@bytecodealliance/preview2-shim 0.23.0 → 0.24.0

package/dist/io/worker-thread.bundle.js

@@ -10,7 +10,7 @@ import { Server, Socket, isIP } from "node:net";
 import { lookup } from "node:dns/promises";
 import { createSocket } from "node:dgram";
 import { ALL, BADFAMILY, CANCELLED, CONNREFUSED, NODATA, NOMEM, NONAME, NOTFOUND, REFUSED, SERVFAIL, TIMEOUT, V4MAPPED } from "node:dns";
-import { EACCES, EADDRINUSE, EADDRNOTAVAIL, EALREADY, EBADF, ECONNABORTED, ECONNREFUSED, ECONNRESET, EINVAL, ENOBUFS, ENOMEM, ENOTCONN, ENOTSUP, EPERM, EWOULDBLOCK } from "node:constants";
+import { EACCES, EADDRINUSE, EADDRNOTAVAIL, EALREADY, EBADF, ECONNABORTED, ECONNREFUSED, ECONNRESET, EHOSTUNREACH, EINVAL, EMFILE, EMSGSIZE, ENETDOWN, ENETUNREACH, ENFILE, ENOBUFS, ENOMEM, ENOTCONN, ENOTSUP, EPERM, EWOULDBLOCK } from "node:constants";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;
 var __exportAll = (all, no_symbols) => {
@@ -611,11 +611,18 @@ function convertSocketError(err) {
 		case "ENOBUFS": return "out-of-memory";
 		case "EALREADY": return "concurrency-conflict";
 		case "EWOULDBLOCK": return "would-block";
+		case "EMFILE":
+		case "ENFILE": return "new-socket-limit";
 		case "EADDRNOTAVAIL": return "address-not-bindable";
 		case "EADDRINUSE": return "address-in-use";
+		case "EHOSTUNREACH":
+		case "EHOSTDOWN":
+		case "ENETUNREACH":
+		case "ENETDOWN": return "remote-unreachable";
 		case "ECONNREFUSED": return "connection-refused";
 		case "ECONNRESET": return "connection-reset";
 		case "ECONNABORTED": return "connection-aborted";
+		case "EMSGSIZE": return "datagram-too-large";
 		default: return "unknown";
 	}
 }
@@ -633,13 +640,19 @@ function convertSocketErrorCode(code) {
 		case ENOBUFS: return "out-of-memory";
 		case EALREADY: return "concurrency-conflict";
 		case EWOULDBLOCK: return "would-block";
+		case EMFILE:
+		case ENFILE: return "new-socket-limit";
 		case 4090:
 		case EADDRNOTAVAIL: return "address-not-bindable";
 		case 4091:
 		case EADDRINUSE: return "address-in-use";
+		case EHOSTUNREACH:
+		case ENETUNREACH:
+		case ENETDOWN: return "remote-unreachable";
 		case ECONNREFUSED: return "connection-refused";
 		case ECONNRESET: return "connection-reset";
 		case ECONNABORTED: return "connection-aborted";
+		case EMSGSIZE: return "datagram-too-large";
 		default: return "unknown";
 	}
 }
@@ -687,13 +700,14 @@ function ipv4ToTuple(ipv4) {
 	return ipv4.split(".").map((segment) => parseInt(segment, 10));
 }
 function ipSocketAddress(family, addr, port) {
-	if (family === "ipv4") return {
+	if (family === "ipv4" || family === "IPv4" || family === 4) return {
 		tag: "ipv4",
 		val: {
 			port,
