@downdraft/engine 0.1.0 → 0.1.2-alpha.5

package/dist/core/src/plugin/loader-quickjs.js

@@ -0,0 +1,67 @@
+// ============================================================================
+// QuickjsPluginLoader — loads `quickjs` format (script-tier) plugins.
+//
+// QuickJS plugins run in-process on the renderer thread inside a QuickJS WASM
+// VM. The VM provides hard isolation: only the host-bridged `ddPlugin` global
+// exists. This loader:
+//   1. Fetches the singleton QuickJS WASM module (lazy, cached).
+//   2. Creates a runtime + context via createQuickjsBridge.
+//   3. Fetches the plugin entry JS source (the manifest `entry` URL).
+//   4. Evals the source (which defines a `register` global function).
+//   5. Calls `register(ddPlugin)`.
+//   6. On dispose, disposes the VM.
+// ============================================================================
+import { createLogger } from "../util/logger.js";
+import { createQuickjsBridge } from "./quickjs-bridge.js";
+const log = createLogger("info");
+let modulePromise = null;
+async function getModule() {
+    if (!modulePromise) {
+        // Dynamic import so the QuickJS wasm is only loaded when a quickjs plugin
+        // is actually used. The singlefile-browser variant inlines the wasm.
+        const mod = await import("quickjs-emscripten");
+        modulePromise = mod.getQuickJS();
+    }
+    return modulePromise;
+}
+export class QuickjsPluginLoader {
+    format = "quickjs";
+    bridges = new Map();
+    async load(manifest, ctx, _granted) {
+        const module = await getModule();
+        const bridge = createQuickjsBridge(module, ctx, {
+            pluginId: manifest.id,
+            instructionBudget: manifest.quickjs?.instructionBudget,
+        });
+        this.bridges.set(manifest.id, bridge);
+        // Fetch the plugin entry source.
+        const entryUrl = manifest.entry;
+        let source;
+        try {
+            const resp = await fetch(entryUrl);
+            if (!resp.ok)
+                throw new Error(`HTTP ${resp.status}`);
+            source = await resp.text();
+        }
+        catch (e) {
+            bridge.dispose();
+            this.bridges.delete(manifest.id);
+            throw new Error(`Failed to fetch QuickJS plugin entry "${entryUrl}": ${e.message}`);
+        }
+        // Eval the source — it should define a `register` function on the global.
+        bridge.eval(source, entryUrl);
+        // Call register(ddPlugin) — the bridged global is available in the VM.
+        bridge.eval(`register(ddPlugin);`, `${entryUrl}#register`);
+        bridge.drainJobs();
+        log.info("quickjs-plugin-loader", `Loaded QuickJS plugin "${manifest.id}"`);
+        return () => {
+            bridge.dispose();
+            this.bridges.delete(manifest.id);
+        };
+    }
+    disposeAll() {
+        for (const [, b] of this.bridges.entries())
+            b.dispose();
+        this.bridges.clear();
+    }
+}

package/dist/core/src/plugin/loader-wasm.js

@@ -0,0 +1,385 @@
+// ============================================================================
+// WasmPluginLoader — loads `wasm` format (native-tier) plugins.
+//
+// WASM plugins ALWAYS run in their own dedicated worker (stability isolation).
+// The loader:
+//   1. Fetches the .wasm file.
+//   2. Instantiates it with the host import module (env namespace).
+//   3. Calls the module's `register` export.
+//   4. Forwards tick calls + event dispatch to the module's exports.
+//   5. On dispose, calls the module's `dispose` export.
+//
+// For testing, an in-process variant (`InlineWasmPluginLoader`) instantiates
+// the WASM module directly on the current thread.
+// ============================================================================
+import { createLogger } from "../util/logger.js";
+import { readStringFromMemory, writeBytesToMemory, writeStringToMemory, } from "./wasm-abi.js";
+const log = createLogger("info");
+/**
+ * Build the host import module (`env` namespace) for a WASM plugin.
