@crowdedkingdoms/crowdyjs 8.21.1 → 9.0.0

package/dist/live-coding/vfs.js

@@ -0,0 +1,174 @@
+export const DEFAULT_VFS_LIMITS = {
+    maxFiles: 32,
+    maxFileBytes: 256 * 1024,
+    maxWorkspaceBytes: 1024 * 1024,
+};
+export class VfsLimitError extends Error {
+    constructor(message) {
+        super(message);
+        this.code = 'VFS_LIMIT';
+        this.name = 'VfsLimitError';
+    }
+}
+export class VirtualFileSystem {
+    constructor(workspaceUri = 'file:///player-mod', limits = {}) {
+        this.files = new Map();
+        this.encoder = new TextEncoder();
+        this.totalBytes = 0;
+        this.workspaceUri = workspaceUri.replace(/\/+$/, '');
+        const root = new URL(this.workspaceUri);
+        if (root.protocol !== 'file:' ||
+            root.search ||
+            root.hash ||
+            !root.pathname.startsWith('/') ||
+            root.pathname === '/') {
+            throw new Error('workspaceUri must be a non-root file URI');
+        }
+        this.limits = { ...DEFAULT_VFS_LIMITS, ...limits };
+        this.assertLimits();
+    }
+    get size() {
+        return this.files.size;
+    }
+    get bytes() {
+        return this.totalBytes;
+    }
+    open(item) {
+        const path = this.pathForUri(item.uri);
+        const previous = this.files.get(item.uri);
+        if (!previous && this.files.size >= this.limits.maxFiles) {
+            throw new VfsLimitError(`Workspace file limit is ${this.limits.maxFiles}`);
+        }
+        if (previous && item.version <= previous.version) {
+            return previous;
+        }
+        const next = this.makeDocument(item, path);
+        this.ensureFits(next.bytes, previous?.bytes ?? 0);
+        if (previous)
+            this.totalBytes -= previous.bytes;
+        this.files.set(item.uri, next);
+        this.totalBytes += next.bytes;
+        return next;
+    }
+    change(uri, version, changes) {
+        const previous = this.require(uri);
+        if (version <= previous.version) {
+            return { applied: false, document: previous };
+        }
+        let text = previous.text;
+        for (const change of changes) {
+            if (!change.range) {
+                text = change.text;
+                continue;
+            }
+            const start = offsetAt(text, change.range.start);
+            const end = offsetAt(text, change.range.end);
+            if (end < start)
+                throw new Error('Invalid content change range');
+            text = text.slice(0, start) + change.text + text.slice(end);
+        }
+        const next = this.makeDocument({
+            uri,
+            version,
+            languageId: previous.languageId,
+            text,
+        }, previous.path);
+        this.ensureFits(next.bytes, previous.bytes);
+        this.files.set(uri, next);
+        this.totalBytes += next.bytes - previous.bytes;
+        return { applied: true, document: next };
+    }
+    close(uri) {
+        const previous = this.files.get(uri);
+        if (!previous)
+            return false;
+        this.files.delete(uri);
+        this.totalBytes -= previous.bytes;
+        return true;
+    }
+    get(uri) {
+        return this.files.get(uri);
+    }
+    require(uri) {
+        const document = this.files.get(uri);
+        if (!document)
+            throw new Error(`Document is not open: ${uri}`);
+        return document;
+    }
+    documents() {
+        return [...this.files.values()];
+    }
+    clear() {
+        this.files.clear();
+        this.totalBytes = 0;
+    }
+    pathForUri(uri) {
+        let parsed;
+        try {
+            parsed = new URL(uri);
+        }
+        catch {
+            throw new Error(`Invalid document URI: ${uri}`);
+        }
+        if (parsed.protocol !== 'file:' ||
+            parsed.search ||
+            parsed.hash ||
+            !uri.startsWith(`${this.workspaceUri}/`)) {
+            throw new Error(`Document is outside ${this.workspaceUri}`);
+        }
