@volter/browser-wali 0.1.5 → 0.1.6

package/README.md

@@ -11,6 +11,11 @@ vault, exposes only declared network hosts and browser URLs, and invokes named
 actions. Grok and Codex are therefore data under `programs/`; this package has
 no provider-specific execution path.
 
+Program runs use `terminal: { columns, rows }` to attach a terminal. Direct
+`BrowserWaliRuntime.run` calls use `terminal: true`; a supplied `WaliStdin`
+can provide its dimensions through `terminalSize()`. Without this opt-in,
+stdio is headless and terminal queries return `ENOTTY`, including in pthreads.
+
 Missing syscalls and undeclared capabilities fail closed. Native TCP/TLS is
 forwarded as opaque records by the optional bounded gateway; TLS still
 terminates inside the unchanged program.
@@ -18,3 +23,71 @@ terminates inside the unchanged program.
 WALI toolchain pins and reusable compatibility patches live in
 `toolchains/wali`. Program-specific build recipes and upstream locks live in
 `programs/<id>/<version>`.
+
+The Rust toolchain's browser spawn bridge supports argv, environment, cwd and
+stdio, but cannot execute child-only `pre_exec` hooks or change child user/group
+credentials. New builds reject those requests with `ErrorKind::Unsupported`
+before dispatch instead of silently skipping them or running them in the
+parent. This does not implement Landlock. Existing WASM artifacts must be
+rebuilt to receive this toolchain fix.
+
+Native programs can explicitly import `wali.SYS_browser_spawn_confined_v1`.
+It takes the original seven `SYS_browser_spawn` arguments, followed by an i32
+pointer and byte length for UTF-8 JSON `{ "writableRoots": ["/workspace"] }`.
+An empty list is read-only. The policy is limited to 64 KiB and the runtime's
+128-root limit. Invalid policy data returns `-22`, invalid policy memory ranges
+return `-14`, and an unnegotiated bridge returns `-95`. Successful dispatch
+returns a child PID; ordinary `wait4` observes its completion.
+
+The patched Rust standard library exposes the same request on `CommandExt`,
+only for the WALI target, behind its `wali_browser_spawn` feature:
+
+```rust
+#![feature(wali_browser_spawn)]
+use std::os::unix::process::CommandExt;
+use std::process::Command;
+
+let output = Command::new("sh")
+    .args(["-c", "printf allowed > /workspace/result.txt"])
+    .browser_filesystem_policy_json(br#"{"writableRoots":["/workspace"]}"#)
+    .output()?;
+```
+
+The command owns a copy of the policy bytes; changing its environment cannot
+clear them. `spawn`, `status` and `output` use the confined operation, including
+when Tokio wraps the standard command. Invalid policies fail at spawn. `exec`
+with a policy, unsupported hooks and credential changes refuse. New binaries
+require a runtime that supplies the new import; existing artifacts are unchanged.
+Child launch checkpoints pending parent writes through the ordered filesystem
+channel before dispatch. Reaping imports child patches atomically with their
+original metadata instead of replaying them as new parent writes.
+Child ownership and pidfds are shared across pthreads. `wait4` applies the child
+filesystem patch once; `poll` and `epoll` observe completion without a consumer
+timer. The host requires `Atomics.waitAsync` for child execution. Tokio uses its
+upstream Linux process implementation, including with its `time` feature disabled.
+Cooperative SIGCHLD delivery lets upstream Tokio reap abandoned children and
+commit their writes. Signal dispositions are shared; thread masks are inherited.
+Unblocked pending signals interrupt shared `poll`/`epoll` waits. Delivery occurs
+at syscall boundaries, without CPU-loop preemption or a native register context.
+Alternate stacks, recursive handlers and SIGCHLD auto-reap dispositions refuse;
+other blocking syscalls are not yet signal-interruptible.
+The linker-supplied syscall entry requires the
+updated runtime when rebuilt; older artifacts are unchanged.
+
+`BrowserWaliWorkerProgram` negotiates this operation only when its `spawn`
+backend declares `capabilities.filesystemPolicy: true`; the receiver validates
+and forwards the policy to that backend. A direct `BrowserWaliRuntime` embedder
+can declare `browserProcess.filesystemPolicyVersion: 1` only if its `spawn`
+callback enforces the requested policy. Root and pthread callers use the same
+contract. The shell and WALI child engines enforce it; Node and Python still
+refuse it. This operation does not add Landlock or automatically convert a Rust
+`pre_exec` hook into a policy.
+
+WALI program/command handles expose `capabilities.filesystemPolicy: true` for
+registration with the process host. Their `run` options accept the same
+`filesystemPolicy`; direct `BrowserWaliRuntime.run` accepts it as well. Guest
+write opens, mutations, metadata and mapped-file writeback are checked on the
+process-wide filesystem owner for root and pthread callers. Reads remain broad.
+Descendants inherit the grant even through ordinary spawn; additional requests
+can only narrow it. Host bootstrap and peer restoration are separate from guest
+authority. This does not add OS hard-link isolation or durable confined jobs.

package/dist/browser-wali-command.d.ts

@@ -18,6 +18,9 @@ export interface BrowserWaliCommandOptions {
 export declare class BrowserWaliCommand {
     private readonly filesystem;
     private readonly options;
+    readonly capabilities: Readonly<{
+        filesystemPolicy: true;
+    }>;
     constructor(filesystem: BrowserFileSystem, options?: BrowserWaliCommandOptions);
     run: (argv: readonly string[], runOptions?: BrowserProcessRunOptions) => Promise<BrowserProcessResult>;
 }

package/dist/browser-wali-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser-wali-command.d.ts","sourceRoot":"","sources":["../src/browser-wali-command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,KAAK,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAGxG,MAAM,WAAW,yBAAyB;IACxC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACvC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7G,QAAQ,CAAC,EAAE,sBAAsB,CAAC;IAClC,KAAK,CAAC,EAAE,qBAAqB,CAAC;CAC/B;AAED,iFAAiF;AACjF,qBAAa,kBAAkB;IAE3B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,UAAU,EAAE,iBAAiB,EAC7B,OAAO,GAAE,yBAA8B;IAG1D,GAAG,GACD,MAAM,SAAS,MAAM,EAAE,EACvB,aAAY,wBAA6B,KACxC,OAAO,CAAC,oBAAoB,CAAC,CAmC9B;CACH"}
+{"version":3,"file":"browser-wali-command.d.ts","sourceRoot":"","sources":["../src/browser-wali-command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+CAA+C,CAAC;AACvF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,KAAK,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAGxG,MAAM,WAAW,yBAAyB;IACxC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACvC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7G,QAAQ,CAAC,EAAE,sBAAsB,CAAC;IAClC,KAAK,CAAC,EAAE,qBAAqB,CAAC;CAC/B;AAED,iFAAiF;AACjF,qBAAa,kBAAkB;IAG3B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAH1B,QAAQ,CAAC,YAAY;;OAAsD;gBAExD,UAAU,EAAE,iBAAiB,EAC7B,OAAO,GAAE,yBAA8B;IAG1D,GAAG,GACD,MAAM,SAAS,MAAM,EAAE,EACvB,aAAY,wBAA6B,KACxC,OAAO,CAAC,oBAAoB,CAAC,CAmC9B;CACH"}

