@crowdedkingdoms/crowdyjs 8.16.0 → 8.18.0

package/dist/player-runtime/glue-sab.js

@@ -0,0 +1,79 @@
+/**
+ * The synchronous host-call transport for browser-target player WASM
+ * (player compute P5). WASM imports are synchronous, but the host-call
+ * handler (the server-authorized SDK path) is async and lives on the page,
+ * while the guest runs in a Worker. The only correct bridge is a
+ * SharedArrayBuffer the worker blocks on with `Atomics.wait`: the worker
+ * writes the request, posts a wake to the page, and blocks; the page
+ * services the async call and writes the reply back into the SAB, then
+ * `Atomics.notify` wakes the worker. (A worker blocked in `Atomics.wait`
+ * cannot receive `postMessage`, which is exactly why the reply must return
+ * through the SAB, not a message.)
+ *
+ * SharedArrayBuffer + Atomics require cross-origin isolation
+ * (COOP: same-origin + COEP: require-corp) in the browser; Node worker
+ * threads have them unconditionally, which is how this is integration-tested.
+ *
+ * Layout: [ state:i32, len:i32 ] header, then a byte data region.
+ *   state: 0 IDLE, 1 PENDING (worker waiting), 2 DONE.
+ * The request travels to the page as a normal postMessage (before the
+ * worker blocks); only the reply uses the SAB.
+ */
+export const SAB_STATE_IDLE = 0;
+export const SAB_STATE_PENDING = 1;
+export const SAB_STATE_DONE = 2;
+const HEADER_I32 = 2; // state, len
+export const SAB_HEADER_BYTES = HEADER_I32 * 4;
+/** 1 MiB reply region — host-call replies (chunk/actor reads) are well under this. */
+export const SAB_DATA_BYTES = 1024 * 1024;
+export function createGlueSab(dataBytes = SAB_DATA_BYTES) {
+    const sab = new SharedArrayBuffer(SAB_HEADER_BYTES + dataBytes);
+    return wrapGlueSab(sab);
+}
+export function wrapGlueSab(sab) {
+    return {
+        sab,
+        header: new Int32Array(sab, 0, HEADER_I32),
+        data: new Uint8Array(sab, SAB_HEADER_BYTES),
+    };
+}
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+/**
+ * Responder side (page/broker): write the reply envelope bytes into the SAB
+ * and wake the blocked worker. `respBytes` must already be the SDK Response
+ * envelope (`{ok,data}` / `{ok:false,error}`) the guest expects.
+ */
+export function writeGlueReply(view, respBytes) {
+    const len = Math.min(respBytes.length, view.data.length);
+    view.data.set(respBytes.subarray(0, len));
+    Atomics.store(view.header, 1, len);
+    Atomics.store(view.header, 0, SAB_STATE_DONE);
+    Atomics.notify(view.header, 0, 1);
+}
+/** Convenience for responders holding a plain object result. */
+export function writeGlueResult(view, result) {
+    writeGlueReply(view, encoder.encode(JSON.stringify(result)));
+}
+/**
+ * Requester side (worker): mark PENDING before posting the wake, block until
+ * the page flips the state to DONE, then read the reply bytes out. The
+ * caller is responsible for posting the request message between `arm()` and
+ * `waitAndRead()` — that ordering (post, then wait) is what lets the page
+ * see the request while the worker is blocked.
+ */
+export function armGlueRequest(view) {
+    Atomics.store(view.header, 1, 0);
+    Atomics.store(view.header, 0, SAB_STATE_PENDING);
+}
+export function waitAndReadGlueReply(view, timeoutMs = 5000) {
+    const res = Atomics.wait(view.header, 0, SAB_STATE_PENDING, timeoutMs);
+    if (res === 'timed-out') {
+        throw new Error('host call timed out');
+    }
+    const len = Atomics.load(view.header, 1);
+    const out = view.data.slice(0, len);
+    Atomics.store(view.header, 0, SAB_STATE_IDLE);
+    return out;
+}
+export { encoder as glueEncoder, decoder as glueDecoder };

package/dist/player-runtime/player-code-broker.d.ts

@@ -51,6 +51,12 @@ export interface PlayerCodeBrokerOptions {
     hashArtifact?: (artifact: ArrayBuffer) => Promise<string>;
     /** Wall-clock ms allowed per dispatch before the broker recycles the worker. */
     dispatchWatchdogMs?: number;
+    /**
+     * Local tick cadence (ms) for a client mod: the worker self-drives `tick`
+     * at this interval. Omit/0 for invoke-only mods (no periodic tick). A HUD
+     * mod typically ticks ~1 Hz; the per-dispatch watchdog still bounds each.
