Consume deltic from JSR: packaged translator, repo-built browser assets

AGENTS.md

@@ -88,9 +88,9 @@ with copies; symlinks require `core.symlinks` on Windows.
 
 wasmtime 47 (`-W component-model-async -S p3`), wac-cli 0.10, wit-bindgen
 0.60, Node 24 (plain — the selftest legs; no engine flags anywhere:
-deltic's callback ABI needs no JSPI), deno 2.9 (deltic asset fetching +
-runner leg; deltic itself is release-pinned — see
-`js/runner-deltic/README.md`), Rust
+deltic's callback ABI needs no JSPI), deno 2.9 (deltic runner
+leg + browser-asset build; deltic itself is consumed from JSR as exact
+prerelease pins — see `js/runner-deltic/README.md`), Rust
 target `wasm32-wasip2`, wasm-tools (WIT validation), just (task
 runner). jco is GONE from this repo (the deltic migration's Phase 4
 cutover); its findings in `docs/findings.md` are historical. Known
@@ -144,14 +144,14 @@ them before committing anything cross-cutting):
    component-model-async -S p3`. Same sample-suite verdicts.
 3. **deltic runner + browser leg** (see `js/runner-deltic/README.md`):
    drive the suite directly under deltic — no transpile step, no engine
-   flag; release-pinned in `js/runner-deltic/`. Same sample verdicts
-   (shared human + fold goldens); tag scheduling from the suite's own
-   embedded inventory (fixture leg runs `--missing hsm` like Paths 1/4,
-   lane goldens in `expected/verify-deltic-*`). The browser worker
-   (`browser-worker.mjs`, drop-in for `page-runner.mjs` via `workerUrl`)
-   shares `harness.mjs`'s case loop; `selftest.mjs` gates that engine
-   path under plain node as `verify-deltic`'s last leg. (The jco-node
-   runner that used to be this path was deleted in the deltic
+   flag; JSR-pinned in `js/runner-deltic/deno.json` + `deno.lock`. Same
+   sample verdicts (shared human + fold goldens); tag scheduling from the
+   suite's own embedded inventory (fixture leg runs `--missing hsm` like
+   Paths 1/4, lane goldens in `expected/verify-deltic-*`). The browser
+   worker (`browser-worker.mjs`, drop-in for `page-runner.mjs` via
+   `workerUrl`) shares `harness.mjs`'s case loop; `selftest.mjs` gates
+   that engine path under plain node as `verify-deltic`'s last leg. (The
+   jco-node runner that used to be this path was deleted in the deltic
    migration's Phase 4; `js/viewer/browser-worker.mjs` remains as
    consumer-facing glue for transpiled-module layouts.)
 4. **Inventory + results pipeline**:

js/runner-deltic/README.md

@@ -11,14 +11,16 @@ suites' `wasi:{cli,clocks,io,random,filesystem}` leaves.
 
 ```sh
 cargo build --target wasm32-wasip2 --release -p sample-suite   # from repo root
-translator=$(deno run --allow-read=js/runner-deltic,target --allow-write=target \
-    --allow-net=github.com,objects.githubusercontent.com,release-assets.githubusercontent.com \
-    js/runner-deltic/fetch-deltic.ts --asset translator)
 deno run --allow-read=target --config js/runner-deltic/deno.json --frozen \
     js/runner-deltic/runner.ts target/wasm32-wasip2/release/sample_suite.wasm \
-    --translator "$translator" [--jsonl]
+    [--jsonl]
 ```
 
+No fetch step and no extra permissions: the translator arrives with the
+pinned `@deltic/translator` package and loads through the module graph
+(`defaultTranslator()`). `--translator <wasm>` remains as a documented
+escape hatch for an externally-sourced translator build.
+
 Human mode reproduces `expected/verify-run-sample.txt` byte-for-byte
 (shared with the composed-cli and jco legs); `--jsonl` emits canonical
 L4 results JSONL (`just verify-deltic` diffs it, normalized, against
@@ -35,9 +37,9 @@ cases out as `not-applicable`.
 `harness.mjs` case loop (striping, freshCases, timeouts, mark
 scheduling), no transpiled artifacts: the run message carries
 `{ bundleUrl, translatorUrl, suiteUrl, env?, missing?, only?, shard?,
-caseTimeoutMs? }` and the worker loads the pinned `deltic-embedder.mjs`
-release asset (one platform-neutral ES module: embedder API +
-Translator + runner glue + wasi shims). It drops into
+caseTimeoutMs? }` and the worker loads `deltic-embedder.mjs`, built by
+`just deltic-assets` from the pinned JSR graph (one platform-neutral
+ES module: embedder API + Translator + runner glue + wasi shims). It drops into
 `page-runner.mjs`'s `runSuitesInPage` via its `workerUrl` parameter —
 page runner and browser driver unchanged. `engine.mjs` is the shared
 glue; `selftest.mjs` drives the same engine path under plain `node`
@@ -60,19 +62,35 @@ bundleUrl-loading defaults.
 
