@daugasauron/dolly 0.0.0-stage → 0.1.4-rc.0

package/host/nena/abi.mjs

@@ -0,0 +1,19 @@
+// Generated from host/nena/dolly-nena-0.wat, host/nena/nena.h, include/dolly/process.h.
+export const DOLLY_NENA_VERSION = 0;
+export const DOLLY_NENA_PROCESS_OP = 133;
+export const DOLLY_NENA_SLOTS = 2;
+export const DOLLY_NENA_REPLY_BYTES = 256;
+export const DOLLY_NENA_PACKET_BYTES = 72;
+export const DOLLY_NENA_NAME_BYTES = 32;
+export const DOLLY_NENA_GIVES_BYTES = 120;
+export const DOLLY_NENA_REASON_BYTES = 96;
+export const DOLLY_NENA_OPEN = 1;
+export const DOLLY_NENA_MODULE = 2;
+export const DOLLY_NENA_ENABLE = 3;
+export const DOLLY_NENA_DISABLE = 4;
+export const DOLLY_NENA_CLOSE = 5;
+export const DOLLY_NENA_ENABLED = 1;
+export const DOLLY_NENA_DECLARED = 2;
+export const DOLLY_NENA_FIXED = 4;
+export const DOLLY_ERRNO = Object.freeze({ E2BIG: 1, EACCES: 2, EADDRINUSE: 3, EADDRNOTAVAIL: 4, EAFNOSUPPORT: 5, EAGAIN: 6, EALREADY: 7, EBADF: 8, EBADMSG: 9, EBUSY: 10, ECANCELED: 11, ECHILD: 12, ECONNABORTED: 13, ECONNREFUSED: 14, ECONNRESET: 15, EDEADLK: 16, EDESTADDRREQ: 17, EDOM: 18, EDQUOT: 19, EEXIST: 20, EFAULT: 21, EFBIG: 22, EHOSTUNREACH: 23, EIDRM: 24, EILSEQ: 25, EINPROGRESS: 26, EINTR: 27, EINVAL: 28, EIO: 29, EISCONN: 30, EISDIR: 31, ELOOP: 32, EMFILE: 33, EMLINK: 34, EMSGSIZE: 35, EMULTIHOP: 36, ENAMETOOLONG: 37, ENETDOWN: 38, ENETRESET: 39, ENETUNREACH: 40, ENFILE: 41, ENOBUFS: 42, ENODEV: 43, ENOENT: 44, ENOEXEC: 45, ENOLCK: 46, ENOLINK: 47, ENOMEM: 48, ENOMSG: 49, ENOPROTOOPT: 50, ENOSPC: 51, ENOSYS: 52, ENOTCONN: 53, ENOTDIR: 54, ENOTEMPTY: 55, ENOTRECOVERABLE: 56, ENOTSOCK: 57, ENOTTY: 59, ENXIO: 60, EOVERFLOW: 61, EOWNERDEAD: 62, EPERM: 63, EPIPE: 64, EPROTO: 65, EPROTONOSUPPORT: 66, EPROTOTYPE: 67, ERANGE: 68, EROFS: 69, ESPIPE: 70, ESRCH: 71, ESTALE: 72, ETIMEDOUT: 73, ETXTBSY: 74, EXDEV: 75, ENODATA: 116, ENOTSUP: 138 });
+export const DOLLY_NENA_ABI_DIGEST = "3b6540395986cc839e4ef67cdfd0a0510780e26cdf7071522b60730c7b05c58e";

package/host/nena/module.json

@@ -0,0 +1,15 @@
+{
+  "name": "nena",
+  "version": 0,
+  "gives": "enable and disable host modules with nena; disabling it fixes them",
+  "dependencies": ["runtime@0"],
+  "phase": "image",
+  "switches": true,
+  "imports": ["env.dolly_nena_dispatch"],
+  "host": "nena.mjs",
+  "contracts": ["dolly-nena-0.wat"],
+  "process": [],
+  "headers": ["nena.h", "nena-abi.h"],
+  "kernel": ["kernel.c"],
+  "client": ["client.c"]
+}

