@crowdedkingdoms/crowdyjs 17.14.0-dev.1 → 18.0.1-dev.1

package/dist/live-coding/rust-analysis.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rust-analysis.d.ts","sourceRoot":"","sources":["../../src/live-coding/rust-analysis.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,cAAc,EACd,UAAU,EACV,cAAc,EACd,KAAK,EACL,QAAQ,EACR,QAAQ,EAET,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAEV,aAAa,EAGd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAsHhD,qBAAa,YAAY;IAIrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAJhC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAuC;IAE7D,OAAO;WAKM,MAAM,CAAC,OAAO,EAAE;QAC3B,aAAa,EAAE,MAAM,CAAC;QACtB,cAAc,EAAE,MAAM,CAAC;QACvB,aAAa,EAAE,aAAa,CAAC;KAC9B,GAAG,OAAO,CAAC,YAAY,CAAC;IAWzB,WAAW,CAAC,QAAQ,EAAE,eAAe,GAAG,UAAU,EAAE;IAIpD,WAAW,CACT,QAAQ,EAAE,eAAe,EACzB,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,SAAS,eAAe,EAAE,GACpC,cAAc,EAAE;IAoCnB,KAAK,CACH,QAAQ,EAAE,eAAe,EACzB,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,SAAS,eAAe,EAAE,GACpC,KAAK,GAAG,IAAI;IAwCf,eAAe,CAAC,QAAQ,EAAE,eAAe,GAAG,cAAc,EAAE;IAU5D,UAAU,CACR,QAAQ,EAAE,eAAe,EACzB,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,SAAS,eAAe,EAAE,GACpC,QAAQ,GAAG,IAAI;IAWlB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAI7B,OAAO,IAAI,IAAI;IAKf,OAAO,CAAC,gBAAgB;IAMxB,OAAO,CAAC,OAAO;CA6ChB"}
+{"version":3,"file":"rust-analysis.d.ts","sourceRoot":"","sources":["../../src/live-coding/rust-analysis.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,cAAc,EACd,UAAU,EACV,cAAc,EACd,KAAK,EACL,QAAQ,EACR,QAAQ,EAET,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAEV,aAAa,EAGd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAqHhD,qBAAa,YAAY;IAIrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAJhC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAuC;IAE7D,OAAO;WAKM,MAAM,CAAC,OAAO,EAAE;QAC3B,aAAa,EAAE,MAAM,CAAC;QACtB,cAAc,EAAE,MAAM,CAAC;QACvB,aAAa,EAAE,aAAa,CAAC;KAC9B,GAAG,OAAO,CAAC,YAAY,CAAC;IAWzB,WAAW,CAAC,QAAQ,EAAE,eAAe,GAAG,UAAU,EAAE;IAIpD,WAAW,CACT,QAAQ,EAAE,eAAe,EACzB,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,SAAS,eAAe,EAAE,GACpC,cAAc,EAAE;IAoCnB,KAAK,CACH,QAAQ,EAAE,eAAe,EACzB,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,SAAS,eAAe,EAAE,GACpC,KAAK,GAAG,IAAI;IAwCf,eAAe,CAAC,QAAQ,EAAE,eAAe,GAAG,cAAc,EAAE;IAU5D,UAAU,CACR,QAAQ,EAAE,eAAe,EACzB,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,SAAS,eAAe,EAAE,GACpC,QAAQ,GAAG,IAAI;IAWlB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAI7B,OAAO,IAAI,IAAI;IAKf,OAAO,CAAC,gBAAgB;IAMxB,OAAO,CAAC,OAAO;CA6ChB"}

