@hew-lang/sandbox-vm 0.6.0-rc7 → 0.6.1

package/dist/interpreter/v1/package.d.ts

@@ -1,6 +1,6 @@
 export type Own = "none" | "owned" | "guaranteed";
 export type BoundaryDecision = "borrow" | "borrow_mut" | "copy" | "move" | "snapshot";
-export type TrapName = "integer_overflow" | "divide_by_zero" | "shift_out_of_range" | "vector_bounds";
+export type TrapName = "integer_overflow" | "divide_by_zero" | "shift_out_of_range" | "vector_bounds" | "actor_refused";
 export interface SpanV1 {
     start: number;
     end: number;
@@ -34,7 +34,7 @@ export interface VariantShape {
     cases: VariantCase[];
     runtime_tags?: Partial<Record<RuntimeVariantRole, number>>;
 }
-export type RuntimeVariantRole = "OptionSome" | "OptionNone" | "ResultOk" | "ResultErr" | "ActorErrorRejected" | "ActorErrorFailed" | "ActorErrorTrapped" | "ActorErrorDead" | "ActorErrorTimedOut" | "ActorErrorNodeNotRunning" | "ActorErrorRoutingFailed" | "ActorErrorEncodeFailed" | "ActorErrorConnectionDropped" | "ActorErrorPartition" | "SendErrorFull" | "SendErrorClosed" | "SendErrorPartition" | "SendErrorStaleRef" | "SendErrorLocalShutdown" | "SendErrorCancelled" | "SendErrorVersionMismatch" | "SendErrorUnauthorized" | "SendErrorBackpressure" | "SendErrorDead" | "DeliveryAccepted" | "DeliveryDiscarded" | "LinkErrorNoContext";
+export type RuntimeVariantRole = "OptionSome" | "OptionNone" | "ResultOk" | "ResultErr" | "ActorErrorRejected" | "ActorErrorFailed" | "ActorErrorTrapped" | "ActorErrorRefused" | "CallerActor" | "CallerTask" | "CallerTimer" | "CallerNode" | "ActorErrorDead" | "ActorErrorTimedOut" | "ActorErrorNodeNotRunning" | "ActorErrorRoutingFailed" | "ActorErrorEncodeFailed" | "ActorErrorConnectionDropped" | "ActorErrorPartition" | "SendErrorFull" | "SendErrorClosed" | "SendErrorPartition" | "SendErrorStaleRef" | "SendErrorLocalShutdown" | "SendErrorCancelled" | "SendErrorVersionMismatch" | "SendErrorBackpressure" | "SendErrorDead" | "SendErrorWriteTimedOut" | "DeliveryAccepted" | "DeliveryDiscarded" | "LinkErrorNoContext";
 export declare function runtimeTag(shape: VariantShape, role: RuntimeVariantRole): number;
 export interface RuntimeFamilyEntry {
     id: number;
@@ -44,6 +44,7 @@ export interface RuntimeFamilyEntry {
 export interface ExternEntry {
     id: number;
     symbol: string;
+    native_capability?: string;
 }
 export type PlaceDecl = {
     id: number;
@@ -75,15 +76,27 @@ export type PlaceDecl = {
 };
 export interface ValueCapability {
     id: number;
-    capability: "Eq" | "Hash";
+    capability: "Eq" | "Hash" | "Less" | "LessEqual" | "Greater" | "GreaterEqual";
     ty: string;
     callable?: number;
-    components?: number[];
-    variants?: number[][];
+    components?: ValueComponentCapabilities[];
+    variants?: ValueComponentCapabilities[][];
+}
+export interface ValueComponentCapabilities {
+    selected: number;
+    ordering?: {
+        less: number;
+        less_equal: number;
+        greater: number;
+        greater_equal: number;
+    };
 }
 export interface ClosureShape {
     id: number;
-    body: number;
+    entries: Array<{
+        body: number;
+        specialization: number | null;
+    }>;
     fields: number;
 }
 export interface VtableShape {
@@ -93,6 +106,7 @@ export interface VtableShape {
         method: string;
         callee: number;
         receiver: BoundaryDecision;
+        receiver_handback?: boolean;
