@tishlang/tish-format 3.12.2 → 3.15.0

package/Cargo.toml

@@ -22,6 +22,7 @@ members = [
     "crates/tish_vm",
     "crates/tish_llvm",
     "crates/tish_ffi",
+    "crates/tish_ffi_guest",
     "crates/tish_native",
     "crates/tish_wasm",
     "crates/tish",

package/crates/tish/Cargo.toml

@@ -25,7 +25,7 @@ path = "src/main.rs"
 default = ["full", "fast-alloc"]
 # Alias: same dependency edges as `default` (kept for `--features full` in CI and docs).
 # Includes `pg` so `tish run` can resolve `import … from '@tishlang/pg'` (`cargo:tish_pg`) on the bytecode VM.
-full = ["http", "fs", "process", "regex", "ws", "timers", "tty", "pg", "test-runner"]
+full = ["http", "fs", "process", "regex", "ws", "timers", "tty", "ffi", "pg", "test-runner"]
 # Fast allocator (mimalloc) as the process `#[global_allocator]`. tish's object/array/string workloads
 # are allocation-bound (a sampling profile of object-heavy code spends ~14%+ in system malloc/free);
 # mimalloc is markedly faster for the many-small-allocations pattern — the same reason JSC ships bmalloc.
@@ -43,6 +43,8 @@ process = ["tishlang_eval/process", "tishlang_runtime/process", "tishlang_compil
 regex   = ["tishlang_eval/regex",   "tishlang_runtime/regex",   "tishlang_compile/regex",   "tishlang_vm/regex"]
 ws      = ["tishlang_eval/ws",      "tishlang_runtime/ws",      "tishlang_compile/ws",      "tishlang_vm/ws"]
 tty     = ["tishlang_eval/tty",     "tishlang_runtime/tty",     "tishlang_compile/tty",     "tishlang_vm/tty"]
+# `tish:ffi` loadModule (runtime loading of `--crate-type cdylib` modules); static `ffi:` imports need no feature.
+ffi     = ["tishlang_runtime/ffi",  "tishlang_vm/ffi"]
 # GPU compute — Apple Silicon only
 [dependencies]
 rustyline = { version = "17", features = ["with-file-history"] }

package/crates/tish/src/cli_help.rs

@@ -556,7 +556,8 @@ pub(crate) struct BuildArgs {
     /// Cross-compile to an Apple iOS triple (e.g. `aarch64-apple-ios-sim`). Implies `--crate-type staticlib`.
     #[arg(long, value_name = "TRIPLE", help_heading = "Options")]
     pub ios_triple: Option<String>,
-    /// Output artifact for `--target native` (default: `bin`; use `staticlib` for embedded iOS).
+    /// Output artifact for `--target native` (default: `bin`; `staticlib` for embedded iOS; `cdylib`
+    /// for a dynamically loadable tish FFI module whose `export fn`s any tish host can load).
     #[arg(long, value_name = "TYPE", default_value = "bin", help_heading = "Options")]
     pub crate_type: String,
     #[arg(long, help_heading = "Options")]

package/crates/tish/src/main.rs

@@ -30,7 +30,7 @@ fn normalize_capability_flags(features: &[String]) -> HashSet<String> {
     for s in features {
         for part in s.split(',').map(str::trim).filter(|p| !p.is_empty()) {
             if part == "full" {
-                for name in ["http", "timers", "fs", "process", "regex", "ws", "tty"] {
+                for name in ["http", "timers", "fs", "process", "regex", "ws", "tty", "ffi"] {
                     out.insert(name.to_string());
                 }
             } else {
@@ -1077,14 +1077,29 @@ fn build_file(
             cargo_target: None,
             emit_mode: tishlang_compile::NativeEmitMode::EmbeddedLib,
         }
+    } else if crate_type == "cdylib" {
+        if is_js {
+            return Err("--crate-type cdylib requires a .tish entry file.".to_string());
+        }
+        tishlang_native::NativeBuildConfig::ffi_module()
     } else if crate_type != "bin" {
         return Err(format!(
-            "Unknown --crate-type: {}. Use 'bin' or 'staticlib'.",
+            "Unknown --crate-type: {}. Use 'bin', 'staticlib' or 'cdylib'.",
             crate_type
         ));
     } else {
         tishlang_native::NativeBuildConfig::desktop()
     };
+    // Release builds name the triple so the binary targets the platform baseline instead of the
+    // build machine's CPU, and so one host can build each slice of a universal binary.
+    let mut build_config = build_config;
+    if build_config.cargo_target.is_none() {
+        if let Ok(triple) = std::env::var("TISH_NATIVE_CARGO_TARGET") {
+            if !triple.is_empty() {
+                build_config.cargo_target = Some(triple);
+            }
+        }
+    }
 
