The WASM tier: WASI modules run by wasmtime on any runner (closes #75) 28cc603f737d

//! The WASM tier (spec §4.1, oxygenflow#75): a job's `exec` names a WASI

//! preview 1 module, or a glob of modules run one after another, which

//! wasmtime runs with the job's workspace at `/src` and nothing else: no

//! network, no other file of the runner. Every runner can offer it, and it

//! is the tier phones and browsers run (docs/handover.md).

//!

//! As in the syscall tier the module runs in a child of the runner

//! (`flow __wasm SPEC`), so the runner streams its output as it comes,

//! stops it at the time limit or when the run is cancelled, and measures

//! its memory the same way; wasmtime itself also holds it to the sandbox's

//! memory limit.

use crate::microvm::{Outcome, Sink};

use crate::syscall::{lines, self_hash, FAILED};

use anyhow::{bail, Context, Result};

use flow_core::api::Record;

use flow_core::{Environment, Job, MountSource, Sandbox};

use serde::{Deserialize, Serialize};

use std::path::{Path, PathBuf};

use std::sync::mpsc;

use std::time::{Duration, Instant};

/// The runtime, named in every receipt this tier writes.

pub const WASMTIME: &str = "49.0.4";

/// A line the helper writes to say something about the job itself (which

/// module starts), shown as the runner's own note rather than the job's.

const NOTE: &str = "\u{1e}N ";

/// The exit code for a module that trapped (crashed) rather than exiting.

const TRAPPED: i32 = 134;

/// What the helper runs, written by the runner for `flow __wasm`.

#[derive(Serialize, Deserialize)]

struct Spec {

    /// The job's files, preopened as `/src` (and as the current directory).

    workspace: PathBuf,

    /// The modules to run in turn, relative to the workspace.

    modules: Vec<String>,

    /// The arguments after the module.

    args: Vec<String>,

    env: Vec<(String, String)>,

    memory_mib: u32,

    /// The job's mounts: a directory of the runner and where the module sees it.

    preopens: Vec<(PathBuf, String)>,

}

/// The receipt environment of a job in this tier: the runtime and its

/// version, this runner's binary, the memory allowed, and every module run

/// with its hash, so the receipt says exactly what code ran.

pub fn environment(sandbox: &Sandbox, job: &Job, modules: &[(String, String)]) -> Environment {

    Environment {

        runtime: "wasm".into(),

        parts: vec![

            ("wasmtime".into(), WASMTIME.into()),

            ("flow".into(), self_hash().to_string()),

            ("memory_mib".into(), sandbox.memory_mib.to_string()),

        ]

        .into_iter()

        .chain(modules.iter().map(|(path, hash)| (format!("module {path}"), hash.clone())))

        .collect(),

        rootfs: String::new(),

        argv: job.exec.clone(),

        env: job.env.iter().map(|(k, v)| (k.clone(), v.clone())).collect(),

    }

}

/// The modules `program` names in `workspace`: one file, or the files a

/// glob matches (`*` in its last part only), sorted. A path may start with

/// `/src/`, where the module sees the workspace.

pub fn modules(workspace: &Path, program: &str) -> Result<Vec<String>> {

    let rel = program.strip_prefix("/src/").unwrap_or(program).trim_start_matches("./");

    if rel.is_empty() || rel.starts_with('/') || rel.split('/').any(|p| p == "..") {

        bail!("module {program:?}: give a path inside the job's files, such as target/wasm32-wasip1/debug/app.wasm");

    }

    let (dir, last) = rel.rsplit_once('/').unwrap_or(("", rel));

    if dir.contains('*') {

        bail!("module {program:?}: only the file name may hold `*`");

    }

    if !last.contains('*') {

        if !workspace.join(rel).is_file() {

            bail!("module {rel} is not among the job's files (its scope or an earlier job's artifact)");

        }

        return Ok(vec![rel.to_string()]);

    }

    let mut found: Vec<String> = std::fs::read_dir(workspace.join(dir))

        .with_context(|| format!("module {program:?}: the directory {dir} is not among the job's files"))?

