@amritk/nish-aarch64-darwin 0.10.0

package/runtime/runtime_os.c

@@ -0,0 +1,351 @@
+/* Nish runtime, the operating system half: files, directories, subprocesses,
+ * the environment, the clock, and which machine this is.
+ *
+ * Split out of runtime.c so that the two halves can be measured apart. Every
+ * function here wraps a system call, which is the reason it has to be C at all:
+ * the language cannot express `openat` or `posix_spawnp`, so the surface a
+ * program uses to reach the operating system grows in this file and nowhere
+ * else. runtime.c holds what every program touches whatever it does — the
+ * arena, strings, arrays, number formatting, the panics — and that is a closed
+ * set. Before the split the two shared one `.text*` budget, so a new syscall
+ * wrapper raised the ceiling over the arena and the string functions as well,
+ * and the number a reader saw for "the runtime" moved for a reason that had
+ * nothing to do with it. Each file now carries its own measured ceiling in
+ * tests/run.js; docs/wp7-runtime.md §"Runtime additions and budget" has both
+ * rows and the reasoning.
+ *
+ * What a linked binary pays is unchanged: `-ffunction-sections
+ * -Wl,--gc-sections` drops every function no program calls, whichever
+ * translation unit defined it, and the symbol names are the same frozen ABI
+ * they were.
+ *
+ * The declarations come from nish.h, the public ABI header, rather than from a
+ * private copy: this file calls three of the core's symbols (`nish_alloc_struct`,
+ * `nish_str_new`, `nish_array_grow`) and shares two of its layouts, and
+ * compiling against the header a C host sees is what keeps a definition here
+ * from drifting from the contract it is published under.
+ */
+#define _POSIX_C_SOURCE 200809L
+/* `realpath` is XSI rather than POSIX base, so _POSIX_C_SOURCE alone does not
+   declare it (measured on glibc 2.39: undeclared, and clang then infers
+   `int`, which is a pointer-truncating bug rather than a compile error before
+   C99). Declaring it here by hand would be worse than this line on Darwin,
+   where <stdlib.h> gives `realpath` an asm label -- a hand declaration binds
+   the LEGACY symbol, for which a NULL second argument is undefined. */
+#define _XOPEN_SOURCE 700
+#include <dirent.h>
+#include <limits.h>
+#include <fcntl.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <time.h>
+#include <unistd.h>
+#ifndef __wasi__
+/* WASI has no processes, so `spawn.h` and `wait.h` do not exist there. */
+#include <spawn.h>
+#include <sys/wait.h>
+extern char **environ;
+#endif
+
+#include "nish.h"
+
+/* The same spelling runtime.c uses for its own cold paths: a function that
+   reports and exits is never on a path worth optimising for. */
+#define NISH_COLD __attribute__((noreturn, cold, noinline))
+
+/* ---- Process and files */
+void nish_exit(int32_t code) { exit(code); }
+static NISH_COLD void nish_io_fail(const char *what, const nish_str *path) {
+  dprintf(2, "nish: cannot %s%.*s\n", what, (int)path->len, path->data);
+  _exit(1);
+}
+
+/* `readFileSyncOrNull(path)`: null rather than a message, so a program can
+   turn a missing file into its own diagnostic and carry on.
+ *
+ * The `S_ISDIR` guard is what makes "or null" true of a **directory**, which
+ * `open(O_RDONLY)` accepts: `lseek` then answers `LONG_MAX` on Linux and the
+ * arena is asked for that many bytes, so the program dies with `out of memory`
+ * instead of answering null. Node's `readFileSync` raises `EISDIR` and the
+ * stage0 twin (the TypeScript compiler, deleted in R6) turned that into null,
+ * so without this the two compilers answered differently for one tree — a
+ * package whose `exports` names a directory, which WP21 S2 made reachable
+ * (`tests/link/package_dir_target`).
