// ✅ 始终验证外部输入
#[wasm_bindgen]
pub fn process_data(input: &[u8]) -> Result<Vec<u8>, JsValue> {
    // 检查输入大小
    if input.len() > MAX_INPUT_SIZE {
        return Err(JsValue::from_str("Input too large"));
    }
    
    // 检查输入格式
    if !is_valid_format(input) {
        return Err(JsValue::from_str("Invalid format"));
    }
    
    // 安全处理
    Ok(transform(input))
}

// ✅ 使用安全的 Rust 模式
#[wasm_bindgen]
pub fn safe_memory_access(data: &[u8], index: usize) -> Option<u8> {
    data.get(index).copied()  // 返回 Option，不会 panic
}

// ❌ 避免不安全的边界访问
#[wasm_bindgen]
pub fn unsafe_memory_access(data: &[u8], index: usize) -> u8 {
    data[index]  // 可能 panic（Wasm trap）
}

// ✅ 在生产环境禁用详细错误信息
const isProd = process.env.NODE_ENV === 'production';

try {
  await WebAssembly.instantiateStreaming(fetch('module.wasm'), imports);
} catch (error) {
  if (isProd) {
    console.error('Module load failed');
  } else {
    console.error('Detailed error:', error);  // 开发环境显示详情
  }
}

# Rust — 保留调试信息
cargo build --target wasm32-unknown-unknown --debug
# 或在 Cargo.toml 中设置 debug = true

# C/C++ — 保留 DWARF 信息
emcc -g -O0 -s ASSERTIONS=1 input.c -o output.js

# AssemblyScript — 调试模式
npx asc assembly/index.ts --outFile build/module.wasm --debug

// Rust 方式
use web_sys::console;

macro_rules! log {
    ($($t:tt)*) => {
        console::log_1(&format!($($t)*).into())
    }
}

#[wasm_bindgen]
pub fn debuggable_function(x: i32) -> i32 {
    log!("Input: {}", x);
    let result = x * 2;
    log!("Output: {}", result);
    result
}

// C 方式（Emscripten）
#include <emscripten.h>

EM_JS(void, debug_log, (const char* msg), {
    console.log('[Wasm]', UTF8ToString(msg));
});

// Rust 单元测试
#[cfg(test)]
mod tests {
    use super::*;
    
    #[test]
    fn test_fibonacci() {
        assert_eq!(fibonacci(0), 0);
        assert_eq!(fibonacci(1), 1);
        assert_eq!(fibonacci(10), 55);
    }
    
    #[test]
    fn test_edge_cases() {
        assert_eq!(fibonacci(2), 1);
        assert_eq!(fibonacci(46), 1836311903);  // i32 上限附近
    }
}

// 运行测试
// cargo test --target wasm32-unknown-unknown

// tests/integration.test.js
import { describe, it, expect, beforeAll } from 'vitest';
import init, { add, fibonacci, process_data } from '../pkg/my_wasm.js';

describe('Wasm Module', () => {
  beforeAll(async () => {
    await init();
  });
  
  it('should add two numbers', () => {
    expect(add(2, 3)).toBe(5);
  });
  
  it('should compute fibonacci', () => {
    expect(fibonacci(10)).toBe(55);
  });
  
  it('should handle large inputs', () => {
    const input = new Uint8Array(1024 * 1024);  // 1MB
    const result = process_data(input);
    expect(result).toBeDefined();
  });
  
  it('should throw on invalid input', () => {
    expect(() => process_data(null)).toThrow();
  });
});

// tests/benchmark.js
import { Bench } from 'tinybench';
import init, { add } from '../pkg/my_wasm.js';

await init();

const bench = new Bench({ time: 1000 });

bench
  .add('Wasm add', () => {
    add(10, 20);
  })
  .add('JS add', () => {
    10 + 20;
  });

await bench.run();

console.table(bench.table());

name: Wasm CI/CD
on: [push, pull_request]

jobs:
  build-and-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: wasm32-unknown-unknown
      
      - name: Install wasm-pack
        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
      
      - name: Install wasm-opt
        run: cargo install binaryen
      
      - name: Build
        run: wasm-pack build --target web --release
      
      - name: Optimize
        run: |
          wasm-opt -Oz pkg/my_wasm_bg.wasm -o pkg/my_wasm_bg.wasm
          wasm-strip pkg/my_wasm_bg.wasm
      
      - name: Test
        run: |
          npm ci
          npm test
      
      - name: Check size
        run: |
          SIZE=$(stat -f%z pkg/my_wasm_bg.wasm || stat -c%s pkg/my_wasm_bg.wasm)
          echo "Wasm size: ${SIZE} bytes"
          if [ "$SIZE" -gt 1048576 ]; then
            echo "⚠️ Wasm file exceeds 1MB!"
            exit 1
          fi
      
      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: wasm-pkg
          path: pkg/

# 使用语义版本
[package]
version = "1.2.3"  # 主版本.次版本.补丁

server {
    listen 443 ssl http2;
    server_name app.example.com;
    
    # MIME 类型
    types {
        application/wasm wasm;
        application/javascript js;
        application/json json;
    }
    
    # CORS 头
    add_header Access-Control-Allow-Origin "*";
    
    # SharedArrayBuffer 支持
    add_header Cross-Origin-Opener-Policy "same-origin";
    add_header Cross-Origin-Embedder-Policy "require-corp";
    
    # Wasm 文件缓存策略
    location ~* \.wasm$ {
        add_header Cache-Control "public, max-age=31536000, immutable";
        
        # Brotli 压缩
        brotli on;
        brotli_comp_level 6;
        
        # Gzip 降级
        gzip on;
        gzip_types application/wasm;
    }
    
    # JS 文件
    location ~* \.js$ {
        add_header Cache-Control "public, max-age=31536000, immutable";
        brotli on;
    }
}

// 捕获 Wasm 错误
window.addEventListener('error', (event) => {
  if (event.message?.includes('RuntimeError') || 
      event.message?.includes('CompileError')) {
    // 上报到监控系统
    reportToSentry({
      type: 'wasm_error',
      message: event.message,
      filename: event.filename,
      lineno: event.lineno,
      url: window.location.href,
      userAgent: navigator.userAgent,
    });
  }
});

// 未捕获的 Promise rejection
window.addEventListener('unhandledrejection', (event) => {
  if (event.reason instanceof WebAssembly.CompileError ||
      event.reason instanceof WebAssembly.RuntimeError) {
    reportToSentry({
      type: 'wasm_unhandled_rejection',
      message: event.reason.message,
    });
  }
});

async function loadWithFallback() {
  // 策略：Wasm → JavaScript 降级
  try {
    if (typeof WebAssembly !== 'object') {
      throw new Error('Wasm not supported');
    }
    
    const { instance } = await WebAssembly.instantiateStreaming(
      fetch('/wasm/module.wasm'), imports
    );
    
    return instance.exports;
  } catch (error) {
    console.warn('Wasm load failed, falling back to JS:', error);
    
    // 加载 JavaScript 降级版本
    await loadScript('/js/fallback.js');
    return window.FallbackModule;
  }
}