@daugasauron/dolly 0.1.5-rc.0 → 0.1.6

package/host/snapshot/transport.mjs

@@ -1,4 +1,4 @@
-import { DOLLY_SESSION_MAX_BYTES } from "../../src/session-store.mjs";
+import { DOLLY_SESSION_MAX_BYTES } from "../../site/session-store.mjs";
 import { DOLLY_ERRNO } from "./abi.mjs";
 import * as A from "./abi.mjs";
 
@@ -17,15 +17,16 @@ export class SessionTransport {
   static totalSizeLow = A.DOLLY_SESSION_WORD_TOTAL_SIZE_LOW;
   static totalSizeHigh = A.DOLLY_SESSION_WORD_TOTAL_SIZE_HIGH;
   static cancelledSequence = A.DOLLY_SESSION_WORD_CANCELLED_SEQUENCE;
+  static changes = A.DOLLY_SESSION_WORD_CHANGES;
 
   constructor(buffer, address, transferAddress, wake) {
     const range = (start, size) => Number.isSafeInteger(start) && start > 0 && start <= buffer.byteLength - size;
-    if (!(buffer instanceof SharedArrayBuffer) || !range(address, A.DOLLY_SESSION_HEADER_SIZE) || address % 4 ||
+    if (!(buffer instanceof SharedArrayBuffer) || !range(address, A.DOLLY_SESSION_MAILBOX_HEADER_SIZE) || address % 4 ||
         !range(transferAddress, A.DOLLY_SESSION_TRANSFER_CAPACITY)) {
       throw new Error("Dolly supplied an invalid session mailbox");
     }
     this.bytes = new Uint8Array(buffer);
-    this.words = new Int32Array(buffer, address, A.DOLLY_SESSION_HEADER_SIZE / 4);
+    this.words = new Int32Array(buffer, address, A.DOLLY_SESSION_MAILBOX_HEADER_SIZE / 4);
     this.transferAddress = transferAddress;
     this.transferCapacity = A.DOLLY_SESSION_TRANSFER_CAPACITY;
     this.wake = wake;
@@ -110,6 +111,10 @@ export class SessionTransport {
       if (status === -DOLLY_ERRNO.EFBIG) {
         throw new Error(`Dolly session exceeds its ${DOLLY_SESSION_MAX_BYTES / 1024 / 1024} MiB limit; remove files or installed packages and save again`);
       }
+      // DOLLY_SESSION_MAX_RECORDS (kernel/session-records.h).
+      if (status === -DOLLY_ERRNO.E2BIG) {
+        throw new Error("Dolly session holds more than 1,000,000 files and directories; remove some and save again");
+      }
       if (status !== 0) throw new Error(`Dolly session capture failed with status ${status}`);
       if (offset < 16 || offset !== declaredTotal) throw new Error("Dolly session snapshot was incomplete");
       complete = true;
@@ -120,5 +125,7 @@ export class SessionTransport {
       this.cancel = null;
     }
   }
+  // Whether processes changed what a save holds since the last capture began.
+  get changed() { return Atomics.load(this.words, SessionTransport.changes) !== 0; }
   close() { this.closed = true; this.cancel?.(); }
 }

package/host/snapshot/ui.mjs

@@ -1,5 +1,5 @@
-import { DOLLY_BUILD_ID } from "../../dist/dolly-build-id.mjs";
-import { DOLLY_IMAGES } from "../../src/images.mjs";
+import { DOLLY_IMAGE_BUILD_ID } from "../../page/generated.mjs";
+import { DOLLY_IMAGES } from "../../page/images.mjs";
 import {
   DOLLY_SESSION_FORMAT_VERSION,
   customSessionIdentity,
@@ -9,28 +9,30 @@ import {
   sessionImageIdentity,
   sessionLoadUrl,
   validSessionName,
-} from "../../src/session-store.mjs";
+} from "../../site/session-store.mjs";
+import { keepRuntime } from "../../site/offline.mjs";
 