package/host/nena/nena.mjs

@@ -0,0 +1,131 @@
+import * as N from "./abi.mjs";
+import { bootFiles } from "../runtime/boot-files.mjs";
+import { hostRequirements } from "../requirements.mjs";
+import { DOLLY_ERRNO as E } from "./abi.mjs";
+export { DOLLY_NENA_ABI_DIGEST as digest } from "./abi.mjs";
+
+// The device as the lease bridge sees it.
+export const lease = { type: "nena", slots: N.DOLLY_NENA_SLOTS, packetBytes: N.DOLLY_NENA_PACKET_BYTES,
+  replyBytes: N.DOLLY_NENA_REPLY_BYTES, open: N.DOLLY_NENA_OPEN, close: N.DOLLY_NENA_CLOSE };
+// The session's own record of the modules it enabled, one name@version a line.
+// The Worker writes it after every switch and the page enables what it lists
+// when the session is loaded again; the recipe engine reads it for amy.
+const record = "/etc/dolly/enabled";
+// Boot waits ten seconds for a provider's page side (host/modules.mjs).
+const restoreMilliseconds = 3000;
+
+const encoder = new TextEncoder(), decoder = new TextDecoder("utf-8", { fatal: true });
+const fail = errno => { throw Object.assign(new Error("nena request failed"), { errno }); };
+// A NUL-terminated text field, cut at a whole character.
+const text = (bytes, offset, size, value) => void encoder.encodeInto(value, bytes.subarray(offset, offset + size - 1));
+
+// The page side: `modules` is the registry's list and its two switches
+// (host/modules.mjs), which only this provider is given. Every answer is the
+// page's; a packet names a module and never a file, URL or provider.
+export function browser({ send, modules, showStatus }) {
+  const requirement = ({ name, version }) => `${name}@${version}`;
+  function moduleRecord(module, reason) {
+    const bytes = new Uint8Array(N.DOLLY_NENA_REPLY_BYTES), view = new DataView(bytes.buffer);
+    text(bytes, 0, N.DOLLY_NENA_NAME_BYTES, module.name);
+    view.setUint32(32, module.version, true);
+    view.setUint32(36, (module.enabled ? N.DOLLY_NENA_ENABLED : 0) | (module.declared ? N.DOLLY_NENA_DECLARED : 0) |
+      (module.fixed ? N.DOLLY_NENA_FIXED : 0), true);
+    text(bytes, 40, N.DOLLY_NENA_GIVES_BYTES, module.gives);
+    text(bytes, 40 + N.DOLLY_NENA_GIVES_BYTES, N.DOLLY_NENA_REASON_BYTES, reason ?? module.fixed);
+    return bytes;
+  }
+  // What the session enabled beyond what the page started with: its record.
+  const enabledSince = () => modules.list().filter(module => module.enabled && !module.declared).map(requirement);
+  async function dispatch(packet) {
+    if (!(packet instanceof Uint8Array) || packet.byteLength < 32 || packet.byteLength > N.DOLLY_NENA_PACKET_BYTES) fail(E.EINVAL);
+    const view = new DataView(packet.buffer, packet.byteOffset, packet.byteLength);
+    const operation = view.getUint32(4, true), scope = view.getUint32(8, true);
+    if (view.getUint32(0, true) !== N.DOLLY_NENA_VERSION || view.getUint32(12, true) || view.getUint32(20, true) ||
+        !scope || view.getUint32(24, true) !== packet.length - 32 || view.getUint32(28, true)) fail(E.EINVAL);
+    const sized = bytes => { if (packet.length !== bytes) fail(E.EINVAL); };
+    if (operation === N.DOLLY_NENA_OPEN) {
+      sized(32);
+      const reply = new Uint8Array(8);
+      new DataView(reply.buffer).setBigUint64(0, BigInt(scope), true);
+      return { bytes: reply };
+    }
+    if (operation === N.DOLLY_NENA_CLOSE) { sized(32); return { bytes: new Uint8Array() }; }
+    if (operation === N.DOLLY_NENA_MODULE) {
+      sized(40);
+      if (view.getUint32(36, true)) fail(E.EINVAL);
+      return { bytes: moduleRecord(modules.list()[view.getUint32(32, true)] ?? fail(E.ENOENT)) };
+    }
+    if (operation !== N.DOLLY_NENA_ENABLE && operation !== N.DOLLY_NENA_DISABLE) fail(E.EINVAL);
+    sized(72);
+    const field = packet.subarray(32, 32 + N.DOLLY_NENA_NAME_BYTES), end = field.indexOf(0);
