Add RustPython generated WASM WS module

.dockerignore

@@ -8,6 +8,7 @@
 **/target/
 **/.DS_Store
 services/ws-wasm-agent/pkg/
+services/ws-modules/pywasm1/pkg/
 services/ws-server/static/models/
 **/.zig-cache/
 **/zig-out/

.editorconfig

@@ -19,7 +19,7 @@ indent_style = tab
 indent_size = unset
 
 # License files use the canonical upstream formatting (centred headers, odd
-# indent widths, etc.) — leave them alone.
+# indent widths, etc.) -- leave them alone.
 [LICENSE-*]
 indent_size = unset
 indent_style = unset
@@ -43,7 +43,7 @@ indent_style = unset
 max_line_length = unset
 trim_trailing_whitespace = unset
 
-# Upstream WIT packages fetched verbatim — their formatting is whatever the
+# Upstream WIT packages fetched verbatim -- their formatting is whatever the
 # upstream repos use and shouldn't be normalised on our side.
 [generated/specs/wit/deps/wasi-*/**]
 charset = unset
@@ -55,22 +55,18 @@ trim_trailing_whitespace = unset
 max_line_length = unset
 
 # openapi-python-client emits framework-boilerplate docstrings (e.g. the
-# "errors.UnexpectedStatus: If the server returns an undocumented status code
-# …" line in every operation) that exceed 120 chars, and continuation lines
-# inside the generated function signatures use 3-space indentation that
-# clashes with the workspace `indent_size = 2`. ruff format doesn't reflow
-# plain-text docstrings or re-indent the templates, so we drop both checks
-# for this tree.
+# "errors.UnexpectedStatus: If the server returns an undocumented status code ..." line in every operation) that exceed
+# 120 chars, and continuation lines inside the generated function signatures use 3-space indentation that
+# clashes with the workspace `indent_size = 2`. ruff format doesn't reflow plain-text docstrings or
+# re-indent the templates, so we drop both checks for this tree.
 [generated/python-rest/**]
 indent_size = unset
 max_line_length = unset
 
-# datamodel-code-generator renders each Pydantic field's `description=`
-# from the schemars `description` (i.e. the source enum's `///` doc
-# comment) as a single string literal — `\n`-joined, no implicit
-# concatenation. ruff format won't break string literals, so any
-# multi-paragraph Rust doc comment on `ClientMessage` / `ServerMessage`
-# blows past 120 chars in the generated Python.
+# datamodel-code-generator renders each Pydantic field's `description=` from the schemars `description`
+# (i.e. the source enum's `///` doc comment) as a single string literal -- `\n`-joined, no implicit
+# concatenation. ruff format won't break string literals, so any multi-paragraph Rust doc comment on
+# `ClientMessage` / `ServerMessage` blows past 120 chars in the generated Python.
 [generated/python-ws/**]
 max_line_length = unset
 
@@ -79,3 +75,6 @@ max_line_length = unset
 # The generator is the source of truth; we don't edit its output by hand.
 [generated/zig-rest/**]
 max_line_length = unset
+
+[config/upstream-cache/data.toml]
+max_line_length = 200

.gitattributes

@@ -3,10 +3,10 @@
 # Windows runners default to `core.autocrlf=true`, which rewrites LF to
 # CRLF at checkout. Multiple formatters in this repo (zig fmt, dprint)
 # read CRLF as a diff against their LF-normalized output and report
-# every file as "would be reformatted" — with no diff, just paths.
+# every file as "would be reformatted" -- with no diff, just paths.
 # Pinning `eol=lf` workspace-wide makes the checked-out tree match the
 # committed bytes on every OS, so the formatters behave identically.
 * text=auto eol=lf
 
-# Binaries tracked in this repo — never run text conversion on these.
+# Binaries tracked in this repo -- never run text conversion on these.
 *.png binary

