@wasm-oj/server 0.2.1 → 0.2.2

package/THIRD_PARTY_NOTICES.md

@@ -65,13 +65,39 @@ package. The generated dependency report covers every package in the pinned
 normal Cargo dependency graph selected for `wasm32-unknown-unknown`; its compact
 inventory binds all 332 package identities and the exact HTML report digest.
 
+### QuickJS guest Node standard I/O libraries
+
+The generated guest prelude in `src/runtime/quickjs/stdlib.generated.ts` bundles
+the following exact npm releases. `scripts/build-quickjs-stdlib.mjs` builds this
+prelude from the locked packages and the WASM-OJ standard I/O adapters.
+
+| Component | Source release | License |
+| --- | --- | --- |
+| buffer 6.0.3 | <https://github.com/feross/buffer/tree/v6.0.3> | MIT |
+| readable-stream 4.7.0 | <https://github.com/nodejs/readable-stream/tree/v4.7.0> | MIT |
+| events 3.3.0 | <https://github.com/Gozala/events/tree/v3.3.0> | MIT |
+| abort-controller 3.0.0 | <https://github.com/mysticatea/abort-controller/tree/v3.0.0> | MIT |
+| event-target-shim 5.0.1 | <https://github.com/mysticatea/event-target-shim/tree/v5.0.1> | MIT |
+| base64-js 1.5.1 | <https://github.com/beatgammit/base64-js/tree/v1.5.1> | MIT |
+| ieee754 1.2.1 | <https://github.com/feross/ieee754/tree/v1.2.1> | BSD-3-Clause |
+| string_decoder 1.3.0 | <https://github.com/nodejs/string_decoder/tree/v1.3.0> | MIT |
+| safe-buffer 5.2.1 | <https://github.com/feross/safe-buffer/tree/v5.2.1> | MIT |
+
+The complete upstream license texts, including the Node-derived stream and
+decoder notices, are reproduced in `licenses/quickjs-node-stdlib-LICENSES.txt`
+(SHA-256 `38e42dcb48e476e4e836552c814c911eb5464d80b56b970d87aa07b88c7b28f8`).
+`licenses/components.json` binds each release to the generated bundle digest;
+`pnpm-lock.yaml` pins all package integrity values. The Buffer declarations are
+also copied from the same buffer 6.0.3 release. These guest libraries implement
+the supported byte buffers and standard streams; they do not include Node.js.
+
 ## Distributed toolchain assets
 
 ### TypeScript-Go
 
 - Distributed asset: `typescript-7.0.2.wasm.gz.bin`
-- Compressed SHA-256: `06e58ce887d95d1895055699b8dc96a1cde7d1f2baa48de40f9b790e3271dc16`
-- Expanded Wasm SHA-256: `27c931087b3b0cc48804f3749b07eb710538c4ab175969db8a8ff680e6ec4fde`
+- Compressed SHA-256: `29c6ee0e46151e2644049ae96162b1b1d46dcb13310e2a928114bb9030c3ea92`
+- Expanded Wasm SHA-256: `01cea8c18841b73e0601d31859be1dcd323e61d83e7cfb15523dd051fc78c8da`
 - Source revision: `microsoft/typescript-go@2bd066d87f5bafd315be9f40889d0a60b9e58e0b`
 - Source: <https://github.com/microsoft/typescript-go/tree/2bd066d87f5bafd315be9f40889d0a60b9e58e0b>
 - Build runtime: Go 1.26.3 standard library (`GOOS=wasip1`, `GOARCH=wasm`)
@@ -101,29 +127,29 @@ byte-identical to `go/LICENSE` in the exact Go 1.26.5 source distribution.
 
 ### Java compiler toolchain
 
-- Distributed assets: `java-teavm-0.13.1.wasi.compiler.webc.gz.bin`,
+- Distributed assets: `java-teavm-0.13.1.compiler.wasm`,
   `java-teavm-0.13.1.compile-classlib.bin`, and
   `java-teavm-0.13.1.runtime-classlib.bin`
 - TeaVM Java compiler source: <https://github.com/konsoletyper/teavm-javac/tree/7e4a44cf521694a4e326e33850dd8aec165eb5c9>
 - TeaVM core source: `konsoletyper/teavm@b3a245b7d9034ff35cdfab2def057a3d4f256efb`
-  plus the pinned WASI compiler and math-intrinsic patch
-- Compiler package compressed SHA-256:
-  `129f1f51d591e58954f88787d36396b856a9a68ba3ae9c9d14f20bd67c2c7722`
-- Compiler package expanded SHA-256:
-  `f8f86761cf31062565187e4a66f73b6903f257fe84c0ce70ea1cd28441b6c2e9`
-- Licenses: TeaVM Apache-2.0; OpenJDK class library GPL-2.0 with Classpath
-  Exception
-- License material: `licenses/Apache-2.0.txt` and
-  `licenses/openjdk-21-GPL-2.0-with-Classpath-exception.txt`
-
-The compiler emits standalone `wasip1` modules. The class-library archives are
-mounted only during compilation and are not included in submitted artifacts.
+  with source patches and build provenance in `tools/java-client/`
+- Compiler SHA-256: `8c37bce1c6fceeaffeffe93e10834309b67c8b6fb58c6f8a24547afe8be67f5d`
+- Android Scanner and Spliterators source: `platform/libcore@de876a01b29230b877c9f408348c38a90ee724a5`
+- Licenses: TeaVM Apache-2.0; OpenJDK and Android class libraries GPL-2.0
+  with Classpath exception
+- License material: `licenses/Apache-2.0.txt`,
+  `licenses/openjdk-21-GPL-2.0-with-Classpath-exception.txt`, and
+  `licenses/android-libcore-GPL-2.0-with-Classpath-exception.txt`
+
+The WasmGC compiler uses statically packaged JavaScript bindings and emits
+standalone `wasip1` student modules. TeaVM links reachable class-library code
+into those modules; the full class-library archives are compiler inputs.
 