package/dist/browser-wali-command.js

@@ -3,6 +3,7 @@ import { BrowserWaliWorkerProgram } from "./worker-program.js";
 export class BrowserWaliCommand {
     filesystem;
     options;
+    capabilities = Object.freeze({ filesystemPolicy: true });
     constructor(filesystem, options = {}) {
         this.filesystem = filesystem;
         this.options = options;
@@ -16,7 +17,7 @@ export class BrowserWaliCommand {
         if (!this.filesystem.existsSync(path) || !this.filesystem.statSync(path).isFile()) {
             return { stdout: "", stderr: `wali: ${path}: file not found\n`, exitCode: 127 };
         }
-        const source = this.filesystem.readFileSync(path);
+        const source = await this.filesystem.readFile(path);
         const bytes = new Uint8Array(source.byteLength);
         bytes.set(source);
         const url = URL.createObjectURL(new Blob([bytes], { type: "application/wasm" }));

package/dist/browser-wali-command.js.map

@@ -1 +1 @@
-{"version":3,"file":"browser-wali-command.js","sourceRoot":"","sources":["../src/browser-wali-command.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAW/D,iFAAiF;AACjF,MAAM,OAAO,kBAAkB;IAEV;IACA;IAFnB,YACmB,UAA6B,EAC7B,UAAqC,EAAE;QADvC,eAAU,GAAV,UAAU,CAAmB;QAC7B,YAAO,GAAP,OAAO,CAAgC;IACvD,CAAC;IAEJ,GAAG,GAAG,KAAK,EACT,IAAuB,EACvB,aAAuC,EAAE,EACV,EAAE;QACjC,MAAM,gBAAgB,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM;YAC9E,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzB,MAAM,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,GAAG,gBAAgB,CAAC;QAC/C,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,wCAAwC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAChG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAClF,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,IAAI,oBAAoB,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;QAClF,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAChD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClB,MAAM,GAAG,GAAG,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;QACjF,MAAM,OAAO,GAAG,IAAI,wBAAwB,CAAC,IAAI,CAAC,UAAU,EAAE;YAC5D,GAAG;YACH,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG;YAC5B,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE;YAC3B,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE;YACjD,OAAO,EAAE;gBACP,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO;gBACvB,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,IAAI,EAAE;gBACtD,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,cAAc,IAAI,EAAE;gBAC1D,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI;aAC7D;YACD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CAAC,CAAC;QACH,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,EAAE;gBAC9C,GAAG,UAAU;gBACb,cAAc,EAAE,IAAI;aACrB,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,SAAS,EAAE,CAAC;YACpB,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC;CACH"}
+{"version":3,"file":"browser-wali-command.js","sourceRoot":"","sources":["../src/browser-wali-command.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAW/D,iFAAiF;AACjF,MAAM,OAAO,kBAAkB;IAGV;IACA;IAHV,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,IAAa,EAAE,CAAC,CAAC;IAC3E,YACmB,UAA6B,EAC7B,UAAqC,EAAE;QADvC,eAAU,GAAV,UAAU,CAAmB;QAC7B,YAAO,GAAP,OAAO,CAAgC;IACvD,CAAC;IAEJ,GAAG,GAAG,KAAK,EACT,IAAuB,EACvB,aAAuC,EAAE,EACV,EAAE;QACjC,MAAM,gBAAgB,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM;YAC9E,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzB,MAAM,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,GAAG,gBAAgB,CAAC;QAC/C,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,wCAAwC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAChG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAClF,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,IAAI,oBAAoB,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;QAClF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAChD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClB,MAAM,GAAG,GAAG,GAAG,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;QACjF,MAAM,OAAO,GAAG,IAAI,wBAAwB,CAAC,IAAI,CAAC,UAAU,EAAE;YAC5D,GAAG;YACH,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG;YAC5B,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE;YAC3B,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE;YACjD,OAAO,EAAE;gBACP,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO;gBACvB,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,IAAI,EAAE;gBACtD,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,cAAc,IAAI,EAAE;gBAC1D,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI;aAC7D;YACD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CAAC,CAAC;QACH,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,EAAE;gBAC9C,GAAG,UAAU;gBACb,cAAc,EAAE,IAAI;aACrB,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,SAAS,EAAE,CAAC;YACpB,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC;CACH"}

