@nimbus-sh/worker 0.12.0 → 0.13.1

package/scripts/oxc-wasm/Cargo.toml

@@ -0,0 +1,30 @@
+# Nimbus's Oxc transform, built as wasm by build.mjs (see src/lib.rs).
+[package]
+name = "nimbus_oxc"
+version = "0.1.0"
+edition = "2024"
+publish = false
+license = "MIT"
+
+# Its own workspace: build.mjs copies the crate into a work directory.
+[workspace]
+
+[lib]
+# cdylib for the wasm; rlib for the examples, which run the same transform natively.
+crate-type = ["cdylib", "rlib"]
+doctest = false
+
+[dependencies]
+oxc = { version = "=0.152.0", default-features = false, features = ["transformer", "semantic", "codegen", "ast_visit"] }
+oxc_ecmascript = "=0.152.0"
+oxc_traverse = "=0.152.0"
+memchr = "2"
+rustc-hash = "2"
+
+[profile.release]
+codegen-units = 1
+lto = "fat"
+opt-level = 3
+panic = "abort"
+debug = false
+strip = "symbols"

package/scripts/oxc-wasm/build.mjs

@@ -0,0 +1,249 @@
+#!/usr/bin/env bun
+/**
+ * build.mjs — build Nimbus's Oxc transform (this crate) as wasm, reproducibly.
+ *
+ *   bun packages/worker/scripts/oxc-wasm/build.mjs --work <dir> --out <dir>
+ *
+ * Cargo may run in its own bounded cgroup (keep this Bun orchestrator small):
+ *   NIMBUS_CARGO_RUNNER=/mnt/scratch/nimbus/run-bounded NIMBUS_CARGO_JOBS=4 \
+ *   NIMBUS_TEST_MEMORY_MAX=2G NIMBUS_TEST_TIMEOUT=3600 run-bounded bun .../build.mjs ...
+ *
+ * Every input is pinned and every check fails loudly:
+ *   1. The crate (Cargo.toml, Cargo.lock, rust-toolchain.toml, src/) is copied
+ *      into <work>/nimbus-oxc, so the build path is the work directory's, and
+ *      built with `cargo --locked` (crates.io checksums in Cargo.lock) by the
+ *      exact rustc rust-toolchain.toml names, for wasm32-unknown-unknown.
+ *   2. binaryen's release archive is checked against its pinned SHA-256, and
+ *      its wasm-opt drops the wasm-bindgen exports oxc-browserslist's js-sys
+ *      dependency leaves (no code path here calls into JavaScript), replaces
+ *      the one import they keep, a diverging `throw`, with a trap, and
+ *      optimizes (-O3).
+ *   3. The result must import nothing, export exactly the ABI (src/abi.rs),
+ *      and define an unshared memory of at most OXC_MAX_INITIAL_PAGES.
+ * Output (--out): nimbus-oxc.wasm and provenance.json (inputs, toolchain,
+ * flags, digests). Stage it with
+ *   NIMBUS_OXC_WASM_ARTIFACTS=<out> node packages/worker/scripts/bundle-oxc-wasm.mjs
+ */
+
+import { createHash } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { promises as fs, existsSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { changedInputs, oxcWasmInputs } from './inputs.mjs';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const TARGET = 'wasm32-unknown-unknown';
+/**
+ * Bytes of linear memory the wasm shadow stack takes. Call frames live on the
+ * host's native stack; this one holds what they spill, and at 4 MiB it is not
+ * what limits nesting depth under workerd's or Node's default stack.
+ */
+const WASM_STACK_BYTES = 4 * 1024 * 1024;
+/**
+ * The ceiling on the module's floor, the stack plus static data, in 64 KiB
+ * pages: 5 MiB. Napi-rs's wasm builds start at 981 pages (a 64 MB stack).
+ */
+const OXC_MAX_INITIAL_PAGES = 80;
+const RUSTFLAGS = ['-Ctarget-feature=+simd128', `-Clink-arg=-zstack-size=${WASM_STACK_BYTES}`];
+const BINARYEN = {
+  version: 'version_133',
+  url: 'https://github.com/WebAssembly/binaryen/releases/download/version_133/binaryen-version_133-x86_64-linux.tar.gz',