+        const relative = decodeURIComponent(parsed.pathname.slice(new URL(this.workspaceUri).pathname.length + 1));
+        if (relative.length === 0 ||
+            relative.startsWith('/') ||
+            relative.split('/').some((part) => part === '' || part === '..' || part === '.')) {
+            throw new Error(`Unsafe document path: ${relative}`);
+        }
+        return relative;
+    }
+    makeDocument(item, path) {
+        if (!Number.isSafeInteger(item.version) || item.version < 0) {
+            throw new Error('Document version must be a non-negative safe integer');
+        }
+        const bytes = this.encoder.encode(item.text).byteLength;
+        if (bytes > this.limits.maxFileBytes) {
+            throw new VfsLimitError(`${path} is ${bytes} bytes; file limit is ${this.limits.maxFileBytes}`);
+        }
+        return Object.freeze({ ...item, path, bytes });
+    }
+    ensureFits(nextBytes, replacedBytes) {
+        const total = this.totalBytes - replacedBytes + nextBytes;
+        if (total > this.limits.maxWorkspaceBytes) {
+            throw new VfsLimitError(`Workspace is ${total} bytes; limit is ${this.limits.maxWorkspaceBytes}`);
+        }
+    }
+    assertLimits() {
+        for (const [name, value] of Object.entries(this.limits)) {
+            if (!Number.isSafeInteger(value) || value <= 0) {
+                throw new Error(`${name} must be a positive safe integer`);
+            }
+        }
+        if (this.limits.maxFileBytes > this.limits.maxWorkspaceBytes) {
+            throw new Error('maxFileBytes cannot exceed maxWorkspaceBytes');
+        }
+    }
+}
+export function offsetAt(text, position) {
+    if (!Number.isSafeInteger(position.line) ||
+        !Number.isSafeInteger(position.character) ||
+        position.line < 0 ||
+        position.character < 0) {
+        throw new Error('Invalid document position');
+    }
+    let offset = 0;
+    for (let line = 0; line < position.line; line++) {
+        const newline = text.indexOf('\n', offset);
+        if (newline < 0)
+            throw new Error('Document position is outside the text');
+        offset = newline + 1;
+    }
+    const newline = text.indexOf('\n', offset);
+    const lineEnd = newline < 0 ? text.length : newline;
+    const target = offset + position.character;
+    if (target > lineEnd)
+        throw new Error('Document position is outside the text');
+    return target;
+}

package/dist/live-coding/worker-transport.d.ts

@@ -0,0 +1,60 @@
+import { AbstractMessageReader, AbstractMessageWriter, type DataCallback, type Disposable, type Message } from 'vscode-jsonrpc';
+import { type JsonRpcMessage } from './lsp-protocol.js';
+export type { Disposable };
+export interface LanguageWorkerLike {
+    postMessage(message: unknown): void;
+    addEventListener(type: 'message' | 'error' | 'messageerror', listener: EventListener): void;
+    removeEventListener(type: 'message' | 'error' | 'messageerror', listener: EventListener): void;
+    terminate(): void;
+}
+/** Standard vscode-jsonrpc MessageReader over structured-clone worker messages. */
+export declare class WorkerMessageReader extends AbstractMessageReader {
+    private readonly worker;
+    private callback;
+    private listening;
+    constructor(worker: LanguageWorkerLike);
+    listen(callback: DataCallback): Disposable;
+    dispose(): void;
+    private readonly onMessage;
+    private readonly onMessageError;
+    private readonly onWorkerError;
+}
+/** Standard vscode-jsonrpc MessageWriter over structured-clone worker messages. */
+export declare class WorkerMessageWriter extends AbstractMessageWriter {
+    private readonly worker;
+    private disposed;
+    private errorCount;
+    constructor(worker: LanguageWorkerLike);
+    write(message: Message): Promise<void>;
+    end(): void;
+    dispose(): void;
+}
+export interface WorkerLanguageClientOptions {
+    requestTimeoutMs?: number;
+}
+/**
+ * LSP 3.17 JSON-RPC client over a real vscode-jsonrpc MessageConnection.