 			address: ipv4ToTuple(addr)
 		}
 	};
+	if (family !== "ipv6" && family !== "IPv6" && family !== 6) throw "invalid-argument";
 	return {
 		tag: "ipv6",
 		val: {
@@ -789,7 +803,7 @@ function socketTcpBindStart(id, localAddress, family) {
 				reject("invalid-state");
 				return;
 			}
-			socket.localAddress = ipSocketAddress(boundAddress.family.toLowerCase(), boundAddress.address, boundAddress.port);
+			socket.localAddress = ipSocketAddress(boundAddress.family, boundAddress.address, boundAddress.port);
 			resolve();
 		}
 		server.once("listening", handleListen);
@@ -915,14 +929,14 @@ function socketTcpSetListenBacklogSize(id, backlogSize) {
 function socketTcpGetLocalAddress(id) {
 	const socket = tcpSockets.get(id);
 	const address = socket.tcpSocket?.address();
-	if (address && typeof address !== "string" && "family" in address) return ipSocketAddress(address.family.toLowerCase(), address.address, address.port);
+	if (address && typeof address !== "string" && "family" in address) return ipSocketAddress(address.family, address.address, address.port);
 	if (socket.localAddress) return socket.localAddress;
 	throw "invalid-state";
 }
 function socketTcpGetRemoteAddress(id) {
 	const { tcpSocket } = tcpSockets.get(id);
 	if (!tcpSocket?.remoteFamily || !tcpSocket.remoteAddress || !tcpSocket.remotePort) throw "invalid-state";
-	return ipSocketAddress(tcpSocket.remoteFamily.toLowerCase(), tcpSocket.remoteAddress, tcpSocket.remotePort);
+	return ipSocketAddress(tcpSocket.remoteFamily, tcpSocket.remoteAddress, tcpSocket.remotePort);
 }
 function socketTcpShutdown(id, _shutdownType) {
 	const socket = tcpSockets.get(id);
@@ -1000,10 +1014,9 @@ function createIncomingDatagramStream(socket) {
 		udpSocket.off("error", onError);
 	}
 	function onMessage(data, rinfo) {
-		const family = rinfo.family.toLowerCase();
 		datagramStream.queue?.push({
 			data,
-			remoteAddress: ipSocketAddress(family, rinfo.address, rinfo.port)
+			remoteAddress: ipSocketAddress(rinfo.family, rinfo.address, rinfo.port)
 		});
 		if (!pollState.ready) pollStateReady(pollState);
 	}
@@ -1089,7 +1102,7 @@ function socketUdpGetLocalAddress(id) {
 	} catch (err) {
 		throw convertSocketError(err);
 	}
-	return ipSocketAddress(family.toLowerCase(), address, port);
+	return ipSocketAddress(family, address, port);
 }
 /**
 * @param {number} id
@@ -1103,7 +1116,7 @@ function socketUdpGetRemoteAddress(id) {
 	} catch (err) {
 		throw convertSocketError(err);
 	}
-	return ipSocketAddress(family.toLowerCase(), address, port);
+	return ipSocketAddress(family, address, port);
 }
 function socketUdpStream(id, remoteAddress) {
 	const socket = udpSockets.get(id);

