crossbind 2.0.0-beta.60 → 2.0.0-beta.62

package/README.md

@@ -68,8 +68,9 @@ target-specific artifacts, transitive dependencies, build recipes, and runtime
 adapters.
 
 - **Target-aware distribution.** A package family can carry WebAssembly, iOS,
-  Android, and WASI variants; each build consumes only the artifact valid for
-  its platform, architecture, runtime, environment, and build type.
+  Android, macOS, Linux, Windows, and WASI variants; each build consumes only the
+  artifact valid for its platform, architecture, runtime, environment, and build
+  type.
 - **Native dependency resolution.** Package manifests and crossbind configs
   carry the transitive native graph, so prerequisites are built and linked in
   the correct order.
@@ -253,9 +254,10 @@ The repository contains 16 port families:
 OpenSSL · PROJ · SpatiaLite · SQLite · libTIFF · WebP · zlib · Zstandard**
 
 Each family has target-specific packages. For example, a browser or Node.js
-project uses `@crossbind/port-gdal-wasm`, while mobile and WASI builds use the
-matching `-android`, `-ios`, or `-wasi` variant. Import the variant's
-`crossbind.config.js` into the application's dependency list:
+project uses `@crossbind/port-gdal-wasm`, while mobile, native Node.js addon and
+WASI builds use the matching `-android`, `-ios`, `-darwin`, `-linux`, `-win32`,
+or `-wasi` variant. Import the variant's `crossbind.config.js` into the
+application's dependency list:
 
 ```bash
 npm install @crossbind/port-gdal-wasm@beta

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "crossbind",
-    "version": "2.0.0-beta.60",
+    "version": "2.0.0-beta.62",
     "license": "MIT",
     "homepage": "https://crossbind.dev",
     "repository": "https://github.com/crossbind/crossbind.git",

package/src/actions/buildDependencies.js

@@ -14,6 +14,11 @@ import {
 } from '../utils/dependencyRebuild.js';
 import withDirLock from '../utils/dirLock.js';
 import { prepareRustSysroot } from '../utils/rustSysroot.js';
+import getAbsolutePath from '../utils/getAbsolutePath.js';
+import getCMakeListsFilePath from '../utils/getCMakeListsFilePath.js';
+import getParentPath from '../utils/getParentPath.js';
+import calculateDependencyParameters from '../state/calculateDependencyParameters.js';
+import { getEmbindRsFingerprint, isEmbindRsFingerprintStale } from '../utils/embindRsFingerprint.js';
 
 export default async function buildDependencies({ targetParams, rebuildOption }) {
     // Before the early returns below: this is the one async step every build path awaits, and the
@@ -64,17 +69,23 @@ export default async function buildDependencies({ targetParams, rebuildOption })
 async function buildMissingCargoDependencies(targets, targetParams) {
     if (targets.length === 0) return;
     const appConfig = state.config;
-    const missing = (appConfig.allDependencies ?? []).filter((dep) => dep !== appConfig
-        && dep.export?.type === 'cargo'
-        && targets.some((target) => !dep.functions.isEnabled(target)));
+    const cargoDependencies = (appConfig.allDependencies ?? []).filter((dep) => dep !== appConfig && dep.export?.type === 'cargo');
+    if (cargoDependencies.length === 0) return;
+    // A prebuilt from another embind-rs counts as missing: linked, it carries stale glue or clashes with the others.
+    const fingerprint = getEmbindRsFingerprint();
+    const prebuiltOf = (dep, target) => [target.path, target.releasePath]
+        .map((targetPath) => `${dep.paths.output}/prebuilt/${targetPath}`)
+        .find((dir) => fs.existsSync(dir)) ?? `${dep.paths.output}/prebuilt/${target.path}`;
+    const isBuilt = (dep, target) => dep.functions.isEnabled(target) && !isEmbindRsFingerprintStale(prebuiltOf(dep, target), fingerprint);
+    const missing = cargoDependencies.filter((dep) => targets.some((target) => !isBuilt(dep, target)));
 
     for (const dep of missing) {
         const name = dep.general.name;
         // isEnabled reads the filesystem on every call, so a build that lands while this one waits
         // for the lock is picked up without any state to refresh.
