feat: native engine port, cli native by default, web behind --web

.cargo/config.toml

@@ -1,3 +1,8 @@
 # `cargo wasm` build edge-python release WebAssembly artifact.
 [alias]
 wasm = "build --release --target wasm32-unknown-unknown -p edge-python"
+
+# `--profile native` speed-first build of the native port binaries.
+[profile.native]
+inherits = "release"
+opt-level = 3

.github/actions/cdn-deploy/action.yml

@@ -32,6 +32,13 @@ runs:
         path: /tmp/cli/
         merge-multiple: true
 
+    - name: Download native artifacts
+      uses: actions/download-artifact@v8
+      with:
+        pattern: native-*
+        path: /tmp/native/
+        merge-multiple: true
+
     - name: Install brotli
       shell: bash
       run: command -v brotli >/dev/null || (sudo apt-get update && sudo apt-get install -y brotli)
@@ -45,10 +52,10 @@ runs:
         brotli -q 11 -c /tmp/compiler/compiler.wasm > _site/compiler.wasm
         printf '/compiler.wasm\n  Content-Type: application/wasm\n  Content-Encoding: br\n  Cache-Control: public, max-age=0, must-revalidate\n' > _site/_headers
 
-        # js package: served under /runtime/ (public embed URLs); tests/ not shipped.
-        cp -r js/src _site/runtime/src
+        # runtime package: served under /runtime/ (public embed URLs); tests/ not shipped.
+        cp -r runtime/src _site/runtime/src
         # Compat alias: cached index.js builds resolve ../worker/worker.js.
-        cp -r js/src/worker _site/runtime/worker
+        cp -r runtime/src/worker _site/runtime/worker
 
         # std: <pkg>.wasm / <pkg>.py.
         cp -r /tmp/std/. _site/std/
@@ -68,6 +75,12 @@ runs:
         cp -r /tmp/cli/. _site/cli/
         cp cli/setup/install.sh cli/setup/uninstall.sh _site/cli/
 
+        # native assets, the std plugin .so files, under /native/<contract>/ matching the resolver's URL.
+        contract="$(sed -n 's/^pub const RUNTIME_CONTRACT: &str = "\(.*\)";$/\1/p' src/devkit.rs)"
+        test -n "$contract"
+        mkdir -p "_site/native/$contract"
+        cp -r /tmp/native/. "_site/native/$contract/"
+
     - name: Report served size
       shell: bash
       run: |

.github/actions/cli/action.yml

@@ -44,6 +44,12 @@ runs:
       shell: bash
       run: sudo apt-get update && sudo apt-get install -y musl-tools
 
+    # Gnu releases link through zig against a glibc 2.28 floor so dlopen'd std plugins work everywhere.
+    - name: Install cargo-zigbuild
+      if: inputs.mode == 'release' && contains(inputs.target, 'linux-gnu')
+      shell: bash
+      run: command -v cargo-zigbuild >/dev/null || pip3 install --user cargo-zigbuild
+
     - name: Cache Rust (release)
       if: inputs.mode == 'release'
       uses: Swatinem/rust-cache@v2
@@ -55,7 +61,12 @@ runs:
       if: inputs.mode == 'release'
       shell: bash
       working-directory: cli
-      run: cargo build --release --target "${{ inputs.target }}"
+      run: |
+        export PATH="$HOME/.local/bin:$PATH"
+        case "${{ inputs.target }}" in
+          *linux-gnu) cargo zigbuild --release --target "${{ inputs.target }}.2.28" ;;
+          *) cargo build --release --target "${{ inputs.target }}" ;;
+        esac
 
     - name: Tar
       if: inputs.mode == 'release'
@@ -89,6 +100,22 @@ runs:
         name: compiler_wasm
         path: target/wasm32-unknown-unknown/release/
 