+  sha256: '2dc9c7813f5375db93d96ead4b78222fcc3e2677bbb832297af4797782a37489',
+};
+const WASM_OPT_ARGS = [
+  // The features rustc 1.98 enables for wasm32-unknown-unknown, plus simd128.
+  '--enable-simd', '--enable-bulk-memory', '--enable-nontrapping-float-to-int', '--enable-sign-ext',
+  '--enable-mutable-globals', '--enable-reference-types', '--enable-multivalue',
+  '--remove-exports', '--pass-arg=remove-exports@__*',
+  '--remove-imports',
+  '-O3',
+];
+const EXPORTS = ['memory', 'nimbus_oxc_alloc', 'nimbus_oxc_realloc', 'nimbus_oxc_release', 'nimbus_oxc_transform'];
+const CRATE_FILES = ['Cargo.toml', 'Cargo.lock', 'rust-toolchain.toml', 'src'];
+
+function arg(name) {
+  const i = process.argv.indexOf(name);
+  if (i < 0 || !process.argv[i + 1]) throw new Error(`oxc-wasm: ${name} <value> is required`);
+  return path.resolve(process.argv[i + 1]);
+}
+const WORK = arg('--work');
+const OUT = arg('--out');
+
+const sha256 = (bytes) => createHash('sha256').update(bytes).digest('hex');
+
+function run(cmd, args, opts = {}) {
+  const r = spawnSync(cmd, args, { stdio: opts.capture ? 'pipe' : 'inherit', encoding: 'utf8', ...opts });
+  if (r.status !== 0) throw new Error(`oxc-wasm: ${cmd} ${args.join(' ')} exited ${r.status}${r.stderr ? `\n${r.stderr}` : ''}`);
+  return r.stdout ?? '';
+}
+
+async function copyCrate(into) {
+  await fs.rm(into, { recursive: true, force: true });
+  await fs.mkdir(into, { recursive: true });
+  for (const entry of CRATE_FILES) await fs.cp(path.join(HERE, entry), path.join(into, entry), { recursive: true });
+}
+
+function toolchain(crateDir, text) {
+  const pinned = text.match(/^channel = "(.+)"$/m)?.[1];
+  if (!pinned) throw new Error('oxc-wasm: rust-toolchain.toml names no channel');
+  // rustup, when present, owns the pinned toolchain; otherwise the rustc on PATH must be it.
+  const which = spawnSync('rustup', ['which', '--toolchain', pinned, 'rustc'], { encoding: 'utf8', cwd: crateDir });
+  const binDir = which.status === 0 ? path.dirname(which.stdout.trim()) : null;
+  const env = { ...process.env, PATH: binDir ? `${binDir}:${process.env.PATH}` : process.env.PATH, RUSTUP_TOOLCHAIN: pinned };
+  const rustc = run('rustc', ['-vV'], { capture: true, env });
+  const release = rustc.match(/^release: (.+)$/m)?.[1];
+  if (release !== pinned) {
+    throw new Error(`oxc-wasm: needs rustc ${pinned} with ${TARGET} (rustup toolchain install ${pinned} --target ${TARGET}); found ${release}`);
+  }
+  const sysroot = run('rustc', ['--print', 'sysroot'], { capture: true, env }).trim();
+  if (!existsSync(path.join(sysroot, 'lib', 'rustlib', TARGET))) {
+    throw new Error(`oxc-wasm: rustc ${pinned} has no ${TARGET} target (rustup target add --toolchain ${pinned} ${TARGET})`);
+  }
+  // The compiler itself, not a rustup proxy: cargo is told to use exactly this.
+  const compiler = path.join(sysroot, 'bin', 'rustc');
+  if (run(compiler, ['-vV'], { capture: true }) !== rustc) throw new Error(`oxc-wasm: ${compiler} is not the rustc ${pinned} checked`);
+  return { rustc: rustc.trim(), compiler, env };
+}
+
+async function wasmOpt() {
+  const archives = path.join(WORK, '_archives');
+  await fs.mkdir(archives, { recursive: true });
+  const archive = path.join(archives, path.basename(BINARYEN.url));
+  if (!existsSync(archive)) {
+    const res = await fetch(BINARYEN.url, { redirect: 'follow' });
