@polyengine/runtime 0.5.0 → 0.6.0

package/esm/embedder/resources.js

@@ -1,9 +1,9 @@
 // Resources as classes on both sides of the boundary
-// (contracts/embedder-api.md §"Resources"; C2 checklist item 3).
+// (contracts/embedder-api.md §"Resources").
 //
 // The raw boundary represents `own<R>` / `borrow<R>` as bare **reps**
 // (cabi/handles.ts `liftOwn` returns `rh.rep`; the host never holds a table
-// index). C0 findings 1-3 were embedders turning that into identity tables and
+// index). Embedders otherwise turn that into identity tables and
 // hand-transcribed `[method]…` keys by hand. Both become runtime obligations
 // here.
 //
@@ -19,14 +19,15 @@ import { hostDtorCall } from "../exec/boundary.js";
 import { COPY_URL, describeCrossCopy } from "./copy.js";
 import { InvalidHandleError } from "./errors.js";
 import { camelCase, pascalCase } from "./casing.js";
+import { markSyncCallable, syncPayloadOf } from "./sync.js";
 /**
  * Internal state of a guest-resource wrapper.
  *
- * The KEY is the process-global `polyengine.resourceState/1` brand since amendment
- * A9 (it used to be a module-local `Symbol(...)`, on the now-repealed
+ * The KEY is the process-global `polyengine.resourceState/1` brand
+ * (contracts/embedder-api.md §"Module identity": it used to be a module-local `Symbol(...)`, on the now-repealed
  * assumption that bundle and source runtimes are never mixed in one process —
  * issue #83 showed they routinely are). The state SHAPE stays strictly
- * runtime-internal, exactly as the A9 brand table notes: another copy may
+ * runtime-internal, exactly as the module identity brand table notes: another copy may
  * RECOGNIZE a wrapper, and must never read or write this object. `copyUrl` is
  * what lets this copy tell its own wrappers from a foreign copy's.
  */
@@ -34,7 +35,7 @@ const STATE = RESOURCE_STATE;
 /** Base of every runtime-built guest-resource class. */
 export class GuestResource {
     constructor() {
-        // A20 (contracts/embedder-api.md §"Realm boundaries and
+        // realm boundary (contracts/embedder-api.md §"Realm boundaries and
         // structured-clone-safe forms"; issue #131): guest-resource wrappers are
         // realm-local by principle (their machinery lives in the minting
         // copy's tables, issue #129's identity rule) — the pill makes a raw
@@ -130,7 +131,7 @@ export function initWrapper(w, state) {
  *
  * A wrapper minted by ANOTHER copy carries the same (process-global) brand key
  * but its state belongs to that copy — reading it here would be reading a
- * foreign copy's private shape (A9). So it is not a state: it is
+ * foreign copy's private shape. So it is not a state: it is
  * `undefined` here, and `requireLive` turns that into the named cross-copy
  * error rather than a misleading "not a resource handle" / "not live".
  */
@@ -141,9 +142,9 @@ export function wrapperState(w) {
     return s.copyUrl === COPY_URL ? s : undefined;
 }
 /**
- * True iff `w` carries the A9 resource-state key but is not one of ours.
+ * True iff `w` carries the module identity resource-state key but is not one of ours.
  *
- * Note the resource brand is the odd one out in the A9 table: its value is the
+ * Note the resource brand is the odd one out in the module identity table: its value is the
  * state OBJECT, not `true`, so `hasBrand` does not apply — presence of the key
  * is the recognition. Only meaningful once `wrapperState` has returned
  * `undefined`, i.e. presence here means "another copy's wrapper".
@@ -265,7 +266,7 @@ export function takeRep(w, own, what) {
  * synchronously is reported as such rather than silently returning a
  * half-built object (see the report's contract-friction list).