        .filter_map(|e| e.ok())

        .filter(|e| e.file_type().is_ok_and(|t| t.is_file()))

        .filter_map(|e| e.file_name().into_string().ok())

        .filter(|name| wildcard(last, name))

        .map(|name| if dir.is_empty() { name } else { format!("{dir}/{name}") })

        .collect();

    found.sort();

    if found.is_empty() {

        bail!("no module matches {program:?}");

    }

    Ok(found)

}

/// Whether `name` matches `pattern`, where `*` stands for any run of characters.

fn wildcard(pattern: &str, name: &str) -> bool {

    let parts: Vec<&str> = pattern.split('*').collect();

    let (first, last) = (parts[0], parts[parts.len() - 1]);

    if parts.len() == 1 {

        return pattern == name;

    }

    if !name.starts_with(first) || !name[first.len()..].ends_with(last) || name.len() < first.len() + last.len() {

        return false;

    }

    let mut rest = &name[first.len()..name.len() - last.len()];

    for middle in &parts[1..parts.len() - 1] {

        match rest.find(middle) {

            Some(i) => rest = &rest[i + middle.len()..],

            None => return false,

        }

    }

    true

}

/// Run `job` in this tier with its files in `workspace` (as the syscall

/// tier lays them out); `scratch` holds the helper's spec and the job's

/// mounts.

pub fn run(sandbox: &Sandbox, job: &Job, workspace: &Path, scratch: &Path, timeout: Duration, sink: &mut dyn Sink) -> Result<Outcome> {

    if !job.secrets.is_empty() || !job.identities.is_empty() {

        bail!("job {}: the WASM tier takes no secrets or identities yet; run it in a microvm or syscall sandbox", job.name);

    }

    let Some(program) = job.exec.first() else { bail!("job {}: exec names no module", job.name) };

    let modules = modules(workspace, program)?;

    let hashed: Vec<(String, String)> =

        modules.iter().map(|m| Ok((m.clone(), crate::home::hash_file(&workspace.join(m))?))).collect::<Result<_>>()?;

    let environment = environment(sandbox, job, &hashed);

    let mut preopens = Vec::new();

    let mut disks = 0;

    for (i, m) in job.mounts.iter().enumerate() {

        let dir = match m.source {

            MountSource::Disk => {

                disks += 1;

                crate::syscall::disk_dir(scratch, disks - 1)

            }

            MountSource::Tmpfs => scratch.join(format!("tmpfs-{i}")),

        };

        std::fs::create_dir_all(&dir)?;

        preopens.push((dir, m.target.clone()));

    }

    let spec = Spec {

        workspace: workspace.to_path_buf(),

        modules,

        args: job.exec[1..].to_vec(),

        env: job.env.iter().map(|(k, v)| (k.clone(), v.clone())).collect(),

        memory_mib: sandbox.memory_mib,

        preopens,

    };

    let spec_path = scratch.join("wasm.json");

    std::fs::write(&spec_path, serde_json::to_vec(&spec)?)?;

    let started = Instant::now();

    let mut child = std::process::Command::new("/proc/self/exe")

        .arg("__wasm")

        .arg(&spec_path)

        .env_clear()

        .current_dir(scratch)

        .stdin(std::process::Stdio::null())

        .stdout(std::process::Stdio::piped())

        .stderr(std::process::Stdio::piped())

        .spawn()

        .context("start the WASM helper")?;

    let (tx, rx) = mpsc::channel::<(bool, Vec<u8>)>();

    let out = child.stdout.take().unwrap();

    let err = child.stderr.take().unwrap();

    let tx2 = tx.clone();

    let readers = [std::thread::spawn(move || lines(out, true, tx)), std::thread::spawn(move || lines(err, false, tx2))];

    let t = |s: &Instant| s.elapsed().as_millis() as u64;

    let (mut timed_out, mut cancelled, mut failed_to_start) = (false, false, false);

    let mut peak_memory_mib = None;

    let deadline = started + timeout;

    loop {

        if let Some(m) = crate::facts::peak_rss_mib(child.id()) {

            peak_memory_mib = Some(m);

        }

        match rx.recv_timeout(Duration::from_millis(200)) {

            Ok((stdout, line)) => {

                let text = String::from_utf8_lossy(&line).into_owned();

                let rec = |stream: &str, text: &str| Record { t: t(&started), stream: stream.into(), text: text.into() };

                if let Some(note) = text.strip_prefix(NOTE).filter(|_| !stdout) {

                    sink.record(rec("flow", note));

                } else if let Some(why) = text.strip_prefix(FAILED).filter(|_| !stdout) {

                    failed_to_start = true;

                    sink.record(rec("flow", &format!("the WASM tier could not run the job: {why}")));

                } else {

                    sink.record(rec(if stdout { "out" } else { "err" }, &text));

