@hew-lang/sandbox-vm 0.6.1 → 0.6.2

package/dist/interpreter/v1/validate.js

@@ -11,7 +11,7 @@
 import { SUPPORTED_NATIVE_IO, SUPPORTED_SUSPEND_KINDS, resolveExternShim, resolveRuntimeShim, } from "./shims.js";
 const UNSUPPORTED = "sandbox.capability.unsupported";
 const NATIVE_FAMILIES = new Set(["AsyncIo", "FileRead", "Tcp"]);
-const NATIVE_SUSPENSIONS = new Set(["NativeIo", "RemoteAsk", "Read", "Accept"]);
+const NATIVE_SUSPENSIONS = new Set(["NativeIo", "Read", "Accept"]);
 const OPS = new Set([
     "coverage.hit",
     "const.int",
@@ -64,6 +64,7 @@ const OPS = new Set([
     "task_scope.enter",
     "task_scope.close",
     "task.spawn",
+    "task.invoke",
     "task.race",
 ]);
 const TERMS = new Set([
@@ -92,6 +93,7 @@ const TERMS = new Set([
     "unreachable",
 ]);
 const ACTOR_OPS = new Set([
+    "identity",
     "spawn",
     "self_handle",
     "stop",
@@ -102,6 +104,7 @@ const ACTOR_OPS = new Set([
     "call_take",
     "submit",
     "stream_start",
+    "timer_schedule",
     "supervisor_spawn",
     "supervisor_child",
     "supervisor_pool_view",
@@ -114,13 +117,11 @@ function capabilityMessage(capability, native) {
         NativeIo: "Host input and output",
         Read: "Host input and output",
         Accept: "Accepting network connections",
-        RemoteAsk: "Remote actor calls",
     };
     const features = {
         Vector: "This vector operation",
         Map: "This map operation",
         Set: "This set operation",
-        "actor.periodic": "Periodic actor handlers",
         "actor.local_observation": "Actor links and monitors",
         "actor.heap_limit": "Per-actor heap limits",
         "actor.ingress_adapter": "Actor ingress adapters",
@@ -150,6 +151,7 @@ export function admitPackage(pkg) {
             span: null,
         };
     }
+    const timerResources = new Set();
     for (const function_ of pkg.functions) {
         for (const block of function_.blocks) {
             if (block.ops.some((op) => op.op === "actor.ingress_adapter"))
@@ -182,6 +184,66 @@ export function admitPackage(pkg) {
                     span: null,
                 };
             }
+            const term = block.term;
+            if (term.op === "runtime.call" &&
+                pkg.runtime_families[term.family]?.family === "BytesDecodeUtf8") {
+                const shapes = term.variant_result_shapes;
+                const error = shapes && pkg.aggregates[shapes.error];
+                const length = shapes && pkg.variants[shapes.error_len];
+                const result = term.result_shape === null
+                    ? undefined
+                    : pkg.variants[term.result_shape];
+                if (!error ||
+                    error.fields.length !== 2 ||
+                    !length ||
+                    !result ||
+                    length.runtime_tags?.OptionSome === undefined ||
+                    length.runtime_tags?.OptionNone === undefined ||
+                    result.runtime_tags?.ResultOk === undefined ||
+                    result.runtime_tags?.ResultErr === undefined)
+                    return {
+                        category: "invalid_package",
+                        code: "sandbox.package.variant_result_shapes",
+                        capability: null,
+                        message: "UTF-8 decode lacks its checked result carrier",
+                        span: null,
+                    };
+            }
+            if (term.op === "actor.call" && term.operation.op === "timer_schedule") {
+                const operation = term.operation;
+                const handler = pkg.actors
+                    ?.find((actor) => actor.id === operation.actor)
+                    ?.handlers.find((handler) => handler.message_id === operation.message);
+                const resource = pkg.resources?.[operation.resource];
+                if (!handler ||
+                    handler.streams ||
+                    term.args.length !== 5 ||
+                    !["reject", "drop_newest"].includes(operation.policy) ||
+                    resource?.kind !== "opaque" ||
+                    resource.close === undefined ||
+                    !pkg.functions.some((fn) => fn.id === resource.close))
