feat!: ship C ABI 3 and schema 0.10 on a consolidated engine

[owenthcarey]

This is the overhaul from the repo analysis: C ABI revision 3 and IDL schema 0.10.0, built on a consolidated engine. It's one squashed commit, breaking by design (pre-1.0), with no compatibility shims.

Excluding snapshots: 557 files changed, +54K / −79K lines. Snapshots, mostly regenerated: 395 files, +77K / −55K.

Why

The analysis found problems the README didn't mention:

• Undefined behavior: validation accepted IDLs whose C header declared conflicting symbols. The macro also emitted the wrong thunk signature for C-style enums and interfaces declared in a sibling module.
• Generated code that was unsafe or crashed:
  • Python and Ruby passed bool as 32 bits.
  • .NET and Kotlin had a use-after-free when the finalizer ran mid-call.
  • Dart aborted on off-thread callbacks.
  • Wasm only loaded with an experimental Node flag.
• Packages that only built inside the test harness: Swift, Node, Kotlin and Go.
• Fixed weaveffi_* runtime symbols, so two WeaveFFI libraries couldn't share one process.

What changed

Identity

• Package name, C prefix and native library name come from Cargo.toml (Rust producers) or [package] (IDLs).
• Every symbol is {prefix}_…, including the runtime.
• Nothing generated is named after WeaveFFI.

ABI 3 (see docs/src/reference/abi.md)

• Strings are (ptr, len) and freed with {prefix}_free_bytes.
• New -5 cancelled code.
• Cancel tokens are reference counted, and cancelling one drops the future.
• Async completion fires exactly once.
• Per-module contract checksums are checked at load.
• Leak counters for tests.

Validation

• A global C symbol table catches every collision.
• Qualified names must match their module.
• Float map keys and synchronous cancellable functions are rejected.
• Resolved types use absolute names.

Macro

• Thunks are unsafe and doc-hidden.
• Error messages come from Display.
• Callback methods can return Result<T, ForeignError>.
• &str and &[u8] parameters are zero-copy.
• A type from a sibling module tree must be a record or rich enum. The old silent ABI mismatch is now a compile error with guidance.

Crates

• 18 become 6: weaveffi, -abi, -macros, -model, -gen, -cli.
• The proc macro no longer pulls YAML, schemars, miette or rayon into producer builds.

Generators

• All 11 targets are ported, with standalone packages, idiomatic cancellation, lifetime safety, and their fixed runtime code moved into real source files.
• Node and Wasm share one JS layer.
• C gets a generated value-buffer helper header.
• package builds an XCFramework when iOS slices are included.

CLI

• weaveffi init.
• A [project] table (input, out, targets), so bare weaveffi generate works.
• Generation writes only changed files and removes files it no longer produces.
• diff --target without running hooks.
• package defaults to the host, or to the platforms already in --binaries.

Tests and CI

• Integration tests are one binary, and the brittle prose-grep tests are gone.
• Every snapshot fixture is compile-checked with each language's own toolchain.
• Conformance runs per language with lane timeouts and leak assertions, on Linux and macOS.
• release-plz with prebuilt binaries replaces semantic-release and the Node tooling.

Docs

• Rewritten for the new design, and about 60% smaller.

Verification (local, macOS)

• cargo fmt --check, cargo clippy --workspace --all-targets -D warnings, cargo doc (with -D warnings -D rustdoc::all), and cargo machete: clean.
• cargo insta test --workspace --check: all pass.
• bash scripts/check-fixtures.sh: 55 of 55 pass (5 fixtures × 11 targets).
• bash conformance/run.sh: 61 of 61 lanes pass across all 11 languages, each ending with every leak counter at zero. The C and C++ lanes run under ASan/UBSan.
• weaveffi package --target swift --platforms ios-arm64,ios-sim-arm64,darwin-x64 assembled an XCFramework that swift build links against.

Not done, or not verified

• Not run locally: cargo deny (not installed) and the new CI workflows themselves (the matrix, the composite toolchain action, the Android NDK job, release-plz, and binary releases).
• No Windows conformance lanes yet. On the roadmap.
• Codec golden vectors: not done. Each language's codec consumer still asserts its values by hand. On the roadmap.
• Rich callback returns, async callback methods and vtable versioning: deferred, as planned.
• Known limitations, documented on each language's page:
  • In Dart, a callback method that returns a value can't be called from another thread.
  • {PREFIX}_LIBRARY is a build-time setting for Go, Swift and C++, because they link the library rather than load it.
  • Kotlin's Gradle builds weren't run (no Gradle locally). The sources and the JNI shim are verified with kotlinc and CMake.