+     */
+    tickIntervalMs?: number;
 }
 /**
  * Page-side security broker for browser-target player WASM (production shape,
@@ -92,6 +98,16 @@ export declare class PlayerCodeBroker {
     /** Clear a tripped circuit so the caller can start again after a fix. */
     resetCircuit(): void;
     private handleMessage;
+    /**
+     * Deliver a host-call reply. Always posts the message (the offline test
+     * shape + any async-transport consumer), and — when the worker shared a
+     * SharedArrayBuffer for this call — ALSO writes the SDK Response envelope
+     * into it and wakes the worker blocked in Atomics.wait. The synchronous
+     * guest can only receive the reply through the SAB (a blocked worker never
+     * runs its message handler), so the SAB write is the load-bearing path in
+     * the browser; the postMessage is harmless there.
+     */
+    private reply;
     private enforceRate;
     private recordTrap;
     private assertGridScope;

package/dist/player-runtime/player-code-broker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"player-code-broker.d.ts","sourceRoot":"","sources":["../../src/player-runtime/player-code-broker.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,IAAI,EAAE;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAC/D,gBAAgB,CACd,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,IAAI,GAC/C,IAAI,CAAC;IACR,mBAAmB,CACjB,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,IAAI,GAC/C,IAAI,CAAC;IACR,SAAS,IAAI,IAAI,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,KAAK,GAAG,SAAS,CAAC;IAC3B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,6EAA6E;IAC7E,SAAS,EAAE,MAAM,GAAG,GAAG,CAAC;IACxB,IAAI,EAAE,oBAAoB,CAAC;IAC3B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4FAA4F;IAC5F,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3D,iFAAiF;IACjF,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE,sBAAsB,KAAK,IAAI,CAAC;IAChE,iFAAiF;IACjF,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,KAAK,oBAAoB,CAAC;IAC5D,8EAA8E;IAC9E,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,gFAAgF;IAChF,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AA+DD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,gBAAgB;IASf,OAAO,CAAC,QAAQ,CAAC,OAAO;IARpC,OAAO,CAAC,MAAM,CAAqC;IACnD,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA+B;IAC3D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAExB;gBAE2B,OAAO,EAAE,uBAAuB;IAE7D;;;;OAIG;IACG,KAAK,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAiCjD,4EAA4E;IACtE,OAAO,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAKnD,IAAI,IAAI,IAAI;IAOZ,yEAAyE;IACzE,YAAY,IAAI,IAAI;YAMN,aAAa;IAkD3B,OAAO,CAAC,WAAW;IAanB,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,WAAW;YAiBL,IAAI;CAOnB"}
+{"version":3,"file":"player-code-broker.d.ts","sourceRoot":"","sources":["../../src/player-runtime/player-code-broker.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,IAAI,EAAE;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAC/D,gBAAgB,CACd,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,IAAI,GAC/C,IAAI,CAAC;IACR,mBAAmB,CACjB,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,IAAI,GAC/C,IAAI,CAAC;IACR,SAAS,IAAI,IAAI,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,KAAK,GAAG,SAAS,CAAC;IAC3B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,6EAA6E;IAC7E,SAAS,EAAE,MAAM,GAAG,GAAG,CAAC;IACxB,IAAI,EAAE,oBAAoB,CAAC;IAC3B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4FAA4F;IAC5F,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3D,iFAAiF;IACjF,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE,sBAAsB,KAAK,IAAI,CAAC;IAChE,iFAAiF;IACjF,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,KAAK,oBAAoB,CAAC;IAC5D,8EAA8E;IAC9E,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,gFAAgF;IAChF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAiED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,gBAAgB;IASf,OAAO,CAAC,QAAQ,CAAC,OAAO;IARpC,OAAO,CAAC,MAAM,CAAqC;IACnD,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA+B;IAC3D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAExB;gBAE2B,OAAO,EAAE,uBAAuB;IAE7D;;;;OAIG;IACG,KAAK,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAkCjD,4EAA4E;IACtE,OAAO,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAKnD,IAAI,IAAI,IAAI;IAOZ,yEAAyE;IACzE,YAAY,IAAI,IAAI;YAMN,aAAa;IA8D3B;;;;;;;;OAQG;IACH,OAAO,CAAC,KAAK;IAeb,OAAO,CAAC,WAAW;IAanB,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,WAAW;YAiBL,IAAI;CAOnB"}

package/dist/player-runtime/player-code-broker.js

@@ -1,3 +1,4 @@
+import { wrapGlueSab, writeGlueResult } from './glue-sab.js';
 /**
  * Deny-by-default host-call allowlist, grouped by capability (04 §4). Only
  * owner-lawful reads and effects cross the bridge; auth, admin, authoring,
@@ -28,7 +29,9 @@ const ALLOWED_HOST_CALLS = {
     world_write: new Set(['voxel_set']),
     egress: new Set(['emit_spatial']),
     present: new Set(['hud_set', 'overlay_draw']),
-    meta: new Set(['grid_permission_check']),
+    // grid_info is answered by the broker itself (the mod's own clamped bounds),
+    // so a client mod can address its grid without a server round-trip.