package/dist/live-coding/rust-analysis.js

@@ -54,19 +54,19 @@ const RUST_KEYWORDS = [
 const TARGET_SNIPPETS = {
     server: [
         {
-            label: 'server lifecycle',
+            label: 'mod hub',
             kind: 15,
-            detail: 'SERVER init, tick, and invoke entry points',
-            documentation: 'Runs in the platform sandbox as the grid owner. Host effects remain permission checked and grid-clamped.',
-            insertText: 'fn on_init() {\n    $1\n}\n\nfn on_tick(dt_ms: u32) {\n    $2\n}\n\nfn on_invoke(payload: &[u8]) -> Vec<u8> {\n    $3\n}\n\ncrowdy_compute_sdk::register_module!(init: on_init, tick: on_tick, invoke: on_invoke);',
+            detail: 'SERVER: a ck-exec mod (spawn, load, persist, handle)',
+            documentation: 'Runs on the platform as a hub keyed by the grid, in its owner\u2019s sandbox; its node API calls reach only this grid. Crowdy Studio Invoke calls one of its endpoints (`state` by default).',
+            insertText: 'use ckx_sdk::prelude::*;\n\n#[derive(Serialize, Deserialize, Default)]\npub struct Mod {\n    $1\n}\n\nimpl Hub for Mod {\n    fn spawn(_ctx: &Ctx, _seed: &[u8]) -> Result<Self> {\n        Ok(Self::default())\n    }\n\n    fn load(_ctx: &Ctx, snapshot: &[u8], _from_version: u64) -> Result<Self> {\n        decode(snapshot)\n    }\n\n    fn persist(&mut self, _ctx: &Ctx) -> Result<Vec<u8>> {\n        encode(self)\n    }\n\n    fn handle(&mut self, _ctx: &Ctx, call: Call<\'_>) -> Result<Vec<u8>> {\n        match call.method {\n            "state" => encode(&*self),\n            m => Err(Error(format!("no endpoint `{m}`"))),\n        }\n    }\n}\n\nckx_sdk::export_hub!(Mod);',
             sortText: '0-server-lifecycle',
         },
         {
-            label: 'server invoke export',
+            label: 'mod endpoint',
             kind: 15,
-            detail: 'SERVER export callable from Crowdy Studio Invoke',
-            documentation: 'The caller and owned grid are supplied by the platform runtime; author identity is never authority.',
-            insertText: 'fn on_invoke(payload: &[u8]) -> Vec<u8> {\n    ${1:payload.to_vec()}\n}',
+            detail: 'SERVER: an endpoint in handle, called over an exec connection',
+            documentation: 'The platform names the caller (`call.player()`); author identity is never authority.',
+            insertText: '"${1:visit}" => {\n    $2\n    encode(&*self)\n}',
             sortText: '0-server-invoke',
         },
     ],
@@ -74,17 +74,17 @@ const TARGET_SNIPPETS = {
         {
             label: 'client lifecycle',
             kind: 15,
-            detail: 'CLIENT init, tick, and invoke entry points',
-            documentation: 'Runs in the browser Rust sandbox. Page capabilities are exposed only through the broker allow-list. The host only ticks when PlayerCodeBroker.tickIntervalMs is set.',
-            insertText: 'fn on_init() {\n    $1\n}\n\nfn on_tick(dt_ms: u32) {\n    $2\n}\n\nfn on_invoke(payload: &[u8]) -> Vec<u8> {\n    $3\n}\n\ncrowdy_compute_sdk::register_module!(init: on_init, tick: on_tick, invoke: on_invoke);',
+            detail: 'CLIENT half: init, tick, invoke and event entry points',
+            documentation: 'Runs in the visitor\u2019s browser sandbox. Page capabilities are exposed only through the broker allow-list, narrowed to what the visitor consented to. It ticks every tick_interval_ms (Cargo.toml).',
+            insertText: 'fn init() {\n    $1\n}\n\nfn tick(_dt_ms: u32) {\n    $2\n}\n\nfn invoke(payload: &[u8]) -> Vec<u8> {\n    ${3:payload.to_vec()}\n}\n\nfn event(_payload: &[u8]) {}\n\ncrowdy_client_sdk::register_module!(init: init, tick: tick, invoke: invoke, event: event);',
             sortText: '0-client-lifecycle',
         },
         {
             label: 'client presentation tick',
             kind: 15,
             detail: 'CLIENT tick for allow-listed HUD/presentation effects',
-            documentation: 'Presentation calls cross PlayerCodeBroker; the language worker and guest module never receive page credentials. The host only ticks when tickIntervalMs is set.',
-            insertText: 'fn on_tick(dt_ms: u32) {\n    // Call an allow-listed presentation host function here.\n    $1\n}',
+            documentation: 'Presentation calls cross PlayerCodeBroker to the HUD the game offers; the language worker and guest module never receive page credentials.',
+            insertText: 'fn tick(_dt_ms: u32) {\n    let _ = crowdy_client_sdk::api::hud_set(serde_json::json!({ "text": "${1:hello}" }));\n}',
             sortText: '0-client-presentation',
         },
     ],
@@ -132,7 +132,7 @@ export class RustAnalysis {
         }
         const target = targetForDocument(document);
         if (target) {
-            for (const snippet of targetSnippets(target, document.text))
+            for (const snippet of targetSnippets(target))
                 add(snippet);
         }
         for (const symbol of this.platformIndex.symbols) {
@@ -255,35 +255,31 @@ export class RustAnalysis {
         }
     }
 }
-/** A CLIENT file on crowdy-client-sdk, a ck-exec mod's CLIENT half, registers through that crate. */
-function targetSnippets(target, text) {
-    const snippets = TARGET_SNIPPETS[target];
-    if (target !== 'client' || !text.includes('crowdy_client_sdk'))
-        return snippets;
-    return snippets.map((snippet) => snippet.insertText?.includes('crowdy_compute_sdk::')
-        ? {
-            ...snippet,
-            insertText: snippet.insertText.replace('crowdy_compute_sdk::', 'crowdy_client_sdk::'),
-        }
-        : snippet);
+function targetSnippets(target) {
+    return TARGET_SNIPPETS[target];
 }
 function targetForDocument(document) {
     const first = document.path.split('/', 1)[0]?.toLowerCase();
     return first === 'server' || first === 'client' ? first : null;
 }
+const SERVER_LIFECYCLE = ['spawn', 'load', 'persist', 'handle', 'on_world', 'on_timer'];
+const CLIENT_LIFECYCLE = ['init', 'tick', 'invoke', 'event'];
 function targetLifecycleNote(document, word) {
     const target = targetForDocument(document);
-    if (!target || !['on_init', 'on_tick', 'on_invoke'].includes(word)) {
-        return null;
+    if (target === 'server' && SERVER_LIFECYCLE.includes(word)) {
+        return word === 'handle'
+            ? 'SERVER lifecycle: a mod endpoint runs for the caller the platform names (`call.player()`); its node API calls reach only this grid.'
+            : 'SERVER lifecycle: the mod runs on the platform as a hub keyed by the grid, in its owner\u2019s sandbox, once its build succeeds.';
     }
-    if (target === 'server') {
-        return word === 'on_invoke'
-            ? 'SERVER invoke exports execute as the current grid owner; host effects remain permission checked and grid-confined.'
-            : 'SERVER lifecycle code executes in the platform sandbox and is activated only after an authoritative compile succeeds.';
+    if (target === 'client' && CLIENT_LIFECYCLE.includes(word)) {
+        if (word === 'tick') {
+            return 'CLIENT ticks run in the visitor\u2019s browser sandbox every tick_interval_ms (Cargo.toml); all page effects cross the PlayerCodeBroker allow-list, narrowed to what the visitor consented to.';
+        }
+        return word === 'invoke'
+            ? 'CLIENT invoke answers the page (PlayerCodeBroker.invoke); its reply goes back to the game as bytes.'
+            : 'CLIENT code is loaded from the exact hash-bound artifact the grid serves for this CLIENT half.';
     }
-    return word === 'on_tick'
-        ? 'CLIENT ticks execute inside the browser guest sandbox only when PlayerCodeBroker.tickIntervalMs is set; all page effects cross the PlayerCodeBroker allow-list.'
-        : 'CLIENT lifecycle code is loaded from the exact hash-bound artifact produced for this project version.';
+    return null;
 }
 function visit(node, callback) {
     callback(node);

package/dist/player-runtime/client-host-calls.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The host calls a ck-exec mod's CLIENT half may make, grouped by capability (04 §4): the
+ * client half of the platform host catalog less what only the legacy engines answered (the
+ * `model` group, `sessions_list` and `grid_state_*`). It is exactly what crowdy-client-sdk
+ * wraps, and the broker's deny-by-default allowlist.
+ */
+export declare const EXEC_CLIENT_HOST_CALLS: Readonly<Record<string, ReadonlySet<string>>>;
+//# sourceMappingURL=client-host-calls.d.ts.map