+ *
+ * The test is `!S_ISDIR` rather than `S_ISREG` on purpose: a directory is the
+ * only thing whose `lseek(SEEK_END)` answers `LONG_MAX`, and refusing anything
+ * else would answer null where Node answers bytes. `/dev/null` is the case to
+ * keep in mind — `readFileSync` there is `""` in Node and in `shim.mjs`, and a
+ * narrower guard would have made it `null` here and split the two compilers
+ * again for the entry a command line can name. `fstat` on the descriptor
+ * rather than `stat` on the path, so the answer is about the file that was
+ * opened and not about whatever the name means a moment later. */
+nish_str *nish_read_file_or_null(const nish_str *path) {
+  int fd = open(path->data, O_RDONLY);
+  if (fd < 0) return 0;
+  struct stat st;
+  off_t len = fstat(fd, &st) == 0 && !S_ISDIR(st.st_mode) ? lseek(fd, 0, SEEK_END) : -1;
+  if (len < 0) {
+    close(fd);
+    return 0;
+  }
+  nish_str *s = nish_alloc_struct(8 + len + 1);
+  uint64_t got = 0;
+  ssize_t n;
+  while ((n = pread(fd, s->data + got, len - got, got)) > 0) got += n;
+  close(fd);
+  s->len = got;
+  s->data[got] = 0;
+  return s;
+}
+
+nish_str *nish_read_file(const nish_str *path) {
+  nish_str *s = nish_read_file_or_null(path);
+  if (!s) nish_io_fail("read ", path);
+  return s;
+}
+
+static void nish_put_file(const nish_str *path, const nish_str *data, int flags) {
+  int fd = open(path->data, O_WRONLY | O_CREAT | flags, 0644);
+  if (fd < 0) nish_io_fail("write ", path);
+  for (uint64_t done = 0; done < data->len;) {
+    ssize_t n = write(fd, data->data + done, data->len - done);
+    if (n <= 0) nish_io_fail("write ", path);
+    done += n;
+  }
+  close(fd);
+}
+void nish_write_file(const nish_str *path, const nish_str *data) { nish_put_file(path, data, O_TRUNC); }
+void nish_append_file(const nish_str *path, const nish_str *data) { nish_put_file(path, data, O_APPEND); }
+
+/* ---- Directories and subprocesses (WP14 D4): what a driver needs to create
+   its own output directory and shell out for `--link`. Both answer a value
+   instead of exiting, as `nish_read_file_or_null` does — there are no
+   exceptions, so the caller owns the diagnostic — and so does the `stat`
+   beside them (WP14 §7a), which is what tells `-o <dir>` from `-o <file>`.
+   Contracts: nish.h. */
+
+/* `isDirectorySync(path)` (WP14 §7a): the one question a driver asks of a path
+   it was handed — is there a directory here? A missing path, a plain file and
+   a parent it cannot search are the same false, because they are the same
+   answer to that question. */
+_Bool nish_is_dir(const nish_str *path) {
+  struct stat st;
+  return stat(path->data, &st) == 0 && S_ISDIR(st.st_mode);
+}
+
+/* One directory, not recursive. The retry is the `stat` above rather than
+   `errno == EEXIST` so that a plain file at the path answers false, which is
+   what the promise "a directory is there afterwards" means. */
+_Bool nish_mkdir(const nish_str *path) {
+  return mkdir(path->data, 0777) == 0 || nish_is_dir(path);
+}
+
+/* `posix_spawnp` is one libc call where fork/execvp/waitpid would be three,
+   it searches PATH, and glibc reports a failed exec through its return
+   value rather than through a child that has already run.
