@oxc-minify/binding-wasm32-wasi 0.150.0 → 0.151.0

package/minify.wasi-browser.js

@@ -8,6 +8,55 @@ import {
 import { createContext as __emnapiCreateContext } from '@emnapi/runtime'
 
 
+export const __napiBindingTarget = 'wasm32-wasi'
+function __napiStampBindingTarget(exportsObject, target) {
+  if (
+    Object.prototype.hasOwnProperty.call(exportsObject, '__napiBindingTarget')
+  ) {
+    if (exportsObject.__napiBindingTarget === target) {
+      // Already ours: the root entry aliases the object it loaded, so a WASI
+      // fallback candidate — or a `NAPI_RS_NATIVE_LIBRARY_PATH` override that
+      // is a generated loader — arrives already stamped with this same value.
+      return target
+    }
+    const error = new Error(
+      '`__napiBindingTarget` is reserved by the generated binding loader, but the loaded binding already exports it. Rename the export, e.g. #[napi(js_name = "...")].',
+    )
+    error.code = 'ERR_NAPI_BINDING_TARGET_CONFLICT'
+    throw error
+  }
+  if (!Object.isExtensible(exportsObject)) {
+    // A `#[napi(module_exports)]` hook may seal or freeze this object
+    // (`Object::seal` / `Object::freeze`). Reporting the artifact is metadata,
+    // never a reason to fail an otherwise successful load, so the stamp is
+    // skipped. What a consumer still sees then follows the entry point: the
+    // browser and deferred loaders declare `__napiBindingTarget` at module
+    // level and go on reporting it, while the CommonJS entries hand back this
+    // very object as `module.exports`, so there the value is absent.
+    return target
+  }
+  try {
+    // [[Define]], not [[Set]]: an ordinary assignment walks the prototype
+    // chain, so an inherited accessor could swallow the value or throw and
+    // fail an otherwise successful load. The descriptor is what a successful
+    // assignment would have produced.
+    Object.defineProperty(exportsObject, '__napiBindingTarget', {
+      configurable: true,
+      enumerable: true,
+      value: target,
+      writable: true,
+    })
+  } catch {
+    // Same rule as the non-extensible skip above: reporting the artifact is
+    // metadata, never a reason to fail an otherwise successful load. An exotic
+    // object (a Proxy whose defineProperty trap refuses) is skipped, not
+    // thrown over.
+  }
+  // The CommonJS loaders assign this return value so `cjs-module-lexer` — and
+  // therefore Node's CJS -> ESM named export detection — can see
+  // `__napiBindingTarget` statically.
+  return target
+}
 
 const __wasi = new __WASI({
   version: 'preview1',
@@ -42,14 +91,45 @@ let __emnapiContext
 
 const __wasiDisposeSymbol = Symbol.for('napi.rs.wasi.dispose')
 const __wasiWorkers = new Set()
+// The thread manager has to be reachable *before* anything that can throw
+// during load or registration. Initialization can fail after the pool has
+// already spawned workers, and the rollback still has to mark their
+// terminations as expected — but `__napiModule` is assigned only when
+// instantiation RETURNS, so on exactly that path it is still undefined. A
+// plugin factory runs while the emnapi module is being created, before the
+// wasm is loaded and before any registration function runs, and its context
+// carries the very same manager instance.
+let __wasiThreadManager
+
+function __captureWasiThreadManager(context) {
+  if (context && context.PThread) {
+    __wasiThreadManager = context.PThread
+  }
+  return {}
+}
+
+function __getWasiThreadManager() {
+  const manager =
+    __wasiThreadManager !== undefined
+      ? __wasiThreadManager
+      : __napiModule
+        ? __napiModule.PThread
+        : undefined
+  if (manager && typeof manager.terminateWorker === 'function') {
+    return manager
+  }
+  return undefined
+}
 let __napiInstance
 let __emnapiContextDestroyed = false
 let __emnapiContextDestroyPromise
 let __emnapiWasmEnvCleanupPrepared = false
+let __emnapiWasmEnvCleanupPreparing = false
 let __emnapiWasmEnvCleanupRan = false
 let __emnapiWasmEnvCleanupDrained = false
 let __emnapiWasmEnvCleanupDrainPromise
 let __wasiDisposed = false
+let __wasiAsyncWorkDrainPromise
 let __wasiDisposePromise
 let __completeWasiDisposal = function () {}
 // Overridden by loader flavors that have a last-resort reclaim for a rollback
@@ -119,13 +199,58 @@ function __attachCleanupErrors(error, cleanupErrors) {
   return aggregate
 }
 
+function __wrapEmnapiContextDestroyForSettlement(
+  context,
+  prepareEnvCleanup,
+  isPreparingEnvCleanup,
+) {
+  let destroy
+  try {
+    destroy = context.destroy
+  } catch {
+    return context
+  }
+  if (typeof destroy !== 'function') {
+    return context
+  }
+  try {
+    Object.defineProperty(context, 'destroy', {
+      configurable: true,
+      enumerable: false,
+      writable: true,
+      value: function () {
+        // Reentered from a promise hook that fired inside the barrier: the
+        // frame running it destroys as soon as it returns.
+        if (isPreparingEnvCleanup?.()) {
+          return
+        }
+        prepareEnvCleanup?.()
+        return Reflect.apply(destroy, this, arguments)
+      },
+    })
+  } catch {}
+  return context
+}
+
+function __isPreparingWasmEnvCleanup() {
+  return __emnapiWasmEnvCleanupPreparing
+}
+
 function __prepareWasmEnvCleanup() {
-  if (__emnapiWasmEnvCleanupPrepared) {
+  if (__emnapiWasmEnvCleanupPrepared || __emnapiWasmEnvCleanupPreparing) {
     return
   }
   const prepare = __napiInstance?.exports?.napi_prepare_wasm_env_cleanup
   if (typeof prepare === 'function') {
-    prepare()
+    // The addon settles the promises it cancels synchronously, under a
+    // non-reentrant lifecycle mutex: anything a promise hook calls from in
+    // here must not reach this export again.
+    __emnapiWasmEnvCleanupPreparing = true
+    try {
+      prepare()
+    } finally {
+      __emnapiWasmEnvCleanupPreparing = false
+    }
     __emnapiWasmEnvCleanupRan = true
   }
   __emnapiWasmEnvCleanupPrepared = true
@@ -162,6 +287,24 @@ const __scheduleMacrotask = (function () {
   }
 })()
 