     }>;
 }
 export interface FunctionV1 {
@@ -115,6 +129,9 @@ interface OpBase {
     span?: SpanV1 | null;
 }
 export type OpV1 = (OpBase & {
+    op: "coverage.hit";
+    counter: number;
+}) | (OpBase & {
     op: "const.int";
     dst: number;
     value: string;
@@ -312,6 +329,7 @@ export type OpV1 = (OpBase & {
     op: "callable.coerce";
     dst: number;
     source: Operand;
+    specialization: number | null;
 }) | (OpBase & {
     op: "dyn.make";
     dst: number;
@@ -341,6 +359,11 @@ export type OpV1 = (OpBase & {
 }) | (OpBase & {
     op: "task_scope.close";
     scope: number;
+}) | (OpBase & {
+    op: "task.race";
+    dst: number;
+    scope: number;
+    members: Operand[];
 }) | (OpBase & {
     op: "task.spawn";
     dst: number;
@@ -407,6 +430,7 @@ export type TermV1 = (TermBase & {
 }) | (TermBase & CallShape & {
     op: "indirect.call";
     callee: BoundaryOperand;
+    specialization: number | null;
 }) | (TermBase & CallShape & {
     op: "dyn.call";
     receiver: BoundaryOperand;
@@ -414,12 +438,25 @@ export type TermV1 = (TermBase & {
 }) | (TermBase & CallShape & {
     op: "value.call";
     plan: number;
+}) | (TermBase & CallShape & {
+    op: "wire.codec";
+    codec: number;
+    format: number;
+    direction: "encode" | "decode" | "test_input";
+    decoded: {
+        shape: number;
+        ok: number;
+        error: number;
+        error_root: number;
+    } | null;
+    callbacks: Record<string, number[]>;
 }) | (TermBase & CallShape & {
     op: "runtime.call";
     family: number;
     structural?: number | null;
     callbacks?: number[];
     releases_contents?: boolean;
+    keeps_inputs_on_failure?: boolean;
     result_member_shapes?: Array<number | null>;
     result_shape: number | null;
 }) | (TermBase & CallShape & {
@@ -436,10 +473,6 @@ export type TermV1 = (TermBase & {
     };
     result_shape: number | null;
     error_shape: number | null;
-}) | (TermBase & CallShape & {
-    op: "wire.codec";
-    direction: string;
-    plan: number;
 }) | (TermBase & {
     op: "panic";
     message: BoundaryOperand;
@@ -498,7 +531,7 @@ export interface EntryPlan {
 export interface ActorProtocol {
     actor: number;
     message: number;
-    policy: "reject" | "wait" | "drop_newest" | "replace_latest";
+    policy: "reject" | "wait" | "drop_newest";
     sealed: boolean;
 }
 export type ActorOperation = {
@@ -558,7 +591,6 @@ export interface ActorShape {
         keys: Array<{
             message: number;
             param: number;
-            kind: string;
         }>;
     };
     max_heap_bytes?: number;
@@ -582,6 +614,7 @@ export interface SupervisorShape {
     }>;
 }
 export interface PackageV1 {
+    codecs?: string[];
     resources?: Array<{
         kind: string;
         ty?: string;

package/dist/interpreter/v1/shims.js

@@ -6,7 +6,7 @@
 /// reject list to keep in step with this one. `FileRead` is refused by its
 /// absence, and a `NativeIo` suspension by an operation missing from
 /// [`SUPPORTED_NATIVE_IO`].
-import { UNIT, cloneValue, renderStdout } from "../values.js";
+import { UNIT, cloneValue, compareUtf8, renderStdout, } from "../values.js";
 import { seededMt } from "./mt19937.js";
 /// A language-visible fault raised inside a shim. The executor routes it to the
 /// call's `unwind` edge, or ends the program when the call names none.