  */
-export function buildGuestResourceClass(spec, rt, adapt, lowerArgs) {
+export function buildGuestResourceClass(spec, rt, wrapExport, lowerArgs) {
     const className = pascalCase(spec.name);
     const cls = class extends GuestResource {
         constructor(...args) {
@@ -298,22 +299,44 @@ export function buildGuestResourceClass(spec, rt, adapt, lowerArgs) {
     for (const m of spec.methods) {
         const js = camelCase(m.member);
         const where = `${className}.${js}`;
+        // Built ONCE at class-build time (sync(): "prototype methods and statics
+        // must carry the brand at class-build time, not per call") — every
+        // instance's method call goes through this same wrapper, receiver
+        // (`self`) prepended.
+        const wrapped = wrapExport(m.raw, m.params, m.results, m.async, where);
+        const methodFn = function (...args) {
+            // params[0] is the `borrow<R>`/`own<R>` self.
+            return wrapped(this, ...args);
+        };
+        const payload = syncPayloadOf(wrapped);
+        if (payload !== undefined) {
+            // A resource method's sync form takes `self` as its first argument —
+            // exactly `wrapped`'s own synchronous form (params[0] IS self), so the
+            // "method" brand's `fn` is `payload.fn` verbatim, just re-tagged so
+            // `sync()` knows this one needs `sync(instance)` rather than being
+            // callable bare.
+            markSyncCallable(methodFn, payload.kind === "free"
+                ? { kind: "method", fn: payload.fn }
+                : payload);
+        }
         Object.defineProperty(cls.prototype, js, {
             configurable: true,
             writable: true,
-            value: function (...args) {
-                // params[0] is the `borrow<R>`/`own<R>` self.
-                return adapt(m.raw, m.params, m.results, where, [this, ...args]);
-            },
+            value: methodFn,
         });
     }
     for (const s of spec.statics) {
         const js = camelCase(s.member);
         const where = `${className}.${js} (static)`;
+        const wrapped = wrapExport(s.raw, s.params, s.results, s.async, where);
+        const staticFn = (...args) => wrapped(...args);
+        const payload = syncPayloadOf(wrapped);
+        if (payload !== undefined)
+            markSyncCallable(staticFn, payload);
         Object.defineProperty(cls, js, {
             configurable: true,
             writable: true,
-            value: (...args) => adapt(s.raw, s.params, s.results, where, args),
+            value: staticFn,
         });
     }
     return cls;
@@ -323,7 +346,7 @@ export function makeWrapper(
 // deno-lint-ignore no-explicit-any
 cls, rep, rt, owns) {
     const w = Object.create(cls.prototype);
-    // A20: `Object.create` bypasses `GuestResource`'s constructor, so the
+    // realm boundary: `Object.create` bypasses `GuestResource`'s constructor, so the
     // realm-local pill is installed explicitly here (see that constructor).
     defineRealmLocal(w);
     initWrapper(w, {

package/esm/embedder/streams.js

@@ -1,5 +1,5 @@
 // Stream / future conventions (contracts/embedder-api.md §"Streams and
-// futures"; C2 checklist item 4).
+// futures").
 //
 // The low-level seam is `exec/host_streams.ts` — `HostStream`/`HostFuture`
 // over the shared rendezvous object. This file is the *handle* layer named by
@@ -14,7 +14,7 @@ import { defineBrand, defineRealmLocal, ERROR_CONTEXT, FUTURE, hasBrand, isStrea
 import { describeCrossCopy } from "./copy.js";
 import { DroppedError, PeerTrappedError } from "./errors.js";
 // `StreamProducerError`'s canonical definition moved to `@polyengine/protocol`
-// with amendment A9 (it is an embedder-contract value: recognition must
+// with §"Module identity and @polyengine/protocol" (it is an embedder-contract value: recognition must
 // survive multiple runtime copies, issue #83). Re-exported here so every
 // existing import path is unchanged.
 export { StreamProducerError } from "@polyengine/protocol";
@@ -45,7 +45,7 @@ const producerFailures = new WeakMap();
  * shared object and raised on the next interaction with the handle.