         await withDirLock(`${dep.paths.output}.autobuild.lock`, async () => {
-            if (targets.every((target) => dep.functions.isEnabled(target))) return;
-            logger.info(`crossbind: building cargo dependency "${name}" - it has no prebuilt for this target yet…`);
+            if (targets.every((target) => isBuilt(dep, target))) return;
+            logger.info(`crossbind: building cargo dependency "${name}" - it has no prebuilt from this embind-rs for this target yet…`);
             const scoped = await loadConfig(dep.paths.project);
             const prev = state.config;
             state.config = scoped;
@@ -84,17 +95,21 @@ async function buildMissingCargoDependencies(targets, targetParams) {
                 state.config = prev;
             }
         });
+        // loadConfig resolved a never-built package's CMakeLists to the CLI's own, and isEnabled and the link read it.
+        dep.paths.cmake = getAbsolutePath(dep.paths.project, getCMakeListsFilePath(dep.paths.output));
+        dep.paths.cmakeDir = getParentPath(dep.paths.cmake);
     }
+    if (missing.length > 0) appConfig.dependencyParameters = calculateDependencyParameters(appConfig);
 
     // The build above is the fix; this is the guard behind it. assertDependsBuilt only runs while
     // the cmake link is being configured, so a cached native build skips the check and a missing
     // cargo dependency reaches the app anyway - measured on wasm as a clean BUILD=0 whose module
     // then failed 22 of 43 conformance features at init. Here the answer is known either way.
-    const unresolved = missing.filter((dep) => targets.some((target) => !dep.functions.isEnabled(target)));
+    const unresolved = missing.filter((dep) => targets.some((target) => !isBuilt(dep, target)));
     if (unresolved.length > 0) {
         const names = unresolved.map((dep) => `"${dep.general.name}"`).join(', ');
         throw new Error(`crossbind: cargo ${unresolved.length > 1 ? 'dependencies' : 'dependency'} ${names} still `
-            + `${unresolved.length > 1 ? 'have' : 'has'} no prebuilt for ${targets.map((t) => t.path).join(', ')} `
+            + `${unresolved.length > 1 ? 'have' : 'has'} no prebuilt built from the current embind-rs for ${targets.map((t) => t.path).join(', ')} `
             + 'after building. Linking without it produces a module that builds clean and dies at init.');
     }
 }

package/src/actions/buildJs.js

@@ -13,7 +13,7 @@ const SUPPRESSED_WARN_CODES = new Set([
     'MIXED_EXPORTS',
 ]);
 
-function suppressNodeBuiltinWarnings(warning, defaultHandler) {
+export function suppressNodeBuiltinWarnings(warning, defaultHandler) {
     if (SUPPRESSED_WARN_CODES.has(warning.code)) return;
     if (warning.code === 'UNRESOLVED_IMPORT' && /^node:/.test(warning.exporter || warning.source || warning.id || '')) return;
     defaultHandler(warning);

package/src/actions/buildLib.js

@@ -7,6 +7,7 @@ import state from '../state/index.js';
 import logger from '../utils/logger.js';
 import findFiles from '../utils/findFiles.js';
 import { getSourceFingerprint, isSourceFingerprintStale, staleTargetDirectories, writeSourceFingerprint } from '../utils/sourceFingerprint.js';
+import { getEmbindRsFingerprint, writeEmbindRsFingerprint } from '../utils/embindRsFingerprint.js';
 
 export default function buildLib(targetParams, options = {}) {
     let isChanged = false;
@@ -48,6 +49,7 @@ export default function buildLib(targetParams, options = {}) {
                 fs.copyFileSync(modulePath, `${state.config.paths.output}/prebuilt/${target.path}/swig/${fileName}`);
             });
             writeSourceFingerprint(libdir, sourceFingerprint);
+            if (isCargo) writeEmbindRsFingerprint(libdir, getEmbindRsFingerprint());
             isChanged = true;
         } else {
             // The skip is existence-only; without this warning a source edit is served stale silently.