     if is_js {
         let source = fs::read_to_string(&input_path).map_err(|e| format!("{}", e))?;
@@ -1121,6 +1136,10 @@ fn build_file(
     if build_config.artifact == tishlang_native::NativeArtifact::RustLib {
         return Ok(());
     }
+    if build_config.artifact == tishlang_native::NativeArtifact::FfiModule {
+        println!("Built tish FFI module: {}", output_path);
+        return Ok(());
+    }
 
     let out_name = Path::new(output_path)
         .file_stem()

package/crates/tish_bytecode/src/compiler.rs

@@ -3086,8 +3086,9 @@ impl<'a> Compiler<'a> {
         props: &[JsxProp],
         children: &[JsxChild],
     ) -> Result<(), CompileError> {
-        let h_idx = self.name_idx(&Arc::from("h"));
-        self.emit_u16(Opcode::LoadGlobal, h_idx);
+        // `h`, `Fragment` and component tags resolve lexically (imports, module `fn`s, locals)
+        // and fall back to globals, so embedder-injected `h` via `set_global` still works.
+        self.emit_var_load(&Arc::from("h"));
         let tag_str = tag.as_ref();
         let is_component = tag_str
             .chars()
@@ -3095,8 +3096,7 @@ impl<'a> Compiler<'a> {
             .map(|c| c.is_uppercase())
             .unwrap_or(false);
         if is_component {
-            let tag_idx = self.name_idx(tag);
-            self.emit_u16(Opcode::LoadGlobal, tag_idx);
+            self.emit_var_load(tag);
         } else {
             let tag_const = self.constant_idx(Constant::String(Arc::from(tag_str)));
             self.emit(Opcode::LoadConst);
@@ -3109,10 +3109,8 @@ impl<'a> Compiler<'a> {
     }
 
     fn compile_jsx_fragment(&mut self, children: &[JsxChild]) -> Result<(), CompileError> {
-        let h_idx = self.name_idx(&Arc::from("h"));
-        self.emit_u16(Opcode::LoadGlobal, h_idx);
-        let fragment_idx = self.name_idx(&Arc::from("Fragment"));
-        self.emit_u16(Opcode::LoadGlobal, fragment_idx);
+        self.emit_var_load(&Arc::from("h"));
+        self.emit_var_load(&Arc::from("Fragment"));
         let null_idx = self.constant_idx(Constant::Null);
         self.emit(Opcode::LoadConst);
         self.chunk.write_u16(null_idx);

