cherry-pick: WASI component pipeline (#446), bare-metal port (#448, #449), H3 migration tests (#450) to main

.github/workflows/interop.yml

@@ -57,3 +57,26 @@ jobs:
 
     - name: Echo session, stream, datagram, refusal and close
       run: make -j"$(nproc)" webtransport-e2e CWIST_WEBTRANSPORT=server PYTHON="$RUNNER_TEMP/wt/bin/python"
+
+  http3-migration:
+    name: HTTP/3 connection migration (aioquic)
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+      with:
+        submodules: recursive
+
+    - name: Install build dependencies
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y cmake libcurl4-openssl-dev libnghttp2-dev libbrotli-dev libzstd-dev
+
+    - name: Install aioquic
+      run: |
+        python3 -m venv "$RUNNER_TEMP/h3-migration"
+        "$RUNNER_TEMP/h3-migration/bin/pip" install aioquic==1.4.0
+
+    - name: Test requests through 400 address changes
+      run: make -j"$(nproc)" http3-migration-e2e CWIST_WEBRTC=0 PYTHON="$RUNNER_TEMP/h3-migration/bin/python"

.github/workflows/release-assets.yml

@@ -189,10 +189,28 @@ jobs:
         ref: ${{ env.TAG }}
         submodules: recursive
 
-    - name: Install Emscripten
-      uses: mymindstorm/setup-emsdk@v14
+    - name: Install node 24
+      uses: actions/setup-node@v4
       with:
-        version: 5.0.0
+        node-version: 24
+
+    - name: Install wasi-sdk 25.0
+      run: |
+        mkdir -p "$HOME/toolchains"
+        curl -sSL -o /tmp/wasi-sdk.tar.gz \
+          https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-25/wasi-sdk-25.0-x86_64-linux.tar.gz
+        tar -xzf /tmp/wasi-sdk.tar.gz -C "$HOME/toolchains"
+
+    - name: Install wasm-tools 1.259.0 and wit-bindgen 0.62.0
+      run: |
+        curl -sSL -o /tmp/wasm-tools.tar.gz \
+          https://github.com/bytecodealliance/wasm-tools/releases/download/v1.259.0/wasm-tools-1.259.0-x86_64-linux.tar.gz
+        tar -xzf /tmp/wasm-tools.tar.gz -C /tmp
+        curl -sSL -o /tmp/wit-bindgen.tar.gz \
+          https://github.com/bytecodealliance/wit-bindgen/releases/download/v0.62.0/wit-bindgen-0.62.0-x86_64-linux.tar.gz
+        tar -xzf /tmp/wit-bindgen.tar.gz -C /tmp
+        echo "/tmp/wasm-tools-1.259.0-x86_64-linux" >> "$GITHUB_PATH"
+        echo "/tmp/wit-bindgen-0.62.0-x86_64-linux" >> "$GITHUB_PATH"
 