+ * Monaco providers adapt editor calls to this connection; transport framing,
+ * request ids, cancellation, errors, and notifications are standard JSON-RPC.
+ */
+export declare class WorkerLanguageClient {
+    private readonly worker;
+    private readonly options;
+    private readonly reader;
+    private readonly writer;
+    private readonly connection;
+    private readonly transportErrorHandlers;
+    private readonly readerErrorDisposable;
+    private disposed;
+    private terminateTimer;
+    constructor(worker: LanguageWorkerLike, options?: WorkerLanguageClientOptions);
+    initialize(params: unknown): Promise<unknown>;
+    request(method: string, params?: unknown): Promise<unknown>;
+    notify(method: string, params?: unknown): Promise<void>;
+    onNotification(method: string, callback: (params: unknown) => void): Disposable;
+    shutdown(): void;
+    dispose(): void;
+}
+export declare function createDefaultRustLanguageWorker(): Worker;
+export declare function isWorkerLspMessage(value: unknown): value is JsonRpcMessage;
+//# sourceMappingURL=worker-transport.d.ts.map

package/dist/live-coding/worker-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-transport.d.ts","sourceRoot":"","sources":["../../src/live-coding/worker-transport.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EAErB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,OAAO,EACb,MAAM,gBAAgB,CAAC;AASxB,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EAAE,UAAU,EAAE,CAAC;AAE3B,MAAM,WAAW,kBAAkB;IACjC,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACpC,gBAAgB,CACd,IAAI,EAAE,SAAS,GAAG,OAAO,GAAG,cAAc,EAC1C,QAAQ,EAAE,aAAa,GACtB,IAAI,CAAC;IACR,mBAAmB,CACjB,IAAI,EAAE,SAAS,GAAG,OAAO,GAAG,cAAc,EAC1C,QAAQ,EAAE,aAAa,GACtB,IAAI,CAAC;IACR,SAAS,IAAI,IAAI,CAAC;CACnB;AAED,mFAAmF;AACnF,qBAAa,mBAAoB,SAAQ,qBAAqB;IAIhD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAHnC,OAAO,CAAC,QAAQ,CAA6B;IAC7C,OAAO,CAAC,SAAS,CAAS;gBAEG,MAAM,EAAE,kBAAkB;IAIvD,MAAM,CAAC,QAAQ,EAAE,YAAY,GAAG,UAAU;IAUjC,OAAO,IAAI,IAAI;IAWxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAOxB;IAEF,OAAO,CAAC,QAAQ,CAAC,cAAc,CAE7B;IAEF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAM5B;CACH;AAED,mFAAmF;AACnF,qBAAa,mBAAoB,SAAQ,qBAAqB;IAIhD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAHnC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,UAAU,CAAK;gBAEM,MAAM,EAAE,kBAAkB;IAIvD,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAYtC,GAAG,IAAI,IAAI;IAIF,OAAO,IAAI,IAAI;CAIzB;AAED,MAAM,WAAW,2BAA2B;IAC1C,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,qBAAa,oBAAoB;IAU7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAV1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAC7C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAChD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAqC;IAC5E,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAa;IACnD,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,cAAc,CAA8C;gBAGjD,MAAM,EAAE,kBAAkB,EAC1B,OAAO,GAAE,2BAAgC;IAWtD,UAAU,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAMnD,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAsD3D,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAKvD,cAAc,CACZ,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,GAClC,UAAU;IAIb,QAAQ,IAAI,IAAI;IAehB,OAAO,IAAI,IAAI;CAYhB;AAED,wBAAgB,+BAA+B,IAAI,MAAM,CAKxD;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAE1E"}

