@crowdedkingdoms/crowdyjs 8.21.1 → 8.22.0

package/dist/index.d.ts

@@ -45,7 +45,7 @@
  * or internal tooling, never an untrusted browser.
  */
 /** The published package version. Mirrors `package.json`. */
-export declare const VERSION = "8.21.1";
+export declare const VERSION = "8.22.0";
 export { LbCookieStore } from './lb-cookie-store.js';
 export { CrowdyClient, createCrowdyClient, type CrowdyClientConfig, } from './crowdy-client.js';
 export { BrowserLocalStorageTokenStore, SessionStore, type SessionListener, type TokenStore, } from './session.js';

package/dist/index.js

@@ -45,7 +45,7 @@
  * or internal tooling, never an untrusted browser.
  */
 /** The published package version. Mirrors `package.json`. */
-export const VERSION = '8.21.1';
+export const VERSION = '8.22.0';
 export { LbCookieStore } from './lb-cookie-store.js';
 export { CrowdyClient, createCrowdyClient, } from './crowdy-client.js';
 export { BrowserLocalStorageTokenStore, SessionStore, } from './session.js';

package/dist/player-runtime/glue-runtime.d.ts

@@ -25,12 +25,18 @@ export interface GlueInitMessage {
     type: 'init';
     artifact: ArrayBuffer;
     authority: 'player';
+    /** Server-authored budget loaded into an injected mutable `ck_fuel` global. */
     fuelPerDispatch?: string;
+    /** Legacy metadata; the hard watchdog is owned by the page-side broker. */
     watchdogMs?: number;
+    hostCallTimeoutMs?: number;
     /** Local client tick cadence in ms (0/undefined => no self-tick). */
     tickIntervalMs?: number;
 }
-/** Parse the fuel budget the broker forwards; undefined/invalid => unbounded (server still meters). */
+/**
+ * Parse the server-authored budget used to refill an instrumented artifact's
+ * mutable `ck_fuel` global before every guest dispatch.
+ */
 export declare function parseFuelBudget(raw: string | undefined): bigint | null;
 /** A dispatch outcome the worker reports back to the broker. */
 export type GlueDispatchResult = {
@@ -41,9 +47,9 @@ export type GlueDispatchResult = {
     detail?: string;
 };
 /**
- * Wrap a single guest dispatch with the wall-clock watchdog. The fuel trap is
- * enforced inside the gas-injected module; this guards against a hang that
- * spins without consuming fuel. Pure and unit-testable.
+ * Classify a completed guest dispatch by elapsed wall time. This cannot
+ * interrupt synchronous WASM; the page-side PlayerCodeBroker owns the hard
+ * dispatch watchdog and terminates a worker whose dispatch never returns.
  */
 export declare function runWithWatchdog(dispatch: () => unknown, watchdogMs: number, now?: () => number): Promise<GlueDispatchResult>;
 /** The minimal guest-instance surface the runtime drives (a real WebAssembly.Instance satisfies it). */
@@ -51,6 +57,7 @@ export interface GuestExports {
     memory: {
         buffer: ArrayBuffer;
     };
+    ck_fuel?: WebAssembly.Global;
     ck_alloc(len: number): number;
     ck_free?(ptr: number, len: number): void;
     init?(): void;
@@ -66,6 +73,7 @@ export interface GlueRuntimeOptions {
     /** Deterministic-enough randomness for the guest `random_get` (defaults to crypto). */
     randomFill?: (buf: Uint8Array) => void;
     now?: () => number;
+    fuelPerDispatch?: bigint | null;
 }
 /**
  * Drives one untrusted guest module: builds the `ck` + wasi import table,
@@ -79,6 +87,7 @@ export declare class GlueRuntime {
     private exports;
     private stateBlob;
     constructor(options: GlueRuntimeOptions);
+    private resetFuel;
     /** The import object handed to `WebAssembly.instantiate`. Guest sees only these. */
     buildImports(getExports: () => GuestExports | null): WebAssembly.Imports;
     instantiate(artifact: ArrayBuffer): Promise<void>;

package/dist/player-runtime/glue-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"glue-runtime.d.ts","sourceRoot":"","sources":["../../src/player-runtime/glue-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,8EAA8E;AAC9E,eAAO,MAAM,mBAAmB,iVAoBtB,CAAC;AAEX,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,WAAW,CAAC;IACtB,SAAS,EAAE,QAAQ,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,uGAAuG;AACvG,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAQtE;AAED,gEAAgE;AAChE,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzE;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,OAAO,EACvB,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,MAAM,MAAyB,GACnC,OAAO,CAAC,kBAAkB,CAAC,CAe7B;AAED,wGAAwG;AACxG,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE;QAAE,MAAM,EAAE,WAAW,CAAA;KAAE,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,IAAI,CAAC,IAAI,IAAI,CAAC;IACd,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAC1D,QAAQ,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IACjC,4FAA4F;IAC5F,YAAY,EAAE,CAAC,QAAQ,EAAE,UAAU,KAAK,UAAU,CAAC;IACnD,gEAAgE;IAChE,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACjD,uFAAuF;IACvF,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,IAAI,CAAC;IACvC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAgBD;;;;;;GAMG;AACH,qBAAa,WAAW;IAIV,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHpC,OAAO,CAAC,OAAO,CAA6B;IAC5C,OAAO,CAAC,SAAS,CAAiC;gBAErB,OAAO,EAAE,kBAAkB;IAExD,oFAAoF;IACpF,YAAY,CAAC,UAAU,EAAE,MAAM,YAAY,GAAG,IAAI,GAAG,WAAW,CAAC,OAAO;IAkFlE,WAAW,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAUvD,gEAAgE;IAChE,IAAI,IAAI,IAAI;IAIZ,gFAAgF;IAChF,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAIxB,sFAAsF;IACtF,MAAM,CAAC,OAAO,EAAE,UAAU,GAAG,UAAU;CAcxC"}
+{"version":3,"file":"glue-runtime.d.ts","sourceRoot":"","sources":["../../src/player-runtime/glue-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,8EAA8E;AAC9E,eAAO,MAAM,mBAAmB,iVAoBtB,CAAC;AAEX,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,WAAW,CAAC;IACtB,SAAS,EAAE,QAAQ,CAAC;IACpB,+EAA+E;IAC/E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qEAAqE;IACrE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAQtE;AAED,gEAAgE;AAChE,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzE;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,OAAO,EACvB,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,MAAM,MAAyB,GACnC,OAAO,CAAC,kBAAkB,CAAC,CAe7B;AAED,wGAAwG;AACxG,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE;QAAE,MAAM,EAAE,WAAW,CAAA;KAAE,CAAC;IAChC,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,IAAI,CAAC,IAAI,IAAI,CAAC;IACd,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAC1D,QAAQ,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IACjC,4FAA4F;IAC5F,YAAY,EAAE,CAAC,QAAQ,EAAE,UAAU,KAAK,UAAU,CAAC;IACnD,gEAAgE;IAChE,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACjD,uFAAuF;IACvF,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,IAAI,CAAC;IACvC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAkCD;;;;;;GAMG;AACH,qBAAa,WAAW;IAIV,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHpC,OAAO,CAAC,OAAO,CAA6B;IAC5C,OAAO,CAAC,SAAS,CAAiC;gBAErB,OAAO,EAAE,kBAAkB;IAExD,OAAO,CAAC,SAAS;IASjB,oFAAoF;IACpF,YAAY,CAAC,UAAU,EAAE,MAAM,YAAY,GAAG,IAAI,GAAG,WAAW,CAAC,OAAO;IA4FlE,WAAW,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAUvD,gEAAgE;IAChE,IAAI,IAAI,IAAI;IAKZ,gFAAgF;IAChF,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAKxB,sFAAsF;IACtF,MAAM,CAAC,OAAO,EAAE,UAAU,GAAG,UAAU;CAuBxC"}