 ### QuickJS-ng
 
 - Distributed asset: `quickjs-0.15.1.wasm.gz.bin`
-- Compressed SHA-256: `8c7f0588210490e7d77f198fc91f72c1b94787ab4c359c4786ca59a363c4f5e8`
-- Expanded Wasm SHA-256: `956bf2b3700690e1817034eb8e063cfd9781c66b4bffa244ef4f9445656ccfa1`
+- Compressed SHA-256: `dc6e02e8610269e61b341331661515616451cec929fd534fa96d1c4f47fbcc9a`
+- Expanded Wasm SHA-256: `a098db08592626781f6ad6e63f1b8a36da6d03b85b530dc94c441a348426b20b`
 - Source revision: `quickjs-ng/quickjs@fd0a0210b7be00957751871e7e01b8291268fc29`
 - Source: <https://github.com/quickjs-ng/quickjs/tree/fd0a0210b7be00957751871e7e01b8291268fc29>
 - Build SDK: [WASI SDK 24.0 release archive for arm64 macOS](https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-24/wasi-sdk-24.0-arm64-macos.tar.gz),
@@ -240,25 +266,25 @@ source trees, so the inventory reuses the exact digest-bound `b9ef79d7` copies;
 the revision-specific root and musl-fts notices remain separate. The generated
 WebC and pinned command manifests do not relicense those payloads.
 
-### CPython 3.14.6 for WASI P1
+### CPython 3.14.7 for WASI P1
 
-- Distributed assets: `python-3.14.6-wasip1.webc.gz.bin` and its provenance
-  manifest `python-3.14.6-wasip1.manifest.json`
-- Official source archive: <https://www.python.org/ftp/python/3.14.6/Python-3.14.6.tar.xz>,
-  SHA-256 `143b1dddefaec3bd2e21e3b839b34a2b7fb9842272883c576420d605e9f30c63`
-- Official SPDX document: <https://www.python.org/ftp/python/3.14.6/Python-3.14.6.tar.xz.spdx.json>,
-  SHA-256 `1f5d394856783fa77e1f1db280f84eabf693bffc1fb06a747f7116de9f99f3bd`
+- Distributed assets: `python-3.14.7-wasip1.webc.gz.bin` and its provenance
+  manifest `python-3.14.7-wasip1.manifest.json`
+- Official source archive: <https://www.python.org/ftp/python/3.14.7/Python-3.14.7.tar.xz>,
+  SHA-256 `3b48dac8fb59f62eaa67ac83c1eb12bda1b7a08406dd286e252c11a66be27f81`
+- Official SPDX document: <https://www.python.org/ftp/python/3.14.7/Python-3.14.7.tar.xz.spdx.json>,
+  SHA-256 `87f55ca6c59fe159fa8c47ba2d7d8bec39cc649b1d3f47c667f34025a2ca9a68`
 - Expanded WebC SHA-256:
-  `454ffc53936aa13a0d7f4afbb5bd50ada339c8ebd04bbf27ea19e4104cf43207`
+  `a42c98f5f00582638c8e445440c506bbf94d5e55b3415d1f8d82d11c56cd4b56`
 - Distributed gzip SHA-256:
-  `218cd20ac4abb443e0700816010a615a345a43eae623a0232da2227135a6c7a6`
+  `10027f0e32c77dfa0ce1c413b6cb27307d6744fe5e18e6da8cea738bd020260c`
 - Provenance manifest SHA-256:
-  `054eccad04a7cee7ba1661062142ef0d639976850981eab8fc785f48eb26129e`
+  `53a24b258363a8494af164121111a34b49c85fa0e054627fe131feba6f359cd5`
 - Deterministically exported `WOJFS002` runtime archive SHA-256:
-  `44d894f91487f20c2bb04fe496a9343db37d8720fb706472c2b4a7f3300db039`
+  `c1acac884af1c86833db5b65f8cc0a2304fce74dea0a05d9b40bde0a4e3e7c0e`
 - CPython license: Python Software Foundation License Version 2 and the
   historical notices reproduced with it
-- License text: `licenses/cpython-3.14.6-PSF-2.0.txt`
+- License text: `licenses/cpython-3.14.7-PSF-2.0.txt`
 - Bundled third-party source: Expat 2.8.1 (MIT), HACL* revision
   `8ba599b2f6c9701b3dc961db895b0856a2210f76` (MIT), and libmpdec 2.5.1
   (BSD-2-Clause); their exact notices are
@@ -270,7 +296,8 @@ WebC and pinned command manifests do not relicense those payloads.
   `26a1d6601d727a96f4301d0d8647b5a42760ae0c`, and wasi-libc revision
   `b9ef79d7dbd47c6c5bafdae760823467c2f60b70`.
 
-WASM-OJ compiles this package from the pinned official sources, disables
+WASM-OJ compiles this package from the pinned official sources with a 4 MiB C
+stack and 16 MiB initial linear memory, retaining `--stack-first`, disables
 `_socket`, removes test/development-only standard-library roots, canonicalizes
 build-only sysconfig paths, and packages the complete source SPDX document and
 applicable CPython, third-party, compiler-rt, WASI SDK, and wasi-libc notices

package/crates/runtime-core/src/capabilities.rs

@@ -1,4 +1,7 @@
-use wasmer::{AsStoreMut, ExternType, Function, Imports, Module, RuntimeError};
+use wasmer::{
+    AsStoreMut, ExternType, Function, FunctionEnv, FunctionEnvMut, FunctionType, Imports, Instance,
+    Module, RuntimeError, Type,
+};
 
 /// Returns whether an import exposes host state that WASM-OJ deliberately keeps
 /// outside the deterministic judge contract.
@@ -63,14 +66,77 @@ pub(crate) fn attach_capability_denials(
     for (namespace, name, function_type) in denied {
         let capability = format!("{namespace}.{name}");
         let error_message = format!("WASM-OJ denied nondeterministic capability {capability}");
-        let denial = Function::new(store, function_type, move |_| {
-            Err(RuntimeError::new(error_message.clone()))
-        });
+        let denial = capability_trap(store, &function_type, error_message)?;
         imports.define(&namespace, &name, denial);
     }
     Ok(())
 }
 
+fn deny_capability(env: FunctionEnvMut<String>) -> Result<(), RuntimeError> {
+    Err(RuntimeError::new(env.data().clone()))
+}
+
+fn capability_trap(
+    store: &mut impl AsStoreMut,
+    signature: &FunctionType,
+    message: String,
+) -> Result<Function, String> {
+    use wasm_encoder::{
+        CodeSection, EntityType, ExportKind, ExportSection, FunctionSection, ImportSection,
+        Instruction, TypeSection, ValType,
+    };
+
+    let value_type = |ty: &Type| match ty {
+        Type::I32 => ValType::I32,
+        Type::I64 => ValType::I64,
+        Type::F32 => ValType::F32,
+        Type::F64 => ValType::F64,
+        Type::V128 => ValType::V128,
+        Type::ExternRef => ValType::EXTERNREF,
+        Type::FuncRef => ValType::FUNCREF,
+        Type::ExceptionRef => ValType::EXNREF,
+    };
+    let mut types = TypeSection::new();
+    types.ty().function([], []);
+    types.ty().function(
+        signature.params().iter().map(value_type),
+        signature.results().iter().map(value_type),
+    );
+    let mut imports = ImportSection::new();
+    imports.import("host", "deny", EntityType::Function(0));
+    let mut functions = FunctionSection::new();
+    functions.function(1);
+    let mut exports = ExportSection::new();
+    exports.export("deny", ExportKind::Func, 1);
+    let mut body = wasm_encoder::Function::new([]);
+    body.instruction(&Instruction::Call(0));
+    body.instruction(&Instruction::Unreachable);
+    body.instruction(&Instruction::End);
+    let mut code = CodeSection::new();
+    code.function(&body);
+    let mut wasm = wasm_encoder::Module::new();
+    wasm.section(&types)
+        .section(&imports)
+        .section(&functions)
+        .section(&exports)
+        .section(&code);
+
+    // Wasmer's dynamic host functions evaluate JavaScript under the web backend.
+    // A Wasm stub preserves any declared signature and calls a CSP-safe typed trap.
+    let module =
+        Module::new(&store.as_store_ref(), wasm.finish()).map_err(|error| error.to_string())?;
+    let env = FunctionEnv::new(&mut *store, message);
+    let trap = Function::new_typed_with_env(&mut *store, &env, deny_capability);
+    let mut imports = Imports::new();
+    imports.define("host", "deny", trap);
+    let instance = Instance::new(store, &module, &imports).map_err(|error| error.to_string())?;
+    instance
+        .exports
+        .get_function("deny")
+        .cloned()
+        .map_err(|error| error.to_string())
+}
+
 #[cfg(test)]
 mod tests {
     use super::is_denied_capability;

package/crates/runtime-core/src/lib.rs

@@ -46,7 +46,11 @@ pub use types::{
 };
 
 pub fn run_response(request: RunRequest) -> RunResponse {
-    match run(request) {
+    run_response_from_result(run(request))
+}
+
+pub(crate) fn run_response_from_result(result: Result<RunResult, RunError>) -> RunResponse {
+    match result {
         Ok(result) => RunResponse {
             ok: true,
             result: Some(result),

package/crates/runtime-core/src/run/mod.rs

@@ -22,7 +22,16 @@ pub fn run(request: RunRequest) -> Result<RunResult, RunError> {
     #[cfg(not(target_arch = "wasm32"))]
     return native::run(request);
     #[cfg(target_arch = "wasm32")]
-    return web::run(request);
+    return web::run(request, |_| Ok(()));
+}
+
+#[cfg(target_arch = "wasm32")]
+pub(crate) fn run_observed(
+    request: RunRequest,
+    on_execution: impl FnMut(bool) -> Result<(), RunError>,
+) -> Result<RunResult, RunError> {
+    validate(&request)?;
+    web::run(request, on_execution)
 }
 
 fn validate(request: &RunRequest) -> Result<(), RunError> {

package/crates/runtime-core/src/run/web.rs

@@ -14,7 +14,10 @@ use wasmer_wasix::{
     Pipe, WasiEnv, WasiError, WasiModuleInstanceHandles, WasiModuleTreeHandles, wasmer_wasix_types,
 };
 
-pub fn run(request: RunRequest) -> Result<RunResult, RunError> {
+pub fn run(
+    request: RunRequest,
+    mut on_execution: impl FnMut(bool) -> Result<(), RunError>,
+) -> Result<RunResult, RunError> {
     let limited = enforce_memory_limit(&request.wasm, request.resources.memory_limit_bytes)
         .map_err(RunError::Compile)?;
     let metered = instrument_wasm(&limited, request.resources.instruction_budget)
@@ -110,6 +113,7 @@ pub fn run(request: RunRequest) -> Result<RunResult, RunError> {
         .exports
         .get_function("_start")
         .map_err(|error| RunError::Compile(format!("module has no _start function: {error}")))?;
+    on_execution(true)?;
     let execution = if executable.has_deferred_start {
         let initializer = instance
             .exports
@@ -125,6 +129,8 @@ pub fn run(request: RunRequest) -> Result<RunResult, RunError> {
         start.call(&mut store, &[])
     };
 