-const markup = `<style>
+// An adopted style sheet, which a page's style-src without 'unsafe-inline' allows.
+const style = `
   #session-open { position: absolute; right: 0.5rem; bottom: 0.35rem; z-index: 6;
-    padding: 0.15rem 0.45rem; color: inherit; background: #262626;
-    border: 1px solid #77736c; font: inherit; font-size: 13px; cursor: pointer; }
-  #session-open[data-failed] { border-color: #e98773; }
+    padding: 0.15rem 0.45rem; color: inherit; background: var(--dolly-ui-background);
+    border: 1px solid var(--dolly-ui-quiet); font: inherit; font-size: 13px; cursor: pointer; }
+  #session-open[data-failed] { border-color: var(--dolly-ui-alert); }
   #session-dialog { width: min(420px, calc(100vw - 2rem)); padding: 1.2rem;
-    background: #262626; color: inherit; border: 1px solid #77736c; font: inherit; }
+    background: var(--dolly-ui-background); color: inherit; border: 1px solid var(--dolly-ui-quiet); font: inherit; }
   #session-dialog::backdrop { background: #0008; }
   #session-dialog h2 { margin: 0 0 1rem; font-size: 20px; }
   #session-dialog p { font-size: 14px; line-height: 1.5; }
   #session-dialog label { display: block; margin: 1rem 0 0.4rem; }
   #session-dialog input { width: 100%; padding: 0.4rem; font: inherit;
-    color: inherit; background: #191919; border: 1px solid #77736c; }
+    color: inherit; background: var(--dolly-ui-sunken); border: 1px solid var(--dolly-ui-quiet); }
   #session-dialog button { padding: 0.35rem 0.65rem; font: inherit;
-    color: inherit; background: #333; border: 1px solid #77736c; cursor: pointer; }
-  #session-dialog a { color: #f2d45c; }
+    color: inherit; background: var(--dolly-ui-raised); border: 1px solid var(--dolly-ui-quiet); cursor: pointer; }
+  #session-dialog a { color: var(--dolly-ui-accent); }
   #session-dialog nav { display: flex; gap: 0.6rem; align-items: center; margin-top: 1rem; }
   #session-dialog nav a { margin-right: auto; font-size: 14px; }
-</style>
-<button id="session-open" class="page-indicator" type="button" aria-label="Save session" title="Save session (Ctrl+Shift+S)" hidden>Save</button>
+`;
+const markup = `<button id="session-open" class="page-indicator" type="button" aria-label="Save session" title="Save session (Ctrl+Shift+S)" hidden>Save</button>
 <dialog id="session-dialog" aria-labelledby="session-title">
   <form id="session-form">
     <h2 id="session-title">Save session</h2>
@@ -55,6 +57,9 @@ const markup = `<style>
 // (the site's session route, or ?session= on a page of one's own), and on a
 // page with a site the dialog links the site's list of saves.
 export function mountSessionSave({ mount, keyboard, showStatus, site, indicators }, transport, restored) {
+  const look = new CSSStyleSheet();
+  look.replaceSync(style);
+  document.adoptedStyleSheets = [...document.adoptedStyleSheets, look];
   mount.insertAdjacentHTML("beforeend", markup);
   const button = document.querySelector("#session-open");
   const dialog = document.querySelector("#session-dialog");
@@ -64,6 +69,15 @@ export function mountSessionSave({ mount, keyboard, showStatus, site, indicators
   const dataset = document.documentElement.dataset;
   let base, sessionName = null, lastSave = null, saveError = "";
   let saving = null, controller = null;
+  // When the save this tab restored or last made was stored: a later one is another tab's.
+  let knownSave = null;
+  // Whether processes changed files since the last capture began (the kernel's
+  // count, snapshot.mjs), and whether any change was reported since the last save
+  // that was stored: a failed save leaves it set.
+  let changed = false, unsaved = false;
+  // A tab of the site whose session was saved or restored asks, with the
+  // browser's own prompt, before it is left with changes no save holds.
+  if (site) addEventListener("beforeunload", event => { if (sessionName !== null && (changed || unsaved)) event.preventDefault(); });
 