+// A real, *referenced* timer, for waits that must let the whole host make
+// progress between looks — the async-work drain polls the addon rather than
+// interleaving with the @emnapi/core dispatch, so a zero-delay macrotask there
+// would spin the loop instead of yielding it. Falls back to the macrotask
+// scheduler on a host without timers.
+function __scheduleTimer(callback, delay) {
+  const setTimer = globalThis.setTimeout
+  if (typeof setTimer !== 'function') {
+    __scheduleMacrotask(callback)
+    return
+  }
+  try {
+    setTimer(callback, delay)
+  } catch {
+    __scheduleMacrotask(callback)
+  }
+}
+
 // Turns to wait for while the addon still reports queued settlements. Reaching
 // zero is the only success. A counter still nonzero at this bound rejects the
 // disposal as retryable (`ERR_NAPI_WASI_CLEANUP_PENDING`) rather than
@@ -318,13 +461,209 @@ function __destroyEmnapiContext() {
   return destroyPromise
 }
 
+/**
+ * Holds the event loop open until `work` settles.
+ *
+ * Nothing else can: the pool workers are deliberately unreferenced so an idle
+ * binding cannot keep a process alive, and referencing them again for the
+ * termination does not hold either — emnapi unreferences a worker the moment it
+ * reports `async-thread-ready`, which for a worker that was still starting
+ * lands *after* the termination began. Without a handle of its own, an
+ * `await dispose()` with nothing else pending exits the process with its
+ * promise unsettled, and everything after the `await` is skipped.
+ *
+ * The timer is cleared as soon as the work settles, so this never outlives the
+ * disposal that asked for it.
+ */
+function __keepEventLoopAliveUntil(work) {
+  const setTimer = globalThis.setInterval
+  const clearTimer = globalThis.clearInterval
+  if (typeof setTimer !== 'function' || typeof clearTimer !== 'function') {
+    return work
+  }
+  let timer
+  try {
+    timer = setTimer(function () {}, 50)
+  } catch {
+    return work
+  }
+  const release = function () {
+    try {
+      clearTimer(timer)
+    } catch {}
+  }
+  return work.then(
+    (value) => {
+      release()
+      return value
+    },
+    (error) => {
+      release()
+      throw error
+    },
+  )
+}
+
+// How often to re-read `napi_wasm_async_work_pending` while waiting. The wait
+// ends when the addon reports zero, so this only decides how promptly disposal
+// notices — not how long it waits.
+const __WASI_ASYNC_WORK_POLL_INTERVAL_MS = 1
+
+/**
+ * Settles this addon's outstanding `napi_async_work` before the teardown that
+ * would strand it.
+ *
+ * `napi_prepare_wasm_env_cleanup` does not cover async work, and nothing about
+ * it is observable from JavaScript: the threadless archive resolves
+ * `napi_*_async_work` through the `@emnapi/core` plugins, but the threaded one
+ * links the C `async_work.c` on the uv threadpool, so there the wasm neither
+ * imports nor exports those symbols and the only brackets a loader could watch
+ * (`_emnapi_ctx_*_waiting_request_counter`) are shared with threadsafe
+ * functions. The addon is the one place both flavors go through, so it answers
+ * for both, through the same kind of handshake the settlement drain uses:
+ *
+ *   - `napi_wasm_cancel_pending_async_work()` cancels what no thread has
+ *     started. Those completion callbacks run with `napi_cancelled`, which
+ *     napi-rs turns into a promise rejected with an `AbortError`.
+ *   - `napi_wasm_async_work_pending()` counts what is still owed a completion
+ *     callback. Work already executing refuses cancellation and stays counted
+ *     until it finishes normally — which it can, because this runs before the
+ *     barrier, before `Context.destroy()` and before anything is terminated.
+ *
+ * Both exports are optional: an addon built against a napi crate that predates
+ * them drains nothing and keeps the previous behavior, exactly as the
+ * `napi_wasm_env_cleanup_pending` handshake degrades.
+ *
+ * Returns nothing when there is nothing outstanding, which keeps disposal
+ * synchronous in the common case. The promise it returns otherwise never
+ * rejects.
+ *
+ * The wait has no deadline, and that is the point: giving up would destroy the
+ * environment with a completion callback still owed, which is the stranding
+ * this exists to prevent. A task whose `execute` never returns already keeps an
+ * *undisposed* process alive in exactly the same way, so disposal inherits that
+ * rather than inventing a bound it cannot honor.
+ *
+ * Safe to call from inside a completion callback, which is reachable: settling
+ * a task runs addon code that can re-enter JavaScript — a setter on the value
+ * being handed back, a threadsafe-function callback — and that JavaScript can
+ * call `dispose()`. Two things make it terminate rather than wait on itself:
+ *
+ *   - The addon keeps a work registered until its completion callback
+ *     *finishes*, so the count read here is at least one and this takes the
+ *     polling path instead of declaring the environment drained and tearing it
+ *     down from inside the frame that is still settling a promise.
+ *   - The poll is a timer, so it cannot run until the callback has returned to
+ *     the host — by which time that work has left the registry. The count the
+ *     next poll reads is the one taken after the callback finished.
+ *
+ * `__disposeWasiBinding` hands every caller the same in-flight promise, so the
+ * nested call joins this disposal rather than starting a second one.
+ */
+function __drainWasiAsyncWork() {
+  if (__wasiAsyncWorkDrainPromise !== undefined) {
+    return __wasiAsyncWorkDrainPromise
+  }
+  const exports = __napiInstance?.exports
+  const pending = exports?.napi_wasm_async_work_pending
+  const cancelPending = exports?.napi_wasm_cancel_pending_async_work
+  if (typeof pending !== 'function' || typeof cancelPending !== 'function') {
+    return
+  }
+
+  const readPending = () => {
+    try {
+      return pending()
+    } catch (error) {
+      // A trap is the only way this call fails: it reads a counter and cannot
+      // allocate or call back into JavaScript. A trapped instance can no longer
+      // run anything, so its outstanding work is unreachable by definition —
+      // there is nothing left to wait for, and refusing to dispose would only
+      // keep a dead instance and its stuck counter alive. Best-effort here is
+      // the honest answer, and it is what disposal did before this drain
+      // existed.
+      //
+      // Only a trap. Anything else means the export is not what this loader
+      // thinks it is, which is a defect worth surfacing rather than disposing
+      // over.
+      if (error instanceof globalThis.WebAssembly.RuntimeError) {
+        return 0
+      }
+      throw error
+    }
+  }
+
+  if (!readPending()) {
+    return
+  }
+  try {
+    cancelPending()
+  } catch {
+    // Cancellation is an optimization: it bounds the wait by the work already
+    // executing. Failing it only means waiting for the whole queue instead.
+  }
+  if (!readPending()) {
+    return
+  }
+
+  const drainPromise = __keepEventLoopAliveUntil(
+    (async () => {
+      while (readPending()) {
+        await new Promise((resolve) => {
+          __scheduleTimer(resolve, __WASI_ASYNC_WORK_POLL_INTERVAL_MS)
+        })
+      }
+    })(),
+  ).then(
+    () => {
+      __wasiAsyncWorkDrainPromise = undefined
+    },
+    (error) => {
+      // A wait that could not run is not a wait that finished. The only way
+      // here is a host whose timers and macrotask primitives all refuse, and
+      // the work is still outstanding — reporting success would destroy the
+      // environment over it, which is the stranding this exists to prevent.
+      // Reject instead: disposal stays retryable, and the context is not
+      // destroyed. Clearing the memo first is what makes the retry re-run this.
+      __wasiAsyncWorkDrainPromise = undefined
+      throw error
+    },
+  )
+  __wasiAsyncWorkDrainPromise = drainPromise
+  return drainPromise
+}
+
+/**
+ * `@emnapi/wasi-threads` counts a worker exit as expected only when its own
+ * thread manager performed the termination. A bare `worker.terminate()` reaches
+ * the manager's `exit` listener instead, which reports
+ * `worker (tid = N) sent an error! ... stopped with exit code 1` and rethrows
+ * inside the emit — aborting the `once('exit')` that backs the terminate
+ * promise, so disposal never settles and the process dies with an uncaught
+ * exception. Mark the termination through the manager first.
+ *
+ * The manager comes from `__getWasiThreadManager`, not from `__napiModule`:
+ * the initialization rollback runs on the one path where instantiation never
+ * returned, so `__napiModule` is still undefined there while the workers it
+ * spawned are already registered and loaded.
+ *
+ * Not `terminateAllThreads()`: that one recreates the pool it just shut down.
+ */
 function __terminateWasiWorkers() {
   const cleanupErrors = []
   const pending = []
+  const threadManager = __getWasiThreadManager()
 
