise trap_class_for(e), "Sandbox##{verb} failed: #{e.message}"
     ensure

data/lib/kobako/transport/dispatcher.rb

@@ -13,7 +13,7 @@ module Kobako
   module Transport
     # Pure-function dispatcher for guest-initiated transport calls.
     # Decodes a msgpack-encoded Request envelope, resolves the target
-    # object through the Catalog::Namespaces (path lookup) or
+    # object through the Catalog::Services (path lookup) or
     # Catalog::Handles (Handle lookup), invokes the method, and returns
     # a msgpack-encoded Response envelope.
     #
@@ -24,7 +24,7 @@ module Kobako
     #
     # Entry point:
     #
-    #   Kobako::Transport::Dispatcher.dispatch(request_bytes, namespaces, handler, yield_to_guest)
+    #   Kobako::Transport::Dispatcher.dispatch(request_bytes, services, handler, yield_to_guest)
     #   # => msgpack-encoded Response bytes (never raises)
     module Dispatcher
       # Throw tag for the Yielder's break unwind back to the
@@ -67,7 +67,7 @@ module Kobako
 
       # Dispatch a single transport request and return the encoded
       # Response bytes. Invoked from the +Runtime#on_dispatch+ Proc that
-      # +Kobako::Sandbox#initialize+ installs on the ext side; +namespaces+,
+      # +Kobako::Sandbox#initialize+ installs on the ext side; +services+,
       # +handler+, and +yield_to_guest+ are captured in that Proc's
       # closure so the Dispatcher stays stateless and the registry doesn't
       # need to publish accessors for the Sandbox-owned +Catalog::Handles+
@@ -77,24 +77,31 @@ module Kobako
       # returns a binary String — every failure path is reified as a
       # Response.error envelope so the guest sees a transport error rather
       # than a wasm trap.
-      def dispatch(request_bytes, namespaces, handler, yield_to_guest)
-        request = Kobako::Transport::Request.decode(request_bytes)
-        target = resolve_target(request.target, namespaces, handler)
-        args, kwargs = resolve_call_args(request, handler)
+      #
+      # The decode runs inside +Codec.track_handles+ so #resolve_call_args
+      # can skip the argument walk when no Capability Handle crossed the
+      # wire.
+      def dispatch(request_bytes, services, handler, yield_to_guest)
+        request, carried_handle = Kobako::Codec.track_handles { Kobako::Transport::Request.decode(request_bytes) }
+        target = resolve_target(request.target, services, handler)
+        args, kwargs = resolve_call_args(request, handler, carried_handle)
         yielder = Yielder.new(yield_to_guest, BREAK_THROW, handler) if request.block_given
-        value = catch(BREAK_THROW) { invoke(target, request.method_name, args, kwargs, yielder) }
-        encode_ok(value, handler)
+        encode_ok(catch(BREAK_THROW) { invoke(target, request.method_name, args, kwargs, yielder) }, handler)
       rescue StandardError => e
         encode_caught_error(e)
       ensure
         yielder&.invalidate!
       end
 
-      # Resolve positional and keyword arguments off +request+ in one
-      # step. Both pass through #resolve_arg so Capability Handles
-      # round-trip back to the host-side Ruby object before the call
-      # reaches +public_send+.
-      def resolve_call_args(request, handler)
+      # Resolve positional and keyword arguments off +request+ in one step.
+      # +carried_handle+ reports whether the decode carried any Capability
+      # Handle; when it did not, every argument resolves to itself, so the
+      # decoded values pass straight through and the walk is skipped entirely.
+      # Otherwise both go through #resolve_arg so Handles round-trip back to
+      # the host-side Ruby object before the call reaches +public_send+.
+      def resolve_call_args(request, handler, carried_handle)
+        return [request.args, request.kwargs] unless carried_handle
+
         [request.args.map { |v| resolve_arg(v, handler) },
          request.kwargs.transform_values { |v| resolve_arg(v, handler) }]
       end
@@ -187,17 +194,17 @@ module Kobako
       # Target type is already validated by +Transport::Request.decode+
       # before this method is reached, so no else-branch is needed here —
       # the wire layer is the system boundary that enforces the invariant.
-      def resolve_target(target, namespaces, handler)
+      def resolve_target(target, services, handler)
         case target
         when String
-          resolve_path(target, namespaces)
+          resolve_path(target, services)
         when Kobako::Handle
           require_live_object!(target.id, handler)
         end
       end
 
