@polyengine/wasi 0.4.0-pre.gebdce7f → 0.5.0

package/esm/cli_stdio.js

@@ -46,7 +46,7 @@
 //     error.
 //   * terminals: reported from the real streams' `isTTY` (injectable).
 //   * environment/arguments/cwd: the host process's, overridable.
-import { Stream } from "@polyengine/runtime/embedder";
+import { isStream } from "@polyengine/protocol";
 import { ExitError, TerminalInput, TerminalOutput, } from "./internal/cli_shared.js";
 import { FedInputStream, SinkOutputStream } from "./io.js";
 const OK = { kind: "ok" };
@@ -119,7 +119,7 @@ export function cliStdio(options = {}) {
             return OK;
         }
         catch (e) {
-            if (data instanceof Stream)
+            if (isStream(data))
                 data.drop(); // the guest's writer must not hang
             return { kind: "err", value: ioErrorCode(e) };
         }

package/esm/http.js

@@ -65,7 +65,7 @@
 // A10: case names are data, kebab-case as written, including capitals).
 // Fetch failures are TypeErrors with prose; a small sniff table maps the
 // recognizable ones and everything else is `internal-error(message)`.
-import { ComponentException, isComponentException } from "@polyengine/runtime/embedder";
+import { ComponentException, isComponentException } from "@polyengine/protocol";
 /**
  * The compatibility track the fragment registers on by default.
  *