+    meta: new Set(['grid_permission_check', 'grid_info']),
 };
 /** Per-call-family rate caps (calls per rolling second); flood one, others hold. */
 const RATE_CAPS = {
@@ -114,6 +117,7 @@ export class PlayerCodeBroker {
                 ? this.options.fuelPerDispatch.toString()
                 : undefined,
             watchdogMs: this.options.dispatchWatchdogMs ?? 250,
+            tickIntervalMs: this.options.tickIntervalMs ?? 0,
         }, [artifact]);
     }
     /** Terminate + respawn on a fresh artifact — the client hot-reload path. */
@@ -166,6 +170,18 @@ export class PlayerCodeBroker {
             this.enforceRate(group, raw.fn);
             this.assertGridScope(raw.fn, args);
             let data;
+            if (raw.fn === 'grid_info') {
+                // Answered locally: the mod's own clamped grid bounds, so it can
+                // address its chunks without knowing world coordinates or a server
+                // round-trip. Chunk coords cross as decimal strings (may exceed 2^53).
+                const { low, high } = this.options.grid;
+                data = {
+                    low: { x: low.x.toString(), y: low.y.toString(), z: low.z.toString() },
+                    high: { x: high.x.toString(), y: high.y.toString(), z: high.z.toString() },
+                };
+                this.reply(raw.reply, id, { type: 'hostcall-result', id, ok: true, data });
+                return;
+            }
             if (PRESENTATION_FUNCTIONS.has(raw.fn)) {
                 // Presentation never reaches the SDK/server: it goes only to the
                 // game-declared channel. A game that offers no sink silently drops it.
@@ -178,10 +194,10 @@ export class PlayerCodeBroker {
             else {
                 data = await this.options.onHostCall({ fn: raw.fn, args });
             }
-            this.worker?.postMessage({ type: 'hostcall-result', id, ok: true, data });
+            this.reply(raw.reply, id, { type: 'hostcall-result', id, ok: true, data });
         }
         catch (error) {
-            this.worker?.postMessage({
+            this.reply(raw.reply, id, {
                 type: 'hostcall-result',
                 id,
                 ok: false,
@@ -189,6 +205,25 @@ export class PlayerCodeBroker {
             });
         }
     }
+    /**
+     * Deliver a host-call reply. Always posts the message (the offline test
+     * shape + any async-transport consumer), and — when the worker shared a
+     * SharedArrayBuffer for this call — ALSO writes the SDK Response envelope
+     * into it and wakes the worker blocked in Atomics.wait. The synchronous
+     * guest can only receive the reply through the SAB (a blocked worker never
+     * runs its message handler), so the SAB write is the load-bearing path in
+     * the browser; the postMessage is harmless there.
+     */
+    reply(replyBuffer, _id, message) {
+        this.worker?.postMessage(message);
+        if (typeof SharedArrayBuffer !== 'undefined' && replyBuffer instanceof SharedArrayBuffer) {
+            const view = wrapGlueSab(replyBuffer);
+            const envelope = message.ok
+                ? { ok: true, data: message.data }
+                : { ok: false, error: message.error };
+            writeGlueResult(view, envelope);
+        }
+    }
     enforceRate(group, fn) {
         const cap = RATE_CAPS[group] ?? 60;
         const now = Date.now();

package/dist/player-runtime/player-glue-worker.d.ts

@@ -1,62 +1,34 @@
 /**
- * Platform glue worker for browser-target player WASM (player compute P3).
