Crate polymorph_webcrypto_wasmtime 

Wasmtime host implementation of the polymorph:webcrypto interfaces, backed by the pure-Rust RustCrypto crates.

This crate factors the host-agnostic part of the Wasmtime WebCrypto host out of the demo binaries so any host can satisfy the polymorph:webcrypto imports with one call to add_to_linker. It is an async (component-model async) implementation modeled after wasmtime_wasi_http::p3: a host embeds a WasiWebcryptoCtx in its store state, implements WasiWebcryptoView to expose it alongside the store’s [ResourceTable], and calls add_to_linker to satisfy the full polymorph:webcrypto package surface with RustCrypto implementations.

An embedder that already holds key material in its own process — loaded from a platform keystore, generated by another library — can place it in the store’s table as typed handles rather than round-tripping it through a serialized import call: see SigningKey::from_material and VerifyingKey::from_material.

Modules

bindings

Raw bindgen! output for the polymorph:webcrypto package.

standalone

Ready-made embedding for hosts whose component imports only polymorph:webcrypto: the canonical store state and the engine/linker/store setup this repository’s drivers share (the demo host and the conformance adapter), so the engine configuration the async imports require has one definition.

Structs

AeadKey

Backing type for the aead.aead-key resource.

AeadKeyOptions

An aead-key-options resource. See MacKeyOptions.

AgreementKeyOptions

An agreement-key-options resource. See MacKeyOptions.

AgreementPublicKey

Backing type for the key-agreement.public-key resource: public material only, exchangeable and secret-free.

AgreementSecretKey

Backing type for the key-agreement.secret-key resource. agree is one-shot and stateless per call; the derivation state lives in the derive-input it mints.

CipherKey

Backing type for the cipher.cipher-key resource: the unauthenticated AES modes’ key material.

CipherKeyOptions

A cipher-key-options resource. See MacKeyOptions.

DecryptionKey

Backing type for the public-encryption.decryption-key resource.

DecryptionKeyOptions

A decryption-key-options resource. See MacKeyOptions.

DeriveInput

Backing type for the derivation.derive-input resource: a parameterized derivation, run eagerly (the extract step runs at prepare, so this retains the PRK rather than the base secret).

DeriveOptions

A derive-options resource. See MacKeyOptions.

Digest

Backing type for the digest.digest resource.

EncryptionKey

Backing type for the public-encryption.encryption-key resource.

Ikm

Backing type for the hkdf.ikm resource: input keying material, never readable through the API under any grant.

KwKey

Backing type for the key-wrap.kw-key resource: the AES-KW key-encryption key’s material.

KwKeyOptions

A kw-key-options resource. See MacKeyOptions.

LinkOptions

Which @unstable-gated interfaces add_to_linker_with_options adds. Every flag defaults to off; this host implements all of them, so a flag is embedder policy, not capability.

MacKey

Backing type for the mac.mac-key resource.

MacKeyOptions

A mac-key-options resource: mint-time policy under construction. Constructed with the WIT defaults (nothing granted), mutated by the setters, consumed by a mint.

Password

Backing type for the pbkdf2.password resource: a password, never readable through the API under any grant.

SigningKey

Backing type for the signature.signing-key resource.

SigningKeyMaterial

The shared core’s key-material and policy types, re-exported for the embedder key constructors (SigningKey::from_material, VerifyingKey::from_material). The material behind a signature.signing-key resource: the private key bound to its algorithm at minting, and the key’s extractability.

SigningKeyOptions

A signing-key-options resource. See MacKeyOptions.

SigningPolicy

The shared core’s key-material and policy types, re-exported for the embedder key constructors (SigningKey::from_material, VerifyingKey::from_material). signature.signing-key-options (degenerate: sign is the sole usage).

UnwrapInput

Backing type for the wrapping.unwrap-input resource: decrypted key material awaiting a typed mint, consumed by the unwrap mints.

VerifyingKey

Backing type for the signature.verifying-key resource.

WasiWebcrypto

The type for which this crate implements the polymorph:webcrypto interfaces. Used as the [HasData] marker for the generated bindings.

WasiWebcryptoCtx

Configuration and per-store state for the WebCrypto host.

WasiWebcryptoCtxView

A borrowed view into a host’s WasiWebcryptoCtx and its [ResourceTable].

WrapInput

Backing type for the wrapping.wrap-input resource: one key’s serialized material awaiting encryption under a wrapping key, consumed by the wrap operations.

Enums

Error

The shared core’s key-material and policy types, re-exported for the embedder key constructors (SigningKey::from_material, VerifyingKey::from_material). The WIT types.error variant, mirrored case for case. Implementations convert values of this type into their generated error types with the mechanical From that [impl_conversions!] defines; the message strings carried here are the ones the WIT contracts specify, shared verbatim by both implementations.

SigPublic

The shared core’s key-material and policy types, re-exported for the embedder key constructors (SigningKey::from_material, VerifyingKey::from_material). The public key behind a signature.verifying-key resource, bound to its algorithm (and, for ECDSA and RSA, its digest parameterization) at minting. Verification is secret-free, so every arm exists on every target.

Traits

WasiWebcryptoView

A trait that provides access to the WasiWebcryptoCtx host state.

Functions

add_to_linker

Add the polymorph:webcrypto interfaces implemented by this crate — types, the primitive kinds (mac, aead, digest, signature), and the algorithm minting interfaces — to the provided [Linker].

add_to_linker_with_options

add_to_linker, with the @unstable-gated interfaces options selects also served.