@polyengine/runtime 0.4.0-pre.g28b13d2 → 0.4.0-pre.g7fb65ed

package/esm/cabi/context.js

@@ -26,15 +26,32 @@ export class LiftLowerContext {
         this.borrowScope = borrowScope;
     }
     /**
-     * definitions.py `LiftLowerContext.reallocate` routes the call through
-     * canon_lift (reentrance bookkeeping and may_leave toggling around a
-     * guest-side realloc export). v1 simplification: call the provided realloc
-     * directly. The full path returns with the task machinery.
+     * definitions.py `LiftLowerContext.reallocate`: the guest's realloc runs
+     * with `may_leave` cleared, so a realloc that lowers an import traps
+     * (`canon_lower`'s `trap_if(not ...may_leave)`, implemented here by
+     * exec/boundary.ts `createLoweredImport`). That bracket is implemented
+     * below. What remains deferred is only the reference's routing of the call
+     * through `canon_lift`; upstream component-model PR #705 removes that
+     * routing, leaving this bracket as the whole story. polyengine issue #147.
      */
     reallocate(old, oldByteLength, alignment, newByteLength) {
         const realloc = this.opts.realloc;
         trapIf(realloc === null, "realloc required but not provided");
-        return realloc(old, oldByteLength, alignment, newByteLength);
+        // A null instance is the value-interpreter unit-test harness only
+        // (tests/support/driver.ts `mkCx`); every real runtime path constructs
+        // this context with an instance, so there is no flag to bracket.
+        if (this.inst === null) {
+            return realloc(old, oldByteLength, alignment, newByteLength);
+        }
+        assert_(this.inst.mayLeave, "realloc with may_leave already false");
+        this.inst.mayLeave = false;
+        // NO try/finally, deliberately: same bare bracket as the post-return one
+        // in intrinsics/fact_calls.ts (#91) and the reference's `assert`/restore
+        // pair. A trapping realloc skips the restore exactly as the reference
+        // does; the host-boundary unwind and instance poisoning handle the rest.
+        const ptr = realloc(old, oldByteLength, alignment, newByteLength);
+        this.inst.mayLeave = true;
+        return ptr;
     }
     allocate(alignment, byteLength) {
         return this.reallocate(0, 0, alignment, byteLength);

package/esm/embedder/mod.js

@@ -25,7 +25,7 @@ export { COPY_URL, RUNTIME_VERSION } from "./copy.js";
 // The A9 vocabulary, re-exported unchanged: embedder code needs no import
 // change, and consumers that want the multi-copy-robust spellings get them
 // from the same module they already import.
-export { copyCensus, DROPPED, ERROR_CONTEXT, FUTURE, hasBrand, INVALID_HANDLE, isDroppedError, isInvalidHandleError, isPeerTrappedError, isStreamProducerError, isSuspending, isTrap, isComponentException, PEER_TRAPPED, PROTOCOL_GENERATION, registerRuntimeCopy, RESOURCE_STATE, runtimeCopies, STREAM, STREAM_PRODUCER, SUSPENDING, TRAP, COMPONENT_EXCEPTION, } from "@polyengine/protocol";
+export { copyCensus, defineRealmLocal, DROPPED, ERROR_CONTEXT, fromCloneable, FUTURE, hasBrand, INVALID_HANDLE, isDroppedError, isInvalidHandleError, isPeerTrappedError, isRealmLocal, isStreamProducerError, isSuspending, isTrap, isComponentException, PEER_TRAPPED, PROTOCOL_GENERATION, REALM_LOCAL, registerRuntimeCopy, RESOURCE_STATE, runtimeCopies, STREAM, STREAM_PRODUCER, SUSPENDING, toCloneable, TRAP, COMPONENT_EXCEPTION, } from "@polyengine/protocol";
 export { artifactsFromEnvelope, instantiate, instantiateEmbedder, resolveArtifacts, } from "./instantiate.js";
 export { requiredImports } from "./imports.js";
 export { DroppedError, InvalidHandleError, NameCollisionError, PeerTrappedError, Trap, ComponentException, } from "./errors.js";