package/esm/internal/fs_provider.js

@@ -46,13 +46,31 @@
 // from one site. Refusals use the WIT `read-only` error code.
 //
 // Two DISTINCT concerns, deliberately not merged:
-//   * per-descriptor flags (`requireWrite`) -> `bad-descriptor`: this
-//     descriptor was not opened for writing / directory mutation;
 //   * the global grant (`requireWritable`) -> `read-only`: this
-//     filesystem is read-only, whatever the descriptor says.
-// The global check runs FIRST on every mutating leaf, so a read-only
-// package answers `read-only` uniformly rather than leaking descriptor
-// bookkeeping.
+//     filesystem is read-only, whatever the descriptor says. It runs
+//     FIRST on every mutating leaf, so a read-only package answers
+//     `read-only` uniformly rather than leaking descriptor bookkeeping.
+//   * per-descriptor flags, which SPLIT by descriptor kind because the
+//     WIT dictates one half and is silent on the other:
+//       - directories (`requireDirMutate`) -> `read-only`. WIT-mandated:
+//         of `mutate-directory`, "When this flag is unset on a
+//         descriptor, operations using the descriptor which would
+//         create, rename, delete, modify the data or metadata of
+//         filesystem objects, or obtain another handle which would
+//         permit any of those, shall fail with `error-code::read-only`".
+//       - files (`requireFileWrite`) -> `bad-descriptor`. The WIT says
+//         nothing about a file descriptor opened without `write`; POSIX
+//         answers EBADF for a write on a handle not opened for writing,
+//         so we do. `mutate-directory` is NOT accepted here: the WIT
+//         says it "may only be set on directories".
+// The "obtain another handle" fragment is why `open-at` carries an
+// ESCALATION clause: through a directory descriptor without
+// `mutate-directory`, an open asking for `write`/`mutate-directory` (or
+// `create`/`truncate`/`exclusive`) is refused `read-only` — otherwise
+// the handle it mints would launder the missing permission.
+// Path-ops check kind before permission (`requireDir` first), so a
+// path-op through a FILE descriptor reports `not-directory` rather than
+// a bogus `read-only` — wasmtime's `Descriptor::dir()` ordering.
 //
 // PATHS. Guest paths are resolved TEXTUALLY: split on "/", drop "." and
 // empty segments, ".." pops (underflow = `not-permitted`), absolute
@@ -66,7 +84,7 @@
 // (filesystem_node.ts header, issue #177), so guest-created and
 // pre-existing escaping symlinks alike are refused with `not-permitted`;
 // OPFS has no symlinks, so the web backend is immune by construction.
-import { ComponentException, Stream, suspending } from "@polyengine/runtime/embedder";
+import { ComponentException, isStream, suspending } from "@polyengine/protocol";
 import { FedInputStream, IoError, OutputStream, Pollable, SinkOutputStream } from "../io.js";
 const OK03 = { kind: "ok" };
 // --- errors ----------------------------------------------------------------------
@@ -258,8 +276,9 @@ export function makeFilesystem(backend, preopens, access = {}) {
     });
     const PREOPEN_FLAGS = flagsValue({ read: true, write: true, mutateDirectory: true });
     /** The package-level grant. Refuses with the WIT `read-only` code —
-     * distinct from `requireWrite`'s per-descriptor `bad-descriptor`
-     * (module header). Called FIRST by every mutating leaf. */
+     * distinct from the per-descriptor checks (`requireDirMutate`,
+     * `requireFileWrite`; module header). Called FIRST by every mutating
+     * leaf. */
     const requireWritable = (shape) => {
         if (!writable)
             throw shape("read-only");
@@ -366,10 +385,21 @@ export function makeFilesystem(backend, preopens, access = {}) {
         if (!c.flags.read)
             throw shape("bad-descriptor");
     };
-    const requireWrite = (c, shape) => {
-        if (!c.flags.write && !c.flags.mutateDirectory)
+    /** Per-descriptor write permission on a FILE. WIT-silent; POSIX EBADF
+     * (module header). `mutate-directory` deliberately does NOT satisfy
+     * it: the WIT says that flag "may only be set on directories". */
+    const requireFileWrite = (c, shape) => {
+        if (!c.flags.write)
             throw shape("bad-descriptor");
     };
+    /** Per-descriptor mutation permission on a DIRECTORY. The WIT's
+     * `mutate-directory` doc mandates the code: operations that would
+     * create/rename/delete/modify "shall fail with
+     * `error-code::read-only`". */
+    const requireDirMutate = (c, shape) => {
+        if (!c.flags.mutateDirectory)
+            throw shape("read-only");
+    };
     // --- the 0.2 track ---------------------------------------------------------
     class DirectoryEntryStream02 {
         #entries;
@@ -402,7 +432,7 @@ export function makeFilesystem(backend, preopens, access = {}) {
             return g02(() => {
                 requireWritable(err02);
                 requireFile(this.core, err02);
-                requireWrite(this.core, err02);
+                requireFileWrite(this.core, err02);
                 let cursor = Number(offset);
                 if (backend.isSync) {
                     return syncWriteStream((chunk) => {
@@ -418,7 +448,7 @@ export function makeFilesystem(backend, preopens, access = {}) {
             return g02(() => {
                 requireWritable(err02);
                 requireFile(this.core, err02);
-                requireWrite(this.core, err02);
+                requireFileWrite(this.core, err02);
                 if (backend.isSync) {
                     return syncWriteStream((chunk) => void backend.append(this.core.h, chunk));
                 }
@@ -442,14 +472,19 @@ export function makeFilesystem(backend, preopens, access = {}) {
         setSize(size) {
             return g02(() => {
                 requireWritable(err02);
-                requireWrite(this.core, err02);
+                requireFileWrite(this.core, err02);
                 return backend.setSize(this.core.h, Number(size));
             });
         }
         setTimes(atime, mtime) {
             return g02(() => {
                 requireWritable(err02);
-                requireWrite(this.core, err02);
+                // The descriptor's OWN times: which half of the per-descriptor
+                // rule applies depends on what this descriptor IS (module header).
+                if (this.core.type === "directory")
+                    requireDirMutate(this.core, err02);
+                else
+                    requireFileWrite(this.core, err02);
                 return backend.setTimes(this.core.h, newTimestampToSpec(atime), newTimestampToSpec(mtime));
             });