package/dist/player-runtime/client-host-calls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-host-calls.d.ts","sourceRoot":"","sources":["../../src/player-runtime/client-host-calls.ts"],"names":[],"mappings":"AAaA;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAS7E,CAAC"}

package/dist/player-runtime/client-host-calls.js

@@ -0,0 +1,28 @@
+import { GENERATED_HOST_CATALOG } from './host-catalog.generated.js';
+/**
+ * Client calls in the platform catalog that only the legacy engines answered, besides the
+ * Game Model group: crowdy-client-sdk does not wrap them, and nothing in the browser answers
+ * them.
+ */
+const LEGACY_HOST_CALLS = new Set([
+    'sessions_list',
+    'grid_state_get',
+    'grid_state_set',
+]);
+/**
+ * The host calls a ck-exec mod's CLIENT half may make, grouped by capability (04 §4): the
+ * client half of the platform host catalog less what only the legacy engines answered (the
+ * `model` group, `sessions_list` and `grid_state_*`). It is exactly what crowdy-client-sdk
+ * wraps, and the broker's deny-by-default allowlist.
+ */
+export const EXEC_CLIENT_HOST_CALLS = (() => {
+    var _a;
+    const groups = {};
+    for (const fn of GENERATED_HOST_CATALOG.functions) {
+        if (!fn.targets.includes('client') || fn.group === 'model' || LEGACY_HOST_CALLS.has(fn.name)) {
+            continue;
+        }
+        (groups[_a = fn.group] ?? (groups[_a] = new Set())).add(fn.name);
+    }
+    return groups;
+})();

package/dist/player-runtime/glue-runtime.d.ts

@@ -1,21 +1,19 @@
 /**
- * Factored, environment-agnostic core of the platform glue (player compute
- * P3/P5). This is the ONLY platform code that shares an execution context
+ * Factored, environment-agnostic core of the platform glue for a ck-exec mod's
+ * CLIENT half. This is the ONLY platform code that shares an execution context
  * with an untrusted player module, so it is deliberately tiny and auditable
  * and has NO dependency on worker globals, the DOM, or the SDK client — the
  * browser worker entry ([player-glue-worker.ts]) and the Node integration
  * test both drive this same core.
  *
- * ABI (matches crowdy-compute-sdk and crowdy-client-sdk `lib.rs`, CLIENT ABI
- * 0): the guest imports module `ck` with `log`, `now_ms`, `state_get`,
- * `state_set`, and the JSON gateway `host_call(ptr,len) -> u64` (packed
- * `resp_ptr<<32 | resp_len`, guest frees with `ck_free`), plus
- * `wasi_snapshot_preview1.random_get`. The guest exports `memory`,
- * `ck_alloc`, `ck_free`, and the module hooks `init`, `tick(dt_ms)`,
- * `handle_invoke(ptr,len)->u64`, optional `on_event(ptr,len)`. A ck-exec
- * CLIENT half (`engine: 'ck-exec'`) is offered exactly those imports, and
- * must export the `ck_fuel` meter; a legacy module also gets inert wasi
- * stubs and the `wasi_unstable` alias.
+ * ABI (crowdy-client-sdk `lib.rs`, CLIENT ABI 0): the guest imports module
+ * `ck` with `log`, `now_ms`, `state_get`, `state_set`, and the JSON gateway
+ * `host_call(ptr,len) -> u64` (packed `resp_ptr<<32 | resp_len`, guest frees
+ * with `ck_free`), plus `wasi_snapshot_preview1.random_get`, and nothing else.
+ * The guest exports `memory`, `ck_alloc`, `ck_free`, the `ck_fuel` meter the
+ * build's instrument step injects, and the module hooks `init`,
+ * `tick(dt_ms)`, `handle_invoke(ptr,len)->u64` and optional
+ * `on_event(ptr,len)`.
  *
  * `host_call` is SYNCHRONOUS from the guest's view. The single synchronous
  * dependency this core takes is `hostCallSync(reqBytes) -> respBytes`; the
@@ -23,17 +21,19 @@
  * (the worker blocks; the page/broker services the async SDK call and writes
  * the reply back). Everything else here is pure.
  */
-/** The host-call names surfaced to a guest: the client half of the host catalog (the broker allowlist). */
+/** The host-call names a guest may send: the broker's allowlist, {@link EXEC_CLIENT_HOST_CALLS}. */
 export declare const GLUE_HOST_FUNCTIONS: readonly string[];
+/** The most of one `ck.log` message read out of guest memory, in bytes. */
+export declare const GLUE_LOG_MAX_BYTES = 4096;
 /** Every import a ck-exec CLIENT half may have (CLIENT ABI 0), by module. */
 export declare const EXEC_CLIENT_ABI_IMPORTS: Readonly<Record<string, readonly string[]>>;
 export interface GlueInitMessage {
     type: 'init';
     artifact: ArrayBuffer;
     authority: 'player';
-    /** `'ck-exec'`: a mod's CLIENT half, offered exactly {@link EXEC_CLIENT_ABI_IMPORTS}. */
-    engine?: 'player-compute' | 'ck-exec';
-    /** Server-authored budget loaded into an injected mutable `ck_fuel` global. */
+    /** A mod's CLIENT half, offered exactly {@link EXEC_CLIENT_ABI_IMPORTS}: the only engine. */
+    engine?: 'ck-exec';
+    /** Server-authored budget loaded into the module's mutable `ck_fuel` global; required. */
     fuelPerDispatch?: string;
     /** Legacy metadata; the hard watchdog is owned by the page-side broker. */
     watchdogMs?: number;
@@ -76,17 +76,21 @@ export interface GuestExports {
 export interface GlueRuntimeOptions {
     /** Synchronous host-API gateway: JSON request bytes in, SDK Response-envelope bytes out. */
     hostCallSync: (reqBytes: Uint8Array) => Uint8Array;
-    /** debug/info/warn/error sink for guest `ck.log` (optional). */
+    /**
+     * Sink for guest `ck.log` (optional): crowdy-client-sdk's level (0 debug, 1 info, 2 warn,
+     * 3 error) and at most {@link GLUE_LOG_MAX_BYTES} of the message.
+     */
     onLog?: (level: number, message: string) => void;
     /** Deterministic-enough randomness for the guest `random_get` (defaults to crypto). */
     randomFill?: (buf: Uint8Array) => void;
     now?: () => number;
+    /** The per-dispatch budget; a module is refused without one. */
     fuelPerDispatch?: bigint | null;
     /**
-     * `'ck-exec'`: offer exactly {@link EXEC_CLIENT_ABI_IMPORTS} and refuse a module that does not
-     * export the `ck_fuel` meter, or a missing budget. Default `'player-compute'`.
+     * `'ck-exec'`, the only engine: offer exactly {@link EXEC_CLIENT_ABI_IMPORTS} and refuse a
+     * module that does not export the `ck_fuel` meter, or a missing budget.
      */
-    engine?: 'player-compute' | 'ck-exec';
+    engine?: 'ck-exec';
 }
 /**
  * Drives one untrusted guest module: builds the `ck` + wasi import table,