package/dist/capabilities.d.ts

@@ -1,3 +1,75 @@
-export declare const WALI_IMPLEMENTED_IMPORTS: Set<"__init" | "__deinit" | "__proc_exit" | "__cl_get_argc" | "__cl_get_argv_len" | "__cl_copy_argv" | "__get_init_envfile" | "SYS_access" | "SYS_brk" | "SYS_chdir" | "SYS_clock_getres" | "SYS_clock_gettime" | "SYS_clock_nanosleep" | "SYS_close" | "SYS_dup" | "SYS_dup2" | "SYS_dup3" | "SYS_epoll_create" | "SYS_epoll_create1" | "SYS_epoll_ctl" | "SYS_epoll_pwait" | "SYS_epoll_wait" | "SYS_eventfd" | "SYS_eventfd2" | "SYS_exit" | "SYS_exit_group" | "SYS_faccessat" | "SYS_faccessat2" | "SYS_fchdir" | "SYS_fcntl" | "SYS_fdatasync" | "SYS_flock" | "SYS_fstat" | "SYS_fsync" | "SYS_ftruncate" | "SYS_getcwd" | "SYS_getdents64" | "SYS_getegid" | "SYS_geteuid" | "SYS_getgid" | "SYS_futex" | "SYS_getpid" | "SYS_getppid" | "SYS_getrandom" | "SYS_getrlimit" | "SYS_getrusage" | "SYS_gettid" | "SYS_gettimeofday" | "SYS_getuid" | "SYS_ioctl" | "SYS_lseek" | "SYS_lstat" | "SYS_mkdir" | "SYS_mkdirat" | "SYS_mmap" | "SYS_mprotect" | "SYS_mremap" | "SYS_munmap" | "SYS_nanosleep" | "SYS_newfstatat" | "SYS_open" | "SYS_openat" | "SYS_poll" | "SYS_pread64" | "SYS_pwrite64" | "SYS_read" | "SYS_readlink" | "SYS_readlinkat" | "SYS_readv" | "SYS_symlink" | "SYS_symlinkat" | "SYS_prctl" | "SYS_prlimit64" | "SYS_rename" | "SYS_rmdir" | "SYS_rt_sigaction" | "SYS_rt_sigprocmask" | "SYS_sched_getaffinity" | "SYS_sched_setscheduler" | "SYS_sched_yield" | "SYS_set_robust_list" | "SYS_set_tid_address" | "SYS_setrlimit" | "SYS_sigaltstack" | "SYS_stat" | "SYS_sysinfo" | "SYS_umask" | "SYS_uname" | "SYS_unlink" | "SYS_unlinkat" | "SYS_socketpair" | "SYS_tkill" | "SYS_write" | "SYS_writev" | "__wasm_thread_spawn" | "SYS_timerfd_create" | "SYS_timerfd_settime" | "SYS_browser_spawn" | "SYS_pipe" | "SYS_pipe2" | "SYS_wait4" | "SYS_kill" | "SYS_setpgid" | "SYS_getpgid" | "SYS_getsid" | "SYS_chmod" | "SYS_fchmod" | "SYS_fchmodat" | "SYS_utimensat" | "SYS_statfs" | "SYS_fstatfs" | "SYS_inotify_init" | "SYS_inotify_init1" | "SYS_inotify_add_watch" | "SYS_inotify_rm_watch" | "SYS_socket" | "SYS_connect" | "SYS_bind" | "SYS_send" | "SYS_sendto" | "SYS_recv" | "SYS_recvfrom" | "SYS_sendmsg" | "SYS_recvmsg" | "SYS_shutdown" | "SYS_setsockopt" | "SYS_getsockopt" | "SYS_getsockname" | "SYS_getpeername" | "SYS_madvise" | "SYS_msync">;
+export declare const WALI_IMPLEMENTED_IMPORTS: Set<"SYS_pipe" | "SYS_pipe2" | "SYS_close" | "SYS_read" | "SYS_pread64" | "SYS_write" | "SYS_pwrite64" | "SYS_readv" | "SYS_writev" | "SYS_lseek" | "SYS_fstat" | "SYS_dup" | "SYS_dup2" | "SYS_dup3" | "SYS_fcntl" | "SYS_poll" | "SYS_brk" | "SYS_mmap" | "SYS_mprotect" | "SYS_munmap" | "SYS_mremap" | "SYS_madvise" | "SYS_msync" | "SYS_rt_sigaction" | "SYS_rt_sigprocmask" | "SYS_rt_sigpending" | "__init" | "__deinit" | "__proc_exit" | "__cl_get_argc" | "__cl_get_argv_len" | "__cl_copy_argv" | "__get_init_envfile" | "SYS_access" | "SYS_chdir" | "SYS_clock_getres" | "SYS_clock_gettime" | "SYS_clock_nanosleep" | "SYS_epoll_create" | "SYS_epoll_create1" | "SYS_epoll_ctl" | "SYS_epoll_pwait" | "SYS_epoll_wait" | "SYS_eventfd" | "SYS_eventfd2" | "SYS_exit" | "SYS_exit_group" | "SYS_faccessat" | "SYS_faccessat2" | "SYS_fchdir" | "SYS_fdatasync" | "SYS_flock" | "SYS_fsync" | "SYS_ftruncate" | "SYS_getcwd" | "SYS_getdents64" | "SYS_getegid" | "SYS_geteuid" | "SYS_getgid" | "SYS_futex" | "SYS_getpid" | "SYS_getppid" | "SYS_getrandom" | "SYS_getrlimit" | "SYS_getrusage" | "SYS_gettid" | "SYS_gettimeofday" | "SYS_getuid" | "SYS_ioctl" | "SYS_lstat" | "SYS_mkdir" | "SYS_mkdirat" | "SYS_nanosleep" | "SYS_newfstatat" | "SYS_open" | "SYS_openat" | "SYS_readlink" | "SYS_readlinkat" | "SYS_symlink" | "SYS_symlinkat" | "SYS_prctl" | "SYS_prlimit64" | "SYS_rename" | "SYS_rmdir" | "SYS_sched_getaffinity" | "SYS_sched_setscheduler" | "SYS_sched_yield" | "SYS_set_robust_list" | "SYS_set_tid_address" | "SYS_setrlimit" | "SYS_sigaltstack" | "SYS_stat" | "SYS_sysinfo" | "SYS_umask" | "SYS_uname" | "SYS_unlink" | "SYS_unlinkat" | "SYS_socketpair" | "SYS_tkill" | "__wasm_thread_spawn" | "SYS_timerfd_create" | "SYS_timerfd_settime" | "SYS_browser_spawn" | "SYS_browser_spawn_confined_v1" | "SYS_wait4" | "SYS_pidfd_open" | "SYS_kill" | "SYS_setpgid" | "SYS_getpgid" | "SYS_getsid" | "SYS_chmod" | "SYS_fchmod" | "SYS_fchmodat" | "SYS_utimensat" | "SYS_statfs" | "SYS_fstatfs" | "SYS_inotify_init" | "SYS_inotify_init1" | "SYS_inotify_add_watch" | "SYS_inotify_rm_watch" | "SYS_socket" | "SYS_connect" | "SYS_bind" | "SYS_send" | "SYS_sendto" | "SYS_recv" | "SYS_recvfrom" | "SYS_sendmsg" | "SYS_recvmsg" | "SYS_shutdown" | "SYS_setsockopt" | "SYS_getsockopt" | "SYS_getsockname" | "SYS_getpeername" | "setjmp" | "longjmp" | "SYS_select" | "SYS_browser_codec_query_v1" | "SYS_browser_codec_open_v1" | "SYS_browser_codec_push_v1" | "SYS_browser_codec_pull_v1" | "SYS_browser_codec_flush_v1" | "SYS_browser_codec_close_v1">;