+    if (!res.ok) throw new Error(`oxc-wasm: GET ${BINARYEN.url} -> ${res.status}`);
+    await fs.writeFile(archive, new Uint8Array(await res.arrayBuffer()));
+  }
+  const digest = sha256(await fs.readFile(archive));
+  if (digest !== BINARYEN.sha256) throw new Error(`oxc-wasm: ${BINARYEN.url} sha256 ${digest}, pinned ${BINARYEN.sha256}`);
+  const dir = path.join(WORK, 'binaryen');
+  await fs.rm(dir, { recursive: true, force: true });
+  await fs.mkdir(dir, { recursive: true });
+  run('tar', ['xzf', archive, '-C', dir]);
+  const bin = path.join(dir, `binaryen-${BINARYEN.version}`, 'bin', 'wasm-opt');
+  const version = run(bin, ['--version'], { capture: true }).trim();
+  if (!version.includes(BINARYEN.version)) throw new Error(`oxc-wasm: ${bin} reports ${version}`);
+  return { bin, version };
+}
+
+/** The import, export and memory sections of a wasm binary. */
+function wasmFacts(bytes) {
+  let at = 8;
+  const u = () => {
+    let result = 0, shift = 0, byte;
+    do { byte = bytes[at++]; result |= (byte & 0x7f) << shift; shift += 7; } while (byte & 0x80);
+    return result >>> 0;
+  };
+  const str = () => { const n = u(); const s = new TextDecoder().decode(bytes.subarray(at, at + n)); at += n; return s; };
+  const facts = { imports: [], exports: [], memories: [] };
+  while (at < bytes.length) {
+    const id = bytes[at++];
+    const size = u();
+    const end = at + size;
+    if (id === 2) {
+      for (let i = u(); i > 0; i--) {
+        facts.imports.push(`${str()}.${str()}`);
+        const kind = bytes[at++];
+        if (kind === 0) u();
+        else if (kind === 1) { at++; const f = bytes[at++]; u(); if (f & 1) u(); }
+        else if (kind === 2) { const f = bytes[at++]; u(); if (f & 1) u(); }
+        else if (kind === 3) at += 2;
+      }
+    } else if (id === 5) {
+      for (let i = u(); i > 0; i--) {
+        const flags = bytes[at++];
+        const memory = { shared: (flags & 2) !== 0, initial: u() };
+        if (flags & 1) memory.maximum = u();
+        facts.memories.push(memory);
+      }
+    } else if (id === 7) {
+      for (let i = u(); i > 0; i--) { facts.exports.push(str()); at++; u(); }
+    }
+    at = end;
+  }
+  return facts;
+}
+
+// ── Main ────────────────────────────────────────────────────────────────
+await fs.mkdir(WORK, { recursive: true });
+await fs.mkdir(OUT, { recursive: true });
+const crateDir = path.join(WORK, 'nimbus-oxc');
+const inputs = await oxcWasmInputs();
+await copyCrate(crateDir);
+const toolchainText = await fs.readFile(path.join(crateDir, 'rust-toolchain.toml'), 'utf8');
+const rust = toolchain(crateDir, toolchainText);
+const optimizer = await wasmOpt();
+
+const cargoHome = process.env.CARGO_HOME ?? path.join(process.env.HOME ?? '/', '.cargo');
+// Cargo and rustc read settings from the environment that Cargo.toml and the
+// flags below pin (RUSTC, RUSTDOC, CARGO_PROFILE_RELEASE_*, CARGO_BUILD_*,
+// RUSTFLAGS, RUSTC_WRAPPER, …): the build sees none of them but where its
+// caches live, and the compiler is the one toolchain() checked.
+const KEPT = new Set(['CARGO_HOME', 'RUSTUP_HOME', 'RUSTUP_TOOLCHAIN']);
+const OVERRIDES = /^(CARGO|RUST|RUSTC|RUSTDOC)(_|$)|^RUSTFLAGS$|^RUSTDOCFLAGS$/;
+const ambient = Object.fromEntries(Object.entries(rust.env).filter(([name]) => KEPT.has(name) || !OVERRIDES.test(name)));
+for (const name of ['RUSTC', 'RUSTDOC', 'RUSTFLAGS', 'RUSTC_WRAPPER', 'CARGO_PROFILE_RELEASE_OPT_LEVEL', 'CARGO_BUILD_TARGET']) {