package/dist/player-runtime/glue-runtime.js

@@ -41,7 +41,10 @@ export const GLUE_HOST_FUNCTIONS = [
     'overlay_draw',
     'grid_permission_check',
 ];
-/** Parse the fuel budget the broker forwards; undefined/invalid => unbounded (server still meters). */
+/**
+ * Parse the server-authored budget used to refill an instrumented artifact's
+ * mutable `ck_fuel` global before every guest dispatch.
+ */
 export function parseFuelBudget(raw) {
     if (raw == null)
         return null;
@@ -54,9 +57,9 @@ export function parseFuelBudget(raw) {
     }
 }
 /**
- * Wrap a single guest dispatch with the wall-clock watchdog. The fuel trap is
- * enforced inside the gas-injected module; this guards against a hang that
- * spins without consuming fuel. Pure and unit-testable.
+ * Classify a completed guest dispatch by elapsed wall time. This cannot
+ * interrupt synchronous WASM; the page-side PlayerCodeBroker owns the hard
+ * dispatch watchdog and terminates a worker whose dispatch never returns.
  */
 export async function runWithWatchdog(dispatch, watchdogMs, now = () => Date.now()) {
     const start = now();
@@ -76,6 +79,16 @@ export async function runWithWatchdog(dispatch, watchdogMs, now = () => Date.now
     return { ok: true };
 }
 const textDecoder = new TextDecoder();
+function assertMemoryRange(buffer, ptr, len, operation) {
+    if (!Number.isSafeInteger(ptr) ||
+        !Number.isSafeInteger(len) ||
+        ptr < 0 ||
+        len < 0 ||
+        ptr > buffer.byteLength ||
+        len > buffer.byteLength - ptr) {
+        throw new RangeError(`${operation} is outside guest memory`);
+    }
+}
 function defaultRandomFill(buf) {
     const c = globalThis.crypto;
     if (c?.getRandomValues) {
@@ -102,6 +115,15 @@ export class GlueRuntime {
         this.exports = null;
         this.stateBlob = new Uint8Array(0);
     }
+    resetFuel() {
+        const fuel = this.exports?.ck_fuel;
+        if (!fuel)
+            return;
+        if (this.options.fuelPerDispatch == null) {
+            throw new Error('instrumented artifact is missing a fuel budget');
+        }
+        fuel.value = this.options.fuelPerDispatch;
+    }
     /** The import object handed to `WebAssembly.instantiate`. Guest sees only these. */
     buildImports(getExports) {
         const mem = () => {
@@ -114,17 +136,21 @@ export class GlueRuntime {
             const ex = getExports();
             if (!ex)
                 throw new Error('guest not instantiated');
+            const buffer = ex.memory.buffer;
+            assertMemoryRange(buffer, ptr, len, 'guest memory read');
             // Copy into a fresh ArrayBuffer-backed view — the guest buffer may
             // detach/grow between calls (and may be a SharedArrayBuffer).
             const out = new Uint8Array(len);
-            out.set(new Uint8Array(ex.memory.buffer, ptr, len));
+            out.set(new Uint8Array(buffer, ptr, len));
             return out;
         };
         const writeAt = (ptr, src) => {
             const ex = getExports();
             if (!ex)
                 throw new Error('guest not instantiated');
-            new Uint8Array(ex.memory.buffer, ptr, src.length).set(src);
+            const buffer = ex.memory.buffer;
+            assertMemoryRange(buffer, ptr, src.length, 'guest memory write');
+            new Uint8Array(buffer, ptr, src.length).set(src);
         };
         const now = this.options.now ?? (() => Date.now());
         const randomFill = this.options.randomFill ?? defaultRandomFill;
@@ -153,6 +179,9 @@ export class GlueRuntime {
                 if (!ex)
                     throw new Error('guest not instantiated');
                 const outPtr = ex.ck_alloc(respBytes.length);
+                if (respBytes.length > 0 && outPtr === 0) {
+                    throw new RangeError('ck_alloc returned a null reply pointer');
+                }
                 writeAt(outPtr, respBytes);
                 // Packed (ptr << 32 | len); the guest reads then ck_frees it.
                 return (BigInt(outPtr) << 32n) | BigInt(respBytes.length >>> 0);
@@ -160,9 +189,13 @@ export class GlueRuntime {
         };
         const wasi = {
             random_get: (ptr, len) => {
-                const buf = new Uint8Array(len);
+                const ex = getExports();
+                if (!ex)
+                    throw new Error('guest not instantiated');
+                const buffer = ex.memory.buffer;
+                assertMemoryRange(buffer, ptr, len, 'random_get write');
+                const buf = new Uint8Array(buffer, ptr, len);
                 randomFill(buf);
-                writeAt(ptr, buf);
                 return 0;
             },
             // A player artifact may pull in a few benign wasi stubs; keep them inert.
@@ -196,10 +229,12 @@ export class GlueRuntime {
     }
     /** Run the module's `init` export (once, after instantiate). */
     init() {
+        this.resetFuel();
         this.exports?.init?.();
     }
     /** Run one `tick(dt_ms)`. Throws propagate to the caller's watchdog wrapper. */
     tick(dtMs) {
+        this.resetFuel();
         this.exports?.tick?.(dtMs);
     }
     /** Invoke the module with an opaque payload; returns the reply bytes (copied out). */
@@ -208,13 +243,22 @@ export class GlueRuntime {
         if (!ex || typeof ex.handle_invoke !== 'function')
             return new Uint8Array(0);
         const ptr = ex.ck_alloc(payload.length);
+        if (payload.length > 0 && ptr === 0) {
+            throw new RangeError('ck_alloc returned a null invoke pointer');
+        }
+        assertMemoryRange(ex.memory.buffer, ptr, payload.length, 'invoke request write');
         new Uint8Array(ex.memory.buffer, ptr, payload.length).set(payload);
+        this.resetFuel();
         const packed = BigInt(ex.handle_invoke(ptr, payload.length));
         ex.ck_free?.(ptr, payload.length);
         const outPtr = Number(packed >> 32n);
         const outLen = Number(packed & 0xffffffffn);
         if (outLen === 0)
             return new Uint8Array(0);
+        if (outPtr === 0) {
+            throw new RangeError('guest returned a null invoke reply pointer');
+        }
+        assertMemoryRange(ex.memory.buffer, outPtr, outLen, 'invoke reply read');
         const out = new Uint8Array(ex.memory.buffer, outPtr, outLen).slice();
         ex.ck_free?.(outPtr, outLen);
         return out;

package/dist/player-runtime/glue-sab.d.ts

@@ -14,7 +14,9 @@
  * (COOP: same-origin + COEP: require-corp) in the browser; Node worker
  * threads have them unconditionally, which is how this is integration-tested.
  *
- * Layout: [ state:i32, len:i32 ] header, then a byte data region.
+ * Layout: [ state:i32, len:i32, requestId:i32 ] header, then a byte data
+ * region. The request id prevents a host response that completed after the
+ * worker's timeout from waking a later request that reused the same SAB.
  *   state: 0 IDLE, 1 PENDING (worker waiting), 2 DONE.
  * The request travels to the page as a normal postMessage (before the
  * worker blocks); only the reply uses the SAB.
@@ -22,6 +24,7 @@
 export declare const SAB_STATE_IDLE = 0;
 export declare const SAB_STATE_PENDING = 1;
 export declare const SAB_STATE_DONE = 2;
+export declare const GLUE_HOST_CALL_TIMEOUT_MS = 5000;
 export declare const SAB_HEADER_BYTES: number;
 /** 1 MiB reply region — host-call replies (chunk/actor reads) are well under this. */
 export declare const SAB_DATA_BYTES: number;
@@ -39,9 +42,9 @@ declare const decoder: TextDecoder;
  * and wake the blocked worker. `respBytes` must already be the SDK Response
  * envelope (`{ok,data}` / `{ok:false,error}`) the guest expects.
  */
-export declare function writeGlueReply(view: GlueSab, respBytes: Uint8Array): void;
+export declare function writeGlueReply(view: GlueSab, respBytes: Uint8Array, requestId?: number): boolean;
 /** Convenience for responders holding a plain object result. */
-export declare function writeGlueResult(view: GlueSab, result: unknown): void;
+export declare function writeGlueResult(view: GlueSab, result: unknown, requestId?: number): boolean;
 /**
  * Requester side (worker): mark PENDING before posting the wake, block until
  * the page flips the state to DONE, then read the reply bytes out. The
@@ -49,7 +52,7 @@ export declare function writeGlueResult(view: GlueSab, result: unknown): void;
  * `waitAndRead()` — that ordering (post, then wait) is what lets the page
  * see the request while the worker is blocked.
  */
-export declare function armGlueRequest(view: GlueSab): void;
-export declare function waitAndReadGlueReply(view: GlueSab, timeoutMs?: number): Uint8Array;
+export declare function armGlueRequest(view: GlueSab, requestId: number): void;
+export declare function waitAndReadGlueReply(view: GlueSab, requestId: number, timeoutMs?: number): Uint8Array;
 export { encoder as glueEncoder, decoder as glueDecoder };
 //# sourceMappingURL=glue-sab.d.ts.map

package/dist/player-runtime/glue-sab.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"glue-sab.d.ts","sourceRoot":"","sources":["../../src/player-runtime/glue-sab.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,eAAO,MAAM,cAAc,IAAI,CAAC;AAChC,eAAO,MAAM,iBAAiB,IAAI,CAAC;AACnC,eAAO,MAAM,cAAc,IAAI,CAAC;AAGhC,eAAO,MAAM,gBAAgB,QAAiB,CAAC;AAC/C,sFAAsF;AACtF,eAAO,MAAM,cAAc,QAAc,CAAC;AAE1C,MAAM,WAAW,OAAO;IACtB,GAAG,EAAE,iBAAiB,CAAC;IACvB,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,EAAE,UAAU,CAAC;CAClB;AAED,wBAAgB,aAAa,CAAC,SAAS,SAAiB,GAAG,OAAO,CAGjE;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAM3D;AAED,QAAA,MAAM,OAAO,aAAoB,CAAC;AAClC,QAAA,MAAM,OAAO,aAAoB,CAAC;AAElC;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,GAAG,IAAI,CAMzE;AAED,gEAAgE;AAChE,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI,CAEpE;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAGlD;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,SAAO,GAAG,UAAU,CAShF;AAED,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,OAAO,IAAI,WAAW,EAAE,CAAC"}
+{"version":3,"file":"glue-sab.d.ts","sourceRoot":"","sources":["../../src/player-runtime/glue-sab.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,eAAO,MAAM,cAAc,IAAI,CAAC;AAChC,eAAO,MAAM,iBAAiB,IAAI,CAAC;AACnC,eAAO,MAAM,cAAc,IAAI,CAAC;AAChC,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAG9C,eAAO,MAAM,gBAAgB,QAAiB,CAAC;AAC/C,sFAAsF;AACtF,eAAO,MAAM,cAAc,QAAc,CAAC;AAE1C,MAAM,WAAW,OAAO;IACtB,GAAG,EAAE,iBAAiB,CAAC;IACvB,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,EAAE,UAAU,CAAC;CAClB;AAED,wBAAgB,aAAa,CAAC,SAAS,SAAiB,GAAG,OAAO,CAGjE;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAM3D;AAED,QAAA,MAAM,OAAO,aAAoB,CAAC;AAClC,QAAA,MAAM,OAAO,aAAoB,CAAC;AAQlC;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,OAAO,EACb,SAAS,EAAE,UAAU,EACrB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAkBT;AAED,gEAAgE;AAChE,wBAAgB,eAAe,CAC7B,IAAI,EAAE,OAAO,EACb,MAAM,EAAE,OAAO,EACf,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAET;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAIrE;AAED,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,OAAO,EACb,SAAS,EAAE,MAAM,EACjB,SAAS,SAA4B,GACpC,UAAU,CAuBZ;AAED,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,OAAO,IAAI,WAAW,EAAE,CAAC"}

package/dist/player-runtime/glue-sab.js

@@ -14,7 +14,9 @@
  * (COOP: same-origin + COEP: require-corp) in the browser; Node worker
  * threads have them unconditionally, which is how this is integration-tested.
  *
- * Layout: [ state:i32, len:i32 ] header, then a byte data region.
+ * Layout: [ state:i32, len:i32, requestId:i32 ] header, then a byte data
+ * region. The request id prevents a host response that completed after the
+ * worker's timeout from waking a later request that reused the same SAB.
  *   state: 0 IDLE, 1 PENDING (worker waiting), 2 DONE.
  * The request travels to the page as a normal postMessage (before the
  * worker blocks); only the reply uses the SAB.
@@ -22,7 +24,8 @@
 export const SAB_STATE_IDLE = 0;
 export const SAB_STATE_PENDING = 1;
 export const SAB_STATE_DONE = 2;
-const HEADER_I32 = 2; // state, len
+export const GLUE_HOST_CALL_TIMEOUT_MS = 5000;
+const HEADER_I32 = 3; // state, len, request id
 export const SAB_HEADER_BYTES = HEADER_I32 * 4;
 /** 1 MiB reply region — host-call replies (chunk/actor reads) are well under this. */
 export const SAB_DATA_BYTES = 1024 * 1024;
@@ -39,21 +42,34 @@ export function wrapGlueSab(sab) {
 }
 const encoder = new TextEncoder();
 const decoder = new TextDecoder();
+const overflowReply = encoder.encode(JSON.stringify({
+    ok: false,
+    error: { kind: 'response_too_large', message: 'host response exceeds reply limit' },
+}));
 /**
  * Responder side (page/broker): write the reply envelope bytes into the SAB
  * and wake the blocked worker. `respBytes` must already be the SDK Response
  * envelope (`{ok,data}` / `{ok:false,error}`) the guest expects.
  */
-export function writeGlueReply(view, respBytes) {
-    const len = Math.min(respBytes.length, view.data.length);
-    view.data.set(respBytes.subarray(0, len));
-    Atomics.store(view.header, 1, len);
+export function writeGlueReply(view, respBytes, requestId) {
+    if (requestId != null &&
+        (Atomics.load(view.header, 0) !== SAB_STATE_PENDING ||
+            Atomics.load(view.header, 2) !== requestId)) {
+        return false;
+    }
+    const payload = respBytes.length <= view.data.length ? respBytes : overflowReply;
+    if (payload.length > view.data.length) {
+        throw new RangeError('glue reply region cannot hold the overflow envelope');
+    }
+    view.data.set(payload);
+    Atomics.store(view.header, 1, payload.length);
     Atomics.store(view.header, 0, SAB_STATE_DONE);
     Atomics.notify(view.header, 0, 1);
+    return true;
 }
 /** Convenience for responders holding a plain object result. */
-export function writeGlueResult(view, result) {
-    writeGlueReply(view, encoder.encode(JSON.stringify(result)));
+export function writeGlueResult(view, result, requestId) {
+    return writeGlueReply(view, encoder.encode(JSON.stringify(result)), requestId);
 }
 /**
  * Requester side (worker): mark PENDING before posting the wake, block until
@@ -62,16 +78,26 @@ export function writeGlueResult(view, result) {
  * `waitAndRead()` — that ordering (post, then wait) is what lets the page
  * see the request while the worker is blocked.
  */
-export function armGlueRequest(view) {
+export function armGlueRequest(view, requestId) {
     Atomics.store(view.header, 1, 0);
+    Atomics.store(view.header, 2, requestId);
     Atomics.store(view.header, 0, SAB_STATE_PENDING);
 }
-export function waitAndReadGlueReply(view, timeoutMs = 5000) {
+export function waitAndReadGlueReply(view, requestId, timeoutMs = GLUE_HOST_CALL_TIMEOUT_MS) {
     const res = Atomics.wait(view.header, 0, SAB_STATE_PENDING, timeoutMs);
     if (res === 'timed-out') {
+        Atomics.compareExchange(view.header, 0, SAB_STATE_PENDING, SAB_STATE_IDLE);
         throw new Error('host call timed out');
     }
+    if (Atomics.load(view.header, 2) !== requestId) {
+        Atomics.store(view.header, 0, SAB_STATE_IDLE);
+        throw new Error('host call reply id mismatch');
+    }
     const len = Atomics.load(view.header, 1);
+    if (len < 0 || len > view.data.length) {
+        Atomics.store(view.header, 0, SAB_STATE_IDLE);
+        throw new Error('host call reply length is invalid');
+    }
     const out = view.data.slice(0, len);
     Atomics.store(view.header, 0, SAB_STATE_IDLE);
     return out;

package/dist/player-runtime/player-code-broker.d.ts

@@ -39,7 +39,10 @@ export interface PlayerCodeBrokerOptions {
      * run (09 T7). Compute it from the same bytes the game-api served.
      */
     artifactHash?: string;
-    /** Per-dispatch client fuel budget (from playerComputeArtifact); the glue traps past it. */
+    /**
+     * Informational server-authored fuel metadata. The browser does not enforce
+     * this value; metering must be injected into the platform artifact.
+     */
     fuelPerDispatch?: bigint;
     onHostCall: (call: PlayerCodeHostCall) => Promise<unknown>;
     /** Optional sink for HUD/overlay presentation the mod emits (BWF wires this). */
@@ -51,6 +54,10 @@ export interface PlayerCodeBrokerOptions {
     hashArtifact?: (artifact: ArrayBuffer) => Promise<string>;
     /** Wall-clock ms allowed per dispatch before the broker recycles the worker. */
     dispatchWatchdogMs?: number;
+    /** Wall-clock ms allowed for worker creation + WASM instantiation. */
+    startupWatchdogMs?: number;
+    /** Wall-clock ms allowed while an async SDK host call is outstanding. */
+    hostCallTimeoutMs?: number;
     /**
      * Local tick cadence (ms) for a client mod: the worker self-drives `tick`
      * at this interval. Omit/0 for invoke-only mods (no periodic tick). A HUD
@@ -81,15 +88,25 @@ export interface PlayerCodeBrokerOptions {
 export declare class PlayerCodeBroker {
     private readonly options;
     private worker;
+    private workerListener;
+    private artifact;
     private circuitOpen;
     private consecutiveTraps;
+    private hardTimeouts;
     private readonly rateBuckets;
-    private readonly onMessage;
+    private globalCallBucket;
+    private generation;
+    private lifecycleVersion;
+    private starting;
+    private workerReady;
+    private startupTimer;
+    private dispatchTimer;
+    private activeDispatch;
     constructor(options: PlayerCodeBrokerOptions);
     /**
      * Start the worker on a platform-fetched artifact. Verifies the artifact
-     * hash (side-load refusal, T7) before handing bytes to the worker, and
-     * forwards the fuel budget so the glue can trap a runaway dispatch.
+     * hash (side-load refusal, T7) before handing bytes to the worker. A retained
+     * copy allows the page-side hard watchdog to replace a wedged worker.
      */
     start(artifact: ArrayBuffer): Promise<void>;
     /** Terminate + respawn on a fresh artifact — the client hot-reload path. */
@@ -108,6 +125,18 @@ export declare class PlayerCodeBroker {
      * the browser; the postMessage is harmless there.
      */
     private reply;
+    private spawnWorker;
+    private stopWorker;
+    private armStartupTimer;
+    private clearStartupTimer;
+    private armDispatchTimer;
+    private armHostCallTimer;
+    private resumeDispatchWatchdog;
+    private finishDispatch;
+    private clearDispatchTimer;
+    private recycleWorker;
+    private openCircuit;
+    private enforceGlobalRate;
     private enforceRate;
     private recordTrap;
     private assertGridScope;