   for (const worker of __wasiWorkers) {
     let result
     try {
+      if (threadManager) {
+        threadManager.terminateWorker(worker)
+        // `terminateWorker` leaves behind a reporter that logs every message
+        // still queued on the port, which Node flushes on exit. Nothing is
+        // listening for those any more.
+        worker.onmessage = undefined
+      }
       result = worker.terminate()
     } catch (error) {
       cleanupErrors.push(error)
@@ -354,7 +693,9 @@ function __terminateWasiWorkers() {
       )
     }
   }
-  return pending.length > 0 ? Promise.all(pending).then(finish) : finish()
+  return pending.length > 0
+    ? __keepEventLoopAliveUntil(Promise.all(pending)).then(finish)
+    : finish()
 }
 
 function __finishWasiDisposal() {
@@ -373,7 +714,7 @@ function __continueWasiDisposal() {
   return __finishWasiDisposal()
 }
 
-function __startWasiDisposal() {
+function __cleanUpWasmEnvForWasiDisposal() {
   // Run the pre-teardown barrier, then let the settlements it queued actually
   // reach JavaScript, and only then destroy the environment. Doing these two
   // back to back is what strands them.
@@ -385,6 +726,21 @@ function __startWasiDisposal() {
   return __continueWasiDisposal()
 }
 