+    on_execution(false)?;
+
     let stdout = stdout_capture.bytes();
     let stderr = stderr_capture.bytes();
     let mut output_exceeded = stdout_capture.exceeded() || stderr_capture.exceeded();

package/crates/runtime-core/src/stdio.rs

@@ -1,5 +1,7 @@
 use std::sync::{Arc, Mutex};
-use wasmer::{AsStoreMut, Extern, Function, FunctionEnv, Imports, Memory, RuntimeError, Value};
+use wasmer::{
+    AsStoreMut, Extern, Function, FunctionEnv, FunctionEnvMut, Imports, Memory, RuntimeError, Value,
+};
 use wasmer_wasix::wasmer_wasix_types::wasi::Filetype;
 
 struct StdioEnv {
@@ -17,7 +19,6 @@ pub(crate) fn attach_redirected_stdio(
         else {
             continue;
         };
-        let signature = original.ty(store);
         let env = FunctionEnv::new(
             store,
             StdioEnv {
@@ -25,32 +26,123 @@ pub(crate) fn attach_redirected_stdio(
                 memory: memory.clone(),
             },
         );
-        imports.define(
-            namespace,
-            "fd_fdstat_get",
-            Function::new_with_env(store, &env, signature, |mut env, arguments| {
-                let result = env.data().original.clone().call(&mut env, arguments)?;
-                if matches!(arguments.first(), Some(Value::I32(0..=2)))
-                    && matches!(result.as_ref(), [Value::I32(0)])
-                {
-                    let offset = match arguments[1] {
-                        Value::I32(offset) => u64::from(offset as u32),
-                        Value::I64(offset) => offset as u64,
-                        _ => return Err(RuntimeError::new("Invalid fdstat pointer type")),
-                    };
-                    let memory = env.data().memory.lock().unwrap();
-                    let memory = memory
-                        .as_ref()
-                        .ok_or_else(|| RuntimeError::new("Missing WASI memory"))?;
-                    // Wasmer hardcodes stdio as CharacterDevice even when backed by pipes.
-                    // WASI has no FIFO filetype; only replace the first fdstat field.
-                    memory
-                        .view(&env)
-                        .write(offset, &[Filetype::Unknown as u8])
-                        .map_err(|error| RuntimeError::new(error.to_string()))?;
+        let function = if namespace == "wasix_64v1" {
+            Function::new_typed_with_env(store, &env, redirected_fdstat_64)
+        } else {
+            Function::new_typed_with_env(store, &env, redirected_fdstat_32)
+        };
+        imports.define(namespace, "fd_fdstat_get", function);
+    }
+}
+
+fn redirected_fdstat_32(
+    env: FunctionEnvMut<StdioEnv>,
+    fd: i32,
+    offset: i32,
+) -> Result<i32, RuntimeError> {
+    redirected_fdstat(env, fd, Value::I32(offset), u64::from(offset as u32))
+}
+
+fn redirected_fdstat_64(
+    env: FunctionEnvMut<StdioEnv>,
+    fd: i32,
+    offset: i64,
+) -> Result<i32, RuntimeError> {
+    redirected_fdstat(env, fd, Value::I64(offset), offset as u64)
+}
+
+fn redirected_fdstat(
+    mut env: FunctionEnvMut<StdioEnv>,
+    fd: i32,
+    pointer: Value,
+    offset: u64,
+) -> Result<i32, RuntimeError> {
+    let original = env.data().original.clone();
+    let result = original.call(&mut env, &[Value::I32(fd), pointer])?;
+    let [Value::I32(errno)] = result.as_ref() else {
+        return Err(RuntimeError::new("WASI fdstat returned an invalid result"));
+    };
+    if (0..=2).contains(&fd) && *errno == 0 {
+        let memory = env.data().memory.lock().unwrap();
+        let memory = memory
+            .as_ref()
+            .ok_or_else(|| RuntimeError::new("Missing WASI memory"))?;
+        // Wasmer hardcodes stdio as CharacterDevice even when backed by pipes.
+        // WASI has no FIFO filetype; only replace the first fdstat field.
+        memory
+            .view(&env)
+            .write(offset, &[Filetype::Unknown as u8])
+            .map_err(|error| RuntimeError::new(error.to_string()))?;
+    }
+    Ok(*errno)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use wasmer::{MemoryType, Store};
+
+    fn original_32(env: FunctionEnvMut<Memory>, fd: i32, offset: i32) -> i32 {
+        original(env, fd, u64::from(offset as u32))
+    }
+
+    fn original_64(env: FunctionEnvMut<Memory>, fd: i32, offset: i64) -> i32 {
+        original(env, fd, offset as u64)
+    }
+
+    fn original(env: FunctionEnvMut<Memory>, fd: i32, offset: u64) -> i32 {
+        if fd == 999 {
+            return 8;
+        }
+        let mut stat = [0x5a; 24];
+        stat[0] = Filetype::CharacterDevice as u8;
+        env.data().view(&env).write(offset, &stat).unwrap();
+        0
+    }
+
+    #[test]
+    fn redirects_only_successful_stdio_filetype_and_preserves_flags_and_rights() {
+        for namespace in ["wasi_snapshot_preview1", "wasix_32v1", "wasix_64v1"] {
+            let mut store = Store::default();
+            let memory = Memory::new(&mut store, MemoryType::new(1, None, false)).unwrap();
+            let env = FunctionEnv::new(&mut store, memory.clone());
+            let original = if namespace == "wasix_64v1" {
+                Function::new_typed_with_env(&mut store, &env, original_64)
+            } else {
+                Function::new_typed_with_env(&mut store, &env, original_32)
+            };
+            let mut imports = Imports::new();
+            imports.define(namespace, "fd_fdstat_get", original);
+            attach_redirected_stdio(
+                &mut store,
+                &mut imports,
+                &Arc::new(Mutex::new(Some(memory.clone()))),
+            );
+            let Some(Extern::Function(stat)) = imports.get_export(namespace, "fd_fdstat_get")
+            else {
+                panic!("missing fdstat wrapper");
+            };
+            for fd in [0, 1, 2, 3, 999] {
+                memory.view(&store).write(32, &[0x5a; 24]).unwrap();
+                let pointer = if namespace == "wasix_64v1" {
+                    Value::I64(32)
+                } else {
+                    Value::I32(32)
+                };
+                let result = stat.call(&mut store, &[Value::I32(fd), pointer]).unwrap();
+                assert!(
+                    matches!(result.as_ref(), [Value::I32(errno)] if *errno == if fd == 999 { 8 } else { 0 })
+                );
+                let mut actual = [0; 24];
+                memory.view(&store).read(32, &mut actual).unwrap();
+                let mut expected = [0x5a; 24];
+                if fd <= 2 {
+                    expected[0] = Filetype::Unknown as u8;
+                } else if fd == 3 {
+                    expected[0] = Filetype::CharacterDevice as u8;
                 }
-                Ok(result.into_vec())
-            }),
-        );
+                assert_eq!(actual, expected, "{namespace} fd {fd}");
+            }
+        }
     }
 }