@@ -29,6 +29,8 @@ export function resolveRuntimeShim(entry) {
                     throw new Error("SupervisorPool requires its resumable executor");
                 }
                 : undefined;
+        case "ActorCaller":
+        case "ActorRefusalLog":
         case "StructuralFormat":
             return () => {
                 throw new Error("StructuralFormat requires its resumable executor");
@@ -60,7 +62,11 @@ export function resolveRuntimeShim(entry) {
                 ? () => {
                     throw new Error("array mutation requires its resumable executor");
                 }
-                : undefined;
+                : entry.detail === "IndexBorrow"
+                    ? (_host, args) => sequenceElement(args)
+                    : ["Len", "Index"].includes(String(entry.detail))
+                        ? VECTOR_SHIMS[detailName(entry.detail)]
+                        : undefined;
         case "Map":
         case "Set":
             return [
@@ -85,6 +91,12 @@ export function resolveRuntimeShim(entry) {
                 : undefined;
         case "MathIntrinsic":
             return MATH_SHIMS[detailName(entry.detail)];
+        case "FloatMethod":
+            return FLOAT_METHOD_SHIMS[detailName(entry.detail)];
+        case "IntMethod":
+            return intMethodShim(entry.detail);
+        case "IntArith":
+            return intArithShim(entry.detail);
         default:
             return UNIT_FAMILY_SHIMS[entry.family];
     }
@@ -105,10 +117,10 @@ export const SUPPORTED_SUSPEND_KINDS = new Set([
     "StreamSend",
     "StreamNext",
 ]);
-/// The `NativeIo` operations the VM serves. A standard input line comes from
-/// the replay stdin; every file and socket operation stays native.
+/// The VM serves replay standard input and in-memory sink closure.
 export const SUPPORTED_NATIVE_IO = new Set([
     "StdinReadLine",
+    "SinkFinish",
 ]);
 // ── families ────────────────────────────────────────────────────────────────
 /// `Print { kind, newline }`. The rendering follows the value's own
@@ -149,10 +161,6 @@ const UNIT_FAMILY_SHIMS = {
         host.closePipe(arg(args, 0));
         return UNIT;
     },
-    SinkFinish: (host, args) => {
-        host.pipes.close(arg(args, 0));
-        return UNIT;
-    },
     StreamClose: (host, args) => {
         host.closePipe(arg(args, 0));
         return UNIT;
@@ -160,9 +168,20 @@ const UNIT_FAMILY_SHIMS = {
     StringConcat: (_host, args) => str(`${text(args, 0)}${text(args, 1)}`),
     StringClone: (_host, args) => str(text(args, 0)),
     StringEquals: (_host, args) => bool(text(args, 0) === text(args, 1)),
+    StringCompare: (_host, args) => int(BigInt(compareUtf8(text(args, 0), text(args, 1)))),
     StringContains: (_host, args) => bool(text(args, 0).includes(text(args, 1))),
+    StringTrim: (_host, args) => str(text(args, 0).replace(/^\p{White_Space}+|\p{White_Space}+$/gu, "")),
     // Native string length counts codepoints, not bytes.
     StringLen: (_host, args) => int(BigInt([...text(args, 0)].length)),
+    StringIndex: (_host, args) => {
+        const chars = [...text(args, 0)];
+        const at = index(args, 1);
+        if (at < 0 || at >= chars.length) {
+            throw new ShimFault("vector_bounds", `string index ${at} out of bounds for length ${chars.length}`);
+        }
+        return str(chars[at]);
+    },
+    StringIsEmpty: (_host, args) => bool(text(args, 0).length === 0),
     StringReplace: (_host, args) => str(text(args, 0).split(text(args, 1)).join(text(args, 2))),
     // Native slicing is by codepoint and clamps rather than trapping.
     StringSlice: (_host, args) => {
@@ -183,8 +202,63 @@ const UNIT_FAMILY_SHIMS = {
     // TextDecoder replaces each maximal invalid subsequence with U+FFFD, as
     // native lossy decoding does.
