Struct Host 

pub struct Host { /* private fields */ }

The wasmtime host: two engines (one per isolation mode) plus the shared state backend. One per process/worker.

Implementations

impl Host

pub fn new(trust: TrustPolicy) -> Result<Self>

A host backed by an in-memory store (the default; process-lifetime state). trust is the set of keys allowed to sign loadable filters (ADR 000006) — pass TrustPolicy::empty() only if you intend that nothing can load.

pub fn pooling_allocator_metrics(&self) -> Option<PoolingAllocatorMetrics>

Read-only residency metrics for the trusted (pooling) engine (wasmtime 46 PoolingAllocatorMetrics). A cheap, cloneable handle for perf probes / observability — not the hot path. unused_memory_bytes_resident() reports bytes kept resident for unused-but-warm pool slots (linear_memory_keep_resident, left at its default 0 here, so this is expected to read ~0); memories() / component_instances() report the live count. None if the trusted engine is not pooling (it always is here, so this returns Some).

pub fn with_backend(trust: TrustPolicy, kv: Arc<dyn KvBackend>) -> Result<Self>

A host backed by a caller-supplied store (e.g. RedbBackend for durability).

pub fn with_telemetry_sink(self, sink: Arc<dyn TelemetrySink>) -> Self

Set the telemetry sink (ADR 000009 observability stage). Filters loaded after this emit one span per on_request / on_response to sink; the default is NoopSink (observability off, zero cost). Builder style: Host::new(trust)?.with_telemetry_sink(sink). The sink is cloned into each filter at load, so set it before loading.

pub fn with_added_telemetry_sink(self, sink: Arc<dyn TelemetrySink>) -> Self

Add sink ALONGSIDE the current one (fan-out) instead of replacing it — the composition hook for wiring the OTLP export buffer (ADR 000040) next to whatever sink the caller already set. Same load-time rule as with_telemetry_sink: compose before loading filters.

pub fn load( &self, filter_id: &str, artifact: &SignedArtifact<'_>, opts: LoadOptions, ) -> Result<LoadedFilter>

Load a filter component under the given isolation mode. Type-checks and resolves imports up front (InstancePre). For Trusted, the single persistent instance is created now and init runs once; for Untrusted, instantiation is deferred to each request.

filter_id is the host-assigned identity used to namespace this filter’s keyspace (ADR 000011). It must be non-empty and free of the namespace delimiter; the filter never sees or controls it. Uniqueness is the caller’s responsibility: load rejects an empty or delimiter-bearing id but not a duplicate, so loading the same id twice shares one keyspace. A manifest-driven registry will assign and dedup ids (ADR 000007).