package/crates/runtime-core/src/web.rs

@@ -1,16 +1,21 @@
 use crate::{
     GoCompilerSession as CoreGoCompilerSession, GoCompilerSessionConfig, GoCompilerSessionRequest,
-    InteractiveRequest, RunRequest, interactive_response, run_response,
+    InteractiveRequest, RunError, RunRequest, interactive_response, run_response_from_result,
 };
 use serde::Serialize;
 use wasm_bindgen::prelude::*;
 
 #[wasm_bindgen]
-pub fn run_wasm_oj(request: JsValue) -> Result<JsValue, JsValue> {
+pub fn run_wasm_oj(request: JsValue, on_execution: js_sys::Function) -> Result<JsValue, JsValue> {
     console_error_panic_hook::set_once();
     let request: RunRequest = serde_wasm_bindgen::from_value(request)
         .map_err(|error| JsValue::from_str(&format!("invalid run request: {error}")))?;
-    let response = run_response(request);
+    let response = run_response_from_result(crate::run::run_observed(request, |running| {
+        on_execution
+            .call1(&JsValue::UNDEFINED, &JsValue::from_bool(running))
+            .map(|_| ())
+            .map_err(|error| RunError::Runtime(format!("execution observer failed: {error:?}")))
+    }));
     response
         .serialize(&serde_wasm_bindgen::Serializer::new().serialize_maps_as_objects(true))
         .map_err(|error| JsValue::from_str(&format!("failed to serialize run response: {error}")))

package/dist/chunks/{go-toolchain-Dbt-lp2L.js → go-toolchain-DRQSILaC.js}

@@ -1,4 +1,4 @@
-import { _ as GO_STANDARD_LIBRARY_SHA256, c as GO_COMPILER_SHA256, d as GO_LINKER_SHA256, f as GO_PACKAGE_ASSET_PATH, g as GO_STANDARD_LIBRARY_ASSET_PATH, h as GO_PACKAGE_SHA256, l as GO_COMPRESSED_PACKAGE_SHA256, m as GO_PACKAGE_MANIFEST_SHA256, p as GO_PACKAGE_MANIFEST_ASSET_PATH, u as GO_COMPRESSED_STANDARD_LIBRARY_SHA256, v as GO_VERSION } from "./toolchains-C6KuA1yM.js";
+import { _ as GO_STANDARD_LIBRARY_SHA256, c as GO_COMPILER_SHA256, d as GO_LINKER_SHA256, f as GO_PACKAGE_ASSET_PATH, g as GO_STANDARD_LIBRARY_ASSET_PATH, h as GO_PACKAGE_SHA256, l as GO_COMPRESSED_PACKAGE_SHA256, m as GO_PACKAGE_MANIFEST_SHA256, p as GO_PACKAGE_MANIFEST_ASSET_PATH, u as GO_COMPRESSED_STANDARD_LIBRARY_SHA256, v as GO_VERSION } from "./toolchains-uz3XbZGI.js";
 import { WASM_OJ_SCHEMAS } from "@wasm-oj/contracts";
 //#region src/compiler/dependency-input.ts
 var ECOSYSTEM_BY_LANGUAGE = Object.freeze({
@@ -22,21 +22,9 @@ function projectDependencyPackages(project, ecosystem) {
 	return project.dependencies?.packages.filter((item) => item.package.ecosystem === ecosystem) ?? [];
 }
 function pythonDependencyFiles(project) {
-	const sourceFiles = [];
-	const artifactFiles = {};
-	for (const item of projectDependencyPackages(project, "pypi")) for (const [path, bytes] of Object.entries(item.files)) {
-		const installedPath = `site-packages/${path}`;
-		artifactFiles[installedPath] = bytes.slice();
-		if (path.endsWith(".py")) sourceFiles.push({
-			path: installedPath,
-			language: "python",
-			content: decodeDependencyText(bytes, item.package.id, path)
-		});
-	}
-	return {
-		sourceFiles,
-		artifactFiles
-	};
+	const files = {};
+	for (const item of projectDependencyPackages(project, "pypi")) for (const [path, bytes] of Object.entries(item.files)) files[`site-packages/${path}`] = bytes.slice();
+	return files;
 }
 function npmDependencyFiles(project) {
 	const files = {};

package/dist/chunks/process-keepalive-BWLUz55N.js

@@ -0,0 +1,16 @@
+//#region src/server/process-keepalive.mjs
+/**
+* Keep Node alive while a promise is backed only by a foreign async runtime.
+* Top-level await does not itself create a referenced libuv handle, so Node can
+* otherwise exit with code 13 while a Wasmer SDK operation is still pending.
+*/
+async function withProcessKeepalive(promise) {
+	const keepalive = setInterval(() => void 0, 6e4);
+	try {
+		return await promise;
+	} finally {
+		clearInterval(keepalive);
+	}
+}
+//#endregion
+export { withProcessKeepalive as t };