+    # Same idea for the native engine: this run's std plugins and test.py, never the CDN.
+    - name: Download native std plugins
+      if: inputs.mode == 'test'
+      uses: actions/download-artifact@v8
+      with:
+        pattern: native-*-x86_64-unknown-linux-gnu
+        path: std_local/native/
+        merge-multiple: true
+
+    - name: Download std test.py
+      if: inputs.mode == 'test'
+      uses: actions/download-artifact@v8
+      with:
+        name: dist-test
+        path: std_local/std/
+
     # Drives a real Chromium; ubuntu-latest ships google-chrome-stable.
     - name: Test
       if: inputs.mode == 'test'
@@ -97,4 +124,5 @@ runs:
       env:
         EDGE_RUNTIME_DIR: ${{ github.workspace }}/js
         EDGE_COMPILER_WASM: ${{ github.workspace }}/target/wasm32-unknown-unknown/release/compiler.wasm
+        EDGE_STD_DIR: ${{ github.workspace }}/std_local
       run: cargo test

.github/actions/compiler/action.yml

@@ -39,6 +39,12 @@ runs:
       shell: bash
       run: cargo clippy --all-targets --no-default-features -- -D warnings
 
+    # The native engine module only compiles under this feature, e2e coverage lives in cli/tests.
+    - name: Clippy (native engine)
+      if: inputs.mode == 'check'
+      shell: bash
+      run: cargo clippy --lib --no-default-features --features native -- -D warnings
+
     - name: Install wasm target (check)
       if: inputs.mode == 'check'
       shell: bash

.github/actions/js/action.yml

@@ -23,7 +23,7 @@ runs:
     - name: Lint
       if: inputs.mode == 'lint'
       shell: bash
-      run: deno lint js/
+      run: deno lint runtime/
 
     # Test against this run's compiler, not the deployed CDN copy.
     - name: Download compiler wasm
@@ -50,4 +50,4 @@ runs:
     - name: Test
       if: inputs.mode == 'test'
       shell: bash
-      run: deno test --allow-all js/tests/js.test.js
+      run: deno test --allow-all runtime/tests/runtime.test.js

.github/actions/native/action.yml

@@ -0,0 +1,98 @@
+name: Native std packages
+description: std packages as native plugin cdylibs, linux with a glibc 2.28 floor plus darwin dylibs. CDN staging + tag Release upload.
+
+inputs:
+  package:
+    description: "json | re | math | struct"
+    required: true
+  target:
+    description: Rust linux-gnu or apple-darwin target triple.
+    required: true
+  github-token:
+    description: Token for the tag Release upload (tags only).
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    # Nightly rotates daily, its manifest hash keys an exact-version toolchain cache.
+    - name: Toolchain cache key
+      id: toolchain
+      shell: bash
+      run: echo "nightly=$(curl -fsSL https://static.rust-lang.org/dist/channel-rust-nightly.toml.sha256 | cut -c1-16)" >> "$GITHUB_OUTPUT"
+
+    # Restoring update-hashes lets rustup see the toolchain as current and skip reinstalling.
+    - name: Cache toolchain
+      uses: actions/cache@v5
+      with:
+        path: |
+          ~/.rustup/toolchains
+          ~/.rustup/update-hashes
+        key: rustup-std-${{ inputs.target }}-${{ steps.toolchain.outputs.nightly }}
+
+    # build-std needs nightly plus rust-src.
+    - name: Toolchain (nightly)
+      uses: dtolnay/rust-toolchain@nightly
+      with:
+        targets: ${{ inputs.target }}
+        components: rust-src
+
+    # The pip wheel bundles zig, which links against a chosen glibc floor.
+    - name: Install cargo-zigbuild
+      if: contains(inputs.target, 'linux')
+      shell: bash
+      run: command -v cargo-zigbuild >/dev/null || pip3 install --user cargo-zigbuild
+
+    - name: Cache Rust
+      uses: Swatinem/rust-cache@v2
+      with:
+        workspaces: std/${{ inputs.package }} -> std/${{ inputs.package }}/target
+        key: native-${{ inputs.target }}
+
+    # Glibc 2.28 covers every mainstream distro of the last decade; Mach-O leaves edge_* to dlopen via dynamic_lookup.
+    - name: Build
+      shell: bash
+      working-directory: std/${{ inputs.package }}
+      env:
+        TARGET: ${{ inputs.target }}
+        SIZE_FLAGS: -Z location-detail=none -Z fmt-debug=none -Z unstable-options -C panic=immediate-abort
+      run: |
+        export PATH="$HOME/.local/bin:$PATH"
+        case "$TARGET" in
+          *linux-gnu)
+            RUSTFLAGS="$SIZE_FLAGS" cargo +nightly zigbuild --profile native --target "${TARGET}.2.28" -Z build-std=std,panic_abort ;;
+          *apple-darwin)
+            RUSTFLAGS="$SIZE_FLAGS -C link-arg=-undefined -C link-arg=dynamic_lookup" \
+            cargo +nightly build --profile native --target "$TARGET" -Z build-std=std,panic_abort ;;
+        esac
+
+    # Assets carry the short arch, the lib glob absorbs keyword-crate names like libedge_struct.
+    - name: Package
+      shell: bash
+      env:
+        TARGET: ${{ inputs.target }}
+      run: |
+        ARCH="${TARGET%%-*}"
+        case "$TARGET" in
+          *apple-darwin) EXT="dylib" ;;
+          *) EXT="so" ;;
+        esac
+        mkdir -p _native
+        cp "std/${{ inputs.package }}/target/${TARGET}/native/"lib*."$EXT" "_native/${{ inputs.package }}-${ARCH}.${EXT}"
+
+    # The `native-` prefix is the glob cdn-deploy stages under /native/.
+    - name: Upload artifact
+      uses: actions/upload-artifact@v6
+      with:
+        name: native-${{ inputs.package }}-${{ inputs.target }}
+        path: _native/
+        retention-days: 1
+
+    - name: Upload Release assets
+      if: startsWith(github.ref, 'refs/tags/')
+      uses: softprops/action-gh-release@v3
+      with:
+        token: ${{ inputs.github-token }}
+        files: _native/*
+        fail_on_unmatched_files: true