package/crates/tish_compile/src/codegen.rs

@@ -2446,6 +2446,10 @@ impl Codegen {
                     "entries" => Some("Value::native(|args: &[Value]| tishlang_runtime::zip_entries(args))"),
                     _ => None,
                 },
+            "tish:ffi" if self.has_feature("ffi") => match export_name {
+                    "loadModule" => Some("Value::native(|args: &[Value]| tishlang_runtime::ffi_load_module(args))"),
+                    _ => None,
+                },
             _ => return None,
         };
         init.map(String::from)
@@ -2456,7 +2460,7 @@ impl Codegen {
             matches!(
                 name,
                 "http" | "timers" | "fs" | "process" | "regex" | "ws" | "tty" | "pty" | "net"
-                    | "encoding" | "crypto" | "zip"
+                    | "encoding" | "crypto" | "zip" | "ffi"
             )
         } else {
             self.features.contains(name)
@@ -3150,7 +3154,7 @@ impl Codegen {
         // `VmRef`) from THIS crate and cannot version-skew them against a separate `tishlang_runtime`
         // dependency of their own. Also avoids a duplicate-import error, since `Value` is already in
         // this list and could not be re-exported a second time at the crate root.
-        if self.emit_mode == crate::NativeEmitMode::RustLib {
+        if self.is_lib_surface() {
             self.write("pub ");
         }
         self.write("use tishlang_runtime::{console_debug as tish_console_debug, console_info as tish_console_info, console_log as tish_console_log, console_warn as tish_console_warn, console_error as tish_console_error, boolean as tish_boolean, decode_uri as tish_decode_uri, encode_uri as tish_encode_uri, encode_uri_component as tish_encode_uri_component, decode_uri_component as tish_decode_uri_component, string_escape_html_impl as tish_escape_html, in_operator as tish_in_operator, is_finite as tish_is_finite, is_nan as tish_is_nan, json_parse as tish_json_parse, json_stringify as tish_json_stringify, math_abs as tish_math_abs, math_ceil as tish_math_ceil, math_floor as tish_math_floor, math_max as tish_math_max, math_min as tish_math_min, math_round as tish_math_round, math_sqrt as tish_math_sqrt, parse_float as tish_parse_float, parse_int as tish_parse_int, math_random as tish_math_random, math_pow as tish_math_pow, math_sin as tish_math_sin, math_cos as tish_math_cos, math_tan as tish_math_tan, math_log as tish_math_log, math_exp as tish_math_exp, math_sign as tish_math_sign, math_trunc as tish_math_trunc, math_imul as tish_math_imul, math_sinh as tish_math_sinh, math_cosh as tish_math_cosh, math_tanh as tish_math_tanh, math_asinh as tish_math_asinh, math_acosh as tish_math_acosh, math_atanh as tish_math_atanh, math_cbrt as tish_math_cbrt, math_log2 as tish_math_log2, math_log10 as tish_math_log10, math_expm1 as tish_math_expm1, math_log1p as tish_math_log1p, math_clz32 as tish_math_clz32, math_fround as tish_math_fround, math_hypot as tish_math_hypot, math_atan2 as tish_math_atan2, math_asin as tish_math_asin, math_acos as tish_math_acos, math_atan as tish_math_atan, array_is_array as tish_array_is_array, array_of as tish_array_of, array_from as tish_array_from, object_is as tish_object_is, object_has_own as tish_object_has_own, structured_clone as tish_structured_clone, array_construct as tish_array_construct, string_from_char_code as tish_string_from_char_code, string_convert as tish_string_convert, number_convert as tish_number_convert, number_is_integer as tish_number_is_integer, number_is_safe_integer as tish_number_is_safe_integer, number_is_nan as tish_number_is_nan, number_is_finite as tish_number_is_finite, object_assign as tish_object_assign, object_freeze as tish_object_freeze, object_is_frozen as tish_object_is_frozen, object_keys as tish_object_keys, object_values as tish_object_values, object_entries as tish_object_entries, object_from_entries as tish_object_from_entries, symbol_object as tish_symbol_object, tish_construct, tish_error_constructor, tish_date_constructor, tish_set_constructor, tish_map_constructor, map_get as tish_map_get, map_has as tish_map_has, map_set as tish_map_set, map_values as tish_map_values, tish_float64_array_constructor, tish_float32_array_constructor, tish_int8_array_constructor, tish_uint8_array_constructor, tish_uint8_clamped_array_constructor, tish_int16_array_constructor, tish_uint16_array_constructor, tish_int32_array_constructor, tish_uint32_array_constructor, tish_audio_context_constructor, ObjectMap, ObjectData, PropMap, TishError, Value, VmRef};\n");
@@ -3268,7 +3272,7 @@ impl Codegen {
             self.writeln("}");
             self.writeln("");
         }
-        if self.emit_mode == crate::NativeEmitMode::RustLib {
+        if self.is_lib_surface() {
             self.emit_rust_lib_surface(program)?;
         }
         // M5 (default-on via native_opts_enabled; TISH_NATIVE_OPT=0 opts out): emit a parallel
@@ -3432,6 +3436,15 @@ impl Codegen {
             for s in &program.statements {
                 Self::collect_value_used_stmt(s, &mut self.value_used_names);
             }
+            // A library surface publishes each exported binding as a `Value`
+            // (`__tish_publish_exports`), so an exported fn is value-used even if the module only
+            // ever calls it. Without this a numeric `export fn add(a, b)` lost its boxed wrapper
+            // and the published list named a binding that didn't exist (E0308 / E0425).
+            if self.is_lib_surface() {
+                for e in self.rust_lib_exports(program) {
+                    self.value_used_names.insert(e.local_name.to_string());
+                }
+            }
             // Which of the survivors carry the all-`i32` signature. Computed AFTER the fixpoint,
             // so a function the proof rejected never reaches the i32 ABI either.
             self.native_fns_i32 = program
@@ -3571,7 +3584,7 @@ impl Codegen {
             .unwrap_or(self.emit_mode == crate::NativeEmitMode::Gba || !threads_possible);
         // `RustLib` publishes its exports by naming the `run()` local, so its bindings must stay
         // locals; the whole point there is that the frame outlives the call anyway.
-        if self.emit_mode == crate::NativeEmitMode::RustLib {
+        if self.is_lib_surface() {
             self.module_statics_on = false;
         }
         if crate::module_statics_flag().unwrap_or(true) {
@@ -4084,7 +4097,7 @@ impl Codegen {
         // `Rc`, so the closure — and every module-level cell it captured — stays alive and shared.
         // That is what makes module state survive between `pub fn` calls (and stay mutable through
         // `clear*`-style reassignment, since captures are `VmRef` cells, not copies).
-        if self.emit_mode == crate::NativeEmitMode::RustLib {
+        if self.is_lib_surface() {
             let pairs: Vec<String> = self
                 .rust_lib_exports(program)
                 .iter()
@@ -4171,6 +4184,51 @@ impl Codegen {
     /// unless the `send-values` feature is on (it follows `http`), so a `static` would not compile
     /// for the common configuration. Per-thread instances also match how a consumer uses this:
     /// register into the module's registries, then call it, on one thread.
+    /// Library emit modes: the entry module's exports become a crate surface (no `fn main`).
+    fn is_lib_surface(&self) -> bool {
+        matches!(
+            self.emit_mode,
+            crate::NativeEmitMode::RustLib | crate::NativeEmitMode::FfiModule
+        )
+    }
+
+    /// The tish FFI ABI v2 surface for [`crate::NativeEmitMode::FfiModule`]: one `extern "C"`
+    /// trampoline per export (marshaling through `tishlang_ffi_guest`) and
+    /// `tish_module_register_v2`, which installs the host's API table and returns the export table.
+    fn emit_ffi_module_surface(&mut self, export_names: &[String]) {
+        self.writeln("// ── tish FFI module (ABI v2) ──────────────────────────────────────────");
+        self.writeln("mod __tish_ffi {");
+        self.indent += 1;
+        self.writeln("use super::*;");
+        self.writeln("use tishlang_ffi_guest as guest;");
+        for (i, name) in export_names.iter().enumerate() {
+            self.writeln(&format!(
+                "extern \"C\" fn __tish_ffi_export_{i}(args: *const guest::TishValueRef, argc: usize) -> guest::TishValueRef {{"
+            ));
+            self.writeln(&format!(
+                "    unsafe {{ guest::export_call(args, argc, |a| __tish_call_export({name:?}, &a), tish_last_throw) }}"
+            ));
+            self.writeln("}");
+        }
+        self.writeln("#[no_mangle]");
+        self.writeln("pub unsafe extern \"C\" fn tish_module_register_v2(api: *const guest::TishHostApi) -> *const guest::TishExportTable {");
+        self.indent += 1;
+        self.writeln("if !guest::install(api) { return ::std::ptr::null(); }");
+        self.writeln("guest::export_table(&[");
+        for (i, name) in export_names.iter().enumerate() {
+            let cname = format!("{name}\\0");
+            self.writeln(&format!(
+                "    (b\"{cname}\", __tish_ffi_export_{i} as guest::TishNativeFn),"
+            ));
+        }
+        self.writeln("])");
+        self.indent -= 1;
+        self.writeln("}");
+        self.indent -= 1;
+        self.writeln("}");
+        self.writeln("");
+    }
+
     fn emit_rust_lib_surface(&mut self, program: &Program) -> Result<(), CompileError> {
         if self.is_async {
             return Err(CompileError::new(
@@ -4299,7 +4357,32 @@ impl Codegen {
         self.writeln("}");
         self.writeln("");
 