+ * The imports bridge the plugin's WASM calls to the ScriptPluginContext /
+ * NativePluginContext. v3 host-call imports forward to the NativePluginContext
+ * host-call bridge and post results back via `on_host_call_result`.
+ *
+ * Exported for testing (so tests can instantiate a WASM module directly
+ * without going through the loader's fetch path).
+ */
+export function buildImports(ctx, exports, subscriptions, pending) {
+    const readStr = (ptr, len) => readStringFromMemory(exports(), ptr, len);
+    // Host-call bridge: only available on NativePluginContext. For script-tier
+    // (QuickJS) contexts, host calls reject with a clear error.
+    const hostCalls = ctx.spawnProp
+        ? ctx
+        : undefined;
+    let nextReqId = 1;
+    const dispatchHostCall = (p, requestId) => {
+        p.then((result) => {
+            const exp = exports();
+            if (!exp.on_host_call_result)
+                return;
+            if (result === undefined) {
+                exp.on_host_call_result(requestId, 0, 0, 0, 0);
+            }
+            else {
+                const json = JSON.stringify(result);
+                const [ptr, len] = writeBytesToMemory(exp, new TextEncoder().encode(json)) ?? [0, 0];
+                exp.on_host_call_result(requestId, ptr, len, 0, 0);
+            }
+        }).catch((err) => {
+            const exp = exports();
+            if (!exp.on_host_call_result)
+                return;
+            const [ptr, len] = writeStringToMemory(exp, err.message) ?? [0, 0];
+            exp.on_host_call_result(requestId, 0, 0, ptr, len);
+        });
+    };
+    return {
+        env: {
+            log_info: (ptr, len) => ctx.log.info(readStr(ptr, len)),
+            log_warn: (ptr, len) => ctx.log.warn(readStr(ptr, len)),
+            log_error: (ptr, len) => ctx.log.error(readStr(ptr, len)),
+            log_debug: (ptr, len) => ctx.log.debug(readStr(ptr, len)),
+            state_get: (keyPtr, keyLen) => {
+                const key = readStr(keyPtr, keyLen);
+                const val = ctx.state.get(key);
+                if (val === undefined)
+                    return 0;
+                // Write the value as JSON into memory. Store length as u32 before the ptr.
+                const json = JSON.stringify(val);
+                const [ptr, len] = writeBytesToMemory(exports(), new TextEncoder().encode(json)) ?? [0, 0];
+                if (ptr === 0)
+                    return 0;
+                // Write the length 4 bytes before the pointer.
+                const mem = exports().memory;
+                const dv = new DataView(mem.buffer, ptr - 4, 4);
+                dv.setUint32(0, len, true);
+                return ptr;
+            },
+            state_set: (keyPtr, keyLen, valPtr, valLen) => {
+                const key = readStr(keyPtr, keyLen);
+                const json = readStr(valPtr, valLen);
+                try {
+                    ctx.state.set(key, JSON.parse(json));
+                }
+                catch {
+                    ctx.state.set(key, json);
+                }
+            },
+            state_delete: (keyPtr, keyLen) => {
+                ctx.state.delete(readStr(keyPtr, keyLen));
+            },
+            event_publish: (namePtr, nameLen, dataPtr, dataLen) => {
+                const name = readStr(namePtr, nameLen);
+                const json = readStr(dataPtr, dataLen);
+                try {
+                    ctx.events.publish(name, JSON.parse(json));
+                }
+                catch {
+                    ctx.events.publish(name, json);
+                }
+            },
+            event_subscribe: (namePtr, nameLen) => {
+                const name = readStr(namePtr, nameLen);
+                const subId = subscriptions.size + 1;
+                const handler = (data) => {
+                    const exp = exports();
+                    if (!exp.on_event)
+                        return;
+                    const json = JSON.stringify(data);
+                    const [ptr, len] = writeBytesToMemory(exp, new TextEncoder().encode(json)) ?? [0, 0];
+                    if (ptr !== 0)
+                        exp.on_event(subId, ptr, len);
+                };
+                const unsub = ctx.events.subscribe(name, handler);
+                subscriptions.set(subId, unsub);
+                // Store the unsub for cleanup.