         }
@@ -465,7 +500,7 @@ export function makeFilesystem(backend, preopens, access = {}) {
             return g02(() => {
                 requireWritable(err02);
                 requireFile(this.core, err02);
-                requireWrite(this.core, err02);
+                requireFileWrite(this.core, err02);
                 return chain(backend.write(this.core.h, buffer, Number(offset)), BigInt);
             });
         }
@@ -481,7 +516,8 @@ export function makeFilesystem(backend, preopens, access = {}) {
         createDirectoryAt(path) {
             return g02(() => {
                 requireWritable(err02);
-                requireWrite(this.core, err02);
+                requireDir(this.core, err02);
+                requireDirMutate(this.core, err02);
                 return backend.createDirectoryAt(this.core.h, requireFinal(parsePath(path, err02), err02));
             });
         }
@@ -494,7 +530,8 @@ export function makeFilesystem(backend, preopens, access = {}) {
         setTimesAt(pathFlags, path, atime, mtime) {
             return g02(() => {
                 requireWritable(err02);
-                requireWrite(this.core, err02);
+                requireDir(this.core, err02);
+                requireDirMutate(this.core, err02);
                 return backend.setTimesAt(this.core.h, parsePath(path, err02), pathFlags.symlinkFollow === true, newTimestampToSpec(atime), newTimestampToSpec(mtime));
             });
         }
@@ -505,14 +542,27 @@ export function makeFilesystem(backend, preopens, access = {}) {
                     throw err02("unsupported");
                 // Both ends: a two-descriptor op checked on one side only is the
                 // classic bridge bug (module header).
-                requireWrite(this.core, err02);
-                requireWrite(newDescriptor.core, err02);
+                requireDir(this.core, err02);
+                requireDirMutate(this.core, err02);
+                requireDir(newDescriptor.core, err02);
+                requireDirMutate(newDescriptor.core, err02);
                 return backend.linkAt(this.core.h, requireFinal(parsePath(oldPath, err02), err02), oldPathFlags.symlinkFollow === true, newDescriptor.core.h, requireFinal(parsePath(newPath, err02), err02));
             });
         }
         openAt(pathFlags, path, openFlags, flags) {
             return g02(() => {
                 requireOpenAllowed(openFlags, flags, err02);
+                requireDir(this.core, err02);
+                // "obtain another handle which would permit any of those" (WIT,
+                // mutate-directory): a base directory without mutate-directory
+                // cannot mint a handle that escalates. `exclusive` is included
+                // beyond the WIT's literal create/truncate to mirror the
+                // package-level `requireOpenAllowed` enumeration.
+                if (flags.write === true || flags.mutateDirectory === true ||
+                    openFlags.create === true || openFlags.truncate === true ||
+                    openFlags.exclusive === true) {
+                    requireDirMutate(this.core, err02);
+                }
                 return chain(backend.openAt(this.core.h, parsePath(path, err02), decodeOpen(pathFlags, openFlags, flags)), ({ handle, type }) => new Descriptor02(handle, type, flagsValue(flags)));
             });
         }
@@ -526,7 +576,8 @@ export function makeFilesystem(backend, preopens, access = {}) {
         removeDirectoryAt(path) {
             return g02(() => {
                 requireWritable(err02);
-                requireWrite(this.core, err02);
+                requireDir(this.core, err02);
+                requireDirMutate(this.core, err02);
                 return backend.removeDirectoryAt(this.core.h, requireFinal(parsePath(path, err02), err02));
             });
         }
@@ -534,8 +585,10 @@ export function makeFilesystem(backend, preopens, access = {}) {
             return g02(() => {
                 requireWritable(err02);
                 // Both ends (see link-at).
-                requireWrite(this.core, err02);
-                requireWrite(newDescriptor.core, err02);
+                requireDir(this.core, err02);
+                requireDirMutate(this.core, err02);
+                requireDir(newDescriptor.core, err02);
+                requireDirMutate(newDescriptor.core, err02);
                 return backend.renameAt(this.core.h, requireFinal(parsePath(oldPath, err02), err02), newDescriptor.core.h, requireFinal(parsePath(newPath, err02), err02));
             });
         }
@@ -544,7 +597,8 @@ export function makeFilesystem(backend, preopens, access = {}) {
                 requireWritable(err02);
                 if (backend.symlinkAt === undefined)
                     throw err02("unsupported");
-                requireWrite(this.core, err02);
+                requireDir(this.core, err02);
+                requireDirMutate(this.core, err02);
                 // old-path is the link CONTENTS (never validated as a lookup path).
                 return backend.symlinkAt(oldPath, this.core.h, requireFinal(parsePath(newPath, err02), err02));
             });
@@ -552,7 +606,8 @@ export function makeFilesystem(backend, preopens, access = {}) {
         unlinkFileAt(path) {
             return g02(() => {
                 requireWritable(err02);
-                requireWrite(this.core, err02);
+                requireDir(this.core, err02);
+                requireDirMutate(this.core, err02);
                 return backend.unlinkFileAt(this.core.h, requireFinal(parsePath(path, err02), err02));
             });
         }
@@ -602,7 +657,7 @@ export function makeFilesystem(backend, preopens, access = {}) {
             try {
                 requireWritable(err03);
                 requireFile(this.core, err03);
-                requireWrite(this.core, err03);
+                requireFileWrite(this.core, err03);
                 let cursor = Number(offset);
                 for await (const chunk of data) {
                     const bytes = chunk instanceof Uint8Array ? chunk : Uint8Array.from(chunk);
@@ -611,7 +666,7 @@ export function makeFilesystem(backend, preopens, access = {}) {
                 return OK03;
             }
             catch (e) {
-                if (data instanceof Stream)
+                if (isStream(data))
                     data.drop(); // the guest's writer must not hang
                 return {
                     kind: "err",
@@ -623,7 +678,7 @@ export function makeFilesystem(backend, preopens, access = {}) {
             try {
                 requireWritable(err03);
                 requireFile(this.core, err03);