+        // Items the surface itself defines: a same-named `pub fn` would not compile.
+        let reserved = |name: &str| {
+            matches!(name, "run" | "main" | "tish_last_throw" | "runtime") || name.starts_with("__tish")
+        };
+        let clashing: Vec<&str> = exports
+            .iter()
+            .map(|e| e.exported_name.as_str())
+            .filter(|n| reserved(n))
+            .collect();
+        if !clashing.is_empty() && self.emit_mode == crate::NativeEmitMode::RustLib {
+            return Err(CompileError::new(
+                format!(
+                    "--target rust-lib: the export name(s) `{}` clash with items the generated crate \
+                     defines. Rename them (e.g. `export {{ {} as start }}`).",
+                    clashing.join("`, `"),
+                    clashing[0]
+                ),
+                None,
+            ));
+        }
+
         for e in &exports {
+            // FFI modules export by string name, so a clashing Rust wrapper is simply not emitted.
+            if reserved(&e.exported_name) {
+                continue;
+            }
             // Checked above: every remaining export is a `fn`, so the arity is present.
             let n = e.arity.unwrap_or(0);
             let params: Vec<String> = (0..n).map(|i| format!("a{}: Value", i)).collect();
@@ -4319,6 +4402,10 @@ impl Codegen {
             self.writeln("}");
         }
         self.writeln("");
+        if self.emit_mode == crate::NativeEmitMode::FfiModule {
+            let names: Vec<String> = exports.iter().map(|e| e.exported_name.clone()).collect();
+            self.emit_ffi_module_surface(&names);
+        }
         Ok(())
     }
 