 export declare function missingWaliImports(importNames: Iterable<string>): string[];
+/**
+ * AN UNIMPLEMENTED SYSCALL ANSWERS `-ENOSYS`; THESE FOUR STILL TRAP.
+ *
+ * A Linux kernel that does not implement a syscall returns `-ENOSYS`. It does
+ * not kill the process, and programs are written for that answer: this very
+ * musl branches on it BY NAME in 51 of its source files -- `ppoll.c`,
+ * `select.c`, `sigtimedwait.c`, `statx`/`renameat2`/`copy_file_range`
+ * fallbacks, `setxid.c`, which returns `-ENOSYS` itself for a setxid number it
+ * cannot dispatch. ENOSYS is not an exotic failure on this ABI; it is the
+ * ordinary answer to "your kernel is older than this syscall", and the libc
+ * under every WALI program already carries the path for it.
+ *
+ * Trapping instead inverts that: `platform.platform()` shells out to `uname`,
+ * `subprocess` raises `OSError`, `platform._syscmd_uname` catches it and falls
+ * back to a default string -- a caller behaving correctly, killed by the
+ * runtime for asking. Measured 2026-09-19: the scene battery's
+ * `17-workshop-interior` died at sequence 2 on `SYS_fork` for exactly that.
+ *
+ * THE RULE, and it is the reason the list below is four names and not forty:
+ * a syscall may be answered with an errno WHEN A CALLER CAN ACT ON IT. It must
+ * trap when the errno cannot reach a caller that can do anything but ask
+ * again. Two shapes fail that test and no others do:
+ *
+ *   1. THE CALL DOES NOT RETURN TO ITS CALLER. `rt_sigreturn` replaces the
+ *      interrupted context; it has no error channel, and any value at all
+ *      resumes execution on a frame that was meant to be popped.
+ *   2. THE CALL'S WHOLE CONTRACT IS TO BLOCK UNTIL AN EXTERNAL EVENT. A
+ *      correct caller's only response to "I did not block" is to re-check its
+ *      predicate and call again, so an error return is a live-lock by
+ *      construction -- a spinning core in a worker, undiagnosable from
+ *      outside, which is worse than dying. This is not a prediction: musl's
+ *      own `src/thread/__wait.c` is
+ *          while (*addr==val) {
+ *              __syscall_SYS_futex(...) != -ENOSYS || __syscall_SYS_futex(...);
+ *          }
+ *      An ENOSYS futex makes that a tight infinite spin.
+ *
+ * WHAT DOES NOT EARN A TRAP, because both readings were considered and lost:
+ *   - "the caller will abort anyway" (libc++'s `condition_variable::wait` is
+ *     `noexcept`). A caller that checks an error and dies is a caller HANDLING
+ *     it; the trap buys only a better message. `futex` is on this list for
+ *     shape 2, which is a hang, not for that.
+ *   - "this syscall is privileged" (`setuid`, `chroot`, `unshare`). A kernel
+ *     already answers those `EPERM`, so a caller that ignores the errno is
+ *     already wrong on real Linux. Ours is not a new class of lie.
+ *   - a timeout argument settles shape 2: `ppoll`, `pselect6` and
+ *     `rt_sigtimedwait` can all return without the event on a real kernel, so
+ *     their callers must already distinguish that from an error -- and musl's
+ *     wrappers for all three branch on `-ENOSYS` explicitly.
+ *
+ * SCOPE, measured on `blender.wasm` (`sha256-hsUYCtV0…`) rather than assumed:
+ * all 181 `SYS_*` imports return `i64`, and every non-`SYS_` import
+ * (`__init`, `__cl_get_argc`, `setjmp`, `longjmp`, `__proc_exit`) returns
+ * `i32` or nothing. Only a `SYS_*` name is a syscall with an errno channel, so
+ * only a `SYS_*` name may be answered `-ENOSYS`; an unimplemented ABI hook
+ * still traps, and handing `-38n` to an `i32` slot would have trapped anyway
+ * with a worse message.
+ *
+ * ADDING A NAME HERE IS THE EXCEPTION, NOT THE HABIT: say which of the two
+ * shapes it is, and cite the caller.
+ */
+export declare const WALI_TRAPPING_IMPORTS: Set<"SYS_futex" | "SYS_rt_sigreturn" | "SYS_pause" | "SYS_rt_sigsuspend">;
+/** Linux's answer for a syscall the kernel does not implement. */
+export declare const WALI_ENOSYS = -38n;
+/**
+ * What the runtime installs for an import it has no handler for: a trap, or
+ * the kernel's own `-ENOSYS`. Both instance halves ask this one question --
+ * the root (`runtime.ts`) and every pthread (`thread-worker.ts`) -- because a
+ * program whose survival depended on WHICH THREAD made the call is the defect
+ * this function exists to prevent. It was exactly that until 2026-09-19.
+ */
+export declare function waliUnimplementedTraps(name: string): boolean;
 //# sourceMappingURL=capabilities.d.ts.map