+function __startWasiDisposal() {
+  // Outstanding `napi_async_work` goes first, while the environment is still
+  // completely live: the completion callbacks run addon code, and everything
+  // after this point takes that away from them — the barrier shuts the async
+  // runtime down, `Context.destroy()` stops JavaScript calls, and terminating
+  // the pool threads removes what would have reported the work finished.
+  const asyncWorkResult = __drainWasiAsyncWork()
+  if (__isThenable(asyncWorkResult)) {
+    return Promise.resolve(asyncWorkResult).then(
+      __cleanUpWasmEnvForWasiDisposal,
+    )
+  }
+  return __cleanUpWasmEnvForWasiDisposal()
+}
+
 /**
  * Disposes this generated WASI binding.
  *
@@ -526,36 +882,71 @@ function __retainFailedWasiRollback(cleanupErrors) {
  * bug with no upper bound, while the retained bookkeeping is bounded by the page.
  */
 function __rollbackWasiInitialization() {
-  const cleanupErrors = []
-  let drainResult
-  let settlementsUnreached = false
+  // The environment teardown this rollback performs, kept nested so it cannot
+  // be reached without the async-work drain below running first.
+  function __rollbackWasmEnvForWasiInitialization() {
+    const cleanupErrors = []
+    let drainResult
+    let settlementsUnreached = false
+    try {
+      __prepareWasmEnvCleanup()
+      drainResult = __drainWasmEnvCleanup()
+    } catch (cleanupError) {
+      cleanupErrors.push(cleanupError)
+      settlementsUnreached = true
+    }
+    if (__isThenable(drainResult)) {
+      return Promise.resolve(drainResult).then(
+        () => __destroyContextForWasiRollback(cleanupErrors),
+        (cleanupError) => {
+          cleanupErrors.push(cleanupError)
+          return __retainFailedWasiRollback(cleanupErrors)
+        },
+      )
+    }
+    if (settlementsUnreached) {
+      return __retainFailedWasiRollback(cleanupErrors)
+    }
+    return __destroyContextForWasiRollback(cleanupErrors)
+  }
+
+  // Same reason as `__startWasiDisposal`: a module-init hook can start async
+  // work before the load goes on to fail, and this rollback tears down exactly
+  // what those completions need. Settle them while everything is still live,
+  // before the barrier and the teardown above take that away.
+  //
+  // A drain that could not finish leaves async work possibly outstanding, and
+  // destroying the context over it would strand exactly what this rollback is
+  // there to settle. Stop short and retain instead — the same trade
+  // `__rollbackWasmEnvForWasiInitialization` makes for the settlement drain, so
+  // the context stays reclaimable by a retry or by this flavor's own
+  // last-resort teardown.
+  const __retainAfterAsyncWorkDrainFailure = (cleanupError) =>
+    __retainFailedWasiRollback([cleanupError])
+  let asyncWorkResult
   try {
-    __prepareWasmEnvCleanup()
-    drainResult = __drainWasmEnvCleanup()
+    asyncWorkResult = __drainWasiAsyncWork()
   } catch (cleanupError) {
-    cleanupErrors.push(cleanupError)
-    settlementsUnreached = true
+    return __retainAfterAsyncWorkDrainFailure(cleanupError)
   }
-  if (__isThenable(drainResult)) {
-    return Promise.resolve(drainResult).then(
-      () => __destroyContextForWasiRollback(cleanupErrors),
-      (cleanupError) => {
-        cleanupErrors.push(cleanupError)
-        return __retainFailedWasiRollback(cleanupErrors)
-      },
+  if (__isThenable(asyncWorkResult)) {
+    return Promise.resolve(asyncWorkResult).then(
+      __rollbackWasmEnvForWasiInitialization,
+      __retainAfterAsyncWorkDrainFailure,
     )
   }
-  if (settlementsUnreached) {
-    return __retainFailedWasiRollback(cleanupErrors)
-  }
-  return __destroyContextForWasiRollback(cleanupErrors)
+  return __rollbackWasmEnvForWasiInitialization()
 }
 
 let __wasiModule
 let __napiModule
 
 try {
-  __emnapiContext = __emnapiCreateContext({ autoDestroy: false })
+  __emnapiContext = __wrapEmnapiContextDestroyForSettlement(
+    __emnapiCreateContext({ autoDestroy: false }),
+    __prepareWasmEnvCleanup,
+    __isPreparingWasmEnvCleanup,
+  )
   __emnapiContext.suppressDestroy()
   
   ;({
@@ -566,7 +957,11 @@ try {
     context: __emnapiContext,
     asyncWorkPoolSize: __asyncWorkPoolSize,
     reuseWorker: false,
-    plugins: [__emnapiAsyncWorkPlugin, __emnapiTSFNPlugin],
+    plugins: [
+      __captureWasiThreadManager,
+      __emnapiAsyncWorkPlugin,
+      __emnapiTSFNPlugin,
+    ],
     wasi: __wasi,
     onCreateWorker() {
       const worker = new Worker(new URL('@oxc-minify/binding-wasm32-wasi/wasi-worker-browser.mjs', import.meta.url), {
@@ -596,6 +991,12 @@ try {
     },
   }))
   __publishWasiDispose(__napiModule.exports)
+  // The default export hands out this object; a named module export does not
+  // travel with it, so carry the marker on the binding itself too. After the
+  // host install, which hands the same object to addon-provided registration
+  // functions that may put anything on it, and inside this `try`, so a claimed
+  // name fails the load through the rollback below rather than past it.
+  __napiStampBindingTarget(__napiModule.exports, __napiBindingTarget)
 } catch (error) {
   const cleanupErrors = await __rollbackWasiInitialization()
   throw __attachCleanupErrors(error, cleanupErrors)