@@ -25239,7 +25326,7 @@ impl Codegen {
         // exported fn that got de-virtualized would leave the emitted `__tish_publish_exports` call
         // referencing a binding that no longer exists. The unboxed path is a numeric fast path;
         // a correct public surface outranks it.
-        if self.emit_mode == crate::NativeEmitMode::RustLib {
+        if self.is_lib_surface() {
             return;
         }
         let dbg = std::env::var("TISH_AGG_DEBUG").is_ok();

package/crates/tish_compile/src/lib.rs

@@ -73,6 +73,10 @@ pub enum NativeEmitMode {
     /// `thread_local!` (rather than a global) is forced by `Value`: `send-values` is off unless
     /// `http` is enabled, so `VmRef` is `Rc<RefCell<_>>` and `Value` is `!Send`.
     RustLib,
+    /// [`NativeEmitMode::RustLib`] plus a tish FFI ABI v2 surface: one `extern "C"` trampoline per
+    /// `export fn` and `tish_module_register_v2`, via `tishlang_ffi_guest`. Built as a `cdylib`
+    /// that any tish host loads at runtime (`ffi:` import / `tishlang_ffi::load_module`).
+    FfiModule,
     /// Game Boy Advance ROM: `#![no_std]`, `#[agb::entry] fn agb_main(gba)`, links the
     /// `tishlang_runtime_gba` facade. Numbers/async lowering diverge; see codegen `emit_program`.
     Gba,

package/crates/tish_compile/src/resolve.rs

@@ -123,6 +123,7 @@ pub fn is_builtin_native_spec(spec: &str) -> bool {
             | "tish:encoding"
             | "tish:crypto"
             | "tish:zip"
+            | "tish:ffi"
             | "tish:test"
             | "tish:assert"
     ) || matches!(