package/dist/player-runtime/glue-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"glue-runtime.d.ts","sourceRoot":"","sources":["../../src/player-runtime/glue-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,2GAA2G;AAC3G,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAGxB,CAAC;AAE1B,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAG/E,CAAC;AAEF,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,WAAW,CAAC;IACtB,SAAS,EAAE,QAAQ,CAAC;IACpB,yFAAyF;IACzF,MAAM,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACtC,+EAA+E;IAC/E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qEAAqE;IACrE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAQtE;AAED,gEAAgE;AAChE,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzE;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,OAAO,EACvB,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,MAAM,MAAyB,GACnC,OAAO,CAAC,kBAAkB,CAAC,CAe7B;AAED,wGAAwG;AACxG,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE;QAAE,MAAM,EAAE,WAAW,CAAA;KAAE,CAAC;IAChC,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,IAAI,CAAC,IAAI,IAAI,CAAC;IACd,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAC1D,QAAQ,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IACjC,4FAA4F;IAC5F,YAAY,EAAE,CAAC,QAAQ,EAAE,UAAU,KAAK,UAAU,CAAC;IACnD,gEAAgE;IAChE,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACjD,uFAAuF;IACvF,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,IAAI,CAAC;IACvC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC;;;OAGG;IACH,MAAM,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;CACvC;AAkCD;;;;;;GAMG;AACH,qBAAa,WAAW;IAIV,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHpC,OAAO,CAAC,OAAO,CAA6B;IAC5C,OAAO,CAAC,SAAS,CAAiC;gBAErB,OAAO,EAAE,kBAAkB;IAExD,OAAO,CAAC,SAAS;IASjB,oFAAoF;IACpF,YAAY,CAAC,UAAU,EAAE,MAAM,YAAY,GAAG,IAAI,GAAG,WAAW,CAAC,OAAO;IAoGlE,WAAW,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBvD,gEAAgE;IAChE,IAAI,IAAI,IAAI;IAKZ,gFAAgF;IAChF,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAKxB,oFAAoF;IACpF,KAAK,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI;IAchC,sFAAsF;IACtF,MAAM,CAAC,OAAO,EAAE,UAAU,GAAG,UAAU;CAuBxC"}
+{"version":3,"file":"glue-runtime.d.ts","sourceRoot":"","sources":["../../src/player-runtime/glue-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,oGAAoG;AACpG,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAEhD,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAG/E,CAAC;AAEF,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,WAAW,CAAC;IACtB,SAAS,EAAE,QAAQ,CAAC;IACpB,6FAA6F;IAC7F,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,0FAA0F;IAC1F,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qEAAqE;IACrE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAQtE;AAED,gEAAgE;AAChE,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzE;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,OAAO,EACvB,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,MAAM,MAAyB,GACnC,OAAO,CAAC,kBAAkB,CAAC,CAe7B;AAED,wGAAwG;AACxG,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE;QAAE,MAAM,EAAE,WAAW,CAAA;KAAE,CAAC;IAChC,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,IAAI,CAAC,IAAI,IAAI,CAAC;IACd,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAC1D,QAAQ,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IACjC,4FAA4F;IAC5F,YAAY,EAAE,CAAC,QAAQ,EAAE,UAAU,KAAK,UAAU,CAAC;IACnD;;;OAGG;IACH,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACjD,uFAAuF;IACvF,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,IAAI,CAAC;IACvC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,gEAAgE;IAChE,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC;;;OAGG;IACH,MAAM,CAAC,EAAE,SAAS,CAAC;CACpB;AAkCD;;;;;;GAMG;AACH,qBAAa,WAAW;IAIV,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHpC,OAAO,CAAC,OAAO,CAA6B;IAC5C,OAAO,CAAC,SAAS,CAAiC;gBAErB,OAAO,EAAE,kBAAkB;IAExD,OAAO,CAAC,SAAS;IASjB,oFAAoF;IACpF,YAAY,CAAC,UAAU,EAAE,MAAM,YAAY,GAAG,IAAI,GAAG,WAAW,CAAC,OAAO;IAyElE,WAAW,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBvD,gEAAgE;IAChE,IAAI,IAAI,IAAI;IAKZ,gFAAgF;IAChF,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAKxB,oFAAoF;IACpF,KAAK,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI;IAchC,sFAAsF;IACtF,MAAM,CAAC,OAAO,EAAE,UAAU,GAAG,UAAU;CAuBxC"}