     - name: Pack cwist-wasm and verify clean-directory install
       run: |

.github/workflows/wasm.yml

@@ -11,131 +11,6 @@ permissions:
   contents: read
 
 jobs:
-  wasm:
-    name: Emscripten build + smoke test
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v4
-      with:
-        submodules: recursive
-
-    # lib/cjson (a WASM_SRCS member) is a submodule; the wasm archive does
-    # not build without it.
-    - name: Install Emscripten
-      uses: mymindstorm/setup-emsdk@v14
-      with:
-        version: 5.0.0
-        actions-cache-folder: emsdk-cache
-
-    # actions/cache restores the cached emsdk without the executable bit on
-    # its bundled node, which makes `node wasm_smoke.js` fail with
-    # "Permission denied" on cache hits. Fix the exact node on PATH and fall
-    # back to the runner's system node if the bit cannot be restored.
-    - name: Restore exec bit on cached emsdk node
-      run: |
-        NODE_BIN="$(command -v node || true)"
-        echo "node on PATH: $NODE_BIN"
-        [ -n "$NODE_BIN" ] && chmod +x "$NODE_BIN" || true
-        ls -l "$NODE_BIN" || true
-
-    # Phase 2 (issue #93): the JS wrapper is only proven if a consumer-style
-    # module built through wasm_entry.h serves a request via the npm wrapper
-    # with no Emscripten glue in the calling code. NODE is resolved the same
-    # way as the smoke step above.
-    - name: Build wrapper-test module and run it through the JS wrapper
-      shell: bash
-      run: |
-        NODE_BIN="$(command -v node || true)"
-        if [ -n "$NODE_BIN" ] && [ -x "$NODE_BIN" ]; then
-          make wasm-wrapper-test NODE="$NODE_BIN"
-        else
-          make wasm-wrapper-test NODE="$(command -v nodejs || echo /usr/bin/node)"
-        fi
-
-    # Phase 2a done-when (issue #183): the packed tarball must install and
-    # load in a clean directory, i.e. `npm install` replaces the from-source
-    # flow. Pack, install into a temp dir outside the repo, load it there.
-    # NODE is resolved the same way as the other steps: emsdk's node can be
-    # restored from cache without its exec bit, so never call bare `node`.
-    - name: Pack cwist-wasm and verify clean-directory install
-      run: |
-        NODE_BIN="$(command -v node || true)"
-        if [ -n "$NODE_BIN" ] && [ -x "$NODE_BIN" ]; then
-          make wasm-dist NODE="$NODE_BIN"
-        else
-          make wasm-dist NODE="$(command -v nodejs || echo /usr/bin/node)"
-        fi
-        TGZ="$(ls dist/cwist-wasm-*.tgz | head -1)"
-        INSTALL_DIR="$(mktemp -d)"
-        cd "$INSTALL_DIR"
-        npm init -y >/dev/null
-        npm install "$OLDPWD/$TGZ"
-        node -e "const w = require('cwist-wasm'); \
-          const r = w.parseResponseBytes(new TextEncoder().encode( \
-            'HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\n\r\nok')); \
-          if (r.status !== 200 || r.headers['Content-Type'] !== 'text/plain') process.exit(1); \
-          console.log('clean-install verification passed');"
-
-    # Phase 4 (issue #93): the end-to-end example app - routing + zod +
-    # template + cwist_db + sessions behind a Service Worker host - must
-    # build, and its WASM logic is covered by a node smoke that dispatches
-    # through the cwist-wasm wrapper (the SW itself needs a browser).
-    - name: Build WASM service-worker example and run node smoke
-      shell: bash
-      run: |
-        make -j$(nproc) wasm
-        example/wasm-service-worker/build.sh
-        NODE_BIN="$(command -v node || true)"
-        if [ -n "$NODE_BIN" ] && [ -x "$NODE_BIN" ]; then
-          "$NODE_BIN" example/wasm-service-worker/smoke.js
-        else
-          "$(command -v nodejs || echo /usr/bin/node)" example/wasm-service-worker/smoke.js
-        fi
-
-    # wasm-smoke compiles and runs the smoke binary under node, so this is
-    # build + run. Catches WASM-only regressions that native CI cannot see
-    # (issue #93 gap 2) - e.g. clang-format corrupting EM_JS bodies.
-    - name: Build libcwist_wasm.a and run smoke test
-      shell: bash
-      run: |
-        emcc --version
-        make -j$(nproc) wasm
-        NODE_BIN="$(command -v node || true)"
-        if [ -n "$NODE_BIN" ] && [ -x "$NODE_BIN" ]; then
-          make wasm-smoke NODE="$NODE_BIN"
-        else
-          # emsdk node unusable (e.g. cache restored without exec bit): use
-          # the runner's system node for the smoke run.
-          make wasm-smoke NODE="$(command -v nodejs || echo /usr/bin/node)"
-        fi
-
-    # The struct layout contract (tests/abi_layout.h) on wasm32, where
-    # pointers are 4 bytes: the native jobs cover the 64-bit targets.
-    - name: Check the public struct layout contract on wasm32
-      shell: bash
-      run: |
-        NODE_BIN="$(command -v node || true)"
-        if [ -z "$NODE_BIN" ] || [ ! -x "$NODE_BIN" ]; then
-          NODE_BIN="$(command -v nodejs || echo /usr/bin/node)"
-        fi
-        make wasm-abi-layout NODE="$NODE_BIN"
-
-    # The EM_JS `=>` corruption this PR fixes recurs silently the next time
-    # anyone runs `make format`. Guard exactly the files carrying EM_JS /
-    # CWIST_WASM_INSTALL_VIEWS bodies with clang-format --dry-run --Werror:
-    # scoped to those two files on purpose, because the tree-wide
-    # `make format-check` compares against one pinned clang-format version
-    # while runners ship different ones, and an unrelated grpc/protobuf.c
-    # formatting drift would fail this job without touching WASM at all.
-    - name: Verify clang-format guards (format-check)
-      run: |
-        clang-format --dry-run --Werror \
-          tests/wasm_smoke.c include/cwist/wasm/typedarray.h \
-          include/cwist/wasm/wasm_entry.h src/net/http/session.c src/sys/wasi/compat.c \
-          example/wasm-service-worker/app.c
-
   # v3.7 Phase 1 (issue #201): the wasip2 socket server is only "supported"
   # if CI builds it and proves wasi:sockets serving on every push. Mirrors
   # the manual `make wasip2-smoke` gate; toolchain versions are pinned to
@@ -218,6 +93,13 @@ jobs:
         echo "/tmp/wasm-tools-1.259.0-x86_64-linux" >> "$GITHUB_PATH"
         echo "/tmp/wit-bindgen-0.62.0-x86_64-linux" >> "$GITHUB_PATH"
 
