fix(itkwasm): support wasmtime 48

[vboussot]

import itkwasm fails on wasmtime >= 48.0.0, released 2026-08-20:

ImportError: cannot import name 'DirPerms' from 'wasmtime'

pipeline.py imports DirPerms and FilePerms at module scope, so the failure hits at import time, before anything runs. Any test suite that imports itkwasm from a conftest.py dies during collection.

What changed upstream

wasmtime 48.0.0 simplified wasi-filesystem permissions to read-write or read-only per directory (bytecodealliance/wasmtime#14010, listed under Changed in the 48.0.0 notes). In the Python bindings (bytecodealliance/wasmtime-py@2ed8d10) both enums are deleted and the signature becomes:

# 28.0.0 through 47.0.1
def preopen_dir(self, path, guest_path,
                dir_perms=DirPerms.READ_WRITE, file_perms=FilePerms.READ_WRITE)
# 48.0.0
def preopen_dir(self, path, guest_path, fs_mutable: bool = True)

The fix

Read-write is the default on both sides of that change, so passing neither permission argument keeps the current behaviour across the whole declared wasmtime >= 28.0.0 range. No version branching, no try/except, no floor bump.

Signature checked at every relevant tag:

wasmtime	preopen_dir signature
28.0.0	dir_perms=DirPerms.READ_WRITE, file_perms=FilePerms.READ_WRITE
33.0.0	same
40.0.0	same
47.0.1	same
48.0.0	fs_mutable: bool = True

Verification

Pipeline.run builds preopen_directories from TextFile and BinaryFile interfaces only, so a pipeline carrying images or streams leaves the list empty and never enters the changed loop. Verification therefore drives the same wasm module and inputs as test/test_pipeline.py::test_pipeline_input_output_files: input-output-files-test.wasi.wasm with a text and a binary input read from one preopened directory, and both outputs written into a second, asserting the bytes that land on disk.

wasmtime	preopened directories	result
28.0.0 (declared floor)	2 (input, output)	guest read and wrote, bytes match
47.0.1 (last with the enums)	2	guest read and wrote, bytes match
48.0.0 (removes them)	2	guest read and wrote, bytes match

RunInstance.__init__ was instrumented for those runs to confirm the two directories reach preopen_dir rather than assuming it.

DirPerms and FilePerms appear nowhere else in the repository.

One coverage note, outside this fix

No CI job exercises test_pipeline_input_output_files: the python-wasm.yml matrix covers the derived packages (downsample, image-io, ...), not packages/core/python/itkwasm, and those packages' pixi environments resolve itkwasm from released PyPI wheels rather than from the local tree. Every pixi.lock in the repository also pins wasmtime below 48. So this change, and the preopen_dir call in general, is not covered by the current matrix on any wasmtime version.

[thewtex]

@vboussot thank you for this!!

I dug into a fix before I found your PR.

[thewtex]

I pushed the same fix to itkwasm 1.0b201 on PyPI, PR incoming.

[thewtex]

redundant