package/src/actions/buildNode.js

@@ -0,0 +1,149 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import { fileURLToPath } from 'node:url';
+import { rollup } from 'rollup';
+import { nodeResolve } from '@rollup/plugin-node-resolve';
+import commonjs from '@rollup/plugin-commonjs';
+import virtual from '@rollup/plugin-virtual';
+import run from './run.js';
+import getLinkInputs from './getLinkInputs.js';
+import getData from './getData.js';
+import { suppressNodeBuiltinWarnings } from './buildJs.js';
+import state from '../state/index.js';
+import logger from '../utils/logger.js';
+import { getContentHash, getFilesFingerprint } from '../utils/hash.js';
+import { buildLinkLibArgs } from '../utils/linkLayout.js';
+import resolveEmbindNapiRoot, { resolveEmbindJsiRoot } from '../utils/resolveEmbindNapi.js';
+import resolveEmbindRustRoot from '../utils/resolveEmbindRust.js';
+
+const cpuCount = Math.max(1, os.cpus().length - 1);
+
+function filesUnder(dirs) {
+    return dirs.flatMap((dir) => (fs.existsSync(dir)
+        ? fs.readdirSync(dir, { recursive: true })
+            .map((file) => `${dir}/${file}`)
+            .filter((file) => fs.statSync(file).isFile())
+        : []));
+}
+
+function linkInputs(target) {
+    const {
+        libs, wholeArchiveAll, wholeArchiveNames, rustKeepFlags, hasRust,
+    } = getLinkInputs(target, {
+        // The linker loads the archive member that defines a -u symbol; Mach-O prefixes C names with _.
+        keepFlag: (name) => `-Wl,-u,${target.platform === 'darwin' ? '_' : ''}crossbind_keep_${name}`,
+    });
+    const linkArgs = [
+        ...buildLinkLibArgs(libs, { wholeArchiveAll, wholeArchiveNames, forceLoad: target.platform === 'darwin' }),
+        ...rustKeepFlags,
+        // The system libraries the archives need, declared by the packages that bring them in.
+        ...(getData('binary', target)?.addonFlags ?? []),
+    ];
+    // The addon runs embind-jsi, so Rust packages bind through the adapter React Native links.
+    const extraSources = hasRust ? [`${resolveEmbindRustRoot()}/adapters/jsi.cpp`] : [];
+    return { libs, linkArgs, extraSources };
+}
+
+function envOf(target) {
+    return Object.fromEntries(Object.entries(getData('env', target))
+        .map(([key, value]) => [key, typeof value === 'function' ? value(state, target) : value]));
+}
+
+// One loader serves every addon of a build type, so each addon's env is keyed the way the loader
+// looks it up at runtime rather than taken from whichever arch happened to build last.
+export function nodeLoaderConfig(target) {
+    const served = state.targets.filter((t) => t.addonPattern && t.jsName === target.jsName);
+    return {
+        env: Object.fromEntries(served.map((t) => [`${t.platform}-${t.arch}`, envOf(t)])),
+        general: { name: state.config.general.name },
+        paths: { addon: target.addonPattern },
+    };
+}
+
+// The loader hands the addon dist/data by default, as the wasm build does. A relinked addon may come
+// from updated dependencies, so its data is copied again rather than kept.
+export function publishNodeData(target, { refresh }) {
+    Object.entries(getData('data', target)).forEach(([source, name]) => {
+        const published = `${state.config.paths.output}/data/${name}`;
+        if (!fs.existsSync(source) || (!refresh && fs.existsSync(published))) {
+            return;
+        }
+        fs.rmSync(published, { recursive: true, force: true });
+        fs.cpSync(source, published, { recursive: true });
+    });
+}
+
+async function bundleLoader(target, napiRoot, loaderConfig) {
+    const systemConfig = `export default ${JSON.stringify(loaderConfig)};`;
+    const bundle = await rollup({
+        input: `${napiRoot}/js/loader.js`,
+        plugins: [virtual({ 'crossbind/systemConfig': systemConfig }), nodeResolve(), commonjs()],
+        onwarn: suppressNodeBuiltinWarnings,
+    });
+    await bundle.write({ file: `${state.config.paths.build}/${target.jsName}`, format: 'cjs', exports: 'default' });
+    await bundle.close();
+}
+
+// Links one Node-API addon from the project's archives and bundles the loader that picks the
+// addon matching the running process.