+                subscriptions[`unsub_${subId}`] = unsub;
+                return subId;
+            },
+            event_unsubscribe: (subId) => {
+                const unsub = subscriptions[`unsub_${subId}`];
+                if (typeof unsub === "function")
+                    unsub();
+                subscriptions.delete(subId);
+            },
+            // ── Host-call bridge (v3) ──
+            spawn_prop: (contentIdPtr, contentIdLen, x, y, z, qx, qy, qz, qw, scale) => {
+                const reqId = nextReqId++;
+                const contentId = readStr(contentIdPtr, contentIdLen);
+                if (!hostCalls?.spawnProp) {
+                    dispatchHostCall(Promise.reject(new Error("spawnProp: no host-call bridge wired")), reqId);
+                    return reqId;
+                }
+                const desc = {
+                    contentId,
+                    position: [x, y, z],
+                    rotation: [qx, qy, qz, qw],
+                    scale,
+                };
+                dispatchHostCall(hostCalls.spawnProp(desc), reqId);
+                return reqId;
+            },
+            remove_prop: (entityId) => {
+                const reqId = nextReqId++;
+                if (!hostCalls?.removeProp) {
+                    dispatchHostCall(Promise.reject(new Error("removeProp: no host-call bridge wired")), reqId);
+                    return reqId;
+                }
+                dispatchHostCall(hostCalls.removeProp(entityId), reqId);
+                return reqId;
+            },
+            set_physics: (entityId, mass, restitution, friction, gravityScale) => {
+                const reqId = nextReqId++;
+                if (!hostCalls?.setPhysics) {
+                    dispatchHostCall(Promise.reject(new Error("setPhysics: no host-call bridge wired")), reqId);
+                    return reqId;
+                }
+                const desc = {};
+                if (!Number.isNaN(mass))
+                    desc.mass = mass;
+                if (!Number.isNaN(restitution))
+                    desc.restitution = restitution;
+                if (!Number.isNaN(friction))
+                    desc.friction = friction;
+                if (!Number.isNaN(gravityScale))
+                    desc.gravityScale = gravityScale;
+                dispatchHostCall(hostCalls.setPhysics(entityId, desc), reqId);
+                return reqId;
+            },
+            get_physics: (entityId) => {
+                const reqId = nextReqId++;
+                if (!hostCalls?.getPhysics) {
+                    dispatchHostCall(Promise.reject(new Error("getPhysics: no host-call bridge wired")), reqId);
+                    return reqId;
+                }
+                dispatchHostCall(hostCalls.getPhysics(entityId), reqId);
+                return reqId;
+            },
+            apply_impulse: (entityId, x, y, z) => {
+                const reqId = nextReqId++;
+                if (!hostCalls?.applyImpulse) {
+                    dispatchHostCall(Promise.reject(new Error("applyImpulse: no host-call bridge wired")), reqId);
+                    return reqId;
+                }
+                dispatchHostCall(hostCalls.applyImpulse(entityId, [x, y, z]), reqId);
+                return reqId;
+            },
+            apply_torque: (entityId, x, y, z) => {
+                const reqId = nextReqId++;
+                if (!hostCalls?.applyTorque) {
+                    dispatchHostCall(Promise.reject(new Error("applyTorque: no host-call bridge wired")), reqId);
+                    return reqId;
+                }
+                dispatchHostCall(hostCalls.applyTorque(entityId, [x, y, z]), reqId);
+                return reqId;
+            },
+            get_asset_ref: (assetIdPtr, assetIdLen) => {
+                const reqId = nextReqId++;
+                const assetId = readStr(assetIdPtr, assetIdLen);
+                if (!hostCalls?.getAssetRef) {
+                    dispatchHostCall(Promise.reject(new Error("getAssetRef: no host-call bridge wired")), reqId);
+                    return reqId;
+                }
+                dispatchHostCall(hostCalls.getAssetRef(assetId), reqId);
+                return reqId;
+            },
+        },
+    };
+}
+/** Resolve the plugin exports from a WebAssembly instance. */
+function resolveExports(instance) {
+    const exp = instance.exports;
+    return {
+        alloc: exp.alloc,
+        register: exp.register,
+        tick: exp.tick,
+        dispose: exp.dispose,
+        on_event: exp.on_event,
+        on_host_call_result: exp.on_host_call_result,
+        memory: exp.memory,
+    };
+}
+/**
+ * In-process WASM plugin loader. Instantiates the WASM module directly on the
+ * current thread. Used for tests and for renderer-thread WASM plugins (though
+ * WASM plugins are always supposed to run in their own worker per the spec).
