@daugasauron/dolly 0.1.4 → 0.1.5-rc.0

package/dist/dolly-process-worker.mjs

@@ -103,7 +103,7 @@ var DOLLY_PROCESS_SIZEOF = Object.freeze({
   dolly_process_directory_request: 24,
   dolly_process_stat_response: 88,
   dolly_process_filesystem_stat_response: 96,
-  dolly_process_spawn_request: 56,
+  dolly_process_spawn_request: 72,
   dolly_process_fd_mapping: 8,
   dolly_process_exec_state: 16,
   dolly_process_exec_request: 48,
@@ -118,18 +118,24 @@ var DOLLY_PROCESS_SIZEOF = Object.freeze({
   dolly_process_wait_response: 16,
   dolly_process_signal_request: 8,
   dolly_process_alarm: 16,
+  dolly_process_signal_dispositions: 8,
   dolly_process_fd_seek_request: 16,
   dolly_process_clock_request: 16,
   dolly_process_path_request: 16
 });
 
 // host/threads/abi.mjs
+var DOLLY_THREAD_SPAWN = 144;
 var DOLLY_THREAD_EXIT = 146;
 var DOLLY_ERRNO2 = Object.freeze({ E2BIG: 1, EACCES: 2, EADDRINUSE: 3, EADDRNOTAVAIL: 4, EAFNOSUPPORT: 5, EAGAIN: 6, EALREADY: 7, EBADF: 8, EBADMSG: 9, EBUSY: 10, ECANCELED: 11, ECHILD: 12, ECONNABORTED: 13, ECONNREFUSED: 14, ECONNRESET: 15, EDEADLK: 16, EDESTADDRREQ: 17, EDOM: 18, EDQUOT: 19, EEXIST: 20, EFAULT: 21, EFBIG: 22, EHOSTUNREACH: 23, EIDRM: 24, EILSEQ: 25, EINPROGRESS: 26, EINTR: 27, EINVAL: 28, EIO: 29, EISCONN: 30, EISDIR: 31, ELOOP: 32, EMFILE: 33, EMLINK: 34, EMSGSIZE: 35, EMULTIHOP: 36, ENAMETOOLONG: 37, ENETDOWN: 38, ENETRESET: 39, ENETUNREACH: 40, ENFILE: 41, ENOBUFS: 42, ENODEV: 43, ENOENT: 44, ENOEXEC: 45, ENOLCK: 46, ENOLINK: 47, ENOMEM: 48, ENOMSG: 49, ENOPROTOOPT: 50, ENOSPC: 51, ENOSYS: 52, ENOTCONN: 53, ENOTDIR: 54, ENOTEMPTY: 55, ENOTRECOVERABLE: 56, ENOTSOCK: 57, ENOTTY: 59, ENXIO: 60, EOVERFLOW: 61, EOWNERDEAD: 62, EPERM: 63, EPIPE: 64, EPROTO: 65, EPROTONOSUPPORT: 66, EPROTOTYPE: 67, ERANGE: 68, EROFS: 69, ESPIPE: 70, ESRCH: 71, ESTALE: 72, ETIMEDOUT: 73, ETXTBSY: 74, EXDEV: 75, ENODATA: 116, ENOTSUP: 138 });
 