package/esm/embedder/resources.js

@@ -14,7 +14,7 @@
 // | host receives borrow<R> | wrapper valid for the call   | instance, mapping kept    |
 // | host passes own<R>      | wrapper invalidated          | instance registered       |
 // | host passes borrow<R>   | wrapper stays valid          | rep reused/allocated      |
-import { RESOURCE_STATE } from "@polyengine/protocol";
+import { defineRealmLocal, RESOURCE_STATE } from "@polyengine/protocol";
 import { hostDtorCall } from "../exec/boundary.js";
 import { COPY_URL, describeCrossCopy } from "./copy.js";
 import { InvalidHandleError } from "./errors.js";
@@ -33,6 +33,16 @@ import { camelCase, pascalCase } from "./casing.js";
 const STATE = RESOURCE_STATE;
 /** Base of every runtime-built guest-resource class. */
 export class GuestResource {
+    constructor() {
+        // A20 (contracts/embedder-api.md §"Realm boundaries and
+        // structured-clone-safe forms"; issue #131): guest-resource wrappers are
+        // realm-local by principle (their machinery lives in the minting
+        // copy's tables, issue #129's identity rule) — the pill makes a raw
+        // structuredClone/postMessage of one throw instead of husking. NOTE:
+        // `makeWrapper` below mints via `Object.create`, which bypasses this
+        // constructor entirely — it installs the pill itself.
+        defineRealmLocal(this);
+    }
     /** Drop the handle (alias of `[Symbol.dispose]`, so TS `using` works). */
     drop() {
         dropWrapper(this);
@@ -313,6 +323,9 @@ export function makeWrapper(
 // deno-lint-ignore no-explicit-any
 cls, rep, rt, owns) {
     const w = Object.create(cls.prototype);
+    // A20: `Object.create` bypasses `GuestResource`'s constructor, so the
+    // realm-local pill is installed explicitly here (see that constructor).
+    defineRealmLocal(w);
     initWrapper(w, {
         rep,
         valid: true,

package/esm/embedder/streams.js

@@ -10,7 +10,7 @@
 import { despecialize } from "../cabi/types.js";
 import { hostFuture, hostFutureFor, hostStream, hostStreamFor, } from "../exec/host_streams.js";
 import { CopyResult, dropSharedForTeardown, poisonFailureOf, } from "../task/mod.js";
-import { defineBrand, ERROR_CONTEXT, FUTURE, hasBrand, isStreamProducerError, STREAM, StreamProducerError, } from "@polyengine/protocol";
+import { defineBrand, defineRealmLocal, ERROR_CONTEXT, FUTURE, hasBrand, isStreamProducerError, STREAM, StreamProducerError, } from "@polyengine/protocol";
 import { describeCrossCopy } from "./copy.js";
 import { DroppedError, PeerTrappedError } from "./errors.js";
 // `StreamProducerError`'s canonical definition moved to `@polyengine/protocol`
@@ -102,6 +102,11 @@ export class Stream {
     constructor(host, codec) {
         this.#host = host;
         this.#codec = codec;
+        // A20 (contracts/embedder-api.md §"Realm boundaries and
+        // structured-clone-safe forms"; issue #131): the realm-local pill —
+        // stateful handles must fail loud (DataCloneError) at a raw
+        // structuredClone/postMessage instead of husking silently.
+        defineRealmLocal(this);
     }
     /** Wrap a stream value that was lifted out of a guest. */
     static fromLifted(value, codec) {
@@ -295,6 +300,8 @@ export class StreamWriter {
     #stream;
     constructor(stream) {
         this.#stream = stream;
+        // A20 realm-local pill (see Stream's constructor above for rationale).
+        defineRealmLocal(this);
     }
     /**
      * Offer values; resolves with how many the reader took.
@@ -376,6 +383,8 @@ export class Future {
         this.#host = host;
         this.#hostP = hostP;
         this.#codec = codec;
+        // A20 realm-local pill (see Stream's constructor above for rationale).
+        defineRealmLocal(this);
     }
     static fromLifted(value, codec) {
         const h = hostFutureFor(value);
@@ -527,6 +536,12 @@ export class ErrorContext {
     constructor(internal) {
         this.internal = internal;
         this.message = internal.debugMessage;
+        // A20 realm-local pill (see Stream's constructor above for rationale).
+        // Note: envelope-encodable brands take precedence over the pill at
+        // toCloneable time (ErrorContext carries both ERROR_CONTEXT and the
+        // pill; it encodes) — the pill here is only the backstop for raw
+        // structuredClone/postMessage that skips toCloneable.
+        defineRealmLocal(this);
     }
 }
 // A9 brands (contracts/embedder-api.md §"Module identity"): the three

