@bytecodealliance/jco 1.33.0 → 1.35.0

package/lib/wit/builtin/jco-node-0.1.0/tls.wit

@@ -0,0 +1,108 @@
+package jco:node@0.1.0;
+
+/// Events are delivered after the initiating import returns, avoiding component reentrance.
+interface tls-callbacks {
+  record event {
+    target: u32,
+    name: string,
+    value: string,
+    data: list<u8>,
+  }
+
+  dispatch: func(event: event);
+}
+
+/// Primary TLS capability for Node APIs. Providers may delegate to wasi:tls.
+interface tls {
+  use wasi:io/streams@0.2.12.{input-stream, output-stream};
+  use wasi:tls/types@0.2.0-draft.{future-client-streams};
+
+  /// Optional TLS upgrade over existing WASI streams. Ownership passes to the provider.
+  is-available: func() -> bool;
+
+  start-tls: func(server-name: string, input: input-stream, output: output-stream) -> future-client-streams;
+
+  record error {
+    name: string,
+    message: string,
+    code: option<string>,
+  }
+
+  enum query-operation {
+    ciphers,
+    compression-algorithms,
+    ca-certificates,
+    check-identity,
+  }
+
+  enum socket-operation-kind {
+    state,
+    address,
+    certificate,
+    peer-certificate,
+    cipher,
+    ephemeral-key-info,
+    finished,
+    peer-finished,
+    protocol,
+    session,
+    shared-sigalgs,
+    tls-ticket,
+    session-reused,
+    export-keying-material,
+    disable-renegotiation,
+    enable-trace,
+    max-send-fragment,
+    key-cert,
+    timeout,
+    no-delay,
+    keep-alive,
+    ref,
+    unref,
+    resume,
+    pause,
+    destroy,
+    renegotiate,
+    set-session,
+    set-servername,
+  }
+
+  enum server-operation-kind {
+    state,
+    address,
+    listen,
+    close,
+    connections,
+    ref,
+    unref,
+    ticket-keys,
+    set-ticket-keys,
+    secure-context,
+    add-context,
+    max-connections,
+    drop-max-connection,
+  }
+
+  /// Options and inspection values use the documented TLS graph-data encoding.
+  query: func(operation: query-operation, args: string) -> result<string, error>;
+
+  set-default-ca: func(certs: string) -> result<_, error>;
+
+  create-context: func(options: string) -> result<u32, error>;
+
+  release-context: func(id: u32);
+
+  connect: func(id: u32, options: string) -> result<_, error>;
+
+  create-server: func(id: u32, options: string) -> result<_, error>;
+
+  socket-operation: func(id: u32, operation: socket-operation-kind, args: string) -> result<string, error>;
+
+  server-operation: func(id: u32, operation: server-operation-kind, args: string) -> result<string, error>;
+
+  write: func(id: u32, token: u32, data: list<u8>) -> result<_, error>;
+
+  end: func(id: u32, token: u32) -> result<_, error>;
+
+  release: func(id: u32);
+}

package/lib/wit/builtin/jco-node-0.1.0/trace-events.wit

@@ -0,0 +1,27 @@
+package jco:node@0.1.0;
+
+/// Host trace capture. Importing this interface does not grant the capability;
+/// applications must map it to a provider. The Node provider traces its host
+/// runtime and uses that process's trace categories, flags, and output files.
+interface trace-events {
+  record error {
+    name: string,
+    code: option<string>,
+    message: string,
+  }
+
+  /// Owns one enabled category set. Stop or drop releases only this owner's
+  /// categories; other sessions and host CLI categories remain enabled.
+  resource trace-session {
+    start: static func(categories: list<string>) -> result<trace-session, error>;
+
+    stop: func() -> result<_, error>;
+  }
+
+  /// Consume a stopped session. Explicit ownership transfer releases the guest
+  /// handle even on engines without a JavaScript resource disposal hook.
+  release: func(session: trace-session);
+
+  /// Sorted union of all enabled host categories, or none when empty.
+  get-enabled-categories: func() -> result<option<string>, error>;
+}