   function update(message) {
     const failed = dataset.sessionStatus === "failed";
@@ -103,12 +117,11 @@ export function mountSessionSave({ mount, keyboard, showStatus, site, indicators
   async function save(requestedName) {
     if (saving) return saving;
     // A save asks the browser to keep the origin's storage: the saves and the
-    // packs their images start from (src/pack-store.mjs). Chrome answers from
-    // the site's engagement, Firefox asks the user; the save does not wait.
+    // packs images start from (page/pack-store.mjs). Chrome answers from the
+    // site's engagement, Firefox asks the user; the save does not wait.
     navigator.storage.persist().catch(() => {});
     saving = (async () => {
       if (!base) throw new Error("Dolly is not ready to save a session");
-      await base.verifyBase?.();
       let name = requestedName ?? sessionName;
       if (name === null) {
         name = window.prompt("Save Dolly session as:", "");
@@ -118,10 +131,16 @@ export function mountSessionSave({ mount, keyboard, showStatus, site, indicators
       if (!validSessionName(name)) {
         throw new Error("Session names use 1-64 letters, numbers, '.', '_' or '-'");
       }
-      if (name !== sessionName && await loadStoredSession(name) !== null &&
-          !window.confirm(`Replace the saved session '${name}'?`)) return null;
-      showStatus(`Saving ${name}…`, true);
+      const before = dataset.sessionStatus;
       dataset.sessionStatus = "capturing";
+      const stored = await loadStoredSession(name);
+      if (stored !== null && (name !== sessionName ? !window.confirm(`Replace the saved session '${name}'?`)
+        : stored.updatedAt !== knownSave && !window.confirm(`'${name}' was saved from another tab at ` +
+          `${new Date(stored.updatedAt).toLocaleTimeString()}. Replace that save with this tab's files?`))) {
+        if (before === undefined) delete dataset.sessionStatus; else dataset.sessionStatus = before;
+        return null;
+      }
+      showStatus(`Saving ${name}…`, true);
       indicators.hold("session", true);
       update(`Saving ${name}…`);
       button.disabled = nameField.disabled = saveButton.disabled = true;
@@ -134,20 +153,20 @@ export function mountSessionSave({ mount, keyboard, showStatus, site, indicators
       };
       const encoded = await encodeSessionStream(capture);
       dataset.sessionStatus = "storing";
-      const encodedSize = encoded.bytes.byteLength;
-      try {
-        await saveStoredSession({
-          name,
-          formatVersion: DOLLY_SESSION_FORMAT_VERSION,
-          buildId: DOLLY_BUILD_ID,
-          image: base.image,
-          imageIdentity: base.identity,
-          ...(base.custom ? { customImage: base.custom } : {}),
-          updatedAt: Date.now(),
-          encoding: encoded.encoding,
-          bytes: encoded.bytes,
-        });
-      } finally { encoded.bytes.transfer(0); }
+      const encodedSize = encoded.bytes.size, updatedAt = Date.now();
+      await saveStoredSession({
+        name,
+        formatVersion: DOLLY_SESSION_FORMAT_VERSION,
+        buildId: DOLLY_IMAGE_BUILD_ID,
+        image: base.image,
+        imageIdentity: base.identity,
+        ...(base.custom ? { customImage: base.custom } : {}),
+        updatedAt,
+        encoding: encoded.encoding,
+        bytes: encoded.bytes,
+      });
+      knownSave = updatedAt;
+      unsaved = false;
       sessionName = name;
       lastSave = new Date();
       dataset.session = name;
@@ -161,10 +180,16 @@ export function mountSessionSave({ mount, keyboard, showStatus, site, indicators
       showStatus(`Saved ${name} locally${site ? " · /sessions lists your saves" : ""}`);
       indicators.hold("session", false);
       update();
+      // The site's runtime is kept beside the save, which then opens without a
+      // network (site/offline.mjs); the save does not wait for it.
+      if (site) void keepRuntime(site).then(() => "kept", () => "failed").then(state => { dataset.sessionOffline = state; });
       return name;
     })().catch((error) => {
       dataset.sessionStatus = "failed";
-      saveError = error instanceof Error ? error.message : String(error);
+      // Chrome's error for a full store has no text.
+      saveError = error?.name === "QuotaExceededError"
+        ? "this browser has no room left for the site. Delete saves or clear downloads on the sessions page; the previous save is unchanged"
+        : error instanceof Error ? error.message : String(error);
       showStatus(`Save failed: ${saveError}`, true);
       indicators.hold("session", true);
       update(`Save failed: ${saveError}`);
@@ -180,6 +205,7 @@ export function mountSessionSave({ mount, keyboard, showStatus, site, indicators
   return {
     get name() { return sessionName; },
     save,
+    changed(value) { changed = value; unsaved ||= value; },
     // The dialog and the Save button keep their keys; Ctrl+Shift+S saves, the
     // first time through the dialog.
     claimsKey(event) {
@@ -195,17 +221,16 @@ export function mountSessionSave({ mount, keyboard, showStatus, site, indicators
       return true;
     },
     // custom is the running custom image record (Dollyfile, artifact and
-    // what the tab inherited); verifyBase, given, checks before a save that
-    // the base is still the one the session restores onto (the site's routes,
-    // src/site.mjs). The identity names that base.
-    entryStarted({ image, custom, verifyBase }) {
-      base = { image, custom, verifyBase,
+    // what the tab inherited); the identity names the image the save was made on.
+    entryStarted({ image, custom }) {
+      base = { image, custom,
         identity: custom ? customSessionIdentity(custom) : sessionImageIdentity(DOLLY_IMAGES, image) };
       if (restored?.recovering) {
         dataset.sessionStatus = "recovered";
         showStatus(`Recovered files in /workspace/recovered-${restored.name}. Ctrl+Shift+S saves this as a new session.`, true);
       } else if (restored) {
         sessionName = restored.name;
+        knownSave = restored.updatedAt;
         dataset.session = restored.name;
         dataset.sessionStatus = "restored";
       }