package/crates/tish_compile/tests/regr_ffi_module_emit.rs

@@ -0,0 +1,120 @@
+//! `--crate-type cdylib` (`NativeEmitMode::FfiModule`): the RustLib surface plus a `tish_ffi` ABI v2
+//! entry point, so the result can be loaded at runtime via `import { .. } from "ffi:./x.lib"`.
+//! The loader behaviour itself is covered by `crates/tish_ffi/tests/loader_v2.rs`.
+use std::path::{Path, PathBuf};
+use tishlang_compile::{compile_project_full_emit, CompileError, NativeEmitMode};
+
+fn compile(path: &Path, mode: NativeEmitMode) -> Result<String, CompileError> {
+    compile_project_full_emit(path, path.parent(), &[], true, mode, None).map(|r| r.0)
+}
+
+fn fixture(rel: &str) -> PathBuf {
+    let manifest = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+    manifest.join("../..").join(rel).canonicalize().unwrap()
+}
+
+fn temp_module(name: &str, src: &str) -> PathBuf {
+    let dir = std::env::temp_dir().join(name);
+    std::fs::create_dir_all(&dir).unwrap();
+    let path = dir.join("index.tish");
+    std::fs::write(&path, src).unwrap();
+    path
+}
+
+#[test]
+fn ffi_module_registers_every_export_by_name() {
+    let rust = compile(&fixture("tests/regression/rust_lib_emit.tish"), NativeEmitMode::FfiModule)
+        .expect("ffi module emit");
+    assert!(
+        rust.contains("pub unsafe extern \"C\" fn tish_module_register_v2("),
+        "missing the v2 entry point:\n{rust}"
+    );
+    for name in ["register", "lookup", "clearAll", "initRuns", "add"] {
+        assert!(
+            rust.contains(&format!("(b\"{name}\\0\", ")),
+            "`{name}` missing from the export table:\n{rust}"
+        );
+        assert!(
+            rust.contains(&format!("__tish_call_export(\"{name}\", &a)")),
+            "`{name}` has no trampoline:\n{rust}"
+        );
+    }
+    // Still a library: the Rust API stays available to in-process consumers.
+    assert!(rust.contains("pub fn add(a0: Value, a1: Value) -> Value"));
+    assert!(!rust.contains("fn main()"));
+}
+
+#[test]
+fn rust_lib_gains_no_ffi_entry_point() {
+    let rust = compile(&fixture("tests/regression/rust_lib_emit.tish"), NativeEmitMode::RustLib)
+        .expect("rust-lib emit");
+    assert!(
+        !rust.contains("tish_module_register_v2") && !rust.contains("tishlang_ffi_guest"),
+        "the FFI entry point must be FfiModule-only:\n{rust}"
+    );
+}
+
+#[test]
+fn an_export_named_like_a_generated_item_is_still_exported_over_ffi() {
+    let path = temp_module(
+        "tish_ffimodule_reserved_name",
+        "export fn run(cb) { return cb(1) }\nexport fn other() { return 2 }\n",
+    );
+    let rust = compile(&path, NativeEmitMode::FfiModule).expect("ffi module emit");
+    assert!(
+        !rust.contains("pub fn run(a0: Value)"),
+        "a `pub fn run` would clash with the module's own `run()`:\n{rust}"
+    );
+    assert!(
+        rust.contains("(b\"run\\0\", ") && rust.contains("__tish_call_export(\"run\", &a)"),
+        "`run` must still be reachable by name over FFI:\n{rust}"
+    );
+}
+
+#[test]
+fn tish_ffi_load_module_lowers_to_the_runtime_loader() {
+    let path = temp_module(
+        "tish_ffi_load_module_emit",
+        "import { loadModule } from \"tish:ffi\"\nlet m = loadModule(\"./x.lib\")\nconsole.log(m)\n",
+    );
+    let rust = compile_project_full_emit(
+        &path,
+        path.parent(),
+        &["ffi".to_string()],
+        true,
+        NativeEmitMode::DesktopBin,
+        None,
+    )
+    .expect("tish:ffi should compile with the ffi feature")
+    .0;
+    assert!(
+        rust.contains("tishlang_runtime::ffi_load_module(args)"),
+        "loadModule must call the runtime loader:\n{rust}"
+    );
+}
+
+#[test]
+fn rust_lib_rejects_an_export_named_like_a_generated_item() {
+    let path = temp_module("tish_rustlib_reserved_name", "export fn run() { return 1 }\n");
+    let err = compile(&path, NativeEmitMode::RustLib).expect_err("`run` cannot be a Rust pub fn here");
+    assert!(
+        err.message.contains("clash") && err.message.contains("`run`"),
+        "the error should name the clashing export: {}",
+        err.message
+    );
+}
+
+#[test]
+fn a_purely_numeric_export_keeps_its_boxed_binding() {
+    // `add` is only ever called, and its params are numeric, so the native fast path used to drop
+    // its boxed `Value` wrapper. A library publishes every export as a `Value`, so it must stay.
+    let path = temp_module(
+        "tish_lib_numeric_export",
+        "export fn add(a, b) {\n  return a + b\n}\nexport fn greet(name) {\n  return \"hi \" + name\n}\n",
+    );
+    for mode in [NativeEmitMode::FfiModule, NativeEmitMode::RustLib] {
+        let rust = compile(&path, mode).expect("lib emit");
+        assert!(rust.contains("(\"add\", add.clone())"), "add is not published:\n{rust}");
+        assert!(rust.contains("let add = "), "add's boxed binding was elided ({mode:?}):\n{rust}");
+    }
+}

package/crates/tish_core/src/lib.rs

@@ -158,19 +158,26 @@ pub fn take_pending_throw() -> Option<Value> {
 // deadline *after* the body returns, which never happens. Backends poll
 // [`execution_deadline_exceeded`] on loop back-edges and abort with a catchable error.
 //
-// Disarmed is the default and costs one relaxed load — `tish run` never arms it. Armed,
+// Two deadlines can be armed, and the earlier one wins: the process-wide one
+// ([`set_execution_deadline`], `tish test`) and a per-thread one
+// ([`set_thread_execution_deadline`]) for embedders that budget each call into a guest VM
+// pinned to a thread, without affecting VMs on other threads.
+//
+// Disarmed is the default and costs two relaxed loads — `tish run` never arms either. Armed,
 // the clock is read once every `DEADLINE_POLL_MASK + 1` back-edges so a hot loop is not
 // paying a `now()` per iteration.
 // ---------------------------------------------------------------------------
 
 #[cfg(not(feature = "portable"))]
 mod deadline {
-    use core::sync::atomic::{AtomicU64, Ordering};
+    use core::sync::atomic::{AtomicU64, AtomicUsize, Ordering};
     use std::sync::LazyLock;
     use std::time::Instant;
 