  */
 function reportProducerFailure(host, where, cause) {
-    // Brand, not class (A9): a producer failure raised by another runtime copy
+    // Brand, not class: a producer failure raised by another runtime copy
     // must not be re-wrapped into a second layer of the same error.
     const err = isStreamProducerError(cause)
         ? cause
@@ -68,8 +68,8 @@ function throwIfFailed(value, where = "stream") {
     throwIfPeerTrapped(value, where);
 }
 /**
- * @internal — raise the recorded poisoning failure, if any (#66, amendment
- * A7). Pre-op: an operation started after the peer's instance trapped must
+ * @internal — raise the recorded poisoning failure, if any (#66,
+ * contracts/embedder-api.md §"Streams and futures"). Pre-op: an operation started after the peer's instance trapped must
  * reject rather than park forever. Post-await (with the op's outcome in
  * hand): an operation the retirement walk settled DROPPED-shaped must reject
  * rather than fake a clean end — but an op that genuinely COMPLETED before
@@ -86,12 +86,12 @@ export function isU8Element(element) {
     return element !== null && despecialize(element).kind === "u8";
 }
 /**
- * A21 (#128): the direct-access byte edges are `stream<u8>` only. A
+ * direct-access byte edge (#128): the direct-access byte edges are `stream<u8>` only. A
  * zero-width element type (`t === null`) is not u8 either.
  */
 function requireU8Direct(codec, who) {
     if (codec === null || !isU8Element(codec.element)) {
-        throw new TypeError(`${who} is available on stream<u8> only (embedder-api amendment A21, ` +
+        throw new TypeError(`${who} is available on stream<u8> only (embedder-api.md §"Streams and futures" ("Direct-access byte edges"), ` +
             `polyengine#128); use write()/read() for other element types`);
     }
 }
@@ -112,7 +112,7 @@ export class Stream {
     constructor(host, codec) {
         this.#host = host;
         this.#codec = codec;
-        // A20 (contracts/embedder-api.md §"Realm boundaries and
+        // realm boundary (contracts/embedder-api.md §"Realm boundaries and
         // structured-clone-safe forms"; issue #131): the realm-local pill —
         // stateful handles must fail loud (DataCloneError) at a raw
         // structuredClone/postMessage instead of husking silently.
@@ -183,14 +183,14 @@ export class Stream {
                 "passed to a guest yet, so it has no element type; pass it first, " +
                 "or use the writer, which parks until then");
         }
-        // Post-transfer refusal (#162, embedder-api amendment A15). Lifting
+        // Post-transfer refusal (#162, contracts/embedder-api.md §"Streams and futures"). Lifting
         // removes the handle from the source table and lowering installs it in
         // the destination's (definitions.py `lift_async_value` line 1530,
         // `lower_stream` line 1828): once this handle's shared object has been
         // passed to a guest, the guest owns the readable end and a host read here
         // would operate a phantom duplicate of it. Refuse loudly instead.
         // `StreamWriter` is deliberately unaffected — the host retains the
-        // writable end, and writing after the pass is the normal A5 pattern —
+        // writable end, and writing after the pass is the normal stream/future round-trip pattern —
         // and `drop()`/`cancelRead()` stay permissive.
         if (this.#consumed) {
             throw new TypeError("this Stream handle has already been passed to a guest; the guest " +
@@ -207,7 +207,7 @@ export class Stream {
         const raw = await host.readable.read(max);
         // An empty chunk normally means clean end-of-stream; when the peer's
         // instance trapped it means the retirement walk settled us — reject
-        // instead of faking EOS (amendment A7). A non-empty chunk was really
+        // instead of faking EOS (§"Streams and futures"). A non-empty chunk was really
         // copied before the trap and is delivered; the next read rejects.
         if (raw.length === 0)
             throwIfPeerTrapped(host.value, where);
@@ -215,7 +215,7 @@ export class Stream {
     }
     /**
      * Consume the writer's bytes in place, without an intermediate chunk
-     * (`stream<u8>` only — contracts/embedder-api.md amendment A21,
+     * (`stream<u8>` only — contracts/embedder-api.md §"Streams and futures" ("Direct-access byte edges"),
      * polyengine#128).
      *
      * At every rendezvous with a writer of nonzero capacity, `consume` runs
@@ -232,7 +232,7 @@ export class Stream {
      * writer's parked operation survives and the stream stays alive.