+ */
+export class InlineWasmPluginLoader {
+    format = "wasm";
+    async load(manifest, ctx, _granted) {
+        const entryUrl = manifest.entry;
+        const resp = await fetch(entryUrl);
+        if (!resp.ok)
+            throw new Error(`Failed to fetch WASM plugin "${entryUrl}": HTTP ${resp.status}`);
+        const bytes = new Uint8Array(await resp.arrayBuffer());
+        const subscriptions = new Map();
+        const pending = new Map();
+        let exportsRef = { alloc: () => 0, register: () => { } };
+        const imports = buildImports(ctx, () => exportsRef, subscriptions, pending);
+        const result = await WebAssembly.instantiate(bytes, imports);
+        exportsRef = resolveExports(result.instance);
+        if (typeof exportsRef.register !== "function") {
+            throw new Error(`WASM plugin "${manifest.id}" has no register() export`);
+        }
+        // Call register.
+        exportsRef.register();
+        // Wire tick if the plugin exports it.
+        if (typeof exportsRef.tick === "function") {
+            const tickFn = exportsRef.tick;
+            const unsub = ctx.tick.onTick((dt, t) => tickFn(dt, t));
+            subscriptions.__tickUnsub = unsub;
+        }
+        log.info("inline-wasm-plugin-loader", `Loaded WASM plugin "${manifest.id}"`);
+        return () => {
+            const unsubTick = subscriptions.__tickUnsub;
+            if (typeof unsubTick === "function")
+                unsubTick();
+            for (const [, unsub] of subscriptions.entries()) {
+                if (typeof unsub === "function")
+                    unsub();
+            }
+            subscriptions.clear();
+            try {
+                exportsRef.dispose?.();
+            }
+            catch { /* swallow */ }
+        };
+    }
+}
+/**
+ * Worker-based WASM plugin loader. Spawns a dedicated worker per WASM plugin.
+ * The worker instantiates the WASM module and bridges the host API.
+ *
+ * CRITICAL: Vite requires `new Worker(new URL("./wasm-worker.ts", import.meta.url))`
+ * to appear literally at the call site. It does here.
+ */
+export class WasmPluginLoader {
+    format = "wasm";
+    workers = new Map();
+    async load(manifest, ctx, _granted) {
+        const entryUrl = manifest.entry;
+        const worker = new Worker(new URL("./wasm-worker.js", import.meta.url), {
+            type: "module",
+        });
+        this.workers.set(manifest.id, worker);
+        const ready = new Promise((resolve, reject) => {
+            const onReady = (ev) => {
+                const msg = ev.data;
+                if (msg?.__wasmReady && msg.pluginId === manifest.id) {
+                    worker.removeEventListener("message", onReady);
+                    resolve();
+                }
+                if (msg?.__wasmError) {
+                    worker.removeEventListener("message", onReady);
+                    reject(new Error(msg.error));
+                }
+            };
+            worker.addEventListener("message", onReady);
+        });
+        worker.onerror = (e) => {
+            log.error("wasm-plugin-loader", `worker error for "${manifest.id}": ${e.message}`);
+        };
+        // Send init message with the WASM URL.
+        worker.postMessage({
+            __wasmInit: true,
+            pluginId: manifest.id,
+            entryUrl,
+        });
+        // Forward host-side calls when the worker posts bridge requests.