package/dist/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,wBAAwB,+qEAkB1B,CAAC;AAEZ,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAE1E"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,wBAAwB,u9EAqB1B,CAAC;AAEZ,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAE1E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AACH,eAAO,MAAM,qBAAqB,2EAOvB,CAAC;AAEZ,kEAAkE;AAClE,eAAO,MAAM,WAAW,OAAO,CAAC;AAEhC;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE5D"}

package/dist/capabilities.js

@@ -6,18 +6,102 @@ export const WALI_IMPLEMENTED_IMPORTS = new Set([
     "SYS_fdatasync", "SYS_flock", "SYS_fstat", "SYS_fsync", "SYS_ftruncate", "SYS_getcwd", "SYS_getdents64", "SYS_getegid", "SYS_geteuid", "SYS_getgid",
     "SYS_futex", "SYS_getpid", "SYS_getppid", "SYS_getrandom", "SYS_getrlimit", "SYS_getrusage", "SYS_gettid", "SYS_gettimeofday", "SYS_getuid", "SYS_ioctl", "SYS_lseek",
     "SYS_lstat", "SYS_mkdir", "SYS_mkdirat", "SYS_mmap", "SYS_mprotect", "SYS_mremap", "SYS_munmap", "SYS_nanosleep", "SYS_newfstatat", "SYS_open", "SYS_openat", "SYS_poll", "SYS_pread64", "SYS_pwrite64", "SYS_read", "SYS_readlink", "SYS_readlinkat", "SYS_readv", "SYS_symlink", "SYS_symlinkat",
-    "SYS_prctl", "SYS_prlimit64", "SYS_rename", "SYS_rmdir", "SYS_rt_sigaction", "SYS_rt_sigprocmask", "SYS_sched_getaffinity", "SYS_sched_setscheduler", "SYS_sched_yield",
+    "SYS_prctl", "SYS_prlimit64", "SYS_rename", "SYS_rmdir", "SYS_rt_sigaction", "SYS_rt_sigpending", "SYS_rt_sigprocmask", "SYS_sched_getaffinity", "SYS_sched_setscheduler", "SYS_sched_yield",
     "SYS_set_robust_list", "SYS_set_tid_address", "SYS_setrlimit", "SYS_sigaltstack", "SYS_stat", "SYS_sysinfo", "SYS_umask", "SYS_uname", "SYS_unlink", "SYS_unlinkat",
     "SYS_socketpair", "SYS_tkill", "SYS_write", "SYS_writev", "__wasm_thread_spawn",
     "SYS_timerfd_create", "SYS_timerfd_settime",
-    "SYS_browser_spawn", "SYS_pipe", "SYS_pipe2", "SYS_wait4", "SYS_kill", "SYS_setpgid", "SYS_getpgid", "SYS_getsid",
+    "SYS_browser_spawn", "SYS_browser_spawn_confined_v1", "SYS_pipe", "SYS_pipe2", "SYS_wait4", "SYS_pidfd_open", "SYS_kill", "SYS_setpgid", "SYS_getpgid", "SYS_getsid",
     "SYS_chmod", "SYS_fchmod", "SYS_fchmodat", "SYS_utimensat",
     "SYS_statfs", "SYS_fstatfs", "SYS_inotify_init", "SYS_inotify_init1", "SYS_inotify_add_watch", "SYS_inotify_rm_watch",
     "SYS_socket", "SYS_connect", "SYS_bind", "SYS_send", "SYS_sendto", "SYS_recv", "SYS_recvfrom",
     "SYS_sendmsg", "SYS_recvmsg", "SYS_shutdown", "SYS_setsockopt", "SYS_getsockopt", "SYS_getsockname", "SYS_getpeername",
     "SYS_madvise", "SYS_msync",
+    "setjmp", "longjmp", "SYS_select",
+    "SYS_browser_codec_query_v1", "SYS_browser_codec_open_v1", "SYS_browser_codec_push_v1",
+    "SYS_browser_codec_pull_v1", "SYS_browser_codec_flush_v1", "SYS_browser_codec_close_v1",
 ]);
 export function missingWaliImports(importNames) {
     return [...new Set(importNames)].filter((name) => !WALI_IMPLEMENTED_IMPORTS.has(name)).sort();
 }
+/**
+ * AN UNIMPLEMENTED SYSCALL ANSWERS `-ENOSYS`; THESE FOUR STILL TRAP.
+ *
+ * A Linux kernel that does not implement a syscall returns `-ENOSYS`. It does
+ * not kill the process, and programs are written for that answer: this very
+ * musl branches on it BY NAME in 51 of its source files -- `ppoll.c`,
+ * `select.c`, `sigtimedwait.c`, `statx`/`renameat2`/`copy_file_range`
+ * fallbacks, `setxid.c`, which returns `-ENOSYS` itself for a setxid number it
+ * cannot dispatch. ENOSYS is not an exotic failure on this ABI; it is the
+ * ordinary answer to "your kernel is older than this syscall", and the libc
+ * under every WALI program already carries the path for it.
+ *
+ * Trapping instead inverts that: `platform.platform()` shells out to `uname`,
+ * `subprocess` raises `OSError`, `platform._syscmd_uname` catches it and falls
+ * back to a default string -- a caller behaving correctly, killed by the
+ * runtime for asking. Measured 2026-09-19: the scene battery's
+ * `17-workshop-interior` died at sequence 2 on `SYS_fork` for exactly that.
+ *
+ * THE RULE, and it is the reason the list below is four names and not forty:
+ * a syscall may be answered with an errno WHEN A CALLER CAN ACT ON IT. It must
+ * trap when the errno cannot reach a caller that can do anything but ask
+ * again. Two shapes fail that test and no others do:
+ *
+ *   1. THE CALL DOES NOT RETURN TO ITS CALLER. `rt_sigreturn` replaces the
+ *      interrupted context; it has no error channel, and any value at all
+ *      resumes execution on a frame that was meant to be popped.
+ *   2. THE CALL'S WHOLE CONTRACT IS TO BLOCK UNTIL AN EXTERNAL EVENT. A
+ *      correct caller's only response to "I did not block" is to re-check its
+ *      predicate and call again, so an error return is a live-lock by
+ *      construction -- a spinning core in a worker, undiagnosable from
+ *      outside, which is worse than dying. This is not a prediction: musl's
+ *      own `src/thread/__wait.c` is
+ *          while (*addr==val) {
+ *              __syscall_SYS_futex(...) != -ENOSYS || __syscall_SYS_futex(...);
+ *          }
+ *      An ENOSYS futex makes that a tight infinite spin.
+ *
+ * WHAT DOES NOT EARN A TRAP, because both readings were considered and lost:
+ *   - "the caller will abort anyway" (libc++'s `condition_variable::wait` is
+ *     `noexcept`). A caller that checks an error and dies is a caller HANDLING
+ *     it; the trap buys only a better message. `futex` is on this list for
+ *     shape 2, which is a hang, not for that.
+ *   - "this syscall is privileged" (`setuid`, `chroot`, `unshare`). A kernel
+ *     already answers those `EPERM`, so a caller that ignores the errno is
+ *     already wrong on real Linux. Ours is not a new class of lie.
+ *   - a timeout argument settles shape 2: `ppoll`, `pselect6` and
+ *     `rt_sigtimedwait` can all return without the event on a real kernel, so
+ *     their callers must already distinguish that from an error -- and musl's
+ *     wrappers for all three branch on `-ENOSYS` explicitly.
+ *
+ * SCOPE, measured on `blender.wasm` (`sha256-hsUYCtV0…`) rather than assumed:
+ * all 181 `SYS_*` imports return `i64`, and every non-`SYS_` import
+ * (`__init`, `__cl_get_argc`, `setjmp`, `longjmp`, `__proc_exit`) returns
+ * `i32` or nothing. Only a `SYS_*` name is a syscall with an errno channel, so
+ * only a `SYS_*` name may be answered `-ENOSYS`; an unimplemented ABI hook
+ * still traps, and handing `-38n` to an `i32` slot would have trapped anyway
+ * with a worse message.
+ *
+ * ADDING A NAME HERE IS THE EXCEPTION, NOT THE HABIT: say which of the two
+ * shapes it is, and cite the caller.
+ */
+export const WALI_TRAPPING_IMPORTS = new Set([
+    // Shape 1 — no return to a caller.
+    "SYS_rt_sigreturn",
+    // Shape 2 — block until an external event; an errno is a live-lock.
+    "SYS_futex",
+    "SYS_pause",
+    "SYS_rt_sigsuspend",
+]);
+/** Linux's answer for a syscall the kernel does not implement. */
+export const WALI_ENOSYS = -38n;
+/**
+ * What the runtime installs for an import it has no handler for: a trap, or
+ * the kernel's own `-ENOSYS`. Both instance halves ask this one question --
+ * the root (`runtime.ts`) and every pthread (`thread-worker.ts`) -- because a
+ * program whose survival depended on WHICH THREAD made the call is the defect
+ * this function exists to prevent. It was exactly that until 2026-09-19.
+ */
+export function waliUnimplementedTraps(name) {
+    return !name.startsWith("SYS_") || WALI_TRAPPING_IMPORTS.has(name);
+}
 //# sourceMappingURL=capabilities.js.map