      *
      * Refusals mirror `read`: an unbound `Stream.create()` handle and a handle
-     * already passed to a guest (the A15 transfer guard) both throw, as does a
+     * already passed to a guest (the deadlock-verdict suppression transfer guard) both throw, as does a
      * non-`u8` element type.
      */
     async readDirect(consume) {
@@ -242,7 +242,7 @@ export class Stream {
         requireU8Direct(this.#codec, "readDirect");
         const info = { endedByVerdict: false };
         const n = await host.readable.readDirect(consume, info);
-        // A7 precision, `read`'s rule adapted: a session the CONSUMER itself
+        // loud component fault precision, `read`'s rule adapted: a session the CONSUMER itself
         // ended with `"done"` genuinely completed and keeps its resolution. Any
         // other way out (the writer dropped, the session was cancelled, the
         // retirement walk settled us) is a settle-path this consumer did not
@@ -298,7 +298,7 @@ export class Stream {
      * DROPPED event into the trapping instance's waitables, and a later
      * driving loop asserted on the corpse).
      *
-     * The arm is released on this path too (#162, amendment A15): the wrapper's
+     * The arm is released on this path too (#162, §"Streams and futures"): the wrapper's
      * `HostActivity` now closes through the shared object's drop observers,
      * which `dropSharedForTeardown` fires unconditionally — so a teardown with
      * nothing parked no longer leaves the arm outliving the stream. (This
@@ -349,7 +349,7 @@ export class StreamWriter {
     #stream;
     constructor(stream) {
         this.#stream = stream;
-        // A20 realm-local pill (see Stream's constructor above for rationale).
+        // realm boundary realm-local pill (see Stream's constructor above for rationale).
         defineRealmLocal(this);
     }
     /**
@@ -370,7 +370,7 @@ export class StreamWriter {
         const n = await host.writable.write(packChunk(values, this.#stream.codec));
         // A short take normally means "re-offer later" / "reader done"; when the
         // reader's instance trapped it means the retirement walk settled us —
-        // reject, carrying the delivered count (amendment A7). A full take
+        // reject, carrying the delivered count (§"Streams and futures"). A full take
         // genuinely completed before the trap and stays a success.
         if (n < values.length)
             throwIfPeerTrapped(host.value, where, n);
@@ -378,7 +378,7 @@ export class StreamWriter {
     }
     /**
      * Fill the reader's landing zone in place, without an intermediate chunk
-     * (`stream<u8>` only — contracts/embedder-api.md amendment A21,
+     * (`stream<u8>` only — contracts/embedder-api.md §"Streams and futures" ("Direct-access byte edges"),
      * polyengine#128).
      *
      * At every rendezvous with a reader of nonzero capacity, `produce` runs
@@ -406,7 +406,7 @@ export class StreamWriter {
         requireU8Direct(this.#stream.codec, "writeDirect");
         const info = { endedByVerdict: false };
         const n = await host.writable.writeDirect(produce, info);
-        // A7 precision, `write`'s short-take rule adapted: a session the PRODUCER
+        // loud component fault precision, `write`'s short-take rule adapted: a session the PRODUCER
         // itself ended with `"done"` keeps its resolution; every other way out is
         // a settle-path the producer did not cause, so a trapped peer rejects
         // here carrying the delivered count.
@@ -470,7 +470,7 @@ export class Future {
         this.#host = host;
         this.#hostP = hostP;
         this.#codec = codec;
-        // A20 realm-local pill (see Stream's constructor above for rationale).
+        // realm boundary realm-local pill (see Stream's constructor above for rationale).
         defineRealmLocal(this);
     }
     static fromLifted(value, codec) {
@@ -494,7 +494,6 @@ export class Future {
      * is itself PromiseLike, so `await` still works and still yields `T`), which
      * keeps `drop()`/`cancel()` reachable for a caller that does not await. The
      * alternative — resolving a Promise *to* the handle — is not expressible.
-     * Flagged in the C2 report.