package/dist/player-runtime/player-code-broker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"player-code-broker.d.ts","sourceRoot":"","sources":["../../src/player-runtime/player-code-broker.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,IAAI,EAAE;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAC/D,gBAAgB,CACd,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,IAAI,GAC/C,IAAI,CAAC;IACR,mBAAmB,CACjB,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,IAAI,GAC/C,IAAI,CAAC;IACR,SAAS,IAAI,IAAI,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,KAAK,GAAG,SAAS,CAAC;IAC3B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,6EAA6E;IAC7E,SAAS,EAAE,MAAM,GAAG,GAAG,CAAC;IACxB,IAAI,EAAE,oBAAoB,CAAC;IAC3B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4FAA4F;IAC5F,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3D,iFAAiF;IACjF,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE,sBAAsB,KAAK,IAAI,CAAC;IAChE,iFAAiF;IACjF,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,KAAK,oBAAoB,CAAC;IAC5D,8EAA8E;IAC9E,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,gFAAgF;IAChF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAiED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,gBAAgB;IASf,OAAO,CAAC,QAAQ,CAAC,OAAO;IARpC,OAAO,CAAC,MAAM,CAAqC;IACnD,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA+B;IAC3D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAExB;gBAE2B,OAAO,EAAE,uBAAuB;IAE7D;;;;OAIG;IACG,KAAK,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAkCjD,4EAA4E;IACtE,OAAO,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAKnD,IAAI,IAAI,IAAI;IAOZ,yEAAyE;IACzE,YAAY,IAAI,IAAI;YAMN,aAAa;IA8D3B;;;;;;;;OAQG;IACH,OAAO,CAAC,KAAK;IAeb,OAAO,CAAC,WAAW;IAanB,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,WAAW;YAiBL,IAAI;CAOnB"}
+{"version":3,"file":"player-code-broker.d.ts","sourceRoot":"","sources":["../../src/player-runtime/player-code-broker.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,IAAI,EAAE;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAC/D,gBAAgB,CACd,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,IAAI,GAC/C,IAAI,CAAC;IACR,mBAAmB,CACjB,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,IAAI,GAC/C,IAAI,CAAC;IACR,SAAS,IAAI,IAAI,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,KAAK,GAAG,SAAS,CAAC;IAC3B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,6EAA6E;IAC7E,SAAS,EAAE,MAAM,GAAG,GAAG,CAAC;IACxB,IAAI,EAAE,oBAAoB,CAAC;IAC3B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3D,iFAAiF;IACjF,cAAc,CAAC,EAAE,CAAC,YAAY,EAAE,sBAAsB,KAAK,IAAI,CAAC;IAChE,iFAAiF;IACjF,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,KAAK,oBAAoB,CAAC;IAC5D,8EAA8E;IAC9E,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,gFAAgF;IAChF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sEAAsE;IACtE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAiFD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,gBAAgB;IAqBf,OAAO,CAAC,QAAQ,CAAC,OAAO;IApBpC,OAAO,CAAC,MAAM,CAAqC;IACnD,OAAO,CAAC,cAAc,CAEN;IAChB,OAAO,CAAC,QAAQ,CAA4B;IAC5C,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA+B;IAC3D,OAAO,CAAC,gBAAgB,CAAgB;IACxC,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,YAAY,CAA8C;IAClE,OAAO,CAAC,aAAa,CAA8C;IACnE,OAAO,CAAC,cAAc,CAEN;gBAEa,OAAO,EAAE,uBAAuB;IAE7D;;;;OAIG;IACG,KAAK,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BjD,4EAA4E;IACtE,OAAO,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAKnD,IAAI,IAAI,IAAI;IAOZ,yEAAyE;IACzE,YAAY,IAAI,IAAI;YAQN,aAAa;IAuJ3B;;;;;;;;OAQG;IACH,OAAO,CAAC,KAAK;IAuCb,OAAO,CAAC,WAAW;IAoCnB,OAAO,CAAC,UAAU;IAclB,OAAO,CAAC,eAAe;IAgBvB,OAAO,CAAC,iBAAiB;IAKzB,OAAO,CAAC,gBAAgB;IAYxB,OAAO,CAAC,gBAAgB;IAmBxB,OAAO,CAAC,sBAAsB;IAK9B,OAAO,CAAC,cAAc;IAYtB,OAAO,CAAC,kBAAkB;IAK1B,OAAO,CAAC,aAAa;IAYrB,OAAO,CAAC,WAAW;IAOnB,OAAO,CAAC,iBAAiB;IAazB,OAAO,CAAC,WAAW;IAanB,OAAO,CAAC,UAAU;IAOlB,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,WAAW;YAiBL,IAAI;CAOnB"}