+  if (name in ambient) throw new Error(`oxc-wasm: ${name} survived the environment filter`);
+}
+const env = {
+  ...ambient,
+  RUSTC: rust.compiler,
+  CARGO_TARGET_DIR: path.join(WORK, 'target'),
+  CARGO_ENCODED_RUSTFLAGS: RUSTFLAGS.join('\x1f'),
+  // Machine paths out of panic messages without entering cargo's metadata
+  // hash (napi-wasm/rustc-remap.sh explains why not RUSTFLAGS).
+  RUSTC_WRAPPER: path.join(HERE, '..', 'napi-wasm', 'rustc-remap.sh'),
+  NIMBUS_REMAP_WORK: WORK,
+  NIMBUS_REMAP_CARGO_HOME: cargoHome,
+  SOURCE_DATE_EPOCH: '0',
+};
+const jobs = Number(process.env.NIMBUS_CARGO_JOBS ?? '4');
+if (!Number.isInteger(jobs) || jobs < 1 || jobs > 12) throw new Error('oxc-wasm: NIMBUS_CARGO_JOBS must be an integer from 1 to 12');
+const cargoArgs = ['build', '--release', '--locked', '--lib', '--target', TARGET, '-j', String(jobs)];
+const runner = process.env.NIMBUS_CARGO_RUNNER;
+if (runner) run(runner, ['cargo', ...cargoArgs], { cwd: crateDir, env });
+else run('cargo', cargoArgs, { cwd: crateDir, env });
+
+const linked = path.join(WORK, 'target', TARGET, 'release', 'nimbus_oxc.wasm');
+const output = path.join(OUT, 'nimbus-oxc.wasm');
+run(optimizer.bin, [linked, ...WASM_OPT_ARGS, '-o', output]);
+const wasm = new Uint8Array(await fs.readFile(output));
+const facts = wasmFacts(wasm);
+if (facts.imports.length !== 0) throw new Error(`oxc-wasm: the module imports ${facts.imports.join(', ')}; it must import nothing`);
+if (JSON.stringify([...facts.exports].sort()) !== JSON.stringify(EXPORTS)) {
+  throw new Error(`oxc-wasm: the module exports ${facts.exports.join(', ')}; the ABI is ${EXPORTS.join(', ')}`);
+}
+const [memory] = facts.memories;
+if (facts.memories.length !== 1 || memory.shared) throw new Error('oxc-wasm: the module must define one unshared memory');
+if (memory.initial > OXC_MAX_INITIAL_PAGES) {
+  throw new Error(`oxc-wasm: the module's memory starts at ${memory.initial} pages, over OXC_MAX_INITIAL_PAGES (${OXC_MAX_INITIAL_PAGES})`);
+}
+
+const drifted = changedInputs(inputs, await oxcWasmInputs());
+if (drifted.length) throw new Error(`oxc-wasm: inputs changed during the build: ${drifted.join(', ')}`);
+const cargoToml = await fs.readFile(path.join(crateDir, 'Cargo.toml'), 'utf8');
+const lock = await fs.readFile(path.join(crateDir, 'Cargo.lock'), 'utf8');
+const provenance = {
+  artifact: 'nimbus-oxc',
+  oxc: lock.match(/\nname = "oxc"\nversion = "(.+)"/)?.[1],
+  target: TARGET,
+  source: {
+    crate: 'packages/worker/scripts/oxc-wasm',
+    manifestVersion: cargoToml.match(/^version = "(.+)"$/m)?.[1],
+    // Every input's sha256 (inputs.mjs); bundle-oxc-wasm.mjs stages this wasm
+    // only while they are the tree's.
+    inputs,
+  },
+  toolchain: rust.rustc,
+  cargo: {
+    command: `cargo ${cargoArgs.slice(0, -2).join(' ')}`,
+    rustflags: RUSTFLAGS,
+    rustcWrapper: 'napi-wasm/rustc-remap.sh (--remap-path-prefix <work>=/build <CARGO_HOME>=/cargo)',
+  },
+  wasmOpt: { binaryen: BINARYEN, version: optimizer.version, args: WASM_OPT_ARGS },
+  wasm: { imports: [], exports: EXPORTS, memoryInitialPages: memory.initial, stackBytes: WASM_STACK_BYTES },
+  outputs: { 'nimbus-oxc.wasm': { bytes: wasm.length, sha256: sha256(wasm) } },
+};
+await fs.writeFile(path.join(OUT, 'provenance.json'), JSON.stringify(provenance, null, 2) + '\n');
+console.log(JSON.stringify(provenance.outputs, null, 2));