+
+   `out` and `err` are paths for the child's stdout and stderr, or NULL to let
+   it inherit this process's. Both spawn builtins are this function with those
+   two arguments answered differently, so the argv vector, the wait and the
+   signal convention are written once; it is `static`, so a program that spawns
+   nothing still loses all three to `--gc-sections`. */
+static int32_t nish_spawn_impl(const nish_array *argv, const char *out, const char *err) {
+#ifdef __wasi__
+  (void)argv;
+  (void)out;
+  (void)err;
+  return -1;
+#else
+  if (!argv->len) return -1; /* argv[0] would read past an empty array */
+  nish_str **s = (nish_str **)argv->data;
+  /* NULL-terminated, borrowing each string's bytes; the arena owns it, so no
+     path out of here has anything to free. */
+  char **v = nish_alloc_struct((argv->len + 1) * sizeof *v);
+  uint64_t i = 0;
+  for (; i < argv->len; i++) v[i] = s[i]->data;
+  v[i] = 0;
+  posix_spawn_file_actions_t fa;
+  posix_spawn_file_actions_t *fap = 0;
+  if (out || err) {
+    if (posix_spawn_file_actions_init(&fa)) return -1;
+    fap = &fa;
+    /* The child opens the file, not this process: a redirect that this process
+       performed would have to be undone afterwards, and a failed open would
+       leave its own stdout pointing at the file. */
+    if (out) posix_spawn_file_actions_addopen(fap, 1, out, O_WRONLY | O_CREAT | O_TRUNC, 0644);
+    if (err) posix_spawn_file_actions_addopen(fap, 2, err, O_WRONLY | O_CREAT | O_TRUNC, 0644);
+  }
+  pid_t pid;
+  int status;
+  int failed = posix_spawnp(&pid, v[0], fap, 0, v, environ);
+  if (fap) posix_spawn_file_actions_destroy(fap);
+  if (failed) return -1;
+  if (waitpid(pid, &status, 0) < 0) return -1;
+  return WIFSIGNALED(status) ? 128 + WTERMSIG(status) : WEXITSTATUS(status);
+#endif
+}
+
+int32_t nish_spawn(const nish_array *argv) { return nish_spawn_impl(argv, 0, 0); }
+
+/* `spawnSyncTo(argv, stdoutPath, stderrPath)`: the same run with a stream sent
+   to a file, which is what comparing a program's output against a golden needs
+   — `nish_spawn` answers a status and the output is gone. An **empty** path
+   leaves that stream inherited, so one call can capture stdout and let stderr
+   through to the terminal. Each file is created or truncated at 0644, as
+   `writeFileSync` does.
+
+   Two streams must not name one path: each would be opened separately, with
+   its own offset, and the two would overwrite each other rather than
+   interleave. Capturing them apart and concatenating is the way to merge. */
+int32_t nish_spawn_to(const nish_array *argv, const nish_str *out, const nish_str *err) {
+  return nish_spawn_impl(argv, out->len ? out->data : 0, err->len ? err->data : 0);
+}
+
+/* `readdirSync(path)`: the listing a driver needs to discover its own inputs.
+
+   **Sorted by bytes**, which `readdir(3)` and Node are not, for two reasons
+   that both belong to this language rather than to taste: there is no `sort`,
+   so every caller of an unsorted listing would have to write one, and an order
+   that is the file system's is an order that differs between two machines
+   running the same suite. `.` and `..` are dropped, as Node drops them; every
+   other dotfile is kept.