package/host/stack/module.json

@@ -1,6 +1,7 @@
 {
   "name": "stack",
   "version": 0,
+  "build": true,
   "gives": "recursion deeper than one browser stack",
   "dependencies": ["runtime@0"],
   "phase": "kernel",

package/host/stack/stack.mjs

@@ -7,7 +7,7 @@ export function worker({ get, runtimeBase }) {
   return {
     async start() {
       const response = await fetch(new URL("dist/dolly-process-stack.mjs", runtimeBase), {
-        cache: "no-store", credentials: "same-origin", redirect: "error",
+        credentials: "same-origin", redirect: "error",
       });
       if (!response.ok) throw new Error(`Dolly dolly-process-stack.mjs returned HTTP ${response.status}`);
       get("runtime").serveInProcess("stack@0", {

package/host/threads/module.json

@@ -1,13 +1,18 @@
 {
   "name": "threads",
   "version": 0,
+  "build": true,
   "gives": "threads, a Worker each: 32 a process, 64 in all",
   "dependencies": ["runtime@0"],
+  "phase": "kernel",
   "imports": [],
   "host": "threads.mjs",
   "contracts": ["dolly-threads-supervisor-0.wat"],
   "process": ["dolly-threads-0.wat"],
   "headers": ["threads.h", "threads-abi.h"],
   "kernel": ["kernel.c"],
-  "client": ["client.c"]
+  "client": [],
+  "ccExports": { "pthread": ["dolly_thread_start"] },
+  "seed": "seed.sh",
+  "package": "libdolly-threads"
 }

package/host/threads/threads.mjs

@@ -1,22 +1,41 @@
-import { sameWasmType } from "../../src/wasm-interface.mjs";
+import { parseWasmInterface, sameWasmType } from "../../page/wasm-interface.mjs";
+import { DOLLY_THREAD_EXIT, DOLLY_THREAD_SPAWN } from "./abi.mjs";
 export { DOLLY_THREADS_ABI_DIGEST as digest } from "./abi.mjs";
 