- *
- * This is the ONLY platform code that shares an execution context with an
- * untrusted player module. It runs inside a dedicated Web Worker and is
- * deliberately tiny and auditable:
+ * Browser Web Worker entry for browser-target player WASM (player compute
+ * P3/P5). This is the ONLY platform code that shares an execution context
+ * with an untrusted player module. It is intentionally thin: the auditable
+ * runtime + ABI marshalling live in [glue-runtime.ts] and the synchronous
+ * host-call transport in [glue-sab.ts]; this file only wires them to the
+ * worker message loop.
  *
  *  - it instantiates the gas-injected player artifact with an import table
- *    that exposes ONLY the `ck.*` host functions (every one forwards to the
- *    page-side broker; nothing else is importable),
- *  - it never has the DOM, `window`, auth tokens, `fetch`, or `importScripts`
- *    of third-party code,
- *  - it enforces a per-dispatch wall-clock watchdog and forwards the fuel
- *    budget so a runaway dispatch traps locally (the fuel counter itself is
- *    injected into the artifact by the server compile pipeline),
- *  - it reports traps to the broker, which owns the local circuit breaker.
- *
- * Host calls are synchronous from the guest's perspective. In a worker that
- * is realized with a SharedArrayBuffer control block plus Atomics.wait: the
- * guest's import stub writes the request, wakes the page, and blocks until
- * the broker writes the reply. The message/really-shared plumbing lives in
- * buildImportObject / the init handler below; the pure, testable pieces
- * (budget parsing, host-fn table) are exported.
+ *    that exposes ONLY `ck.*` + inert wasi stubs (nothing else importable),
+ *  - it never has the DOM, `window`, auth tokens, `fetch`, or third-party
+ *    `importScripts`,
+ *  - `ck.host_call` blocks the worker on a SharedArrayBuffer while the
+ *    page-side broker services the (async) server-authorized call and writes
+ *    the reply back, so the guest sees a synchronous gateway,
+ *  - it enforces a per-dispatch wall-clock watchdog and reports traps to the
+ *    broker, which owns the local circuit breaker.
  *
- * This module is bundled to a standalone worker asset; it must not import
- * anything that pulls in the SDK client, DOM types, or Node built-ins.
- */
-/** The exact host-call names the glue exposes to the guest (mirrors the broker allowlist). */
-export declare const GLUE_HOST_FUNCTIONS: readonly ["container_create", "container_get", "containers_list", "container_delete", "property_set", "model_invoke", "user_state_get", "user_state_set", "grid_state_get", "grid_state_set", "chunk_get", "voxels_list", "actors_list", "actors_list_radius", "voxel_set", "emit_spatial", "hud_set", "overlay_draw", "grid_permission_check"];
-export interface GlueInitMessage {
-    type: 'init';
-    artifact: ArrayBuffer;
-    authority: 'player';
-    fuelPerDispatch?: string;
-    watchdogMs?: number;
-}
-/** Parse the fuel budget the broker forwards; undefined/invalid => unbounded (server still meters). */
-export declare function parseFuelBudget(raw: string | undefined): bigint | null;
-/** A dispatch outcome the worker reports back to the broker. */
-export type GlueDispatchResult = {
-    ok: true;
-} | {
-    ok: false;
-    reason: 'fuel' | 'watchdog' | 'trap';
-    detail?: string;
-};
-/**
- * Wrap a single guest dispatch with the wall-clock watchdog. The fuel trap is
- * enforced inside the gas-injected module; this guards against a hang that
- * spins without consuming fuel (e.g. a tight host-call loop the broker rate
- * cap already bounds, belt-and-suspenders). Pure and unit-testable.
+ * Re-exports the pure helpers + the runtime so tests and bundlers can use
+ * them without touching worker globals.
