@kamebara/wisy-engine-wasm

WebAssembly binding for the Wisy cryptographic engine, consumed by the web client (wisy-web). A thin wrapper over wisy-engine — it adds no cryptography, only marshalling.

npm install @kamebara/wisy-engine-wasm

Which entry point

One package, two builds, because "works in a bundler" is not one thing.

// Default. The wasm is an ordinary import and the bundler resolves it — webpack, rollup, and anything
// else that treats a .wasm as a module. Nothing to initialise.
import { WasmEngine, deriveChannelRef } from '@kamebara/wisy-engine-wasm'

// For anything that will not do that, and for a plain <script type="module">: fetch the wasm at
// runtime, once, before the first call.
import init, { WasmEngine } from '@kamebara/wisy-engine-wasm/web'
await init()

Webpack 5 loads the default build only with experiments.asyncWebAssembly turned on; /web needs no build configuration at all. The API is identical either way.

Boundary

• The opaque WasmEngine holds the Engine (identity key + held epoch keys) inside wasm linear memory. Nothing but ciphertext, signatures, and public metadata crosses to JS; free() (or Symbol.dispose) drops it and zeroizes the held keys.
• Compound values cross as plain JS objects via serde-wasm-bindgen: keys are camelCase, byte fields are Uint8Array, and numbers (epochNumber, pos, createdAt) are plain JS numbers.
• Every instant is a millisecond timestamp bounded by MAX_INSTANT, which is exactly Number.MAX_SAFE_INTEGER. createdAt, notBefore and notAfter all carry it: what the protocol accepts and what a JS number holds exactly are one value rather than two that drift. A larger one is refused by name; here it does not even cross, because serde-wasm-bindgen cannot represent it.
• Every fallible call throws a JS Error on failure, carrying the engine's fixed, secret-free message.

Compound params/returns are typed any in the generated .d.ts for now; the web client layers its own typed wrappers over this surface. The Rust DTOs in wisy_engine::types are the source shape.

Build

Key generation on wasm32-unknown-unknown routes to Web Crypto via getrandom's wasm_js backend, enabled by the wasm_js features in Cargo.toml (no extra build flag needed).

npm run build     # both targets -> bundler/ and web/
npm test          # wasm-pack test --node

bundler/ and web/ are build artifacts and are git-ignored; the committed package.json is the manifest the published package ships with. Releases run from .github/workflows/release-wasm.yml, on a wasm-v* tag.