+
+   NULL when the directory cannot be read — the language's `string[] | null` —
+   so a missing directory is a diagnostic the caller writes and not an exit. An
+   empty directory is an empty array, which is a different answer. */
+nish_array *nish_readdir(const nish_str *path) {
+#ifdef __wasi__
+  /* The WASI form of this is a different contract, not a port of this one:
+     `fd_readdir` lists a preopened directory rather than a path, and the wasi
+     profile has no check in the default run. NULL until it has both. */
+  (void)path;
+  return 0;
+#else
+  DIR *d = opendir(path->data);
+  if (!d) return 0;
+  nish_array *a = nish_alloc_struct(sizeof *a);
+  *a = (nish_array){ 0, 0, 0 };
+  const struct dirent *e;
+  while ((e = readdir(d))) {
+    const char *n = e->d_name;
+    if (n[0] == '.' && (!n[1] || (n[1] == '.' && !n[2]))) continue;
+    if (a->len == a->cap) nish_array_grow(a, sizeof(nish_str *));
+    ((nish_str **)a->data)[a->len++] = nish_str_new(n, strlen(n));
+  }
+  closedir(d);
+  /* Insertion sort over pointers: a directory is short, and `qsort` would cost
+     a comparator symbol and its unwind entry for a call that is never hot. */
+  nish_str **v = (nish_str **)a->data;
+  for (uint64_t i = 1; i < a->len; i++) {
+    nish_str *s = v[i];
+    uint64_t j = i;
+    while (j && strcmp(v[j - 1]->data, s->data) > 0) {
+      v[j] = v[j - 1];
+      j--;
+    }
+    v[j] = s;
+  }
+  return a;
+#endif
+}
+
+/* `monotonicNanos()`: `CLOCK_MONOTONIC` in nanoseconds, which is what timing a
+   run needs. Not the wall clock: a wall clock corrected mid-run can go
+   backwards and make an elapsed time negative. Only the difference between two
+   reads means anything — the origin is arbitrary and is not comparable across
+   processes or machines — and an i64 of nanoseconds is 292 years of it. */
+int64_t nish_monotonic_nanos(void) {
+  struct timespec ts;
+  clock_gettime(CLOCK_MONOTONIC, &ts);
+  return (int64_t)ts.tv_sec * 1000000000 + ts.tv_nsec;
+}
+
+/* ---- The environment (WP19 R1): `getenv(name)`, the one environment read the
+   language has. A driver needs it to honour `CC` the way `scripts/build.sh`
+   does before it spawns that script, which is the whole reason it exists.
+
+   The bytes are copied into the arena rather than handed back where libc put
+   them: `getenv` answers a pointer into `environ`, and a later `setenv` in the
+   same process may move or overwrite that block, so a string the program is
+   still holding would change under it. Copying makes it an ordinary arena
+   string with the lifetime every other one has. NULL for an unset variable,
+   which is the language's `string | null`. Contract: nish.h. */
+nish_str *nish_getenv(const nish_str *name) {
+  const char *v = getenv(name->data);
+  if (!v) return 0;
+  uint64_t len = strlen(v);
+  nish_str *s = nish_alloc_struct(8 + len + 1);
+  s->len = len;
+  memcpy(s->data, v, len + 1);
+  return s;
+}
+
+/* ---- Symlinks (WP19 §5a item 4): `realpathSync(path)`, the one path
+   resolution the language has. A compiler that finds `scripts/build.sh` and
+   `std/` relative to its own `argv[0]` cannot do it through a symlink without
+   this: `ln -s /opt/nish/bin/nish /usr/local/bin/nish` is the ordinary way a
+   binary reaches `$PATH`, and npm links every command the same way, so the
+   directory `argv[0]` names is the link's rather than the package's.
+
+   A PATH_MAX buffer rather than `realpath(p, NULL)`, which is the shorter
+   spelling and the wrong one here. Allocating the result is POSIX 2008, and
+   on Darwin it is the `__DARWIN_EXTSN` variant that implements it -- the
+   legacy symbol of the same name leaves a NULL second argument undefined. A
+   caller-supplied buffer is defined for both, so it is the spelling that
+   cannot depend on which variant a given feature-macro level binds.