package/dist/nodejs/filesystem.d.ts

@@ -75,6 +75,13 @@ declare class Descriptor implements IDescriptor {
 }
 export declare const preopens: typeof PreopensNamespace;
 export declare const types: typeof TypesNamespace;
+/** Create isolated filesystem namespaces from Node.js host-path preopens. */
+export declare function createFilesystem({ preopens }: {
+    preopens: Record<string, string>;
+}): {
+    types: typeof TypesNamespace;
+    preopens: typeof PreopensNamespace;
+};
 /**
  * Replace all preopens with the given set.
  * @param {Record<string, string>} preopens - Map of virtual paths to host paths

package/dist/nodejs/filesystem.js

@@ -1,6 +1,6 @@
 import { earlyDispose, inputStreamCreate, ioCall, outputStreamCreate, registerDispose, } from "../io/worker-io.js";
 import { FILE, FILESYSTEM_DESCRIPTOR_ADVISE, FILESYSTEM_DESCRIPTOR_CLOSE, FILESYSTEM_DESCRIPTOR_GET_TYPE, FILESYSTEM_DESCRIPTOR_METADATA_HASH, FILESYSTEM_DESCRIPTOR_OPEN, FILESYSTEM_DESCRIPTOR_READ, FILESYSTEM_DESCRIPTOR_SET_SIZE, FILESYSTEM_DESCRIPTOR_SET_TIMES, FILESYSTEM_DESCRIPTOR_STAT, FILESYSTEM_DESCRIPTOR_SYNC, FILESYSTEM_DESCRIPTOR_SYNC_DATA, FILESYSTEM_DESCRIPTOR_WRITE, INPUT_STREAM_CREATE, OUTPUT_STREAM_CREATE, } from "../io/calls.js";
-import { constants, linkSync, lstatSync, lutimesSync, mkdirSync, opendirSync, readlinkSync, renameSync, rmdirSync, statSync, symlinkSync, unlinkSync, utimesSync, } from "node:fs";
+import { constants, linkSync, lstatSync, lutimesSync, mkdirSync, opendirSync, readlinkSync, realpathSync, renameSync, rmdirSync, statSync, symlinkSync, unlinkSync, utimesSync, } from "node:fs";
 import { platform } from "node:process";
 const symbolDispose = Symbol.dispose || Symbol.for("dispose");
 const isWindows = platform === "win32";
@@ -226,7 +226,7 @@ class Descriptor {
         }
     }
     createDirectoryAt(path) {
-        const fullPath = this.#getFullPath(path, undefined);
+        const fullPath = this.#getFullPath(path);
         try {
             mkdirSync(fullPath);
         }
@@ -256,7 +256,7 @@ class Descriptor {
         };
     }
     statAt(pathFlags, path) {
-        const fullPath = this.#getFullPath(path, false);
+        const fullPath = this.#getFullPath(path);
         let stats;
         try {
             stats = (pathFlags.symlinkFollow ? statSync : lstatSync)(fullPath, {
@@ -277,7 +277,7 @@ class Descriptor {
         };
     }
     setTimesAt(pathFlags, path, dataAccessTimestamp, dataModificationTimestamp) {
-        const fullPath = this.#getFullPath(path, false);
+        const fullPath = this.#getFullPath(path);
         let stats;
         if (dataAccessTimestamp.tag === "no-change" ||
             dataModificationTimestamp.tag === "no-change") {
@@ -297,14 +297,32 @@ class Descriptor {
         }
     }
     linkAt(oldPathFlags, oldPath, newDescriptor, newPath) {
-        const oldFullPath = this.#getFullPath(oldPath, oldPathFlags.symlinkFollow);
-        const newFullPath = newDescriptor.#getFullPath(newPath, false);
+        const oldFullPath = this.#getFullPath(oldPath);
+        const newFullPath = newDescriptor.#getFullPath(newPath);
         // Windows doesn't automatically fail on trailing slashes
         if (isWindows && newFullPath.endsWith("/")) {
             throw "no-entry";
         }
         try {
-            linkSync(oldFullPath, newFullPath);
+            // Unlike open/stat, Node's link does not follow the final symlink.
+            // Resolve only this operation's source, propagating resolution errors
+            // instead of silently hard-linking a dangling or cyclic symlink.
+            let source = oldFullPath;
+            if (oldPathFlags.symlinkFollow) {
+                source = realpathSync(source);
+                // realpath strips trailing slashes; keep the caller's directory
+                // requirement so a regular-file source ending in '/' still fails.
+                if (oldFullPath.endsWith("/")) {
+                    // Windows may ignore a trailing slash even in linkSync.
+                    if (!statSync(source).isDirectory()) {
+                        throw "not-directory";
+                    }
+                    if (!source.endsWith("/")) {
+                        source += "/";
+                    }
+                }
+            }
+            linkSync(source, newFullPath);
         }
         catch (e) {
             throw convertFsError(e);
@@ -314,7 +332,7 @@ class Descriptor {
         if (preopenEntries.length === 0) {
             throw "access";
         }
-        const fullPath = this.#getFullPath(path, pathFlags.symlinkFollow);
+        const fullPath = this.#getFullPath(path);
         let fsOpenFlags = 0x0;
         if (openFlags.create) {
             fsOpenFlags |= constants.O_CREAT;
@@ -384,6 +402,15 @@ class Descriptor {
