Crate tensor_wasm_artifacts 

Unified content-addressed signed artifact store (roadmap feature #9).

Folds the JIT L2 disk cache (tensor-wasm-jit::cache::DiskCache) and the snapshot store (tensor-wasm-snapshot::SnapshotWriter/SnapshotReader) into one primitive: a content-addressed, HMAC-signed, on-disk byte blob keyed by BLAKE3 of the payload.

v0.3.7 status: scaffold

The trait + an in-memory impl + a disk impl land. Migration of the JIT cache and snapshot crate to use this store is a v0.4 follow-up; today they continue to use their own format. The new crate provides the reference shape both implementations will converge on.

Format

magic(16) || version(4) || content_hash(32) || zstd(payload) || hmac_tag(32)

The HMAC covers magic..end-of-zstd. Verification is constant-time via subtle::ConstantTimeEq. Key rotation: filenames include the first 8 bytes of blake3(hmac_key) so distinct keys partition the on-disk namespace cleanly.

Structs

ArtifactMetadata

Optional per-artifact metadata, stored as a serde-encoded sidecar next to the blob.

ContentHash

32-byte BLAKE3 content hash. The put path computes this from the uncompressed payload; the get path recomputes it from the decoded body and rejects on mismatch.

DiskArtifactStore

On-disk content-addressed signed artifact store.

InMemoryArtifactStore

In-memory artifact store. Intended for tests, fuzzers, and ephemeral caches.

RotatingKeyProvider

A rotation-aware key provider: one active (write) key plus an ordered list of additional keys accepted for reads only.

SingleKeyProvider

The default single-key provider: writes and reads under exactly one key. This is what DiskArtifactStore::new wraps the caller’s [u8; 32] in, so the historical single-key constructor keeps its exact behaviour (one active key, that same key the only accepted read key).

Enums

ArtifactError

Errors returned by ArtifactStore implementations.

Constants

ARTIFACT_HEADER_LEN

Length of the fixed header that precedes the zstd body: magic(16) || version(4) || content_hash(32).

ARTIFACT_HMAC_LEN

Length of the trailing HMAC tag (HMAC-SHA256 output size).

ARTIFACT_MAGIC

Magic bytes identifying a TensorWasm unified-artifact blob.

ARTIFACT_VERSION

On-disk schema version for the unified artifact envelope.

DEFAULT_ZSTD_LEVEL

Default zstd compression level. Matches tensor-wasm-snapshot’s DEFAULT_ZSTD_LEVEL so the two stores converge on the same setting.

MAX_DECOMPRESSED_LEN

Hard ceiling on the size of the decompressed body emitted by DiskArtifactStore::get.

MAX_PAYLOAD_LEN

Hard ceiling on the size of an individual payload accepted by DiskArtifactStore::put.

Traits

ArtifactStore

Artifact store trait. v0.3.7 ships an in-memory and a disk implementation.

KeyProvider

Supplies the signing material a DiskArtifactStore uses, abstracting over key rotation.

Functions

decode_envelope_from_bytes

Decode the unified artifact-store envelope from bytes, returning the inner payload after verifying the HMAC in constant time and the BLAKE3 content hash as defence-in-depth.

decode_envelope_from_bytes_with_cap

Decode the unified artifact-store envelope from bytes, like decode_envelope_from_bytes, but with a caller-supplied max_decompressed ceiling instead of the crate-wide MAX_DECOMPRESSED_LEN.

encode_envelope_to_vec

Encode payload into the unified artifact-store envelope (v0.4 snapshot default).