 ## Pinning
 
-deltic is pinned to a release tag in **two** places, cross-checked at
-run time by `fetch-deltic.ts`:
+deltic is consumed from JSR as **exact-pinned unstable prereleases**:
+every green deltic `main` commit publishes
+`@deltic/{runtime,translator,wasi-shims,ct-runner}` as
+`0.1.0-pre.g<shorthash>`, so one version names one upstream commit
+(there is no stable line yet — hash versions are unordered and semver
+ranges never resolve to prereleases).
 
-- `deno.json` — import-map URLs (`raw.githubusercontent.com/lann/deltic/<tag>/…`);
-  `deno.lock` carries integrity hashes for that module graph and is
-  enforced with `--frozen`. The `@deltic/runtime/embedder` entry exists
-  because `wasi-shims` imports it by bare specifier (resolved by the
-  workspace config inside deltic; URL consumers must map it).
-- `fetch-deltic.ts` — `TAG` + per-asset sha256 for the
-  `deltic-translator-shim.wasm` and `deltic-embedder.mjs` release assets
-  (cached under `target/deltic/<tag>/`; `--asset translator|embedder`).
+- `deno.json` — the import map holds the five `jsr:@deltic/...@<version>`
+  specifiers. `@deltic/runtime/embedder` is mapped because
+  `@deltic/wasi-shims` imports it by bare specifier.
+  `minimumDependencyAge` exempts the `@deltic` scope so same-day
+  publishes resolve (Deno >= 2.9 for the wildcard exclude).
+- `deno.lock` — carries JSR package integrity for that graph and is
+  enforced with `--frozen` on every run, check, bundle, and
+  `deno info` invocation.
+- No sha256 bookkeeping and no release-asset downloads: the browser-leg
+  assets are built from the same locked graph by `just deltic-assets`
+  into `target/deltic-browser/` — `deltic-embedder.mjs` bundled from
+  `browser-bundle-entry.ts`, and `deltic-translator-shim.wasm` copied
+  out of the lock-pinned module cache (the packaged
+  `@deltic/translator` asset). The directory is version-free: the lock
+  owns versioning.
+- `just deltic-pin-gate` (a `verify-deltic` prerequisite, so it runs in
+  CI) asserts one version across every `@deltic` specifier in every
+  `deno.json` and everything the lock resolves — the successor to the
+  retired release-asset fetch script's `assertPinConsistency`.
 
-To bump: update the tag in both files and the shas from the release's
-`SHA256SUMS`, delete `deno.lock`, re-run
-`deno cache runner.ts fetch-deltic.ts` in this directory, regenerate the
-`expected/verify-deltic-*` goldens, and commit the diff.
+To bump: update the version in `deno.json`'s import map, delete
+`deno.lock`, re-run `deno install --entrypoint runner.ts
+browser-bundle-entry.ts` in this directory, and commit the diff; the pin
+gate asserts agreement. Regenerate the `expected/verify-deltic-*`
+goldens only if an explained upstream behavior change moves them.