package/scripts/oxc-wasm/examples/memory.rs

@@ -0,0 +1,51 @@
+//! `cargo run --release --example memory -- <file> [key=value ...]`: peak heap of one transform.
+use std::alloc::{GlobalAlloc, Layout, System};
+use std::sync::atomic::{AtomicUsize, Ordering::Relaxed};
+
+use oxc::allocator::Allocator;
+
+struct Counting;
+static LIVE: AtomicUsize = AtomicUsize::new(0);
+static PEAK: AtomicUsize = AtomicUsize::new(0);
+
+unsafe impl GlobalAlloc for Counting {
+    unsafe fn alloc(&self, layout: Layout) -> *mut u8 {
+        let live = LIVE.fetch_add(layout.size(), Relaxed) + layout.size();
+        PEAK.fetch_max(live, Relaxed);
+        unsafe { System.alloc(layout) }
+    }
+    unsafe fn dealloc(&self, ptr: *mut u8, layout: Layout) {
+        LIVE.fetch_sub(layout.size(), Relaxed);
+        unsafe { System.dealloc(ptr, layout) }
+    }
+    unsafe fn realloc(&self, ptr: *mut u8, layout: Layout, new_size: usize) -> *mut u8 {
+        let live = LIVE.fetch_add(new_size, Relaxed) + new_size;
+        PEAK.fetch_max(live, Relaxed);
+        LIVE.fetch_sub(layout.size(), Relaxed);
+        unsafe { System.realloc(ptr, layout, new_size) }
+    }
+}
+
+#[global_allocator]
+static GLOBAL: Counting = Counting;
+
+fn main() {
+    let mut args = std::env::args().skip(1);
+    let path = args.next().expect("a file");
+    let source = std::fs::read_to_string(&path).expect("readable file");
+    let wire: Vec<String> = args.flat_map(|a| a.splitn(2, '=').map(str::to_string).collect::<Vec<_>>()).collect();
+    let options = nimbus_oxc::options::Options::decode(&wire.join("\0")).expect("options");
+    let base = LIVE.load(Relaxed);
+    PEAK.store(base, Relaxed);
+    let allocator = Allocator::default();
+    let started = std::time::Instant::now();
+    let output = nimbus_oxc::transform(&allocator, &source, &options);
+    let ms = started.elapsed().as_secs_f64() * 1000.0;
+    let arena = allocator.capacity();
+    let mib = |b: usize| b as f64 / 1048576.0;
+    eprintln!(
+        "source {:.2} MiB, output {:.2} MiB, arena {:.2} MiB (used {:.2}), peak heap over base {:.2} MiB, {:.1} ms, errors {}",
+        mib(source.len()), mib(output.code.len()), mib(arena), mib(allocator.used_bytes()), mib(PEAK.load(Relaxed) - base), ms,
+        output.diagnostics.iter().filter(|d| d.error).count()
+    );
+}