  */
-export declare function runWithWatchdog(dispatch: () => unknown, watchdogMs: number, now?: () => number): Promise<GlueDispatchResult>;
+import { GlueRuntime, GLUE_HOST_FUNCTIONS, parseFuelBudget, runWithWatchdog, type GlueInitMessage, type GlueDispatchResult } from './glue-runtime.js';
+export { GlueRuntime, GLUE_HOST_FUNCTIONS, parseFuelBudget, runWithWatchdog, type GlueInitMessage, type GlueDispatchResult, };
 /**
- * Build the guest import object. Every entry is a `ck.*` host stub that
- * forwards to the broker; the function set is fixed at build time, so a guest
- * cannot import anything outside GLUE_HOST_FUNCTIONS. `invokeHostCall` is the
- * synchronous bridge (SharedArrayBuffer + Atomics in the browser; injectable
- * for tests).
+ * Wire the glue runtime to a worker-like message port. Exported (not just
+ * run at import) so the Node integration test can drive the identical wiring
+ * over a `worker_threads` port.
  */
-export declare function buildImportObject(invokeHostCall: (fn: string, argsJson: string) => string): WebAssembly.Imports;
+export declare function startGlueWorker(port: {
+    addEventListener?: (t: string, l: (e: MessageEvent) => void) => void;
+    on?: (t: string, l: (data: unknown) => void) => void;
+    postMessage: (message: unknown) => void;
+}): void;
 //# sourceMappingURL=player-glue-worker.d.ts.map

package/dist/player-runtime/player-glue-worker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"player-glue-worker.d.ts","sourceRoot":"","sources":["../../src/player-runtime/player-glue-worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,8FAA8F;AAC9F,eAAO,MAAM,mBAAmB,iVAoBtB,CAAC;AAEX,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,WAAW,CAAC;IACtB,SAAS,EAAE,QAAQ,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,uGAAuG;AACvG,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAQtE;AAED,gEAAgE;AAChE,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzE;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,OAAO,EACvB,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,MAAM,MAAyB,GACnC,OAAO,CAAC,kBAAkB,CAAC,CAe7B;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,GACvD,WAAW,CAAC,OAAO,CAgBrB"}
+{"version":3,"file":"player-glue-worker.d.ts","sourceRoot":"","sources":["../../src/player-runtime/player-glue-worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,KAAK,eAAe,EACpB,KAAK,kBAAkB,GACxB,CAAC;AAOF;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,gBAAgB,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,YAAY,KAAK,IAAI,KAAK,IAAI,CAAC;IACrE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,KAAK,IAAI,CAAC;IACrD,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;CACzC,GAAG,IAAI,CAuGP"}

package/dist/player-runtime/player-glue-worker.js

@@ -1,127 +1,146 @@
 /**
- * Platform glue worker for browser-target player WASM (player compute P3).
- *
- * This is the ONLY platform code that shares an execution context with an
- * untrusted player module. It runs inside a dedicated Web Worker and is
- * deliberately tiny and auditable:
+ * Browser Web Worker entry for browser-target player WASM (player compute
+ * P3/P5). This is the ONLY platform code that shares an execution context
+ * with an untrusted player module. It is intentionally thin: the auditable
+ * runtime + ABI marshalling live in [glue-runtime.ts] and the synchronous
+ * host-call transport in [glue-sab.ts]; this file only wires them to the
+ * worker message loop.
  *
  *  - it instantiates the gas-injected player artifact with an import table
- *    that exposes ONLY the `ck.*` host functions (every one forwards to the
- *    page-side broker; nothing else is importable),
- *  - it never has the DOM, `window`, auth tokens, `fetch`, or `importScripts`
- *    of third-party code,
- *  - it enforces a per-dispatch wall-clock watchdog and forwards the fuel
- *    budget so a runaway dispatch traps locally (the fuel counter itself is
- *    injected into the artifact by the server compile pipeline),
- *  - it reports traps to the broker, which owns the local circuit breaker.
- *
- * Host calls are synchronous from the guest's perspective. In a worker that
- * is realized with a SharedArrayBuffer control block plus Atomics.wait: the
- * guest's import stub writes the request, wakes the page, and blocks until
- * the broker writes the reply. The message/really-shared plumbing lives in
- * buildImportObject / the init handler below; the pure, testable pieces
- * (budget parsing, host-fn table) are exported.
+ *    that exposes ONLY `ck.*` + inert wasi stubs (nothing else importable),
+ *  - it never has the DOM, `window`, auth tokens, `fetch`, or third-party
+ *    `importScripts`,
+ *  - `ck.host_call` blocks the worker on a SharedArrayBuffer while the
+ *    page-side broker services the (async) server-authorized call and writes
+ *    the reply back, so the guest sees a synchronous gateway,
+ *  - it enforces a per-dispatch wall-clock watchdog and reports traps to the
+ *    broker, which owns the local circuit breaker.