-      def resolve_path(path, namespaces)
-        namespaces.lookup(path)
+      def resolve_path(path, services)
+        services.lookup(path)
       rescue KeyError => e
         raise UndefinedTargetError, e.message
       end

data/lib/kobako/transport/request.rb

@@ -12,7 +12,7 @@ module Kobako
     #
     # 5-element msgpack array:
     # +[target, method_name, args, kwargs, block_given]+. +target+ is
-    # either a +String+ (+"<Namespace>::<Member>"+, e.g. +"MyService::KV"+)
+    # either a +String+ (+"MyService::KV"+, e.g. +"MyService::KV"+)
     # or a Handle. SPEC pins +kwargs+ map keys to ext 0x00 Symbol;
     # enforced at construction so the Value Object is the single source of
     # truth. +block_given+ is a Boolean signalling whether the guest call
@@ -44,16 +44,21 @@ module Kobako
       end
 
       # Decode +bytes+ into a Request. Raises +Codec::InvalidType+ when the
-      # envelope is not the expected 5-element msgpack array, or when the
-      # Value Object's construction invariants reject the decoded fields.
+      # envelope is not the expected 5-element msgpack array, when any
+      # position carries an ext 0x02 Fault envelope (a Request is a payload
+      # position; the Response fault field is the envelope's only home), or
+      # when the Value Object's construction invariants reject the decoded
+      # fields.
       def self.decode(bytes)
-        Codec::Decoder.decode(bytes) do |arr|
-          unless arr.is_a?(Array) && arr.length == 5
-            raise Codec::InvalidType, "Request envelope is malformed (expected a 5-element array)"
-          end
+        Codec.forbid_faults do
+          Codec::Decoder.decode(bytes) do |arr|
+            unless arr.is_a?(Array) && arr.length == 5
+              raise Codec::InvalidType, "Request envelope is malformed (expected a 5-element array)"
+            end
 
-          target, method_name, args, kwargs, block_given = arr
-          new(target: target, method_name: method_name, args: args, kwargs: kwargs, block_given: block_given)
+            target, method_name, args, kwargs, block_given = arr
+            new(target: target, method_name: method_name, args: args, kwargs: kwargs, block_given: block_given)
+          end
         end
       end
 

data/lib/kobako/transport/response.rb

@@ -53,9 +53,16 @@ module Kobako
       def error? = status == STATUS_ERROR
 
       # Encode this Response to msgpack bytes as the 2-element
-      # +[status, payload]+ array.
+      # +[status, payload]+ array. The ok variant's value is a payload
+      # position, so a +Kobako::Fault+ inside it has no wire
+      # representation and surfaces as +UnsupportedType+ — the
+      # Dispatcher's auto-wrap rescue turns it into a Capability Handle.
+      # The error variant carries the Fault envelope in its one legal
+      # position and encodes it plainly.
       def encode
-        Codec::Encoder.encode([status, payload])
+        return Codec::Encoder.encode([status, payload]) if error?
+
+        Codec.forbid_faults { Codec::Encoder.encode([status, payload]) }
       end
 