js/runner-deltic/browser-bundle-entry.ts

@@ -0,0 +1,18 @@
+// The browser-leg bundle entry: one platform-neutral ES module carrying
+// the embedder API + Translator + ct-runner glue + wasi shims, bundled
+// from the SAME pinned JSR graph as the Deno leg (deno.json + deno.lock,
+// --frozen). It replaces the sha-pinned `deltic-embedder.mjs` release
+// asset the retired release-asset fetch script downloaded; the surface is
+// upstream tools/release-bundle/entry.ts's, verbatim.
+//
+//   deno bundle --config js/runner-deltic/deno.json --frozen \
+//       --platform browser -o target/deltic-browser/deltic-embedder.mjs \
+//       js/runner-deltic/browser-bundle-entry.ts
+//
+// (`just deltic-assets` builds it; verify-deltic/viewer-build consume it.)
+
+export * from "@deltic/runtime/embedder";
+export { Translator } from "@deltic/runtime/shim";
+export * from "@deltic/ct-runner";
+export { wasiShims } from "@deltic/wasi-shims";
+export type { WasiShims, WasiShimsOptions } from "@deltic/wasi-shims";

js/runner-deltic/browser-worker.mjs

@@ -5,8 +5,10 @@
 // worker's run message instead of the jco one:
 //
 //   {
-//     bundleUrl,      // the pinned deltic-embedder.mjs (release asset)
-//     translatorUrl,  // the pinned deltic-translator-shim.wasm
+//     bundleUrl,      // deltic-embedder.mjs, built from the pinned JSR
+//                     // graph by `just deltic-assets`
+//     translatorUrl,  // deltic-translator-shim.wasm, extracted from the
+//                     // same locked graph (@deltic/translator's asset)
 //     suiteUrl,       // the suite COMPONENT wasm (no transpile, no cores)
 //     env?,           // [name, value] pairs for wasi:cli/environment
 //     missing?, only?, shard?, caseTimeoutMs?,

js/runner-deltic/deno.json

@@ -1,8 +1,32 @@
 {
+  // MODULE IDENTITY — deltic is consumed from JSR as exact-pinned unstable
+  // prereleases: every green deltic `main` commit publishes
+  // `0.1.0-pre.g<shorthash>`, so the version below NAMES ONE upstream commit
+  // (there is no stable line yet; hash versions are unordered and semver
+  // ranges never resolve to prereleases, hence exact pins). All four
+  // packages must carry the SAME version — `just verify-deltic`'s pin gate
+  // asserts that repo-wide.
+  //
+  // `@deltic/runtime/embedder` is mapped because `@deltic/wasi-shims`
+  // imports it by bare specifier. `@deltic/translator` ships the translator
+  // wasm built from the same commit: the Deno leg loads it through the
+  // module graph (`defaultTranslator()`, permission-free) and the browser
+  // leg extracts it from the lock-pinned module cache — no release-asset
+  // fetch, no sha bookkeeping. `deno.lock` carries JSR package integrity
+  // and is enforced with `--frozen` everywhere.
+  //
+  // Bumping: change the version in these five specifiers, delete deno.lock,
+  // re-run `deno install --entrypoint runner.ts browser-bundle-entry.ts` in
+  // this directory, and commit the diff (see README.md "Pinning").
   "imports": {
-    "@deltic/ct-runner": "https://raw.githubusercontent.com/lann/deltic/pre-83fff30/ct-runner/src/mod.ts",
-    "@deltic/runtime/embedder": "https://raw.githubusercontent.com/lann/deltic/pre-83fff30/runtime/src/embedder/mod.ts",
-    "@deltic/runtime/shim": "https://raw.githubusercontent.com/lann/deltic/pre-83fff30/runtime/src/shim/mod.ts",
-    "@deltic/wasi-shims": "https://raw.githubusercontent.com/lann/deltic/pre-83fff30/wasi-shims/src/mod.ts"
-  }
+    "@deltic/ct-runner": "jsr:@deltic/ct-runner@0.1.0-pre.ga67ee83",
+    "@deltic/runtime/embedder": "jsr:@deltic/runtime@0.1.0-pre.ga67ee83/embedder",
+    "@deltic/runtime/shim": "jsr:@deltic/runtime@0.1.0-pre.ga67ee83/shim",
+    "@deltic/translator": "jsr:@deltic/translator@0.1.0-pre.ga67ee83",
+    "@deltic/wasi-shims": "jsr:@deltic/wasi-shims@0.1.0-pre.ga67ee83"
+  },
+  // Deno's supply-chain minimum-dependency-age gate (24h default) applies
+  // even to exact prerelease pins; deltic publishes per commit, so the
+  // scope is excluded (wildcard excludes need Deno >= 2.9; CI pins 2.9.5).
+  "minimumDependencyAge": { "age": "P1D", "exclude": ["jsr:@deltic/*"] }
 }