+    if (end < 1 || field.subarray(end).some(byte => byte) || view.getUint32(68, true)) fail(E.EINVAL);
+    let name;
+    try { name = decoder.decode(field.subarray(0, end)); } catch { fail(E.EINVAL); }
+    const version = view.getUint32(64, true), enabling = operation === N.DOLLY_NENA_ENABLE;
+    const found = () => modules.list().find(module => module.name === name && module.version === version) ?? fail(E.ENOENT);
+    const value = requirement(found());
+    // The session gives the privilege up: answered first, since the answer
+    // travels through the provider that the switch takes away.
+    if (!enabling && name === "nena") return { bytes: moduleRecord({ ...found(), enabled: false }), after: () => modules.disable(value) };
+    const refusal = await (enabling ? modules.enable(value) : modules.disable(value));
+    return { bytes: moduleRecord(found(), refusal ?? undefined), enabled: enabledSince() };
+  }
+  return {
+    messages: {
+      async "nena-request"(message) {
+        let result;
+        try { result = await dispatch(message.packet); }
+        catch (error) { result = { error: error.errno ?? E.EIO, bytes: new Uint8Array() }; }
+        if (result.enabled) send({ type: "nena-record", enabled: result.enabled });
+        send({ type: "nena-complete", scope: message.scope, sequence: message.sequence, error: result.error ?? 0,
+          bytes: result.bytes }, [result.bytes.buffer]);
+        await result.after?.();
+      },
+      "nena-revoke"(message) { send({ type: "nena-complete", scope: message.scope, revoked: true }); },
+    },
+    // A loaded session has the modules its record lists again, and the page
+    // says in one line which, and which it could not enable, with the command
+    // that tries again. Boot waits for them, so that the ENTRY finds them,
+    // but only so long: a module slower than that comes while the session
+    // runs, and never stops it from loading.
+    async start({ enabled }) {
+      const restored = (async () => {
+        const refused = [];
+        for (const value of enabled) {
+          const refusal = await modules.enable(value);
+          if (refusal) refused.push(`${value} is not enabled: ${refusal}. nena enable ${value.split("@")[0]} tries again.`);
+        }
+        const again = enabledSince();
+        send({ type: "nena-record", enabled: again });
+        const said = [...again.length ? [`This session enabled ${again.join(", ")} again.`] : [], ...refused];
+        if (said.length) showStatus(said.join(" "), refused.length > 0);
+      })();
+      await Promise.race([restored, new Promise(resolve => setTimeout(resolve, restoreMilliseconds))]);
+    },
+  };
+}
+
+export function worker({ send, get }) {
+  let bridge, files;
+  return {
+    bindings: { "env.dolly_nena_dispatch": (address, bytes) =>
+      bridge ? bridge.dispatch({ address, bytes }) : -E.ENOSYS },
+    // After the image and a saved session are restored: the record names what
+    // the page enables again. The file is the session's own, so it is bounded
+    // and parsed as requirements; a malformed one enables nothing.
+    start({ kernel, memory }) {
+      bridge = get("runtime").leaseBridge(lease, Number(kernel.dolly_nena_mailbox_address()), send);
+      files = bootFiles(kernel, memory);
+      let enabled = [];
+      try { enabled = hostRequirements(decoder.decode(files.read(record, 4096)).split("\n").filter(Boolean)); } catch {}
+      return { enabled };
+    },
+    messages: {
+      "nena-complete": message => bridge?.acknowledge(message),
+      "nena-record"({ enabled }) {
+        if (enabled.length) files.write(record, `${enabled.join("\n")}\n`); else files.remove(record);
+      },
+    },
+    dispose() { bridge?.dispose(); bridge = undefined; },
+  };
+}