package/dist/live-coding/worker-transport.js

@@ -0,0 +1,204 @@
+import { AbstractMessageReader, AbstractMessageWriter, CancellationTokenSource, } from 'vscode-jsonrpc';
+import { ExitNotification, InitializeRequest, InitializedNotification, ShutdownRequest, createProtocolConnection, } from 'vscode-languageserver-protocol';
+import { decodeJsonRpcMessage, } from './lsp-protocol.js';
+/** Standard vscode-jsonrpc MessageReader over structured-clone worker messages. */
+export class WorkerMessageReader extends AbstractMessageReader {
+    constructor(worker) {
+        super();
+        this.worker = worker;
+        this.callback = null;
+        this.listening = false;
+        this.onMessage = (event) => {
+            const decoded = decodeJsonRpcMessage(event.data);
+            if (!decoded.ok) {
+                this.fireError(new Error(decoded.message));
+                return;
+            }
+            this.callback?.(decoded.message);
+        };
+        this.onMessageError = () => {
+            this.fireError(new Error('Language worker sent an unreadable message'));
+        };
+        this.onWorkerError = (event) => {
+            const message = 'message' in event && typeof event.message === 'string'
+                ? event.message
+                : 'Language worker failed';
+            this.fireError(new Error(message));
+        };
+    }
+    listen(callback) {
+        if (this.listening)
+            throw new Error('WorkerMessageReader is already listening');
+        this.listening = true;
+        this.callback = callback;
+        this.worker.addEventListener('message', this.onMessage);
+        this.worker.addEventListener('messageerror', this.onMessageError);
+        this.worker.addEventListener('error', this.onWorkerError);
+        return { dispose: () => this.dispose() };
+    }
+    dispose() {
+        if (this.listening) {
+            this.worker.removeEventListener('message', this.onMessage);
+            this.worker.removeEventListener('messageerror', this.onMessageError);
+            this.worker.removeEventListener('error', this.onWorkerError);
+        }
+        this.listening = false;
+        this.callback = null;
+        super.dispose();
+    }
+}
+/** Standard vscode-jsonrpc MessageWriter over structured-clone worker messages. */
+export class WorkerMessageWriter extends AbstractMessageWriter {
+    constructor(worker) {
+        super();
+        this.worker = worker;
+        this.disposed = false;
+        this.errorCount = 0;
+    }
+    write(message) {
+        if (this.disposed)
+            return Promise.reject(new Error('Worker writer is disposed'));
+        try {
+            this.worker.postMessage(message);
+            return Promise.resolve();
+        }
+        catch (error) {
+            this.errorCount++;
+            this.fireError(error, message, this.errorCount);
+            return Promise.reject(error);
+        }
+    }
+    end() {
+        this.dispose();
+    }
+    dispose() {
+        this.disposed = true;
+        super.dispose();
+    }
+}
+/**
+ * LSP 3.17 JSON-RPC client over a real vscode-jsonrpc MessageConnection.
+ * Monaco providers adapt editor calls to this connection; transport framing,
+ * request ids, cancellation, errors, and notifications are standard JSON-RPC.