.github/actions/free-disk-space-windows/action.yaml

@@ -0,0 +1,124 @@
+---
+name: Free disk space
+description: >-
+  Remove safely-unused preinstalled software from the GHA Windows runner's
+  `C:\` to give downstream `docker build` (which stages HCS layer scratch
+  on `C:\Windows\SystemTemp`) more headroom. Counterpart to
+  jlumbroso/free-disk-space on Linux, which doesn't have a Windows path.
+  Logs disk-free before + after so the reclaimed space is visible.
+
+  Enabling all makes approximately 10Gb free.
+
+  Caller is responsible for the `if: runner.os == 'Windows'` guard --
+  every step here uses Git Bash with `C:\` mounted at `/c`; running this
+  on a non-Windows runner will silently no-op (no /c mount) at best.
+
+inputs:
+  android:
+    description: "Remove Android SDK trees (~12 GB)."
+    required: false
+    default: "true"
+  hostedtoolcache-old-pythons:
+    description: >-
+      Remove Python 3.9/3.10/3.11/3.12 versions from `hostedtoolcache`
+      (~2 GB). The repo uses mise's pinned 3.13.
+    required: false
+    default: "true"
+  hostedtoolcache-old-jdks:
+    description: >-
+      Remove JDK 8/11/17/21 versions from `hostedtoolcache\Java`
+      (~1 GB). The repo uses mise's pinned Java 26.
+    required: false
+    default: "true"
+  old-dotnet-sdks:
+    description: >-
+      Remove .NET SDK 6.0.x and 7.0.x trees (~1-2 GB). The repo
+      installs current dotnet via mise.
+    required: false
+    default: "true"
+  misc-sdks:
+    description: >-
+      Remove unused preinstalled SDKs (Heroku, MongoDB, PostgreSQL,
+      Strawberry Perl) -- ~1 GB combined.
+    required: false
+    default: "true"
+  keep-image:
+    description: >-
+      Docker image (repo:tag) to preserve during the docker prune.
+      Empty (default) removes every image.
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - name: Disk usage before
+      shell: bash --noprofile --norc -euo pipefail {0}
+      run: df -h /c
+
+    - name: Remove Android SDK
+      if: inputs.android == 'true'
+      shell: bash --noprofile --norc -euo pipefail {0}
+      run: |
+        for p in "/c/Android" "/c/Program Files (x86)/Android"; do
+          [ -e "$p" ] && { echo "removing $p"; rm -rf -- "$p"; } || true
+        done
+
+    - name: Remove hostedtoolcache old Pythons
+      if: inputs.hostedtoolcache-old-pythons == 'true'
+      shell: bash --noprofile --norc -euo pipefail {0}
+      run: |
+        shopt -s nullglob
+        for p in /c/hostedtoolcache/Python/3.{9,10,11,12}*; do
+          echo "removing $p"
+          rm -rf -- "$p"
+        done
+
+    - name: Remove hostedtoolcache old JDKs
+      if: inputs.hostedtoolcache-old-jdks == 'true'
+      shell: bash --noprofile --norc -euo pipefail {0}
+      run: |
+        shopt -s nullglob
+        for p in /c/hostedtoolcache/Java_Adopt_jdk/{8,11,17,21}.*; do
+          echo "removing $p"
+          rm -rf -- "$p"
+        done
+
+    - name: Remove old .NET SDKs
+      if: inputs.old-dotnet-sdks == 'true'
+      shell: bash --noprofile --norc -euo pipefail {0}
+      run: |
+        shopt -s nullglob
+        for p in "/c/Program Files/dotnet/sdk/"{6,7}.0.*; do
+          echo "removing $p"
+          rm -rf -- "$p"
+        done
+
+    - name: Remove misc SDKs
+      if: inputs.misc-sdks == 'true'
+      shell: bash --noprofile --norc -euo pipefail {0}
+      run: |
+        pf="/c/Program Files"
+        pf86="/c/Program Files (x86)"
+        for p in "$pf/MongoDB" "$pf/PostgreSQL" "$pf86/Heroku" "/c/Strawberry"; do
+          [ -e "$p" ] && { echo "removing $p"; rm -rf -- "$p"; } || true
+        done
+
+    - name: Prune docker images and builder cache
+      shell: bash --noprofile --norc -euo pipefail {0}
+      env:
+        KEEP_IMAGE: ${{ inputs.keep-image }}
+      run: |
+        docker images
+        for img in $(docker images --format '{{.Repository}}:{{.Tag}}'); do
+          if [ "$img" != "$KEEP_IMAGE" ]; then
+            docker rmi -f "$img" || true
+          fi
+        done
+        docker container prune -f
+        docker network prune -f
+        docker builder prune -af
+
+    - name: Disk usage after
+      shell: bash --noprofile --norc -euo pipefail {0}
+      run: df -h /c