package/lib/wit/builtin/jco-node-0.1.0/tty.wit

@@ -0,0 +1,59 @@
+package jco:node@0.1.0;
+
+/// Terminal access for `node:tty`. No capability is granted by default; the Node provider exposes
+/// the terminals of the embedding process, addressed by file descriptor as Node does.
+interface tty {
+  use types.{env-vars};
+
+  variant errno {
+    number(s64),
+    symbolic(string),
+  }
+
+  /// The libuv failure Node attaches to `ERR_TTY_INIT_FAILED` as `info`.
+  record error-info {
+    errno: option<errno>,
+    code: option<string>,
+    message: option<string>,
+    syscall: option<string>,
+  }
+
+  record error {
+    name: string,
+    message: string,
+    code: option<string>,
+    errno: option<errno>,
+    syscall: option<string>,
+    info: option<error-info>,
+  }
+
+  /// Which side of a terminal a stream uses.
+  enum direction {
+    read,
+    write,
+  }
+
+  record terminal-size {
+    columns: u32,
+    rows: u32,
+  }
+
+  /// Whether `fd` refers to a terminal. The guest range-checks the descriptor first.
+  is-tty: func(fd: u32) -> result<bool, error>;
+  /// Acquire a terminal handle on `fd` for one direction. Fails the way Node's `uv_tty_init`
+  /// does when `fd` is not a terminal; a handle may be acquired more than once.
+  open: func(fd: u32, direction: direction) -> result<_, error>;
+  /// Release one acquisition of a handle. Raw mode is restored when the last read handle goes.
+  close: func(fd: u32, direction: direction) -> result<_, error>;
+  /// The terminal's current size; fails when the terminal does not report one.
+  window-size: func(fd: u32) -> result<terminal-size, error>;
+  /// Switch the terminal's input between cooked and raw mode.
+  set-raw-mode: func(fd: u32, enabled: bool) -> result<_, error>;
+  /// Block until input is available and return up to `max-bytes` of it; an empty list is the
+  /// end of input.
+  read: func(fd: u32, max-bytes: u32) -> result<list<u8>, error>;
+  /// Write all of `data` before returning.
+  write: func(fd: u32, data: list<u8>) -> result<_, error>;
+  /// The environment `getColorDepth()` and `hasColors()` consult when none is passed.
+  environment: func() -> result<env-vars, error>;
+}