package/host/packages/module.json

@@ -0,0 +1,13 @@
+{
+  "name": "packages",
+  "version": 0,
+  "gives": "the release's published packages, for amy",
+  "dependencies": ["http@0"],
+  "imports": [],
+  "host": "packages.mjs",
+  "contracts": [],
+  "process": [],
+  "headers": [],
+  "kernel": [],
+  "client": []
+}

package/host/packages/packages.mjs

@@ -0,0 +1,15 @@
+// Published package snapshots for a running image. No Wasm imports: enabling
+// packages@0 only lets the page admit GET https://packages.dolly.invalid/v1/…
+// (host/http/local-services.mjs) once the image ENTRY starts. The guest names
+// a package by the recipe pin this release publishes; the page materializes
+// and verifies its snapshot exactly as it does a build input, then serves the
+// bytes. A request grants no network or other authority. The index of names
+// is a public file of the site, amy-index.txt, read like any other URL.
+import { PackageService } from "./service.mjs";
+
+export function browser({ get }) {
+  return {
+    entryStarted() { get("http").services.packages = new PackageService(); },
+    disabled() { delete get("http").services.packages; },
+  };
+}

package/host/packages/service.mjs

@@ -0,0 +1,59 @@
+import { DOLLY_IMAGES } from "../../src/images.mjs";
+import { loadPackagedSnapshotMetadata, loadPackagedSystemSnapshot } from "../../src/packaged-snapshot.mjs";
+import { MAX_SNAPSHOT_BYTES } from "../../src/snapshot-records.mjs";
+
+const PACKAGES_ORIGIN = "https://packages.dolly.invalid";
+const PACKAGE_LIMITS = Object.freeze({
+  maxRequestBytes: 0, maxResponseBytes: MAX_SNAPSHOT_BYTES,
+  timeoutMilliseconds: 30 * 60_000, credentialHeaders: new Set(),
+  // Snapshots served per page: enough for every package, not for a loop.
+  maxSnapshots: 64,
+});
+const packagePath = /^\/v1\/packages\/([0-9a-f]{64})$/;
+
+function reply(body, status, type = "text/plain; charset=utf-8") {
+  return new Response(body, { status, headers: { "content-type": type, "cache-control": "no-store" } });
+}
+
+// GET /v1/packages/SHA256 is the exact snapshot of the package whose recipe
+// has that pin, verified from the published packs. One snapshot is held at a
+// time, until the guest has read it or the broker's deadline cancels it.
+export class PackageService {
+  constructor() {
+    this.active = false;
+    this.served = 0;
+  }
+  get origin() { return PACKAGES_ORIGIN; }
+  authorize(url, method, bytes) {
+    return method === "GET" && bytes === 0 && packagePath.test(url.pathname) ? PACKAGE_LIMITS : undefined;
+  }
+  async fetch(url, init) {
+    const sha256 = packagePath.exec(url.pathname)[1];
+    const definition = DOLLY_IMAGES.find(candidate => candidate.role === "package" && candidate.sha256 === sha256);
+    if (!definition) return reply("This release publishes no package with that recipe pin\n", 404);
+    if (this.active) return reply("Another package snapshot is being served\n", 409);
+    if (this.served >= PACKAGE_LIMITS.maxSnapshots) return reply("Package snapshot quota exceeded\n", 429);
+    this.active = true;
+    this.served += 1;
+    let bytes;
+    try {
+      const metadata = await loadPackagedSnapshotMetadata(definition.image);
+      bytes = await loadPackagedSystemSnapshot(definition.image, metadata, init.signal);
+    } catch (error) {
+      this.active = false;
+      return reply(`${definition.image}: ${error.message}\n`, 502);
+    }
+    const release = () => { this.active = false; };
+    let offset = 0;
+    const body = new ReadableStream({
+      pull: controller => {
+        const end = Math.min(offset + 1024 * 1024, bytes.byteLength);
+        controller.enqueue(new Uint8Array(bytes, offset, end - offset));
+        offset = end;
+        if (offset === bytes.byteLength) { controller.close(); release(); }
+      },
+      cancel: release,
+    }, { highWaterMark: 0 });
+    return reply(body, 200, "application/octet-stream");
+  }
+}