package/minify.wasi.cjs

@@ -2,6 +2,56 @@
 /* eslint-disable */
 /* auto-generated by NAPI-RS */
 
+const __napiBindingTarget = 'wasm32-wasi'
+function __napiStampBindingTarget(exportsObject, target) {
+  if (
+    Object.prototype.hasOwnProperty.call(exportsObject, '__napiBindingTarget')
+  ) {
+    if (exportsObject.__napiBindingTarget === target) {
+      // Already ours: the root entry aliases the object it loaded, so a WASI
+      // fallback candidate — or a `NAPI_RS_NATIVE_LIBRARY_PATH` override that
+      // is a generated loader — arrives already stamped with this same value.
+      return target
+    }
+    const error = new Error(
+      '`__napiBindingTarget` is reserved by the generated binding loader, but the loaded binding already exports it. Rename the export, e.g. #[napi(js_name = "...")].',
+    )
+    error.code = 'ERR_NAPI_BINDING_TARGET_CONFLICT'
+    throw error
+  }
+  if (!Object.isExtensible(exportsObject)) {
+    // A `#[napi(module_exports)]` hook may seal or freeze this object
+    // (`Object::seal` / `Object::freeze`). Reporting the artifact is metadata,
+    // never a reason to fail an otherwise successful load, so the stamp is
+    // skipped. What a consumer still sees then follows the entry point: the
+    // browser and deferred loaders declare `__napiBindingTarget` at module
+    // level and go on reporting it, while the CommonJS entries hand back this
+    // very object as `module.exports`, so there the value is absent.
+    return target
+  }
+  try {
+    // [[Define]], not [[Set]]: an ordinary assignment walks the prototype
+    // chain, so an inherited accessor could swallow the value or throw and
+    // fail an otherwise successful load. The descriptor is what a successful
+    // assignment would have produced.
+    Object.defineProperty(exportsObject, '__napiBindingTarget', {
+      configurable: true,
+      enumerable: true,
+      value: target,
+      writable: true,
+    })
+  } catch {
+    // Same rule as the non-extensible skip above: reporting the artifact is
+    // metadata, never a reason to fail an otherwise successful load. An exotic
+    // object (a Proxy whose defineProperty trap refuses) is skipped, not
+    // thrown over.
+  }
+  // The CommonJS loaders assign this return value so `cjs-module-lexer` — and
+  // therefore Node's CJS -> ESM named export detection — can see
+  // `__napiBindingTarget` statically.
+  return target
+}
+
 const __nodeFs = require('node:fs')
 const __nodePath = require('node:path')
 const { WASI: __nodeWASI } = require('node:wasi')
@@ -149,14 +199,45 @@ let __emnapiContext
 
 const __wasiDisposeSymbol = Symbol.for('napi.rs.wasi.dispose')
 const __wasiWorkers = new Set()
+// The thread manager has to be reachable *before* anything that can throw
+// during load or registration. Initialization can fail after the pool has
+// already spawned workers, and the rollback still has to mark their
+// terminations as expected — but `__napiModule` is assigned only when
+// instantiation RETURNS, so on exactly that path it is still undefined. A
+// plugin factory runs while the emnapi module is being created, before the
+// wasm is loaded and before any registration function runs, and its context
+// carries the very same manager instance.
+let __wasiThreadManager
+
+function __captureWasiThreadManager(context) {
+  if (context && context.PThread) {
+    __wasiThreadManager = context.PThread
+  }
+  return {}
+}
+
+function __getWasiThreadManager() {
+  const manager =
+    __wasiThreadManager !== undefined
+      ? __wasiThreadManager
+      : __napiModule
+        ? __napiModule.PThread
+        : undefined
+  if (manager && typeof manager.terminateWorker === 'function') {
+    return manager
+  }
+  return undefined
+}
 let __napiInstance
 let __emnapiContextDestroyed = false
 let __emnapiContextDestroyPromise
 let __emnapiWasmEnvCleanupPrepared = false
+let __emnapiWasmEnvCleanupPreparing = false
 let __emnapiWasmEnvCleanupRan = false
 let __emnapiWasmEnvCleanupDrained = false
 let __emnapiWasmEnvCleanupDrainPromise
 let __wasiDisposed = false
+let __wasiAsyncWorkDrainPromise
 let __wasiDisposePromise
 let __completeWasiDisposal = function () {}
 // Overridden by loader flavors that have a last-resort reclaim for a rollback
@@ -226,13 +307,58 @@ function __attachCleanupErrors(error, cleanupErrors) {
   return aggregate
 }
 
+function __wrapEmnapiContextDestroyForSettlement(
+  context,
+  prepareEnvCleanup,
+  isPreparingEnvCleanup,
+) {
+  let destroy
+  try {
+    destroy = context.destroy
+  } catch {
+    return context
+  }
+  if (typeof destroy !== 'function') {
+    return context
+  }
+  try {
+    Object.defineProperty(context, 'destroy', {
+      configurable: true,
+      enumerable: false,
+      writable: true,
+      value: function () {
+        // Reentered from a promise hook that fired inside the barrier: the
+        // frame running it destroys as soon as it returns.
+        if (isPreparingEnvCleanup?.()) {
+          return
+        }
+        prepareEnvCleanup?.()
+        return Reflect.apply(destroy, this, arguments)
+      },
+    })
+  } catch {}
+  return context
+}
+
+function __isPreparingWasmEnvCleanup() {
+  return __emnapiWasmEnvCleanupPreparing
+}
+
 function __prepareWasmEnvCleanup() {
-  if (__emnapiWasmEnvCleanupPrepared) {
+  if (__emnapiWasmEnvCleanupPrepared || __emnapiWasmEnvCleanupPreparing) {
     return
   }
   const prepare = __napiInstance?.exports?.napi_prepare_wasm_env_cleanup
   if (typeof prepare === 'function') {
-    prepare()
+    // The addon settles the promises it cancels synchronously, under a
+    // non-reentrant lifecycle mutex: anything a promise hook calls from in
+    // here must not reach this export again.
+    __emnapiWasmEnvCleanupPreparing = true
+    try {
+      prepare()
+    } finally {
+      __emnapiWasmEnvCleanupPreparing = false
+    }
     __emnapiWasmEnvCleanupRan = true
   }
   __emnapiWasmEnvCleanupPrepared = true
@@ -269,6 +395,24 @@ const __scheduleMacrotask = (function () {
   }
 })()
 