-// An executable that links the threads client (every -pthread program) is
-// threaded; its requirement's digest is checked with the others.
-export function validateThreadProfile(parsed, requirements, schema) {
-  if (!requirements.has("threads@0")) return false;
-  const expected = schema.exports.find(entry => entry.name === "dolly_thread_start");
-  const actual = parsed.exports.find(entry => entry.name === expected.name);
-  if (!actual || !sameWasmType(actual.type, expected.type))
-    throw new TypeError("a program using threads@0 must export dolly_thread_start(i32, i64) -> i64; build C and C++ with -pthread");
-  return true;
-}
-
-export function worker({ get }) {
+// The supervisor runs a process on several Workers through this provider
+// (runtime.mjs setThreadProvider): which executables are threaded, the
+// operations that start and end a thread, the kernel's thread bookkeeping
+// (dolly-threads-supervisor-0.wat) and the Workers themselves.
+export function worker({ get, runtimeBase }) {
+  let kernel, schema;
   // Trusted resource limits, independent of kernel bookkeeping or guest claims.
   // Retired threads retain their join result in Wasm, not a Worker or host slot.
   const workers = new Map();
   const provider = {
+    async start(context) {
+      ({ kernel } = context);
+      const response = await fetch(new URL("dist/dolly-threads-0.wasm", runtimeBase),
+        { cache: "no-store", credentials: "same-origin", redirect: "error" });
+      if (!response.ok) throw new Error(`Dolly dolly-threads-0.wasm returned HTTP ${response.status}`);
+      schema = parseWasmInterface(await response.arrayBuffer(), "dolly-threads-0");
+    },
+    // An executable that links the threads client (every -pthread program) is
+    // threaded; its requirement's digest is checked with the others.
+    threaded(parsed, requirements) {
+      if (!requirements.has("threads@0")) return false;
+      const expected = schema.exports.find(entry => entry.name === "dolly_thread_start");
+      const actual = parsed.exports.find(entry => entry.name === expected.name);
+      if (!actual || !sameWasmType(actual.type, expected.type))
+        throw new TypeError("a program using threads@0 must export dolly_thread_start(i32, i64) -> i64; build C and C++ with -pthread");
+      return true;
+    },
+    operations: { spawn: DOLLY_THREAD_SPAWN, exit: DOLLY_THREAD_EXIT },
+    attach: pid => kernel.dolly_threads_attach(pid),
+    // Through the generic call path, as the supervisor calls dispatch: Firefox
+    // can enter a direct Wasm call twice.
+    dispatch: request => Reflect.apply(kernel.dolly_threads_dispatch, kernel, request),
+    unstarted: (pid, tid) => kernel.dolly_threads_unstarted(pid, tid),
+    retired: (pid, tid, result) => kernel.dolly_threads_retired(pid, tid, result),
     available(pid) {
       return workers.size < 64 && [...workers.values()].filter(owner => owner === pid).length < 32;
     },

package/package.json

@@ -1,10 +1,10 @@
 {
-  "version": "0.1.5-rc.0",
+  "version": "0.1.6",
   "type": "module",
   "name": "@daugasauron/dolly",
   "license": "MIT",
   "exports": {
-    ".": "./src/browser.mjs"
+    ".": "./page/browser.mjs"
   },
   "description": "Dolly's runtime: a POSIX-like userspace for wasm64 in a browser tab. Run images with boot().",
   "repository": {

package/{src → page}/browser.mjs

@@ -10,22 +10,33 @@ import * as processConstants from "./process-constants.mjs";
 // the status line, which lie in boot()'s element and style nothing else of the
 // page. A host module brings the look of what it adds; the page, the boot log's
 // font (the site's is Iosevka, dist/IosevkaTerm-SemiBold.woff2).
-const style = `
+const pageStyle = new CSSStyleSheet();
+pageStyle.replaceSync(`
   .dolly-terminal { position: relative; overflow: hidden; outline: none; caret-color: transparent;
-    display: flex; flex-direction: column; }
-  .dolly-terminal #display { display: block; width: 100%; flex: 1 1 0; min-height: 0; cursor: text; touch-action: none; }
+    display: flex; flex-direction: column;
+    /* Dolly's own UI in the embedding's colours (docs/embedding.md), unset Dolly's: the three, the
+       terminal's bright black for what is quieter, and mixes of them for raised and sunken parts. */
+    --dolly-ui-background: var(--dolly-background, #262626); --dolly-ui-color: var(--dolly-color, #e8e3d7);
+    --dolly-ui-accent: var(--dolly-accent, #f2d45c); --dolly-ui-quiet: var(--dolly-display-palette-8, #77736c);
+    --dolly-ui-raised: color-mix(in srgb, var(--dolly-ui-color) 7%, var(--dolly-ui-background));
+    --dolly-ui-sunken: color-mix(in srgb, var(--dolly-ui-background) 66%, black);
+    --dolly-ui-alert: #e98773; }
+  .dolly-terminal #display { display: block; width: 100%; flex: 1 1 0; min-height: 0; cursor: text; touch-action: none;
+    object-fit: contain; }
   .dolly-terminal #display[hidden] { display: none; }
   .dolly-terminal #keyboard { position: fixed; left: -10000px; top: 0; width: 1px; height: 1px; opacity: 0; caret-color: transparent; }
   .dolly-terminal #bootstrap-log { position: absolute; inset: 0; z-index: 1; margin: 0; padding: 1rem 1.15rem; overflow: auto;
-    white-space: pre-wrap; color: #e8e3d7; background: #262626; font: 600 20px/1.35 "Dolly IosevkaTerm SemiBold", monospace;
-    scrollbar-width: thin; scrollbar-color: #f2d45c #262626; }
+    white-space: pre-wrap; color: var(--dolly-ui-color); background: var(--dolly-ui-background);
+    font: 600 20px/1.35 "Dolly IosevkaTerm SemiBold", monospace;
+    scrollbar-width: thin; scrollbar-color: var(--dolly-ui-accent) var(--dolly-ui-background); }
   .dolly-terminal #bootstrap-log[hidden] { display: none; }
   .dolly-terminal #session-status { position: absolute; right: 1rem; top: 1rem; z-index: 5; max-width: calc(100% - 2rem);
-    padding: 0.5rem 0.75rem; color: #e8e3d7; background: #262626; border: 1px solid #77736c; font-size: 14px; }
+    padding: 0.5rem 0.75rem; color: var(--dolly-ui-color); background: var(--dolly-ui-background);
+    border: 1px solid var(--dolly-ui-quiet); font-size: 14px; }
   .dolly-terminal #session-status[hidden] { display: none; }
   html[data-indicators="hidden"] .page-indicator { display: none; }
   @media (max-width: 640px) { .dolly-terminal #bootstrap-log { padding: 0.65rem 0.75rem; } }
-`;
+`);
 