+export default async function buildNode(target, options = {}) {
+    if (target.platform === 'darwin' && process.platform !== 'darwin') {
+        logger.info(`[${target.path}] addon skipped (macOS addons build on a macOS host)`);
+        return false;
+    }
+    if (state.config.export.type === 'cargo') {
+        logger.info(`[${target.path}] addon skipped (cargo package - staticlib only)`);
+        return false;
+    }
+
+    const buildType = target.buildType === 'release' ? 'Release' : 'Debug';
+    const { build } = state.config.paths;
+    const napiRoot = resolveEmbindNapiRoot();
+    const jsiRoot = resolveEmbindJsiRoot();
+    const { libs, linkArgs, extraSources } = linkInputs(target);
+    const loaderConfig = nodeLoaderConfig(target);
+
+    const fingerprintFile = `${build}/${target.addonName}.fingerprint`;
+    const fingerprint = getContentHash(JSON.stringify({
+        builder: getFilesFingerprint([fileURLToPath(import.meta.url)]),
+        linkArgs,
+        libs: libs.map((lib) => {
+            const stat = fs.existsSync(lib) ? fs.statSync(lib) : null;
+            return { lib, size: stat ? stat.size : null, mtimeMs: stat ? stat.mtimeMs : null };
+        }),
+        loaderConfig,
+        runtime: getFilesFingerprint(filesUnder([
+            `${napiRoot}/cpp`, `${napiRoot}/js`, `${napiRoot}/third_party`, `${jsiRoot}/cpp/src`, `${jsiRoot}/js`,
+        ])),
+        extraSources: getFilesFingerprint(extraSources),
+    }));
+    const isLinkChanged = !fs.existsSync(fingerprintFile)
+        || fs.readFileSync(fingerprintFile, { encoding: 'utf8' }) !== fingerprint;
+    if (!options.force && !isLinkChanged
+        && fs.existsSync(`${build}/${target.addonName}`) && fs.existsSync(`${build}/${target.jsName}`)) {
+        logger.cachedStep(target, 'addon');
+        return false;
+    }
+
+    const platformPrefix = `Node-${buildType}`;
+    logger.startStep(target, 'addon');
+    run(null, [
+        'cmake', `${napiRoot}/cpp`,
+        `-DCMAKE_BUILD_TYPE=${buildType}`,
+        `-DCROSSBIND_ADDON_FILE=${target.addonName}`,
+        `-DCROSSBIND_JSI_ROOT=${jsiRoot}`,
+        `-DCROSSBIND_EXTRA_SOURCES=${extraSources.join(';')}`,
+        `-DCROSSBIND_LINK_ARGS=${linkArgs.join(';')}`,
+        `-DCROSSBIND_LINK_DEPENDS=${libs.join(';')}`,
+    ], platformPrefix, target);
+    run(null, ['cmake', '--build', '.', '-j', String(cpuCount)], platformPrefix, target);
+    fs.copyFileSync(`${build}/${platformPrefix}/${target.path}/${target.addonName}`, `${build}/${target.addonName}`);
+    logger.doneStep(target, 'addon');
+
+    logger.startStep(target, 'js');
+    await bundleLoader(target, napiRoot, loaderConfig);
+    logger.doneStep(target, 'js');
+
+    fs.writeFileSync(fingerprintFile, fingerprint);
+    return true;
+}

package/src/actions/buildWasm.js

@@ -2,7 +2,7 @@ import fs from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import replace from 'replace';
 import run from './run.js';
-import getDependLibs from './getDependLibs.js';
+import getLinkInputs from './getLinkInputs.js';
 import getData from './getData.js';
 import buildJs from './buildJs.js';
 import triggerExtensions from './extensions.js';
@@ -11,29 +11,33 @@ import resolveEmbindRustRoot from '../utils/resolveEmbindRust.js';
 import logger from '../utils/logger.js';
 import { getContentHash, getFilesFingerprint } from '../utils/hash.js';
 import { buildLinkLibArgs } from '../utils/linkLayout.js';
-import buildAppRustCrates from '../utils/appRustCrates.js';
+import { guardBigIntArguments, guardEmbindArguments } from '../utils/embindArgumentGuards.js';
 
 // embind's bigint converter turns any Number into a BigInt, so 2^53+1 silently becomes 2^53.