+ */
+export class WorkerLanguageClient {
+    constructor(worker, options = {}) {
+        this.worker = worker;
+        this.options = options;
+        this.transportErrorHandlers = new Set();
+        this.disposed = false;
+        this.terminateTimer = null;
+        this.reader = new WorkerMessageReader(worker);
+        this.writer = new WorkerMessageWriter(worker);
+        this.readerErrorDisposable = this.reader.onError((error) => {
+            for (const handler of this.transportErrorHandlers)
+                handler(error);
+        });
+        this.connection = createProtocolConnection(this.reader, this.writer);
+        this.connection.listen();
+    }
+    async initialize(params) {
+        const result = await this.request(InitializeRequest.type.method, params);
+        await this.notify(InitializedNotification.type.method, {});
+        return result;
+    }
+    request(method, params) {
+        if (this.disposed)
+            return Promise.reject(new Error('Language client is disposed'));
+        const cancellation = new CancellationTokenSource();
+        const timeoutMs = this.options.requestTimeoutMs ?? 3000;
+        return new Promise((resolve, reject) => {
+            let settled = false;
+            const onTransportError = (error) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                cancellation.cancel();
+                cancellation.dispose();
+                this.transportErrorHandlers.delete(onTransportError);
+                reject(error);
+            };
+            const timer = setTimeout(() => {
+                if (settled)
+                    return;
+                settled = true;
+                cancellation.cancel();
+                cancellation.dispose();
+                this.transportErrorHandlers.delete(onTransportError);
+                reject(new Error(`Language request timed out: ${method}`));
+            }, timeoutMs);
+            this.transportErrorHandlers.add(onTransportError);
+            const request = params === undefined
+                ? this.connection.sendRequest(method, cancellation.token)
+                : this.connection.sendRequest(method, params, cancellation.token);
+            void request
+                .then((value) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                cancellation.dispose();
+                this.transportErrorHandlers.delete(onTransportError);
+                resolve(value);
+            }, (error) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                cancellation.dispose();
+                this.transportErrorHandlers.delete(onTransportError);
+                reject(error instanceof Error
+                    ? error
+                    : new Error('Language request failed'));
+            });
+        });
+    }
+    notify(method, params) {
+        if (this.disposed)
+            return Promise.reject(new Error('Language client is disposed'));
+        return this.connection.sendNotification(method, params);
+    }
+    onNotification(method, callback) {
+        return this.connection.onNotification(method, callback);
+    }
+    shutdown() {
+        if (this.disposed || this.terminateTimer)
+            return;
+        const finish = () => {
+            if (this.disposed)
+                return;
+            void this.connection
+                .sendNotification(ExitNotification.type.method)
+                .catch(() => { })
+                .finally(() => this.dispose());
+        };
+        void this.request(ShutdownRequest.type.method)
+            .catch(() => { })
+            .finally(finish);
+        this.terminateTimer = setTimeout(finish, this.options.requestTimeoutMs ?? 3000);
+    }
+    dispose() {
+        if (this.disposed)
+            return;
+        this.disposed = true;
+        if (this.terminateTimer)
+            clearTimeout(this.terminateTimer);
+        this.terminateTimer = null;
+        this.transportErrorHandlers.clear();
+        this.readerErrorDisposable.dispose();
+        this.connection.dispose();
+        this.reader.dispose();
+        this.writer.dispose();
+        this.worker.terminate();
+    }
+}
+export function createDefaultRustLanguageWorker() {
+    return new Worker(new URL('./rust-lsp.worker.js', import.meta.url), {
+        type: 'module',
+        name: 'crowdy-rust-lsp',
+    });
+}
+export function isWorkerLspMessage(value) {
+    return decodeJsonRpcMessage(value).ok;
+}

package/dist/player-runtime/glue-runtime.d.ts

@@ -25,12 +25,18 @@ export interface GlueInitMessage {
     type: 'init';
     artifact: ArrayBuffer;
     authority: 'player';
+    /** Server-authored budget loaded into an injected mutable `ck_fuel` global. */
     fuelPerDispatch?: string;
+    /** Legacy metadata; the hard watchdog is owned by the page-side broker. */
     watchdogMs?: number;
+    hostCallTimeoutMs?: number;
     /** Local client tick cadence in ms (0/undefined => no self-tick). */
     tickIntervalMs?: number;
 }
-/** Parse the fuel budget the broker forwards; undefined/invalid => unbounded (server still meters). */
+/**
+ * Parse the server-authored budget used to refill an instrumented artifact's
+ * mutable `ck_fuel` global before every guest dispatch.
+ */
 export declare function parseFuelBudget(raw: string | undefined): bigint | null;
 /** A dispatch outcome the worker reports back to the broker. */
 export type GlueDispatchResult = {
@@ -41,9 +47,9 @@ export type GlueDispatchResult = {
     detail?: string;
 };
 /**
- * Wrap a single guest dispatch with the wall-clock watchdog. The fuel trap is
- * enforced inside the gas-injected module; this guards against a hang that
- * spins without consuming fuel. Pure and unit-testable.