package/dist/chunks/{rust-toolchain-CJ3sMxPE.js → rust-toolchain-CK5h2WT8.js}

@@ -1,4 +1,4 @@
-import { F as RUST_PACKAGE_MANIFEST_ASSET_PATH, I as RUST_PACKAGE_MANIFEST_SHA256, L as RUST_PACKAGE_SHA256, N as RUST_COMPRESSED_PACKAGE_SHA256, P as RUST_PACKAGE_ASSET_PATH, R as RUST_VERSION } from "./toolchains-C6KuA1yM.js";
+import { F as RUST_PACKAGE_SHA256, I as RUST_VERSION, M as RUST_PACKAGE_ASSET_PATH, N as RUST_PACKAGE_MANIFEST_ASSET_PATH, P as RUST_PACKAGE_MANIFEST_SHA256, j as RUST_COMPRESSED_PACKAGE_SHA256 } from "./toolchains-uz3XbZGI.js";
 /**
 * Accept a mounted output only after byte-identical snapshots have persisted for
 * the complete stability interval. This prevents a valid WebAssembly prefix

package/dist/chunks/{toolchains-C6KuA1yM.js → toolchains-uz3XbZGI.js}

@@ -12,37 +12,37 @@ var CLANG_COMPRESSED_PACKAGE_SHA256 = "7f10d90b8e52b270f04874641a1d0bf9e94e85b4f
 /** SHA-256 after browser-side gzip decompression. */
 var CLANG_PACKAGE_SHA256 = "21ded33b9c6d4e1aaad5528c940bdaf6c3e84be77ea8f522f018ca7289a2a224";
 /** SHA-256 of the pinned cc1/wasm-ld argv manifest; regenerated by scripts/pin-clang-cc1-argv.mjs. */
-var CLANG_CC1_PINS_SHA256 = "66c4604dccd3f89d8e1472bf4432367d7396cce4a01279b1a1db445f229dba72";
+var CLANG_CC1_PINS_SHA256 = "895eee17c63b1112c84adcc4ddbcb38e0c18e53bff15f50a8689b9b82d87b1ff";
 var CLANG_MANIFEST_SHA256 = "6382dcdfb6a2da49032a0e08da3b1fb490eb24432be85c3c12e3e871a5065273";
 /** Updated atomically with the generated toolchain-admitted PCH assets. */
-var CLANG_LIBCXX_PCH_MANIFEST_SHA256 = "d126c99e951a7302d4ea2b66da4ed64d3d74e9d319d562518867c8d8c97a06b8";
+var CLANG_LIBCXX_PCH_MANIFEST_SHA256 = "9bbe41d77c786f1c36169369c909268530b05726e1581683f6edd9a2983eebd0";
 var CLANG_LIBCXX_PCH = Object.freeze({
 	"cpp-debug": Object.freeze({
 		path: CLANG_LIBCXX_PCH_DEBUG_ASSET_PATH,
-		sha256: "05a4db721448ba33e65977cb4ac366908ea215ab377e3b6d09f1fd224d515b68",
-		compressedSha256: "a4152027d248412eca8aec3e7e23f6f7c81f95170cae9fd385bcf02e57e91fc9"
+		sha256: "c420c4643c48826643e75585d5bfdc281f11883d4bda28b283e3c706f3046b3a",
+		compressedSha256: "a3811351bae3289caf096f2d4bb6d2ee5db84b97e05514e87190d36b65c500cf"
 	}),
 	"cpp-release": Object.freeze({
 		path: CLANG_LIBCXX_PCH_RELEASE_ASSET_PATH,
-		sha256: "aec9e778ac527c120ba369b9b0e142cf8206d11365801208847ba0e1c39daa1a",
-		compressedSha256: "18f4ca8ab8ca7888db572ba34146fc1acb213a7e7305000ea6285188f52f99f4"
+		sha256: "c4b2132cc6d698e97dd1386431fdb54faaaf38b35b2528c7bc854f860d1f64b1",
+		compressedSha256: "ef004fc05ec50af697a37f7c9c814bf62e9676d0de162d6ac35305533939f93f"
 	})
 });
-var PYTHON_VERSION = "3.14.6";
-var PYTHON_PACKAGE_SHA256 = "454ffc53936aa13a0d7f4afbb5bd50ada339c8ebd04bbf27ea19e4104cf43207";
+var PYTHON_VERSION = "3.14.7";
+var PYTHON_PACKAGE_SHA256 = "a42c98f5f00582638c8e445440c506bbf94d5e55b3415d1f8d82d11c56cd4b56";
 var PYTHON_PACKAGE = `${`wasm-oj/cpython@${PYTHON_VERSION}`}#sha256:${PYTHON_PACKAGE_SHA256}`;
 var PYTHON_PACKAGE_ASSET_PATH = `/toolchains/python-${PYTHON_VERSION}-wasip1.webc.gz.bin`;
 var PYTHON_PACKAGE_MANIFEST_ASSET_PATH = `/toolchains/python-${PYTHON_VERSION}-wasip1.manifest.json`;
-var PYTHON_COMPRESSED_PACKAGE_SHA256 = "218cd20ac4abb443e0700816010a615a345a43eae623a0232da2227135a6c7a6";
-var PYTHON_PACKAGE_MANIFEST_SHA256 = "054eccad04a7cee7ba1661062142ef0d639976850981eab8fc785f48eb26129e";
-var PYTHON_RUNTIME_FILES_ARCHIVE_SHA256 = "44d894f91487f20c2bb04fe496a9343db37d8720fb706472c2b4a7f3300db039";
+var PYTHON_COMPRESSED_PACKAGE_SHA256 = "10027f0e32c77dfa0ce1c413b6cb27307d6744fe5e18e6da8cea738bd020260c";