 // src/process-worker.mjs
 var PROCESS_EXIT = Symbol("Dolly process exit");
 var THREAD_EXIT = Symbol("Dolly thread exit");
+var UNSTARTED = Symbol("Dolly thread ended before it started");
+var deferredResult = -(1n << 63n);
+var reservationRetryMilliseconds = 50;
+var reservationPatienceMilliseconds = 5e3;
 var configuration = await new Promise((resolve, reject) => {
   const timeout = setTimeout(
     () => reject(new Error("Dolly process configuration was not provided")),
@@ -142,19 +148,92 @@ var configuration = await new Promise((resolve, reject) => {
     resolve(event.data);
   });
 });
-if (!(configuration.module instanceof WebAssembly.Module) || !(configuration.memory instanceof WebAssembly.Memory) || !(configuration.control instanceof SharedArrayBuffer) || !Array.isArray(configuration.local) || configuration.control.byteLength !== 16 || !Number.isFinite(configuration.clockOrigin) || !Number.isInteger(configuration.pid) || configuration.pid <= 0) {
+if (!(configuration.module instanceof WebAssembly.Module || configuration.module instanceof MessagePort) || !(configuration.gateModule instanceof WebAssembly.Module) || !(configuration.kernelMemory instanceof WebAssembly.Memory) || !(configuration.control instanceof SharedArrayBuffer) || !Array.isArray(configuration.local) || configuration.control.byteLength !== 32 || !Number.isFinite(configuration.clockOrigin) || !Number.isSafeInteger(configuration.mailbox) || configuration.mailbox <= 0 || typeof configuration.memory?.initial !== "bigint" || typeof configuration.memory?.maximum !== "bigint" || configuration.port !== void 0 && !(configuration.port instanceof MessagePort) || !Number.isInteger(configuration.pid) || configuration.pid <= 0) {
   throw new Error("Dolly process received an invalid configuration");
 }
 var control = new Int32Array(configuration.control);
+var mailbox = BigInt(configuration.mailbox);
+var maximumBytes = configuration.memory.maximum * 65536n;
 var clockOffset = performance.timeOrigin - configuration.clockOrigin;
 var lastSignalCheck = -Infinity;
 var threadResult;
+var ending = null;
+var ended = (how) => {
+  ending = how;
+  return deferredResult;
+};
 var instance;
+var memory;
+var gate;
 var localModules = [];
+var awaitHost = (wait) => wait();
+var openChannels = [];
+var receiverPatienceMilliseconds = 1e4;
+function closeReceivedChannels() {
+  for (let index = openChannels.length; index--; ) {
+    const { port, received } = openChannels[index];
+    if (Atomics.load(received, 0)) {
+      port.close();
+      openChannels.splice(index, 1);
+    }
+  }
+}
+function reportThreadFinished() {
+  for (const { received } of openChannels) {
+    while (Atomics.load(received, 0) === 0 && Atomics.wait(received, 0, 0, receiverPatienceMilliseconds) !== "timed-out") ;
+  }
+  self.postMessage({ type: "thread-finished", pid: configuration.pid, tid: configuration.tid, result: threadResult });
+}
+async function processMemory() {
+  if (configuration.port) {
+    const ended2 = Atomics.waitAsync(control, 5, 0);
+    const { memory: memory2, received } = await new Promise((resolve, reject) => {
+      const timeout = setTimeout(() => reject(new Error("the process memory was not provided")), 1e4);
+      configuration.port.onmessage = ({ data }) => {
+        clearTimeout(timeout);
+        resolve(data ?? {});
+      };
+      Promise.resolve(ended2.value).then(() => {
+        clearTimeout(timeout);
+        reject(UNSTARTED);
+      });
+    });
+    configuration.port.close();
+    if (!(memory2 instanceof WebAssembly.Memory) || !(received instanceof Int32Array)) {
+      throw new TypeError("Dolly thread received an invalid memory");
+    }
+    Atomics.store(received, 0, 1);
+    Atomics.notify(received, 0);
+    return memory2;
+  }
+  const { initial, maximum } = configuration.memory;
+  for (let waited = 0; ; waited += reservationRetryMilliseconds) {
+    try {
+      return new WebAssembly.Memory({ initial, maximum, shared: true, address: "i64" });
+    } catch (error) {
+      if (!(error instanceof RangeError) || waited >= reservationPatienceMilliseconds) throw error;
+    }
+    await new Promise((resolve) => setTimeout(resolve, reservationRetryMilliseconds));
+  }
+}
+async function programModule() {
+  const { module } = configuration;
+  if (module instanceof WebAssembly.Module) return module;
+  const received = await new Promise((resolve, reject) => {
+    const timeout = setTimeout(() => reject(new Error("the program's module was not provided")), 1e4);
+    module.onmessage = ({ data }) => {
+      clearTimeout(timeout);
+      resolve(data);
+    };
+  });
+  module.close();
+  if (!(received instanceof WebAssembly.Module)) throw new TypeError("Dolly process received an invalid module");
+  return received;
+}
 function packetRange(addressValue, sizeValue) {
   const address = Number(addressValue);
   const size = Number(sizeValue);
-  const length = configuration.memory.buffer.byteLength;
+  const length = memory.buffer.byteLength;
   return !Number.isSafeInteger(address) || !Number.isSafeInteger(size) || address < 0 || size < 0 || address > length - size || size !== 0 && address === 0 ? null : { address, size };
 }
 function decodeResult() {
@@ -166,9 +245,29 @@ function clockResponse(clock, response, now) {
   const nanoseconds = Math.round(
     (clock === DOLLY_PROCESS_CLOCK_REALTIME ? Date.now() : now + clockOffset) * 1e6
   );
-  new DataView(configuration.memory.buffer, response.address, 8).setBigUint64(0, BigInt(nanoseconds), true);
+  new DataView(memory.buffer, response.address, 8).setBigUint64(0, BigInt(nanoseconds), true);
   return 8n;
 }
+function copyRequest(request) {
+  if (Atomics.compareExchange(control, 4, 0, 1) !== 0) return false;
+  try {
+    gate.exports.request(BigInt(request.address), mailbox, BigInt(request.size));
+  } finally {
+    Atomics.store(control, 4, 0);
+    Atomics.notify(control, 4);
+  }
+  return true;
+}
+function reserveMaximum() {
+  const size = BigInt(memory.buffer.byteLength);
+  if (size >= maximumBytes) return true;
+  try {
+    memory.grow(configuration.memory.maximum - size / 65536n);
+  } catch {
+    return false;
+  }
+  return true;
+}
 function call(operation, requestAddressValue, requestSizeValue, responseAddressValue, responseCapacityValue) {
   operation >>>= 0;
   const request = packetRange(requestAddressValue, requestSizeValue);
@@ -177,55 +276,83 @@ function call(operation, requestAddressValue, requestSizeValue, responseAddressV
   for (const module of localModules) {
     if (module.handles(operation)) return module.call(operation, request, response);