     BytesDecodeUtf8Lossy: (_host, args) => str(decodeUtf8(arg(args, 0))),
+    BytesNew: () => ({ kind: "vector", elementType: "u8", items: [] }),
     BytesIsEmpty: (_host, args) => bool(vec(args, 0).items.length === 0),
     BytesLen: (_host, args) => int(BigInt(vec(args, 0).items.length)),
+    BytesContains: (_host, args) => {
+        const byte = integer(args, 1);
+        return bool(vec(args, 0).items.some((item) => integer([item], 0) === byte));
+    },
+    BytesIndex: (_host, args) => {
+        const items = vec(args, 0).items;
+        const at = index(args, 1);
+        if (at < 0 || at >= items.length) {
+            throw new ShimFault("vector_bounds", `bytes index ${at} out of bounds for length ${items.length}`);
+        }
+        return cloneValue(items[at]);
+    },
+    // A native bytes range shares the buffer; a VM value is never aliased, so
+    // a copy is observably the same.
+    BytesSlice: (_host, args) => {
+        const items = vec(args, 0).items;
+        const start = index(args, 1);
+        const end = index(args, 2);
+        checkSliceBounds(start, end, items.length);
+        return byteVector(items.slice(start, end));
+    },
+    BytesSliceFrom: (_host, args) => {
+        const items = vec(args, 0).items;
+        const start = index(args, 1);
+        checkSliceBounds(start, items.length, items.length);
+        return byteVector(items.slice(start));
+    },
+    BytesConcat: (_host, args) => byteVector([...vec(args, 0).items, ...vec(args, 1).items]),
+    BytesStartsWith: (_host, args) => bool(runAt(vec(args, 0).items, vec(args, 1).items, 0)),
+    BytesEndsWith: (_host, args) => {
+        const items = vec(args, 0).items;
+        const run = vec(args, 1).items;
+        return bool(runAt(items, run, items.length - run.length));
+    },
+    // A mutating call receives its receiver by `move` and returns it.
+    BytesPush: (_host, args) => {
+        const target = vec(args, 0);
+        target.items.push(cloneValue(arg(args, 1)));
+        return target;
+    },
+    BytesSet: (_host, args) => {
+        const target = vec(args, 0);
+        const at = index(args, 1);
+        if (at < 0 || at >= target.items.length) {
+            throw new ShimFault("vector_bounds", `bytes index ${at} out of bounds for length ${target.items.length}`);
+        }
+        target.items[at] = cloneValue(arg(args, 2));
+        return target;
+    },
+    BytesClear: (_host, args) => {
+        const target = vec(args, 0);
+        target.items.length = 0;
+        return target;
+    },
     BytesGet: (host, args, shape) => {
         if (!shape) {
             throw new TypeError("BytesGet names no result shape to build its Option against");
@@ -230,6 +304,15 @@ const VECTOR_SHIMS = {
         target.items.push(arg(args, 1));
         return target;
     },
+    Remove: (_host, args) => {
+        const target = vec(args, 0);
+        const at = index(args, 1);
+        if (at < 0 || at >= target.items.length) {
+            throw new ShimFault("vector_bounds", `vector index ${at} out of bounds for length ${target.items.length}`);
+        }
+        const [item] = target.items.splice(at, 1);
+        return { kind: "record", typeId: "", fields: [target, item] };
+    },
     Get: (host, args, shape) => {
         if (!shape) {
             throw new TypeError("Vector::Get names no result shape to build its Option against");
@@ -240,19 +323,14 @@ const VECTOR_SHIMS = {
             ? host.enumValue(shape, "OptionSome", [cloneValue(items[at])])
             : host.enumValue(shape, "OptionNone", []);
     },
-    Index: (_host, args) => {
-        const items = vec(args, 0).items;
-        const at = index(args, 1);
-        if (at < 0 || at >= items.length) {
-            throw new ShimFault("vector_bounds", `vector index ${at} out of bounds for length ${items.length}`);
-        }
-        return cloneValue(items[at]);
-    },
+    Index: (_host, args) => cloneValue(sequenceElement(args)),
+    IndexBorrow: (_host, args) => sequenceElement(args),
     Len: (_host, args) => int(BigInt(vec(args, 0).items.length)),
     Slice: (_host, args) => {
         const items = vec(args, 0).items;
-        const start = Math.min(Math.max(index(args, 1), 0), items.length);
-        const end = Math.min(Math.max(index(args, 2), start), items.length);
+        const start = index(args, 1);
+        const end = index(args, 2);
+        checkSliceBounds(start, end, items.length);
         return {
             kind: "vector",
             elementType: "",
@@ -261,7 +339,8 @@ const VECTOR_SHIMS = {
     },
     SliceFrom: (_host, args) => {
         const items = vec(args, 0).items;
-        const start = Math.min(Math.max(index(args, 1), 0), items.length);
+        const start = index(args, 1);
+        checkSliceBounds(start, items.length, items.length);
         return {
             kind: "vector",
             elementType: "",
@@ -269,6 +348,30 @@ const VECTOR_SHIMS = {
         };
     },
 };
+function sequenceElement(args) {
+    const items = vec(args, 0).items;
+    const at = index(args, 1);
+    if (at < 0 || at >= items.length) {
+        throw new ShimFault("vector_bounds", `vector index ${at} out of bounds for length ${items.length}`);
+    }
+    return items[at];
+}
+function byteVector(items) {
+    return { kind: "vector", elementType: "u8", items: items.map(cloneValue) };
+}
+/// Whether `run` occurs in `items` starting at `at`.