-                requireWrite(this.core, err03);
+                requireFileWrite(this.core, err03);
                 for await (const chunk of data) {
                     const bytes = chunk instanceof Uint8Array ? chunk : Uint8Array.from(chunk);
                     await backend.append(this.core.h, bytes);
@@ -631,7 +686,7 @@ export function makeFilesystem(backend, preopens, access = {}) {
                 return OK03;
             }
             catch (e) {
-                if (data instanceof Stream)
+                if (isStream(data))
                     data.drop();
                 return {
                     kind: "err",
@@ -654,14 +709,19 @@ export function makeFilesystem(backend, preopens, access = {}) {
         setSize(size) {
             return g03(() => {
                 requireWritable(err03);
-                requireWrite(this.core, err03);
+                requireFileWrite(this.core, err03);
                 return backend.setSize(this.core.h, Number(size));
             });
         }
         setTimes(atime, mtime) {
             return g03(() => {
                 requireWritable(err03);
-                requireWrite(this.core, err03);
+                // The descriptor's OWN times: which half of the per-descriptor
+                // rule applies depends on what this descriptor IS (module header).
+                if (this.core.type === "directory")
+                    requireDirMutate(this.core, err03);
+                else
+                    requireFileWrite(this.core, err03);
                 return backend.setTimes(this.core.h, newTimestampToSpec(atime), newTimestampToSpec(mtime));
             });
         }
@@ -681,7 +741,8 @@ export function makeFilesystem(backend, preopens, access = {}) {
         createDirectoryAt(path) {
             return g03(() => {
                 requireWritable(err03);
-                requireWrite(this.core, err03);
+                requireDir(this.core, err03);
+                requireDirMutate(this.core, err03);
                 return backend.createDirectoryAt(this.core.h, requireFinal(parsePath(path, err03), err03));
             });
         }
@@ -694,7 +755,8 @@ export function makeFilesystem(backend, preopens, access = {}) {
         setTimesAt(pathFlags, path, atime, mtime) {
             return g03(() => {
                 requireWritable(err03);
-                requireWrite(this.core, err03);
+                requireDir(this.core, err03);
+                requireDirMutate(this.core, err03);
                 return backend.setTimesAt(this.core.h, parsePath(path, err03), pathFlags.symlinkFollow === true, newTimestampToSpec(atime), newTimestampToSpec(mtime));
             });
         }
@@ -705,14 +767,27 @@ export function makeFilesystem(backend, preopens, access = {}) {
                     throw err03("unsupported");
                 // Both ends: a two-descriptor op checked on one side only is the
                 // classic bridge bug (module header).
-                requireWrite(this.core, err03);
-                requireWrite(newDescriptor.core, err03);
+                requireDir(this.core, err03);
+                requireDirMutate(this.core, err03);
+                requireDir(newDescriptor.core, err03);
+                requireDirMutate(newDescriptor.core, err03);
                 return backend.linkAt(this.core.h, requireFinal(parsePath(oldPath, err03), err03), oldPathFlags.symlinkFollow === true, newDescriptor.core.h, requireFinal(parsePath(newPath, err03), err03));
             });
         }
         openAt(pathFlags, path, openFlags, flags) {
             return g03(() => {
                 requireOpenAllowed(openFlags, flags, err03);
+                requireDir(this.core, err03);
+                // "obtain another handle which would permit any of those" (WIT,
+                // mutate-directory): a base directory without mutate-directory
+                // cannot mint a handle that escalates. `exclusive` is included
+                // beyond the WIT's literal create/truncate to mirror the
+                // package-level `requireOpenAllowed` enumeration.
+                if (flags.write === true || flags.mutateDirectory === true ||
+                    openFlags.create === true || openFlags.truncate === true ||
+                    openFlags.exclusive === true) {
+                    requireDirMutate(this.core, err03);
+                }
                 return chain(backend.openAt(this.core.h, parsePath(path, err03), decodeOpen(pathFlags, openFlags, flags)), ({ handle, type }) => new Descriptor03(handle, type, flagsValue(flags)));
             });
         }
@@ -726,7 +801,8 @@ export function makeFilesystem(backend, preopens, access = {}) {
         removeDirectoryAt(path) {
             return g03(() => {
                 requireWritable(err03);
-                requireWrite(this.core, err03);
+                requireDir(this.core, err03);
+                requireDirMutate(this.core, err03);
                 return backend.removeDirectoryAt(this.core.h, requireFinal(parsePath(path, err03), err03));
             });
         }
@@ -734,8 +810,10 @@ export function makeFilesystem(backend, preopens, access = {}) {
             return g03(() => {
                 requireWritable(err03);
                 // Both ends (see link-at).
-                requireWrite(this.core, err03);
-                requireWrite(newDescriptor.core, err03);
+                requireDir(this.core, err03);
+                requireDirMutate(this.core, err03);
+                requireDir(newDescriptor.core, err03);
+                requireDirMutate(newDescriptor.core, err03);
                 return backend.renameAt(this.core.h, requireFinal(parsePath(oldPath, err03), err03), newDescriptor.core.h, requireFinal(parsePath(newPath, err03), err03));
             });
         }
@@ -744,14 +822,16 @@ export function makeFilesystem(backend, preopens, access = {}) {
                 requireWritable(err03);
                 if (backend.symlinkAt === undefined)
                     throw err03("unsupported");
-                requireWrite(this.core, err03);
+                requireDir(this.core, err03);
+                requireDirMutate(this.core, err03);
                 return backend.symlinkAt(oldPath, this.core.h, requireFinal(parsePath(newPath, err03), err03));
             });
         }
         unlinkFileAt(path) {
             return g03(() => {
                 requireWritable(err03);
-                requireWrite(this.core, err03);
+                requireDir(this.core, err03);
+                requireDirMutate(this.core, err03);
                 return backend.unlinkFileAt(this.core.h, requireFinal(parsePath(path, err03), err03));
             });
         }