+
+   The result is copied into the arena, for the reason `nish_getenv` copies:
+   what the arena owns has the lifetime every other string in the program has,
+   and the stack buffer is gone at the return. NULL when the path does not
+   resolve -- a path that does not exist included -- which is the language's
+   `string | null` rather than an error, because the caller is asking whether
+   it resolves. Contract: nish.h. */
+nish_str *nish_realpath(const nish_str *path) {
+  char buf[PATH_MAX];
+  if (!realpath(path->data, buf)) return 0;
+  uint64_t len = strlen(buf);
+  nish_str *s = nish_alloc_struct(8 + len + 1);
+  s->len = len;
+  memcpy(s->data, buf, len + 1);
+  return s;
+}
+
+/* ---- What machine this is (WP14 §7a): `process.platform` and `process.arch`,
+   the two halves `--target host` composes a triple from. Both are settled when
+   this file is compiled — a cross build compiles the runtime for the target,
+   so the answer is the target's — which is why each is a string in constant
+   data handed back by address: no allocation and no load, and `readnone` on
+   the declaration (self/runtime.ts) is a fact rather than a hope. The
+   spellings are Node's, so a program reads the same answer from this runtime
+   and from `runtime/shim.mjs`; anything neither branch names is "unknown",
+   which is what `--target host` then refuses. Contracts: nish.h.
+
+   The static object is spelled with a sized array because a flexible array
+   member cannot be initialised, and handed out as an `nish_str *`: the two
+   layouts are the same bytes, and nothing anywhere writes through either
+   pointer, so there is no aliasing question to answer. */
+#define NISH_TEXT(name, s) \
+  static const struct { uint64_t len; char data[sizeof s]; } name = { sizeof s - 1, s }
+
+#if defined(__APPLE__)
+NISH_TEXT(nish_platform_text, "darwin");
+#elif defined(__linux__)
+NISH_TEXT(nish_platform_text, "linux");
+#else
+NISH_TEXT(nish_platform_text, "unknown");
+#endif
+
+#if defined(__x86_64__)
+NISH_TEXT(nish_arch_text, "x64");
+#elif defined(__aarch64__)
+NISH_TEXT(nish_arch_text, "arm64");
+#else
+NISH_TEXT(nish_arch_text, "unknown");
+#endif
+
+const nish_str *nish_platform(void) { return (const nish_str *)&nish_platform_text; }
+const nish_str *nish_arch(void) { return (const nish_str *)&nish_arch_text; }

package/runtime/runtime_parallel.c

@@ -0,0 +1,156 @@
+/* Nish runtime, the parallel half: how one range of work becomes several
+ * threads, and nothing else.
+ *
+ * A third translation unit rather than a third of `runtime_os.c`, for the
+ * reason that file's header gives for being a second one: a budget should mean
+ * one thing. `runtime_os.c` is the syscall wrappers and it had 29 bytes of its
+ * ceiling left; `pthread_create` plus a partitioner does not fit in 29 bytes,
+ * and raising the syscall half's ceiling to make room would move the number a
+ * reader sees for "the operating-system surface" for a reason that has nothing
+ * to do with the operating-system surface. So this file carries its own
+ * measured ceiling in tests/run.js beside the other two, and a program that
+ * runs nothing in parallel pays nothing for it: `-ffunction-sections
+ * -Wl,--gc-sections` drops every function no program calls, whichever
+ * translation unit defined it.
+ *
+ * It compiles in both configurations on purpose. With `-DNISH_THREADS` it
+ * spawns; without it, and on WASI where there are no threads to spawn, the same
+ * entry point runs the whole range on the calling thread. That is what keeps it
+ * linkable beside a default build and keeps the caller from needing two
+ * spellings -- the flag decides whether the work is divided, never whether the
+ * function exists. The thread-local arena the divided case needs is WP20 T0 and
+ * arrives with the same macro.
+ *
+ * There is no language surface here and nothing in the language calls this yet:
+ * docs/wp29-thread-surface.md is the surface, and this is the stage under it.
