Crate waf_wasm 

waf-wasm — a Proxy-Wasm plugin runtime that exposes a loaded .wasm filter as a waf_core::WafModule (BOUNDARY §1.7, B3). The runtime is OPEN; marketplace/signing is enterprise (§2.4).

Design (see ARCHITECTURE §9 and the B3 plan)

• Engine: wasmi (pure-Rust interpreter; no JIT/C). Pinned to the version the B3-0 probe validated for reentrant malloc + fuel + memory-cap traps.
• Model: the WAF is buffer-then-inspect on the request, so per request the host runs the Proxy-Wasm request-path callbacks in one shot (end_of_stream = true) and maps a captured proxy_send_local_response to a waf_core::Decision. The plugin never writes the response itself — the pipeline decides (detection-only safe).
• DoS posture: fuel reset per request (latency ceiling, not just kill-switch), a memory cap, no network/filesystem host calls. Any trap fails closed (Reject{500}).
• Subset: a declared set of host functions; everything else returns abi::Status::Unimplemented and is reported at boot (never a silent partial).

This crate isolates the wasmi dependency from the rest of the workspace: it depends only on waf-core (no cycle), and waf-proxy depends on it.

Re-exports

pub use report::ImportReport;

pub use runtime::WasmError;

pub use runtime::WasmModule;

pub use runtime::WasmOptions;

Modules

abi

Proxy-Wasm ABI constants (ABI v0.2.x).

host

HostState (the Store data) and the implemented subset of Proxy-Wasm host functions.

marshal

Pure (no-wasm) serialization between our request view and the Proxy-Wasm wire formats.

memory

Guest linear-memory access + the reentrant guest-allocator primitive.

report

Boot-time classification of a guest’s declared imports (policy D3=A: explicit coverage, never a silent partial). A missing import would make instantiation fail, so the loader STUBS every import it does not implement; this report says which were stubbed and — the load-bearing distinction (paletto #4) — whether any stub alters detection semantics.

runtime

The runtime: compile a Proxy-Wasm guest, drive its request-path lifecycle per request, and expose it as a WafModule. See ARCHITECTURE §9 and the B3 plan.