+var PYTHON_PACKAGE_MANIFEST_SHA256 = "53a24b258363a8494af164121111a34b49c85fa0e054627fe131feba6f359cd5";
+var PYTHON_RUNTIME_FILES_ARCHIVE_SHA256 = "c1acac884af1c86833db5b65f8cc0a2304fce74dea0a05d9b40bde0a4e3e7c0e";
 var QUICKJS_VERSION = "0.15.1";
 var QUICKJS_PACKAGE = `wasm-oj/quickjs-ng@${QUICKJS_VERSION}`;
 var QUICKJS_ASSET_PATH = `/toolchains/quickjs-${QUICKJS_VERSION}.wasm.gz.bin`;
-var QUICKJS_ASSET_SHA256 = "8c7f0588210490e7d77f198fc91f72c1b94787ab4c359c4786ca59a363c4f5e8";
+var QUICKJS_ASSET_SHA256 = "dc6e02e8610269e61b341331661515616451cec929fd534fa96d1c4f47fbcc9a";
 var TYPESCRIPT_VERSION = "7.0.2";
 var TYPESCRIPT_ASSET_PATH = `/toolchains/typescript-${TYPESCRIPT_VERSION}.wasm.gz.bin`;
-var TYPESCRIPT_ASSET_SHA256 = "06e58ce887d95d1895055699b8dc96a1cde7d1f2baa48de40f9b790e3271dc16";
+var TYPESCRIPT_ASSET_SHA256 = "29c6ee0e46151e2644049ae96162b1b1d46dcb13310e2a928114bb9030c3ea92";
 var RUST_VERSION = "1.91.1-dev";
 var RUST_PACKAGE_ASSET_PATH = `/toolchains/rust-${RUST_VERSION}.webc.gz.bin`;
 var RUST_PACKAGE_MANIFEST_ASSET_PATH = `/toolchains/rust-${RUST_VERSION}.manifest.json`;
@@ -61,16 +61,14 @@ var GO_COMPRESSED_STANDARD_LIBRARY_SHA256 = "aeffc384fdc624544f174ba5fc3c2239571
 var GO_STANDARD_LIBRARY_SHA256 = "e1ec64b08efd02b35b7ffdaf3970875aaae98325fa4795eafca94ebae2d0d192";
 var GO_COMPILER_SHA256 = "9e557f5b86961fd604217d7521461c5d2b7322e383fa30dead5669b77db12201";
 var GO_LINKER_SHA256 = "2eefca10af935a307ab7946447146bd30e0ea0fb5460be54dc1c55844d155580";
-var JAVA_VERSION = "teavm-0.13.1-wasi";
+var JAVA_VERSION = "teavm-0.13.1-wasmgc-wasip1";
 var JAVA_COMPILER_PACKAGE = `wasm-oj/java-teavm@${JAVA_VERSION}`;
-var JAVA_COMPILER_ASSET_PATH = "/toolchains/java-teavm-0.13.1.wasi.compiler.webc.gz.bin";
+var JAVA_COMPILER_ASSET_PATH = "/toolchains/java-teavm-0.13.1.compiler.wasm";
 var JAVA_COMPILE_CLASSLIB_ASSET_PATH = "/toolchains/java-teavm-0.13.1.compile-classlib.bin";
 var JAVA_RUNTIME_CLASSLIB_ASSET_PATH = "/toolchains/java-teavm-0.13.1.runtime-classlib.bin";
-var JAVA_COMPILER_COMPRESSED_PACKAGE_SHA256 = "129f1f51d591e58954f88787d36396b856a9a68ba3ae9c9d14f20bd67c2c7722";
-var JAVA_COMPILER_PACKAGE_SHA256 = "f8f86761cf31062565187e4a66f73b6903f257fe84c0ce70ea1cd28441b6c2e9";
-var JAVA_COMPILER_SHA256 = "33a0d662395256f10a5d02ea305fc7b18007b2b8fe8996859017b084d3d19735";
-var JAVA_COMPILE_CLASSLIB_SHA256 = "acfe3fb09e5f2c0c7c8dc2339c66fcdadc1f8e1bf1c74be446926175ef770868";
-var JAVA_RUNTIME_CLASSLIB_SHA256 = "21a9394586e416af2fca4eb0ed08521cbc8924e1d1afaa07863a59a3cfae54ab";
+var JAVA_COMPILER_SHA256 = "8c37bce1c6fceeaffeffe93e10834309b67c8b6fb58c6f8a24547afe8be67f5d";
+var JAVA_COMPILE_CLASSLIB_SHA256 = "738a82b7d7e7ff8d98b07bb076785da7035847a166afb8446fd150c4efce6103";
+var JAVA_RUNTIME_CLASSLIB_SHA256 = "0ed234b66cdde19cb29e6c2865a3636d792d3cf72f102e73a7b3fdede80b79e6";
 Object.freeze({
 	[CLANG_PACKAGE_ASSET_PATH]: CLANG_COMPRESSED_PACKAGE_SHA256,
 	[CLANG_CC1_PINS_ASSET_PATH]: CLANG_CC1_PINS_SHA256,
@@ -87,7 +85,7 @@ Object.freeze({
 	[GO_PACKAGE_ASSET_PATH]: GO_COMPRESSED_PACKAGE_SHA256,
 	[GO_PACKAGE_MANIFEST_ASSET_PATH]: GO_PACKAGE_MANIFEST_SHA256,
 	[GO_STANDARD_LIBRARY_ASSET_PATH]: GO_COMPRESSED_STANDARD_LIBRARY_SHA256,
-	[JAVA_COMPILER_ASSET_PATH]: JAVA_COMPILER_COMPRESSED_PACKAGE_SHA256,
+	[JAVA_COMPILER_ASSET_PATH]: JAVA_COMPILER_SHA256,
 	[JAVA_COMPILE_CLASSLIB_ASSET_PATH]: JAVA_COMPILE_CLASSLIB_SHA256,
 	[JAVA_RUNTIME_CLASSLIB_ASSET_PATH]: JAVA_RUNTIME_CLASSLIB_SHA256
 });
@@ -130,8 +128,6 @@ var TOOLCHAIN_CONTENT_SHA256 = Object.freeze({