   }
-  const exitingResult = operation === DOLLY_THREAD_EXIT && request.size === 8 ? new DataView(configuration.memory.buffer, request.address, 8).getBigUint64(0, true) : void 0;
+  const exitingResult = operation === DOLLY_THREAD_EXIT && request.size === 8 ? new DataView(memory.buffer, request.address, 8).getBigUint64(0, true) : void 0;
   let clock;
   if (operation === DOLLY_PROCESS_CLOCK_TIME && request.size === 16 && response.size >= 8 && response.size <= DOLLY_PROCESS_PACKET_LIMIT) {
-    const packet = new DataView(configuration.memory.buffer, request.address, 16);
+    const packet = new DataView(memory.buffer, request.address, 16);
     const id = packet.getUint32(0, true);
     if ((id === DOLLY_PROCESS_CLOCK_REALTIME || id === DOLLY_PROCESS_CLOCK_MONOTONIC) && packet.getUint32(4, true) === 0) clock = id;
     const now = performance.now();
     if (clock !== void 0 && now - lastSignalCheck < 1) return clockResponse(clock, response, now);
   }
   if (operation === DOLLY_PROCESS_INTERRUPT_POLL && request.size === 0 && response.size >= 4 && performance.now() - lastSignalCheck < 1) {
-    new DataView(configuration.memory.buffer, response.address, 4).setInt32(0, 0, true);
+    new DataView(memory.buffer, response.address, 4).setInt32(0, 0, true);
     return 4n;
   }
   if (request.size > DOLLY_PROCESS_PACKET_LIMIT || response.size > DOLLY_PROCESS_PACKET_LIMIT) {
     return -BigInt(DOLLY_ERRNO.E2BIG);
   }
-  const sequence = Atomics.load(control, 0) % 2147483647 + 1;
-  Atomics.store(control, 0, sequence);
-  self.postMessage({
-    type: "syscall",
-    pid: configuration.pid,
-    tid: configuration.tid,
-    sequence,
-    operation,
-    requestAddress: request.address,
-    requestSize: request.size,
-    responseAddress: response.address,
-    responseCapacity: response.size
+  const memoryBytes = memory.buffer.byteLength;
+  let channel;
+  if (openChannels.length) closeReceivedChannels();
+  if (operation === DOLLY_THREAD_SPAWN && configuration.threaded) {
+    if (!reserveMaximum()) return -BigInt(DOLLY_ERRNO.EAGAIN);
+    channel = new MessageChannel();
+  }
+  const result = awaitHost(() => {
+    const sequence = Atomics.load(control, 0) % 2147483647 + 1;
+    Atomics.store(control, 0, sequence);
+    if (!copyRequest(request)) return deferredResult;
+    self.postMessage({
+      type: "syscall",
+      pid: configuration.pid,
+      tid: configuration.tid,
+      sequence,
+      operation,
+      requestAddress: request.address,
+      requestSize: request.size,
+      responseAddress: response.address,
+      responseCapacity: response.size,
+      memoryBytes,
+      port: channel?.port1
+    }, channel ? [channel.port1] : []);
+    for (; ; ) {
+      const observed = Atomics.load(control, 1);
+      if (observed === sequence) break;
+      Atomics.wait(control, 1, observed);
+    }
+    return decodeResult();
   });
-  for (; ; ) {
-    const observed = Atomics.load(control, 1);
-    if (observed === sequence) break;
-    Atomics.wait(control, 1, observed);
+  if (channel) {
+    if (result < 0n) channel.port2.close();
+    else {
+      const received = new Int32Array(new SharedArrayBuffer(4));
+      channel.port2.postMessage({ memory, received });
+      openChannels.push({ port: channel.port2, received });
+    }
   }
-  const result = decodeResult();
-  if (result === -(1n << 63n)) throw PROCESS_EXIT;
+  if (result === deferredResult) return ended(PROCESS_EXIT);
+  if (result > 0n) gate.exports.response(mailbox, BigInt(response.address), result);
   lastSignalCheck = result === -BigInt(DOLLY_ERRNO.EINTR) ? -Infinity : performance.now();
   if (operation === DOLLY_THREAD_EXIT && result >= 0n) {
     threadResult = exitingResult;
-    throw THREAD_EXIT;
+    for (const module of localModules) module.leaving?.();
+    return ended(THREAD_EXIT);
   }
   if (clock !== void 0 && result === 8n) return clockResponse(clock, response, lastSignalCheck);
-  if (operation === DOLLY_PROCESS_EXIT && result >= 0n) throw PROCESS_EXIT;
+  if (operation === DOLLY_PROCESS_EXIT && result >= 0n) return ended(PROCESS_EXIT);
   return result;
 }
 try {
-  instance = await WebAssembly.instantiate(configuration.module, {
-    env: { memory: configuration.memory },
-    dolly_process_0: { call }
+  memory = await processMemory();
+  if (configuration.port && Atomics.compareExchange(control, 5, 0, 1) !== 0) throw UNSTARTED;
+  gate = new WebAssembly.Instance(configuration.gateModule, {
+    process: { memory, call },
+    kernel: { memory: configuration.kernelMemory }
+  });
+  instance = await WebAssembly.instantiate(await programModule(), {
+    env: { memory },
+    dolly_process_0: { call: gate.exports.call }
   });
   if (typeof instance.exports._start !== "function") {
     throw new TypeError("Dolly process does not export _start");
@@ -236,7 +363,7 @@ try {
       return (await import(url)).serve({
         ...options,
         instance,
-        memory: configuration.memory,
+        memory,
         processInterface: configuration.processInterface,
         threaded: configuration.threaded,
         stack: { promisingEntry: configuration.promisingEntry, depths: configuration.stackDepths }
@@ -245,19 +372,21 @@ try {
       URL.revokeObjectURL(url);
     }
   }));
+  awaitHost = localModules.find((module) => module.awaitHost)?.awaitHost ?? awaitHost;
   self.postMessage({ type: "started", pid: configuration.pid, tid: configuration.tid });
   const enter = configuration.promisingEntry ? WebAssembly.promising : (entry) => entry;
   if (configuration.argument !== void 0) {
     threadResult = await enter(instance.exports.dolly_thread_start)(configuration.tid, configuration.argument);
-    self.postMessage({ type: "thread-finished", pid: configuration.pid, tid: configuration.tid, result: threadResult });
+    reportThreadFinished();
   } else {
     await enter(instance.exports._start)();
     self.postMessage({ type: "finished", pid: configuration.pid, tid: configuration.tid });
   }
 } catch (caught) {
-  if (caught === THREAD_EXIT && configuration.threaded && typeof threadResult === "bigint") {
-    self.postMessage({ type: "thread-finished", pid: configuration.pid, tid: configuration.tid, result: threadResult });
-  } else if (caught === PROCESS_EXIT) {
+  if (caught === UNSTARTED) {
+  } else if (ending === THREAD_EXIT && configuration.threaded && typeof threadResult === "bigint") {
+    reportThreadFinished();
+  } else if (ending === PROCESS_EXIT) {
     self.postMessage({ type: "finished", pid: configuration.pid, tid: configuration.tid });
   } else {
     await null;

