Modernization Roadmap: native/wasm cleanup, JS API improvements, build toolchain, tests, and CI

[kalwalt]

Summary

Modernize FeatureSET-Display: native/wasm layer cleanup, JavaScript API improvements, build toolchain refresh, tests, and CI

Background

The project has not received updates in ~4 years. This tracking issue covers the full modernization effort across three areas: the native Emscripten/wasm layer, the JavaScript API, and the build/test/CI infrastructure. Each sub-issue is self-contained and can be worked independently, but the suggested order below minimizes conflicts.

Scope

1. Native / Emscripten layer

• [1b] Fix writeFP/writeFS per-point wasm→JS call loop and listener leak #18 — [1b] Fix writeFP/writeFS per-point wasm→JS call loop and event listener leak (fix first — affects all drawing changes)
• [1a] Replace EM_ASM_ block in ARimageFsetDisplay.cpp with embind #17 — [1a] Replace EM_ASM_ block in ARimageFsetDisplay.cpp with embind / emscripten::val
• [1c] Fix native code bugs in ARimageFsetDisplay.cpp (NULL deref, exit(), memory leaks, pointer truncation) #19 — [1c] Fix native code bugs: NULL deref, exit() calls, memory leaks, pointer truncation

2. JavaScript API

• [2a] Remove incorrect Module._free(debugBuffer) call #20 — [2a] Remove incorrect Module._free(debugBuffer) call
• [2b] Replace per-pixel ImageData fill loop with Uint32Array view (3-5x speedup) #21 — [2b] Replace per-pixel ImageData fill loop with Uint32Array view (3–5× speedup)
• [2c] Replace axios (CVE-2023-45857) with native fetch #22 — [2c] Replace axios (CVE-2023-45857 / SSRF) with native fetch
• [2d] Delete legacy arfset.api.js and asm.js build targets (major version breaking change) #23 — [2d] Delete legacy arfset.api.js and asm.js build targets (major version bump)
• [2e] Replace hardcoded _setup(893, 1117) with ARFset constructor options #24 — [2e] Replace hardcoded _setup(893, 1117) with ARFset constructor options
• [2f] Add TypeScript declarations, JSDoc, and fix nftMarkerCount/markerNFTCount naming #25 — [2f] Add TypeScript declarations, JSDoc, and fix nftMarkerCount/markerNFTCount naming

3. Build, tests, CI, docs

• [3a] Update JS toolchain: bump webpack/Babel, consider Vite/esbuild #26 — [3a] Update JS toolchain: bump webpack/Babel, consider Vite/esbuild
• [3b] Clean up deprecated Emscripten build flags and bump WebARKitLib submodule #27 — [3b] Clean up deprecated Emscripten build flags and bump WebARKitLib submodule
• [3c] Add test system: Vitest for unit tests + Playwright for browser smoke tests #28 — [3c] Add test system: Vitest for unit tests + Playwright for browser smoke tests
• [3d] Add GitHub Actions CI workflow (build, test, artifact upload on tag) #29 — [3d] Add GitHub Actions CI workflow (build, test, artifact upload on tag)
• [3e] Improve README: quick-start, API reference, migration notes, architecture diagram #30 — [3e] Improve README: quick-start, API reference, migration notes, architecture diagram

Suggested order of attack

1. [1b] Fix writeFP/writeFS per-point wasm→JS call loop and listener leak #18 (1b) — fix the listener leak first; it affects every other drawing change
2. [1a] Replace EM_ASM_ block in ARimageFsetDisplay.cpp with embind #17 (1a) — drop EM_ASM_ once JS reads from nftMarker directly
3. [2a] Remove incorrect Module._free(debugBuffer) call #20, [2b] Replace per-pixel ImageData fill loop with Uint32Array view (3-5x speedup) #21, [2c] Replace axios (CVE-2023-45857) with native fetch #22 (2a–2c) — small, isolated JS fixes; easy wins
4. [1c] Fix native code bugs in ARimageFsetDisplay.cpp (NULL deref, exit(), memory leaks, pointer truncation) #19 (1c) — native cleanup; pairs naturally with rebuilding wasm
5. [2d] Delete legacy arfset.api.js and asm.js build targets (major version breaking change) #23 (2d) — delete legacy file and asm.js builds; major-version bump
6. [3a] Update JS toolchain: bump webpack/Babel, consider Vite/esbuild #26 + [3b] Clean up deprecated Emscripten build flags and bump WebARKitLib submodule #27 (3a + 3b) — toolchain refresh; clean base for tests
7. [3c] Add test system: Vitest for unit tests + Playwright for browser smoke tests #28 + [3d] Add GitHub Actions CI workflow (build, test, artifact upload on tag) #29 (3c + 3d) — tests and CI so regressions get caught from here on
8. [2e] Replace hardcoded _setup(893, 1117) with ARFset constructor options #24, [2f] Add TypeScript declarations, JSDoc, and fix nftMarkerCount/markerNFTCount naming #25, [3e] Improve README: quick-start, API reference, migration notes, architecture diagram #30 (2e, 2f, 3e) — polish and docs

Impact

Critical path: #18 (listener leak) → #19 (native bugs) → #23 (legacy deletion) → #26/#27 (toolchain) → #28/#29 (tests + CI)

Completing this roadmap brings the project to a modern, maintainable baseline: no known CVEs, no wasm-terminating exit() calls, no memory leaks, a working test suite, and automated CI on every PR.