feat(onnxruntime): WebAssembly (Emscripten) static backend

Add an onnx-wasm-static leg that builds a single self-contained
libonnxruntime.a for anira compiled to WebAssembly.

- CMakePresets: onnx-wasm-static (platform=wasm, arch=wasm32,
  toolchain=emscripten); auto-joins the onnx matrix via engine-meta.
- build-ort.sh: wasm case — init the cmake/external/emsdk submodule
  (build.py installs+activates its pinned emsdk 4.0.23 itself) and
  build with --build_wasm_static_lib --enable_wasm_simd
  --enable_wasm_threads --disable_rtti. --build_wasm_static_lib bundles
  every transitive dep via emar, so the wasm leg skips the re2
  force-build and scripts/bundle-static.sh.
- stage.sh: wasm branch ships libonnxruntime_webassembly.a as
  libonnxruntime.a (same name as every other static target).
- _build-backend.yml: smoke (wasm, node) gated on
  toolchain==emscripten — em++ links the smoke against the .a and runs
  a real add.onnx forward pass under emsdk's Node (NODERAWFS +
  PROXY_TO_PTHREAD).
- Docs: support-matrix WASM row + COOP/COEP -pthread consumer note.

Threads => the consuming wasm app must link -pthread on a
cross-origin-isolated page.

Author: vackva

.github/workflows/_build-backend.yml

@@ -148,6 +148,25 @@ jobs:
             adb shell "/data/local/tmp/smoke /data/local/tmp/add.bin" 2>&1 | tee out.txt
             grep -q PASS out.txt
 
+      # WASM: link the smoke against the staged .a with em++ (proves the archive is
+      # symbol-complete) and run a real forward pass under emsdk's Node. NODERAWFS lets the
+      # smoke std::ifstream the model off the real FS; PROXY_TO_PTHREAD runs main() off a
+      # worker so the threads-enabled lib's threadpool works without blocking node's loop.
+      # Uses the same emsdk build.py installed+activated under the ort source (4.0.23).
+      - name: smoke (wasm, node)
+        if: ${{ matrix.toolchain == 'emscripten' }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          . engines/${{ inputs.engine }}/onnxruntime-src/cmake/external/emsdk/emsdk_env.sh
+          st="${{ steps.b.outputs.staging }}"
+          em++ -std=c++17 -O2 -I "$st/include" \
+            engines/${{ inputs.engine }}/test/smoke.cpp "$st/lib/lib${{ inputs.libname }}.a" \
+            -pthread -sPROXY_TO_PTHREAD=1 -sEXIT_RUNTIME=1 \
+            -sALLOW_MEMORY_GROWTH=1 -sNODERAWFS=1 -o smoke.js
+          node smoke.js engines/${{ inputs.engine }}/test/add.onnx 2>&1 | tee out.txt
+          grep -q PASS out.txt
+
       # Publish standalone, except intermediate per-ABI Android legs (toolchain==android),
       # which are combined into one multi-ABI archive below. The multi-ABI AAR leg
       # (toolchain==none, arch==multi) publishes here directly.

CMakePresets.json

@@ -161,6 +161,11 @@
       "cacheVariables": { "BACKENDS_ENGINE": "onnxruntime", "BACKENDS_PLATFORM": "android", "BACKENDS_ARCH": "x86_64", "BACKENDS_CONFIG": "Release", "BACKENDS_KIND": "static", "BACKENDS_SOURCE": "build" },
       "vendor": { "anira": { "name": "Android-x86_64", "runner": "ubuntu-24.04", "arch": "x86_64", "kind": "static", "config": "Release", "canRun": "0", "toolchain": "android", "source": "build" } }
     },
+    {
+      "name": "onnx-wasm-static", "inherits": "orch-base",
+      "cacheVariables": { "BACKENDS_ENGINE": "onnxruntime", "BACKENDS_PLATFORM": "wasm", "BACKENDS_ARCH": "wasm32", "BACKENDS_CONFIG": "Release", "BACKENDS_KIND": "static", "BACKENDS_SOURCE": "build" },
+      "vendor": { "anira": { "name": "WASM", "runner": "ubuntu-24.04", "arch": "wasm32", "kind": "static", "config": "Release", "canRun": "1", "toolchain": "emscripten", "source": "build" } }
+    },
     {
       "name": "onnx-macos-x86_64-shared", "inherits": "orch-base",
       "cacheVariables": { "BACKENDS_ENGINE": "onnxruntime", "BACKENDS_PLATFORM": "macos", "BACKENDS_ARCH": "x86_64", "BACKENDS_CONFIG": "Release", "BACKENDS_KIND": "shared", "BACKENDS_SOURCE": "build" },