 // A 64-bit parameter takes a BigInt or a Number that is a safe integer instead; the jsi adapter
 // enforces the same rule natively. Each runtimeEnv links its own glue, so each one calls this.
-function guardBigIntArguments(target) {
+function guardBigIntConversions(target) {
     const gluePath = `${state.config.paths.build}/${target.rawJsName}`;
-    replace({
-        regex: 'if\\s*\\(\\s*typeof value\\s*==\\s*"number"\\s*\\)\\s*\\{\\s*value\\s*=\\s*BigInt\\(value\\)\\s*;?\\s*\\}',
-        replacement: 'if(typeof value=="number"){if(!Number.isSafeInteger(value))throw new TypeError("a 64-bit integer parameter takes a BigInt or a safe integer Number, got "+value);value=BigInt(value)}',
-        paths: [gluePath],
-        recursive: false,
-        silent: true,
-    });
-    const glue = fs.readFileSync(gluePath, 'utf8');
-    if (glue.includes('__embind_register_bigint') && !glue.includes('Number.isSafeInteger(value)')) {
+    const { text, missed } = guardBigIntArguments(fs.readFileSync(gluePath, 'utf8'));
+    fs.writeFileSync(gluePath, text);
+    if (missed) {
         logger.error('bigint safe-integer rewrite missed (emscripten glue format changed?): 64-bit Number arguments round silently');
     }
 }
 
+// Wrong-typed integer and enum arguments cross as 0 in a release build (utils/embindArgumentGuards.js);
+// each runtimeEnv links its own glue, so each one calls this after its link.
+function guardArgumentConversions(target) {
+    const gluePath = `${state.config.paths.build}/${target.rawJsName}`;
+    const { text, missed } = guardEmbindArguments(fs.readFileSync(gluePath, 'utf8'));
+    fs.writeFileSync(gluePath, text);
+    if (missed.length) {
+        logger.error(`embind argument rewrite missed ${missed.join(', ')} (emscripten glue format changed?): wrong-typed arguments cross as 0`);
+    }
+}
+
 export default async function buildWasm(target, options = {}) {
     const isProd = target.buildType === 'release';
-    const buildType = isProd ? 'Release' : 'Debug';
 
     // Caller can opt out of the final emcc link entirely (e.g. when the
     // package is consumed only as a static library by downstream builds).
@@ -47,51 +51,12 @@ export default async function buildWasm(target, options = {}) {
         return false;
     }
 
-    // buildLib's cache is keyed on paths.output/prebuilt; after a cache clean the
-    // build-dir copy can be gone while the output artifact is still valid — link it then.
-    const sourceLibCandidates = [
-        `${state.config.paths.build}/Source-${buildType}/${target.path}/lib${state.config.general.name}.a`,
-        `${state.config.paths.output}/prebuilt/${target.path}/lib/lib${state.config.general.name}.a`,
-    ];
-    // App-local Rust surfaces (imported .rs files) arrive as ONE super staticlib; it is the
-    // single fully-loaded Rust archive of the link (see the libstd rule below).
-    const appRustLibs = buildAppRustCrates(target, state.config.paths.cache, state.config.cargoDependencies ?? {});
-    const libs = [
-        ...getDependLibs(target),
-        ...appRustLibs,
-        sourceLibCandidates.find((lib) => fs.existsSync(lib)) ?? sourceLibCandidates[0],
-        `${state.config.paths.build}/Bridge-${buildType}/${target.path}/lib${state.config.general.name}.a`,
-    ];
-
-    // By default only the Bridge archive is --whole-archive'd (see
-    // linkLayout.js) so wasm-ld dead-code-eliminates everything unreferenced.
-    // Two escape hatches, both `export.wholeArchive: true`: on the APP it
-    // restores the legacy layout (every archive wholesale); on a LIBRARY's
-    // own config it keeps that library's archives whole in every consumer
-    // link (for members that self-register from static initializers).
-    const wholeArchiveAll = state.config.export.wholeArchive === true;
-    const wholeArchiveNames = new Set();
-    // Rust libstd rule: every Rust staticlib bundles its own libstd, so at most ONE Rust archive
-    // may be fully loaded (the app super staticlib). Generated cargo bridges are linked lazily
-    // with their keep symbol pinned (-u pulls just the registration object); manual-bindings
-    // crates have no keep symbol and fall back to whole-archive - safe only while they are the
-    // single loaded Rust archive.