package/esm/internal/sockets_02.js

@@ -47,7 +47,7 @@
 //     of sockets.ts) — tcp keep-alive enabled/idle-time and udp
 //     hop-limit/buffer-sizes are real where node has API, cached-getter
 //     where it has only a setter, `not-supported` where it has neither.
-import { ComponentException } from "@polyengine/runtime/embedder";
+import { ComponentException } from "@polyengine/protocol";
 import { FedInputStream, IoError, Pollable, SinkOutputStream } from "../io.js";
 import { dnsLookup, listenDatagram, tcpConnect, tcpListen, } from "./sockets_platform.js";
 import { ipHostname, isUnspecified, isValidAddressFamily, mapPlatformError, MAX_UDP_DATAGRAM_SIZE, parseNetAddr, sameSocketAddress, } from "./sockets_shared.js";

package/esm/internal/sockets_03.js

@@ -37,7 +37,7 @@ var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn,
     if (target) Object.defineProperty(target, contextIn.name, descriptor);
     done = true;
 };
-import { ComponentException, Stream, suspending } from "@polyengine/runtime/embedder";
+import { ComponentException, isStream, suspending } from "@polyengine/protocol";
 import { dnsLookup, listenDatagram, tcpConnect, tcpListen, } from "./sockets_platform.js";
 import { componentError, ipHostname, isDenoError, isUnspecified, isValidAddressFamily, mapPlatformError, MAX_UDP_DATAGRAM_SIZE, parseNetAddr, RESULT_INVALID_STATE, RESULT_OK, resultErrOf, sameSocketAddress, wildcardAddress, } from "./sockets_shared.js";
 /**
@@ -964,6 +964,6 @@ const TRANSIENT_ACCEPT_FAILURES = new Set([
  * iteration protocol itself (`for await`'s abrupt-exit `return()`).
  */
 function dropSendSource(data) {
-    if (data instanceof Stream)
+    if (isStream(data))
         data.drop();
 }