package/dist/capabilities.js.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IAC9C,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,oBAAoB;IACjH,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU;IACpJ,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,aAAa,EAAE,cAAc;IAC5H,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,EAAE,YAAY,EAAE,WAAW;IAC1F,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY;IACnJ,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW;IACrK,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe;IAClS,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,iBAAiB;IACvK,qBAAqB,EAAE,qBAAqB,EAAE,eAAe,EAAE,iBAAiB,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc;IACnK,gBAAgB,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,qBAAqB;IAC/E,oBAAoB,EAAE,qBAAqB;IAC3C,mBAAmB,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY;IACjH,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe;IAC1D,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,sBAAsB;IACrH,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc;IAC7F,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB;IACtH,aAAa,EAAE,WAAW;CAClB,CAAC,CAAC;AAEZ,MAAM,UAAU,kBAAkB,CAAC,WAA6B;IAC9D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,wBAAwB,CAAC,GAAG,CAAC,IAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACzG,CAAC"}
+{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IAC9C,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,oBAAoB;IACjH,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU;IACpJ,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,aAAa,EAAE,cAAc;IAC5H,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,EAAE,YAAY,EAAE,WAAW;IAC1F,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY;IACnJ,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW;IACrK,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe;IAClS,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,iBAAiB;IAC5L,qBAAqB,EAAE,qBAAqB,EAAE,eAAe,EAAE,iBAAiB,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc;IACnK,gBAAgB,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,qBAAqB;IAC/E,oBAAoB,EAAE,qBAAqB;IAC3C,mBAAmB,EAAE,+BAA+B,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY;IACpK,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe;IAC1D,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,sBAAsB;IACrH,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc;IAC7F,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB;IACtH,aAAa,EAAE,WAAW;IAC1B,QAAQ,EAAE,SAAS,EAAE,YAAY;IACjC,4BAA4B,EAAE,2BAA2B,EAAE,2BAA2B;IACtF,2BAA2B,EAAE,4BAA4B,EAAE,4BAA4B;CAC/E,CAAC,CAAC;AAEZ,MAAM,UAAU,kBAAkB,CAAC,WAA6B;IAC9D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,wBAAwB,CAAC,GAAG,CAAC,IAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACzG,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IAC3C,mCAAmC;IACnC,kBAAkB;IAClB,oEAAoE;IACpE,WAAW;IACX,WAAW;IACX,mBAAmB;CACX,CAAC,CAAC;AAEZ,kEAAkE;AAClE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC;AAEhC;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAa,CAAC,CAAC;AAC9E,CAAC"}

package/dist/child-processes.d.ts

@@ -0,0 +1,24 @@
+import type { BrowserProcessSharedState } from "./process-bridge.js";
+/** Process-wide child ownership, shared by every guest pthread through the event worker. */
+export declare class WaliChildProcesses {
+    private readonly allocateFd;
+    private readonly onExit?;
+    private readonly children;
+    private readonly descriptors;
+    private readonly listeners;
+    constructor(allocateFd: (minimum?: number) => number, onExit?: ((pid: number, status: number) => void) | undefined);
+    private changed;
+    /** Wakes a blocked `wait` to look again: a signal arrived. */
+    wake(): void;
+    onChange(listener: () => void): () => void;
+    register(pid: number, state: BrowserProcessSharedState): number;
+    forget(pid: number): number;
+    has(pid: number): boolean;
+    wait(pid: number, options: number, destination: BrowserProcessSharedState, interrupted?: () => boolean): Promise<number>;
+    open(pid: number, flags: number): number;
+    owns(fd: number): boolean;
+    poll(fd: number, events: number): number | undefined;
+    close(fd: number): number;
+    fcntl(fd: number, command: number, argument: number): number;
+}
+//# sourceMappingURL=child-processes.d.ts.map

package/dist/child-processes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"child-processes.d.ts","sourceRoot":"","sources":["../src/child-processes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAOrE,4FAA4F;AAC5F,qBAAa,kBAAkB;IAM3B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAN1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkC;IAC3D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA8E;IAC1G,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;gBAGhC,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,KAAK,MAAM,EACxC,MAAM,CAAC,GAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,aAAA;IAGjE,OAAO,CAAC,OAAO;IAEf,8DAA8D;IAC9D,IAAI,IAAI,IAAI;IAEZ,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAK1C,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,yBAAyB,GAAG,MAAM;IAuB/D,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAY3B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAEnB,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,yBAAyB,EAAE,WAAW,GAAE,MAAM,OAAqB,GAAG,OAAO,CAAC,MAAM,CAAC;IA4B3I,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM;IASxC,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAEzB,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAOpD,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM;IAMzB,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;CAc7D"}