                }

            }

            Err(mpsc::RecvTimeoutError::Timeout) => {}

            Err(mpsc::RecvTimeoutError::Disconnected) => break,

        }

        if !timed_out && !cancelled && sink.cancelled() {

            cancelled = true;

            let _ = child.kill();

            sink.record(Record { t: t(&started), stream: "flow".into(), text: "stopped: the run was cancelled".into() });

        }

        if Instant::now() >= deadline && !timed_out && !cancelled {

            timed_out = true;

            let _ = child.kill();

            sink.record(Record {

                t: t(&started),

                stream: "flow".into(),

                text: format!("stopped at the time limit of {} s", timeout.as_secs()),

            });

        }

    }

    let status = child.wait()?;

    for r in readers {

        let _ = r.join();

    }

    let _ = std::fs::remove_file(&spec_path);

    let exit_code = status.code();

    if exit_code.is_none() && !timed_out && !cancelled && !failed_to_start {

        sink.record(Record {

            t: t(&started),

            stream: "flow".into(),

            text: format!("the WASM helper ended without an exit code ({status})"),

        });

    }

    Ok(Outcome {

        exit_code: if timed_out || cancelled { None } else { exit_code },

        duration_ms: t(&started),

        environment,

        timed_out,

        cancelled,

        peak_memory_mib,

        pruned: Vec::new(),

    })

}

/// `flow __wasm SPEC`: run the spec's modules in turn, each in a fresh

/// instance; the exit code is the first non-zero one, after all have run,

/// so one failing module does not hide another's results.

pub fn wasm_main(spec_path: &Path) -> i32 {

    match helper(spec_path) {

        Ok(code) => code,

        Err(e) => {

            eprintln!("{FAILED}{e:#}");

            125

        }

    }

}

/// wasmtime's own error, as this crate's: with its whole chain of causes.

fn ww<T>(r: wasmtime::Result<T>, what: impl FnOnce() -> String) -> Result<T> {

    r.map_err(|e| anyhow::anyhow!("{}: {e:#}", what()))

}

struct State {

    wasi: wasmtime_wasi::p1::WasiP1Ctx,

    limits: wasmtime::StoreLimits,

}

fn helper(spec_path: &Path) -> Result<i32> {

    let spec: Spec = serde_json::from_slice(&std::fs::read(spec_path)?).context("read the spec")?;

    let engine = ww(wasmtime::Engine::new(&wasmtime::Config::new()), || "start wasmtime".into())?;

    let mut linker: wasmtime::Linker<State> = wasmtime::Linker::new(&engine);

    ww(wasmtime_wasi::p1::add_to_linker_sync(&mut linker, |s: &mut State| &mut s.wasi), || "link WASI".into())?;

    let mut first_failure = 0;

    for path in &spec.modules {

        let code = run_module(&engine, &linker, &spec, path)?;

        if spec.modules.len() > 1 {

            eprintln!("{NOTE}{path}: exit {code}");

        }

        if first_failure == 0 && code != 0 {

            first_failure = code;

        }

    }

    Ok(first_failure)

}

fn run_module(engine: &wasmtime::Engine, linker: &wasmtime::Linker<State>, spec: &Spec, path: &str) -> Result<i32> {

    use wasmtime_wasi::{FsPerms, WasiCtxBuilder};

    if spec.modules.len() > 1 {

        eprintln!("{NOTE}running {path}");

    }

    let module = ww(wasmtime::Module::from_file(engine, spec.workspace.join(path)), || format!("module {path} does not load"))?;

    let name = path.rsplit('/').next().unwrap_or(path);

    let mut argv = vec![name.to_string()];

    argv.extend(spec.args.iter().cloned());

    let mut wasi = WasiCtxBuilder::new();

    wasi.inherit_stdout().inherit_stderr().args(&argv).envs(&spec.env).env("PWD", "/src").allow_blocking_current_thread(true);

    let open = |wasi: &mut WasiCtxBuilder, dir: &Path, at: &str| {

        ww(wasi.preopened_dir(dir, at, FsPerms::ReadWrite).map(|_| ()), || format!("open {} as {at}", dir.display()))

    };

    open(&mut wasi, &spec.workspace, "/src")?;

    // Relative paths resolve against the workspace too.

    open(&mut wasi, &spec.workspace, ".")?;

    for (dir, target) in &spec.preopens {

        open(&mut wasi, dir, target)?;