+        // Explicit dispatch table — arbitrary ctx[method] strings are NOT
+        // forwarded; only the methods the wasm worker protocol uses.
+        const eventSubs = new Map();
+        const wasmHostCalls = ctx;
+        const dispatchBridge = (method, args) => {
+            switch (method) {
+                case "log": {
+                    const level = args[0];
+                    return ctx.log[level]?.(String(args[1]));
+                }
+                case "state.load": return ctx.state.load?.();
+                case "state.keys": return ctx.state.keys();
+                case "state.get": return ctx.state.get(args[0]);
+                case "state.set": return ctx.state.set(args[0], args[1]);
+                case "state.delete": return ctx.state.delete(args[0]);
+                case "events.publish": return ctx.events.publish(args[0], args[1]);
+                case "events.subscribe": {
+                    const name = args[0];
+                    const subId = args[1];
+                    const unsub = ctx.events.subscribe(name, (data) => {
+                        worker.postMessage({ __wasmEvent: true, subId, data });
+                    });
+                    eventSubs.set(subId, unsub);
+                    return subId;
+                }
+                case "events.unsubscribe": {
+                    const unsub = eventSubs.get(args[0]);
+                    eventSubs.delete(args[0]);
+                    unsub?.();
+                    return undefined;
+                }
+                case "hostCall": {
+                    // v3 host calls — native-tier context methods only (permission-
+                    // gated inside the context itself).
+                    const [name, ...rest] = args;
+                    const allowed = ["spawnProp", "removeProp", "setPhysics", "getPhysics", "applyImpulse", "applyTorque", "getAssetRef"];
+                    if (!allowed.includes(name)) {
+                        throw new Error(`hostCall "${name}" is not allowed`);
+                    }
+                    const fn = wasmHostCalls[name];
+                    if (typeof fn !== "function") {
+                        throw new Error(`hostCall "${name}" unavailable (no native context)`);
+                    }
+                    return fn.apply(ctx, rest);
+                }
+                default:
+                    throw new Error(`unknown bridge method "${method}"`);
+            }
+        };
+        worker.addEventListener("message", (ev) => {
+            const msg = ev.data;
+            if (msg?.__wasmBridge) {
+                const { method, args } = msg;
+                Promise.resolve()
+                    .then(() => dispatchBridge(method, args))
+                    .then((result) => {
+                    worker.postMessage({ __wasmBridgeResult: true, callId: msg.callId, result });
+                })
+                    .catch((e) => {
+                    worker.postMessage({ __wasmBridgeResult: true, callId: msg.callId, error: e.message });
+                });
+            }
+        });
+        await ready;
+        log.info("wasm-plugin-loader", `Loaded WASM plugin "${manifest.id}" in dedicated worker`);
+        return () => {
+            worker.postMessage({ __wasmDispose: true });
+            setTimeout(() => worker.terminate(), 100);
+            this.workers.delete(manifest.id);
+        };
+    }
+    disposeAll() {
+        for (const [, w] of this.workers.entries())
+            w.terminate();
+        this.workers.clear();
+    }
+}

package/dist/core/src/plugin/loader-worker.js

@@ -0,0 +1,228 @@
+// ============================================================================
+// WorkerPluginLoader — loads `worker-js` format plugins in a sandboxed Web Worker.
+//
+// For `thread: "own-worker"` plugins, this loader spawns a dedicated
+// `sandbox-worker.ts` per plugin, sends the init message (entry URL + granted
+// perms), and forwards host↔worker bridge calls.
+//
+// For `thread: "sim"` plugins, the host forwards the manifest to the sim
+// worker's own PluginHost (which uses the in-process loader path that imports
+// the entry directly into the sim worker's module graph). This loader only
+// handles the `own-worker` case on the renderer/sim-host side.
+//
+// Bridge protocol (`__bridgeCall` / `__bridgeResponse`):
+//   - Every call carries a `callId` so responses correlate with requests.