+function runAt(items, run, at) {
+    return (at >= 0 &&
+        at + run.length <= items.length &&
+        run.every((byte, offset) => integer([items[at + offset]], 0) === integer([byte], 0)));
+}
+/// A slice outside `0 <= start <= end <= length` faults like native's
+/// `IndexOutOfBounds` rather than clamping to the valid range.
+function checkSliceBounds(start, end, length) {
+    if (start < 0 || end < start || end > length) {
+        throw new ShimFault("vector_bounds", `slice ${start}..${end} out of bounds for length ${length}`);
+    }
+}
 /// `std.math`. Native emits the LLVM intrinsic for each of these, so the
 /// mapping is to the matching IEEE operation rather than to whatever JS spells
 /// similarly: `Round` is half away from zero, `MinF64`/`MaxF64` follow
@@ -379,6 +482,176 @@ function fma(a, b, c) {
     const sumTail = product - (sum - bVirtual) + (c - bVirtual);
     return sum + (sumTail + tail);
 }
+/// `f64` classification and bit methods. Native reads the IEEE bits
+/// directly, so `IsSignNegative` tests the sign bit (true for `-0.0` and a
+/// negative NaN) rather than comparing against zero.
+const FLOAT_METHOD_SHIMS = {
+    ToBits: (_host, args) => int(toBits(real(args, 0))),
+    IsNan: (_host, args) => bool(Number.isNaN(real(args, 0))),
+    IsFinite: (_host, args) => bool(Number.isFinite(real(args, 0))),
+    IsInfinite: (_host, args) => {
+        const value = real(args, 0);
+        return bool(value === Infinity || value === -Infinity);
+    },
+    IsSignNegative: (_host, args) => bool(toBits(real(args, 0)) >> 63n === 1n),
+};
+/// The receiver width an `IntMethod`/`IntArith` detail names. The VM is a
+/// 64-bit target, so the pointer-sized widths are 64 bits wide.
+const INT_WIDTHS = {
+    I8: { bits: 8, signed: true },
+    I16: { bits: 16, signed: true },
+    I32: { bits: 32, signed: true },
+    I64: { bits: 64, signed: true },
+    Isize: { bits: 64, signed: true },
+    U8: { bits: 8, signed: false },
+    U16: { bits: 16, signed: false },
+    U32: { bits: 32, signed: false },
+    U64: { bits: 64, signed: false },
+    Usize: { bits: 64, signed: false },
+};
+/// `[op, width]`, as `RuntimeCallFamily` serializes a two-field variant.