+ * Classify a completed guest dispatch by elapsed wall time. This cannot
+ * interrupt synchronous WASM; the page-side PlayerCodeBroker owns the hard
+ * dispatch watchdog and terminates a worker whose dispatch never returns.
  */
 export declare function runWithWatchdog(dispatch: () => unknown, watchdogMs: number, now?: () => number): Promise<GlueDispatchResult>;
 /** The minimal guest-instance surface the runtime drives (a real WebAssembly.Instance satisfies it). */
@@ -51,6 +57,7 @@ export interface GuestExports {
     memory: {
         buffer: ArrayBuffer;
     };
+    ck_fuel?: WebAssembly.Global;
     ck_alloc(len: number): number;
     ck_free?(ptr: number, len: number): void;
     init?(): void;
@@ -66,6 +73,7 @@ export interface GlueRuntimeOptions {
     /** Deterministic-enough randomness for the guest `random_get` (defaults to crypto). */
     randomFill?: (buf: Uint8Array) => void;
     now?: () => number;
+    fuelPerDispatch?: bigint | null;
 }
 /**
  * Drives one untrusted guest module: builds the `ck` + wasi import table,
@@ -79,6 +87,7 @@ export declare class GlueRuntime {
     private exports;
     private stateBlob;
     constructor(options: GlueRuntimeOptions);
+    private resetFuel;
     /** The import object handed to `WebAssembly.instantiate`. Guest sees only these. */
     buildImports(getExports: () => GuestExports | null): WebAssembly.Imports;
     instantiate(artifact: ArrayBuffer): Promise<void>;

package/dist/player-runtime/glue-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"glue-runtime.d.ts","sourceRoot":"","sources":["../../src/player-runtime/glue-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,8EAA8E;AAC9E,eAAO,MAAM,mBAAmB,iVAoBtB,CAAC;AAEX,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,WAAW,CAAC;IACtB,SAAS,EAAE,QAAQ,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,uGAAuG;AACvG,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAQtE;AAED,gEAAgE;AAChE,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzE;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,OAAO,EACvB,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,MAAM,MAAyB,GACnC,OAAO,CAAC,kBAAkB,CAAC,CAe7B;AAED,wGAAwG;AACxG,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE;QAAE,MAAM,EAAE,WAAW,CAAA;KAAE,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,IAAI,CAAC,IAAI,IAAI,CAAC;IACd,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAC1D,QAAQ,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IACjC,4FAA4F;IAC5F,YAAY,EAAE,CAAC,QAAQ,EAAE,UAAU,KAAK,UAAU,CAAC;IACnD,gEAAgE;IAChE,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACjD,uFAAuF;IACvF,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,IAAI,CAAC;IACvC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAgBD;;;;;;GAMG;AACH,qBAAa,WAAW;IAIV,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHpC,OAAO,CAAC,OAAO,CAA6B;IAC5C,OAAO,CAAC,SAAS,CAAiC;gBAErB,OAAO,EAAE,kBAAkB;IAExD,oFAAoF;IACpF,YAAY,CAAC,UAAU,EAAE,MAAM,YAAY,GAAG,IAAI,GAAG,WAAW,CAAC,OAAO;IAkFlE,WAAW,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAUvD,gEAAgE;IAChE,IAAI,IAAI,IAAI;IAIZ,gFAAgF;IAChF,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAIxB,sFAAsF;IACtF,MAAM,CAAC,OAAO,EAAE,UAAU,GAAG,UAAU;CAcxC"}
+{"version":3,"file":"glue-runtime.d.ts","sourceRoot":"","sources":["../../src/player-runtime/glue-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,8EAA8E;AAC9E,eAAO,MAAM,mBAAmB,iVAoBtB,CAAC;AAEX,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,WAAW,CAAC;IACtB,SAAS,EAAE,QAAQ,CAAC;IACpB,+EAA+E;IAC/E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qEAAqE;IACrE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAQtE;AAED,gEAAgE;AAChE,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzE;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,OAAO,EACvB,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,MAAM,MAAyB,GACnC,OAAO,CAAC,kBAAkB,CAAC,CAe7B;AAED,wGAAwG;AACxG,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE;QAAE,MAAM,EAAE,WAAW,CAAA;KAAE,CAAC;IAChC,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,IAAI,CAAC,IAAI,IAAI,CAAC;IACd,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAC1D,QAAQ,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IACjC,4FAA4F;IAC5F,YAAY,EAAE,CAAC,QAAQ,EAAE,UAAU,KAAK,UAAU,CAAC;IACnD,gEAAgE;IAChE,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACjD,uFAAuF;IACvF,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,IAAI,CAAC;IACvC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAkCD;;;;;;GAMG;AACH,qBAAa,WAAW;IAIV,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHpC,OAAO,CAAC,OAAO,CAA6B;IAC5C,OAAO,CAAC,SAAS,CAAiC;gBAErB,OAAO,EAAE,kBAAkB;IAExD,OAAO,CAAC,SAAS;IASjB,oFAAoF;IACpF,YAAY,CAAC,UAAU,EAAE,MAAM,YAAY,GAAG,IAAI,GAAG,WAAW,CAAC,OAAO;IA4FlE,WAAW,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAUvD,gEAAgE;IAChE,IAAI,IAAI,IAAI;IAKZ,gFAAgF;IAChF,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAKxB,sFAAsF;IACtF,MAAM,CAAC,OAAO,EAAE,UAAU,GAAG,UAAU;CAuBxC"}

package/dist/player-runtime/glue-runtime.js

@@ -41,7 +41,10 @@ export const GLUE_HOST_FUNCTIONS = [
     'overlay_draw',
     'grid_permission_check',
 ];
-/** Parse the fuel budget the broker forwards; undefined/invalid => unbounded (server still meters). */
+/**
+ * Parse the server-authored budget used to refill an instrumented artifact's
+ * mutable `ck_fuel` global before every guest dispatch.
+ */
 export function parseFuelBudget(raw) {
     if (raw == null)
         return null;
@@ -54,9 +57,9 @@ export function parseFuelBudget(raw) {
     }
 }
 /**
- * Wrap a single guest dispatch with the wall-clock watchdog. The fuel trap is
- * enforced inside the gas-injected module; this guards against a hang that
- * spins without consuming fuel. Pure and unit-testable.
+ * Classify a completed guest dispatch by elapsed wall time. This cannot
+ * interrupt synchronous WASM; the page-side PlayerCodeBroker owns the hard
+ * dispatch watchdog and terminates a worker whose dispatch never returns.
  */
 export async function runWithWatchdog(dispatch, watchdogMs, now = () => Date.now()) {
     const start = now();
@@ -76,6 +79,16 @@ export async function runWithWatchdog(dispatch, watchdogMs, now = () => Date.now
     return { ok: true };
 }
 const textDecoder = new TextDecoder();
+function assertMemoryRange(buffer, ptr, len, operation) {
+    if (!Number.isSafeInteger(ptr) ||
+        !Number.isSafeInteger(len) ||
+        ptr < 0 ||
+        len < 0 ||
+        ptr > buffer.byteLength ||
+        len > buffer.byteLength - ptr) {
+        throw new RangeError(`${operation} is outside guest memory`);
+    }
+}
 function defaultRandomFill(buf) {
     const c = globalThis.crypto;
     if (c?.getRandomValues) {
@@ -102,6 +115,15 @@ export class GlueRuntime {
         this.exports = null;
         this.stateBlob = new Uint8Array(0);
     }
+    resetFuel() {
+        const fuel = this.exports?.ck_fuel;
+        if (!fuel)
+            return;
+        if (this.options.fuelPerDispatch == null) {
+            throw new Error('instrumented artifact is missing a fuel budget');
+        }
+        fuel.value = this.options.fuelPerDispatch;
+    }
     /** The import object handed to `WebAssembly.instantiate`. Guest sees only these. */
     buildImports(getExports) {
         const mem = () => {
@@ -114,17 +136,21 @@ export class GlueRuntime {
             const ex = getExports();
             if (!ex)
                 throw new Error('guest not instantiated');
+            const buffer = ex.memory.buffer;
+            assertMemoryRange(buffer, ptr, len, 'guest memory read');
             // Copy into a fresh ArrayBuffer-backed view — the guest buffer may
             // detach/grow between calls (and may be a SharedArrayBuffer).