package/lib/wit/builtin/jco-node-0.1.0/v8.wit

@@ -0,0 +1,102 @@
+package jco:node@0.1.0;
+
+/// Explicit access to a host V8 isolate. Diagnostics describe the host engine.
+/// Structured graphs are private transport; returned serialization bytes use native V8 format.
+interface v8 {
+  variant errno {
+    number(s64),
+    symbolic(string),
+  }
+
+  record error {
+    name: string,
+    message: string,
+    code: option<string>,
+    errno: option<errno>,
+    syscall: option<string>,
+  }
+
+  enum statistics-kind {
+    heap,
+    spaces,
+    code,
+    cpp-brief,
+    cpp-detailed,
+  }
+
+  record snapshot-options {
+    expose-internals: option<bool>,
+    expose-numeric-values: option<bool>,
+  }
+
+  cached-data-version-tag: func() -> result<u32, error>;
+
+  /// JSON retains the version-specific native diagnostic schema.
+  statistics: func(kind: statistics-kind) -> result<string, error>;
+
+  get-heap-snapshot: func(options: snapshot-options) -> result<list<u8>, error>;
+
+  write-heap-snapshot: func(
+    filename: option<string>,
+    options: snapshot-options,
+  ) -> result<string, error>;
+
+  set-flags-from-string: func(%flags: string) -> result<_, error>;
+
+  take-coverage: func() -> result<_, error>;
+
+  stop-coverage: func() -> result<_, error>;
+
+  set-heap-snapshot-near-heap-limit: func(limit: u32) -> result<_, error>;
+
+  open-writer: func(defaults: bool) -> result<writer, error>;
+
+  open-reader: func(data: list<u8>, defaults: bool) -> result<reader, error>;
+
+  start-profile: func(cpu: bool) -> result<profile, error>;
+
+  /// Consuming a handle releases the corresponding native state.
+  release-writer: func(handle: writer);
+
+  release-reader: func(handle: reader);
+
+  release-profile: func(handle: profile);
+
+  resource writer {
+    write-header: func() -> result<_, error>;
+
+    write-value: func(graph: string) -> result<bool, error>;
+
+    release-buffer: func() -> result<list<u8>, error>;
+
+    write-uint32: func(value: f64) -> result<_, error>;
+
+    write-uint64: func(hi: f64, lo: f64) -> result<_, error>;
+
+    write-double: func(value: f64) -> result<_, error>;
+
+    write-raw-bytes: func(data: list<u8>) -> result<_, error>;
+
+    set-treat-views-as-host-objects: func(flag: bool) -> result<_, error>;
+  }
+
+  resource reader {
+    read-header: func() -> result<bool, error>;
+
+    read-value: func() -> result<string, error>;
+
+    get-wire-format-version: func() -> result<u32, error>;
+
+    read-uint32: func() -> result<u32, error>;
+
+    read-uint64: func() -> result<tuple<u32, u32>, error>;
+
+    read-double: func() -> result<f64, error>;
+
+    read-raw-bytes: func(length: f64) -> result<list<u8>, error>;
+  }
+
+  resource profile {
+    stop: func() -> result<option<string>, error>;
+  }
+}

package/lib/wit/builtin/jco-node-0.1.0/wasi.wit

@@ -0,0 +1,57 @@
+package jco:node@0.1.0;
+
+/// Host initialisation for `node:wasi`.
+///
+/// Node's `new WASI(options)` validates its options in JavaScript and then initialises a uvwasi
+/// context, which opens every preopen and checks the standard descriptors. That initialisation is
+/// the only part of `node:wasi` a component can hand to a host: everything after it (`start`,
+/// `initialize`, the `wasiImport` syscalls) reads and writes the linear memory of a core
+/// WebAssembly instance the guest created itself, and a component can neither instantiate a
+/// nested module nor share a memory across the component boundary. The interface therefore
+/// exposes initialisation alone and returns no handle, since nothing could be done with one.
+///
+/// No capability is granted by default; the Node provider runs the real `node:wasi` constructor.
+interface wasi {
+  use types.{env-vars};
+
+  variant errno {
+    number(s64),
+    symbolic(string),
+  }
+
+  /// The failure Node raises when `uvwasi_init` rejects the options: a plain `Error` whose
+  /// `code` is a `UVWASI_*` name (`UVWASI_ENOENT` for a missing preopen, `UVWASI_ENOTDIR` for
+  /// a preopen that is not a directory, `UVWASI_EBADF` for a closed descriptor), with the
+  /// numeric uvwasi `errno` and `syscall` set to `uvwasi_init`.
+  record error {
+    name: string,
+    message: string,
+    code: option<string>,
+    errno: option<errno>,
+    syscall: option<string>,
+  }
+
+  /// The WASI snapshot the module targets; selects the import namespace Node binds.
+  enum version {
+    unstable,
+    preview1,
+  }
+
+  /// `new WASI(options)` after Node's validation and normalisation of every field.
+  record options {
+    version: version,
+    /// Command-line arguments, already coerced to strings.
+    args: list<string>,
+    /// Environment entries with `undefined` values already dropped and values coerced.
+    env: env-vars,
+    /// Guest path to host path, in the order `Object.entries` yields them.
+    preopens: list<tuple<string, string>>,
+    stdin: u32,
+    stdout: u32,
+    stderr: u32,
+  }
+
+  /// Initialise a WASI context for `options` exactly as Node's constructor does, failing the way
+  /// `uvwasi_init` fails. The context is discarded: it cannot be linked to a module from a guest.
+  init: func(options: options) -> result<_, error>;
+}