+//   - Only an allowlist of methods may cross the boundary — the worker can
+//     never invoke arbitrary context members. Permission enforcement happens
+//     inside the context itself (makeScriptContext/makeNativeContext gate
+//     each API on the granted set), so a denied call rejects with a
+//     permission error that is forwarded back to the worker.
+//   - Results are awaited before responding — async context methods work.
+//
+// CRITICAL: Vite requires `new Worker(new URL("./sandbox-worker.ts", import.meta.url))`
+// to appear literally at the call site. It does here.
+// ============================================================================
+import { createLogger } from "../util/logger.js";
+const log = createLogger("info");
+/** How long to wait for a plugin worker's __sandboxReady before giving up. */
+const READY_TIMEOUT_MS = 15_000;
+/**
+ * Methods a sandboxed worker may invoke across the bridge. Anything not in
+ * this list is rejected — the worker can never reach arbitrary ctx members.
+ * Permission checks are enforced inside the context methods themselves.
+ */
+const BRIDGE_METHODS = new Set([
+    "events.publish",
+    "events.subscribe",
+    "state.save",
+    "state.load",
+    // Host-call bridge (game mutation) — only present on native-tier contexts;
+    // each method is additionally permission-gated inside the context.
+    "spawnProp",
+    "removeProp",
+    "setPhysics",
+    "getPhysics",
+    "applyImpulse",
+    "applyTorque",
+    "getAssetRef",
+]);
+export class WorkerPluginLoader {
+    format = "worker-js";
+    workers = new Map();
+    host = null;
+    bindHost(host) {
+        this.host = host;
+    }
+    async load(manifest, ctx, granted) {
+        if (manifest.thread !== "own-worker") {
+            // sim-thread worker-js plugins are loaded by the sim worker's own host
+            // via direct dynamic import (not this loader). Renderer-side host skips.
+            log.info("worker-plugin-loader", `plugin "${manifest.id}" thread=${manifest.thread} — skipping on this host (sim-side host loads it)`);
+            return;
+        }
+        const entryUrl = manifest.entry;
+        const worker = new Worker(new URL("./sandbox-worker.js", import.meta.url), {
+            type: "module",
+        });
+        this.workers.set(manifest.id, worker);
+        const ready = new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                cleanup();
+                worker.terminate();
+                this.workers.delete(manifest.id);
+                reject(new Error(`plugin "${manifest.id}" timed out waiting for __sandboxReady (${READY_TIMEOUT_MS}ms)`));
+            }, READY_TIMEOUT_MS);
+            const cleanup = () => {
+                clearTimeout(timer);
+                worker.removeEventListener("message", onReady);
+                worker.onerror = null;
+            };
+            const onReady = (ev) => {
+                const msg = ev.data;
+                if (msg?.__sandboxReady && msg.contextId === manifest.id) {
+                    cleanup();
+                    resolve();
+                }
+                if (msg?.__sandboxError) {
+                    cleanup();
+                    reject(new Error(msg.error));
+                }
+            };
+            worker.addEventListener("message", onReady);
+            worker.onerror = (e) => {
+                cleanup();
+                this.workers.delete(manifest.id);
+                reject(new Error(`worker error for "${manifest.id}": ${e.message}`));
+            };
+        });
+        worker.postMessage({
+            __sandboxInit: true,
+            entryUrl,
+            granted: [...granted.granted],
+            contextId: manifest.id,
+        });
+        // Forward host-side ctx calls when the worker posts __bridgeCall.
+        worker.addEventListener("message", (ev) => {
+            const msg = ev.data;
+            if (msg?.__bridgeCall) {
+                void this.handleBridgeCall(worker, manifest.id, ctx, msg);
+                return;
+            }
+            if (msg?.__pluginLog) {
+                const level = (msg.level ?? "info");
+                log[level]?.("WorkerPluginLoader", `[plugin:${manifest.id}] ${msg.msg}`);
+            }
+        });
+        await ready;
+        return () => {
+            worker.postMessage({ __dispose: true });
+            setTimeout(() => worker.terminate(), 100);
+            this.workers.delete(manifest.id);
+        };
+    }
+    /**
+     * Dispatch an allowlisted bridge call. Async results are awaited before
+     * the response is posted, so async context methods (host calls, state
+     * save/load) propagate correctly.
