Converge .deps pins on the JSR-consuming siblings; gate module identity on the resolved graph

host-deltic/README.md

@@ -83,7 +83,18 @@ diff.
 ## Module identity
 
 deltic's wasi-shims and the sibling deltic host modules import
-`@deltic/runtime/embedder` by bare specifier internally; `deno.json`
-maps that specifier once for the whole module graph, so there is exactly
-one `WitError`/`Stream` module instance and `instanceof` holds across
-every boundary.
+`@deltic/runtime/embedder` by bare specifier internally. This config's
+import map does NOT govern the sibling checkouts' files: a `.deps`
+module under its own package-shaped `deno.json` (name + exports)
+resolves its bare specifiers against THAT config — before the `.deps`
+pins converged on JSR-consuming sibling revisions, the webcrypto module
+silently rode a raw pinned-tag embedder while everything else used the
+JSR one, and `instanceof WitError` did not hold across its boundary.
+Identity therefore rests on every config in the graph — this one and
+each pinned sibling's — naming the SAME `jsr:@deltic/*` version, so the
+resolver dedupes to one `WitError`/`Stream` module instance. Two gates
+in `just exam-deltic` keep it true: the pin grep (this repo's configs
+agree) and `scripts/deltic-identity-gate.ts` (the RESOLVED run-endpoint
+graph carries exactly one `@deltic/runtime` and no raw URLs). Bumping a
+`.deps` pin to a sibling revision that consumes a different deltic
+version trips the gate; converge the versions instead.

justfile

@@ -81,6 +81,11 @@ exam-deltic: build-components relay-build deltic-setup
         echo "deltic pin drift across deno.jsons: $v" >&2
         exit 1
     fi
+    # ...and the RESOLVED graph must agree: one embedder instance, no raw
+    # URLs (a sibling .deps module's own config can silently split module
+    # identity in a way no config grep catches; see the gate script).
+    deno info --json --config host-deltic/deno.json host-deltic/src/run-endpoint.ts \
+        | deno run scripts/deltic-identity-gate.ts
     timeout 600 deno run -A --config host-deltic/deno.json --frozen \
         host-deltic/src/run-endpoint.ts
 

scripts/deltic-identity-gate.ts

@@ -0,0 +1,34 @@
+// The deltic module-identity assert (host-deltic/README.md "Module
+// identity"): the run-endpoint graph must contain exactly ONE
+// @deltic/runtime version and ZERO raw.githubusercontent modules.
+//
+// The failure this guards (seen live before the .deps pins converged on
+// JSR-consuming sibling revisions): a sibling host module's own
+// package-shaped deno.json mapped @deltic/runtime/embedder to a raw
+// pinned-tag URL, so the graph carried TWO embedder module instances and
+// `instanceof WitError` silently stopped holding across that sibling's
+// boundary. Config greps can't see this — only the resolved graph can —
+// so the exam pipes `deno info --json` through this assert.
+//
+//   deno info --json --config host-deltic/deno.json \
+//       host-deltic/src/run-endpoint.ts | deno run scripts/deltic-identity-gate.ts
+const g = JSON.parse(await new Response(Deno.stdin.readable).text());
+const raw = g.modules.filter((m: { specifier: string }) =>
+  m.specifier.includes("raw.githubusercontent")
+);
+const vers = new Set(
+  g.modules
+    .map((m: { specifier: string }) =>
+      m.specifier.match(/jsr\.io\/@deltic\/runtime\/([^/]+)\//)?.[1]
+    )
+    .filter(Boolean),
+);
+if (raw.length || vers.size !== 1) {
+  console.error(
+    `deltic module identity violated: ${raw.length} raw-URL module(s), ` +
+      `@deltic/runtime versions=[${[...vers].join(", ")}] (want exactly one, no raw URLs)`,
+  );
+  for (const m of raw.slice(0, 5)) console.error(`  raw: ${m.specifier}`);
+  Deno.exit(1);
+}
+console.log(`deltic module identity: one runtime (${[...vers][0]}), no raw URLs`);

scripts/setup.sh

@@ -16,11 +16,11 @@ JUST_VERSION="${JUST_VERSION:-1.54.0}"
 WAC_VERSION="${WAC_VERSION:-0.10.1}"
 
 WEBRTC_REPO=https://github.com/polymorph-components/polymorph-webrtc-datachannels.git
-WEBRTC_PIN=13ddd6b4289e2503cb41fa7680758f2e3ddb08a8
+WEBRTC_PIN=5dc3d4184d2ab82b98aa0ff82a218f9ed1e080eb
 WEBCRYPTO_REPO=https://github.com/polymorph-components/polymorph-webcrypto.git
-WEBCRYPTO_PIN=8a3de9cdaae901643d906b8d83f47bb797a2dd74
+WEBCRYPTO_PIN=a0c924d3f10cc598e9ea2e754dc4f13f162dc749
 WEBSOCKET_REPO=https://github.com/polymorph-components/polymorph-websocket.git
-WEBSOCKET_PIN=f8fdf6601d251186a42c66b83f228368415d16ff
+WEBSOCKET_PIN=a3b7fb1d0231c110b0bebb493276d23308642537
 IROH_REPO=https://github.com/n0-computer/iroh.git
 IROH_PIN=816dd70c056b813dcb5cbfb6a9a15e12d04b72b1 # v1.0.3
 TLS_REPO=https://github.com/polymorph-components/polymorph-tls.git