-    const rustKeepFlags = [];
-    if (appRustLibs.length > 0) wholeArchiveNames.add('crossbind_app_super');
-    state.config.dependencyParameters.getCmakeDepends(target).forEach((dep) => {
-        if (dep.export.wholeArchive === true) {
-            (dep.export.libName || []).forEach((name) => wholeArchiveNames.add(name));
-        }
-        if (dep.export.type === 'cargo') {
-            const crateLibRs = `${dep.paths.project}/${dep.export.crate ?? 'crate'}/src/lib.rs`.replace('/./', '/');
-            const isManual = fs.existsSync(crateLibRs) && fs.readFileSync(crateLibRs, 'utf8').includes('bindings!');
-            (dep.export.libName || []).forEach((name) => {
-                // wasm-ld's -u does NOT pull archive members (it just leaves an import);
-                // --export forces the symbol to resolve, dragging the registration object in.
-                if (isManual) wholeArchiveNames.add(name);
-                else rustKeepFlags.push(`-Wl,--export=crossbind_keep_${name}`);
-            });
-        }
+    const {
+        libs, appRustLibs, wholeArchiveAll, wholeArchiveNames, rustKeepFlags, hasRust,
+    } = getLinkInputs(target, {
+        // wasm-ld's -u does NOT pull archive members (it just leaves an import);
+        // --export forces the symbol to resolve, dragging the registration object in.
+        keepFlag: (name) => `-Wl,--export=crossbind_keep_${name}`,
     });
     // The whole-archived app super-staticlib and a lazily-pulled package bridge object each
     // carry rustc's allocator/panic shims (codegen-units=1 places them in the same object as
@@ -104,13 +69,19 @@ export default async function buildWasm(target, options = {}) {
 
     // Any Rust archive in the link needs the web adapter TU: it provides the flat
     // crossbind_embind_* C-ABI (typeid getters + passthroughs to emscripten's embind).
-    const hasRust = rustKeepFlags.length > 0 || appRustLibs.length > 0
-        || state.config.dependencyParameters.getCmakeDepends(target).some((dep) => dep.export.type === 'cargo');
     // The adapter ships in @crossbind/core-embind-rust (declared by the consumer, resolved here).
     const rustSources = hasRust ? [`${resolveEmbindRustRoot()}/adapters/web.cpp`] : [];
 
     const binary = getData('binary', target);
     const emccFlags = [...(binary?.emccFlags || []), ...rustKeepFlags];
+    // Rust code expects a native-sized stack (rustc's own wasm targets reserve 1 MiB) where
+    // emscripten reserves 64 KiB, and a wasm stack has no guard page: an overflow overwrites static
+    // data without a trap. A size set in the config stays; a debug build also checks for overflow.
+    if (hasRust) {
+        const set = emccFlags.join(' ');
+        if (!/-s\s*(?:STACK_SIZE|TOTAL_STACK)=/.test(set)) emccFlags.push('-sSTACK_SIZE=1MB');
+        if (!isProd && !/-s\s*STACK_OVERFLOW_CHECK=/.test(set)) emccFlags.push('-sSTACK_OVERFLOW_CHECK=1');
+    }
 
     triggerExtensions('buildWasm', 'beforeBuild', [emccFlags]);
 
@@ -189,12 +160,13 @@ export default async function buildWasm(target, options = {}) {
         const data = Object.entries(getData('data', target)).map(([key, value]) => ['--preload-file', `${key.replaceAll('@', '@@')}@/crossbind/${value}`]).flat();
         run('em++', [
             '-lembind',
+            // The config's emccFlags follow the default level, so its -Oz or -Os wins (the last -O does).