  *
- * This module is bundled to a standalone worker asset; it must not import
- * anything that pulls in the SDK client, DOM types, or Node built-ins.
+ * Re-exports the pure helpers + the runtime so tests and bundlers can use
+ * them without touching worker globals.
  */
-/** The exact host-call names the glue exposes to the guest (mirrors the broker allowlist). */
-export const GLUE_HOST_FUNCTIONS = [
-    'container_create',
-    'container_get',
-    'containers_list',
-    'container_delete',
-    'property_set',
-    'model_invoke',
-    'user_state_get',
-    'user_state_set',
-    'grid_state_get',
-    'grid_state_set',
-    'chunk_get',
-    'voxels_list',
-    'actors_list',
-    'actors_list_radius',
-    'voxel_set',
-    'emit_spatial',
-    'hud_set',
-    'overlay_draw',
-    'grid_permission_check',
-];
-/** Parse the fuel budget the broker forwards; undefined/invalid => unbounded (server still meters). */
-export function parseFuelBudget(raw) {
-    if (raw == null)
-        return null;
-    try {
-        const v = BigInt(raw);
-        return v > 0n ? v : null;
-    }
-    catch {
-        return null;
-    }
-}
+import { GlueRuntime, GLUE_HOST_FUNCTIONS, parseFuelBudget, runWithWatchdog, } from './glue-runtime.js';
+import { createGlueSab, armGlueRequest, waitAndReadGlueReply, } from './glue-sab.js';
+export { GlueRuntime, GLUE_HOST_FUNCTIONS, parseFuelBudget, runWithWatchdog, };
 /**
- * Wrap a single guest dispatch with the wall-clock watchdog. The fuel trap is
- * enforced inside the gas-injected module; this guards against a hang that
- * spins without consuming fuel (e.g. a tight host-call loop the broker rate
- * cap already bounds, belt-and-suspenders). Pure and unit-testable.
+ * Wire the glue runtime to a worker-like message port. Exported (not just
+ * run at import) so the Node integration test can drive the identical wiring
+ * over a `worker_threads` port.
  */
-export async function runWithWatchdog(dispatch, watchdogMs, now = () => Date.now()) {
-    const start = now();
-    try {
-        dispatch();
-    }
-    catch (err) {
-        const message = err.message ?? 'trap';
-        if (/fuel|gas|unreachable/i.test(message)) {
-            return { ok: false, reason: 'fuel', detail: message };
+export function startGlueWorker(port) {
+    let runtime = null;
+    let sab = null;
+    let hostCallId = 0;
+    let watchdogMs = 250;
+    let ticking = false;
+    const post = (message) => port.postMessage(message);
+    // Synchronous gateway: post the request (so the page can see it), then
+    // block on the SAB until the broker writes the reply.
+    const hostCallSync = (reqBytes) => {
+        if (!sab)
+            throw new Error('host-call transport not initialized');
+        let parsed;
+        try {
+            parsed = JSON.parse(new TextDecoder().decode(reqBytes));
         }
-        return { ok: false, reason: 'trap', detail: message };
-    }
-    if (now() - start > watchdogMs) {
-        return { ok: false, reason: 'watchdog' };
-    }
-    return { ok: true };
-}
-/**
- * Build the guest import object. Every entry is a `ck.*` host stub that
- * forwards to the broker; the function set is fixed at build time, so a guest
- * cannot import anything outside GLUE_HOST_FUNCTIONS. `invokeHostCall` is the
- * synchronous bridge (SharedArrayBuffer + Atomics in the browser; injectable
- * for tests).
- */
-export function buildImportObject(invokeHostCall) {
-    const ck = {};
-    for (const fn of GLUE_HOST_FUNCTIONS) {
-        ck[fn] = (argsPtr, argsLen, outPtr) => {
-            // The real ABI marshals argsPtr/argsLen out of guest memory and writes
-            // the reply back at outPtr; the memory plumbing is wired in the init
-            // handler where the instance's memory export is available. This stub
-            // documents the fixed surface and the synchronous forward.