package/host/dso/abi.mjs

@@ -2,12 +2,14 @@
 export const DOLLY_DSO_OPEN = 112;
 export const DOLLY_DSO_SYMBOL = 113;
 export const DOLLY_DSO_CLOSE = 114;
+export const DOLLY_DSO_WAIT = 115;
 export const DOLLY_DSO_GLOBAL = 1;
 export const DOLLY_DSO_LIMIT = 536870912;
 export const DOLLY_DSO_ERROR_CAPACITY = 240;
+export const DOLLY_DSO_THREADS_SIZE = 272;
 export const DOLLY_FFI_CALL = 120;
 export const DOLLY_FFI_CLOSURE_ALLOC = 121;
 export const DOLLY_FFI_CLOSURE_FREE = 122;
 export const DOLLY_FFI_CLOSURE_PREP = 123;
 export const DOLLY_ERRNO = Object.freeze({ E2BIG: 1, EACCES: 2, EADDRINUSE: 3, EADDRNOTAVAIL: 4, EAFNOSUPPORT: 5, EAGAIN: 6, EALREADY: 7, EBADF: 8, EBADMSG: 9, EBUSY: 10, ECANCELED: 11, ECHILD: 12, ECONNABORTED: 13, ECONNREFUSED: 14, ECONNRESET: 15, EDEADLK: 16, EDESTADDRREQ: 17, EDOM: 18, EDQUOT: 19, EEXIST: 20, EFAULT: 21, EFBIG: 22, EHOSTUNREACH: 23, EIDRM: 24, EILSEQ: 25, EINPROGRESS: 26, EINTR: 27, EINVAL: 28, EIO: 29, EISCONN: 30, EISDIR: 31, ELOOP: 32, EMFILE: 33, EMLINK: 34, EMSGSIZE: 35, EMULTIHOP: 36, ENAMETOOLONG: 37, ENETDOWN: 38, ENETRESET: 39, ENETUNREACH: 40, ENFILE: 41, ENOBUFS: 42, ENODEV: 43, ENOENT: 44, ENOEXEC: 45, ENOLCK: 46, ENOLINK: 47, ENOMEM: 48, ENOMSG: 49, ENOPROTOOPT: 50, ENOSPC: 51, ENOSYS: 52, ENOTCONN: 53, ENOTDIR: 54, ENOTEMPTY: 55, ENOTRECOVERABLE: 56, ENOTSOCK: 57, ENOTTY: 59, ENXIO: 60, EOVERFLOW: 61, EOWNERDEAD: 62, EPERM: 63, EPIPE: 64, EPROTO: 65, EPROTONOSUPPORT: 66, EPROTOTYPE: 67, ERANGE: 68, EROFS: 69, ESPIPE: 70, ESRCH: 71, ESTALE: 72, ETIMEDOUT: 73, ETXTBSY: 74, EXDEV: 75, ENODATA: 116, ENOTSUP: 138 });
-export const DOLLY_DSO_ABI_DIGEST = "f620970cf60972fe67e4d14dd3441edb9652092ed2ebc27a511c24d2931fb800";
+export const DOLLY_DSO_ABI_DIGEST = "6758333327df36a58f1dea5e0741eca482bb92cbede2b525a67a5e5f85bb35fd";

package/host/dso/dso.mjs

@@ -17,9 +17,8 @@ export function worker({ get, abi, runtimeBase }) {
       }));
       // abi is the live set of modules the image admits; a loaded library's
       // own records are checked against it.
-      // threads: it serves each thread's Worker of a program using threads@0.
       get("runtime").serveInProcess("dso@0", { bundle: new Blob([bundle], { type: "text/javascript" }),
-        configuration: { contract: parseWasmInterface(contract, "dolly-dso-0"), hostAbi: abi }, threads: true });
+        configuration: { contract: parseWasmInterface(contract, "dolly-dso-0"), hostAbi: abi } });
     },
     disabled() { get("runtime").serveInProcess("dso@0"); },
   };