+function intDetail(detail) {
+    if (!Array.isArray(detail) || detail.length !== 2) {
+        return undefined;
+    }
+    const [op, width] = detail;
+    const shape = typeof width === "string" ? INT_WIDTHS[width] : undefined;
+    return typeof op === "string" && shape ? [op, shape] : undefined;
+}
+function wrapTo(width, value) {
+    return width.signed
+        ? BigInt.asIntN(width.bits, value)
+        : BigInt.asUintN(width.bits, value);
+}
+function intBounds(width) {
+    const bits = BigInt(width.bits);
+    return width.signed
+        ? [-(1n << (bits - 1n)), (1n << (bits - 1n)) - 1n]
+        : [0n, (1n << bits) - 1n];
+}
+function popcount(value) {
+    let count = 0n;
+    for (let rest = value; rest !== 0n; rest >>= 1n) {
+        count += rest & 1n;
+    }
+    return count;
+}
+/// Integer bit methods. Native emits `ctpop`/`ctlz`/`cttz`/`bswap`/
+/// `bitreverse`/`fshl`/`fshr` at the receiver's width, so every operation
+/// works on the receiver's unsigned bit pattern and the rotate amount is taken
+/// modulo the width.
+function intMethodShim(detail) {
+    const parsed = intDetail(detail);
+    if (!parsed) {
+        return undefined;
+    }
+    const [op, width] = parsed;
+    const bits = BigInt(width.bits);
+    const unsigned = (args) => BigInt.asUintN(width.bits, integer(args, 0));
+    const result = (pattern) => int(wrapTo(width, pattern));
+    const rotate = (args, left) => {
+        const pattern = unsigned(args);
+        const amount = BigInt.asUintN(32, integer(args, 1)) % bits;
+        const shift = left ? amount : (bits - amount) % bits;
+        return result((pattern << shift) | (pattern >> ((bits - shift) % bits)));
+    };
+    switch (op) {
+        case "CountOnes":
+            return (_host, args) => int(popcount(unsigned(args)));
+        case "CountZeros":
+            return (_host, args) => int(bits - popcount(unsigned(args)));
+        case "LeadingZeros":
+            return (_host, args) => {
+                const pattern = unsigned(args);
+                return int(pattern === 0n ? bits : bits - BigInt(pattern.toString(2).length));
+            };
+        case "TrailingZeros":
+            return (_host, args) => {
+                let pattern = unsigned(args);
+                if (pattern === 0n) {
+                    return int(bits);
+                }
+                let count = 0n;
+                while ((pattern & 1n) === 0n) {
+                    pattern >>= 1n;
+                    count += 1n;
+                }
+                return int(count);
+            };
+        case "SwapBytes":
+            return (_host, args) => {
+                let pattern = unsigned(args);
+                let swapped = 0n;
+                for (let byte = 0; byte < width.bits / 8; byte += 1) {
+                    swapped = (swapped << 8n) | (pattern & 0xffn);
+                    pattern >>= 8n;
+                }
+                return result(swapped);
+            };
+        case "ReverseBits":
+            return (_host, args) => {
+                let pattern = unsigned(args);
+                let reversed = 0n;
+                for (let bit = 0; bit < width.bits; bit += 1) {
+                    reversed = (reversed << 1n) | (pattern & 1n);
+                    pattern >>= 1n;
+                }
+                return result(reversed);
+            };
+        case "RotateLeft":
+            return (_host, args) => rotate(args, true);
+        case "RotateRight":
+            return (_host, args) => rotate(args, false);
+        default:
+            return undefined;
+    }
+}
+/// Non-trapping integer arithmetic at the receiver's width: wrapping keeps
+/// the low bits, saturating clamps to the width's bounds and checked answers
+/// `None` where native's overflow flag is set.