.github/actions/install-mise-tools/action.yaml

@@ -0,0 +1,74 @@
+---
+name: Install mise tools
+description: >-
+  Runs `install-mise` action, then installs all of the tools in the per-language
+  toolchains named by the workflow's MISE_ENV (with one retry on transient
+  HTTP flakes). Shared by check.yaml and test.yaml; the caller must run
+  `actions/checkout` before this so .mise/config*.toml exists for `mise trust`.
+
+inputs:
+  github-token:
+    description: >-
+      GitHub token forwarded as `$GITHUB_TOKEN` to the mise install steps.
+    required: true
+  install-action-tools:
+    description: >-
+      Comma-separated tools to co-install via taiki-e/install-action in the
+      same step as mise. Forwarded to install-mise's `extra-tools` input.
+      NOT used for `aube` -- install-action's manifest expects an `aubr`
+      binary that recent aube releases don't ship, so the install resolves
+      to a cargo source-build that flakes on crates.io SSL. The aube path
+      below uses the original `mise run setup-aube` (npm-backed, allowed
+      to fail) which has been the reliable install method.
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - name: Install mise binary
+      uses: ./.github/actions/install-mise
+      with:
+        install-action: ${{ inputs.install-action-tools }}
+
+    # Optional npm backend, installed before the main `mise install`.
+    # Only useful when js env is loaded (it's the backend for npm:* tools, all of which live in config.js.toml); skip
+    # otherwise to avoid the install cost on workflows that don't need any npm: install. See [tasks.setup-aube] in
+    # .mise/config.toml for the full rationale.
+    - name: Install aube (optional npm backend, allowed to fail)
+      if: contains(env.MISE_ENV, 'js')
+      continue-on-error: true
+      shell: bash --noprofile --norc -euo pipefail {0}
+      env:
+        GITHUB_TOKEN: ${{ inputs.github-token }}
+      run: mise run setup-aube
+
+    - name: Install mise tools
+      id: install-mise-tools
+      continue-on-error: true
+      shell: bash --noprofile --norc -euo pipefail {0}
+      env:
+        GITHUB_TOKEN: ${{ inputs.github-token }}
+      run: |
+        mise run preinstall
+        mise install
+
+    - name: Install mise tools (retry)
+      if: steps.install-mise-tools.outcome == 'failure'
+      shell: bash --noprofile --norc -euo pipefail {0}
+      env:
+        GITHUB_TOKEN: ${{ inputs.github-token }}
+      run: |
+        sleep 20
+        mise install
+
+    # Delete mise's auto-generated `mise.cmd` shim on Windows.
+    # This lets cmd's PATH search fall through to the real `mise.exe` at `~/.cargo/bin/mise.exe` (staged by
+    # taiki-e/install-action). Must run AFTER `mise install` -- that's the step that creates the shims.
+    - name: Remove self-recursive mise.cmd shim on Windows
+      if: runner.os == 'Windows'
+      shell: bash --noprofile --norc -euo pipefail {0}
+      run: |
+        shims="$LOCALAPPDATA/mise/shims"
+        rm -fv "$shims/mise.cmd" "$shims/mise"
+        ls "$shims" | grep -i '^mise' || true