             const out = new Uint8Array(len);
-            out.set(new Uint8Array(ex.memory.buffer, ptr, len));
+            out.set(new Uint8Array(buffer, ptr, len));
             return out;
         };
         const writeAt = (ptr, src) => {
             const ex = getExports();
             if (!ex)
                 throw new Error('guest not instantiated');
-            new Uint8Array(ex.memory.buffer, ptr, src.length).set(src);
+            const buffer = ex.memory.buffer;
+            assertMemoryRange(buffer, ptr, src.length, 'guest memory write');
+            new Uint8Array(buffer, ptr, src.length).set(src);
         };
         const now = this.options.now ?? (() => Date.now());
         const randomFill = this.options.randomFill ?? defaultRandomFill;
@@ -153,6 +179,9 @@ export class GlueRuntime {
                 if (!ex)
                     throw new Error('guest not instantiated');
                 const outPtr = ex.ck_alloc(respBytes.length);
+                if (respBytes.length > 0 && outPtr === 0) {
+                    throw new RangeError('ck_alloc returned a null reply pointer');
+                }
                 writeAt(outPtr, respBytes);
                 // Packed (ptr << 32 | len); the guest reads then ck_frees it.
                 return (BigInt(outPtr) << 32n) | BigInt(respBytes.length >>> 0);
@@ -160,9 +189,13 @@ export class GlueRuntime {
         };
         const wasi = {
             random_get: (ptr, len) => {
-                const buf = new Uint8Array(len);
+                const ex = getExports();
+                if (!ex)
+                    throw new Error('guest not instantiated');
+                const buffer = ex.memory.buffer;
+                assertMemoryRange(buffer, ptr, len, 'random_get write');
+                const buf = new Uint8Array(buffer, ptr, len);
                 randomFill(buf);
-                writeAt(ptr, buf);
                 return 0;
             },
             // A player artifact may pull in a few benign wasi stubs; keep them inert.
@@ -196,10 +229,12 @@ export class GlueRuntime {
     }
     /** Run the module's `init` export (once, after instantiate). */
     init() {
+        this.resetFuel();
         this.exports?.init?.();
     }
     /** Run one `tick(dt_ms)`. Throws propagate to the caller's watchdog wrapper. */
     tick(dtMs) {
+        this.resetFuel();
         this.exports?.tick?.(dtMs);
     }
     /** Invoke the module with an opaque payload; returns the reply bytes (copied out). */
@@ -208,13 +243,22 @@ export class GlueRuntime {
         if (!ex || typeof ex.handle_invoke !== 'function')
             return new Uint8Array(0);
         const ptr = ex.ck_alloc(payload.length);
+        if (payload.length > 0 && ptr === 0) {
+            throw new RangeError('ck_alloc returned a null invoke pointer');
+        }
+        assertMemoryRange(ex.memory.buffer, ptr, payload.length, 'invoke request write');
         new Uint8Array(ex.memory.buffer, ptr, payload.length).set(payload);
+        this.resetFuel();
         const packed = BigInt(ex.handle_invoke(ptr, payload.length));
         ex.ck_free?.(ptr, payload.length);
         const outPtr = Number(packed >> 32n);
         const outLen = Number(packed & 0xffffffffn);
         if (outLen === 0)
             return new Uint8Array(0);
+        if (outPtr === 0) {
+            throw new RangeError('guest returned a null invoke reply pointer');
+        }
+        assertMemoryRange(ex.memory.buffer, outPtr, outLen, 'invoke reply read');
         const out = new Uint8Array(ex.memory.buffer, outPtr, outLen).slice();
         ex.ck_free?.(outPtr, outLen);
         return out;