+    - name: Install wasmtime 25
+      run: |
+        curl -sSL -o /tmp/wasmtime.tar.xz \
+          https://github.com/bytecodealliance/wasmtime/releases/download/v25.0.0/wasmtime-v25.0.0-x86_64-linux.tar.xz
+        tar -xJf /tmp/wasmtime.tar.xz -C /tmp
+        echo "/tmp/wasmtime-v25.0.0-x86_64-linux" >> "$GITHUB_PATH"
+
     - name: Validate WIT worlds (wit-check)
       run: make wit-check
 
@@ -239,6 +121,26 @@ jobs:
     - name: Browser runtime gate (WASI 0.2, positive and negative controls)
       run: make component-browser-test NODE="$(command -v node)"
 
+    - name: WASM service-worker example (build + browser runtime test)
+      run: make wasm-sw-browser-test NODE="$(command -v node)"
+
+    - name: Check the public struct layout contract on wasm32
+      run: make wasm-abi-layout
+
+    - name: Pack cwist-wasm and verify clean-directory install
+      run: |
+        make wasm-dist NODE="$(command -v node)"
+        TGZ="$(ls dist/cwist-wasm-*.tgz | head -1)"
+        INSTALL_DIR="$(mktemp -d)"
+        cd "$INSTALL_DIR"
+        npm init -y >/dev/null
+        npm install "$OLDPWD/$TGZ"
+        node -e "const w = require('cwist-wasm'); \
+          const r = w.parseResponseBytes(new TextEncoder().encode( \
+            'HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\n\r\nok')); \
+          if (r.status !== 200 || r.headers['Content-Type'] !== 'text/plain') process.exit(1); \
+          console.log('clean-install verification passed');"
+
     - name: Streaming dispatch smoke (async host send-chunk)
       run: |
         make component-stream-smoke-p3 \

.gitignore

@@ -9,6 +9,7 @@ bindings/rust/Cargo.lock
 
 # Test binaries
 test_sstring
+test_baremetal_port
 test_http
 test_http_client
 test_siphash
@@ -103,6 +104,7 @@ test_grpc_client
 test_grpc_stream
 test_http2
 test_http3
+/http3_migration_server
 test_http_chunked
 test_http_fairness
 test_http_pipeline
@@ -140,10 +142,7 @@ test_https_pool_queue
 benchmarks/web-frameworks/cwist_bench
 dist/
 cwist.pc
-.wasm-build/
-libcwist_wasm.a
-wasm_smoke.js
-wasm_smoke.wasm
+wasm_abi_layout.wasm
 .wit-check/
 .wit-bindings/
 .component-build/
@@ -161,9 +160,8 @@ tests/test_proto_gen_desc_sample.cwist.pb.h
 __pycache__/
 *.pyc
 
-# WASM service-worker example artifacts (built by example/wasm-service-worker/build.sh)
-example/wasm-service-worker/app.js
-example/wasm-service-worker/app.wasm
+# WASM service-worker example artifacts (built by make wasm-sw-example)
+example/wasm-service-worker/build/
 tutorials/*/build/
 build-tutorials/
 rss_gate_server
@@ -175,3 +173,5 @@ c100k_https_client
 c100k_server.log
 c100k_client.log
 webtransport_echo_server
+.baremetal-build/
+