package/esm/internal/sockets_shared.js

@@ -2,7 +2,7 @@
 // (sockets_03.ts, sockets_02.ts) — not a package export; the public home
 // of these names is `@polyengine/wasi/sockets`. Address codec, wasmtime-parity
 // validation, platform error mapping, and the WIT-facing type shapes.
-import { ComponentException } from "@polyengine/runtime/embedder";
+import { ComponentException } from "@polyengine/protocol";
 /**
  * The datagram payload ceiling, matching wasmtime-wasi's
  * `MAX_UDP_DATAGRAM_SIZE` (`u16::MAX`). Larger sends fail

package/esm/io.js

@@ -79,8 +79,8 @@ var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn,
     if (target) Object.defineProperty(target, contextIn.name, descriptor);
     done = true;
 };
-import { defineBrand, POLLABLE } from "@polyengine/protocol";
-import { suspending, ComponentException } from "@polyengine/runtime/embedder";
+import { defineBrand, defineRealmLocal, POLLABLE } from "@polyengine/protocol";
+import { suspending, ComponentException } from "@polyengine/protocol";
 /** The engine setTimeout ceiling: delays above 2^31-1 ms are clamped to
  * ~0 (node/Deno warn and fire at 1 ms). `Pollable.timer` sleeps in
  * chunks of at most this and re-checks the clock at each chunk end. */
@@ -135,6 +135,10 @@ let Pollable = (() => {
         constructor(ready = () => true, wait = () => Promise.resolve()) {
             this.#ready = ready;
             this.#wait = wait;
+            // A20 realm-local pill (contracts/embedder-api.md §"Realm boundaries
+            // and structured-clone-safe forms"; issue #131): stateful handles fail
+            // loud at a raw structuredClone/postMessage instead of husking.
+            defineRealmLocal(this);
         }
         /**
          * A pollable that becomes ready at `deadline` (nanoseconds on the

package/esm/mod.js

@@ -1,6 +1,7 @@
 // `@polyengine/wasi` — the WASI providers for polyengine hosts, and the
 // executable check that the embedder conventions
-// (`@polyengine/runtime/embedder`) serve WASI (contracts/embedder-api.md C2
+// (`@polyengine/protocol`, amendment A22 — this package is protocol-only)
+// serve WASI (contracts/embedder-api.md C2
 // checklist item 7; docs/architecture.md §2 keeps implementations out of
 // the RUNTIME — this package is where they live). Scope: p2
 // baseline + p3 clocks + à la carte sockets on BOTH tracks (the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@polyengine/wasi",
-  "version": "0.4.0-pre.gebdce7f",
+  "version": "0.5.0",
   "description": "WASI providers for polyengine hosts: the p2 baseline and p3 clocks, one module per semver track.",
   "homepage": "https://github.com/polymorph-components/polyengine#readme",
   "repository": {
@@ -91,8 +91,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@polyengine/protocol": "^0.2.0",
-    "@polyengine/runtime": "0.4.0-pre.gebdce7f"
+    "@polyengine/protocol": "^0.2.2"
   },
   "_generatedBy": "dnt@0.43.2"
 }

package/types/http.d.ts

@@ -1,4 +1,4 @@
-import { Stream } from "@polyengine/runtime/embedder";
+import { type Stream } from "@polyengine/protocol";
 /**
  * The compatibility track the fragment registers on by default.
  *

package/types/internal/cli_shared.d.ts

@@ -1,4 +1,4 @@
-import { Stream } from "@polyengine/runtime/embedder";
+import type { Stream } from "@polyengine/protocol";
 /** `wasi:cli/types@0.3`'s `error-code` ENUM: bare kebab-case strings (the
  * A10 value table — enums are data strings, not `{kind}` variants; this
  * type carried a `{kind}` wrapper until 2026-08-14, a latent bug no err

package/types/internal/fs_provider.d.ts

@@ -1,4 +1,4 @@
-import { ComponentException, Stream } from "@polyengine/runtime/embedder";
+import { ComponentException, type Stream } from "@polyengine/protocol";
 import { IoError } from "../io.js";
 /** `wasi:filesystem/types.error-code` labels. 0.2 (enum): all of these,
  * bare. 0.3 (variant): all but `would-block`, as `{kind}` — this package

package/types/internal/sockets_shared.d.ts

@@ -1,4 +1,4 @@
-import { ComponentException, Stream } from "@polyengine/runtime/embedder";
+import { ComponentException, type Stream } from "@polyengine/protocol";
 import type { NetAddr } from "./sockets_platform.js";
 export type { NetAddr };
 /** `wasi:sockets/types@0.3`'s `ip-address-family` enum. */