package/dist/player-runtime/player-code-broker.js

@@ -1,4 +1,4 @@
-import { wrapGlueSab, writeGlueResult } from './glue-sab.js';
+import { GLUE_HOST_CALL_TIMEOUT_MS, SAB_HEADER_BYTES, wrapGlueSab, writeGlueResult, } from './glue-sab.js';
 /**
  * Deny-by-default host-call allowlist, grouped by capability (04 §4). Only
  * owner-lawful reads and effects cross the bridge; auth, admin, authoring,
@@ -57,6 +57,22 @@ for (const [group, fns] of Object.entries(ALLOWED_HOST_CALLS)) {
 }
 const RATE_WINDOW_MS = 1000;
 const CIRCUIT_TRIP_THRESHOLD = 5;
+const GLOBAL_HOST_CALL_CAP = 1000;
+const MAX_HOST_CALL_FN_BYTES = 128;
+const MAX_HOST_CALL_ARGS_BYTES = 256 * 1024;
+const HOST_CALL_ENVELOPE_KEYS = new Set([
+    'type',
+    'id',
+    'fn',
+    'args',
+    'reply',
+]);
+const FORBIDDEN_BINDING_KEYS = new Set([
+    'authority',
+    'bindingKind',
+    'binding_kind',
+]);
+const utf8Encoder = new TextEncoder();
 /**
  * Page-side security broker for browser-target player WASM (production shape,
  * player compute P3).
@@ -81,44 +97,52 @@ export class PlayerCodeBroker {
     constructor(options) {
         this.options = options;
         this.worker = null;
+        this.workerListener = null;
+        this.artifact = null;
         this.circuitOpen = false;
         this.consecutiveTraps = 0;
+        this.hardTimeouts = 0;
         this.rateBuckets = new Map();
-        this.onMessage = (event) => {
-            void this.handleMessage(event.data);
-        };
+        this.globalCallBucket = [];
+        this.generation = 0;
+        this.lifecycleVersion = 0;
+        this.starting = false;
+        this.workerReady = false;
+        this.startupTimer = null;
+        this.dispatchTimer = null;
+        this.activeDispatch = null;
     }
     /**
      * Start the worker on a platform-fetched artifact. Verifies the artifact
-     * hash (side-load refusal, T7) before handing bytes to the worker, and
-     * forwards the fuel budget so the glue can trap a runaway dispatch.
+     * hash (side-load refusal, T7) before handing bytes to the worker. A retained
+     * copy allows the page-side hard watchdog to replace a wedged worker.
      */
     async start(artifact) {
-        if (this.worker)
+        if (this.worker || this.starting) {
             throw new Error('PlayerCodeBroker is already started');
+        }
         if (this.circuitOpen) {
             throw new Error('player code circuit is open; reset before starting');
         }
-        if (this.options.artifactHash) {
-            const actual = await this.hash(artifact);
-            if (actual !== this.options.artifactHash) {
-                throw new Error('refusing to run an artifact that was not fetched from the platform');
+        const lifecycleVersion = ++this.lifecycleVersion;
+        this.starting = true;
+        try {
+            if (this.options.artifactHash) {
+                const actual = await this.hash(artifact);
+                if (actual !== this.options.artifactHash) {
+                    throw new Error('refusing to run an artifact that was not fetched from the platform');
+                }
+            }
+            if (lifecycleVersion !== this.lifecycleVersion) {
+                throw new Error('PlayerCodeBroker start was cancelled');
             }
+            this.artifact = artifact.slice(0);
+            this.spawnWorker();
+        }
+        finally {
+            if (lifecycleVersion === this.lifecycleVersion)
+                this.starting = false;
         }
-        const factory = this.options.workerFactory ??
-            ((url) => new Worker(url, { type: 'module' }));
-        this.worker = factory(this.options.workerUrl);
-        this.worker.addEventListener('message', this.onMessage);
-        this.worker.postMessage({
-            type: 'init',
-            artifact,
-            authority: 'player',
-            fuelPerDispatch: this.options.fuelPerDispatch != null
-                ? this.options.fuelPerDispatch.toString()
-                : undefined,
-            watchdogMs: this.options.dispatchWatchdogMs ?? 250,
-            tickIntervalMs: this.options.tickIntervalMs ?? 0,
-        }, [artifact]);
     }
     /** Terminate + respawn on a fresh artifact — the client hot-reload path. */
     async restart(artifact) {
@@ -126,47 +150,119 @@ export class PlayerCodeBroker {
         await this.start(artifact);
     }
     stop() {
-        if (!this.worker)
-            return;
-        this.worker.removeEventListener('message', this.onMessage);
-        this.worker.terminate();
-        this.worker = null;
+        this.lifecycleVersion += 1;
+        this.starting = false;
+        this.stopWorker();
+        this.artifact = null;
     }
     /** Clear a tripped circuit so the caller can start again after a fix. */
     resetCircuit() {
         this.circuitOpen = false;
         this.consecutiveTraps = 0;
+        this.hardTimeouts = 0;
         this.rateBuckets.clear();
+        this.globalCallBucket = [];
     }
-    async handleMessage(raw) {
-        if (!this.worker || !isRecord(raw))
+    async handleMessage(raw, generation, sourceWorker) {
+        if (this.worker !== sourceWorker ||
+            generation !== this.generation ||
+            !isRecord(raw)) {
             return;
+        }
+        if (raw.type === 'ready') {
+            this.workerReady = true;
+            this.clearStartupTimer();
+            return;
+        }
+        if (raw.type === 'dispatch-start') {
+            if (!Number.isSafeInteger(raw.id) || raw.id <= 0) {
+                this.recycleWorker('invalid dispatch-start id');
+                return;
+            }
+            if (this.activeDispatch) {
+                this.recycleWorker('overlapping guest dispatches');
+                return;
+            }
+            this.activeDispatch = {
+                generation,
+                id: raw.id,
+                kind: typeof raw.kind === 'string' ? raw.kind : 'unknown',
+            };
+            this.armDispatchTimer(generation, raw.id);
+            return;
+        }
         if (raw.type === 'trap') {
-            this.recordTrap(typeof raw.reason === 'string' ? raw.reason : 'trap');
+            this.finishDispatch(generation, raw.id);
+            const reason = typeof raw.reason === 'string' ? raw.reason : 'trap';
+            const detail = typeof raw.detail === 'string' ? raw.detail : '';
+            const trapKind = typeof raw.kind === 'string' ? raw.kind : '';
+            if (reason === 'watchdog' || /host call timed out/i.test(detail)) {
+                this.recycleWorker(/host call timed out/i.test(detail) ? 'hostcall-timeout' : reason);
+            }
+            else if (trapKind === 'startup' || trapKind === 'init') {
+                this.stopWorker();
+                this.recordTrap(reason);
+            }
+            else {
+                this.recordTrap(reason);
+            }
             return;
         }
         if (raw.type === 'dispatch-ok') {
-            this.consecutiveTraps = 0;
+            const kind = this.activeDispatch?.kind;
+            this.finishDispatch(generation, raw.id);
+            if (kind && kind !== 'init') {
+                this.consecutiveTraps = 0;
+                this.hardTimeouts = 0;
+            }
             return;
         }
         if (raw.type !== 'hostcall')
             return;
+        this.armHostCallTimer(generation);
+        if (!this.enforceGlobalRate())
+            return;
         const id = raw.id;
         try {
-            if (typeof id !== 'number')
+            if (!Number.isSafeInteger(id) || id < 0) {
                 throw new Error('invalid hostcall id');
+            }
+            for (const key of Object.keys(raw)) {
+                if (!HOST_CALL_ENVELOPE_KEYS.has(key)) {
+                    throw new Error(`unexpected hostcall envelope field '${key}'`);
+                }
+            }
             if (typeof raw.fn !== 'string')
                 throw new Error('missing host call fn');
+            if (raw.fn.length === 0 ||
+                utf8Encoder.encode(raw.fn).length > MAX_HOST_CALL_FN_BYTES) {
+                throw new Error('invalid host call fn');
+            }
             const group = FN_TO_GROUP.get(raw.fn);
             if (!group) {
                 throw new Error('host call is not allowed in the player browser sandbox');
             }
-            if (!isRecord(raw.args)) {
+            if (!isPlainRecord(raw.args)) {
                 // Confused-deputy guard: reject malformed payloads outright rather
                 // than coercing them (09 T7).
-                throw new Error('host call args must be an object');
+                throw new Error('host call args must be a plain object');
             }
             const args = raw.args;
+            for (const key of FORBIDDEN_BINDING_KEYS) {
+                if (Object.prototype.hasOwnProperty.call(args, key)) {
+                    throw new Error(`host call cannot override '${key}'`);
+                }
+            }
+            let encodedArgs;
+            try {
+                encodedArgs = utf8Encoder.encode(JSON.stringify(args));
+            }
+            catch {
+                throw new Error('host call args must be JSON-serializable');
+            }
+            if (encodedArgs.length > MAX_HOST_CALL_ARGS_BYTES) {
+                throw new Error('host call args exceed the browser sandbox limit');
+            }
             this.enforceRate(group, raw.fn);
             this.assertGridScope(raw.fn, args);
             let data;
@@ -179,7 +275,12 @@ export class PlayerCodeBroker {