    }

    let limits = wasmtime::StoreLimitsBuilder::new().memory_size(spec.memory_mib as usize * 1024 * 1024).build();

    let mut store = wasmtime::Store::new(engine, State { wasi: wasi.build_p1(), limits });

    store.limiter(|s| &mut s.limits);

    let instance = ww(linker.instantiate(&mut store, &module), || format!("module {path} cannot start here"))?;

    let start =

        ww(instance.get_typed_func::<(), ()>(&mut store, "_start"), || format!("module {path} has no _start: is it a WASI command?"))?;

    Ok(match start.call(&mut store, ()) {

        Ok(()) => 0,

        Err(e) => match e.downcast_ref::<wasmtime_wasi::I32Exit>() {

            Some(exit) => exit.0,

            None => {

                eprintln!("{NOTE}{path} trapped: {e:#}");

                TRAPPED

            }

        },

    })

}

#[cfg(test)]

mod tests {

    use super::*;

    #[test]

    fn globs_match_names_with_stars() {

        assert!(wildcard("*.wasm", "oxy_core-1a2b.wasm"));

        assert!(wildcard("oxy_core-*.wasm", "oxy_core-1a2b.wasm"));

        assert!(!wildcard("oxy_core-*.wasm", "oxy_core-1a2b.d"));

        assert!(wildcard("a*b*c", "aXbYc") && !wildcard("a*b*c", "aXcYb"));

        assert!(wildcard("plain.wasm", "plain.wasm") && !wildcard("plain.wasm", "other.wasm"));

    }

    #[test]

    fn modules_are_files_of_the_job() {

        let dir = tempfile::tempdir().unwrap();

        let deps = dir.path().join("target/wasm32-wasip1/debug/deps");

        std::fs::create_dir_all(&deps).unwrap();

        for f in ["b-2.wasm", "a-1.wasm", "a-1.d"] {

            std::fs::write(deps.join(f), b"").unwrap();

        }

        let ws = dir.path();

        assert_eq!(

            modules(ws, "/src/target/wasm32-wasip1/debug/deps/*.wasm").unwrap(),

            ["target/wasm32-wasip1/debug/deps/a-1.wasm", "target/wasm32-wasip1/debug/deps/b-2.wasm"]

        );

        assert_eq!(modules(ws, "./target/wasm32-wasip1/debug/deps/b-2.wasm").unwrap(), ["target/wasm32-wasip1/debug/deps/b-2.wasm"]);

        assert!(modules(ws, "target/wasm32-wasip1/debug/deps/*.so").unwrap_err().to_string().contains("no module matches"));

        assert!(modules(ws, "../etc/passwd").is_err());

        assert!(modules(ws, "/etc/x.wasm").is_err());

        assert!(modules(ws, "target/*/debug/a.wasm").unwrap_err().to_string().contains("only the file name"));

    }

}

//! The WASM tier (oxygenflow#75): modules written as text, run by `flow

//! run` through wasmtime. Every machine offers the tier, so nothing is

//! skipped.

use std::path::Path;

use std::process::Command;

const IMPORTS: &str = r#"

  (import "wasi_snapshot_preview1" "fd_write" (func $fd_write (param i32 i32 i32 i32) (result i32)))

  (import "wasi_snapshot_preview1" "proc_exit" (func $proc_exit (param i32)))

  (import "wasi_snapshot_preview1" "path_open"

    (func $path_open (param i32 i32 i32 i32 i32 i64 i64 i32 i32) (result i32)))

  (import "wasi_snapshot_preview1" "args_sizes_get" (func $args_sizes_get (param i32 i32) (result i32)))

  (memory (export "memory") 1)

"#;

/// A module whose `_start` is `body`, with the WASI calls above.

fn module(dir: &Path, path: &str, data: &str, body: &str) {

    let text = format!("(module {IMPORTS} {data} (func (export \"_start\") (local $e i32) {body}))");

    let bytes = wat::parse_str(&text).unwrap_or_else(|e| panic!("{path}: {e}"));

    let file = dir.join(path);

    std::fs::create_dir_all(file.parent().unwrap()).unwrap();

    std::fs::write(file, bytes).unwrap();

}

/// Print the `len` bytes at 16 to fd `fd`.

fn print(fd: i32, len: i32) -> String {

    format!("(i32.store (i32.const 0) (i32.const 16)) (i32.store (i32.const 4) (i32.const {len})) (drop (call $fd_write (i32.const {fd}) (i32.const 0) (i32.const 1) (i32.const 8)))")

}

#[test]

fn wasi_modules_run_confined_in_the_wasm_tier() {

    let dir = tempfile::tempdir().unwrap();

    let home = dir.path().join("home");

    let work = dir.path().join("work");

    let tiers = Command::new(env!("CARGO_BIN_EXE_flow")).arg("--home").arg(&home).arg("tiers").output().unwrap();

    assert!(String::from_utf8_lossy(&tiers.stdout).contains("wasm"), "{}", String::from_utf8_lossy(&tiers.stdout));