package/scripts/oxc-wasm/examples/transform.rs

@@ -0,0 +1,20 @@
+//! `cargo run --example transform -- <file> [key=value ...]`: print one transform.
+use oxc::allocator::Allocator;
+
+fn main() {
+    let mut args = std::env::args().skip(1);
+    let path = args.next().expect("a file");
+    let source = std::fs::read_to_string(&path).expect("readable file");
+    // key=value; define=name=replacement
+    let wire: Vec<String> = args.flat_map(|a| a.splitn(if a.starts_with("define=") { 3 } else { 2 }, '=').map(str::to_string).collect::<Vec<_>>()).collect();
+    let options = nimbus_oxc::options::Options::decode(&wire.join("\0")).expect("options");
+    let allocator = Allocator::default();
+    let output = nimbus_oxc::transform(&allocator, &source, &options);
+    for d in &output.diagnostics {
+        eprintln!("{} {}:{}:{}: {}", if d.error { "ERROR" } else { "WARN" }, d.file, d.line, d.column, d.text);
+    }
+    print!("{}", output.code);
+    if let Some(map) = output.map {
+        eprintln!("MAP {map}");
+    }
+}

package/scripts/oxc-wasm/inputs.mjs

@@ -0,0 +1,32 @@
+/**
+ * inputs.mjs — what the Oxc wasm is built from, as digests: build.mjs writes
+ * them into the staged provenance.json, and bundle-oxc-wasm.mjs refuses to
+ * stage a wasm whose recorded inputs are not the tree's (a source edited
+ * without a rebuild).
+ */
+import { createHash } from 'node:crypto';
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const CRATE = path.dirname(fileURLToPath(import.meta.url));
+const sha256 = (bytes) => createHash('sha256').update(bytes).digest('hex');
+
+/** Files outside src/ that decide the output, relative to the crate. */
+const FILES = ['Cargo.toml', 'Cargo.lock', 'rust-toolchain.toml', 'build.mjs', 'inputs.mjs', '../napi-wasm/rustc-remap.sh'];
+
+/** `{ <path>: <sha256> }` for every input, src/ file by file, sorted by path. */
+export async function oxcWasmInputs(crate = CRATE) {
+  const src = (await fs.readdir(path.join(crate, 'src'), { recursive: true, withFileTypes: true }))
+    .filter((entry) => entry.isFile())
+    .map((entry) => path.relative(crate, path.join(entry.parentPath, entry.name)).split(path.sep).join('/'));
+  const paths = [...FILES, ...src].sort();
+  const digests = await Promise.all(paths.map(async (file) => [file, sha256(await fs.readFile(path.join(crate, file)))]));
+  return Object.fromEntries(digests);
+}
+
+/** The inputs that differ between two records, as `<path>` lines. */
+export function changedInputs(recorded, current) {
+  const paths = new Set([...Object.keys(recorded ?? {}), ...Object.keys(current)]);
+  return [...paths].sort().filter((file) => recorded?.[file] !== current[file]);
+}

package/scripts/oxc-wasm/rust-toolchain.toml

@@ -0,0 +1,5 @@
+# The exact rustc build.mjs builds with (it refuses any other).
+[toolchain]
+channel = "1.98.1"
+targets = ["wasm32-unknown-unknown"]
+profile = "minimal"