+ */
+#include "nish.h"
+
+#if defined(NISH_THREADS) && !defined(__wasi__) && !defined(__wasm__)
+#define NISH_PAR_REAL 1
+#include <pthread.h>
+#include <unistd.h>
+#endif
+
+/* The ceiling on how many threads one region may use. A fixed bound keeps the
+ * job and handle arrays on the stack -- 64 jobs is 2 KB and 64 handles 512
+ * bytes -- so a region never allocates to divide itself, which matters because
+ * the arena it would allocate from is the very thing being made per-thread. */
+#define NISH_PAR_MAX 64
+
+/* Cached, because `sysconf(_SC_NPROCESSORS_ONLN)` is not a cheap read: glibc
+ * answers it from `sched_getaffinity` or by parsing
+ * /sys/devices/system/cpu/online, and measured here it is 3.7 us -- which
+ * `nish_parallel_range` would otherwise pay on every region, including the ones
+ * too small to divide, where it was the entire cost. The race between two
+ * threads filling it is benign (both compute the same number) but it is still a
+ * race, so the word is read and written with relaxed atomic builtins (a plain
+ * `int64_t`, since `__atomic_*` does not take an `_Atomic`-qualified pointer):
+ * on x86-64 that is
+ * a plain load and store and costs nothing, and it is defined behaviour.
+ *
+ * A machine whose online CPU count changes under a running process therefore
+ * keeps the count it started with, which is the right trade for a number that
+ * decides how many threads a loop is divided into. */
+static int64_t nish_cpu_cached = 0;
+
+int64_t nish_cpu_count(void) {
+  int64_t n = __atomic_load_n(&nish_cpu_cached, __ATOMIC_RELAXED);
+  if (n != 0) return n;
+#ifdef NISH_PAR_REAL
+  long got = sysconf(_SC_NPROCESSORS_ONLN);
+  n = got > 0 ? (int64_t)got : 1;
+#else
+  n = 1;
+#endif
+  __atomic_store_n(&nish_cpu_cached, n, __ATOMIC_RELAXED);
+  return n;
+}
+
+#ifdef NISH_PAR_REAL
+/* One chunk of the range, and where to run it. Passed by pointer to the
+ * worker, so it lives in the caller's frame until the join. */
+typedef struct {
+  nish_par_body body;
+  void *ctx;
+  int64_t lo;
+  int64_t hi;
+} nish_par_job;
+
+/* Non-zero inside a region, so a body that itself calls `nish_parallel_range`
+ * runs its range on one thread instead of multiplying the thread count by the
+ * nesting depth. Thread-local, so the guard is per worker rather than a lock.
+ * Sequential nesting is the conservative answer and the only one that needs no
+ * scheduler: work stealing is what a library would do here and it is not what
+ * this file is for. */
+static NISH_TLS int nish_par_depth = 0;
+
+static void *nish_par_worker(void *p) {
+  nish_par_job *j = (nish_par_job *)p;
+  nish_par_depth = 1;
+  j->body(j->lo, j->hi, j->ctx);
+  /* This thread's arena, not the parent's: the storage class is what makes the
+   * two disjoint (WP20 T0), so a worker can release every byte it bumped
+   * without the parent losing one. A worker that did not do this would leak its
+   * whole arena at thread exit, since nothing else has a pointer to it. */
+  nish_free_arena();
+  return 0;
+}
+#endif
+
+void nish_parallel_range(nish_par_body body, void *ctx, int64_t len, int64_t grain) {
+  if (len <= 0) return;
+#ifdef NISH_PAR_REAL
+  if (grain < 1) grain = 1;
+  /* Never more threads than there is work for at the requested granularity,
+   * and never more than the machine has. */