package/lib/wit/builtin/jco-node-0.1.0/worker-threads.wit

@@ -0,0 +1,67 @@
+package jco:node@0.1.0;
+
+/// Explicit authority to execute worker scripts on the host. Data uses a private
+/// structured-value graph encoding; native handles and shared memory are refused.
+interface worker-threads {
+    variant errno {
+        number(s64),
+        symbolic(string),
+    }
+
+    record error {
+        name: string,
+        message: string,
+        code: option<string>,
+        errno: option<errno>,
+        syscall: option<string>,
+    }
+
+    record resource-limits {
+        max-young-generation-size-mb: option<f64>,
+        max-old-generation-size-mb: option<f64>,
+        code-range-size-mb: option<f64>,
+        stack-size-mb: option<f64>,
+    }
+
+    record worker-info {
+        thread-id: s32,
+        thread-name: string,
+        resource-limits: resource-limits,
+    }
+
+    create-worker: func(
+        filename: string,
+        options: string,
+        environment: string,
+        listener: u32,
+    ) -> result<worker, error>;
+
+    resource worker {
+        post-message: func(value: string) -> result<_, error>;
+
+        terminate: func();
+
+        set-ref: func(value: bool);
+
+        info: func() -> worker-info;
+    }
+}
+
+/// A provider serializes callback entry and resource drops per component.
+interface worker-threads-callbacks {
+    use worker-threads.{error};
+
+    variant worker-event {
+        online,
+        message(string),
+        messageerror(error),
+        error(error),
+        exit(s32),
+    }
+
+    resource worker-listener {
+        event: func(event: worker-event);
+    }
+
+    take-worker-listener: func(id: u32) -> option<worker-listener>;
+}

package/lib/wit/builtin/jco-node-0.1.0/zlib.wit

@@ -0,0 +1,77 @@
+package jco:node@0.1.0;
+
+/// Compression capability. Denied by default; explicitly map a host provider to enable it.
+/// Byte arrays and native compression settings cross this boundary, never Node stream objects.
+interface zlib {
+  variant errno {
+    number(s64),
+    symbolic(string),
+  }
+
+  record error {
+    name: string,
+    message: string,
+    code: option<string>,
+    errno: option<errno>,
+    syscall: option<string>,
+  }
+
+  enum algorithm {
+    deflate,
+    inflate,
+    gzip,
+    gunzip,
+    deflateraw,
+    inflateraw,
+    unzip,
+    brotlicompress,
+    brotlidecompress,
+    zstdcompress,
+    zstddecompress,
+  }
+
+  record options {
+    flush: option<f64>,
+    finish-flush: option<f64>,
+    chunk-size: option<f64>,
+    window-bits: option<f64>,
+    level: option<f64>,
+    mem-level: option<f64>,
+    strategy: option<f64>,
+    max-output-length: option<f64>,
+    pledged-src-size: option<f64>,
+    reject-garbage-after-end: option<bool>,
+    dictionary: option<list<u8>>,
+    params: option<list<tuple<string, f64>>>,
+  }
+
+  record output {
+    data: list<u8>,
+    bytes-written: f64,
+  }
+
+  compress: func(
+    algorithm: algorithm,
+    data: list<u8>,
+    options: options,
+  ) -> result<output, error>;
+
+  crc32: func(data: list<u8>, value: u32) -> result<u32, error>;
+
+  open: func(algorithm: algorithm, options: options) -> result<engine, error>;
+
+  /// Owns native state. Explicit close or resource drop releases it.
+  resource engine {
+    write: func(data: list<u8>) -> result<output, error>;
+
+    finish: func() -> result<output, error>;
+
+    flush: func(kind: f64) -> result<output, error>;
+
+    params: func(level: f64, strategy: f64) -> result<output, error>;
+
+    reset: func() -> result<_, error>;
+
+    close: func() -> result<_, error>;
+  }
+}