    // Prints, and says how many arguments it had (2: its name and one).

    module(

        &work,

        "mods/hello.wasm",

        r#"(data (i32.const 16) "hello from wasm\n")"#,

        &format!(

            "{} (drop (call $args_sizes_get (i32.const 100) (i32.const 104))) (if (i32.ne (i32.load (i32.const 100)) (i32.const 2)) (then (call $proc_exit (i32.const 7))))",

            print(1, 16)

        ),

    );

    // Two modules under one glob: the first passes, the second exits 3.

    module(&work, "mods/each/a.wasm", r#"(data (i32.const 16) "module a\n")"#, &print(1, 9));

    module(&work, "mods/each/b.wasm", r#"(data (i32.const 16) "module b\n")"#, &format!("{} (call $proc_exit (i32.const 3))", print(2, 9)));

    // Creates a file in the workspace (preopen 3 is /src).

    module(

        &work,

        "mods/writer.wasm",

        r#"(data (i32.const 64) "made.txt") (data (i32.const 16) "made in wasm\n")"#,

        "(local.set $e (call $path_open (i32.const 3) (i32.const 0) (i32.const 64) (i32.const 8) (i32.const 9) (i64.const 0x1fffffff) (i64.const 0x1fffffff) (i32.const 0) (i32.const 200)))

         (if (local.get $e) (then (call $proc_exit (i32.const 10))))

         (i32.store (i32.const 0) (i32.const 16)) (i32.store (i32.const 4) (i32.const 13))

         (drop (call $fd_write (i32.load (i32.const 200)) (i32.const 0) (i32.const 1) (i32.const 8)))",

    );

    // Tries to create a file outside the workspace: refused, so it exits 0.

    module(

        &work,

        "mods/escape.wasm",

        r#"(data (i32.const 64) "../escaped")"#,

        "(local.set $e (call $path_open (i32.const 3) (i32.const 0) (i32.const 64) (i32.const 10) (i32.const 9) (i64.const 0x1fffffff) (i64.const 0x1fffffff) (i32.const 0) (i32.const 200)))

         (if (i32.eqz (local.get $e)) (then (call $proc_exit (i32.const 9))))",

    );

    // Asks for 512 MiB in a 256 MiB sandbox: refused, so it exits 0.

    module(

        &work,

        "mods/greedy.wasm",

        "",

        "(if (i32.ne (memory.grow (i32.const 8192)) (i32.const -1)) (then (call $proc_exit (i32.const 9))))",

    );

    module(&work, "mods/trap.wasm", "", "unreachable");

    std::fs::create_dir_all(work.join(".flow")).unwrap();

    std::fs::write(

        work.join(".flow/pipeline.kdl"),

        r#"schema-version 1

sandbox "w" {

    runtime "wasm"

    memory-limit "256MiB"

}

job "hello" {

    sandbox "w"

    exec "/src/mods/hello.wasm" "one"

}

job "each" {

    sandbox "w"

    exec "mods/each/*.wasm"

}

job "writer" {

    sandbox "w"

    exec "mods/writer.wasm"

}

job "escape" {

    sandbox "w"

    exec "mods/escape.wasm"

}

job "greedy" {

    sandbox "w"

    exec "mods/greedy.wasm"

}

job "trap" {

    sandbox "w"

    exec "mods/trap.wasm"

}

"#,

    )

    .unwrap();

    let run = Command::new(env!("CARGO_BIN_EXE_flow")).arg("--home").arg(&home).arg("run").current_dir(&work).output().unwrap();

    let out = String::from_utf8_lossy(&run.stdout).to_string() + &String::from_utf8_lossy(&run.stderr);

    for want in [

        "hello from wasm",

        "── hello passed",

        "running mods/each/a.wasm",

        "module a",

        "mods/each/b.wasm: exit 3",

        "── each failed (exit 3)",

        "── writer passed",

        "── escape passed",

        "── greedy passed",

        "mods/trap.wasm trapped",

        "── trap failed (exit 134)",

    ] {

        assert!(out.contains(want), "{want:?} not in:\n{out}");

    }

    assert!(!dir.path().join("escaped").exists() && !work.join("escaped").exists(), "a module wrote outside the workspace");

    assert_eq!(run.status.code(), Some(1), "two jobs failed:\n{out}");

}

- **The WASM tier (#75):** `runtime "wasm"` runs WASI preview 1 modules with wasmtime 49 on any runner (`flow tiers` offers `wasm` everywhere): no rootfs, no network, the job's files at `/src`, its mounts at their targets, the memory limit enforced by wasmtime. `exec` names a module or a glob of them (`target/wasm32-wasip1/debug/deps/*.wasm` runs each test binary in turn); the receipt names wasmtime's version and every module's hash. The tier phones and browsers will run (docs/handover.md). Secrets and identities are not offered in it yet.