package/host/http/abi.mjs

@@ -4,7 +4,7 @@ export const DOLLY_HTTP_CHUNK_CAPACITY = 65536;
 export const DOLLY_HTTP_MAX_METHOD = 32;
 export const DOLLY_HTTP_MAX_URL = 8192;
 export const DOLLY_HTTP_MAX_HEADERS = 65536;
-export const DOLLY_HTTP_MAX_BODY = 8388608;
+export const DOLLY_HTTP_MAX_BODY = 67108864;
 export const DOLLY_HTTP_HEADER_SIZE = 64;
 export const DOLLY_HTTP_WORD_STATE = 0;
 export const DOLLY_HTTP_WORD_SEQUENCE = 1;
@@ -25,4 +25,4 @@ export const DOLLY_HTTP_POLL = 81;
 export const DOLLY_HTTP_CANCEL = 82;
 export const DOLLY_HTTP_BODY_WRITE = 83;
 export const DOLLY_ERRNO = Object.freeze({ E2BIG: 1, EACCES: 2, EADDRINUSE: 3, EADDRNOTAVAIL: 4, EAFNOSUPPORT: 5, EAGAIN: 6, EALREADY: 7, EBADF: 8, EBADMSG: 9, EBUSY: 10, ECANCELED: 11, ECHILD: 12, ECONNABORTED: 13, ECONNREFUSED: 14, ECONNRESET: 15, EDEADLK: 16, EDESTADDRREQ: 17, EDOM: 18, EDQUOT: 19, EEXIST: 20, EFAULT: 21, EFBIG: 22, EHOSTUNREACH: 23, EIDRM: 24, EILSEQ: 25, EINPROGRESS: 26, EINTR: 27, EINVAL: 28, EIO: 29, EISCONN: 30, EISDIR: 31, ELOOP: 32, EMFILE: 33, EMLINK: 34, EMSGSIZE: 35, EMULTIHOP: 36, ENAMETOOLONG: 37, ENETDOWN: 38, ENETRESET: 39, ENETUNREACH: 40, ENFILE: 41, ENOBUFS: 42, ENODEV: 43, ENOENT: 44, ENOEXEC: 45, ENOLCK: 46, ENOLINK: 47, ENOMEM: 48, ENOMSG: 49, ENOPROTOOPT: 50, ENOSPC: 51, ENOSYS: 52, ENOTCONN: 53, ENOTDIR: 54, ENOTEMPTY: 55, ENOTRECOVERABLE: 56, ENOTSOCK: 57, ENOTTY: 59, ENXIO: 60, EOVERFLOW: 61, EOWNERDEAD: 62, EPERM: 63, EPIPE: 64, EPROTO: 65, EPROTONOSUPPORT: 66, EPROTOTYPE: 67, ERANGE: 68, EROFS: 69, ESPIPE: 70, ESRCH: 71, ESTALE: 72, ETIMEDOUT: 73, ETXTBSY: 74, EXDEV: 75, ENODATA: 116, ENOTSUP: 138 });
-export const DOLLY_HTTP_ABI_DIGEST = "429f0fdb280240a4429fdeb550e6710453d81ac51b7eb662dd43b024fcfaaaed";
+export const DOLLY_HTTP_ABI_DIGEST = "9e3dd4f36f656a23f477c67ce6fe723130caa9b4bf69f6af8670859ea653470f";

package/host/http/broker.mjs

@@ -218,7 +218,19 @@ class HttpTransfer {
   check() {
     if (this.terminalError) throw new HttpError(this.terminalError, "HTTP transfer ended");
     if (this.controller.signal.aborted || performance.now() >= this.deadline)
-      throw new HttpError(errno.ETIMEDOUT, "HTTP deadline exceeded");
+      throw new HttpError(errno.ETIMEDOUT, "HTTP request timed out");
+  }
+
+  // A transfer lasts as long as it moves. It times out when it has waited the
+  // rule's timeout for its next record: the response's headers, its next bytes
+  // or the guest's reading of the record before.
+  moved() {
+    clearTimeout(this.timer);
+    this.deadline = performance.now() + this.timeout;
+    this.timer = setTimeout(() => {
+      this.fail(errno.ETIMEDOUT);
+      this.controller.abort();
+    }, this.timeout);
   }
 
   // The mailbox ends the slot's transfer once, and only while the guest's
@@ -242,10 +254,11 @@ class HttpTransfer {
     const error = await this.broker.mailbox.publish({ index: this.index, transfer: this.id, sequence: this.sequence,
       bytes: bytes.slice(), status, eof, kind, deadline: now() + this.deadline - performance.now() });
     if (error) throw new HttpError(error, "HTTP transfer ended");
+    this.moved();
   }
 
   async run({ method, url, headers: headerBlock, body, flags }) {
-    let timeout, failure = errno.EINVAL;
+    let failure = errno.EINVAL;
     try {
       this.check();
       const target = this.broker.target(url);
@@ -266,11 +279,8 @@ class HttpTransfer {
       stripDollyBrowserOwnedHeaders(headers);
       const upperMethod = method.toUpperCase();
       const rule = this.broker.policy.authorize(target, upperMethod, headers, body?.byteLength ?? 0);
-      this.deadline = performance.now() + rule.timeoutMilliseconds;
-      timeout = setTimeout(() => {
-        this.fail(errno.ETIMEDOUT);
-        this.controller.abort();
-      }, rule.timeoutMilliseconds);
+      this.timeout = rule.timeoutMilliseconds;
+      this.moved();
       failure = errno.EIO;
       const init = {
         method: upperMethod, headers,
@@ -318,7 +328,7 @@ class HttpTransfer {
       this.fail(error instanceof HttpError ? error.errno :
         this.controller.signal.aborted ? errno.ETIMEDOUT : failure);
     } finally {
-      clearTimeout(timeout);
+      clearTimeout(this.timer);
       this.controller.abort();
     }
   }