package/lib/wit/builtin/wasi-tls-0.2.0-draft/LICENSE.md

@@ -0,0 +1,8 @@
+Copyright © 2019-2023 the Contributors to the WASI Specification, published
+by the [WebAssembly Community Group][cg] under the
+[W3C Community Contributor License Agreement (CLA)][cla]. A human-readable
+[summary][summary] is available.
+
+[cg]: https://www.w3.org/community/webassembly/
+[cla]: https://www.w3.org/community/about/agreements/cla/
+[summary]: https://www.w3.org/community/about/agreements/cla-deed/

package/lib/wit/builtin/wasi-tls-0.2.0-draft/README.md

@@ -0,0 +1,25 @@
+# Local WASI TLS contract
+
+This is a slightly modified copy of [WebAssembly/wasi-tls](https://github.com/WebAssembly/wasi-tls/tree/6781ae26084100c0628ef72cc44e4517c6c48ae5/wit)
+at revision `6781ae26084100c0628ef72cc44e4517c6c48ae5`, under the W3C Community
+Contributor License Agreement (see LICENSE.md).
+
+It provides a provisional, shared interface for TLS implementations on Node.js,
+the web, and other host platforms. It is not an unmodified upstream standard or
+a claim that every host platform already has an implementation.
+
+Local changes:
+
+- Use `wasi:io@0.2.12` instead of `0.2.6`, sharing the sockets implementation's
+  stream resources directly without version bridging. IO WIT is copied from
+  Jco's existing `builtin/0.2.12/wasi-io/package.wit`.
+- Add `is-available`, a side-effect-free capability query so denied TLS requests
+  fail before acquiring TCP resources.
+- Omit upstream unstable-feature annotations so normal WIT tooling can consume
+  this explicitly imported local contract without TLS-specific feature handling.
+
+The package retains `wasi:tls@0.2.0-draft`.
+Hosts must implement this local contract. The upstream client handshake,
+future polling, stream ownership, and output shutdown operations are retained.
+Server TLS and guest trust/ALPN configuration remain outside the contract;
+certificate verification and trust are host policy. No wit-deps tooling is used.

package/lib/wit/builtin/wasi-tls-0.2.0-draft/deps/io/package.wit

@@ -0,0 +1,66 @@
+package wasi:io@0.2.12;
+interface error {
+    resource error {
+        to-debug-string: func() -> string;
+    }
+}
+interface poll {
+    resource pollable {
+        ready: func() -> bool;
+        block: func();
+    }
+    poll: func(in: list<borrow<pollable>>) -> list<u32>;
+}
+interface streams {
+    use error.{error};
+    use poll.{pollable};
+    variant stream-error {
+        last-operation-failed(error),
+        closed
+    }
+    resource input-stream {
+        read: func(
+            len: u64
+        ) -> result<list<u8>, stream-error>;
+        blocking-read: func(
+            len: u64
+        ) -> result<list<u8>, stream-error>;
+        skip: func(
+            len: u64,
+        ) -> result<u64, stream-error>;
+        blocking-skip: func(
+            len: u64,
+        ) -> result<u64, stream-error>;
+        subscribe: func() -> pollable;
+    }
+    resource output-stream {
+        check-write: func() -> result<u64, stream-error>;
+        write: func(
+            contents: list<u8>
+        ) -> result<_, stream-error>;
+        blocking-write-and-flush: func(
+            contents: list<u8>
+        ) -> result<_, stream-error>;
+        flush: func() -> result<_, stream-error>;
+        blocking-flush: func() -> result<_, stream-error>;
+        subscribe: func() -> pollable;
+        write-zeroes: func(
+            len: u64
+        ) -> result<_, stream-error>;
+        blocking-write-zeroes-and-flush: func(
+            len: u64
+        ) -> result<_, stream-error>;
+        splice: func(
+            src: borrow<input-stream>,
+            len: u64,
+        ) -> result<u64, stream-error>;
+        blocking-splice: func(
+            src: borrow<input-stream>,
+            len: u64,
+        ) -> result<u64, stream-error>;
+    }
+}
+world imports {
+    import streams;
+    import poll;
+}