+// A real, *referenced* timer, for waits that must let the whole host make
+// progress between looks — the async-work drain polls the addon rather than
+// interleaving with the @emnapi/core dispatch, so a zero-delay macrotask there
+// would spin the loop instead of yielding it. Falls back to the macrotask
+// scheduler on a host without timers.
+function __scheduleTimer(callback, delay) {
+  const setTimer = globalThis.setTimeout
+  if (typeof setTimer !== 'function') {
+    __scheduleMacrotask(callback)
+    return
+  }
+  try {
+    setTimer(callback, delay)
+  } catch {
+    __scheduleMacrotask(callback)
+  }
+}
+
 // Turns to wait for while the addon still reports queued settlements. Reaching
 // zero is the only success. A counter still nonzero at this bound rejects the
 // disposal as retryable (`ERR_NAPI_WASI_CLEANUP_PENDING`) rather than
@@ -425,13 +569,209 @@ function __destroyEmnapiContext() {
   return destroyPromise
 }
 
+/**
+ * Holds the event loop open until `work` settles.
+ *
+ * Nothing else can: the pool workers are deliberately unreferenced so an idle
+ * binding cannot keep a process alive, and referencing them again for the
+ * termination does not hold either — emnapi unreferences a worker the moment it
+ * reports `async-thread-ready`, which for a worker that was still starting
+ * lands *after* the termination began. Without a handle of its own, an
+ * `await dispose()` with nothing else pending exits the process with its
+ * promise unsettled, and everything after the `await` is skipped.
+ *
+ * The timer is cleared as soon as the work settles, so this never outlives the
+ * disposal that asked for it.
+ */
+function __keepEventLoopAliveUntil(work) {
+  const setTimer = globalThis.setInterval
+  const clearTimer = globalThis.clearInterval
+  if (typeof setTimer !== 'function' || typeof clearTimer !== 'function') {
+    return work
+  }
+  let timer
+  try {
+    timer = setTimer(function () {}, 50)
+  } catch {
+    return work
+  }
+  const release = function () {
+    try {
+      clearTimer(timer)
+    } catch {}
+  }
+  return work.then(
+    (value) => {
+      release()
+      return value
+    },
+    (error) => {
+      release()
+      throw error
+    },
+  )
+}
+
+// How often to re-read `napi_wasm_async_work_pending` while waiting. The wait
+// ends when the addon reports zero, so this only decides how promptly disposal
+// notices — not how long it waits.
+const __WASI_ASYNC_WORK_POLL_INTERVAL_MS = 1
+
+/**
+ * Settles this addon's outstanding `napi_async_work` before the teardown that
+ * would strand it.
+ *
+ * `napi_prepare_wasm_env_cleanup` does not cover async work, and nothing about
+ * it is observable from JavaScript: the threadless archive resolves
+ * `napi_*_async_work` through the `@emnapi/core` plugins, but the threaded one
+ * links the C `async_work.c` on the uv threadpool, so there the wasm neither
+ * imports nor exports those symbols and the only brackets a loader could watch
+ * (`_emnapi_ctx_*_waiting_request_counter`) are shared with threadsafe
+ * functions. The addon is the one place both flavors go through, so it answers
+ * for both, through the same kind of handshake the settlement drain uses:
+ *
+ *   - `napi_wasm_cancel_pending_async_work()` cancels what no thread has
+ *     started. Those completion callbacks run with `napi_cancelled`, which
+ *     napi-rs turns into a promise rejected with an `AbortError`.
+ *   - `napi_wasm_async_work_pending()` counts what is still owed a completion
+ *     callback. Work already executing refuses cancellation and stays counted
+ *     until it finishes normally — which it can, because this runs before the
+ *     barrier, before `Context.destroy()` and before anything is terminated.
+ *
+ * Both exports are optional: an addon built against a napi crate that predates
+ * them drains nothing and keeps the previous behavior, exactly as the
+ * `napi_wasm_env_cleanup_pending` handshake degrades.
+ *
+ * Returns nothing when there is nothing outstanding, which keeps disposal
+ * synchronous in the common case. The promise it returns otherwise never
+ * rejects.
+ *
+ * The wait has no deadline, and that is the point: giving up would destroy the
+ * environment with a completion callback still owed, which is the stranding
+ * this exists to prevent. A task whose `execute` never returns already keeps an
+ * *undisposed* process alive in exactly the same way, so disposal inherits that
+ * rather than inventing a bound it cannot honor.
+ *
+ * Safe to call from inside a completion callback, which is reachable: settling
+ * a task runs addon code that can re-enter JavaScript — a setter on the value
+ * being handed back, a threadsafe-function callback — and that JavaScript can
+ * call `dispose()`. Two things make it terminate rather than wait on itself:
+ *
+ *   - The addon keeps a work registered until its completion callback
+ *     *finishes*, so the count read here is at least one and this takes the
+ *     polling path instead of declaring the environment drained and tearing it
+ *     down from inside the frame that is still settling a promise.
+ *   - The poll is a timer, so it cannot run until the callback has returned to
+ *     the host — by which time that work has left the registry. The count the
+ *     next poll reads is the one taken after the callback finished.
+ *
+ * `__disposeWasiBinding` hands every caller the same in-flight promise, so the
+ * nested call joins this disposal rather than starting a second one.
+ */
+function __drainWasiAsyncWork() {
+  if (__wasiAsyncWorkDrainPromise !== undefined) {
+    return __wasiAsyncWorkDrainPromise
+  }
+  const exports = __napiInstance?.exports
+  const pending = exports?.napi_wasm_async_work_pending
+  const cancelPending = exports?.napi_wasm_cancel_pending_async_work
+  if (typeof pending !== 'function' || typeof cancelPending !== 'function') {
+    return
+  }
+
+  const readPending = () => {
+    try {
+      return pending()
+    } catch (error) {
+      // A trap is the only way this call fails: it reads a counter and cannot
+      // allocate or call back into JavaScript. A trapped instance can no longer
+      // run anything, so its outstanding work is unreachable by definition —
+      // there is nothing left to wait for, and refusing to dispose would only
+      // keep a dead instance and its stuck counter alive. Best-effort here is
+      // the honest answer, and it is what disposal did before this drain
+      // existed.
+      //
+      // Only a trap. Anything else means the export is not what this loader
+      // thinks it is, which is a defect worth surfacing rather than disposing
+      // over.
+      if (error instanceof globalThis.WebAssembly.RuntimeError) {
+        return 0
+      }
+      throw error
+    }
+  }
+
+  if (!readPending()) {
+    return
+  }
+  try {
+    cancelPending()
+  } catch {
+    // Cancellation is an optimization: it bounds the wait by the work already
+    // executing. Failing it only means waiting for the whole queue instead.
+  }
+  if (!readPending()) {
+    return
+  }
+
+  const drainPromise = __keepEventLoopAliveUntil(
+    (async () => {
+      while (readPending()) {
+        await new Promise((resolve) => {
+          __scheduleTimer(resolve, __WASI_ASYNC_WORK_POLL_INTERVAL_MS)
+        })
+      }
+    })(),
+  ).then(
+    () => {
+      __wasiAsyncWorkDrainPromise = undefined
+    },
+    (error) => {
+      // A wait that could not run is not a wait that finished. The only way
+      // here is a host whose timers and macrotask primitives all refuse, and
+      // the work is still outstanding — reporting success would destroy the
+      // environment over it, which is the stranding this exists to prevent.
+      // Reject instead: disposal stays retryable, and the context is not
+      // destroyed. Clearing the memo first is what makes the retry re-run this.
+      __wasiAsyncWorkDrainPromise = undefined
+      throw error
+    },
+  )
+  __wasiAsyncWorkDrainPromise = drainPromise
+  return drainPromise
+}
+
+/**
+ * `@emnapi/wasi-threads` counts a worker exit as expected only when its own
+ * thread manager performed the termination. A bare `worker.terminate()` reaches
+ * the manager's `exit` listener instead, which reports
+ * `worker (tid = N) sent an error! ... stopped with exit code 1` and rethrows
+ * inside the emit — aborting the `once('exit')` that backs the terminate
+ * promise, so disposal never settles and the process dies with an uncaught
+ * exception. Mark the termination through the manager first.
+ *
+ * The manager comes from `__getWasiThreadManager`, not from `__napiModule`:
+ * the initialization rollback runs on the one path where instantiation never
+ * returned, so `__napiModule` is still undefined there while the workers it
+ * spawned are already registered and loaded.
+ *
+ * Not `terminateAllThreads()`: that one recreates the pool it just shut down.
+ */
 function __terminateWasiWorkers() {
   const cleanupErrors = []
   const pending = []
+  const threadManager = __getWasiThreadManager()
 
