sausage/host/cred-script/README.md

Credential script guest (D58)

This host-internal WASI component runs credential validators and transforms in QuickJS. The host embeds script.wasm. It never exposes this component as a world program.

src/lib.rs ports v2's bounded jsrun evaluator. src/tests.rs preserves its tests unchanged. The vendored compatibility patches and licenses remain in vendor/. vendor/PATCHES.md explains the compatibility fixes and memory-error classification.

Rebuild the checked-in component from the repository root:

CARGO_TARGET_DIR="$PWD/target/cred-guest" nix develop -c nu host/cred-script/build.nu

The script sets CARGO_BUILD_JOBS=2 and uses the locked, separate guest workspace. The development shell supplies the WASI C compiler and Rust target.

Run the unchanged evaluator tests natively:

CARGO_BUILD_JOBS=2 CARGO_TARGET_DIR="$PWD/target/cred-guest" nix develop -c cargo test --manifest-path host/cred-script/Cargo.toml --release --all-targets --locked

These tests use optimized C and Rust code, like the shipped guest. Native debug builds exceed the 16 KiB interpreter stack.

The JSON protocol accepts one source module, input, export name, and two limits. The reply contains a JSON result or a static error category. Script exception text never leaves the guest. The guest owns its input in zeroizing buffers before the QuickJS boundary.

The host compiles the component once and caches its compiled code. Construct cred::quickjs::QuickJs::default() at startup and reuse it through cred::script::Script. The injection API does not change. Each call uses a fresh Store with linear memory limited to the clamped heap plus 8 MiB. The margin covers the Rust stack, WASI adapter, and protocol buffers. Only two evaluations run concurrently. Queue time counts against the deadline. Epoch callbacks check each call's deadline independently.

The guest receives no directories, environment variables, or network access. Its wall clock returns zero. Its random sources use a fixed seed. Its monotonic clock serves the evaluator's internal budget only. JavaScript receives no clocks, random function, module loader, or host interfaces. Error.prepareStackTrace is disabled and immutable. Errors retain plain stack strings.