package/host/http/http.mjs

@@ -12,7 +12,6 @@ export function browser({ applicationBase, configuration, send, ask }) {
   const services = {};
   const instance = {
     services,
-    get transport() { return transport; },
     page: {
       get httpActive() { return transport?.active ?? false; },
       get httpRequestCount() { return transport?.requestCount ?? 0; },

package/host/http/policy.mjs

@@ -1,4 +1,4 @@
-import { DOLLY_ERRNO } from "./abi.mjs";
+import { DOLLY_ERRNO, DOLLY_HTTP_MAX_BODY } from "./abi.mjs";
 
 export class HttpError extends Error {
   constructor(errno, message) { super(message); this.errno = errno; }
@@ -38,14 +38,17 @@ export function stripDollyBrowserOwnedHeaders(headers) {
 
 const defaultLimits = Object.freeze({
   maxRequests: 256,
-  maxRequestBytes: 8 * 1024 * 1024,
+  maxRequestBytes: DOLLY_HTTP_MAX_BODY,
   maxResponseBytes: Infinity,
   timeoutMilliseconds: 600_000,
 });
 
-function positiveInteger(value, fallback, name) {
+// Timers wait at most this long; a longer timeout would fire early.
+const longestTimeout = 2 ** 31 - 1;
+
+function positiveInteger(value, fallback, name, maximum = Number.MAX_SAFE_INTEGER) {
   const result = value ?? fallback;
-  if (!Number.isSafeInteger(result) || result <= 0) {
+  if (!Number.isSafeInteger(result) || result <= 0 || result > maximum) {
     throw new TypeError(`invalid Dolly HTTP policy ${name}`);
   }
   return result;
@@ -105,6 +108,7 @@ function normalizeRule(rule) {
       rule.timeoutMilliseconds,
       defaultLimits.timeoutMilliseconds,
       "timeoutMilliseconds",
+      longestTimeout,
     ),
   });
 }

package/host/input/abi.mjs

@@ -0,0 +1,47 @@
+// Generated from host/input/dolly-input-0.wat, host/input/input.h, include/dolly/process.h.
+export const DOLLY_INPUT_HEADER_SIZE = 28;
+export const DOLLY_INPUT_EVENT_SIZE = 128;
+export const DOLLY_INPUT_EVENT_DATA_SIZE = 88;
+export const DOLLY_INPUT_EVENT_CAPACITY = 256;
+export const DOLLY_INPUT_WORD_EVENT_READ = 0;
+export const DOLLY_INPUT_WORD_EVENT_WRITE = 1;
+export const DOLLY_INPUT_WORD_FLAGS = 2;
+export const DOLLY_INPUT_WORD_PASTE_SEQUENCE = 3;
+export const DOLLY_INPUT_WORD_PASTE_CONSUMED_SEQUENCE = 4;
+export const DOLLY_INPUT_WORD_PASTE_LENGTH = 5;
+export const DOLLY_INPUT_WORD_ENABLED = 6;
+export const DOLLY_INPUT_LEASED = 1;
+export const DOLLY_INPUT_POINTER_RELATIVE = 2;
+export const DOLLY_INPUT_EVENT_KEY = 1;
+export const DOLLY_INPUT_EVENT_TEXT = 2;
+export const DOLLY_INPUT_EVENT_FOCUS = 4;
+export const DOLLY_INPUT_EVENT_PASTE = 5;
+export const DOLLY_INPUT_EVENT_POINTER = 6;
+export const DOLLY_INPUT_EVENT_SCROLL = 7;
+export const DOLLY_INPUT_EVENT_POINTER_MOTION = 8;
+export const DOLLY_INPUT_EVENT_POINTER_CAPTURE = 9;
+export const DOLLY_INPUT_EVENT_POINTER_PRESENCE = 10;
+export const DOLLY_INPUT_EVENT_DROPPED = 11;
+export const DOLLY_KEY_ACTION_RELEASE = 0;
+export const DOLLY_KEY_ACTION_PRESS = 1;
+export const DOLLY_KEY_ACTION_REPEAT = 2;
+export const DOLLY_POINTER_ACTION_RELEASE = 0;
+export const DOLLY_POINTER_ACTION_PRESS = 1;
+export const DOLLY_POINTER_ACTION_DRAG = 2;
+export const DOLLY_SCROLL_UNIT_PIXEL = 0;
+export const DOLLY_SCROLL_UNIT_LINE = 1;
+export const DOLLY_SCROLL_UNIT_PAGE = 2;
+export const DOLLY_INPUT_MOD_SHIFT = 1;
+export const DOLLY_INPUT_MOD_CONTROL = 2;
+export const DOLLY_INPUT_MOD_ALT = 4;
+export const DOLLY_INPUT_MOD_META = 8;
+export const DOLLY_INPUT_MOD_CAPS_LOCK = 16;
+export const DOLLY_INPUT_MOD_NUM_LOCK = 32;
+export const DOLLY_INPUT_FLAG_COMPOSING = 1;
+export const DOLLY_INPUT_PASTE_CAPACITY = 262144;
+export const DOLLY_INPUT_ACQUIRE = 88;
+export const DOLLY_INPUT_NEXT_EVENT = 89;
+export const DOLLY_INPUT_SET_POINTER = 90;
+export const DOLLY_INPUT_RELEASE = 91;
+export const DOLLY_ERRNO = Object.freeze({ E2BIG: 1, EACCES: 2, EADDRINUSE: 3, EADDRNOTAVAIL: 4, EAFNOSUPPORT: 5, EAGAIN: 6, EALREADY: 7, EBADF: 8, EBADMSG: 9, EBUSY: 10, ECANCELED: 11, ECHILD: 12, ECONNABORTED: 13, ECONNREFUSED: 14, ECONNRESET: 15, EDEADLK: 16, EDESTADDRREQ: 17, EDOM: 18, EDQUOT: 19, EEXIST: 20, EFAULT: 21, EFBIG: 22, EHOSTUNREACH: 23, EIDRM: 24, EILSEQ: 25, EINPROGRESS: 26, EINTR: 27, EINVAL: 28, EIO: 29, EISCONN: 30, EISDIR: 31, ELOOP: 32, EMFILE: 33, EMLINK: 34, EMSGSIZE: 35, EMULTIHOP: 36, ENAMETOOLONG: 37, ENETDOWN: 38, ENETRESET: 39, ENETUNREACH: 40, ENFILE: 41, ENOBUFS: 42, ENODEV: 43, ENOENT: 44, ENOEXEC: 45, ENOLCK: 46, ENOLINK: 47, ENOMEM: 48, ENOMSG: 49, ENOPROTOOPT: 50, ENOSPC: 51, ENOSYS: 52, ENOTCONN: 53, ENOTDIR: 54, ENOTEMPTY: 55, ENOTRECOVERABLE: 56, ENOTSOCK: 57, ENOTTY: 59, ENXIO: 60, EOVERFLOW: 61, EOWNERDEAD: 62, EPERM: 63, EPIPE: 64, EPROTO: 65, EPROTONOSUPPORT: 66, EPROTOTYPE: 67, ERANGE: 68, EROFS: 69, ESPIPE: 70, ESRCH: 71, ESTALE: 72, ETIMEDOUT: 73, ETXTBSY: 74, EXDEV: 75, ENODATA: 116, ENOTSUP: 138 });
+export const DOLLY_INPUT_ABI_DIGEST = "862edb42d7dbb04c1c49411d740a97503fe387678a1b660f19b3b2dc4f18b9c6";