   for (const worker of __wasiWorkers) {
     let result
     try {
+      if (threadManager) {
+        threadManager.terminateWorker(worker)
+        // `terminateWorker` leaves behind a reporter that logs every message
+        // still queued on the port, which Node flushes on exit. Nothing is
+        // listening for those any more.
+        worker.onmessage = undefined
+      }
       result = worker.terminate()
     } catch (error) {
       cleanupErrors.push(error)
@@ -461,7 +801,9 @@ function __terminateWasiWorkers() {
       )
     }
   }
-  return pending.length > 0 ? Promise.all(pending).then(finish) : finish()
+  return pending.length > 0
+    ? __keepEventLoopAliveUntil(Promise.all(pending)).then(finish)
+    : finish()
 }
 
 function __finishWasiDisposal() {
@@ -480,7 +822,7 @@ function __continueWasiDisposal() {
   return __finishWasiDisposal()
 }
 
-function __startWasiDisposal() {
+function __cleanUpWasmEnvForWasiDisposal() {
   // Run the pre-teardown barrier, then let the settlements it queued actually
   // reach JavaScript, and only then destroy the environment. Doing these two
   // back to back is what strands them.
@@ -492,6 +834,21 @@ function __startWasiDisposal() {
   return __continueWasiDisposal()
 }
 