                     low: { x: low.x.toString(), y: low.y.toString(), z: low.z.toString() },
                     high: { x: high.x.toString(), y: high.y.toString(), z: high.z.toString() },
                 };
-                this.reply(raw.reply, id, { type: 'hostcall-result', id, ok: true, data });
+                this.reply(sourceWorker, generation, raw.reply, id, {
+                    type: 'hostcall-result',
+                    id,
+                    ok: true,
+                    data,
+                });
                 return;
             }
             if (PRESENTATION_FUNCTIONS.has(raw.fn)) {
@@ -194,10 +295,15 @@ export class PlayerCodeBroker {
             else {
                 data = await this.options.onHostCall({ fn: raw.fn, args });
             }
-            this.reply(raw.reply, id, { type: 'hostcall-result', id, ok: true, data });
+            this.reply(sourceWorker, generation, raw.reply, id, {
+                type: 'hostcall-result',
+                id,
+                ok: true,
+                data,
+            });
         }
         catch (error) {
-            this.reply(raw.reply, id, {
+            this.reply(sourceWorker, generation, raw.reply, id, {
                 type: 'hostcall-result',
                 id,
                 ok: false,
@@ -214,15 +320,173 @@ export class PlayerCodeBroker {
      * runs its message handler), so the SAB write is the load-bearing path in
      * the browser; the postMessage is harmless there.
      */
-    reply(replyBuffer, _id, message) {
-        this.worker?.postMessage(message);
-        if (typeof SharedArrayBuffer !== 'undefined' && replyBuffer instanceof SharedArrayBuffer) {
-            const view = wrapGlueSab(replyBuffer);
-            const envelope = message.ok
-                ? { ok: true, data: message.data }
-                : { ok: false, error: message.error };
-            writeGlueResult(view, envelope);
+    reply(sourceWorker, generation, replyBuffer, id, message) {
+        if (this.worker !== sourceWorker || generation !== this.generation)
+            return;
+        let sabAttempted = false;
+        let delivered = false;
+        if (typeof SharedArrayBuffer !== 'undefined' &&
+            replyBuffer instanceof SharedArrayBuffer &&
+            replyBuffer.byteLength >= SAB_HEADER_BYTES) {
+            sabAttempted = true;
+            try {
+                const view = wrapGlueSab(replyBuffer);
+                const envelope = message.ok
+                    ? { ok: true, data: message.data }
+                    : { ok: false, error: message.error };
+                delivered = writeGlueResult(view, envelope, id);
+            }
+            catch {
+                // The async postMessage result above is still delivered. A forged or
+                // undersized SAB must not turn a denied worker request into an
+                // unhandled page-side rejection.
+            }
+        }
+        if (!sabAttempted || delivered) {
+            try {
+                sourceWorker.postMessage(message);
+            }
+            catch {
+                // The SAB is authoritative in production. An async mirror that cannot
+                // be cloned must not strand a successfully delivered synchronous reply.
+            }
         }
+        if (delivered)
+            this.resumeDispatchWatchdog(generation);
+    }
+    spawnWorker() {
+        if (!this.artifact || this.circuitOpen)
+            return;
+        const factory = this.options.workerFactory ??
+            ((url) => new Worker(url, { type: 'module' }));
+        const worker = factory(this.options.workerUrl);
+        const generation = ++this.generation;
+        const listener = (event) => {
+            void this.handleMessage(event.data, generation, worker);
+        };
+        this.worker = worker;
+        this.workerListener = listener;
+        this.workerReady = false;
+        worker.addEventListener('message', listener);
+        const workerArtifact = this.artifact.slice(0);
+        try {
+            worker.postMessage({
+                type: 'init',
+                artifact: workerArtifact,
+                authority: 'player',
+                fuelPerDispatch: this.options.fuelPerDispatch?.toString(),
+                hostCallTimeoutMs: this.options.hostCallTimeoutMs ?? GLUE_HOST_CALL_TIMEOUT_MS,
+                tickIntervalMs: this.options.tickIntervalMs ?? 0,
+            }, [workerArtifact]);
+            this.armStartupTimer(generation);
+        }
+        catch (error) {
+            this.stopWorker();
+            throw error;
+        }
+    }
+    stopWorker() {
+        this.clearStartupTimer();
+        this.clearDispatchTimer();
+        this.activeDispatch = null;
+        this.workerReady = false;
+        const worker = this.worker;
+        const listener = this.workerListener;
+        this.worker = null;
+        this.workerListener = null;
+        if (!worker)
+            return;
+        if (listener)
+            worker.removeEventListener('message', listener);
+        worker.terminate();
+    }
+    armStartupTimer(generation) {
+        this.clearStartupTimer();
+        const timeoutMs = this.options.startupWatchdogMs ??
+            Math.max(5000, (this.options.dispatchWatchdogMs ?? 250) * 4);
+        this.startupTimer = setTimeout(() => {
+            if (generation === this.generation &&
+                this.worker &&
+                !this.workerReady) {
+                this.recycleWorker('startup-watchdog');
+            }
+        }, timeoutMs);
+    }
+    clearStartupTimer() {
+        if (this.startupTimer)
+            clearTimeout(this.startupTimer);
+        this.startupTimer = null;
+    }
+    armDispatchTimer(generation, id) {
+        this.clearDispatchTimer();
+        this.dispatchTimer = setTimeout(() => {
+            if (this.activeDispatch?.generation === generation &&
+                this.activeDispatch.id === id) {
+                this.recycleWorker('dispatch-watchdog');
+            }
+        }, this.options.dispatchWatchdogMs ?? 250);
+    }
+    armHostCallTimer(generation) {
+        if (this.activeDispatch?.generation !== generation ||
+            !this.worker) {
+            return;
+        }
+        const id = this.activeDispatch.id;
+        this.clearDispatchTimer();
+        this.dispatchTimer = setTimeout(() => {
+            if (this.activeDispatch?.generation === generation &&
+                this.activeDispatch.id === id) {
+                this.recycleWorker('hostcall-timeout');
+            }
+        }, this.options.hostCallTimeoutMs ?? GLUE_HOST_CALL_TIMEOUT_MS);
+    }
+    resumeDispatchWatchdog(generation) {
+        if (this.activeDispatch?.generation !== generation)
+            return;
+        this.armDispatchTimer(generation, this.activeDispatch.id);
+    }
+    finishDispatch(generation, id) {
+        if (!Number.isSafeInteger(id) ||
+            this.activeDispatch?.generation !== generation ||
+            this.activeDispatch.id !== id) {
+            return;
+        }
+        this.clearDispatchTimer();
+        this.activeDispatch = null;
+    }
+    clearDispatchTimer() {
+        if (this.dispatchTimer)
+            clearTimeout(this.dispatchTimer);
+        this.dispatchTimer = null;
+    }
+    recycleWorker(reason) {
+        if (!this.worker || this.circuitOpen)
+            return;
+        this.hardTimeouts += 1;
+        this.consecutiveTraps += 1;
+        this.stopWorker();
+        if (this.hardTimeouts >= CIRCUIT_TRIP_THRESHOLD) {
+            this.openCircuit(reason);
+            return;
+        }
+        this.spawnWorker();
+    }
+    openCircuit(reason) {
+        if (this.circuitOpen)
+            return;
+        this.circuitOpen = true;
+        this.stopWorker();
+        this.options.onCircuitOpen?.(reason);
+    }
+    enforceGlobalRate() {
+        const now = Date.now();
+        this.globalCallBucket = this.globalCallBucket.filter((timestamp) => now - timestamp < RATE_WINDOW_MS);
+        if (this.globalCallBucket.length >= GLOBAL_HOST_CALL_CAP) {
+            this.openCircuit('global host-call rate exceeded');
+            return false;
+        }
+        this.globalCallBucket.push(now);
+        return true;
     }
     enforceRate(group, fn) {
         const cap = RATE_CAPS[group] ?? 60;
@@ -237,9 +501,7 @@ export class PlayerCodeBroker {
     recordTrap(reason) {
         this.consecutiveTraps += 1;
         if (this.consecutiveTraps >= CIRCUIT_TRIP_THRESHOLD && !this.circuitOpen) {
-            this.circuitOpen = true;
-            this.stop();
-            this.options.onCircuitOpen?.(reason);
+            this.openCircuit(reason);
         }
     }
     assertGridScope(fn, args) {
@@ -276,7 +538,26 @@ export class PlayerCodeBroker {
 function isRecord(value) {
     return value !== null && typeof value === 'object' && !Array.isArray(value);
 }
+function isPlainRecord(value) {
+    if (!isRecord(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
 function toBigInt(value) {
+    if (typeof value === 'string' &&
+        !/^-?(0|[1-9][0-9]*)$/.test(value)) {
+        throw new Error('chunk coordinates must be decimal integer strings');
+    }
+    if (typeof value === 'number' &&
+        (!Number.isSafeInteger(value) || !Number.isFinite(value))) {
+        throw new Error('chunk coordinates must be safe integers or decimal strings');
+    }
+    if (typeof value !== 'string' &&
+        typeof value !== 'number' &&
+        typeof value !== 'bigint') {
+        throw new Error('chunk coordinates must be integers');
+    }
     try {
         return BigInt(value);
     }