.github/actions/install-mise/action.yaml

@@ -0,0 +1,54 @@
+---
+name: Install mise
+description: >-
+  Install the mise binary via taiki-e/install-action, and on Windows add mise's
+  file-shim dir to PATH so subsequent steps can resolve mise-managed tools by
+  bare name.
+
+inputs:
+  install-action-tools:
+    description: >-
+      Comma-separated tools to co-install via taiki-e/install-action.
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - name: Verify actions/checkout has run
+      shell: bash --noprofile --norc -euo pipefail {0}
+      run: git rev-parse --is-inside-work-tree >/dev/null
+
+    - name: Install mise
+      uses: taiki-e/install-action@v2
+      with:
+        tool: cargo-binstall,mise@2026.6.5
+
+    - name: Install extra tools via install-action
+      if: inputs.install-action-tools != ''
+      uses: taiki-e/install-action@v2
+      with:
+        tool: ${{ inputs.install-action-tools }}
+
+    # Append mise's shims dir to PATH for subsequent steps on Windows.
+    # taiki-e/install-action's mise manifest stages only `mise.exe`; mise's per-tool `.cmd` "file" shims under
+    # `%LOCALAPPDATA%\mise\shims` aren't on PATH by default, so tool lookups inside `mise run` fail with
+    # `'dart' / 'mvn' / 'recur' / 'wasm-pack' / 'zig' is not recognized...`. The companion `mise-shim.exe`
+    # (single-binary shim) ALSO ships in the Windows zip, but staging it triggers a CreateProcess
+    # `ERROR_FILENAME_EXCED_RANGE` (os error 206) when mise-shim re-execs mise.exe with the runner's already-long
+    # PATH inherited -- the file-shim fallback doesn't have this problem (each .cmd shim invokes `mise exec --`
+    # plainly via cmd).
+    - name: Add mise shims dir to PATH on Windows
+      if: runner.os == 'Windows'
+      shell: bash --noprofile --norc -euo pipefail {0}
+      # The github-env audit's arbitrary-code-execution shape doesn't apply here.
+      # The appended value is a hardcoded mise install-dir constant under our control -- no user input flows in.
+      run: echo "$LOCALAPPDATA\mise\shims" >> "$GITHUB_PATH" # zizmor: ignore[github-env]
+
+    - name: Trust mise config
+      shell: bash --noprofile --norc -euo pipefail {0}
+      run: mise trust
+
+    - name: Show MISE_ENV
+      shell: bash --noprofile --norc -euo pipefail {0}
+      run: echo "MISE_ENV=$MISE_ENV"

.github/workflows/check.yaml

@@ -16,7 +16,10 @@ concurrency:
 
 defaults:
   run:
-    shell: bash
+    shell: bash --noprofile --norc -euo pipefail {0}
+
+env:
+  MISE_ENV: dart,dotnet,java,js,python,rust,zig
 
 jobs:
   check:
@@ -29,35 +32,10 @@ jobs:
           fetch-depth: 1
           persist-credentials: false
 
-      - name: Install mise
-        uses: taiki-e/install-action@v2
+      - name: Install mise + tools
+        uses: ./.github/actions/install-mise-tools
         with:
-          tool: cargo-binstall,mise@2026.6.5
-
-      - name: Select all language envs
-        run: echo "MISE_ENV=$(mise run print-all-langs)" >> "$GITHUB_ENV"
-
-      # Optional npm backend, installed before the main `mise install`.
-      # See [tasks.setup-aube] in .mise/config.toml for the full rationale.
-      - name: Install aube (optional npm backend, allowed to fail)
-        continue-on-error: true
-        run: |
-          mise settings experimental=true
-          mise run setup-aube
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-          MISE_HTTP_TIMEOUT: "120"
-
-      - name: Install mise tools
-        run: |
-          mise run preinstall
-          mise install
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-          # GitHub release downloads occasionally take longer than mise's
-          # default 30s HTTP timeout; bump it so transient network slowness
-          # doesn't fail the whole `mise install` step.
-          MISE_HTTP_TIMEOUT: "120"
+          github-token: ${{ github.token }}
 
       - name: Prefetch Rust dependencies
         run: mise run prefetch:rust