package/esm/embedder/values.js

@@ -263,11 +263,20 @@ export function fromHost(v, t, o, inOption = false) {
             }
             if (v instanceof InternalErrorContext)
                 return v;
-            // Branded but not ours (amendment A9): an `ErrorContext` minted by
-            // another runtime copy. It is stateful (it lives in that copy's handle
-            // table), so it can never be lowered here — but "recognized and named"
-            // beats the generic "expected an ErrorContext" that sent issue #83
-            // hunting in the wrong direction.
+            // A20 (contracts/embedder-api.md §"Error-context is message-valued";
+            // issue #131; definitions.py — an error-context's state is exactly
+            // its debug message): a branded carrier of a string `message`, from
+            // any copy (or hand-rolled), is accepted by minting a FRESH local
+            // context — never "the same" one, since there is nothing to alias.
+            if (hasBrand(v, ERROR_CONTEXT) &&
+                typeof v.message === "string") {
+                return new InternalErrorContext(v.message);
+            }
+            // Branded but no string `message` (amendment A9, superseded above only
+            // for the message-valued case): a genuinely foreign stateful handle —
+            // it lives in another copy's handle table, so it can never be lowered
+            // here — but "recognized and named" beats the generic "expected an
+            // ErrorContext" that sent issue #83 hunting in the wrong direction.
             if (hasBrand(v, ERROR_CONTEXT)) {
                 throw new TypeError(`${o.where}: ${describeCrossCopy("this error-context")}`);
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@polyengine/runtime",
-  "version": "0.4.0-pre.g28b13d2",
+  "version": "0.4.0-pre.g7fb65ed",
   "description": "A WebAssembly Component Model host for JavaScript engines: plan executor, canonical ABI, 0.3 task scheduler, JSPI bridge, and embedder API.",
   "homepage": "https://github.com/polymorph-components/polyengine#readme",
   "repository": {

package/types/cabi/context.d.ts

@@ -49,10 +49,13 @@ export declare class LiftLowerContext {
     borrowScope: SubtaskBorrowScope | TaskBorrowScope | null;
     constructor(opts: LiftLowerOptions, inst?: ComponentInstanceLike | null, borrowScope?: SubtaskBorrowScope | TaskBorrowScope | null);
     /**
-     * definitions.py `LiftLowerContext.reallocate` routes the call through
-     * canon_lift (reentrance bookkeeping and may_leave toggling around a
-     * guest-side realloc export). v1 simplification: call the provided realloc
-     * directly. The full path returns with the task machinery.
+     * definitions.py `LiftLowerContext.reallocate`: the guest's realloc runs
+     * with `may_leave` cleared, so a realloc that lowers an import traps
+     * (`canon_lower`'s `trap_if(not ...may_leave)`, implemented here by
+     * exec/boundary.ts `createLoweredImport`). That bracket is implemented
+     * below. What remains deferred is only the reference's routing of the call
+     * through `canon_lift`; upstream component-model PR #705 removes that
+     * routing, leaving this bracket as the whole story. polyengine issue #147.
      */
     reallocate(old: number, oldByteLength: number, alignment: number, newByteLength: number): number;
     allocate(alignment: number, byteLength: number): number;

package/types/embedder/mod.d.ts

@@ -1,5 +1,5 @@
 export { COPY_URL, RUNTIME_VERSION } from "./copy.js";
-export { copyCensus, DROPPED, ERROR_CONTEXT, FUTURE, hasBrand, INVALID_HANDLE, isDroppedError, isInvalidHandleError, isPeerTrappedError, isStreamProducerError, isSuspending, isTrap, isComponentException, PEER_TRAPPED, PROTOCOL_GENERATION, registerRuntimeCopy, RESOURCE_STATE, type RuntimeCopy, runtimeCopies, STREAM, STREAM_PRODUCER, SUSPENDING, TRAP, COMPONENT_EXCEPTION, } from "@polyengine/protocol";
+export { copyCensus, defineRealmLocal, DROPPED, ERROR_CONTEXT, fromCloneable, FUTURE, hasBrand, INVALID_HANDLE, isDroppedError, isInvalidHandleError, isPeerTrappedError, isRealmLocal, isStreamProducerError, isSuspending, isTrap, isComponentException, PEER_TRAPPED, PROTOCOL_GENERATION, REALM_LOCAL, registerRuntimeCopy, RESOURCE_STATE, type RuntimeCopy, runtimeCopies, STREAM, STREAM_PRODUCER, SUSPENDING, toCloneable, TRAP, COMPONENT_EXCEPTION, } from "@polyengine/protocol";
 export { artifactsFromEnvelope, type ComponentArtifacts, type EmbedderInstance, type EmbedderOptions, type InstantiateSource, type UntranslatedArtifacts, instantiate, instantiateEmbedder, resolveArtifacts, } from "./instantiate.js";
 export { type FuncSummary, type ImportLeaf, type PlanLike, requiredImports } from "./imports.js";
 export { DroppedError, InvalidHandleError, NameCollisionError, PeerTrappedError, Trap, ComponentException, } from "./errors.js";

package/types/embedder/resources.d.ts

@@ -48,6 +48,7 @@ interface WrapperState {
 /** Base of every runtime-built guest-resource class. */
 export declare class GuestResource {
     [STATE]: WrapperState;
+    constructor();
     /** Drop the handle (alias of `[Symbol.dispose]`, so TS `using` works). */
     drop(): void;
     [Symbol.dispose](): void;