deps(nativets): inline maybe_transpile_source, drop deno_runtime (#9110)

windmill-runtime-nativets was the workspace's only consumer of the
deno_runtime crate, and its only use of it was one call site in
build.rs:

    deno_runtime::transpile::maybe_transpile_source(specifier, source)

That function (`deno_runtime-0.198.0/transpile.rs`, ~80 lines) is a pure
deno_ast + deno_core + deno_error wrapper — it doesn't touch any
deno_runtime state. Inline it verbatim into our build.rs and drop the
entire deno_runtime dep.

Why this matters now: deno_runtime transitively pulls in deno_cache →
rusqlite → libsqlite3-sys. From deno_cache 0.128.0 (Feb-Mar 2025)
onwards, rusqlite was bumped to ^0.34, which means libsqlite3-sys ^0.35.
sqlx 0.8 transitively requires libsqlite3-sys ^0.30. Cargo's `links =
"sqlite3"` rule allows only one libsqlite3-sys in a build graph, so the
two crates collide on any deno release ≥ v2.5. Inlining the transpile
helper sidesteps the collision entirely — sqlx-sqlite stays the sole
libsqlite3-sys consumer at 0.30.1.

All other appearances of "deno_runtime" in the source tree are for a
Windmill-internal function named `setup_deno_runtime`, not the crate.

Build artifacts validated:
- `cargo check --features quickjs` → green.
- `cargo test -p windmill-runtime-nativets smoke -- --ignored --skip smoke_net_`
  → 8 passed (the in-process V8 runtime + deno_fetch + deno_web + swc
  transpilation surface still works end-to-end through the inlined
  function).
- `cargo tree --invert deno_cache` → "did not match any packages"
  (gone from the graph).
- Single `libsqlite3-sys` entry in Cargo.lock at 0.30.1 (sqlx's).

backend/Cargo.toml

@@ -455,7 +455,6 @@ deno_net = "0.182.0"
 deno_core = "0.336.0"
 deno_ast = { version = "=0.44.0", features = ["transpiling"] }
 deno_permissions = "0.49.0"
-deno_runtime = { version = "0.198.0", features = ["transpile"] }
 deno_telemetry = "0.12.0"
 deno_error = "=0.5.5"
 rustls-pemfile = "2.2.0"

backend/windmill-runtime-nativets/Cargo.toml

@@ -30,7 +30,6 @@ deno_permissions.workspace = true
 deno_io.workspace = true
 deno_telemetry.workspace = true
 deno_error.workspace = true
-deno_runtime.workspace = true
 winapi.workspace = true
 
 itertools.workspace = true
@@ -60,6 +59,6 @@ deno_ast.workspace = true
 deno_tls.workspace = true
 deno_permissions.workspace = true
 deno_io.workspace = true
-deno_runtime.workspace = true
 deno_telemetry.workspace = true
+deno_error.workspace = true
 winapi.workspace = true

backend/windmill-runtime-nativets/build.rs

@@ -1,3 +1,6 @@
+use deno_ast::{MediaType, ParseParams};
+use deno_core::{ModuleCodeString, ModuleName, SourceMapData};
+use deno_error::JsErrorBox;
 use deno_fetch::FetchPermissions;
 use deno_net::NetPermissions;
 use deno_web::{BlobStore, TimersPermission};
@@ -77,6 +80,74 @@ deno_core::extension!(
     esm = ["src/runtime.js"],
 );
 
+// `extension_transpiler` callback for `deno_core::snapshot::create_snapshot`.
+//
+// Specialized to our snapshot's inputs. Of the seven deno_* extensions
+// we register via `init_ops_and_esm()`, six ship pre-built `.js` files
+// in their `esm` lists (webidl/url/console/web/fetch/net) — only
+// `deno_telemetry`'s `extension!` macro lists `.ts` files
+// (`telemetry.ts`, `util.ts`), so the TypeScript branch is needed
+// solely for that crate. Our local `fetch` extension contributes
+// `src/runtime.js` (pure JS). No `node:` imports happen at snapshot
+// build time, no `.mjs`, no user-supplied modules. So:
+//   - `.js` → pass through.
+//   - `.ts` → transpile via deno_ast (deno_telemetry only).
+//   - anything else → build bug (deno shipping an unexpected file type
+//     or us mislabelling one), panic loudly rather than emit a broken
+//     snapshot.
+//
+// No source maps: the snapshot is a binary blob the runtime loads — source
+// maps would never be consumed.
+//
+// The signature still returns `Result<_, JsErrorBox>` because that's what
+// `extension_transpiler` expects, but we never construct one — parse and
+// transpile failures are build-time bugs in deno's own .ts internals (or
+// in our runtime.js, if we ever change its extension), so they panic.
+//
+// This replaces a call to `deno_runtime::transpile::maybe_transpile_source`
+// from `deno_runtime 0.198.0`. The original is more general (handles
+// `node:` modules, `.mjs`, emits source maps in debug builds, plumbs
+// errors via `JsErrorBox`); none of that surface is reachable in our
+// build. Dropping the `deno_runtime` dep eliminates a
+// `deno_cache → rusqlite → libsqlite3-sys 0.35` transitive chain that
+// collides with sqlx-sqlite's `libsqlite3-sys 0.30` (cargo's
+// `links = "sqlite3"` rule).
+fn maybe_transpile_source(
+    name: ModuleName,
+    source: ModuleCodeString,
+) -> Result<(ModuleCodeString, Option<SourceMapData>), JsErrorBox> {
+    let media_type = MediaType::from_path(Path::new(&name));
+    match media_type {
+        MediaType::JavaScript => return Ok((source, None)),
+        MediaType::TypeScript => {}
+        _ => panic!("unexpected media type {media_type:?} for {name} during snapshot build"),
+    }
+
+    let parsed = deno_ast::parse_module(ParseParams {
+        specifier: deno_core::url::Url::parse(&name).unwrap(),
+        text: source.into(),
+        media_type,
+        capture_tokens: false,
+        scope_analysis: false,
+        maybe_syntax: None,
+    })
+    .unwrap_or_else(|e| panic!("snapshot transpile: parse failed for {name}: {e}"));
+
+    let transpiled = parsed
+        .transpile(
+            &deno_ast::TranspileOptions {
+                imports_not_used_as_values: deno_ast::ImportsNotUsedAsValues::Remove,
+                ..Default::default()
+            },
+            &deno_ast::TranspileModuleOptions::default(),
+            &deno_ast::EmitOptions::default(),
+        )
+        .unwrap_or_else(|e| panic!("snapshot transpile: emit failed for {name}: {e}"))
+        .into_source();
+
+    Ok((transpiled.text.into(), None))
+}
+
 fn main() {
     println!("cargo:rustc-env=TARGET={}", env::var("TARGET").unwrap());
     println!("cargo:rustc-env=PROFILE={}", env::var("PROFILE").unwrap());
@@ -105,7 +176,7 @@ fn main() {
             cargo_manifest_dir: env!("CARGO_MANIFEST_DIR"),
             startup_snapshot: None,
             extension_transpiler: Some(std::rc::Rc::new(|specifier, source| {
-                deno_runtime::transpile::maybe_transpile_source(specifier, source)
+                maybe_transpile_source(specifier, source)
             })),
             extensions: exts,
             with_runtime_cb: None,