package/scripts/oxc-wasm/src/abi.rs

@@ -0,0 +1,136 @@
+//! The wasm32 interface. The module imports nothing; JavaScript drives it
+//! through four exports:
+//!
+//! 1. `nimbus_oxc_alloc(capacity)` returns a buffer, into which the caller
+//!    writes the UTF-8 source followed by the options' wire form (options.rs).
+//!    `nimbus_oxc_realloc(ptr, capacity, new_capacity)` grows it, for a source
+//!    whose UTF-8 is longer than the caller first guessed.
+//! 2. `nimbus_oxc_transform(ptr, capacity, source_len, options_len)` consumes
+//!    that buffer and returns the address of nine `u32`s: status (0 ok, 1 the
+//!    module was refused, 2 the options were), then the address and length of
+//!    the code, of the source map JSON, and of the diagnostics, then the bytes
+//!    of AST arena the transform used and reserved.
+//! 3. The caller copies what it needs, then calls `nimbus_oxc_release()`,
+//!    which frees the outputs. Nothing is kept between transforms, so the
+//!    arena a large module needed is reused for the next module's arena and
+//!    everything else.
+//!
+//! Diagnostics are seven fields per diagnostic: `E` or `W`, line, column,
+//! length, file, line text, message. Each field is its UTF-8 byte length in
+//! decimal, `:`, then its bytes, so a field may hold any character (a source
+//! line can hold a NUL).
+
+use std::alloc::{Layout, alloc, dealloc, realloc};
+use std::fmt::Write;
+
+use oxc::allocator::Allocator;
+
+use crate::options::Options;
+
+struct Result {
+    words: [u32; 9],
+    code: String,
+    map: String,
+    diagnostics: String,
+}
+
+static mut RESULT: Option<Result> = None;
+
+#[unsafe(no_mangle)]
+pub extern "C" fn nimbus_oxc_alloc(capacity: usize) -> *mut u8 {
+    // SAFETY: the size is nonzero and the layout's alignment is 1.
+    unsafe { alloc(Layout::from_size_align_unchecked(capacity.max(1), 1)) }
+}
+
+/// # Safety
+/// `ptr` came from `nimbus_oxc_alloc(capacity)` (or this function with that capacity).
+#[unsafe(no_mangle)]
+pub unsafe extern "C" fn nimbus_oxc_realloc(ptr: *mut u8, capacity: usize, new_capacity: usize) -> *mut u8 {
+    // SAFETY: as documented; the layout matches the allocation's.
+    unsafe { realloc(ptr, Layout::from_size_align_unchecked(capacity.max(1), 1), new_capacity.max(1)) }
+}
+
+/// # Safety
+/// `ptr` came from `nimbus_oxc_alloc(capacity)` and its first
+/// `source_len + options_len` bytes are written.
+#[unsafe(no_mangle)]
+pub unsafe extern "C" fn nimbus_oxc_transform(
+    ptr: *mut u8,
+    capacity: usize,
+    source_len: usize,
+    options_len: usize,
+) -> *const u32 {
+    // SAFETY: the caller wrote these bytes at `ptr`.
+    let bytes = unsafe { std::slice::from_raw_parts(ptr, source_len + options_len) };
+    let result = run(&bytes[..source_len], &bytes[source_len..]);
+    // SAFETY: allocated by `nimbus_oxc_alloc(capacity)`.
+    unsafe { dealloc(ptr, Layout::from_size_align_unchecked(capacity.max(1), 1)) };
+    // SAFETY: wasm32 here is single-threaded; nothing else holds a reference to RESULT.
+    unsafe {
+        let slot = &mut *std::ptr::addr_of_mut!(RESULT);
+        let result = slot.insert(result);
+        result.words[1] = result.code.as_ptr() as u32;
+        result.words[2] = result.code.len() as u32;
+        result.words[3] = result.map.as_ptr() as u32;
+        result.words[4] = result.map.len() as u32;
+        result.words[5] = result.diagnostics.as_ptr() as u32;
+        result.words[6] = result.diagnostics.len() as u32;
+        result.words.as_ptr()
+    }
+}
+
+#[unsafe(no_mangle)]
+pub extern "C" fn nimbus_oxc_release() {
+    // SAFETY: as in `nimbus_oxc_transform`.
+    unsafe { *std::ptr::addr_of_mut!(RESULT) = None };
+}
+
+fn run(source: &[u8], options: &[u8]) -> Result {
+    let refused = |status: u32, message: String| Result {
+        words: [status, 0, 0, 0, 0, 0, 0, 0, 0],
+        code: String::new(),
+        map: String::new(),
+        diagnostics: diagnostic_fields(['E'.to_string(), "0".into(), "0".into(), "0".into(), "<stdin>".into(), String::new(), message]),
+    };
+    let Ok(source) = std::str::from_utf8(source) else {
+        return refused(1, "the source is not UTF-8".into());
+    };
+    let options = match std::str::from_utf8(options).map_err(|e| e.to_string()).and_then(Options::decode) {
+        Ok(options) => options,
+        Err(message) => return refused(2, message),
+    };
+    let allocator = Allocator::default();
+    let output = crate::transform(&allocator, source, &options);
+    let arena = [allocator.used_bytes() as u32, allocator.capacity() as u32];
+    drop(allocator);
+    let diagnostics = output
+        .diagnostics
+        .iter()
+        .map(|d| {
+            diagnostic_fields([
+                if d.error { "E" } else { "W" }.to_string(),
+                d.line.to_string(),
+                d.column.to_string(),
+                d.length.to_string(),
+                d.file.clone(),
+                d.line_text.clone(),
+                d.text.clone(),
+            ])
+        })
+        .collect();
+    Result {
+        words: [u32::from(output.has_errors()), 0, 0, 0, 0, 0, 0, arena[0], arena[1]],
+        code: output.code,
+        map: output.map.unwrap_or_default(),
+        diagnostics,
+    }
+}
+
+/// One diagnostic's fields, each as `<byte length>:<bytes>`.
+fn diagnostic_fields(fields: [String; 7]) -> String {
+    let mut out = String::new();
+    for field in fields {
+        let _ = write!(out, "{}:{field}", field.len());
+    }
+    out
+}