+            ...(isProd ? ['-O3'] : []),
             ...emccFlags,
             // '-lwebsocket.js', '-sPROXY_POSIX_SOCKETS', '-sWEBSOCKET_DEBUG=1', '-sJSPI', '-g', '-sWASMFS',
             '-s', 'FORCE_FILESYSTEM=1',
             '-sEXPORT_NAME=Module2', // '-pthread', '-sPTHREAD_POOL_SIZE=5',
             ...linkLibs, ...rustSources, `${state.config.paths.cli}/assets/cpp-runtime/browser.cpp`,
-            ...(isProd ? ['-O3'] : []),
             '-s', 'WASM=1', '-s', 'MODULARIZE=1', '-s', 'DYNAMIC_EXECUTION=0',
             '-s', 'RESERVED_FUNCTION_POINTERS=200', // '-s', 'FORCE_FILESYSTEM=1',
             '-s', 'ALLOW_MEMORY_GROWTH=1',
@@ -244,7 +216,8 @@ export default async function buildWasm(target, options = {}) {
             recursive: false,
             silent: true,
         }); */
-        guardBigIntArguments(target);
+        guardBigIntConversions(target);
+        guardArgumentConversions(target);
         await buildJs(target);
         // fs.rmSync(`${state.config.paths.build}/${state.config.general.name}.js`);
         // fs.copyFileSync(`${state.config.paths.build}/${state.config.general.name}.browser.js`, `${state.config.paths.build}/${state.config.general.name}.js`);
@@ -261,12 +234,13 @@ export default async function buildWasm(target, options = {}) {
         const data = Object.entries(getData('data', target)).map(([key, value]) => ['--preload-file', `${key.replaceAll('@', '@@')}@/crossbind/${value}`]).flat();
         run('em++', [
             '-lembind',
+            // The config's emccFlags follow the default level, so its -Oz or -Os wins (the last -O does).
+            ...(isProd ? ['-O3'] : []),
             ...emccFlags,
             '-sEXPORT_NAME=Module2',
             // rustSources carries the embind-rust adapter TU (emval/json/tid hooks); without
             // it any linked Rust package archive fails with undefined crossbind_* symbols.
             ...linkLibs, ...rustSources,
-            ...(isProd ? ['-O3'] : []),
             '-s', 'WASM=1', '-s', 'MODULARIZE=1', '-s', 'DYNAMIC_EXECUTION=0',
             '-s', 'RESERVED_FUNCTION_POINTERS=200', // '-s', 'FORCE_FILESYSTEM=1',
             '-s', 'ALLOW_MEMORY_GROWTH=1',
@@ -282,7 +256,8 @@ export default async function buildWasm(target, options = {}) {
         const t1 = performance.now();
         logger.doneStep(target, 'wasm');
         logger.startStep(target, 'js');
-        guardBigIntArguments(target);
+        guardBigIntConversions(target);
+        guardArgumentConversions(target);
         await buildJs(target);
         logger.doneStep(target, 'js');
     }
@@ -294,11 +269,12 @@ export default async function buildWasm(target, options = {}) {
 
         run('em++', [
             '-lembind',
+            // The config's emccFlags follow the default level, so its -Oz or -Os wins (the last -O does).
+            ...(isProd ? ['-O3'] : []),
             ...emccFlags,
             // '-s', 'FETCH', '-sJSPI', '-pthread', '-sPTHREAD_POOL_SIZE=5',
             '-s', 'FORCE_FILESYSTEM=1',
             ...linkLibs, ...rustSources, `${state.config.paths.cli}/assets/cpp-runtime/node.cpp`,
-            ...(isProd ? ['-O3'] : []),
             '-s', 'WASM=1', '-s', 'MODULARIZE=1', '-s', 'DYNAMIC_EXECUTION=0',
             '-s', 'RESERVED_FUNCTION_POINTERS=200', // '-s', 'DISABLE_EXCEPTION_CATCHING=0', '-s', 'FORCE_FILESYSTEM=1',
             '-s', 'ALLOW_MEMORY_GROWTH=1',
@@ -314,7 +290,8 @@ export default async function buildWasm(target, options = {}) {
         ], null, target);
         logger.doneStep(target, 'wasm');
         logger.startStep(target, 'js');
-        guardBigIntArguments(target);
+        guardBigIntConversions(target);
+        guardArgumentConversions(target);
         await buildJs(target);
         if (emccFlags.includes('FETCH')) {
             fs.appendFileSync(`${state.config.paths.build}/${target.jsName}`, 'var XMLHttpRequest = require(\'xhr2\');\n');