+                    return {
+                        category: "invalid_package",
+                        code: "sandbox.package.invalid_timer",
+                        capability: "actor.timer_schedule",
+                        message: "timer schedule lacks its checked handler, timing or non-waiting admission",
+                        span: null,
+                    };
+                timerResources.add(operation.resource);
+            }
+            if (term.op === "suspend") {
+                const mandatoryClose = (pkg.resources ?? []).some((resource) => resource.close === function_.id);
+                if (term.kind === "Safepoint"
+                    ? (term.cancel == null) !== mandatoryClose
+                    : term.cancel == null)
+                    return {
+                        category: "invalid_package",
+                        code: "sandbox.package.cancellation_ancestry",
+                        capability: null,
+                        message: "safepoint cancellation ancestry must match its authored close lifecycle",
+                        span: null,
+                    };
+            }
             const unknown = block.ops.find((op) => !OPS.has(op.op))?.op ??
                 (!TERMS.has(block.term.op) ? block.term.op : null);
             if (unknown)
@@ -194,7 +256,7 @@ export function admitPackage(pkg) {
                 };
         }
     }
-    for (const resource of pkg.resources ?? []) {
+    for (const [index, resource] of (pkg.resources ?? []).entries()) {
         if (resource.kind === "record" &&
             (resource.shape === undefined ||
                 !pkg.aggregates.some((shape) => shape.id === resource.shape)))
@@ -205,15 +267,49 @@ export function admitPackage(pkg) {
                 message: "record resource has no exact aggregate shape",
                 span: null,
             };
-        if (resource.kind === "opaque")
+        if (resource.kind === "opaque" && !timerResources.has(index))
             return unavailable("resource.opaque_close");
         if (resource.kind === "nominal" &&
             !resolveExternShim(resource.release ?? ""))
             return unavailable("resource.external_close");
     }
     for (const actor of pkg.actors ?? []) {
-        if (actor.handlers.some((handler) => handler.every_ns != null))
-            return unavailable("actor.periodic");
+        if (typeof actor.name !== "string" || actor.name.length === 0)
+            return {
+                category: "invalid_package",
+                code: "sandbox.package.actor_name",
+                capability: null,
+                message: "actor lacks its declared diagnostic name",
+                span: null,
+            };
+        if (actor.crash != null &&
+            (actor.crash_info == null ||
+                !pkg.aggregates[actor.crash_info] ||
+                actor.crash_kind == null ||
+                !pkg.variants[actor.crash_kind] ||
+                actor.crash_action == null ||
+                !pkg.variants[actor.crash_action]))
+            return {
+                category: "invalid_package",
+                code: "sandbox.package.crash_hook_shapes",
+                capability: null,
+                message: "crash hook lacks its exact info, kind or action shape",
+                span: null,
+            };
+        if (actor.handlers.some((handler) => handler.every_ns != null &&
+            (!Number.isInteger(handler.every_ns) ||
+                handler.every_ns < 1_000_000 ||
+                handler.params !== 0 ||
+                handler.streams ||
+                handler.fallible ||
+                !pkg.functions.some((fn) => fn.id === handler.callable && fn.params.length === 1))))
+            return {
+                category: "invalid_package",
+                code: "sandbox.package.invalid_periodic",
+                capability: "actor.periodic",
+                message: "periodic handler lacks its checked interval or zero-argument body",
+                span: null,
+            };
         if (actor.exit != null || actor.down != null)
             return unavailable("actor.local_observation");
         if (actor.max_heap_bytes != null)