package/host/requirements.mjs

@@ -0,0 +1,62 @@
+import { DOLLY_HOST_RECORD_BYTES as recordBytes, DOLLY_HOST_NAME_BYTES as nameBytes,
+  DOLLY_HOST_DIGEST_BYTES as digestBytes, DOLLY_HOST_MAX_RECORDS as maxRecords } from "./abi.mjs";
+import { hex } from "../src/static-asset.mjs";
+
+const pattern = /^([a-z][a-z0-9-]{0,30})@(0|[1-9][0-9]{0,4})$/;
+
+export function hostRequirement(value) {
+  const match = typeof value === "string" && pattern.exec(value);
+  if (!match || Number(match[2]) > 65535) throw new TypeError(`invalid host requirement: ${value}`);
+  return { name: match[1], version: Number(match[2]) };
+}
+
+export function hostRequirements(values = []) {
+  if (!Array.isArray(values)) throw new TypeError("invalid host requirements");
+  const versions = new Map();
+  for (const value of values) {
+    const { name, version } = hostRequirement(value);
+    if (versions.has(name) && versions.get(name) !== version) throw new Error(`conflicting host ABI requirements for ${name}`);
+    versions.set(name, version);
+  }
+  if (versions.size > maxRecords) throw new TypeError("too many host requirements");
+  return [...versions].sort(([a], [b]) => a.localeCompare(b)).map(([name, version]) => `${name}@${version}`);
+}
+
+// The modules an executable's dolly.host records require: name@version -> ABI digest.
+export function executableHostRequirements(module) {
+  const required = new Map(), decoder = new TextDecoder("utf-8", { fatal: true });
+  let records = 0;
+  for (const { name, data } of module.customSectionData) {
+    if (name !== "dolly.host") continue;
+    records += data.length / recordBytes;
+    if (data.length === 0 || data.length % recordBytes || records > maxRecords) {
+      throw new Error("invalid dolly.host record count");
+    }
+    const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+    for (let offset = 0; offset < data.length; offset += recordBytes) {
+      const bytes = data.subarray(offset, offset + nameBytes), end = bytes.indexOf(0);
+      if (end < 1 || bytes.subarray(end).some(byte => byte !== 0) || view.getUint32(offset + nameBytes + 4, true) !== 0) {
+        throw new Error("invalid dolly.host record");
+      }
+      const requirement = `${decoder.decode(bytes.subarray(0, end))}@${view.getUint32(offset + nameBytes, true)}`;
+      const digest = hex(data.subarray(offset + recordBytes - digestBytes, offset + recordBytes));
+      if (required.has(requirement) && required.get(requirement) !== digest) {
+        throw new Error(`conflicting host ABI digests for ${requirement}`);
+      }
+      required.set(requirement, digest);
+    }
+  }
+  hostRequirements([...required.keys()]);
+  return required;
+}
+
+// available: name@version -> the ABI digest its provider implements. A session
+// with nena@0 can enable a module; any other has its image's list.
+export function checkHostAbi(required, available) {
+  for (const [requirement, digest] of required) {
+    if (!available.has(requirement)) throw new Error(available.has("nena@0")
+      ? `host module ${requirement} is not enabled: nena enable ${hostRequirement(requirement).name}`
+      : `host module ${requirement} is not declared by this image (REQUIRES HOST)`);
+    if (available.get(requirement) !== digest) throw new Error(`host module ${requirement} has a different layout than this program was built for`);
+  }
+}