     /// Nanoseconds since [`START`] at which execution must stop. 0 = disarmed.
     static DEADLINE_NS: AtomicU64 = AtomicU64::new(0);
+    /// Threads with a per-thread deadline armed, so the disarmed path skips the TLS read.
+    static THREADS_ARMED: AtomicUsize = AtomicUsize::new(0);
     static START: LazyLock<Instant> = LazyLock::new(Instant::now);
 
     const DEADLINE_POLL_MASK: u32 = 0x3FF;
@@ -178,6 +185,26 @@ mod deadline {
     thread_local! {
         static POLL_TICK: core::cell::Cell<u32> = const { core::cell::Cell::new(0) };
         static TRIPPED: core::cell::Cell<bool> = const { core::cell::Cell::new(false) };
+        static THREAD_DEADLINE_NS: core::cell::Cell<u64> = const { core::cell::Cell::new(0) };
+    }
+
+    /// Arm a deadline `millis` from now for the calling thread only, or disarm it with `None`.
+    /// Clears any previous trip on this thread. Unlike [`set_execution_deadline`], other threads
+    /// are unaffected.
+    pub fn set_thread_execution_deadline(millis: Option<u64>) {
+        TRIPPED.with(|t| t.set(false));
+        POLL_TICK.with(|t| t.set(0));
+        let at = millis.map_or(0, |ms| (START.elapsed().as_nanos() as u64 + ms.saturating_mul(1_000_000)).max(1));
+        let was = THREAD_DEADLINE_NS.with(|d| d.replace(at));
+        match (was != 0, at != 0) {
+            (false, true) => {
+                THREADS_ARMED.fetch_add(1, Ordering::Relaxed);
+            }
+            (true, false) => {
+                THREADS_ARMED.fetch_sub(1, Ordering::Relaxed);
+            }
+            _ => {}
+        }
     }
 
     /// Arm the deadline `millis` from now, or disarm with `None`. Clears any previous trip.
@@ -197,7 +224,16 @@ mod deadline {
     /// Has the armed deadline passed? Cheap and false when disarmed.
     #[inline]
     pub fn execution_deadline_exceeded() -> bool {
-        let at = DEADLINE_NS.load(Ordering::Relaxed);
+        let global = DEADLINE_NS.load(Ordering::Relaxed);
+        if global == 0 && THREADS_ARMED.load(Ordering::Relaxed) == 0 {
+            return false;
+        }
+        let thread = THREAD_DEADLINE_NS.with(|d| d.get());
+        let at = match (global, thread) {
+            (0, t) => t,
+            (g, 0) => g,
+            (g, t) => g.min(t),
+        };
         if at == 0 {
             return false;
         }
@@ -229,6 +265,7 @@ mod deadline {
 #[cfg(feature = "portable")]
 mod deadline {
     pub fn set_execution_deadline(_millis: Option<u64>) {}
+    pub fn set_thread_execution_deadline(_millis: Option<u64>) {}
     #[inline]
     pub fn execution_deadline_exceeded() -> bool {
         false
@@ -238,7 +275,9 @@ mod deadline {
     }
 }
 
-pub use deadline::{execution_deadline_exceeded, execution_deadline_tripped, set_execution_deadline};
+pub use deadline::{
+    execution_deadline_exceeded, execution_deadline_tripped, set_execution_deadline, set_thread_execution_deadline,
+};
 
 /// Message backends raise when [`execution_deadline_exceeded`] trips.
 pub const DEADLINE_ERROR: &str = "Test exceeded its timeout and was aborted";

package/crates/tish_cranelift_runtime/Cargo.toml

@@ -16,6 +16,8 @@ timers = ["tishlang_vm/timers"]
 ws = ["tishlang_vm/ws"]
 tty = ["tishlang_vm/tty"]
 regex = ["tishlang_vm/regex"]
+# tish:ffi loadModule; builds with every capability (`full`) pass it through like the others.
+ffi = ["tishlang_vm/ffi"]
 
 [lib]
 crate-type = ["staticlib", "rlib"]

package/crates/tish_ffi/src/lib.rs

@@ -25,6 +25,12 @@ use std::ffi::{c_char, c_void, CStr, CString};
 
 use tishlang_core::{ObjectData, Value, VmRef};
 