- **cargo-nextest in the Rust image (#81):** for JUnit test reports beside `cargo llvm-cov`'s coverage.

name = "addr2line"

version = "0.26.1"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "59317f77929f0e679d39364702289274de2f0f0b22cbf50b2b8cff2169a0b27a"

dependencies = [

 "gimli",

]

[[package]]

[[package]]

name = "allocator-api2"

version = "0.2.21"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"

[[package]]

name = "ambient-authority"

version = "0.0.2"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "e9d4ee0d472d1cd2e28c97dfa124b3d8d992e10eb0a035f33f5d12e3a177ba3b"

[[package]]

name = "arbitrary"

version = "1.5.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "3bc62ac97cc33321f50863d514c3bc38a453947a8f9e781137e47c7401020aed"

name = "async-trait"

version = "0.1.92"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"

dependencies = [

 "proc-macro2",

 "quote",

 "syn 3.0.6",

]

[[package]]

 "cpufeatures 0.3.1",

version = "0.10.4"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"

dependencies = [

 "generic-array",

]

[[package]]

name = "block-buffer"

]

[[package]]

name = "bumpalo"

version = "3.20.3"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"

dependencies = [

 "allocator-api2",

]

[[package]]

name = "bytes"

version = "1.12.1"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"

[[package]]

name = "cap-primitives"

version = "4.0.3"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "8b5f74729fd2f44701d1a8eb47e906cdb3ccd9ec0f02baad85a744b791940b18"

dependencies = [

 "ambient-authority",

 "fs-set-times",

 "io-extras",

 "io-lifetimes 3.0.1",

 "ipnet",

 "maybe-owned",

 "rustix",

 "rustix-linux-procfs",

 "windows-sys 0.61.2",

 "winx",

name = "chacha20"

version = "0.10.2"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"

dependencies = [

 "cfg-if",

 "cpufeatures 0.3.1",

 "rand_core 0.10.1",

]

[[package]]

[[package]]

name = "cobs"

version = "0.3.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "0fa961b519f0b462e3a3b4a34b64d119eeaca1d59af726fe450bbba07a9fc0a1"

dependencies = [

 "thiserror 2.0.21",

]

name = "core_detect"

version = "1.0.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "7f8f80099a98041a3d1622845c271458a2d73e688351bf3cb999266764b81d48"

[[package]]

name = "cpp_demangle"

version = "0.5.1"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "0667304c32ea56cb4cd6d2d7c0cfe9a2f8041229db8c033af7f8d69492429def"

dependencies = [

 "cfg-if",

]

[[package]]

version = "0.2.17"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"

dependencies = [

 "libc",

]

[[package]]

name = "cpufeatures"

]

[[package]]

name = "cranelift-assembler-x64"

version = "0.136.4"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "c9c587da2696fbaa58e7a2fa2e5bfdd365d0928219f36992304ac1f15e5bc254"

dependencies = [

 "cranelift-assembler-x64-meta",

name = "cranelift-assembler-x64-meta"

version = "0.136.4"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "f28a60027b7556b680b051651291053ec381edf4ffbc01784997ae51a64269bb"

dependencies = [

 "cranelift-srcgen",

]

[[package]]

name = "cranelift-bforest"

version = "0.136.4"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "62bfdb846acebfd591d601994ea283c98d525ac0bc9a84ca3f2c36bcf5b69ff1"

dependencies = [

 "cranelift-entity",

 "wasmtime-internal-core",

]

[[package]]

name = "cranelift-bitset"

version = "0.136.4"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "aa9f8cc1080739d5f72b4ee7e00aff7d589f1284beaf0a19472c07878be7f299"

dependencies = [

 "serde",

 "serde_derive",

 "wasmtime-internal-core",

]