                 path: fullPath.endsWith("/") ? fullPath.slice(0, -1) : fullPath,
                 flags: fsOpenFlags,
             });
+            // Wasmtime's updated path_open_preopen test requires ISDIR for a
+            // writable directory on every platform.
+            //
+            // Windows may still open it, so check the returned descriptor type.
+            if (type === "directory" && descriptorFlags.write) {
+                // Release the opened handle before reporting the error.
+                closeFileResource(id);
+                throw "is-directory";
+            }
             const descriptor = descriptorCreate(id, descriptorFlags, fullPath);
             if (fullPath.endsWith("/") && type !== "directory") {
                 descriptor[symbolDispose]();
@@ -399,7 +426,7 @@ class Descriptor {
         }
     }
     readlinkAt(path) {
-        const fullPath = this.#getFullPath(path, false);
+        const fullPath = this.#getFullPath(path);
         try {
             return readlinkSync(fullPath);
         }
@@ -408,7 +435,7 @@ class Descriptor {
         }
     }
     removeDirectoryAt(path) {
-        const fullPath = this.#getFullPath(path, false);
+        const fullPath = this.#getFullPath(path);
         try {
             rmdirSync(fullPath);
         }
@@ -420,8 +447,8 @@ class Descriptor {
         }
     }
     renameAt(oldPath, newDescriptor, newPath) {
-        const oldFullPath = this.#getFullPath(oldPath, false);
-        const newFullPath = newDescriptor.#getFullPath(newPath, false);
+        const oldFullPath = this.#getFullPath(oldPath);
+        const newFullPath = newDescriptor.#getFullPath(newPath);
         try {
             renameSync(oldFullPath, newFullPath);
         }
@@ -433,7 +460,7 @@ class Descriptor {
         }
     }
     symlinkAt(target, path) {
-        const fullPath = this.#getFullPath(path, false);
+        const fullPath = this.#getFullPath(path);
         if (target.startsWith("/")) {
             throw "not-permitted";
         }
@@ -462,7 +489,7 @@ class Descriptor {
         }
     }
     unlinkFileAt(path) {
-        const fullPath = this.#getFullPath(path, false);
+        const fullPath = this.#getFullPath(path);
         try {
             if (fullPath.endsWith("/")) {
                 let isDir = false;
@@ -504,7 +531,7 @@ class Descriptor {
         }
     }
     metadataHashAt(pathFlags, path) {
-        const fullPath = this.#getFullPath(path, false);
+        const fullPath = this.#getFullPath(path);
         try {
             const stats = (pathFlags.symlinkFollow ? statSync : lstatSync)(fullPath, {
                 bigint: true,
@@ -515,8 +542,8 @@ class Descriptor {
             throw convertFsError(e);
         }
     }
-    // TODO: support followSymlinks
-    #getFullPath(subpath, _followSymlinks) {
+    // Join paths lexically; each operation supplies its own symlink semantics.
+    #getFullPath(subpath) {
         let descriptor = this;
         if (subpath.indexOf("\\") !== -1) {
             subpath = subpath.replace(/\\/g, "/");
@@ -567,12 +594,18 @@ class Descriptor {
             segments.push(subpath.slice(segmentIndex));
         }
         subpath = segments.join("");
-        if (descriptor.#hostPreopen) {
-            return (descriptor.#hostPreopen +
+        // The default Windows preopen represents all drives.
+        //
+        // Convert drive paths to namespaced paths so joining them to the preopen
+        // does not produce an invalid UNC server name such as //C:/Users/...
+        if (isWindows && descriptor.#hostPreopen === "//" && /^[a-zA-Z]:\//.test(subpath)) {
+            return "//?/" + subpath;
+        }
+        return descriptor.#hostPreopen
+            ? descriptor.#hostPreopen +
                 (descriptor.#hostPreopen.endsWith("/") ? "" : subpath.length > 0 ? "/" : "") +
-                subpath);
-        }
-        return descriptor.#fullPath + (subpath.length > 0 ? "/" : "") + subpath;
+                subpath
+            : descriptor.#fullPath + (subpath.length > 0 ? "/" : "") + subpath;
     }
 }
 const descriptorCreatePreopen = Descriptor._createPreopen;
@@ -629,6 +662,16 @@ export const types = {
         return convertFsError(err.payload);
     },
 };
+/** Create isolated filesystem namespaces from Node.js host-path preopens. */
+export function createFilesystem({ preopens }) {
+    const entries = Object.entries(preopens).map(([virtualPath, hostPath]) => [descriptorCreatePreopen(hostPath), virtualPath]);
+    return {
+        types,
+        preopens: {
+            getDirectories: () => [...entries],
+        },
+    };
+}
 /**
  * Replace all preopens with the given set.
  * @param {Record<string, string>} preopens - Map of virtual paths to host paths