package/dist/player-runtime/glue-runtime.js

@@ -1,21 +1,19 @@
 /**
- * Factored, environment-agnostic core of the platform glue (player compute
- * P3/P5). This is the ONLY platform code that shares an execution context
+ * Factored, environment-agnostic core of the platform glue for a ck-exec mod's
+ * CLIENT half. This is the ONLY platform code that shares an execution context
  * with an untrusted player module, so it is deliberately tiny and auditable
  * and has NO dependency on worker globals, the DOM, or the SDK client — the
  * browser worker entry ([player-glue-worker.ts]) and the Node integration
  * test both drive this same core.
  *
- * ABI (matches crowdy-compute-sdk and crowdy-client-sdk `lib.rs`, CLIENT ABI
- * 0): the guest imports module `ck` with `log`, `now_ms`, `state_get`,
- * `state_set`, and the JSON gateway `host_call(ptr,len) -> u64` (packed
- * `resp_ptr<<32 | resp_len`, guest frees with `ck_free`), plus
- * `wasi_snapshot_preview1.random_get`. The guest exports `memory`,
- * `ck_alloc`, `ck_free`, and the module hooks `init`, `tick(dt_ms)`,
- * `handle_invoke(ptr,len)->u64`, optional `on_event(ptr,len)`. A ck-exec
- * CLIENT half (`engine: 'ck-exec'`) is offered exactly those imports, and
- * must export the `ck_fuel` meter; a legacy module also gets inert wasi
- * stubs and the `wasi_unstable` alias.
+ * ABI (crowdy-client-sdk `lib.rs`, CLIENT ABI 0): the guest imports module
+ * `ck` with `log`, `now_ms`, `state_get`, `state_set`, and the JSON gateway
+ * `host_call(ptr,len) -> u64` (packed `resp_ptr<<32 | resp_len`, guest frees
+ * with `ck_free`), plus `wasi_snapshot_preview1.random_get`, and nothing else.
+ * The guest exports `memory`, `ck_alloc`, `ck_free`, the `ck_fuel` meter the
+ * build's instrument step injects, and the module hooks `init`,
+ * `tick(dt_ms)`, `handle_invoke(ptr,len)->u64` and optional
+ * `on_event(ptr,len)`.
  *
  * `host_call` is SYNCHRONOUS from the guest's view. The single synchronous
  * dependency this core takes is `hostCallSync(reqBytes) -> respBytes`; the
@@ -23,11 +21,11 @@
  * (the worker blocks; the page/broker services the async SDK call and writes
  * the reply back). Everything else here is pure.
  */
-import { GENERATED_HOST_CATALOG } from './host-catalog.generated.js';
-/** The host-call names surfaced to a guest: the client half of the host catalog (the broker allowlist). */
-export const GLUE_HOST_FUNCTIONS = GENERATED_HOST_CATALOG.functions
-    .filter((fn) => fn.targets.includes('client'))
-    .map((fn) => fn.name);
+import { EXEC_CLIENT_HOST_CALLS } from './client-host-calls.js';
+/** The host-call names a guest may send: the broker's allowlist, {@link EXEC_CLIENT_HOST_CALLS}. */
+export const GLUE_HOST_FUNCTIONS = Object.values(EXEC_CLIENT_HOST_CALLS).flatMap((fns) => [...fns]);
+/** The most of one `ck.log` message read out of guest memory, in bytes. */
+export const GLUE_LOG_MAX_BYTES = 4096;
 /** Every import a ck-exec CLIENT half may have (CLIENT ABI 0), by module. */
 export const EXEC_CLIENT_ABI_IMPORTS = {
     ck: ['log', 'now_ms', 'state_get', 'state_set', 'host_call'],
@@ -118,12 +116,6 @@ export class GlueRuntime {
     }
     /** The import object handed to `WebAssembly.instantiate`. Guest sees only these. */
     buildImports(getExports) {
-        const mem = () => {
-            const ex = getExports();
-            if (!ex)
-                throw new Error('guest not instantiated');
-            return new DataView(ex.memory.buffer);
-        };
         const bytesAt = (ptr, len) => {
             const ex = getExports();
             if (!ex)
@@ -148,8 +140,12 @@ export class GlueRuntime {
         const randomFill = this.options.randomFill ?? defaultRandomFill;
         const ck = {
             log: (level, ptr, len) => {
+                const ex = getExports();
+                if (!ex)
+                    throw new Error('guest not instantiated');
+                assertMemoryRange(ex.memory.buffer, ptr, len, 'guest log read');
                 if (this.options.onLog) {
-                    this.options.onLog(level, textDecoder.decode(bytesAt(ptr, len)));
+                    this.options.onLog(level, textDecoder.decode(bytesAt(ptr, Math.min(len, GLUE_LOG_MAX_BYTES))));
                 }
             },
             now_ms: () => BigInt(now()),
@@ -189,32 +185,9 @@ export class GlueRuntime {
             randomFill(buf);
             return 0;
         };
-        if (this.options.engine === 'ck-exec') {
-            return {
-                ck,
-                wasi_snapshot_preview1: { random_get },
-            };
-        }
-        const wasi = {
-            random_get,
-            // A player artifact may pull in a few benign wasi stubs; keep them inert.
-            proc_exit: () => {
-                throw new Error('proc_exit called (guest trap)');
-            },
-            fd_write: () => 0,
-            environ_get: () => 0,
-            environ_sizes_get: (envcPtr, envBufSzPtr) => {
-                const dv = mem();
-                dv.setUint32(envcPtr, 0, true);
-                dv.setUint32(envBufSzPtr, 0, true);
-                return 0;
-            },
-        };
         return {
             ck,
-            wasi_snapshot_preview1: wasi,
-            // Some toolchains name the module `wasi_unstable`; alias defensively.
-            wasi_unstable: wasi,
+            wasi_snapshot_preview1: { random_get },
         };
     }
     async instantiate(artifact) {
@@ -224,13 +197,11 @@ export class GlueRuntime {
         if (!ex.memory || typeof ex.ck_alloc !== 'function') {
             throw new Error('artifact is missing the ck ABI (memory / ck_alloc)');
         }
-        if (this.options.engine === 'ck-exec') {
-            if (!(ex.ck_fuel instanceof WebAssembly.Global)) {
-                throw new Error('a ck-exec CLIENT half must export the ck_fuel meter; it was not instrumented');
-            }
-            if (this.options.fuelPerDispatch == null) {
-                throw new Error('a ck-exec CLIENT half needs its fuel budget');
-            }
+        if (!(ex.ck_fuel instanceof WebAssembly.Global)) {
+            throw new Error('a ck-exec CLIENT half must export the ck_fuel meter; it was not instrumented');
+        }
+        if (this.options.fuelPerDispatch == null) {
+            throw new Error('a ck-exec CLIENT half needs its fuel budget');
         }
         this.exports = ex;
     }

package/dist/player-runtime/glue-sab.d.ts

@@ -1,6 +1,6 @@
 /**
- * The synchronous host-call transport for browser-target player WASM
- * (player compute P5). WASM imports are synchronous, but the host-call
+ * The synchronous host-call transport for a CLIENT half's browser WASM.
+ * WASM imports are synchronous, but the host-call
  * handler (the server-authorized SDK path) is async and lives on the page,
  * while the guest runs in a Worker. The only correct bridge is a
  * SharedArrayBuffer the worker blocks on with `Atomics.wait`: the worker