+function intArithShim(detail) {
+    const parsed = intDetail(detail);
+    if (!parsed) {
+        return undefined;
+    }
+    const [kind, width] = parsed;
+    const [min, max] = intBounds(width);
+    const operations = {
+        Add: (x, y) => x + y,
+        Sub: (x, y) => x - y,
+        Mul: (x, y) => x * y,
+    };
+    const mode = ["Wrapping", "Saturating", "Checked"].find((prefix) => kind.startsWith(prefix));
+    const apply = mode ? operations[kind.slice(mode.length)] : undefined;
+    if (!mode || !apply) {
+        return undefined;
+    }
+    const exact = (args) => apply(wrapTo(width, integer(args, 0)), wrapTo(width, integer(args, 1)));
+    switch (mode) {
+        case "Wrapping":
+            return (_host, args) => int(wrapTo(width, exact(args)));
+        case "Saturating":
+            return (_host, args) => {
+                const value = exact(args);
+                return int(value < min ? min : value > max ? max : value);
+            };
+        default:
+            return (host, args, shape) => {
+                if (!shape) {
+                    throw new TypeError("checked arithmetic names no result shape to build its Option against");
+                }
+                const value = exact(args);
+                return value < min || value > max
+                    ? host.enumValue(shape, "OptionNone", [])
+                    : host.enumValue(shape, "OptionSome", [int(value)]);
+            };
+    }
+}
+function toBits(value) {
+    const view = new DataView(new ArrayBuffer(8));
+    view.setFloat64(0, value);
+    return view.getBigUint64(0);
+}
 function fromBits(bits) {
     const view = new DataView(new ArrayBuffer(8));
     view.setBigUint64(0, BigInt.asUintN(64, bits));

package/dist/interpreter/v1/validate.js

@@ -13,6 +13,7 @@ const UNSUPPORTED = "sandbox.capability.unsupported";
 const NATIVE_FAMILIES = new Set(["AsyncIo", "FileRead", "Tcp"]);
 const NATIVE_SUSPENSIONS = new Set(["NativeIo", "RemoteAsk", "Read", "Accept"]);
 const OPS = new Set([
+    "coverage.hit",
     "const.int",
     "const.bool",
     "const.float",
@@ -63,6 +64,7 @@ const OPS = new Set([
     "task_scope.enter",
     "task_scope.close",
     "task.spawn",
+    "task.race",
 ]);
 const TERMS = new Set([
     "goto",
@@ -77,6 +79,7 @@ const TERMS = new Set([
     "runtime.call",
     "extern.call",
     "value.call",
+    "wire.codec",
     "panic",
     "checked_raise",
     "trap",
@@ -151,11 +154,34 @@ export function admitPackage(pkg) {
         for (const block of function_.blocks) {
             if (block.ops.some((op) => op.op === "actor.ingress_adapter"))
                 return unavailable("actor.ingress_adapter");
-            if (String(block.term.op) === "wire.codec")
-                return unavailable("wire.codec");
+            if (block.term.op === "wire.codec" &&
+                (!Number.isSafeInteger(block.term.codec) ||
+                    block.term.codec < 0 ||
+                    typeof pkg.codecs?.[block.term.codec] !== "string" ||
+                    ![0, 1, 2, 3, 4].includes(block.term.format) ||
+                    !["encode", "decode", "test_input"].includes(block.term.direction)))
+                return {
+                    category: "invalid_package",
+                    code: "sandbox.package.invalid_codec",
+                    capability: "wire.codec",
+                    message: "codec call lacks its checked shape or format",
+                    span: null,
+                };
             if (block.term.op === "actor.call" &&
                 !ACTOR_OPS.has(block.term.operation.op))
                 return unavailable(`actor.${block.term.operation.op}`);
+            if (block.ops.some((op) => op.op === "coverage.hit" &&
+                (!Number.isSafeInteger(op.counter) ||
+                    op.counter < 0 ||
+                    op.counter > 0xffff_ffff))) {
+                return {
+                    category: "invalid_package",
+                    code: "sandbox.package.invalid_counter",
+                    capability: "coverage.hit",
+                    message: "coverage counter must be a u32",
+                    span: null,
+                };
+            }
             const unknown = block.ops.find((op) => !OPS.has(op.op))?.op ??
                 (!TERMS.has(block.term.op) ? block.term.op : null);
             if (unknown)
@@ -208,11 +234,14 @@ export function admitPackage(pkg) {
     }
     for (const entry of pkg.externs) {
         if (!resolveExternShim(entry.symbol)) {
+            const native = entry.native_capability;
             return {
-                category: "not_implemented",
+                category: native === undefined ? "not_implemented" : "native_only",
                 code: UNSUPPORTED,
                 capability: entry.symbol,
-                message: "This external-library operation is not available in the browser runtime yet.",
+                message: native === undefined
+                    ? "This external-library operation is not available in the browser runtime yet."
+                    : `${native} require native execution.`,
                 span: null,
             };
         }