+     */
+    async handleBridgeCall(worker, pluginId, ctx, msg) {
+        const { callId, method, args = [] } = msg;
+        let result;
+        let error;
+        try {
+            if (!method || !BRIDGE_METHODS.has(method)) {
+                throw new Error(`bridge method "${method}" is not allowed`);
+            }
+            switch (method) {
+                case "events.publish":
+                    ctx.events.publish(args[0], args[1]);
+                    break;
+                case "events.subscribe": {
+                    // Subscribe the worker to the shared bus; fan out via __event posts.
+                    // ctx.events is permission-gated, so a plugin without the "events"
+                    // permission throws here and the error is bridged back.
+                    const event = args[0];
+                    const unsub = ctx.events.subscribe(event, (data) => {
+                        worker.postMessage({ __event: true, event, data });
+                    });
+                    this.host?.trackDispose(pluginId, unsub);
+                    break;
+                }
+                case "state.save": {
+                    // Worker pushes its KV entries; host persists via its own store.
+                    args[0].forEach(([k, v]) => {
+                        ctx.state.set(k, v);
+                    });
+                    await ctx.state.save();
+                    break;
+                }
+                case "state.load": {
+                    await ctx.state.load();
+                    result = ctx.state.keys().map((k) => [k, ctx.state.get(k)]);
+                    break;
+                }
+                default: {
+                    // Host calls (spawnProp, setPhysics, ...) — present only on
+                    // native-tier contexts; each is permission-gated internally.
+                    const fn = ctx[method];
+                    if (typeof fn !== "function") {
+                        throw new Error(`bridge method "${method}" is not available on this context`);
+                    }
+                    result = await fn(...args);
+                }
+            }
+        }
+        catch (e) {
+            error = e.message;
+        }
+        worker.postMessage({ __bridgeResponse: true, contextId: pluginId, callId, result, error });
+    }
+    /** Forward a host tick to every worker plugin (drives ctx.tick.onTick). */
+    tick(dt, elapsedTime) {
+        for (const [, worker] of this.workers.entries()) {
+            worker.postMessage({ __tick: true, dt, elapsedTime });
+        }
+    }
+    disposeAll() {
+        for (const [, w] of this.workers.entries())
+            w.terminate();
+        this.workers.clear();
+    }
+}
+/**
+ * In-process loader for worker-js plugins that run on the SAME thread as the
+ * host (e.g. sim-thread plugins loaded by the sim worker's PluginHost, or
+ * renderer-thread plugins in tests). Restricts globals via the shim then
+ * dynamically imports the entry.
+ *
+ * The returned dispose fn restores the globals that restrictGlobals trapped,
+ * so unloading a plugin doesn't leave the host thread's global environment
+ * permanently degraded (e.g. a plugin denied `network` would otherwise trap
+ * `fetch` for the entire sim worker forever).
+ */
+export class InlinePluginLoader {
+    format = "worker-js";
+    async load(manifest, ctx, granted) {
+        // Restrict globals in-process (affects everything on this thread — only
+        // safe in a dedicated worker context like the sim worker, where the
+        // plugin runs alongside the sim but the sim owns the thread).
+        const { restrictGlobals } = await import("./sandbox-shim.js");
+        const { restore } = restrictGlobals(granted.granted);
+        const mod = await import(/* @vite-ignore */ manifest.entry);
+        const entry = mod.default ?? mod;
+        if (typeof entry.register !== "function") {
+            throw new Error(`Plugin "${manifest.id}" entry has no register() function`);
+        }
+        try {
+            await entry.register(ctx);
+        }
+        catch (e) {
+            // Plugin never activated — restore the host thread's globals now.
+            restore();
+            throw e;
+        }
+        return () => {
+            restore();
+        };
+    }
+}