+  int64_t chunks = (len + grain - 1) / grain;
+  int64_t n = nish_cpu_count();
+  if (n > NISH_PAR_MAX) n = NISH_PAR_MAX;
+  if (chunks < n) n = chunks;
+  if (n <= 1 || nish_par_depth != 0) {
+    body(0, len, ctx);
+    return;
+  }
+
+  nish_par_job jobs[NISH_PAR_MAX];
+  pthread_t th[NISH_PAR_MAX];
+  /* Contiguous chunks, the remainder spread one element at a time over the
+   * first `len % n` of them, so the longest chunk is never more than one
+   * element longer than the shortest. Contiguous rather than strided because
+   * two workers then never write the same cache line except at one boundary. */
+  int64_t base = len / n;
+  int64_t rem = len % n;
+  int64_t at = 0;
+  for (int64_t i = 0; i < n; i++) {
+    int64_t take = base + (i < rem ? 1 : 0);
+    jobs[i].body = body;
+    jobs[i].ctx = ctx;
+    jobs[i].lo = at;
+    jobs[i].hi = at + take;
+    at += take;
+  }
+
+  /* The caller runs chunk 0 itself, so N-way parallelism costs N-1 spawns and
+   * the calling thread is not idle while it waits. Its chunk also runs in the
+   * caller's arena, which means chunk 0 behaves exactly as a sequential call
+   * would -- the asymmetry is deliberate and is why a body whose result is
+   * allocated is the surface's error rather than this file's. */
+  int started = 0;
+  for (int64_t i = 1; i < n; i++) {
+    if (pthread_create(&th[started], 0, nish_par_worker, &jobs[i]) != 0) break;
+    started++;
+  }
+  nish_par_depth++;
+  jobs[0].body(jobs[0].lo, jobs[0].hi, jobs[0].ctx);
+  /* A chunk whose thread could not be created runs here. Running short of
+   * threads must cost speed and never correctness, so there is no path on which
+   * a range is silently skipped. */
+  for (int64_t i = (int64_t)started + 1; i < n; i++) jobs[i].body(jobs[i].lo, jobs[i].hi, jobs[i].ctx);
+  nish_par_depth--;
+  for (int i = 0; i < started; i++) pthread_join(th[i], 0);
+#else
+  (void)grain;
+  body(0, len, ctx);
+#endif
+}

package/runtime/runtime_wasm.c

@@ -0,0 +1,99 @@
+/* Nish runtime for the freestanding wasm profile (WP8): the arena and the
+ * array cold paths, without libc. Link it next to the module when a function
+ * takes or returns an array:
+ *   scripts/build.sh x.ll runtime/runtime_wasm.c -o x.wasm --profile wasm
+ *
+ * Linear memory past `__heap_base` (the linker's end-of-data symbol) is one
+ * arena chunk that grows with `memory.grow`; there is no chunk list because
+ * wasm memory never shrinks. Field widths follow the IR contract
+ * (`%struct.nish_arena = type { i8*, i64, i64, i8* }`), not size_t: wasm32
+ * pointers are 4 bytes, and the inlined fast path in every compiled function
+ * bumps the 64-bit `off` field directly. Panics are `unreachable` (a JS
+ * RuntimeError); there is no stderr to write a message to. Strings and I/O
+ * need a WASI runtime and are not provided here, so `--emit-dts` lists
+ * string functions as not exported. */
+#include <stddef.h>
+#include <stdint.h>
+
+/* Thread-local storage for the arena (WP20 T0), mirroring runtime.c and
+ * nish.h so the three definitions of this macro cannot drift. A wasm module
+ * built this way still has exactly one thread: wasm threads need shared memory
+ * plus the atomics and bulk-memory features and a worker on the host side, and
+ * WP20 §6 defers all of that. The macro is here so that `nish --threads`