package/host/runtime/abi.mjs

@@ -0,0 +1,8 @@
+// Generated from abi/dolly-supervisor-0.wat, abi/dolly-image-0.wat, abi/dolly-process-0.wat, abi/dolly-process-gate-0.wat, include/dolly/process.h.
+export const DOLLY_TERMINAL_WORD_RESULT_SEQUENCE = 0;
+export const DOLLY_TERMINAL_WORD_RESULT_STATUS = 1;
+export const DOLLY_TERMINAL_WORD_FOREGROUND_PID = 2;
+export const DOLLY_TERMINAL_WORD_FOREGROUND_INTERRUPTIBLE = 3;
+export const DOLLY_TERMINAL_WORD_INTERRUPT_SEQUENCE = 4;
+export const DOLLY_TERMINAL_WORD_INTERRUPT_TARGET_PID = 5;
+export const DOLLY_ERRNO = Object.freeze({ E2BIG: 1, EACCES: 2, EADDRINUSE: 3, EADDRNOTAVAIL: 4, EAFNOSUPPORT: 5, EAGAIN: 6, EALREADY: 7, EBADF: 8, EBADMSG: 9, EBUSY: 10, ECANCELED: 11, ECHILD: 12, ECONNABORTED: 13, ECONNREFUSED: 14, ECONNRESET: 15, EDEADLK: 16, EDESTADDRREQ: 17, EDOM: 18, EDQUOT: 19, EEXIST: 20, EFAULT: 21, EFBIG: 22, EHOSTUNREACH: 23, EIDRM: 24, EILSEQ: 25, EINPROGRESS: 26, EINTR: 27, EINVAL: 28, EIO: 29, EISCONN: 30, EISDIR: 31, ELOOP: 32, EMFILE: 33, EMLINK: 34, EMSGSIZE: 35, EMULTIHOP: 36, ENAMETOOLONG: 37, ENETDOWN: 38, ENETRESET: 39, ENETUNREACH: 40, ENFILE: 41, ENOBUFS: 42, ENODEV: 43, ENOENT: 44, ENOEXEC: 45, ENOLCK: 46, ENOLINK: 47, ENOMEM: 48, ENOMSG: 49, ENOPROTOOPT: 50, ENOSPC: 51, ENOSYS: 52, ENOTCONN: 53, ENOTDIR: 54, ENOTEMPTY: 55, ENOTRECOVERABLE: 56, ENOTSOCK: 57, ENOTTY: 59, ENXIO: 60, EOVERFLOW: 61, EOWNERDEAD: 62, EPERM: 63, EPIPE: 64, EPROTO: 65, EPROTONOSUPPORT: 66, EPROTOTYPE: 67, ERANGE: 68, EROFS: 69, ESPIPE: 70, ESRCH: 71, ESTALE: 72, ETIMEDOUT: 73, ETXTBSY: 74, EXDEV: 75, ENODATA: 116, ENOTSUP: 138 });