 function element(tag, properties, attributes = {}) {
   const node = Object.assign(document.createElement(tag), properties);
@@ -63,7 +74,7 @@ export function boot(mount, { images, image, modules, site, http = {}, files = {
 //   enables (by default the required ones), which a build alone may set;
 // - configuration, inherited: the modules' configuration, and what http@0
 //   inherits from the tab that opened this one;
-// - worker: the runtime Worker's URL, by default runtime-worker.mjs;
+// - worker: the runtime Worker's URL, by default dist/dolly-runtime-worker.mjs (runtime-worker.mjs bundled);
 // - start(host, report): before the Worker starts, the fields it adds to the
 //   configure message ({ message, transfers }), or null once an image without
 //   ENTRY is built;
@@ -71,9 +82,8 @@ export function boot(mount, { images, image, modules, site, http = {}, files = {
 // - running(host): the context host modules' entryStarted is given beside
 //   `image`, and members of the page's handle.
 export async function run(mount, { images, modules, site, http }, route) {
-  if (!document.querySelector("style[data-dolly]")) {
-    document.head.append(element("style", { textContent: style }, { "data-dolly": "" }));
-  }
+  // Adopted once, which a page's style-src without 'unsafe-inline' allows.
+  if (!document.adoptedStyleSheets.includes(pageStyle)) document.adoptedStyleSheets = [...document.adoptedStyleSheets, pageStyle];
   const canvas = element("canvas", { id: "display", hidden: true }, { "aria-label": "Dolly sandbox framebuffer" });
   const keyboard = element("textarea", { id: "keyboard" }, { "aria-label": "Dolly keyboard input",
     autocomplete: "off", autocapitalize: "off", spellcheck: "false" });
@@ -118,9 +128,9 @@ export async function run(mount, { images, modules, site, http }, route) {
       : `exited with status ${code}`;
     const notice = mount.appendChild(element("div", { id: "image-ended" }, { role: "alert" }));
     notice.style.cssText = "position:absolute;left:0;right:0;bottom:0;z-index:9;padding:0.6rem 1rem;" +
-      "color:#e8e3d7;background:#262626;border-top:1px solid #f2d45c;font-size:16px";
+      "color:var(--dolly-ui-color);background:var(--dolly-ui-background);border-top:1px solid var(--dolly-ui-accent);font-size:16px";
     const links = [{ text: "Reload to start again", href: location.href }, ...offers].map(({ text, href }) =>
-      Object.assign(document.createElement("a"), { textContent: text, href, style: "color:#f2d45c;margin-left:1.5ch" }));
+      Object.assign(document.createElement("a"), { textContent: text, href, style: "color:var(--dolly-ui-accent);margin-left:1.5ch" }));
     notice.append(`This image has ended: its program ${how}.`, ...links);
     // The notice takes the element's bottom strip; the last frame and the log keep the rest.
     Object.assign(canvas.style, { flex: "none", height: `calc(100% - ${notice.offsetHeight}px)`, objectFit: "contain",
@@ -147,6 +157,19 @@ export async function run(mount, { images, modules, site, http }, route) {
     const registry = await hostRegistry(modules);
     const selected = await route(registry);
     const { image } = selected;
+    // The Worker loads its code while the page starts the host modules; it waits for configure.
+    runtimeWorker = new Worker(selected.worker ?? new URL("../dist/dolly-runtime-worker.mjs", import.meta.url), {
+      type: "module",
+      name: "dolly-runtime",
+    });
+    // An uncaught failure in the Worker, a kernel trap outside a system call
+    // among them, is the runtime's end: the page says so.
+    runtimeWorker.addEventListener("error", event => {
+      const message = event.message || "the runtime Worker failed";
+      if (rejectReady) rejectReady(new Error(message)); else fatal(message);
+    });
+    runtimeWorker.postMessage({ type: "prepare", images: imageBase.href, modules: registry.urls,
+      hostModules: selected.enabled ?? selected.required });
     appendBootstrap(`DOLLY / ${image.toUpperCase()} / ${selected.label}\n\n`);
     host = await registry.createHost("browser", selected.enabled ?? selected.required, {
       send: (message, transfers = []) => runtimeWorker.postMessage(message, transfers),
@@ -160,19 +183,10 @@ export async function run(mount, { images, modules, site, http }, route) {
     if (started === null) {
       document.documentElement.dataset.dollyStatus = "built";
       host.dispose();
+      runtimeWorker.terminate();
       return null;
     }
 