package/dist/child-processes.js

@@ -0,0 +1,134 @@
+/** Process-wide child ownership, shared by every guest pthread through the event worker. */
+export class WaliChildProcesses {
+    allocateFd;
+    onExit;
+    children = new Map();
+    descriptors = new Map();
+    listeners = new Set();
+    constructor(allocateFd, onExit) {
+        this.allocateFd = allocateFd;
+        this.onExit = onExit;
+    }
+    changed() { for (const listener of [...this.listeners])
+        listener(); }
+    /** Wakes a blocked `wait` to look again: a signal arrived. */
+    wake() { this.changed(); }
+    onChange(listener) {
+        this.listeners.add(listener);
+        return () => { this.listeners.delete(listener); };
+    }
+    register(pid, state) {
+        if (pid <= 0 || this.children.has(pid))
+            return -22;
+        const waitAsync = Atomics.waitAsync;
+        if (!waitAsync)
+            return -38;
+        const child = { state, reaped: false };
+        this.children.set(pid, child);
+        const control = new Int32Array(state.control);
+        // Completion is published after the exit code and filesystem patch. The
+        // equality check in waitAsync closes the completion-before-subscription race.
+        const watch = async () => {
+            while (Atomics.load(control, 0) === 0 && !child.reaped) {
+                await waitAsync(control, 0, 0).value;
+            }
+            if (!child.reaped)
+                this.onExit?.(pid, Atomics.load(control, 1));
+            this.changed();
+        };
+        void watch();
+        this.changed();
+        return 0;
+    }
+    forget(pid) {
+        const child = this.children.get(pid);
+        if (!child)
+            return -3;
+        child.reaped = true;
+        this.children.delete(pid);
+        // Failed dispatches have no producer left to notify a completion watcher.
+        Atomics.store(new Int32Array(child.state.control), 0, 1);
+        Atomics.notify(new Int32Array(child.state.control), 0);
+        this.changed();
+        return 0;
+    }
+    has(pid) { return this.children.has(pid); }
+    async wait(pid, options, destination, interrupted = () => false) {
+        if (pid === 0 || pid < -1 || (options & ~1) !== 0)
+            return -22;
+        for (;;) {
+            const candidates = pid === -1 ? [...this.children.entries()]
+                : this.children.has(pid) ? [[pid, this.children.get(pid)]] : [];
+            if (candidates.length === 0)
+                return -10;
+            const completed = candidates.find(([, child]) => Atomics.load(new Int32Array(child.state.control), 0) !== 0);
+            if (completed) {
+                const [childPid, child] = completed;
+                const source = new Int32Array(child.state.control);
+                const length = Atomics.load(source, 2);
+                if (length < 0 || length > child.state.response.byteLength || length > destination.response.byteLength)
+                    return -5;
+                new Uint8Array(destination.response).set(new Uint8Array(child.state.response, 0, length));
+                new Int32Array(destination.control).set(source);
+                child.reaped = true;
+                this.children.delete(childPid);
+                this.changed();
+                return childPid;
+            }
+            if (options & 1)
+                return 0;
+            // a blocked wait4 returns -EINTR for a signal the caller does not block, so its handler runs
+            if (interrupted())
+                return -4;
+            await new Promise((resolve) => {
+                const unsubscribe = this.onChange(() => { unsubscribe(); resolve(); });
+            });
+        }
+    }
+    open(pid, flags) {
+        if (pid <= 0 || (flags & ~0x800) !== 0)
+            return -22;
+        const child = this.children.get(pid);
+        if (!child)
+            return -3;
+        const fd = this.allocateFd();
+        this.descriptors.set(fd, { child, flags, cloexec: true });
+        return fd;
+    }
+    owns(fd) { return this.descriptors.has(fd); }
+    poll(fd, events) {
+        const descriptor = this.descriptors.get(fd);
+        if (!descriptor)
+            return;
+        return (descriptor.child.reaped ? 0x10 : 0)
+            | ((events & 1) && Atomics.load(new Int32Array(descriptor.child.state.control), 0) !== 0 ? 1 : 0);
+    }
+    close(fd) {
+        if (!this.descriptors.delete(fd))
+            return -9;
+        this.changed();
+        return 0;
+    }
+    fcntl(fd, command, argument) {
+        const descriptor = this.descriptors.get(fd);
+        if (!descriptor)
+            return -9;
+        if (command === 0 || command === 1030) {
+            if (argument < 0)
+                return -22;
+            const duplicate = this.allocateFd(argument);
+            this.descriptors.set(duplicate, { ...descriptor, cloexec: command === 1030 });
+            return duplicate;
+        }
+        if (command === 1)
+            return descriptor.cloexec ? 1 : 0;
+        if (command === 2) {
+            descriptor.cloexec = Boolean(argument & 1);
+            return 0;
+        }
+        if (command === 3)
+            return descriptor.flags;
+        return -22;
+    }
+}
+//# sourceMappingURL=child-processes.js.map

package/dist/child-processes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"child-processes.js","sourceRoot":"","sources":["../src/child-processes.ts"],"names":[],"mappings":"AAOA,4FAA4F;AAC5F,MAAM,OAAO,kBAAkB;IAMV;IACA;IANF,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC1C,WAAW,GAAG,IAAI,GAAG,EAAmE,CAAC;IACzF,SAAS,GAAG,IAAI,GAAG,EAAc,CAAC;IAEnD,YACmB,UAAwC,EACxC,MAA8C;QAD9C,eAAU,GAAV,UAAU,CAA8B;QACxC,WAAM,GAAN,MAAM,CAAwC;IAC9D,CAAC;IAEI,OAAO,KAAW,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAEnF,8DAA8D;IAC9D,IAAI,KAAW,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAEhC,QAAQ,CAAC,QAAoB;QAC3B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,QAAQ,CAAC,GAAW,EAAE,KAAgC;QACpD,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,SAAS,GAAI,OAEjB,CAAC,SAAS,CAAC;QACb,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9C,wEAAwE;QACxE,8EAA8E;QAC9E,MAAM,KAAK,GAAG,KAAK,IAAmB,EAAE;YACtC,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBACvD,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YACvC,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YAChE,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC,CAAC;QACF,KAAK,KAAK,EAAE,CAAC;QACb,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,CAAC,CAAC;QACtB,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,0EAA0E;QAC1E,OAAO,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACzD,OAAO,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,CAAC,CAAC;IACX,CAAC;IAED,GAAG,CAAC,GAAW,IAAa,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAE5D,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,OAAe,EAAE,WAAsC,EAAE,cAA6B,GAAG,EAAE,CAAC,KAAK;QACvH,IAAI,GAAG,KAAK,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,EAAE,CAAC;QAC9D,SAAS,CAAC;YACR,MAAM,UAAU,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBAC1D,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAE,CAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,EAAE,CAAC;YACxC,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7G,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,SAAS,CAAC;gBACpC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACnD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;gBACvC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,IAAI,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,UAAU;oBAAE,OAAO,CAAC,CAAC,CAAC;gBAClH,IAAI,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;gBAC1F,IAAI,UAAU,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAChD,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;gBACpB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACf,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,IAAI,OAAO,GAAG,CAAC;gBAAE,OAAO,CAAC,CAAC;YAC1B,6FAA6F;YAC7F,IAAI,WAAW,EAAE;gBAAE,OAAO,CAAC,CAAC,CAAC;YAC7B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAClC,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACzE,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,CAAC,GAAW,EAAE,KAAa;QAC7B,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,CAAC,CAAC;QACtB,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAC7B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,EAAU,IAAa,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAE9D,IAAI,CAAC,EAAU,EAAE,MAAc;QAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,UAAU;YAAE,OAAO;QACxB,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;cACvC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtG,CAAC;IAED,KAAK,CAAC,EAAU;QACd,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,CAAC,CAAC;IACX,CAAC;IAED,KAAK,CAAC,EAAU,EAAE,OAAe,EAAE,QAAgB;QACjD,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,UAAU;YAAE,OAAO,CAAC,CAAC,CAAC;QAC3B,IAAI,OAAO,KAAK,CAAC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACtC,IAAI,QAAQ,GAAG,CAAC;gBAAE,OAAO,CAAC,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC,CAAC;YAC9E,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,OAAO,KAAK,CAAC;YAAE,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YAAC,UAAU,CAAC,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;YAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAC5E,IAAI,OAAO,KAAK,CAAC;YAAE,OAAO,UAAU,CAAC,KAAK,CAAC;QAC3C,OAAO,CAAC,EAAE,CAAC;IACb,CAAC;CACF"}