package/host/modules.mjs

@@ -2,9 +2,10 @@ import { hostRequirement, hostRequirements } from "./requirements.mjs";
 import { DOLLY_ERRNO as E } from "../src/process-constants.mjs";
 
 // What a build enables beside the runtime its image declares: the broker the
-// engine fetches sources through, the threads its toolchain uses and the
-// modules its compilers and interpreters load.
-export const buildHost = Object.freeze(["http@0", "threads@0", "dso@0"]);
+// engine fetches sources through, the threads its toolchain uses, the
+// modules its compilers and interpreters load and the fresh stacks of the
+// tools stack-wrap rewrote.
+export const buildHost = Object.freeze(["http@0", "threads@0", "dso@0", "stack@0"]);
 
 // A page's host modules, from the URLs of their manifests. The embedding, trusted
 // code, names them; images select no JS or Worker URLs, and each module's provider

package/host/nena/abi.mjs

@@ -16,4 +16,4 @@ export const DOLLY_NENA_ENABLED = 1;
 export const DOLLY_NENA_DECLARED = 2;
 export const DOLLY_NENA_FIXED = 4;
 export const DOLLY_ERRNO = Object.freeze({ E2BIG: 1, EACCES: 2, EADDRINUSE: 3, EADDRNOTAVAIL: 4, EAFNOSUPPORT: 5, EAGAIN: 6, EALREADY: 7, EBADF: 8, EBADMSG: 9, EBUSY: 10, ECANCELED: 11, ECHILD: 12, ECONNABORTED: 13, ECONNREFUSED: 14, ECONNRESET: 15, EDEADLK: 16, EDESTADDRREQ: 17, EDOM: 18, EDQUOT: 19, EEXIST: 20, EFAULT: 21, EFBIG: 22, EHOSTUNREACH: 23, EIDRM: 24, EILSEQ: 25, EINPROGRESS: 26, EINTR: 27, EINVAL: 28, EIO: 29, EISCONN: 30, EISDIR: 31, ELOOP: 32, EMFILE: 33, EMLINK: 34, EMSGSIZE: 35, EMULTIHOP: 36, ENAMETOOLONG: 37, ENETDOWN: 38, ENETRESET: 39, ENETUNREACH: 40, ENFILE: 41, ENOBUFS: 42, ENODEV: 43, ENOENT: 44, ENOEXEC: 45, ENOLCK: 46, ENOLINK: 47, ENOMEM: 48, ENOMSG: 49, ENOPROTOOPT: 50, ENOSPC: 51, ENOSYS: 52, ENOTCONN: 53, ENOTDIR: 54, ENOTEMPTY: 55, ENOTRECOVERABLE: 56, ENOTSOCK: 57, ENOTTY: 59, ENXIO: 60, EOVERFLOW: 61, EOWNERDEAD: 62, EPERM: 63, EPIPE: 64, EPROTO: 65, EPROTONOSUPPORT: 66, EPROTOTYPE: 67, ERANGE: 68, EROFS: 69, ESPIPE: 70, ESRCH: 71, ESTALE: 72, ETIMEDOUT: 73, ETXTBSY: 74, EXDEV: 75, ENODATA: 116, ENOTSUP: 138 });
-export const DOLLY_NENA_ABI_DIGEST = "3b6540395986cc839e4ef67cdfd0a0510780e26cdf7071522b60730c7b05c58e";
+export const DOLLY_NENA_ABI_DIGEST = "cc920703d81c6e25656402683fc32180bd232f9206d5fbffabdca4c9cb24649a";

package/host/nena/nena.mjs

@@ -5,7 +5,7 @@ import { DOLLY_ERRNO as E } from "./abi.mjs";
 export { DOLLY_NENA_ABI_DIGEST as digest } from "./abi.mjs";
 