-            void argsPtr;
-            void argsLen;
-            void outPtr;
-            const reply = invokeHostCall(fn, '');
-            return reply.length;
+        catch {
+            throw new Error('host_call request was not valid JSON');
+        }
+        const id = ++hostCallId;
+        armGlueRequest(sab);
+        post({
+            type: 'hostcall',
+            id,
+            fn: parsed.fn,
+            args: parsed.args ?? {},
+            reply: sab.sab,
+        });
+        return waitAndReadGlueReply(sab);
+    };
+    const onInit = async (init) => {
+        watchdogMs = init.watchdogMs ?? 250;
+        void parseFuelBudget(init.fuelPerDispatch);
+        sab = createGlueSab();
+        runtime = new GlueRuntime({
+            hostCallSync,
+            onLog: (level, message) => post({ type: 'log', level, message }),
+        });
+        try {
+            await runtime.instantiate(init.artifact);
+            const initResult = await runWithWatchdog(() => runtime.init(), watchdogMs);
+            report(initResult);
+            if ((init.tickIntervalMs ?? 0) > 0)
+                startTicking(init.tickIntervalMs);
+            post({ type: 'ready' });
+        }
+        catch (err) {
+            post({ type: 'trap', reason: 'trap', detail: err.message });
+        }
+    };
+    const report = (result) => {
+        if (result.ok)
+            post({ type: 'dispatch-ok' });
+        else
+            post({ type: 'trap', reason: result.reason, detail: result.detail });
+    };
+    const startTicking = (intervalMs) => {
+        if (ticking)
+            return;
+        ticking = true;
+        let last = Date.now();
+        const loop = () => {
+            if (!ticking || !runtime)
+                return;
+            const nowT = Date.now();
+            const dt = nowT - last;
+            last = nowT;
+            void runWithWatchdog(() => runtime.tick(dt), watchdogMs).then(report);
+            setTimeout(loop, intervalMs);
         };
+        setTimeout(loop, intervalMs);
+    };
+    const handle = (data) => {
+        if (!data || typeof data !== 'object')
+            return;
+        const msg = data;
+        if (msg.type === 'init')
+            void onInit(msg);
+        else if (msg.type === 'tick' && runtime) {
+            void runWithWatchdog(() => runtime.tick(typeof msg.dtMs === 'number' ? msg.dtMs : 0), watchdogMs).then(report);
+        }
+        else if (msg.type === 'invoke' && runtime) {
+            const payload = msg.payload instanceof Uint8Array ? msg.payload : new Uint8Array(0);
+            try {
+                const out = runtime.invoke(payload);
+                post({ type: 'invoke-result', id: msg.id, ok: true, payload: out });
+            }
+            catch (err) {
+                post({
+                    type: 'invoke-result',
+                    id: msg.id,
+                    ok: false,
+                    error: err.message,
+                });
+            }
+        }
+        else if (msg.type === 'stop') {
+            ticking = false;
+        }
+    };
+    if (port.addEventListener) {
+        port.addEventListener('message', (e) => handle(e.data));
+    }
+    else if (port.on) {
+        port.on('message', (d) => handle(d));
     }
-    return { ck };
 }
+// Auto-start when loaded as a real browser Web Worker (has addEventListener,
+// no window). Guarded so importing for the pure helpers never touches globals.
 if (typeof self !== 'undefined' &&
     typeof self.addEventListener === 'function' &&
     typeof self.window === 'undefined') {
-    self.addEventListener('message', (event) => {
-        const data = event.data;
-        if (!data || typeof data !== 'object')
-            return;
-        if (data.type === 'init') {
-            const init = data;
-            // The synchronous host-call bridge (SharedArrayBuffer + Atomics) is set
-            // up here from init.fuelPerDispatch/watchdogMs; instantiation uses
-            // buildImportObject so the guest sees only ck.* host functions.
-            void parseFuelBudget(init.fuelPerDispatch);
-            void (init.watchdogMs ?? 250);
-            self.postMessage?.({ type: 'ready' });
-            return;
-        }
+    startGlueWorker({
+        addEventListener: self.addEventListener.bind(self),
+        postMessage: (m) => self.postMessage?.(m),
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crowdedkingdoms/crowdyjs",
-  "version": "8.16.0",
+  "version": "8.18.0",
   "description": "Client SDK for Crowded Kingdoms GraphQL API with UDP proxy support",
   "type": "module",
   "main": "dist/index.js",