package/dist/codec-protocol.d.ts

@@ -0,0 +1,66 @@
+/**
+ * The shared-memory protocol between a WALI guest thread and the process's
+ * codec worker. The C side of the ABI is
+ * `toolchains/wali/runtime/wali-browser-codec.h`; the field meanings are
+ * `programs/ffmpeg/SPEC.md` §3.3.
+ *
+ * A request carries no payload buffer: the codec worker holds the process's
+ * `WebAssembly.Memory` and reads and writes the guest's own pointers, which
+ * stay valid because the calling thread is parked inside the import for the
+ * whole call. Everything a request needs therefore fits in the control words.
+ */
+export declare const CODEC_ABI_VERSION = 1;
+export declare const CODEC_JSON_MAX: number;
+export declare const CODEC_MAX_HANDLES = 64;
+/** Inputs a handle may hold undelivered before `push` answers -EAGAIN. */
+export declare const CODEC_MAX_INFLIGHT = 8;
+/** Outputs a handle may hold before the worker stops accepting inputs. */
+export declare const CODEC_MAX_OUTPUTS = 32;
+/** How long a waiting `pull` blocks before -ETIMEDOUT. */
+export declare const CODEC_WAIT_MS = 10000;
+export declare const enum CodecOperation {
+    Query = 1,
+    Open = 2,
+    Push = 3,
+    Pull = 4,
+    Flush = 5,
+    Close = 6
+}
+export declare const enum CodecKind {
+    VideoDecoder = 0,
+    VideoEncoder = 1,
+    AudioDecoder = 2,
+    AudioEncoder = 3
+}
+/** `pull` flag bit 0: block until an output, end of stream, or the wait expiry. */
+export declare const CODEC_PULL_WAIT = 1;
+/**
+ * Control words of one channel. Word 0 is the generation word every waiter
+ * sleeps on: 0 idle, `requestId` in flight, `-requestId` retired by a
+ * timed-out caller, `requestId + 1` complete.
+ */
+export declare const enum CodecControl {
+    State = 0,
+    Operation = 1,
+    Result = 2,
+    Argument0 = 3,
+    Argument1 = 4,
+    Argument2 = 5,
+    Argument3 = 6,
+    Argument4 = 7,
+    Argument5 = 8
+}
+/** Six arguments is the widest request (`pull`). */
+export declare const CODEC_ARGUMENTS = 6;
+export declare const CODEC_CONTROL_WORDS = 9;
+export interface WaliCodecChannel {
+    port: MessagePort;
+    control: SharedArrayBuffer;
+}
+export type CodecWorkerMessage = {
+    kind: "initialize";
+    memory: WebAssembly.Memory;
+} | ({
+    kind: "attach";
+} & WaliCodecChannel);
+//# sourceMappingURL=codec-protocol.d.ts.map

package/dist/codec-protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codec-protocol.d.ts","sourceRoot":"","sources":["../src/codec-protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,eAAO,MAAM,iBAAiB,IAAI,CAAC;AACnC,eAAO,MAAM,cAAc,QAAY,CAAC;AACxC,eAAO,MAAM,iBAAiB,KAAK,CAAC;AACpC,0EAA0E;AAC1E,eAAO,MAAM,kBAAkB,IAAI,CAAC;AACpC,0EAA0E;AAC1E,eAAO,MAAM,iBAAiB,KAAK,CAAC;AACpC,0DAA0D;AAC1D,eAAO,MAAM,aAAa,QAAS,CAAC;AAEpC,0BAAkB,cAAc;IAC9B,KAAK,IAAI;IACT,IAAI,IAAI;IACR,IAAI,IAAI;IACR,IAAI,IAAI;IACR,KAAK,IAAI;IACT,KAAK,IAAI;CACV;AAED,0BAAkB,SAAS;IACzB,YAAY,IAAI;IAChB,YAAY,IAAI;IAChB,YAAY,IAAI;IAChB,YAAY,IAAI;CACjB;AAED,mFAAmF;AACnF,eAAO,MAAM,eAAe,IAAI,CAAC;AAEjC;;;;GAIG;AACH,0BAAkB,YAAY;IAC5B,KAAK,IAAI;IACT,SAAS,IAAI;IACb,MAAM,IAAI;IACV,SAAS,IAAI;IACb,SAAS,IAAI;IACb,SAAS,IAAI;IACb,SAAS,IAAI;IACb,SAAS,IAAI;IACb,SAAS,IAAI;CACd;AAED,oDAAoD;AACpD,eAAO,MAAM,eAAe,IAAI,CAAC;AACjC,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,iBAAiB,CAAC;CAC5B;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAA;CAAE,GAClD,CAAC;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG,gBAAgB,CAAC,CAAC"}