package/host/runtime/boot-files.mjs

@@ -0,0 +1,45 @@
+import { DOLLY_ERRNO } from "./abi.mjs";
+
+const encoder = new TextEncoder();
+
+// Boot files cross between the Worker and the in-Wasm filesystem through three
+// kernel exports, which take paths and bytes copied into kernel memory.
+export function bootFiles(kernel, memory) {
+  const allocate = size => {
+    const address = Number(kernel.malloc(BigInt(Math.max(1, size))));
+    if (address === 0) throw new Error("Dolly boot allocation failed");
+    return address;
+  };
+  const withBytes = (bytes, use) => {
+    const address = allocate(bytes.length);
+    try {
+      new Uint8Array(memory.buffer, address, bytes.length).set(bytes);
+      return use(BigInt(address));
+    } finally { kernel.free(BigInt(address)); }
+  };
+  const withPath = (path, use) => withBytes(encoder.encode(`${path}\0`), use);
+  return {
+    write(path, value) {
+      const bytes = typeof value === "string" ? encoder.encode(value) : value;
+      if (!(bytes instanceof Uint8Array)) throw new TypeError("invalid Dolly boot file");
+      const status = withPath(path, pathAddress => withBytes(bytes, address =>
+        kernel.dolly_write_file(pathAddress, address, BigInt(bytes.length))));
+      if (status !== 0) throw new Error(`Dolly could not write ${path}: status ${status}`);
+    },
+    // Guest-writable files are bounded before trusted code copies them.
+    read(path, limit) {
+      const address = allocate(limit);
+      try {
+        const size = withPath(path, pathAddress =>
+          kernel.dolly_read_file(pathAddress, BigInt(address), BigInt(limit)));
+        if (size === -DOLLY_ERRNO.EFBIG || size > limit) throw new Error(`${path} is larger than ${limit} bytes`);
+        if (size < 0) throw new Error(`Dolly could not read ${path}: status ${size}`);
+        return new Uint8Array(memory.buffer, address, size).slice();
+      } finally { kernel.free(BigInt(address)); }
+    },
+    remove(path) {
+      const status = withPath(path, pathAddress => kernel.dolly_remove_file(pathAddress));
+      if (status !== 0 && status !== -DOLLY_ERRNO.ENOENT) throw new Error(`Dolly could not remove ${path}: status ${status}`);
+    },
+  };
+}

package/host/runtime/grower.mjs

@@ -0,0 +1,14 @@
+// Grows the kernel's memory for the runtime Worker, which waits meanwhile
+// (runtime.mjs): word 0 is 1 while a growth by values[1] pages is asked, and
+// the old size in pages, or -1, replaces that count.
+onmessage = ({ data: { memory, control } }) => {
+  const values = new BigInt64Array(control), word = new Int32Array(control);
+  postMessage("waiting");
+  for (;;) {
+    // A notify can be the runtime Worker's for a growth done already.
+    while (Atomics.load(word, 0) === 0) Atomics.wait(word, 0, 0);
+    try { values[1] = BigInt(memory.grow(values[1])); } catch { values[1] = -1n; }
+    Atomics.store(word, 0, 0);
+    Atomics.notify(word, 0);
+  }
+};