 // The device as the lease bridge sees it.
-export const lease = { type: "nena", slots: N.DOLLY_NENA_SLOTS, packetBytes: N.DOLLY_NENA_PACKET_BYTES,
+export const lease = { type: "nena", version: N.DOLLY_NENA_VERSION, slots: N.DOLLY_NENA_SLOTS, packetBytes: N.DOLLY_NENA_PACKET_BYTES,
   replyBytes: N.DOLLY_NENA_REPLY_BYTES, open: N.DOLLY_NENA_OPEN, close: N.DOLLY_NENA_CLOSE };
 // The session's own record of the modules it enabled, one name@version a line.
 // The Worker writes it after every switch and the page enables what it lists
@@ -36,32 +36,30 @@ export function browser({ send, modules, showStatus }) {
   }
   // What the session enabled beyond what the page started with: its record.
   const enabledSince = () => modules.list().filter(module => module.enabled && !module.declared).map(requirement);
-  async function dispatch(packet) {
-    if (!(packet instanceof Uint8Array) || packet.byteLength < 32 || packet.byteLength > N.DOLLY_NENA_PACKET_BYTES) fail(E.EINVAL);
-    const view = new DataView(packet.buffer, packet.byteOffset, packet.byteLength);
-    const operation = view.getUint32(4, true), scope = view.getUint32(8, true);
-    if (view.getUint32(0, true) !== N.DOLLY_NENA_VERSION || view.getUint32(12, true) || view.getUint32(20, true) ||
-        !scope || view.getUint32(24, true) !== packet.length - 32 || view.getUint32(28, true)) fail(E.EINVAL);
-    const sized = bytes => { if (packet.length !== bytes) fail(E.EINVAL); };
+  // A request the lease bridge checked: the packet's operation and scope
+  // (dolly_device_header) and its body.
+  async function dispatch({ operation, scope, body }) {
+    const view = new DataView(body.buffer, body.byteOffset, body.byteLength);
+    const sized = bytes => { if (body.length !== bytes) fail(E.EINVAL); };
     if (operation === N.DOLLY_NENA_OPEN) {
-      sized(32);
+      sized(0);
       const reply = new Uint8Array(8);
       new DataView(reply.buffer).setBigUint64(0, BigInt(scope), true);
       return { bytes: reply };
     }
-    if (operation === N.DOLLY_NENA_CLOSE) { sized(32); return { bytes: new Uint8Array() }; }
+    if (operation === N.DOLLY_NENA_CLOSE) { sized(0); return { bytes: new Uint8Array() }; }
     if (operation === N.DOLLY_NENA_MODULE) {
-      sized(40);
-      if (view.getUint32(36, true)) fail(E.EINVAL);
-      return { bytes: moduleRecord(modules.list()[view.getUint32(32, true)] ?? fail(E.ENOENT)) };
+      sized(8);
+      if (view.getUint32(4, true)) fail(E.EINVAL);
+      return { bytes: moduleRecord(modules.list()[view.getUint32(0, true)] ?? fail(E.ENOENT)) };
     }
     if (operation !== N.DOLLY_NENA_ENABLE && operation !== N.DOLLY_NENA_DISABLE) fail(E.EINVAL);
-    sized(72);
-    const field = packet.subarray(32, 32 + N.DOLLY_NENA_NAME_BYTES), end = field.indexOf(0);
-    if (end < 1 || field.subarray(end).some(byte => byte) || view.getUint32(68, true)) fail(E.EINVAL);
+    sized(40);
+    const field = body.subarray(0, N.DOLLY_NENA_NAME_BYTES), end = field.indexOf(0);
+    if (end < 1 || field.subarray(end).some(byte => byte) || view.getUint32(36, true)) fail(E.EINVAL);
     let name;
     try { name = decoder.decode(field.subarray(0, end)); } catch { fail(E.EINVAL); }
-    const version = view.getUint32(64, true), enabling = operation === N.DOLLY_NENA_ENABLE;
+    const version = view.getUint32(32, true), enabling = operation === N.DOLLY_NENA_ENABLE;
     const found = () => modules.list().find(module => module.name === name && module.version === version) ?? fail(E.ENOENT);
     const value = requirement(found());
     // The session gives the privilege up: answered first, since the answer
@@ -74,7 +72,7 @@ export function browser({ send, modules, showStatus }) {
     messages: {
       async "nena-request"(message) {
         let result;
-        try { result = await dispatch(message.packet); }
+        try { result = await dispatch(message); }
         catch (error) { result = { error: error.errno ?? E.EIO, bytes: new Uint8Array() }; }
         if (result.enabled) send({ type: "nena-record", enabled: result.enabled });
         send({ type: "nena-complete", scope: message.scope, sequence: message.sequence, error: result.error ?? 0,