package/dist/nodejs/sockets.d.ts

@@ -18,4 +18,17 @@ export declare const tcpCreateSocket: typeof TcpCreateSocketNamespace;
 export declare const tcp: typeof TcpNamespace;
 export declare const udpCreateSocket: typeof UdpCreateSocketNamespace;
 export declare const udp: typeof UdpNamespace;
+export interface SocketsConfig {
+    enableNetwork?: boolean;
+}
+/** Create socket namespaces with an instance-local network capability. */
+export declare function createSockets(config?: SocketsConfig): {
+    instanceNetwork: typeof InstanceNetworkNamespace;
+    network: typeof NetworkNamespace;
+    ipNameLookup: typeof IpNameLookupNamespace;
+    tcpCreateSocket: typeof TcpCreateSocketNamespace;
+    tcp: typeof TcpNamespace;
+    udpCreateSocket: typeof UdpCreateSocketNamespace;
+    udp: typeof UdpNamespace;
+};
 export {};

package/dist/nodejs/sockets.js

@@ -480,3 +480,23 @@ export const udp = {
     OutgoingDatagramStream,
     IncomingDatagramStream,
 };
+/** Create socket namespaces with an instance-local network capability. */
+export function createSockets(config = {}) {
+    const localNetwork = new Network();
+    if (config.enableNetwork === false) {
+        _denyDnsLookup(localNetwork);
+        _denyTcp(localNetwork);
+        _denyUdp(localNetwork);
+    }
+    return {
+        instanceNetwork: {
+            instanceNetwork: () => localNetwork,
+        },
+        network,
+        ipNameLookup,
+        tcpCreateSocket,
+        tcp,
+        udpCreateSocket,
+        udp,
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bytecodealliance/preview2-shim",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "description": "WASI Preview2 shim for JS environments",
   "homepage": "https://github.com/bytecodealliance/jco#readme",
   "bugs": {

package/types/instantiation.d.ts

@@ -43,6 +43,7 @@ type _WASIImportObject = {
     'wasi:clocks/wall-clock': typeof import('./interfaces/wasi-clocks-wall-clock.d.ts');
 
     'wasi:http/types': typeof import('./interfaces/wasi-http-types.d.ts');
+    'wasi:http/incoming-handler': typeof import('./interfaces/wasi-http-incoming-handler.d.ts');
     'wasi:http/outgoing-handler': typeof import('./interfaces/wasi-http-outgoing-handler.d.ts');
 };
 
@@ -53,10 +54,7 @@ type VersionedWASIImportObject<V extends string> = {
 };
 
 /** Used to append versions to generated WASI import objects */
-type AppendVersion<
-    Key extends string | number | symbol,
-    Version extends string,
-> = Version extends ''
+type AppendVersion<Key extends string | number | symbol, Version extends string> = Version extends ''
     ? Key
     : Version extends `${infer V}`
       ? Key extends `${infer K}`
@@ -68,8 +66,8 @@ type AppendVersion<
  * Sandbox configuration options for WASIShim
  */
 interface SandboxConfig {
-    /** Filesystem preopens mapping (virtual path -> host path) */
-    preopens?: Record<string, string>;
+    /** Filesystem-specific preopens mapping (virtual path -> host path or capability). */
+    preopens?: Record<string, unknown>;
     /** Environment variables visible to the guest */
     env?: Record<string, string>;
     /** Command-line arguments */
@@ -78,14 +76,49 @@ interface SandboxConfig {
     enableNetwork?: boolean;
 }
 