      */
     static deferred(pending, codec) {
         const hostP = pending.then((v) => {
@@ -530,7 +529,7 @@ export class Future {
         return this.#host.value;
     }
     #read() {
-        // Post-transfer refusal (#162, amendment A15), the `Stream.read` mirror:
+        // Post-transfer refusal (#162, §"Streams and futures"), the `Stream.read` mirror:
         // once this handle was passed to a guest, the guest owns the readable end
         // and a host read would operate a phantom duplicate. A read MEMOIZED
         // before the transfer keeps resolving — it genuinely happened while the
@@ -546,7 +545,7 @@ export class Future {
             const { value, result } = await host.readResult();
             if (result !== CopyResult.COMPLETED) {
                 // A drop caused by the writer's instance trapping is a fault, not a
-                // "no value" outcome — brand it (#66, amendment A7).
+                // "no value" outcome — brand it (#66, §"Streams and futures").
                 throwIfPeerTrapped(host.value, this.#codec.where ?? "future read");
                 throw new DroppedError(result === CopyResult.CANCELLED
                     ? "the future read was cancelled"
@@ -623,7 +622,7 @@ export class ErrorContext {
     constructor(internal) {
         this.internal = internal;
         this.message = internal.debugMessage;
-        // A20 realm-local pill (see Stream's constructor above for rationale).
+        // realm boundary realm-local pill (see Stream's constructor above for rationale).
         // Note: envelope-encodable brands take precedence over the pill at
         // toCloneable time (ErrorContext carries both ERROR_CONTEXT and the
         // pill; it encodes) — the pill here is only the backstop for raw
@@ -631,11 +630,11 @@ export class ErrorContext {
         defineRealmLocal(this);
     }
 }
-// A9 brands (contracts/embedder-api.md §"Module identity"): the STATEFUL
+// module identity brands (contracts/embedder-api.md §"Module identity"): the STATEFUL
 // embedder-facing handle classes. Their machinery lives in the copy that
 // minted them, so the brand never makes a foreign handle usable — it makes
 // it DIAGNOSABLE, at the lowering sites below. `StreamWriter` gains its
-// brand with amendment A22 (§"The host-ABI surface and its version"):
+// brand with §"The host-ABI surface and its version" (§"The host-ABI surface and its version"):
 // writers carried none before because nothing needed to recognize one, and
 // `isStreamWriter` now does.
 defineBrand(Stream.prototype, STREAM);
@@ -651,13 +650,13 @@ defineBrand(ErrorContext.prototype, ERROR_CONTEXT);
  * footgun.
  */
 export function lowerStreamSource(src, codec) {
-    // Order matters (amendment A9). Same-copy handle: the fast path, unchanged.
+    // Order matters (§"Module identity and @polyengine/protocol"). Same-copy handle: the fast path, unchanged.
     if (src instanceof Stream) {
         return src.takeValue(codec);
     }
     // Branded but not ours: a `Stream` minted by ANOTHER runtime copy. Without
     // this check it would fall through to producer adaptation below and be
-    // pumped by its async iterator — a silent downgrade that quietly voids A5's
+    // pumped by its async iterator — a silent downgrade that quietly voids stream/future round-trip's
     // identity guarantees. Refused, loudly, naming both copies (issue #83).
     if (hasBrand(src, STREAM)) {
         throw new TypeError(describeCrossCopy("this stream handle", "To pipe it by value, pass `src.readable()` instead."));
@@ -695,11 +694,11 @@ async function pump(src, host, codec) {
     const where = codec.where ?? "stream producer";
     let failure;
     let produced = 0;
-    // A13 cancellation companion: the pump learns of the reader dropping
+    // resource stream cancellation companion: the pump learns of the reader dropping
     // through short writes, but a producer PARKED on an external event (an
     // accept-shaped source holding a live platform resource) offers no write
     // to shorten — this notification is its only stop signal. It also fires
-    // on the A7 teardown walk and on our own end-of-pump drop (harmless: the
+    // on the loud component fault teardown walk and on our own end-of-pump drop (harmless: the
     // loop has exited by then).
     const gone = new Promise((resolve) => host.writable.onDropped(() => resolve(READER_GONE)));
     try {
@@ -712,7 +711,7 @@ async function pump(src, host, codec) {
                 n = await host.writable.writeAll(lowered);
             }
             catch (e) {
-                // A13: elements past the fault's progress point were lowered but
+                // resource stream: elements past the fault's progress point were lowered but
                 // will never be taken — destroy them (an `own` element may hold a
                 // live platform resource). `PeerTrappedError.progress` reports
                 // delivered-before-the-fault; anything else delivered nothing.