[[package]]

name = "cranelift-codegen"

version = "0.136.4"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "d85417d493ecec833b5134546b4a252c78cc0bd5be11729a35d25dcff9e4e70b"

dependencies = [

 "bumpalo",

 "cranelift-assembler-x64",

 "cranelift-bforest",

 "cranelift-bitset",

 "cranelift-codegen-meta",

 "cranelift-codegen-shared",

 "cranelift-control",

 "cranelift-entity",

 "cranelift-isle",

 "gimli",

 "hashbrown 0.17.1",

 "libm",

 "log",

 "postcard",

 "pulley-interpreter",

 "regalloc2",

 "rustc-hash",

 "serde",

 "serde_derive",

 "sha2 0.10.9",

 "smallvec",

 "target-lexicon",

 "wasmtime-internal-core",

]

[[package]]

name = "cranelift-codegen-meta"

version = "0.136.4"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "d01c8ed0098360bae69ad6b82952d4247516799ce8050d45ad168d6689f4eae6"

dependencies = [

 "cranelift-assembler-x64-meta",

 "cranelift-codegen-shared",

 "cranelift-srcgen",

 "heck",

 "pulley-interpreter",

]

[[package]]

name = "cranelift-codegen-shared"

version = "0.136.4"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "04f9b86d809cec9c4e88b201f1b3ed3b0347674c9ccfbb8c355228669e34be81"

[[package]]

name = "cranelift-control"

version = "0.136.4"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "ce182038fb10b719841e65fdf5deeee258c684f63439f5be680c2be059274b58"

dependencies = [

 "arbitrary",

]

[[package]]

name = "cranelift-entity"

version = "0.136.4"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "7bca812b03a7b942796391f25bc02aa70a1a007fee3ce2756490c788429e9c39"

dependencies = [

 "cranelift-bitset",

 "serde",

 "serde_derive",

 "wasmtime-internal-core",

]

[[package]]

name = "cranelift-frontend"

version = "0.136.4"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "a0c30563d2aef95e8d1a00a920199c99117b350339599f0e9487a7a1cf5d59de"

dependencies = [

 "cranelift-codegen",

 "hashbrown 0.17.1",

 "log",

 "smallvec",

 "target-lexicon",

]

[[package]]

name = "cranelift-isle"

version = "0.136.4"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "9c54184333a275698edb1d3bdff226131a25d47133d792aa716e47e32b8b7f05"

[[package]]

name = "cranelift-native"

version = "0.136.4"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "eb67a4c8a3180b5f1d77dffcd6317c05386ced42e5a31c7004523a9d99dc85c1"

dependencies = [

 "cranelift-codegen",

 "libc",

 "target-lexicon",

]

[[package]]

name = "cranelift-srcgen"

version = "0.136.4"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "b533db1679b4b728568bd490da6533cf50974c48a4d7534e78f1e0e02bc39769"

[[package]]

[[package]]

name = "crypto-common"

version = "0.1.7"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"

dependencies = [

 "generic-array",

 "typenum",

]

 "cpufeatures 0.3.1",

 "digest 0.11.3",

[[package]]

name = "digest"

version = "0.10.7"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"

dependencies = [

 "block-buffer 0.10.4",

 "crypto-common 0.1.7",

]

 "block-buffer 0.12.1",

 "crypto-common 0.2.2",

 "sha2 0.11.0",

[[package]]

name = "embedded-io"

version = "0.4.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "ef1a6892d9eef45c8fa6b9e0086428a2cca8491aca8f787c534a3d6d0bcb3ced"

[[package]]

name = "embedded-io"

version = "0.6.1"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "edd0f118536f44f5ccd48bcb8b111bdc3de888b58c74639dfb034a357d0f206d"

[[package]]

name = "encoding_rs"

version = "0.8.42"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "8e985e0451871ad22fb8d2b6b076e2028a502a0d3950998c2c5c0a4f9b5d9679"

dependencies = [

 "cfg-if",

 "core_detect",

 "multiversion_no_op",

 "rustversion",

 "scopeguard",

 "simdutf8",

]

 "wasmtime",

 "wasmtime-wasi",

 "wat",

[[package]]

name = "fnv"

version = "1.0.7"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"

name = "foldhash"

version = "0.2.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"

[[package]]

]

[[package]]

name = "fs-set-times"

version = "0.20.3"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "94e7099f6313ecacbe1256e8ff9d617b75d1bcb16a6fddef94866d225a01a14a"

dependencies = [

 "io-lifetimes 2.0.4",

 "rustix",

 "windows-sys 0.52.0",

]