package/dist/interpreter/v1/value-operations.d.ts

@@ -1,6 +1,9 @@
-import { type VmValue } from "../values.js";
+import { type VmValue, type RcOwner } from "../values.js";
 import { type PackageV1 } from "./package.js";
 export type ValueRequest = {
+    kind: "fault";
+    message: string;
+} | {
     kind: "call";
     callee: number;
     args: VmValue[];
@@ -13,7 +16,7 @@ export type ValueProgram = Generator<ValueRequest, VmValue, VmValue>;
 /** Execute the exact checked plan, including every derived component selection.
  * A user method yields to an ordinary VM frame and can suspend or fail. */
 export declare function selectedValue(pkg: PackageV1, id: number, args: VmValue[]): ValueProgram;
-export declare function sharedOperation(operation: string, args: VmValue[]): ValueProgram;
+export declare function sharedOperation(operation: string, args: VmValue[], owner: RcOwner | null, typeName: string, option: (value: VmValue | null) => VmValue): ValueProgram;
 /** Open-addressed collection operations preserve native callback ordering:
  * growth hashes occupied slots before probing the incoming key. Staged slots
  * borrow their owners until every fallible callback has completed. */

package/dist/interpreter/v1/value-operations.js

@@ -1,6 +1,7 @@
-import { UNIT, cloneValue, compareUtf8 } from "../values.js";
+import { UNIT, cloneValue, compareUtf8, } from "../values.js";
 import { runtimeTag, } from "./package.js";
 import { ShimFault } from "./shims.js";
+import { actorIdentical } from "./actor-identity.js";
 const OFFSET = 0xcbf29ce484222325n;
 const PRIME = 0x100000001b3n;
 const integer = (value) => ({
@@ -117,10 +118,16 @@ export function* selectedValue(pkg, id, args) {
                 bytes.every((value, i) => BigInt(value) === bits(right.items[i], "u8")));
         throw new Error("bytes ordering is outside the checked capability domain");
     }
+    if (left.kind === "actor" || left.kind === "supervisor") {
+        if (equality)
+            return boolean(actorIdentical(left, right));
+        throw new Error("actor capability is outside the checked equality domain");
+    }
     const components = plan.components ?? [];
     let fields;
     let others = [];
     let selections;
+    let vectorHashLength;
     if (left.kind === "record") {
         fields = left.fields;
         selections = components;
@@ -144,13 +151,20 @@ export function* selectedValue(pkg, id, args) {
         selections = plan.variants?.[left.tag] ?? [];
     }
     else if (left.kind === "vector") {
-        if (hash)
-            throw new Error("derived vector Hash is outside the checked capability domain");
-        if (right?.kind !== "vector" || left.items.length !== right.items.length)
-            return boolean(false);
         fields = left.items;
-        others = right.items;
-        selections = fields.map(() => components[0]);
+        if (hash) {
+            const elementSelection = components[0];
+            if (!elementSelection)
+                throw new Error("derived vector Hash lacks its checked element selection");
+            selections = fields.map(() => elementSelection);
+            vectorHashLength = fields.length;
+        }
+        else {
+            if (right?.kind !== "vector" || left.items.length !== right.items.length)
+                return boolean(false);
+            others = right.items;
+            selections = fields.map(() => components[0]);
+        }
     }
     else {
         if (hash)
@@ -159,7 +173,9 @@ export function* selectedValue(pkg, id, args) {
             return boolean(!!right && bits(left, plan.ty) === bits(right, plan.ty));
         return scalarOrdering(left, right, plan.ty, ordering);
     }
-    let state = OFFSET;
+    let state = vectorHashLength === undefined
+        ? OFFSET
+        : mix(OFFSET, BigInt(vectorHashLength));
     for (const [at, field] of fields.entries()) {
         const selection = selections[at];
         if (!selection)
@@ -247,15 +263,44 @@ function option(pkg, shape, value) {
         payload: value === undefined ? [] : [value],
     };
 }
-export function* sharedOperation(operation, args) {
-    if (operation === "RcNew")
-        return { kind: "rc", cell: { value: args[0], refs: 1 }, closed: false };
+export function* sharedOperation(operation, args, owner, typeName, option) {
+    if (operation === "RcNew") {
+        if (owner?.closed)
+            throw new Error("Rc allocation after actor cleanup quiesced");
+        const cell = {
+            value: args[0],
+            refs: 1,
+            weak: 0,
+            dying: false,
+            owner,
+            typeName,
+        };
+        owner?.blocks.add(cell);
+        return { kind: "rc", cell, closed: false };
+    }
     const receiver = args[0];
+    if (operation === "WeakCloneRc" || operation === "WeakUpgradeRc") {
+        if (receiver?.kind !== "weak" || receiver.closed)
+            throw new Error("shared operation has no live Weak");
+        if (operation === "WeakCloneRc")
+            return cloneValue(receiver);
+        if (receiver.cell.dying || receiver.cell.refs === 0)
+            return option(null);
+        receiver.cell.refs += 1;
+        return option({ kind: "rc", cell: receiver.cell, closed: false });
+    }
     if (receiver?.kind !== "rc" || receiver.closed)
         throw new Error("shared operation has no live Rc");
+    if (!receiver.cell || receiver.cell.dying) {
+        yield { kind: "fault", message: "Rc payload is being released" };
+        return UNIT;
+    }
     switch (operation) {
         case "RcClone":
             return cloneValue(receiver);
+        case "RcDowngrade":
+            receiver.cell.weak += 1;
+            return { kind: "weak", cell: receiver.cell, closed: false };
         case "RcGet":
             return cloneValue(receiver.cell.value);
         case "RcIsUnique":
@@ -263,7 +308,7 @@ export function* sharedOperation(operation, args) {
         case "RcStrongCount":
             return integer(BigInt(receiver.cell.refs));
         case "RcWeakCount":
-            return integer(0n);
+            return integer(BigInt(receiver.cell.weak));
         case "RcSet": {
             const old = receiver.cell.value;
             receiver.cell.value = args[1];

package/dist/interpreter/values.d.ts

@@ -1,10 +1,26 @@
 import type { JsonValue } from "./types.js";
+import { IndexedString } from "./strings.js";
+export { stringValue } from "./strings.js";
+/** One creator-owned membership list; payload destruction uses the ordinary VM release path. */
+export interface RcOwner {
+    blocks: Set<RcCell>;
+    closed: boolean;
+}
+export interface RcCell {
+    value: VmValue;
+    refs: number;
+    weak: number;
+    dying: boolean;
+    owner: RcOwner | null;
+    typeName: string;
+}
 export type VmValue = {
     kind: "rc";
-    cell: {
-        value: VmValue;
-        refs: number;
-    };
+    cell: RcCell | null;
+    closed: boolean;
+} | {
+    kind: "weak";
+    cell: RcCell;
     closed: boolean;
 } | {
     kind: "unit";
@@ -17,10 +33,7 @@ export type VmValue = {
 } | {
     kind: "f64";
     value: number;
-} | {
-    kind: "string";
-    value: string;
-} | {
+} | IndexedString | {
     kind: "actor";
     id: string;
 } | {
@@ -38,6 +51,11 @@ export type VmValue = {
 } | {
     kind: "task";
     id: string;
+} | {
+    kind: "timer";
+    resource: number;
+    cancel(): void;
+    closed: boolean;
 } | {
     kind: "generator";
     id: string;

package/dist/interpreter/values.js

@@ -1,3 +1,5 @@
+import { stringValue } from "./strings.js";
+export { stringValue } from "./strings.js";
 export const UNIT = { kind: "unit" };
 const UTF8_ENCODER = new TextEncoder();
 export function compareUtf8(a, b) {
@@ -18,14 +20,22 @@ export function cloneValue(value) {
         case "rc":
             if (value.closed)
                 throw new Error("cannot copy a released Rc");
+            if (!value.cell || value.cell.dying)
+                return { kind: "rc", cell: null, closed: false };
             value.cell.refs += 1;
             return { kind: "rc", cell: value.cell, closed: false };
+        case "weak":
+            if (value.closed)
+                throw new Error("cannot copy a released Weak");
+            value.cell.weak += 1;
+            return { kind: "weak", cell: value.cell, closed: false };
+        case "timer":
+            throw new Error("a timer cancellation handle cannot be copied");
         case "unit":
             return UNIT;
         case "bool":
         case "i64":
         case "f64":
-        case "string":
         case "actor":
         case "supervisor":
         case "monitor":
@@ -38,6 +48,8 @@ export function cloneValue(value) {
         case "duplex":
         case "function": // function values are immutable — identity clone
             return { ...value };
+        case "string":
+            return value.clone();
         case "regex":
             return {
                 kind: "regex",
@@ -106,9 +118,9 @@ export function valueFromLiteral(value) {
                 ? { kind: "i64", value: BigInt(value) }
                 : { kind: "f64", value };
         case "string":
-            return { kind: "string", value };
+            return stringValue(value);
         default:
-            return { kind: "string", value: canonicalJson(value) };
+            return stringValue(canonicalJson(value));
     }
 }
 function taggedI64Literal(value) {
@@ -192,6 +204,8 @@ export function renderF64(value) {
 }
 export function renderStdout(value) {
     switch (value.kind) {
+        case "timer":
+            return "Timer";
         case "unit":
             return "()";
         case "bool":
@@ -232,7 +246,9 @@ export function renderStdout(value) {
         case "vector":
             return canonicalJson(value.items.map((item) => toJsonValue(item)));
         case "rc":
-            return renderStdout(value.cell.value);
+            return "Rc";
+        case "weak":
+            return "Weak";
         case "map":
             return canonicalJson(mapEntriesJson(value));
         case "dyn":
@@ -245,6 +261,8 @@ export function renderStdout(value) {
 }
 export function toJsonValue(value) {
     switch (value.kind) {
+        case "timer":
+            return "Timer";
         case "unit":
             return null;
         case "bool":
@@ -280,7 +298,9 @@ export function toJsonValue(value) {
         case "vector":
             return value.items.map(toJsonValue);
         case "rc":
-            return toJsonValue(value.cell.value);
+            return "Rc";
+        case "weak":
+            return "Weak";
         case "map":
             return mapEntriesJson(value);
         case "dyn":

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@hew-lang/sandbox-vm",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "hewSource": {
-    "commit": "6a446f773391f45d2c0ce0a799240b8b9afef54e",
-    "tag": "v0.6.1",
+    "commit": "dd0911184af12136eda7e89052e5b564d56ba643",
+    "tag": "v0.6.2",
     "dirty": false
   },
   "description": "Deterministic TypeScript interpreter for the Hew educational sandbox",
@@ -21,7 +21,7 @@
     "cli/"
   ],
   "dependencies": {
-    "@hew-lang/wasm": "0.6.1"
+    "@hew-lang/wasm": "0.6.2"
   },
   "keywords": [
     "hew",