@hoardodile/host 0.1.0 → 0.1.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hoardodile/host",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "license": "MIT",
   "description": "hoardodile plugin runtime host: sandbox, hook strategy, ResourceAPI, containers and the test runner.",
   "keywords": [
@@ -67,11 +67,11 @@
     "file-type": "^22.0.2",
     "yauzl": "^3.4.0",
     "yazl": "^3.3.1",
-    "@hoardodile/sdk-types": "0.1.0"
+    "@hoardodile/sdk-types": "0.1.1"
   },
   "optionalDependencies": {
     "@derhuerst/ffprobe-static": "^5.3.0",
-    "@hoardodile/7z-bin": "^1.1.0",
+    "@hoardodile/7z-bin": "^1.1.3",
     "ffmpeg-static": "^5.3.0"
   },
   "peerDependencies": {

package/src/sandbox/fixtures/asset-plugin.mjs

@@ -1,6 +1,7 @@
 // Sandbox fixture: exercises the plugin asset API within detect — reads
-// the vault stat, then performs a consent-gated download. Used to verify
-// the manifest permission gate and the wired plugin asset handler.
+// the vault stat, performs a consent-gated single download and a batch
+// download. Used to verify the manifest permission gate and the wired
+// plugin asset handler (single in → single out, array in → array out).
 export default {
 	detect: async (api) => {
 		const stat = await api.statAsset("runtime/a.mjs")
@@ -8,6 +9,10 @@ export default {
 			url: "https://example.com/runtime/a.mjs",
 			dest: "runtime/a.mjs",
 		})
-		return { ok: true, stat, downloaded }
+		const batched = await api.download([
+			{ url: "https://example.com/runtime/b.mjs", dest: "runtime/b.mjs" },
+			{ url: "https://example.com/runtime/c.mjs", dest: "runtime/c.mjs" },
+		])
+		return { ok: true, stat, downloaded, batched }
 	},
 }

package/src/sandbox/host.test.ts

@@ -548,12 +548,13 @@ describe("plugin sandbox", () => {
 				pluginAssets: {
 					download: async (pluginId, request) => {
 						seen.push([pluginId, request])
-						return {
-							path: request.dest,
+						const requests = Array.isArray(request) ? request : [request]
+						return requests.map((req) => ({
+							path: req.dest,
 							sizeBytes: 3,
 							sha256: "a".repeat(64),
 							cached: false,
-						}
+						}))
 					},
 					statAsset: async (pluginId, path) => {
 						seen.push([pluginId, path])
@@ -574,12 +575,27 @@ describe("plugin sandbox", () => {
 		await expect(plugin.detect(createStubApi())).resolves.toEqual({
 			ok: true,
 			stat: undefined,
+			// Single in → single result out, batch in → array out.
 			downloaded: {
 				path: "runtime/a.mjs",
 				sizeBytes: 3,
 				sha256: "a".repeat(64),
 				cached: false,
 			},
+			batched: [
+				{
+					path: "runtime/b.mjs",
+					sizeBytes: 3,
+					sha256: "a".repeat(64),
+					cached: false,
+				},
+				{
+					path: "runtime/c.mjs",
+					sizeBytes: 3,
+					sha256: "a".repeat(64),
+					cached: false,
+				},
+			],
 		})
 		expect(seen[0]).toEqual(["asset-allowed", "runtime/a.mjs"])
 		expect(seen[1]).toEqual([
@@ -589,6 +605,13 @@ describe("plugin sandbox", () => {
 				dest: "runtime/a.mjs",
 			},
 		])
+		expect(seen[2]).toEqual([
+			"asset-allowed",
+			[
+				{ url: "https://example.com/runtime/b.mjs", dest: "runtime/b.mjs" },
+				{ url: "https://example.com/runtime/c.mjs", dest: "runtime/c.mjs" },
+			],
+		])
 	})
 
 	test("a log flood exceeds the per-hook budget and fails the hook", async () => {

package/src/sandbox/host.ts

@@ -33,10 +33,15 @@ import { createSandboxedPlugin } from "./sandboxed-plugin.ts"
  * workbench) omit it and the methods answer `UNAVAILABLE`.
  */
 export type PluginAssetHandler = {
+	/**
+	 * Download one request or a batch of requests. Answers with the
+	 * result array (batch shape) — this adapter unwraps the single
+	 * result for a single request (see {@link dispatchApi}).
+	 */
 	readonly download: (
 		pluginId: string,
-		request: PluginDownloadRequest,
-	) => Promise<PluginDownloadResult>
+		request: PluginDownloadRequest | readonly PluginDownloadRequest[],
+	) => Promise<readonly PluginDownloadResult[]>
 	readonly statAsset: (
 		pluginId: string,
 		path: string,
@@ -804,13 +809,15 @@ export function createPluginSandbox(
 					return
 				}
 				// RPC boundary: the child-side proxy forwards args verbatim,
-				// so the contract order is guaranteed (request object for
-				// `download`, string path for the rest).
+				// so the contract order is guaranteed (request object or
+				// request array for `download`, string path for the rest).
 				if (method === "download") {
-					respond(
-						true,
-						await handler.download(state.id, args[0] as PluginDownloadRequest),
-					)
+					const request = args[0] as
+						| PluginDownloadRequest
+						| readonly PluginDownloadRequest[]
+					const results = await handler.download(state.id, request)
+					// Wire rule: array in → array out, single in → single out.
+					respond(true, Array.isArray(request) ? results : results[0])
 				} else if (method === "statAsset") {
 					respond(true, await handler.statAsset(state.id, args[0] as string))
 				} else if (method === "readAsset") {