package/dist/player-runtime/player-glue-worker.d.ts

@@ -13,8 +13,9 @@
  *  - `ck.host_call` blocks the worker on a SharedArrayBuffer while the
  *    page-side broker services the (async) server-authorized call and writes
  *    the reply back, so the guest sees a synchronous gateway,
- *  - it enforces a per-dispatch wall-clock watchdog and reports traps to the
- *    broker, which owns the local circuit breaker.
+ *  - it announces each dispatch before entering WASM; the page-side broker
+ *    owns the hard watchdog and can terminate this worker if WASM never
+ *    returns. The local elapsed-time helper only classifies completed calls.
  *
  * Re-exports the pure helpers + the runtime so tests and bundlers can use
  * them without touching worker globals.

package/dist/player-runtime/player-glue-worker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"player-glue-worker.d.ts","sourceRoot":"","sources":["../../src/player-runtime/player-glue-worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,KAAK,eAAe,EACpB,KAAK,kBAAkB,GACxB,CAAC;AAOF;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,gBAAgB,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,YAAY,KAAK,IAAI,KAAK,IAAI,CAAC;IACrE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,KAAK,IAAI,CAAC;IACrD,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;CACzC,GAAG,IAAI,CAuGP"}
+{"version":3,"file":"player-glue-worker.d.ts","sourceRoot":"","sources":["../../src/player-runtime/player-glue-worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAS3B,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,KAAK,eAAe,EACpB,KAAK,kBAAkB,GACxB,CAAC;AAOF;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,gBAAgB,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,YAAY,KAAK,IAAI,KAAK,IAAI,CAAC;IACrE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,KAAK,IAAI,CAAC;IACrD,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;CACzC,GAAG,IAAI,CAkJP"}

package/dist/player-runtime/player-glue-worker.js

@@ -13,14 +13,15 @@
  *  - `ck.host_call` blocks the worker on a SharedArrayBuffer while the
  *    page-side broker services the (async) server-authorized call and writes
  *    the reply back, so the guest sees a synchronous gateway,
- *  - it enforces a per-dispatch wall-clock watchdog and reports traps to the
- *    broker, which owns the local circuit breaker.
+ *  - it announces each dispatch before entering WASM; the page-side broker
+ *    owns the hard watchdog and can terminate this worker if WASM never
+ *    returns. The local elapsed-time helper only classifies completed calls.
  *
  * Re-exports the pure helpers + the runtime so tests and bundlers can use
  * them without touching worker globals.
  */
 import { GlueRuntime, GLUE_HOST_FUNCTIONS, parseFuelBudget, runWithWatchdog, } from './glue-runtime.js';
-import { createGlueSab, armGlueRequest, waitAndReadGlueReply, } from './glue-sab.js';
+import { createGlueSab, armGlueRequest, GLUE_HOST_CALL_TIMEOUT_MS, waitAndReadGlueReply, } from './glue-sab.js';
 export { GlueRuntime, GLUE_HOST_FUNCTIONS, parseFuelBudget, runWithWatchdog, };
 /**
  * Wire the glue runtime to a worker-like message port. Exported (not just
@@ -31,7 +32,8 @@ export function startGlueWorker(port) {
     let runtime = null;
     let sab = null;
     let hostCallId = 0;
-    let watchdogMs = 250;
+    let dispatchId = 0;
+    let hostCallTimeoutMs = GLUE_HOST_CALL_TIMEOUT_MS;
     let ticking = false;
     const post = (message) => port.postMessage(message);
     // Synchronous gateway: post the request (so the page can see it), then
@@ -46,8 +48,9 @@ export function startGlueWorker(port) {
         catch {
             throw new Error('host_call request was not valid JSON');
         }
-        const id = ++hostCallId;
-        armGlueRequest(sab);
+        hostCallId = (hostCallId % 0x7ffffffe) + 1;
+        const id = hostCallId;
+        armGlueRequest(sab, id);
         post({
             type: 'hostcall',
             id,
@@ -55,34 +58,59 @@ export function startGlueWorker(port) {
             args: parsed.args ?? {},
             reply: sab.sab,
         });
-        return waitAndReadGlueReply(sab);
+        return waitAndReadGlueReply(sab, id, hostCallTimeoutMs);
     };
+    const beginDispatch = (kind) => {
+        dispatchId = (dispatchId % 0x7ffffffe) + 1;
+        post({ type: 'dispatch-start', id: dispatchId, kind });
+        return dispatchId;
+    };
+    const report = (id, kind, result) => {
+        if (result.ok)
+            post({ type: 'dispatch-ok', id, kind });
+        else {
+            post({
+                type: 'trap',
+                id,
+                kind,
+                reason: result.reason,
+                detail: result.detail,
+            });
+        }
+    };
+    // Trap classification remains local, but wall-clock enforcement is entirely
+    // page-side so time blocked on an authorized async host call is excluded.
+    const runDispatch = (dispatch) => runWithWatchdog(dispatch, Number.POSITIVE_INFINITY);
     const onInit = async (init) => {
-        watchdogMs = init.watchdogMs ?? 250;
-        void parseFuelBudget(init.fuelPerDispatch);
+        hostCallTimeoutMs =
+            init.hostCallTimeoutMs ?? GLUE_HOST_CALL_TIMEOUT_MS;
         sab = createGlueSab();
+        const fuelPerDispatch = parseFuelBudget(init.fuelPerDispatch);
         runtime = new GlueRuntime({
             hostCallSync,
             onLog: (level, message) => post({ type: 'log', level, message }),
+            fuelPerDispatch,
         });
         try {
             await runtime.instantiate(init.artifact);
-            const initResult = await runWithWatchdog(() => runtime.init(), watchdogMs);
-            report(initResult);
+            const id = beginDispatch('init');
+            const initResult = await runDispatch(() => runtime.init());
+            report(id, 'init', initResult);
+            if (!initResult.ok)
+                return;
             if ((init.tickIntervalMs ?? 0) > 0)
                 startTicking(init.tickIntervalMs);
             post({ type: 'ready' });
         }
         catch (err) {
-            post({ type: 'trap', reason: 'trap', detail: err.message });
+            post({
+                type: 'trap',
+                kind: 'startup',
+                reason: 'trap',
+                detail: err.message,
+            });
         }
     };
-    const report = (result) => {
-        if (result.ok)
-            post({ type: 'dispatch-ok' });
-        else
-            post({ type: 'trap', reason: result.reason, detail: result.detail });
-    };
     const startTicking = (intervalMs) => {
         if (ticking)
             return;
@@ -94,7 +122,8 @@ export function startGlueWorker(port) {
             const nowT = Date.now();
             const dt = nowT - last;
             last = nowT;
-            void runWithWatchdog(() => runtime.tick(dt), watchdogMs).then(report);
+            const id = beginDispatch('tick');
+            void runDispatch(() => runtime.tick(dt)).then((result) => report(id, 'tick', result));
             setTimeout(loop, intervalMs);
         };
         setTimeout(loop, intervalMs);
@@ -106,22 +135,29 @@ export function startGlueWorker(port) {
         if (msg.type === 'init')
             void onInit(msg);
         else if (msg.type === 'tick' && runtime) {
-            void runWithWatchdog(() => runtime.tick(typeof msg.dtMs === 'number' ? msg.dtMs : 0), watchdogMs).then(report);
+            const id = beginDispatch('tick');
+            void runDispatch(() => runtime.tick(typeof msg.dtMs === 'number' ? msg.dtMs : 0)).then((result) => report(id, 'tick', result));
         }
         else if (msg.type === 'invoke' && runtime) {
             const payload = msg.payload instanceof Uint8Array ? msg.payload : new Uint8Array(0);
-            try {
-                const out = runtime.invoke(payload);
-                post({ type: 'invoke-result', id: msg.id, ok: true, payload: out });
-            }
-            catch (err) {
-                post({
-                    type: 'invoke-result',
-                    id: msg.id,
-                    ok: false,
-                    error: err.message,
-                });
-            }
+            const id = beginDispatch('invoke');
+            let out = new Uint8Array(0);
+            void runDispatch(() => {
+                out = runtime.invoke(payload);
+            }).then((result) => {
+                report(id, 'invoke', result);
+                if (result.ok) {
+                    post({ type: 'invoke-result', id: msg.id, ok: true, payload: out });
+                }
+                else {
+                    post({
+                        type: 'invoke-result',
+                        id: msg.id,
+                        ok: false,
+                        error: result.detail ?? result.reason,
+                    });
+                }
+            });
         }
         else if (msg.type === 'stop') {
             ticking = false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crowdedkingdoms/crowdyjs",
-  "version": "8.21.1",
+  "version": "8.22.0",
   "description": "Client SDK for Crowded Kingdoms GraphQL API with UDP proxy support",
   "type": "module",
   "main": "dist/index.js",