.github/actions/std/action.yml

@@ -136,7 +136,7 @@ runs:
       working-directory: std
       env:
         STDPKG: ${{ inputs.package }}
-      run: deno test --allow-all tests/
+      run: deno test --allow-all harness/
 
     # Stage native -> <pkg>.wasm, pure-Python -> <pkg>.py.
     - name: Stage artifact

.github/workflows/main.yml

@@ -86,6 +86,35 @@ jobs:
         with:
           package: ${{ matrix.package }}
 
+  # std packages as native plugin cdylibs for the CLI's in-process engine. Assets ship to the CDN and tag Releases.
+  native:
+    name: Native / ${{ matrix.package }} (${{ matrix.target }})
+    needs: [compiler-check]
+    permissions:
+      contents: write
+    strategy:
+      fail-fast: false
+      matrix:
+        package: [json, re, math, struct]
+        target: [aarch64-unknown-linux-gnu, x86_64-unknown-linux-gnu, aarch64-apple-darwin, x86_64-apple-darwin]
+        include:
+          - target: aarch64-unknown-linux-gnu
+            runner: ubuntu-24.04-arm
+          - target: x86_64-unknown-linux-gnu
+            runner: ubuntu-latest
+          - target: aarch64-apple-darwin
+            runner: macos-15
+          - target: x86_64-apple-darwin
+            runner: macos-15
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/native
+        with:
+          package: ${{ matrix.package }}
+          target: ${{ matrix.target }}
+          github-token: ${{ github.token }}
+
   # Clippy + check once (no matrix); gates the release build.
   cli-lint:
     name: CLI / Lint and Check
@@ -104,6 +133,10 @@ jobs:
       fail-fast: false
       matrix:
         include:
+          - target: x86_64-unknown-linux-gnu
+            runner: ubuntu-latest
+          - target: aarch64-unknown-linux-gnu
+            runner: ubuntu-24.04-arm
           - target: x86_64-unknown-linux-musl
             runner: ubuntu-latest
           - target: aarch64-unknown-linux-musl
@@ -122,7 +155,7 @@ jobs:
 
   cli-test:
     name: CLI / Test
-    needs: [host, std, cli-release]
+    needs: [host, std, native, cli-release]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
@@ -132,7 +165,7 @@ jobs:
 
   cdn:
     name: Cloudflare Upload (CDN)
-    needs: [cli-test]
+    needs: [cli-test, native]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     steps: