confium_sandbox_wasm/
lib.rs

1#![allow(rustdoc::broken_intra_doc_links)]
2#![allow(rustdoc::bare_urls)]
3#![allow(rustdoc::redundant_explicit_links)]
4#![allow(rustdoc::private_intra_doc_links)]
5#![allow(rustdoc::invalid_html_tags)]
6
7//! Confium WASM plugin sandbox — capability-bounded execution of
8//! third-party plugin modules via wasmtime.
9//!
10//! Confium plugins today (1.0) run in-process and are fully
11//! trusted. This crate implements the sandboxed path: any language
12//! that compiles to WASM (Rust, C, C++, Zig, AssemblyScript) can be
13//! loaded as a Confium plugin, with explicit and revocable
14//! capabilities gating every host-side effect.
15//!
16//! ## Surfaces
17//!
18//! - [`Sandbox`] — the runtime trait (impl: [`WasmSandbox`]).
19//! - [`SandboxInstance`] — a loaded, capability-bound plugin.
20//! - [`Capability`] — the capability model (interface / network /
21//!   key / filesystem).
22//! - [`Value`] — values crossing the sandbox boundary.
23//! - [`HostImports`] (internal) — `cfm_*` host-import dispatch with
24//!   capability gating.
25//!
26//! See `TODO.roadmap/15-wasm-sandboxing.md` for the full design.
27//!
28//! ## Status
29//!
30//! Skeleton + capability-gating dispatch are in place. The host
31//! imports are stubs (deterministic return values) so the end-to-end
32//! pipeline can be exercised before the real hash / net / key
33//! handlers in confium-core / confium-net / confium-store are wired
34//! up.
35
36pub mod error;
37pub mod imports;
38pub mod sandbox;
39pub mod wasm;
40
41pub use error::Error;
42pub use error::Result;
43pub use sandbox::Capability;
44pub use sandbox::FilesystemMode;
45pub use sandbox::Sandbox;
46pub use sandbox::SandboxInstance;
47pub use sandbox::Value;
48pub use wasm::WasmInstance;
49pub use wasm::WasmSandbox;
confium_sandbox_wasm/lib.rs

confium_sandbox_wasm/
lib.rs