package/scripts/oxc-wasm/src/diagnostics.rs

@@ -0,0 +1,49 @@
+//! Diagnostics in the shape esbuild reports them: text plus a location whose
+//! line is 1-based and whose column is a 0-based byte offset into the line.
+
+use oxc::diagnostics::{OxcDiagnostic, Severity};
+
+pub struct Diagnostic {
+    pub error: bool,
+    pub text: String,
+    pub file: String,
+    /// 0 when the diagnostic has no location.
+    pub line: u32,
+    pub column: u32,
+    pub length: u32,
+    pub line_text: String,
+}
+
+pub fn convert(source: &str, file: &str, diagnostics: Vec<OxcDiagnostic>) -> Vec<Diagnostic> {
+    diagnostics
+        .into_iter()
+        .filter(|d| matches!(d.severity, Severity::Error | Severity::Warning))
+        .map(|d| {
+            let mut text = d.message.to_string();
+            if let Some(help) = &d.help {
+                text.push_str(" (");
+                text.push_str(help);
+                text.push(')');
+            }
+            let mut diagnostic = Diagnostic {
+                error: d.severity == Severity::Error,
+                text,
+                file: file.to_string(),
+                line: 0,
+                column: 0,
+                length: 0,
+                line_text: String::new(),
+            };
+            if let Some(label) = d.labels.first() {
+                let offset = (label.offset() as usize).min(source.len());
+                let line_start = source[..offset].rfind(['\n', '\r']).map_or(0, |i| i + 1);
+                let line_end = source[offset..].find(['\n', '\r']).map_or(source.len(), |i| offset + i);
+                diagnostic.line = 1 + source[..line_start].bytes().filter(|&b| b == b'\n').count() as u32;
+                diagnostic.column = (offset - line_start) as u32;
+                diagnostic.length = label.span().size().min((line_end - offset) as u32);
+                diagnostic.line_text = source[line_start..line_end].to_string();
+            }
+            diagnostic
+        })
+        .collect()
+}