package/dist/player-runtime/glue-sab.js

@@ -1,6 +1,6 @@
 /**
- * The synchronous host-call transport for browser-target player WASM
- * (player compute P5). WASM imports are synchronous, but the host-call
+ * The synchronous host-call transport for a CLIENT half's browser WASM.
+ * WASM imports are synchronous, but the host-call
  * handler (the server-authorized SDK path) is async and lives on the page,
  * while the guest runs in a Worker. The only correct bridge is a
  * SharedArrayBuffer the worker blocks on with `Atomics.wait`: the worker

package/dist/player-runtime/player-code-broker.d.ts

@@ -1,4 +1,6 @@
+import { EXEC_CLIENT_HOST_CALLS } from './client-host-calls.js';
 import { ClientGridEvent, ClientGridEventBus } from './client-grid-event-bus.js';
+export { EXEC_CLIENT_HOST_CALLS };
 export interface PlayerCodeGridBounds {
     low: {
         x: bigint;
@@ -12,8 +14,8 @@ export interface PlayerCodeGridBounds {
     };
     /**
      * The grid's id. Required for the grid event bus (`emit_event` /
-     * `on_event`) and for self-grid checks on `grid_state_*`; a broker without
-     * it refuses those calls.
+     * `on_event`); a broker without it refuses those calls. With it, a
+     * `grid_permission_check` naming another grid is refused here.
      */
     gridId?: string;
 }
@@ -36,46 +38,69 @@ export interface PlayerCodePresentation {
     channel: 'hud' | 'overlay';
     payload: unknown;
 }
+/** crowdy-client-sdk's log levels: 0 debug, 1 info, 2 warn, 3 error. */
+export type PlayerCodeLogLevel = 'debug' | 'info' | 'warn' | 'error';
 /**
- * What built a player module. `'ck-exec'`: the CLIENT half of a ck-exec mod, a
- * `crowdy-client-sdk` crate. `'player-compute'`: a legacy CLIENT module (removed in 18.0).
+ * One `crowdy::log` line of the running module, as the broker forwards it. The text is the
+ * module author's, so render it as text, never as markup.
  */
-export type PlayerCodeEngine = 'player-compute' | 'ck-exec';
+export interface PlayerCodeLogLine {
+    level: PlayerCodeLogLevel;
+    /** At most {@link PLAYER_CODE_LOG_MAX_CHARS} characters; a longer line ends in `…`. */
+    message: string;
+    /** The broker's `moduleName`, or null. */
+    moduleName: string | null;
+}
+/** Log lines forwarded per rolling second; past it lines are counted and dropped. */
+export declare const PLAYER_CODE_LOG_LINES_PER_SECOND = 20;
+/** The longest log line forwarded, in characters. */
+export declare const PLAYER_CODE_LOG_MAX_CHARS = 1000;
+/** The largest `invoke` payload, and the largest reply accepted, in bytes. */
+export declare const PLAYER_CODE_INVOKE_MAX_BYTES: number;
+/**
+ * What built a player module: the CLIENT half of a ck-exec mod, a `crowdy-client-sdk` crate.
+ * The only engine since 18.0 removed legacy player compute's CLIENT modules.
+ */
+export type PlayerCodeEngine = 'ck-exec';
 export interface PlayerCodeBrokerOptions {
     /** Platform-owned glue worker URL; the worker never receives auth tokens. */
     workerUrl: string | URL;
     grid: PlayerCodeGridBounds;
     /**
-     * `'ck-exec'` for a mod's CLIENT half: host calls are exactly
-     * {@link EXEC_CLIENT_HOST_CALLS}, the glue offers exactly the CLIENT ABI imports
+     * `'ck-exec'`, the only engine and the default: host calls are at most
+     * {@link EXEC_CLIENT_HOST_CALLS}, and the glue offers exactly the CLIENT ABI imports
      * (`ck::{log,now_ms,state_get,state_set,host_call}` and
-     * `wasi_snapshot_preview1::random_get`), and a module without the `ck_fuel` meter, a
-     * `fuelPerDispatch` or {@link consentedHostCalls} does not start. `'player-compute'` (the
-     * default until 18.0) keeps a legacy
-     * CLIENT module's whole {@link ALLOWED_HOST_CALLS} and import table.
+     * `wasi_snapshot_preview1::random_get`) and refuses a module without the `ck_fuel` meter.
      */
     engine?: PlayerCodeEngine;
     /**
      * The host calls the player consented to: the served CLIENT half's
-     * `capabilitySummary.hostFunctions`. Required with `engine: 'ck-exec'`. A call outside it is
-     * refused like one outside the allowlist, so a module that assembles a host call's name at run
-     * time, which the build's summary cannot see, still reaches only what the player agreed to.
+     * `capabilitySummary.hostFunctions`. A call outside it is refused like one outside the
+     * allowlist, so a module that assembles a host call's name at run time, which the build's
+     * summary cannot see, still reaches only what the player agreed to.
      */
-    consentedHostCalls?: readonly string[];
+    consentedHostCalls: readonly string[];
     /**
-     * Content hash of the platform-fetched artifact. When set, start() refuses
-     * any artifact whose hash does not match — a side-loaded module cannot be
-     * run (09 T7). Compute it from the same bytes the game-api served.
+     * Content hash (SHA-256, hex) of the platform-served artifact: start() refuses any artifact
+     * whose hash does not match, so a side-loaded module cannot run (09 T7). Pass the served
+     * CLIENT half's `digest`.
      */
-    artifactHash?: string;
+    artifactHash: string;
     /**