README.md

@@ -34,12 +34,16 @@ What ships per target — `shared` and/or `static`:
 | Windows arm64                   | shared · static ¹ | shared · static ¹   | shared · static ¹ | shared   |
 | Android (`arm64-v8a` + `x86_64`)| shared · static   | shared · static     | shared · static   | —        |
 | iOS (xcframework)               | static            | shared              | static            | —        |
+| WASM (Emscripten)               | —                 | —                   | static ²          | —        |
 
 macOS `shared` dylibs are **Developer ID code-signed** (Hardened Runtime, timestamped); the
 consuming app re-signs/notarizes on embed.
 
 > ¹ Windows `static` also ships a `Debug` variant.
 
+> ² WASM is a single Emscripten static archive built with SIMD + pthreads (`--disable_rtti`);
+> link it into an anira-on-WASM build with `-pthread` on a cross-origin-isolated (COOP/COEP) page.
+
 > `—` = not provided.
 
 Per-backend build details (e.g. LiteRT's `LiteRt*` vs `TfLite*` API split, Windows-arm64

TODO.md

@@ -2,6 +2,7 @@
 
 - Android `arm64-v8a` smoke is compile+link only (software emulation hangs; `x86_64` runs the real forward pass).
 - Android shared run-on-emulator smoke (currently compile+link only — the `.so` may need `libc++_shared.so` on-device).
-- wasm — Emscripten target/preset (re-add the deferred `wasm` row; `-matomics -msimd128 -mbulk-memory`).
+- wasm — ONNXRuntime done (`onnx-wasm-static`, `--build_wasm_static_lib` + simd/threads). TFLite next
+  (Emscripten CMake build, `-matomics -msimd128 -mbulk-memory`); LiteRT deferred (Bazel+emscripten — use the TFLite C API on WASM).
 - ExecuTorch backend — researching (static + AOT `.pte` model).
 - Linux `armv7l` (Bela) — needs `-DTFLITE_ENABLE_XNNPACK=OFF`.

engines/onnxruntime/README.md

@@ -4,7 +4,8 @@ Builds `onnxruntime` (C API, **full operator set** — any model works, CPU prov
 for [anira](https://github.com/anira-project/anira). ONNX Runtime ships only *shared*
 libs upstream, so **static is built from source** (no op-reduction — every operator
 ships); **shared** is built for macOS but **repackaged** from Microsoft's prebuilts
-elsewhere.
+elsewhere. A **WASM** (Emscripten) static lib is built from source too — for anira
+compiled to WebAssembly.
 
 ## Files
 
@@ -43,12 +44,22 @@ elsewhere.
   DLLs next to the exe; macOS needs `-framework Foundation -framework CoreFoundation`; Linux
   needs `rt`/`dl`/`m`.
 - **iOS** `build.py` flag is `--apple_sysroot` (renamed from `--ios_sysroot` in 1.26).
+- **WASM** (`build-ort.sh wasm`): `--build_wasm_static_lib` builds one **self-contained**
+  `libonnxruntime_webassembly.a` (all deps bundled by `bundle_static_library` via `emar`) —
+  so the wasm leg skips the re2 force-build *and* `bundle-static.sh`; `stage.sh` just renames
+  it to `libonnxruntime.a`. Built with `--enable_wasm_simd --enable_wasm_threads --disable_rtti`
+  (the ort-builder recipe). `build.py` installs+activates its own pinned **emsdk 4.0.23** from
+  the `cmake/external/emsdk` submodule (init'd in `build-ort.sh`) — no external emsdk needed.
+  **Threads** ⇒ the consuming wasm app must link `-pthread` and be served cross-origin-isolated
+  (COOP/COEP). The CI smoke links + runs the forward pass under emsdk's Node (`NODERAWFS` +
+  `PROXY_TO_PTHREAD`).
 