+/**
+ * Application-provided implementation of the two `wasi:filesystem` namespaces.
+ * Browser applications can use this boundary to select their own storage and
+ * permission model without the shim choosing a filesystem implementation.
+ */
+export interface FilesystemShim {
+    preopens: typeof import('./interfaces/wasi-filesystem-preopens.d.ts');
+    types: typeof import('./interfaces/wasi-filesystem-types.d.ts');
+    /** Interpret sandbox preopen properties and return this filesystem's preopens namespace. */
+    createPreopens?(
+        preopens: Record<string, unknown>,
+    ): typeof import('./interfaces/wasi-filesystem-preopens.d.ts');
+    dispose?(): void;
+}
+
+/** Application-provided implementation of the WASI TCP namespaces. */
+export interface TcpSocketsShim {
+    tcp: typeof import('./interfaces/wasi-sockets-tcp.d.ts');
+    tcpCreateSocket: typeof import('./interfaces/wasi-sockets-tcp-create-socket.d.ts');
+}
+
+/** Application-provided implementation of the WASI UDP namespaces. */
+export interface UdpSocketsShim {
+    udp: typeof import('./interfaces/wasi-sockets-udp.d.ts');
+    udpCreateSocket: typeof import('./interfaces/wasi-sockets-udp-create-socket.d.ts');
+}
+
+/** Browser HTTP handler using standard Web Request and Response objects. */
+export type WebIncomingHandler = (request: Request) => Response | Promise<Response>;
+
 /**
  * Configuration options for WASIShim
  */
 interface WASIShimConfig {
     /** Custom CLI shim */
     cli?: object;
-    /** Custom filesystem shim */
-    filesystem?: object;
+    /** Application-provided filesystem namespaces. */
+    filesystem?: FilesystemShim;
+    /** Explicit ephemeral browser file-data adapter and guest-path mappings. */
+    browserFilesystem?: {
+        adapter: object;
+        preopens: Record<string, unknown>;
+    };
     /** Custom I/O shim */
     io?: object;
     /** Custom random shim */
@@ -94,8 +127,26 @@ interface WASIShimConfig {
     clocks?: object;
     /** Custom sockets shim */
     sockets?: object;
+    /** Custom TCP socket namespaces. */
+    tcpSockets?: TcpSocketsShim;
+    /** Custom UDP socket namespaces. */
+    udpSockets?: UdpSocketsShim;
     /** Custom HTTP shim */
     http?: object;
+    /** Browser incoming HTTP handler. */
+    incomingHandler?: WebIncomingHandler;
+    /** Browser-only isolated environment variables. */
+    environment?: Record<string, string>;
+    /** Browser-only isolated command-line arguments. */
+    arguments?: string[];
+    /** Browser-only initial working directory. */
+    initialCwd?: string;
+    /** Browser input stream handler. */
+    stdin?: object;
+    /** Browser output stream handler. */
+    stdout?: object;
+    /** Browser error stream handler. */
+    stderr?: object;
     /** Sandbox configuration for restricting guest capabilities */
     sandbox?: SandboxConfig;
 }
@@ -160,7 +211,7 @@ interface WASIShimConfig {
  *     }
  * });
  *
- * // Limited filesystem access
+ * // Node.js only: limited host filesystem access
  * const limitedShim = new WASIShim({
  *     sandbox: {
  *         preopens: {
@@ -171,6 +222,9 @@ interface WASIShimConfig {
  * });
  * ```
  *
+ * Browser applications should inject `filesystem` namespaces or explicitly
+ * configure `browserFilesystem`; browser preopens never interpret host paths.
+ *
  * Note that this object is similar but not identical to the Node `WASI` object --
  * it is solely concerned with shimming of preview2 when dealing with a WebAssembly
  * component transpiled by Jco. While this object *does* work with Node (and the browser)
@@ -189,9 +243,7 @@ export class WASIShim {
      * @param {options} [opt]
      * @returns {object}
      */
-    getImportObject<V extends string = ''>(
-        opts?: GetImportObjectArgs
-    ): VersionedWASIImportObject<V>;
+    getImportObject<V extends string = ''>(opts?: GetImportObjectArgs): VersionedWASIImportObject<V>;
 }
 
 interface GetImportObjectArgs {