       # Decode +bytes+ into a Response. Raises +Codec::InvalidType+ when the

data/lib/kobako/transport/yield.rb

@@ -70,7 +70,10 @@ module Kobako
         body = bytes.byteslice(1, bytes.bytesize - 1) # : String
 
         reject_dead_tag!(tag)
-        new(tag: tag, value: Codec::Decoder.decode(body))
+        # A YieldResponse is a payload position: an ext 0x02 Fault in its
+        # value is a wire violation (the Response fault field is the
+        # envelope's only home).
+        new(tag: tag, value: Codec.forbid_faults { Codec::Decoder.decode(body) })
       end
 
       def self.reject_dead_tag!(tag)

data/lib/kobako/transport/yielder.rb

@@ -52,8 +52,14 @@ module Kobako
       def yield(*args)
         raise LocalJumpError, "guest block invoked after host dispatch frame returned" unless @active
 
-        response = Kobako::Transport::Yield.decode(@yield_to_guest.call(Kobako::Codec::Encoder.encode(args)))
-        return restore(response.value) if response.ok?
+        # Yield arguments are a payload position: a +Kobako::Fault+ among
+        # them has no wire representation, so the encode refuses it at
+        # this call site. The tracking bracket below opens only around the
+        # decode: the guest re-entry may run nested dispatches whose own
+        # brackets would otherwise pollute the signal.
+        bytes = @yield_to_guest.call(Kobako::Codec.forbid_faults { Kobako::Codec::Encoder.encode(args) })
+        response, carried_handle = Kobako::Codec.track_handles { Kobako::Transport::Yield.decode(bytes) }
+        return restore(response.value, carried_handle) if response.ok?
 
         throw @break_tag, response.value if response.break?
 
@@ -78,10 +84,12 @@ module Kobako
       # Restore any Capability Handle in a block's ok value to its host
       # object via the injected +Catalog::Handles+. Only the
       # ok path calls this — host code consumes the ok value, whereas a
-      # break value returns to the guest and stays a Handle. Walks nested
-      # Array / Hash one level at a time; a plain value passes through
-      # unchanged.
-      def restore(value)
+      # break value returns to the guest and stays a Handle. A response
+      # whose decode carried no Handle resolves to itself, so the walk is
+      # skipped entirely.
+      def restore(value, carried_handle)
+        return value unless carried_handle
+
         Kobako::Codec::HandleWalk.deep_restore(value, @handler)
       end
 

data/lib/kobako/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Kobako
-  VERSION = "0.14.0"
+  VERSION = "0.15.0"
 end

data/sig/kobako/catalog/services.rbs

@@ -0,0 +1,25 @@
+module Kobako
+  module Catalog
+    class Services
+      NAME_PATTERN: Regexp
+
+      def initialize: (?handler: Kobako::Catalog::Handles) -> void
+
+      def bind: (Symbol | String path, untyped object) -> self
+
+      def lookup: (Symbol | String target) -> untyped
+
+      def encode: () -> String
+
+      def seal!: () -> self
+
+      def sealed?: () -> bool
+
+      private
+
+      def validate_path!: (Symbol | String path) -> String
+
+      def collision?: (String path) -> bool
+    end
+  end
+end

data/sig/kobako/codec/ext_types.rbs

@@ -0,0 +1,31 @@
+module Kobako
+  module Codec
+    module ExtTypes
+      EXT_SYMBOL: Integer
+      EXT_HANDLE: Integer
+      EXT_ERRENV: Integer
+
+      def self?.build_factory: () -> MessagePack::Factory
+
+      def self?.pack_symbol: (Symbol symbol) -> String
+
+      def self?.unpack_symbol: (String payload) -> Symbol
+
+      def self?.pack_handle: (Kobako::Handle handle) -> String
+
+      def self?.unpack_handle: (String payload, State state) -> Kobako::Handle
+
+      def self?.pack_fault: (Kobako::Fault fault, State state) -> String
+
+      def self?.unpack_fault: (String payload, State state) -> Kobako::Fault
+
+      def self?.register_symbol: (MessagePack::Factory factory) -> void
+
+      def self?.register_handle: (MessagePack::Factory factory) -> void
+
+      def self?.register_fault: (MessagePack::Factory factory) -> void
+    end
+
+    FACTORY: MessagePack::Factory
+  end
+end