@@ -722,7 +721,7 @@ async function pump(src, host, codec) {
             produced += n;
             if (n < lowered.length) {
                 // The reader went away: a clean end — but the un-taken tail of this
-                // chunk was already lowered and must be destroyed, not leaked (A13).
+                // chunk was already lowered and must be destroyed, not leaked.
                 releaseUntaken(lowered, n, codec);
                 break;
             }
@@ -744,7 +743,7 @@ async function pump(src, host, codec) {
     // been recorded on the store, so the call fails rather than resolving.
     host.writable.drop();
 }
-/** A13: destroy `lowered[taken..]` when a codec's elements hold resources. */
+/** resource stream: destroy `lowered[taken..]` when a codec's elements hold resources. */
 function releaseUntaken(lowered, taken, codec) {
     const release = codec.release;
     if (release === undefined || lowered instanceof Uint8Array)
@@ -754,13 +753,13 @@ function releaseUntaken(lowered, taken, codec) {
 }
 /**
  * Normalize every accepted producer shape to an async iterator of batches,
- * racing each pull against `gone` (A13 cancellation): when the stream dies
+ * racing each pull against `gone` (resource stream cancellation): when the stream dies
  * with the producer parked, a `ReadableStream` source is `cancel()`ed
  * through its reader, and an (async-)iterable source gets its optional
  * `cancel()` method invoked — the documented producer-cancellation hook —
  * then its pending pull is drained so a straggler element the producer
  * already minted still reaches the caller's release path. A source with no
- * cancel hook keeps the pre-A13 behavior: the pump stays parked until the
+ * cancel hook keeps the pre-resource stream behavior: the pump stays parked until the
  * producer's next element (or forever — the documented embedder-negligence
  * hang class).
  */
@@ -835,10 +834,10 @@ function isReadableStream(v) {
 export function lowerFutureSource(src, codec) {
     if (src instanceof Future)
         return src.takeValue();
-    // Branded but not ours (amendment A9). This one is the sharpest edge in the
+    // Branded but not ours (§"Module identity and @polyengine/protocol"). This one is the sharpest edge in the
     // family: `Future` is a `PromiseLike`, so a foreign future would otherwise
     // be adopted as a plain thenable and appear to work — exactly the silent
-    // path A9 bans, since the awaited value would ride the OTHER copy's
+    // path module identity bans, since the awaited value would ride the OTHER copy's
     // machinery with no handle transfer at all.
     if (hasBrand(src, FUTURE)) {
         throw new TypeError(describeCrossCopy("this future handle", "To pipe it by value, pass `Promise.resolve(f)` instead."));

package/esm/embedder/sync.js

@@ -0,0 +1,242 @@
+// `sync()` — the explicit synchronous view of a WIT-sync export (contracts/
+// embedder-api.md §"Functions and async", §"Functions and async", 2026-08-30).
+//
+// Placement: application machinery exported from
+// `@polyengine/runtime/embedder`, like `createStream` — only an instantiating
+// application holds export functions, so this is deliberately NOT host-module
+// vocabulary and does not touch `@polyengine/protocol`.
+//
+// Recognition is by brand (`polyengine.syncCallable/1`, a registry symbol per
+// module identity) so views work across mixed runtime copies. Unlike the boolean brands in
+// `@polyengine/protocol`'s `brands.ts` (whose payload is always `true`), this
+// brand carries a PAYLOAD describing the callable's synchronous form — the
+// dispatch shapes below are what `instantiate.ts` / `resources.ts` attach at
+// wrap time and what this module reads back.
+/** The registry symbol. `Symbol.for` per module identity: N runtime copies agree on it
+ * without sharing modules. */
+export const SYNC_CALLABLE = Symbol.for("polyengine.syncCallable/1");
+/**
+ * Stamp `payload` on `target` under the brand: non-enumerable, non-writable,
+ * matching `@polyengine/protocol`'s `defineBrand` (protocol/src/brands.ts) —
+ * implemented locally since the runtime does not add application-tier
+ * vocabulary to the protocol package.