 /** Exact executable/compiler content used by cache keys and cost calibration. */
 function toolchainContentIdentity(language) {
 	if (language === "java") return [
-		JAVA_COMPILER_COMPRESSED_PACKAGE_SHA256,
-		JAVA_COMPILER_PACKAGE_SHA256,
 		JAVA_COMPILER_SHA256,
 		JAVA_COMPILE_CLASSLIB_SHA256,
 		JAVA_RUNTIME_CLASSLIB_SHA256
@@ -182,7 +178,7 @@ var TOOLCHAINS = Object.freeze({
 		runtimePackage: PYTHON_PACKAGE,
 		targets: ["wasip1"],
 		version: PYTHON_VERSION,
-		note: "Byte-compiled project bundled with the source-built CPython wasm32-wasip1 interpreter and standard library."
+		note: "Python source files executed by the source-built CPython wasm32-wasip1 interpreter and standard library."
 	}),
 	javascript: freezeToolchain({
 		language: "javascript",
@@ -221,4 +217,4 @@ function toolchainPackageIdentities(language) {
 	return [.../* @__PURE__ */ new Set([...toolchain.compilerPackages, ...toolchain.runtimePackage ? [toolchain.runtimePackage] : []])];
 }
 //#endregion
-export { PYTHON_PACKAGE_ASSET_PATH as A, TYPESCRIPT_VERSION as B, JAVA_COMPILE_CLASSLIB_ASSET_PATH as C, JAVA_VERSION as D, JAVA_RUNTIME_CLASSLIB_SHA256 as E, RUST_PACKAGE_MANIFEST_ASSET_PATH as F, toolchainPackageIdentities as H, RUST_PACKAGE_MANIFEST_SHA256 as I, RUST_PACKAGE_SHA256 as L, QUICKJS_PACKAGE as M, RUST_COMPRESSED_PACKAGE_SHA256 as N, PYTHON_COMPRESSED_PACKAGE_SHA256 as O, RUST_PACKAGE_ASSET_PATH as P, RUST_VERSION as R, JAVA_COMPILER_PACKAGE_SHA256 as S, JAVA_RUNTIME_CLASSLIB_ASSET_PATH as T, toolchainContentIdentity as V, GO_STANDARD_LIBRARY_SHA256 as _, CLANG_PACKAGE_ASSET_PATH as a, JAVA_COMPILER_COMPRESSED_PACKAGE_SHA256 as b, GO_COMPILER_SHA256 as c, GO_LINKER_SHA256 as d, GO_PACKAGE_ASSET_PATH as f, GO_STANDARD_LIBRARY_ASSET_PATH as g, GO_PACKAGE_SHA256 as h, CLANG_LIBCXX_PCH_MANIFEST_SHA256 as i, PYTHON_PACKAGE_SHA256 as j, PYTHON_PACKAGE as k, GO_COMPRESSED_PACKAGE_SHA256 as l, GO_PACKAGE_MANIFEST_SHA256 as m, CLANG_CC1_PINS_SHA256 as n, CLANG_PACKAGE_SHA256 as o, GO_PACKAGE_MANIFEST_ASSET_PATH as p, CLANG_LIBCXX_PCH_MANIFEST_ASSET_PATH as r, CLANG_VERSION as s, CLANG_CC1_PINS_ASSET_PATH as t, GO_COMPRESSED_STANDARD_LIBRARY_SHA256 as u, GO_VERSION as v, JAVA_COMPILE_CLASSLIB_SHA256 as w, JAVA_COMPILER_PACKAGE as x, JAVA_COMPILER_ASSET_PATH as y, TYPESCRIPT_ASSET_PATH as z };
+export { QUICKJS_PACKAGE as A, toolchainPackageIdentities as B, JAVA_COMPILE_CLASSLIB_SHA256 as C, PYTHON_COMPRESSED_PACKAGE_SHA256 as D, JAVA_VERSION as E, RUST_PACKAGE_SHA256 as F, RUST_VERSION as I, TYPESCRIPT_ASSET_PATH as L, RUST_PACKAGE_ASSET_PATH as M, RUST_PACKAGE_MANIFEST_ASSET_PATH as N, PYTHON_PACKAGE as O, RUST_PACKAGE_MANIFEST_SHA256 as P, TYPESCRIPT_VERSION as R, JAVA_COMPILE_CLASSLIB_ASSET_PATH as S, JAVA_RUNTIME_CLASSLIB_SHA256 as T, GO_STANDARD_LIBRARY_SHA256 as _, CLANG_PACKAGE_ASSET_PATH as a, JAVA_COMPILER_PACKAGE as b, GO_COMPILER_SHA256 as c, GO_LINKER_SHA256 as d, GO_PACKAGE_ASSET_PATH as f, GO_STANDARD_LIBRARY_ASSET_PATH as g, GO_PACKAGE_SHA256 as h, CLANG_LIBCXX_PCH_MANIFEST_SHA256 as i, RUST_COMPRESSED_PACKAGE_SHA256 as j, PYTHON_PACKAGE_SHA256 as k, GO_COMPRESSED_PACKAGE_SHA256 as l, GO_PACKAGE_MANIFEST_SHA256 as m, CLANG_CC1_PINS_SHA256 as n, CLANG_PACKAGE_SHA256 as o, GO_PACKAGE_MANIFEST_ASSET_PATH as p, CLANG_LIBCXX_PCH_MANIFEST_ASSET_PATH as r, CLANG_VERSION as s, CLANG_CC1_PINS_ASSET_PATH as t, GO_COMPRESSED_STANDARD_LIBRARY_SHA256 as u, GO_VERSION as v, JAVA_RUNTIME_CLASSLIB_ASSET_PATH as w, JAVA_COMPILER_SHA256 as x, JAVA_COMPILER_ASSET_PATH as y, toolchainContentIdentity as z };