-     * Informational server-authored fuel metadata. The browser does not enforce
-     * this value; metering must be injected into the platform artifact.
+     * The served CLIENT half's per-dispatch fuel budget. The glue loads it into the module's
+     * `ck_fuel` meter before every dispatch; the build's instrument step is what enforces it.
      */
-    fuelPerDispatch?: bigint;
+    fuelPerDispatch: bigint;
     onHostCall: (call: PlayerCodeHostCall) => Promise<unknown>;
     /** Optional sink for HUD/overlay presentation the mod emits (BWF wires this). */
     onPresentation?: (presentation: PlayerCodePresentation) => void;
+    /**
+     * Optional sink for the module's `crowdy::log` lines, at most
+     * {@link PLAYER_CODE_LOG_LINES_PER_SECOND} a second, each cut to
+     * {@link PLAYER_CODE_LOG_MAX_CHARS} characters. Past the rate, lines are dropped and the next
+     * line forwarded is preceded by a `warn` that counts them. Without a sink they are dropped.
+     */
+    onLog?: (line: PlayerCodeLogLine) => void;
     /** Called when the local circuit breaker trips (repeated traps / rate abuse). */
     onCircuitOpen?: (reason: string) => void;
     workerFactory?: (url: string | URL) => PlayerCodeWorkerLike;
@@ -105,32 +130,16 @@ export interface PlayerCodeBrokerOptions {
     eventBus?: ClientGridEventBus | null;
 }
 /**
- * Deny-by-default host-call allowlist, grouped by capability (04 §4), built
- * from the platform host catalog (DN-10: the same list the server dispatchers
- * and the capability summary are checked against). Only owner-lawful reads and
- * effects cross the bridge; auth, admin, authoring, grid mutation, raw UDP
- * pose, voice, teams, and any network fetch are absent by construction, not
- * by a denylist. `grid_info` and `emit_event` are answered by the broker
- * itself (the mod's own bounds; the page-local grid event bus).
- */
-export declare const ALLOWED_HOST_CALLS: Readonly<Record<string, ReadonlySet<string>>>;
-/**
- * The host calls a ck-exec mod's CLIENT half may make, grouped as {@link ALLOWED_HOST_CALLS}:
- * the client half of the host catalog less what only the legacy engines answer (the `model`
- * group, `sessions_list` and `grid_state_*`). It is exactly what crowdy-client-sdk wraps.
- */
-export declare const EXEC_CLIENT_HOST_CALLS: Readonly<Record<string, ReadonlySet<string>>>;
-/**
- * Page-side security broker for browser-target player WASM (production shape,
- * player compute P3).
+ * Page-side security broker for a ck-exec mod's CLIENT half: browser WASM from one
+ * `crowdy-client-sdk` crate, built by the platform and served to a player who consented to it.
  *
  * The untrusted glue worker runs the player module; the broker is the trusted
  * boundary on the page:
  *  - artifact bytes come only from the platform (hash-verified; side-load
- *    refused),
+ *    refused) and are metered (`ck_fuel`, refilled per dispatch),
  *  - a deny-by-default, capability-grouped host-call allowlist crosses the
- *    bridge, each call re-validated (confused-deputy safe) and grid-AABB
- *    filtered on both reads and effects,
+ *    bridge, narrowed to what the player consented to, each call re-validated
+ *    (confused-deputy safe) and grid-AABB filtered on both reads and effects,
  *  - per-call-family rate caps bound a runaway mod,
  *  - a local circuit breaker + per-dispatch watchdog recover the page from a
  *    hung or abusive worker.
@@ -160,6 +169,10 @@ export declare class PlayerCodeBroker {
     private readonly consented;
     private busUnsubscribe;
     private deliveringEventDepth;
+    private logBucket;
+    private droppedLogs;
+    private invokeSeq;
+    private readonly pendingInvokes;
     private readonly busSubscriber;
     constructor(options: PlayerCodeBrokerOptions);
     /**
@@ -179,6 +192,17 @@ export declare class PlayerCodeBroker {
     /** Terminate + respawn on a fresh artifact — the client hot-reload path. */
     restart(artifact: ArrayBuffer): Promise<void>;
     stop(): void;
+    /**
+     * Call the running module's `handle_invoke` export with `payload` and resolve with the bytes
+     * it returns. The page chooses the payload; the reply is the module's, so treat it as
+     * untrusted input. Refused while the module is not running, above
+     * {@link PLAYER_CODE_INVOKE_MAX_BYTES}, or with eight invokes already pending; rejected when
+     * the module traps, stops or does not answer within `timeoutMs` (default 10 s). Each invoke is
+     * one dispatch, on the same fuel budget and watchdog as a tick.
+     */
+    invoke(payload: Uint8Array, options?: {
+        timeoutMs?: number;
+    }): Promise<Uint8Array>;
     /** Clear a tripped circuit so the caller can start again after a fix. */
     resetCircuit(): void;
     private handleMessage;
@@ -193,6 +217,9 @@ export declare class PlayerCodeBroker {
      */
     private reply;
     private spawnWorker;
+    private settleInvoke;
+    /** Forward one worker log line within the rate and size bounds; a sink that throws is ignored. */
+    private forwardLog;
     private stopWorker;
     private armStartupTimer;
     private clearStartupTimer;