+ * targeting wasm still links — `_Thread_local` in a non-shared memory is one
+ * ordinary block of linear memory — rather than failing over a storage class
+ * that means nothing here. */
+#ifdef NISH_THREADS
+#define NISH_TLS _Thread_local
+#else
+#define NISH_TLS
+#endif
+
+struct nish_arena { char *buf; uint64_t off; uint64_t cap; void *chunks; };
+NISH_TLS struct nish_arena nish_arena;
+
+_Static_assert(sizeof(struct nish_arena) == 32, "arena layout is ABI: runtime.ts, nish.h");
+_Static_assert(offsetof(struct nish_arena, off) == 8, "the inlined allocator bumps field 1");
+_Static_assert(offsetof(struct nish_arena, cap) == 16, "the inlined allocator reads field 2");
+_Static_assert(offsetof(struct nish_arena, chunks) == 24, "arena layout is ABI");
+
+extern unsigned char __heap_base;
+#define NISH_PAGE ((uint64_t)65536)
+
+/* Slow path of the inlined allocator (`size` is already 8-byte rounded). */
+void *nish_arena_grow(uint64_t size) {
+  if (!nish_arena.buf) {
+    uintptr_t base = ((uintptr_t)&__heap_base + 7) & ~(uintptr_t)7;
+    nish_arena.buf = (char *)base;
+    nish_arena.cap = (uint64_t)__builtin_wasm_memory_size(0) * NISH_PAGE - base;
+  }
+  uint64_t need = nish_arena.off + size;
+  if (need > nish_arena.cap) {
+    uint64_t pages = (need - nish_arena.cap + NISH_PAGE - 1) / NISH_PAGE;
+    if (__builtin_wasm_memory_grow(0, (uintptr_t)pages) == (uintptr_t)-1) __builtin_trap();
+    nish_arena.cap += pages * NISH_PAGE;
+  }
+  void *p = nish_arena.buf + nish_arena.off;
+  nish_arena.off = need;
+  return p;
+}
+
+void *nish_alloc_struct(uint64_t size) {
+  size = (size + 7) & ~(uint64_t)7;
+  if (nish_arena.buf && nish_arena.off + size <= nish_arena.cap) {
+    void *p = nish_arena.buf + nish_arena.off;
+    nish_arena.off += size;
+    return p;
+  }
+  return nish_arena_grow(size);
+}
+
+void nish_reset_arena(void) { nish_arena.off = 0; }
+void nish_free_arena(void) { nish_arena.off = 0; } /* memory cannot be returned */
+uint64_t nish_arena_used(void) { return nish_arena.off; }
+uint64_t nish_arena_mark(void) { return nish_arena.buf ? (uint64_t)(uintptr_t)(nish_arena.buf + nish_arena.off) : 0; }
+void nish_arena_release(uint64_t mark) { nish_arena.off = mark ? mark - (uintptr_t)nish_arena.buf : 0; }
+
+/* ---- Arrays: %struct.nish_array = type { i64, i64, i8* } */
+typedef struct nish_array { uint64_t len; uint64_t cap; char *data; } nish_array;
+
+nish_array *nish_alloc_array(uint64_t elem_size, uint64_t len) {
+  nish_array *a = (nish_array *)nish_alloc_struct(sizeof *a);
+  a->len = a->cap = len;
+  a->data = (char *)nish_alloc_struct(len * elem_size);
+  return a;
+}
+
+void nish_array_grow(nish_array *a, uint64_t elem_size) {
+  uint64_t cap = a->cap ? a->cap * 2 : 4;
+  char *data = (char *)nish_alloc_struct(cap * elem_size);
+  if (a->len) __builtin_memcpy(data, a->data, (uintptr_t)(a->len * elem_size)); /* memory.copy (-mbulk-memory) */
+  a->data = data;
+  a->cap = cap;
+}
+
+/* ---- Panics: `unreachable`, which the host sees as a RuntimeError */
+void nish_panic_index(uint64_t idx, uint64_t len) { (void)idx; (void)len; __builtin_trap(); }
+void nish_panic_slice(int64_t s, int64_t e, int64_t len) { (void)s; (void)e; (void)len; __builtin_trap(); }
+void nish_panic_div(_Bool by_zero) { (void)by_zero; __builtin_trap(); }
+void nish_exit(int32_t code) { (void)code; __builtin_trap(); }