+function __startWasiDisposal() {
+  // Outstanding `napi_async_work` goes first, while the environment is still
+  // completely live: the completion callbacks run addon code, and everything
+  // after this point takes that away from them — the barrier shuts the async
+  // runtime down, `Context.destroy()` stops JavaScript calls, and terminating
+  // the pool threads removes what would have reported the work finished.
+  const asyncWorkResult = __drainWasiAsyncWork()
+  if (__isThenable(asyncWorkResult)) {
+    return Promise.resolve(asyncWorkResult).then(
+      __cleanUpWasmEnvForWasiDisposal,
+    )
+  }
+  return __cleanUpWasmEnvForWasiDisposal()
+}
+
 /**
  * Disposes this generated WASI binding.
  *
@@ -633,29 +990,60 @@ function __retainFailedWasiRollback(cleanupErrors) {
  * bug with no upper bound, while the retained bookkeeping is bounded by the page.
  */
 function __rollbackWasiInitialization() {
-  const cleanupErrors = []
-  let drainResult
-  let settlementsUnreached = false
+  // The environment teardown this rollback performs, kept nested so it cannot
+  // be reached without the async-work drain below running first.
+  function __rollbackWasmEnvForWasiInitialization() {
+    const cleanupErrors = []
+    let drainResult
+    let settlementsUnreached = false
+    try {
+      __prepareWasmEnvCleanup()
+      drainResult = __drainWasmEnvCleanup()
+    } catch (cleanupError) {
+      cleanupErrors.push(cleanupError)
+      settlementsUnreached = true
+    }
+    if (__isThenable(drainResult)) {
+      return Promise.resolve(drainResult).then(
+        () => __destroyContextForWasiRollback(cleanupErrors),
+        (cleanupError) => {
+          cleanupErrors.push(cleanupError)
+          return __retainFailedWasiRollback(cleanupErrors)
+        },
+      )
+    }
+    if (settlementsUnreached) {
+      return __retainFailedWasiRollback(cleanupErrors)
+    }
+    return __destroyContextForWasiRollback(cleanupErrors)
+  }
+
+  // Same reason as `__startWasiDisposal`: a module-init hook can start async
+  // work before the load goes on to fail, and this rollback tears down exactly
+  // what those completions need. Settle them while everything is still live,
+  // before the barrier and the teardown above take that away.
+  //
+  // A drain that could not finish leaves async work possibly outstanding, and
+  // destroying the context over it would strand exactly what this rollback is
+  // there to settle. Stop short and retain instead — the same trade
+  // `__rollbackWasmEnvForWasiInitialization` makes for the settlement drain, so
+  // the context stays reclaimable by a retry or by this flavor's own
+  // last-resort teardown.
+  const __retainAfterAsyncWorkDrainFailure = (cleanupError) =>
+    __retainFailedWasiRollback([cleanupError])
+  let asyncWorkResult
   try {
-    __prepareWasmEnvCleanup()
-    drainResult = __drainWasmEnvCleanup()
+    asyncWorkResult = __drainWasiAsyncWork()
   } catch (cleanupError) {
-    cleanupErrors.push(cleanupError)
-    settlementsUnreached = true
+    return __retainAfterAsyncWorkDrainFailure(cleanupError)
   }
-  if (__isThenable(drainResult)) {
-    return Promise.resolve(drainResult).then(
-      () => __destroyContextForWasiRollback(cleanupErrors),
-      (cleanupError) => {
-        cleanupErrors.push(cleanupError)
-        return __retainFailedWasiRollback(cleanupErrors)
-      },
+  if (__isThenable(asyncWorkResult)) {
+    return Promise.resolve(asyncWorkResult).then(
+      __rollbackWasmEnvForWasiInitialization,
+      __retainAfterAsyncWorkDrainFailure,
     )
   }
-  if (settlementsUnreached) {
-    return __retainFailedWasiRollback(cleanupErrors)
-  }
-  return __destroyContextForWasiRollback(cleanupErrors)
+  return __rollbackWasmEnvForWasiInitialization()
 }
 
 const __wasiRollbackRegistrySymbol = Symbol.for('napi.rs.wasi.rollback.registry.v1')
@@ -831,7 +1219,11 @@ function __captureEmnapiAutoDestroyListener() {
 try {
   const __finishAutoDestroyCapture = __captureEmnapiAutoDestroyListener()
   try {
-    __emnapiContext = __emnapiCreateContext({ autoDestroy: false })
+    __emnapiContext = __wrapEmnapiContextDestroyForSettlement(
+      __emnapiCreateContext({ autoDestroy: false }),
+      __prepareWasmEnvCleanup,
+      __isPreparingWasmEnvCleanup,
+    )
     // emnapi 2.x still registers an unconditional once-listener for
     // beforeExit that auto-destroys the context, and suppressDestroy() only
     // neutralizes its callback without removing it. This loader owns cleanup
@@ -859,7 +1251,11 @@ try {
       }
     })(),
     reuseWorker: true,
-    plugins: [__emnapiAsyncWorkPlugin, __emnapiTSFNPlugin],
+    plugins: [
+      __captureWasiThreadManager,
+      __emnapiAsyncWorkPlugin,
+      __emnapiTSFNPlugin,
+    ],
     wasi: __wasi,
     onCreateWorker() {
       const worker = __createWasiWorker(__nodePath.join(__dirname, 'wasi-worker.mjs'))
@@ -889,6 +1285,10 @@ try {
         }
 
         worker.unref()
+        // These stubs stay in place for the worker's whole life, disposal
+        // included: `__keepEventLoopAliveUntil` is what holds the process open
+        // while a termination is pending, precisely because a worker's own
+        // references cannot be relied on for it.
       }
       return worker
     },
@@ -911,6 +1311,22 @@ try {
     },
   }))
   __publishWasiDispose(__napiModule.exports)
+  // The CommonJS tail below aliases `__napiModule.exports`; a named module
+  // export does not travel with it, so carry the marker on the binding itself
+  // too. Three things pin the stamp to exactly this spot:
+  //   - inside this `try`, because the guard throws on a
+  //     `#[napi(module_exports)]` hook that claimed the name, and only the
+  //     catch below tears the environment — context, workers, exit listener —
+  //     back down;
+  //   - after the async runtime host install, which hands this same object to
+  //     addon-provided registration functions that may put anything on it;
+  //   - assigning onto the loader's own `module.exports`, which is still the
+  //     original object here, so an addon accessor with a refusing setter is
+  //     never written through. `cjs-module-lexer` — Node's CJS -> ESM named
+  //     export detection — reads the static `module.exports.<name> =` either
+  //     way, and the later `module.exports = __napiModule.exports` does not
+  //     undo that.
+  module.exports.__napiBindingTarget = __napiStampBindingTarget(__napiModule.exports, __napiBindingTarget)
   __registerWasiExitListener()
 } catch (error) {
   const rollback = {

package/minify.wasi.d.cts

@@ -1,6 +1,9 @@
 /* auto-generated by NAPI-RS */
 /* eslint-disable */
 
+/** The WASI flavor this loader instantiates. */
+export declare const __napiBindingTarget: 'wasm32-wasi'
+
 export interface CodegenOptions {
   /**
    * Remove whitespace.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxc-minify/binding-wasm32-wasi",
-  "version": "0.150.0",
+  "version": "0.151.0",
   "main": "minify.wasi.cjs",
   "files": [
     "minify.wasm32-wasi.wasm",