-    runtimeWorker = new Worker(selected.worker ?? new URL("./runtime-worker.mjs", import.meta.url), {
-      type: "module",
-      name: "dolly-runtime",
-    });
-    // An uncaught failure in the Worker, a kernel trap outside a system call
-    // among them, is the runtime's end: the page says so.
-    runtimeWorker.addEventListener("error", event => {
-      const message = event.message || "the runtime Worker failed";
-      if (rejectReady) rejectReady(new Error(message)); else fatal(message);
-    });
     runtimeWorker.addEventListener("message", (event) => {
       const message = event.data;
       void host.handle(message).catch(error => fatal(error.message));

package/page/generated.mjs

@@ -0,0 +1,8 @@
+// The modules the runtime's build writes beside it (scripts/build.sh): its identities and
+// the digests and imports of the contracts it was built against. The page, its Workers
+// and the host modules import them from here alone; an image directory's catalog is
+// data, which images.mjs loads.
+export { DOLLY_BUILD_ID } from "../dist/dolly-build-id.mjs";
+export { DOLLY_IMAGE_BUILD_ID } from "../dist/dolly-image-build-id.mjs";
+export { DOLLY_PROCESS_ABI_DIGEST } from "../dist/dolly-process-abi.mjs";
+export { DOLLY_KERNEL_PLUGIN_ABI_DIGEST, DOLLY_KERNEL_PLUGIN_IMPORTS } from "../dist/dolly-kernel-plugin-abi.mjs";