package/host/runtime/lease-bridge.mjs

@@ -0,0 +1,65 @@
+import { DOLLY_ERRNO as E } from "./abi.mjs";
+
+// The Worker side of a device leased per process (src/device-lease.c). Each
+// packet a process submits goes to the page as `TYPE-request`; the page's
+// `TYPE-complete` is published in the lease's reply slot, a 64-byte header and
+// `replyBytes`. `open` and `close` are the device's operation numbers.
+export function createLeaseBridge({ type, slots: count, packetBytes, replyBytes, open, close }, memory, mailbox, send, complete) {
+  const slots = new Array(count), stride = 64 + replyBytes;
+  if (!Number.isSafeInteger(mailbox) || mailbox <= 0 || mailbox % 4 ||
+      mailbox > memory.buffer.byteLength - count * stride) throw new Error(`Invalid ${type} mailbox`);
+  // The reply to the call a slot's lease waits for; its state is published last.
+  function publish(slot, entry, error, bytes) {
+    const words = new Int32Array(memory.buffer, mailbox + slot * stride, 16);
+    new Uint8Array(memory.buffer, mailbox + slot * stride + 64, bytes.length).set(bytes);
+    Atomics.store(words, 1, entry.scope); Atomics.store(words, 2, entry.sequence);
+    Atomics.store(words, 3, error); Atomics.store(words, 4, bytes.length); Atomics.store(words, 0, 1);
+    entry.pending = false;
+  }
+  function acknowledge(message) {
+    const slot = (message.scope - 1) % count, entry = slots[slot];
+    if (!entry || entry.scope !== message.scope) return;
+    if (message.revoked) slots[slot] = undefined;
+    else if (entry.sequence === message.sequence) {
+      const valid = message.bytes instanceof Uint8Array && message.bytes.byteLength <= replyBytes &&
+        Number.isInteger(message.error) && message.error >= 0 && message.error <= 4095;
+      const error = valid ? message.error : E.EIO;
+      publish(slot, entry, error, valid && !error ? message.bytes : new Uint8Array());
+      if (!entry.released && (entry.operation === close || (entry.operation === open && error))) slots[slot] = undefined;
+    }
+    complete();
+  }
+  // The device is going (its module was disabled, or the page ends): the page's
+  // answer to a call still waiting will find no one, so the call is answered
+  // here as every later one is, ENOSYS. The supervisor's next tick delivers it.
+  function dispose() {
+    slots.forEach((entry, slot) => { if (entry?.pending) publish(slot, entry, E.ENOSYS, new Uint8Array()); });
+  }
+  function dispatch({address: addressValue, bytes: sizeValue}) {
+    const address = Number(addressValue), size = Number(sizeValue);
+    if (!Number.isSafeInteger(address) || !Number.isSafeInteger(size) || address < 0 || size <= 0) return -E.EINVAL;
+    if (!address) {
+      if (size > 0xffffffff) return -E.EINVAL;
+      const entry = slots[(size - 1) % count];
+      if (entry?.scope === size && !entry.released) {
+        entry.released = true; send({type: `${type}-revoke`, scope: size});
+      }
+      return 0;
+    }
+    if (size < 32 || size > packetBytes || address > memory.buffer.byteLength - size) return -E.EINVAL;
+    const packet = new Uint8Array(memory.buffer, address, size).slice();
+    const view = new DataView(packet.buffer), scope = view.getUint32(8, true), sequence = view.getUint32(16, true);
+    const operation = view.getUint32(4, true);
+    if (!scope || !sequence || view.getUint32(12, true) || view.getUint32(20, true)) return -E.EINVAL;
+    const slot = (scope - 1) % count, entry = slots[slot];
+    if (entry?.pending || entry?.released) return -E.EBUSY;
+    if (entry && operation === open) return -E.EBUSY;
+    if (entry && entry.scope !== scope) return -E.EBUSY;
+    if (!entry && operation !== open) return -E.EBADF;
+    if (entry && sequence <= entry.sequence) return -E.ESTALE;
+    slots[slot] = {scope, sequence, operation, pending: true, released: false};
+    send({type: `${type}-request`, scope, sequence, packet}, [packet.buffer]);
+    return 0;
+  }
+  return {dispatch, acknowledge, dispose};
+}

package/host/runtime/module.json

@@ -0,0 +1,16 @@
+{
+  "name": "runtime",
+  "version": 0,
+  "gives": "the kernel's memory, clocks, entropy and process Workers",
+  "fixed": "it is the kernel",
+  "provides": "kernel",
+  "dependencies": [],
+  "phase": "kernel",
+  "imports": ["env.memory", "env.dolly_bootstrap_write_bytes", "env.dolly_clock_realtime", "env.dolly_clock_monotonic", "env.dolly_entropy", "env.dolly_memory_grow"],
+  "host": "runtime.mjs",
+  "contracts": ["../../abi/dolly-supervisor-0.wat", "../../abi/dolly-image-0.wat"],
+  "process": ["../../abi/dolly-process-0.wat", "../../abi/dolly-process-gate-0.wat"],
+  "headers": ["../../include/dolly/runtime.h", "../../include/dolly/process.h", "../../include/dolly/host.h", "../../include/dolly/host-abi.h", "../../include/dolly/toolchain.h"],
+  "kernel": ["../../src/dolly.c", "../../src/process-kernel.c", "../../src/system-snapshot.c", "../../src/device-lease.c", "../../src/file-blocks.cpp", "../../src/libc-host.c"],
+  "client": ["../../src/process/runtime-adapter.c", "../../src/process/socket-refusals.c", "../../src/process/libc-stubs.c"]
+}