 ## Local build
 
 ```bash
 # from this directory
 bash build-ort.sh macos arm64 Release build           # <platform> <arch> <config> <build-dir> [kind]
 bash build-ort.sh macos arm64 Release build shared    # shared variant (libonnxruntime.dylib)
-bash ../../scripts/bundle-static.sh build/Release /tmp/out/lib/libonnxruntime.a   # static only
+bash build-ort.sh wasm wasm32 Release build           # WASM static lib (needs emsdk submodule)
+bash ../../scripts/bundle-static.sh build/Release /tmp/out/lib/libonnxruntime.a   # static only (not wasm)
 ```

engines/onnxruntime/build-ort.sh

@@ -95,6 +95,17 @@ case "$PLATFORM" in
   ios-sim)
     ARGS+=(--ios --use_xcode --apple_sysroot iphonesimulator --osx_arch "$ARCH" --apple_deploy_target 13.0 --build_apple_framework)
     ;;
+  wasm)
+    # --build_wasm_static_lib bundles EVERY transitive dep (onnx/protobuf/re2/mlas/xnnpack)
+    # into one self-contained libonnxruntime_webassembly.a via emar (onnxruntime_webassembly.cmake
+    # bundle_static_library) — so the wasm leg needs neither the re2 force-build nor
+    # scripts/bundle-static.sh below. build.py installs+activates its OWN pinned emsdk (4.0.23)
+    # from the cmake/external/emsdk submodule (hardcoded toolchain path), so init it first —
+    # the shallow clone above fetches no submodules. simd + threads (the ort-builder recipe);
+    # threads => the consumer must link -pthread on a cross-origin-isolated (COOP/COEP) page.
+    git -C "$SRC" submodule update --init --depth 1 cmake/external/emsdk
+    ARGS+=(--build_wasm_static_lib --enable_wasm_simd --enable_wasm_threads --disable_rtti)
+    ;;
   *) echo "ERROR: unknown platform '$PLATFORM'"; exit 1 ;;
 esac
 
@@ -111,6 +122,11 @@ if [ "$KIND" = "shared" ]; then
   echo "onnxruntime $VER ($PLATFORM/$ARCH/$CONFIG, shared) built -> $OUT/$CONFIG"
   exit 0
 fi
+if [ "$PLATFORM" = "wasm" ]; then
+  # --build_wasm_static_lib already produced a self-contained libonnxruntime_webassembly.a.
+  echo "onnxruntime $VER (wasm static lib) built -> $OUT/$CONFIG"
+  exit 0
+fi
 echo "+ force-build re2 (static bundle needs libre2.a / re2.lib)"
 # re2 is fetched from source (CMAKE_DISABLE_FIND_PACKAGE_re2=ON + onnxruntime_USE_VCPKG=OFF).
 # With Ninja on every platform, the target builds by name (the old Windows msbuild-by-path

engines/onnxruntime/stage.sh

@@ -35,6 +35,18 @@ fi
 # ---- build from source --------------------------------------------------------------------
 cp "$HERE"/include/*.h "$ST/include/"
 
+if [ "$PLATFORM" = "wasm" ]; then
+  # Emscripten static lib: build-ort.sh emits ONE self-contained libonnxruntime_webassembly.a
+  # (deps bundled by --build_wasm_static_lib) — no re2 force-build / bundle-static.sh. Ship it
+  # as libonnxruntime.a so consumers link the same name as every other static target.
+  bash "$HERE/build-ort.sh" wasm wasm32 "$CONFIG" "$HERE/build" static
+  a="$(find "$HERE/build/$CONFIG" -maxdepth 2 -name 'libonnxruntime_webassembly.a' | head -1)"
+  [ -n "$a" ] || { echo "ERROR: no wasm static lib under $HERE/build/$CONFIG"; exit 1; }
+  cp "$a" "$ST/lib/libonnxruntime.a"
+  echo "staged onnxruntime (wasm/wasm32/static) -> $ST"
+  exit 0
+fi
+
 if [ "$KIND" = "shared" ]; then
   # macOS only (Linux/Windows/Android shared come from prebuilt). Builds libonnxruntime.dylib
   # directly — one self-contained lib, no re2 force-build / no bundling.