[package]
name = "nordisk-heimdall-wasm"
description = "Heimdall is a defensive sandbox: its wasm host, a wasmtime component host with no WASI, fuel + wall-clock + memory/table/instance/stack limits, signed guests verified before load"
version.workspace = true
edition.workspace = true
license.workspace = true
repository.workspace = true
homepage.workspace = true
readme.workspace = true
rust-version.workspace = true
keywords = ["sandbox","wasm","wasmtime","security","component-model"]
categories = ["wasm","virtualization"]
[package.metadata.docs.rs]
targets = ["x86_64-unknown-linux-gnu"]
[lib]
name = "heimdall_wasm"
path = "src/lib.rs"
[dependencies]
# The runtime with the component model and the compiler only: no WASI crate, no
# cache, no text parser, no GC. wasmtime 49 = the same security floor as holger
# (plugin/host/Cargo.toml: every advisory against 27..46 is fixed at or below 48.0.2).
wasmtime = { version = "49.0.4", default-features = false, features = ["anyhow", "runtime", "cranelift", "component-model", "parallel-compilation", "std"] }
heimdall-core = { package = "nordisk-heimdall-core", path = "../heimdall-core", version = "0.1.0" }
blake3 = "1"
# The guest signature gate holger and monetize already use: a detached CMS
# `.wasm.p7s` over the module's blake3, chained to DER roots, through the one
# spec-exact verifier (znippy_common::sign). Reused, not rewritten.
guest-host = { version = "0.2.1", default-features = false, features = ["verify-modules"] }
[dev-dependencies]
sha2 = "0.10"
wat = "1.258.3"
wit-component = "0.258.3"
wit-parser = "0.258.3"
proptest = "1.11"