package/dist/player-runtime/player-code-broker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"player-code-broker.d.ts","sourceRoot":"","sources":["../../src/player-runtime/player-code-broker.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,eAAe,EACf,kBAAkB,EAEnB,MAAM,4BAA4B,CAAC;AAEpC,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,IAAI,EAAE;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAC/D,gBAAgB,CACd,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,IAAI,GAC/C,IAAI,CAAC;IACR,mBAAmB,CACjB,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,IAAI,GAC/C,IAAI,CAAC;IACR,SAAS,IAAI,IAAI,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,KAAK,GAAG,SAAS,CAAC;IAC3B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,gBAAgB,GAAG,SAAS,CAAC;AAE5D,MAAM,WAAW,uBAAuB;IACtC,6EAA6E;IAC7E,SAAS,EAAE,MAAM,GAAG,GAAG,CAAC;IACxB,IAAI,EAAE,oBAAoB,CAAC;IAC3B;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3D,iFAAiF;IACjF,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE,sBAAsB,KAAK,IAAI,CAAC;IAChE,iFAAiF;IACjF,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,KAAK,oBAAoB,CAAC;IAC5D,8EAA8E;IAC9E,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,gFAAgF;IAChF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sEAAsE;IACtE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACtC;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAChD,CAAC;AAS9B;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CACM,CAAC;AA4ExF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,gBAAgB;IA+Bf,OAAO,CAAC,QAAQ,CAAC,OAAO;IA9BpC,OAAO,CAAC,MAAM,CAAqC;IACnD,OAAO,CAAC,cAAc,CAEN;IAChB,OAAO,CAAC,QAAQ,CAA4B;IAC5C,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA+B;IAC3D,OAAO,CAAC,gBAAgB,CAAgB;IACxC,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,YAAY,CAA8C;IAClE,OAAO,CAAC,aAAa,CAA8C;IACnE,OAAO,CAAC,cAAc,CAEN;IAEhB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAEjB;IACT,OAAO,CAAC,cAAc,CAA6B;IACnD,OAAO,CAAC,oBAAoB,CAAK;IACjC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAG5B;gBAE2B,OAAO,EAAE,uBAAuB;IAE7D;;;OAGG;IACH,YAAY,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO;IAoB7C,OAAO,CAAC,YAAY;IAUpB,OAAO,CAAC,aAAa;IAKrB,OAAO,CAAC,aAAa;IAkCrB;;;;OAIG;IACG,KAAK,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAuCjD,4EAA4E;IACtE,OAAO,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAKnD,IAAI,IAAI,IAAI;IAQZ,yEAAyE;IACzE,YAAY,IAAI,IAAI;YAQN,aAAa;IA4J3B;;;;;;;;OAQG;IACH,OAAO,CAAC,KAAK;IAuCb,OAAO,CAAC,WAAW;IAqCnB,OAAO,CAAC,UAAU;IAclB,OAAO,CAAC,eAAe;IAgBvB,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,gBAAgB;IAYxB,OAAO,CAAC,gBAAgB;IAmBxB,OAAO,CAAC,sBAAsB;IAK9B,OAAO,CAAC,cAAc;IAYtB,OAAO,CAAC,kBAAkB;IAK1B,OAAO,CAAC,aAAa;IAYrB,OAAO,CAAC,WAAW;IAOnB,OAAO,CAAC,iBAAiB;IAazB,OAAO,CAAC,WAAW;IAanB,OAAO,CAAC,UAAU;IAOlB,OAAO,CAAC,eAAe;IAcvB,OAAO,CAAC,WAAW;YAiBL,IAAI;CAOnB"}
+{"version":3,"file":"player-code-broker.d.ts","sourceRoot":"","sources":["../../src/player-runtime/player-code-broker.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EACL,eAAe,EACf,kBAAkB,EAEnB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,sBAAsB,EAAE,CAAC;AAElC,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,IAAI,EAAE;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAC/D,gBAAgB,CACd,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,IAAI,GAC/C,IAAI,CAAC;IACR,mBAAmB,CACjB,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,IAAI,GAC/C,IAAI,CAAC;IACR,SAAS,IAAI,IAAI,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,KAAK,GAAG,SAAS,CAAC;IAC3B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wEAAwE;AACxE,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAErE;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,kBAAkB,CAAC;IAC1B,uFAAuF;IACvF,OAAO,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,qFAAqF;AACrF,eAAO,MAAM,gCAAgC,KAAK,CAAC;AACnD,qDAAqD;AACrD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAC9C,8EAA8E;AAC9E,eAAO,MAAM,4BAA4B,QAAa,CAAC;AAEvD;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,SAAS,CAAC;AAEzC,MAAM,WAAW,uBAAuB;IACtC,6EAA6E;IAC7E,SAAS,EAAE,MAAM,GAAG,GAAG,CAAC;IACxB,IAAI,EAAE,oBAAoB,CAAC;IAC3B;;;;;OAKG;IACH,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B;;;;;OAKG;IACH,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3D,iFAAiF;IACjF,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE,sBAAsB,KAAK,IAAI,CAAC;IAChE;;;;;OAKG;IACH,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAC1C,iFAAiF;IACjF,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,KAAK,oBAAoB,CAAC;IAC5D,8EAA8E;IAC9E,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,gFAAgF;IAChF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sEAAsE;IACtE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACtC;AAkED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,gBAAgB;IA0Cf,OAAO,CAAC,QAAQ,CAAC,OAAO;IAzCpC,OAAO,CAAC,MAAM,CAAqC;IACnD,OAAO,CAAC,cAAc,CAEN;IAChB,OAAO,CAAC,QAAQ,CAA4B;IAC5C,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA+B;IAC3D,OAAO,CAAC,gBAAgB,CAAgB;IACxC,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,YAAY,CAA8C;IAClE,OAAO,CAAC,aAAa,CAA8C;IACnE,OAAO,CAAC,cAAc,CAEN;IAEhB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAExB;IACF,OAAO,CAAC,cAAc,CAA6B;IACnD,OAAO,CAAC,oBAAoB,CAAK;IACjC,OAAO,CAAC,SAAS,CAAgB;IACjC,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAO3B;IACJ,OAAO,CAAC,QAAQ,CAAC,aAAa,CAG5B;gBAE2B,OAAO,EAAE,uBAAuB;IAE7D;;;OAGG;IACH,YAAY,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO;IAoB7C,OAAO,CAAC,YAAY;IAUpB,OAAO,CAAC,aAAa;IAKrB,OAAO,CAAC,aAAa;IAkCrB;;;;OAIG;IACG,KAAK,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAsCjD,4EAA4E;IACtE,OAAO,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAKnD,IAAI,IAAI,IAAI;IAQZ;;;;;;;OAOG;IACH,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,UAAU,CAAC;IA+BtF,yEAAyE;IACzE,YAAY,IAAI,IAAI;YAQN,aAAa;IA+K3B;;;;;;;;OAQG;IACH,OAAO,CAAC,KAAK;IAuCb,OAAO,CAAC,WAAW;IAqCnB,OAAO,CAAC,YAAY;IASpB,kGAAkG;IAClG,OAAO,CAAC,UAAU;IAwClB,OAAO,CAAC,UAAU;IAiBlB,OAAO,CAAC,eAAe;IAgBvB,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,gBAAgB;IAYxB,OAAO,CAAC,gBAAgB;IAmBxB,OAAO,CAAC,sBAAsB;IAK9B,OAAO,CAAC,cAAc;IAYtB,OAAO,CAAC,kBAAkB;IAK1B,OAAO,CAAC,aAAa;IAYrB,OAAO,CAAC,WAAW;IAOnB,OAAO,CAAC,iBAAiB;IAazB,OAAO,CAAC,WAAW;IAanB,OAAO,CAAC,UAAU;IAOlB,OAAO,CAAC,eAAe;IAcvB,OAAO,CAAC,WAAW;YAiBL,IAAI;CAOnB"}