+mod v2;
+pub use v2::{
+    TishCallbackFn, TishCtxDropFn, TishHostApi, TISH_FFI_ABI_VERSION, TISH_HOST_API,
+    TISH_TAG_FUNCTION,
+};
+
 /// Opaque handle to a tish value. Internally `*mut Value` (a leaked `Box`); never inspect or
 /// free it except through the accessors. `null` is a valid "no value" sentinel for fallible
 /// accessors (e.g. `tish_value_object_get` on a missing key returns a fresh null handle, not
@@ -279,28 +285,33 @@ pub unsafe extern "C" fn tish_value_drop(r: TishValueRef) {
 /// reference semantics, so an extension can mutate a passed array); the per-call handles and the
 /// result handle are dropped here.
 pub fn wrap_native_fn(func: TishNativeFn) -> Value {
-    Value::native(move |args: &[Value]| -> Value {
-        let handles: Vec<TishValueRef> = args.iter().map(|v| box_value(v.clone())).collect();
-        // Calling an `extern "C"` fn pointer is a safe operation; the unsafety is in the accessors.
-        let result = func(handles.as_ptr(), handles.len());
-        // SAFETY: every `handles[i]` came from `box_value`; `result` is a freshly-owned handle
-        // from a `_new_*`/`_clone` accessor (the documented return contract).
-        unsafe {
-            let out = as_value(result).cloned().unwrap_or(Value::Null);
-            // #384: a buggy extension may violate the "return a fresh handle" contract and hand back
-            // one of its INPUT handles. `out` has already been cloned out of it, so the underlying
-            // value is safe — but dropping both `handles[i]` and `result` would then be a double-free
-            // (heap corruption). Drop each input once; drop `result` only if it is not an input alias.
-            let result_aliases_input = handles.iter().any(|h| std::ptr::eq(*h, result));
-            for h in handles {
-                tish_value_drop(h);
-            }
-            if !result_aliases_input {
-                tish_value_drop(result);
-            }
-            out
+    Value::native(move |args: &[Value]| -> Value { call_through_handles(args, |argv, argc| func(argv, argc)) })
+}
+
+/// Box `args` as owned handles, invoke `call`, unwrap the returned handle, and release them all.
+pub(crate) fn call_through_handles(
+    args: &[Value],
+    call: impl FnOnce(*const TishValueRef, usize) -> TishValueRef,
+) -> Value {
+    let handles: Vec<TishValueRef> = args.iter().map(|v| box_value(v.clone())).collect();
+    let result = call(handles.as_ptr(), handles.len());
+    // SAFETY: every `handles[i]` came from `box_value`; `result` is a freshly-owned handle
+    // from a `_new_*`/`_clone` accessor (the documented return contract).
+    unsafe {
+        let out = as_value(result).cloned().unwrap_or(Value::Null);
+        // #384: a buggy extension may violate the "return a fresh handle" contract and hand back
+        // one of its INPUT handles. `out` has already been cloned out of it, so the underlying
+        // value is safe — but dropping both `handles[i]` and `result` would then be a double-free
+        // (heap corruption). Drop each input once; drop `result` only if it is not an input alias.
+        let result_aliases_input = handles.iter().any(|h| std::ptr::eq(*h, result));
+        for h in handles {
+            tish_value_drop(h);
+        }
+        if !result_aliases_input {
+            tish_value_drop(result);
         }
-    })
+        out
+    }
 }
 
 /// Cached exports of one loaded module: name → C-ABI fn pointer. Fn pointers — unlike `Value`,
@@ -366,10 +377,22 @@ pub fn load_module(path: &str) -> Result<tishlang_core::ObjectMap, String> {
     let exports: CachedExports = unsafe {
         let lib =
             libloading::Library::new(path).map_err(|e| format!("ffi: load {}: {}", path, e))?;
-        let register: libloading::Symbol<unsafe extern "C" fn() -> *const TishExportTable> = lib
-            .get(b"tish_module_register")
-            .map_err(|e| format!("ffi: {}: no tish_module_register: {}", path, e))?;
-        let table = register();
+        // v2 modules receive the host API table; v1 modules resolve exported accessors.
+        let table = match lib.get::<unsafe extern "C" fn(*const TishHostApi) -> *const TishExportTable>(
+            b"tish_module_register_v2",
+        ) {
+            Ok(register_v2) => register_v2(&TISH_HOST_API),
+            Err(_) => {
+                let register: libloading::Symbol<unsafe extern "C" fn() -> *const TishExportTable> =
+                    lib.get(b"tish_module_register").map_err(|e| {
+                        format!(
+                            "ffi: {}: no tish_module_register_v2 or tish_module_register: {}",
+                            path, e
+                        )
+                    })?;
+                register()
+            }
+        };
         if table.is_null() {
             return Err(format!("ffi: {}: tish_module_register returned null", path));
         }