[[package]]

name = "futures"

version = "0.3.34"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "9a31d2a3fbaaeb2af2368bbdd904aa8e812d3c04a1ee10d3171f52d556e5d0a3"

dependencies = [

 "futures-channel",

 "futures-core",

 "futures-io",

 "futures-sink",

 "futures-task",

 "futures-util",

]

[[package]]

name = "futures-channel"

version = "0.3.34"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "b1f9e3d69d39e4862ffed03ed071a76f9a13ba1d9109d355b0f0aa6b15e393c4"

dependencies = [

 "futures-core",

 "futures-sink",

]

[[package]]

name = "futures-core"

version = "0.3.34"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"

[[package]]

name = "futures-io"

version = "0.3.34"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "53c0fa8157de1303bfffdaa1cc2a673bfffb60102f76b0ef4441659124373fed"

[[package]]

name = "futures-sink"

version = "0.3.34"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "1944426bf7d03f1d14f708785e4b33efd750b36d48a157b836b3efc15ede8e1d"

[[package]]

name = "futures-task"

version = "0.3.34"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"

[[package]]

name = "futures-util"

version = "0.3.34"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"

dependencies = [

 "futures-channel",

 "futures-core",

 "futures-io",

 "futures-sink",

 "futures-task",

 "memchr",

 "pin-project-lite",

 "slab",

]

[[package]]

name = "generic-array"

version = "0.14.7"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"

dependencies = [

 "typenum",

 "version_check",

]

[[package]]

name = "gimli"

version = "0.33.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "0bf7f043f89559805f8c7cacc432749b2fa0d0a0a9ee46ce47164ed5ba7f126c"

dependencies = [

 "fnv",

 "hashbrown 0.16.1",

 "indexmap",

 "stable_deref_trait",

version = "0.16.1"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"

[[package]]

name = "hashbrown"

dependencies = [

 "foldhash",

 "serde",

 "serde_core",

]

name = "id-arena"

version = "2.3.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"

[[package]]

 "hashbrown 0.17.1",

 "serde",

 "serde_core",

]

[[package]]

name = "io-extras"

version = "0.19.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "20fd6de4ccfcc187e38bc21cfa543cb5a302cb86a8b114eb7f0bf0dc9f8ac00f"

dependencies = [

 "io-lifetimes 3.0.1",

 "windows-sys 0.52.0",

name = "io-lifetimes"

version = "2.0.4"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "06432fb54d3be7964ecd3649233cddf80db2832f47fec34c01f65b3d9d774983"

[[package]]

name = "io-lifetimes"

version = "3.0.1"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "2f0fb0570afe1fed943c5c3d4102d5358592d8625fda6a0007fdbe65a92fba96"

[[package]]

name = "ipnet"

version = "2.12.2"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "791930b43c0d5973160d90a8f3894509f2b273430f5c5c73b668636d0287c5c0"

[[package]]

[[package]]

name = "itertools"

version = "0.14.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"

dependencies = [

 "either",

]

 "cpufeatures 0.3.1",

name = "leb128"

version = "0.2.7"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "c83bff1d572d6b9aeef67ddfc8448e4a3737909cb28e81f97c791b9018703e52"

[[package]]

name = "leb128fmt"

version = "0.1.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"

[[package]]

[[package]]

name = "libm"

version = "0.2.16"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"

[[package]]

name = "mach2"

version = "0.6.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "dae608c151f68243f2b000364e1f7b186d9c29845f7d2d85bd31b9ad77ad552b"

[[package]]

name = "maybe-owned"

version = "0.3.4"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "4facc753ae494aeb6e3c22f839b158aebd4f9270f55cd3c79906c45476c47ab4"

name = "memfd"

version = "0.6.6"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "57804b2c9b69967f1536a56f86297e367a33b19e98852ed624b84551cdbc0d90"

dependencies = [

 "rustix",

]

[[package]]

 "unicode-width 0.1.14",

name = "mio"

version = "1.2.4"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "1788edb87fdc09c7e26304471e2f5be8cdefb1b6930d6e3985fc02ff53bf86ee"

dependencies = [

 "libc",

 "wasi",

 "windows-sys 0.61.2",

]

[[package]]

 "crypto-common 0.2.2",

name = "multiversion_no_op"

version = "1.0.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "743fb55ba31b18fb1ecef6bdc9aa2743314978ac084044301a7eee33fb99a20d"

[[package]]

name = "object"

version = "0.40.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "dd229a0361b9d0d4396176e02d65897f487eebeab7caa6d443855ee152ca0b9c"

dependencies = [

 "crc32fast",

 "hashbrown 0.17.1",

 "indexmap",

 "memchr",