+ *
+ * @internal — written by `instantiate.ts` and `resources.ts` at wrap/
+ * class-build time; not part of the public `sync()` surface.
+ */
+export function markSyncCallable(target, payload) {
+    Object.defineProperty(target, SYNC_CALLABLE, {
+        value: payload,
+        enumerable: false,
+        writable: false,
+        configurable: false,
+    });
+}
+/**
+ * Read the brand payload off `target`, or `undefined` if unbranded.
+ * Structural, like `hasBrand`: accepts a payload minted by any copy.
+ * @internal
+ */
+export function syncPayloadOf(target) {
+    if (target === null)
+        return undefined;
+    const t = typeof target;
+    if (t !== "object" && t !== "function")
+        return undefined;
+    return target[SYNC_CALLABLE];
+}
+/** Own, function-valued, branded members of `proto`'s prototype chain
+ * (stopping at `Object.prototype`), nearest wins. Used to recognize a
+ * guest-resource INSTANCE: its class's prototype carries `"method"`-branded
+ * data properties (`resources.ts` `buildGuestResourceClass`). */
+function protoBrandedMembers(proto) {
+    const out = new Map();
+    for (let o = proto; o !== null && o !== Object.prototype; o = Object.getPrototypeOf(o)) {
+        for (const key of Object.getOwnPropertyNames(o)) {
+            if (out.has(key) || key === "constructor")
+                continue;
+            const d = Object.getOwnPropertyDescriptor(o, key);
+            if (d === undefined || typeof d.value !== "function")
+                continue;
+            const p = syncPayloadOf(d.value);
+            if (p !== undefined)
+                out.set(key, p);
+        }
+    }
+    return out;
+}
+/** Own, function-valued, branded static members of a guest-resource class. */
+function ownBrandedStatics(cls) {
+    const out = new Map();
+    for (const key of Object.getOwnPropertyNames(cls)) {
+        if (key === "prototype" || key === "name" || key === "length")
+            continue;
+        const d = Object.getOwnPropertyDescriptor(cls, key);
+        if (d === undefined || typeof d.value !== "function")
+            continue;
+        const p = syncPayloadOf(d.value);
+        if (p !== undefined)
+            out.set(key, p);
+    }
+    return out;
+}
+function isResourceInstance(v) {
+    if (typeof v === "function")
+        return false; // a class, not an instance
+    const proto = Object.getPrototypeOf(v);
+    if (proto === null || proto === Object.prototype)
+        return false;
+    return protoBrandedMembers(proto).size > 0;
+}
+// deno-lint-ignore ban-types
+function isResourceClass(v) {
+    return ownBrandedStatics(v).size > 0;
+}
+function asyncMessage(name) {
+    return `sync(): '${name}' is an async-typed WIT export; async exports ` +
+        `have no synchronous form`;
+}
+function methodMessage(name) {
+    return `sync(): '${name}' is a resource method; call sync(instance) ` +
+        `instead of sync(fn) — a bare method function has no receiver to bind`;
+}
+/** Views are stable: `sync(x) === sync(x)` for the same target. */
+const views = new WeakMap();
+function memoView(key, build) {
+    const cached = views.get(key);
+    if (cached !== undefined)
+        return cached;
+    const view = build();
+    views.set(key, view);
+    return view;
+}
+/** A view member that reports its real reason (async) only when accessed —
+ * so an unrelated sync member of the same record/class/instance stays usable
+ * (see the CONTRACT note on record recursion below). */
+function throwingMember(view, key, message) {
+    Object.defineProperty(view, key, {
+        enumerable: true,
+        configurable: true,
+        get() {
+            throw new TypeError(message);
+        },
+    });
+}
+function instanceView(instance) {
+    return memoView(instance, () => {
+        const proto = Object.getPrototypeOf(instance);
+        const members = protoBrandedMembers(proto);
+        const view = {};
+        for (const [key, p] of members) {
+            if (p.kind === "method") {
+                const fn = p.fn;
+                view[key] = (...a) => fn(instance, ...a);
+            }
+            else if (p.kind === "async") {
+                throwingMember(view, key, asyncMessage(key));
+            }
+            // A "free"-kind branded proto member should not occur (methods are
+            // always branded "method" by `buildGuestResourceClass`); nothing to do
+            // if it somehow did — the instance view only ever exposes methods
+            // (statics are not reachable from an instance; §"Functions and async").