package/{src → page}/image-entry.mjs

@@ -1,22 +1,26 @@
-// Shared by packaging and browser admission; empty arguments are valid.
+import { DOLLY_ENTRY_VERSION, DOLLY_ENTRY_HEADER_BYTES, DOLLY_ENTRY_MAX_ARGUMENTS, DOLLY_ENTRY_ARGUMENT_MAX_BYTES,
+  DOLLY_ENTRY_MAX_BYTES } from "../host/runtime/abi.mjs";
+
+// /etc/dolly/entry, as abi/dolly-image-0.wat lays it out. Shared by packaging and
+// browser admission; empty arguments are valid.
 export function decodeImageEntry(bytes) {
-  if (!(bytes instanceof Uint8Array) || bytes.byteLength < 16 || bytes.byteLength > 64 * 1024) {
+  if (!(bytes instanceof Uint8Array) || bytes.byteLength < DOLLY_ENTRY_HEADER_BYTES || bytes.byteLength > DOLLY_ENTRY_MAX_BYTES) {
     throw new TypeError("invalid image ENTRY record");
   }
   const decoder = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
   const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
-  if (decoder.decode(bytes.subarray(0, 8)) !== "DOLLYENT" || view.getUint32(8, true) !== 1) {
+  if (decoder.decode(bytes.subarray(0, 8)) !== "DOLLYENT" || view.getUint32(8, true) !== DOLLY_ENTRY_VERSION) {
     throw new TypeError("invalid image ENTRY version");
   }
   const count = view.getUint32(12, true);
-  if (count === 0 || count > 256) throw new TypeError("invalid image ENTRY count");
-  let offset = 16;
+  if (count === 0 || count > DOLLY_ENTRY_MAX_ARGUMENTS) throw new TypeError("invalid image ENTRY count");
+  let offset = DOLLY_ENTRY_HEADER_BYTES;
   const arguments_ = [];
   for (let index = 0; index < count; ++index) {
     if (offset > bytes.byteLength - 4) throw new TypeError("truncated image ENTRY");
     const size = view.getUint32(offset, true);
     offset += 4;
-    if (size > 4096 || offset > bytes.byteLength - size) throw new TypeError("invalid image ENTRY argument");
+    if (size > DOLLY_ENTRY_ARGUMENT_MAX_BYTES || offset > bytes.byteLength - size) throw new TypeError("invalid image ENTRY argument");
     const value = decoder.decode(bytes.subarray(offset, offset + size));
     if (value.includes("\0")) throw new TypeError("image ENTRY has a NUL argument");
     arguments_.push(value);

package/{src → page}/image-inputs.mjs

@@ -1,3 +1,5 @@
+import { Sha256 } from "./sha256.mjs";
+
 // Recipe pins identify instructions; artifact digests identify their results.
 export function imageInputs(artifacts = []) {
   if (!Array.isArray(artifacts) || artifacts.length > 256) throw new Error("invalid image inputs");
@@ -18,3 +20,12 @@ export function imageInputs(artifacts = []) {
 export function imageInputsMatch(actual, expected) {
   return JSON.stringify(imageInputs(actual)) === JSON.stringify(imageInputs(expected));
 }
+
+// The catalog's digest of an image's recipe records (its metadata's recipes),
+// one line each, "SHA256 BYTES PATH\n", in their order: a start checks the
+// records against the catalog without the catalog repeating them.
+export function recipesDigest(recipes) {
+  const hash = new Sha256();
+  hash.update(new TextEncoder().encode(recipes.map(({ sha256, byteLength, sourcePath }) => `${sha256} ${byteLength} ${sourcePath}\n`).join("")));
+  return hash.hex();
+}

package/{src → page}/image-names.mjs

@@ -5,7 +5,7 @@
 // Dollyfile-example.txt is never a recipe.
 export const validName = name => /^[a-z][a-z0-9]*(?:-[a-z0-9]+|\.[0-9]+)*$/.test(name) && name.length <= 32;
 
-// No image retains scratch space.
+// No image retains scratch space, /tmp.
 export function unretainedPath(value) {
-  return ["/tmp", "/workspace"].some((prefix) => value === prefix || value.startsWith(`${prefix}/`));
+  return value === "/tmp" || value.startsWith("/tmp/");
 }

package/{src → page}/kernel-plugin.mjs

@@ -1,4 +1,4 @@
-import { DOLLY_KERNEL_PLUGIN_ABI_DIGEST, DOLLY_KERNEL_PLUGIN_IMPORTS } from "../dist/dolly-kernel-plugin-abi.mjs";
+import { DOLLY_KERNEL_PLUGIN_ABI_DIGEST, DOLLY_KERNEL_PLUGIN_IMPORTS } from "./generated.mjs";
 import { hex } from "./static-asset.mjs";
 import { Reader } from "./wasm-interface.mjs";
 

package/{src → page}/pack-store.mjs

@@ -7,7 +7,7 @@
 // being read on the origin, what the records of this runtime's images do not
 // name is removed. Only the page and its Workers write here, from an image's
 // trusted metadata; nothing of the guest reaches it.
-import { DOLLY_IMAGE_BUILD_ID } from "../dist/dolly-image-build-id.mjs";
+import { DOLLY_IMAGE_BUILD_ID } from "./generated.mjs";
 import { imageBase, imageDefinition } from "./images.mjs";
 import { sha256 } from "./static-asset.mjs";