data/sig/kobako/codec/state.rbs

@@ -0,0 +1,20 @@
+module Kobako
+  module Codec
+    class State
+      MAX_EXT_DEPTH: Integer
+      STATE_KEY: Symbol
+
+      def self.current: () -> State
+
+      def track_handles: [T] { () -> T } -> [T, bool]
+      def record_handle!: () -> void
+      def forbid_faults: [T] { () -> T } -> T
+      def faults_forbidden?: () -> bool
+      def within_ext_frame: [T] (singleton(Kobako::Codec::Error) over_limit) { () -> T } -> T
+
+      private
+
+      def initialize: () -> void
+    end
+  end
+end

data/sig/kobako/codec.rbs

@@ -1,5 +1,8 @@
 module Kobako
   module Codec
+    def self.track_handles: [T] { () -> T } -> [T, bool]
+    def self.forbid_faults: [T] { () -> T } -> T
+
     # The Handle allocator/resolver a wire walk works against: alloc
     # registers a non-wire-representable object and returns its Handle,
     # fetch resolves a wire Handle id back to the live object. The

data/sig/kobako/sandbox.rbs

@@ -29,7 +29,7 @@ module Kobako
 
     attr_reader usage: Kobako::Usage
 
-    def define: (Symbol | String name) -> Kobako::Namespace
+    def bind: (Symbol | String path, untyped object) -> Kobako::Sandbox
 
     def preload: (code: String, name: Symbol | String) -> Kobako::Sandbox
                | (binary: String) -> Kobako::Sandbox

data/sig/kobako/transport/dispatcher.rbs

@@ -12,9 +12,9 @@ module Kobako
 
       CALLABLE_ALLOW: Array[Symbol]
 
-      def self?.dispatch: (String request_bytes, Kobako::Transport::_NamespaceRegistry namespaces, Kobako::Codec::_HandleTable handler, Kobako::Transport::_GuestYielder yield_to_guest) -> String
+      def self?.dispatch: (String request_bytes, Kobako::Transport::_ServiceRegistry services, Kobako::Codec::_HandleTable handler, Kobako::Transport::_GuestYielder yield_to_guest) -> String
 
-      def self?.resolve_call_args: (Kobako::Transport::Request request, Kobako::Codec::_HandleTable handler) -> [Array[untyped], Hash[Symbol, untyped]]
+      def self?.resolve_call_args: (Kobako::Transport::Request request, Kobako::Codec::_HandleTable handler, bool carried_handle) -> [Array[untyped], Hash[Symbol, untyped]]
 
       def self?.encode_caught_error: (StandardError error) -> String
 
@@ -26,9 +26,9 @@ module Kobako
 
       def self?.resolve_arg: (untyped value, Kobako::Codec::_HandleTable handler) -> untyped
 
-      def self?.resolve_target: (String | Kobako::Handle target, Kobako::Transport::_NamespaceRegistry namespaces, Kobako::Codec::_HandleTable handler) -> untyped
+      def self?.resolve_target: (String | Kobako::Handle target, Kobako::Transport::_ServiceRegistry services, Kobako::Codec::_HandleTable handler) -> untyped
 
-      def self?.resolve_path: (String path, Kobako::Transport::_NamespaceRegistry namespaces) -> untyped
+      def self?.resolve_path: (String path, Kobako::Transport::_ServiceRegistry services) -> untyped
 
       def self?.require_live_object!: (Integer id, Kobako::Codec::_HandleTable handler) -> untyped
 

data/sig/kobako/transport/yielder.rbs

@@ -16,7 +16,7 @@ module Kobako
 
       private
 
-      def restore: (untyped value) -> untyped
+      def restore: (untyped value, bool carried_handle) -> untyped
 
       def yield_failure: (untyped payload, default: String) -> RuntimeError
     end