+        }
+        return view;
+    });
+}
+function classView(cls) {
+    return memoView(cls, () => {
+        const statics = ownBrandedStatics(cls);
+        const view = {};
+        for (const [key, p] of statics) {
+            if (p.kind === "free") {
+                view[key] = p.fn;
+            }
+            else if (p.kind === "async") {
+                throwingMember(view, key, asyncMessage(key));
+            }
+        }
+        return view;
+    });
+}
+/**
+ * Map one record MEMBER by the `sync(record)` recursion rule: a branded
+ * function or a nested resource class/instance/record maps recursively;
+ * anything else (including an unbranded function) passes through unchanged.
+ *
+ * CONTRACT (contracts/embedder-api.md §"Functions and async" sync(), the
+ * `sync(record)` bullet): the bullet says a record's members are "mapped by
+ * these same rules, recursively" — read most literally, an async-typed
+ * member nested in a record should behave exactly as `sync(asyncFn)` does at
+ * top level, i.e. throw. But applying that EAGERLY while building the
+ * parent's view would make one unrelated async export in a real component's
+ * exports record (a normal mix — see contracts/embedder-api.md's own async +
+ * sync export examples) poison `sync(exports)` entirely, defeating the
+ * per-use adapter's whole purpose. The conservative reading kept here defers
+ * that failure to the point the caller actually reaches for the async
+ * member (`throwingMember`), never for members the caller never touches —
+ * every failure the contract mandates still happens, just lazily.
+ */
+function mapMember(v) {
+    if (typeof v === "function") {
+        const p = syncPayloadOf(v);
+        if (p !== undefined) {
+            if (p.kind === "free")
+                return p.fn;
+            if (p.kind === "method")
+                throw new TypeError(methodMessage(v.name));
+            throw new TypeError(asyncMessage(v.name));
+        }
+        if (isResourceClass(v))
+            return classView(v);
+        return v; // unbranded function: pass through unchanged
+    }
+    if (v !== null && typeof v === "object") {
+        if (isResourceInstance(v))
+            return instanceView(v);
+        return recordView(v); // a nested (interface) record
+    }
+    return v; // primitives, null: pass through unchanged
+}
+function recordView(rec) {
+    return memoView(rec, () => {
+        const view = {};
+        for (const key of Object.keys(rec)) {
+            const d = Object.getOwnPropertyDescriptor(rec, key);
+            if (d === undefined)
+                continue;
+            const value = d.value;
+            // Lazy: `mapMember` runs (and can throw, for an async member) only
+            // when the caller actually reads this key — see the CONTRACT note on
+            // `mapMember` above.
+            Object.defineProperty(view, key, {
+                enumerable: true,
+                configurable: true,
+                get: () => mapMember(value),
+            });
+        }
+        return view;
+    });
+}
+export function sync(target) {
+    if (typeof target === "function") {
+        const p = syncPayloadOf(target);
+        if (p !== undefined) {
+            if (p.kind === "free")
+                return p.fn;
+            if (p.kind === "method") {
+                throw new TypeError(methodMessage(target.name || "<anonymous>"));
+            }
+            throw new TypeError(asyncMessage(target.name || "<anonymous>"));
+        }
+        if (isResourceClass(target))
+            return classView(target);
+        throw new TypeError(`sync(): '${target.name || "<anonymous>"}' is not a sync-callable export (unbranded function)`);
+    }
+    if (target === null || typeof target !== "object") {
+        throw new TypeError(`sync(): expected a lifted export function, guest-resource instance/` +
+            `class, or exports record; got ${target === null ? "null" : typeof target}`);
+    }
+    if (isResourceInstance(target))
+        return instanceView(target);
+    return recordView(target);
+}