package/lib/wit/builtin/wasi-tls-0.2.0-draft/types.wit

@@ -0,0 +1,27 @@
+// Adapted from WebAssembly/wasi-tls wit/types.wit,
+// 6781ae26084100c0628ef72cc44e4517c6c48ae5 (W3C Community CLA).
+// Local changes: wasi:io@0.2.12 and an availability query. See README.md.
+interface types {
+    /// Whether the host grants TLS connections. This query performs no IO.
+    is-available: func() -> bool;
+
+    use wasi:io/streams@0.2.12.{input-stream, output-stream};
+    use wasi:io/poll@0.2.12.{pollable};
+    use wasi:io/error@0.2.12.{error as io-error};
+
+    resource client-handshake {
+        constructor(server-name: string, input: input-stream, output: output-stream);
+
+        finish: static func(this: client-handshake) -> future-client-streams;
+    }
+
+    resource client-connection {
+        close-output: func();
+    }
+
+    resource future-client-streams {
+        subscribe: func() -> pollable;
+
+        get: func() -> option<result<result<tuple<client-connection, input-stream, output-stream>, io-error>>>;
+    }
+}

package/lib/wit/builtin/wasi-tls-0.2.0-draft/world.wit

@@ -0,0 +1,8 @@
+// Adapted from WebAssembly/wasi-tls wit/world.wit at
+// 6781ae26084100c0628ef72cc44e4517c6c48ae5 (W3C Community CLA).
+// Local change: omit unstable-feature gates; see README.md.
+package wasi:tls@0.2.0-draft;
+
+world imports {
+    import types;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bytecodealliance/jco",
-  "version": "1.33.0",
+  "version": "1.35.0",
   "description": "JavaScript tooling for working with WebAssembly Components",
   "keywords": [
     "Component",
@@ -50,13 +50,14 @@
   "dependencies": {
     "@bytecodealliance/componentize-js": "^0.22.0",
     "@bytecodealliance/componentize-js-0-19-3": "npm:@bytecodealliance/componentize-js@^0.19.3",
-    "@bytecodealliance/jco-std": "^0.3.1",
-    "@bytecodealliance/jco-transpile": "^0.13.0",
-    "@bytecodealliance/preview2-shim": "^0.24.1",
+    "@bytecodealliance/jco-std": "^0.5.0",
+    "@bytecodealliance/jco-transpile": "^0.15.0",
+    "@bytecodealliance/preview2-shim": "^0.26.0",
     "binaryen": "^130.0.0",
     "commander": "^14",
-    "componentize-qjs": "^0.4.2",
+    "componentize-qjs": "^0.4.5",
     "mkdirp": "^3",
+    "regexpu-core": "6.4.0",
     "rolldown": "^1.2.4",
     "typescript": "7.0.2",
     "typescript-compiler-api": "npm:typescript@6.0.3",
@@ -67,12 +68,13 @@
     "@types/node": "^24.3.0",
     "commitlint": "^19.8.1",
     "conventional-changelog-conventionalcommits": "^9.1.0",
+    "express": "^5.2.1",
     "mime": "^4.0.7",
     "oxfmt": "^0.28.0",
     "puppeteer": "^25.1.0",
     "semver": "^7.7.1",
     "vite": "^7.1.5",
-    "vitest": "^4.1.0",
+    "vitest": "^4.1.11",
     "which": "^2.0.2"
   },
   "scripts": {