feat: port Rust core runtime by pgherveou · Pull Request #104 · paritytech/truapi

pgherveou · 2026-05-17T01:21:14Z

Summary

Umbrella 👉 #104 ports dotli onto the shared Rust TrUAPI core and makes the Rust crates the source of truth for protocol dispatch, generated product/client types, host capability bindings, auth/session state, permissions, SSO/signing orchestration, chainHead, preimage, theme, notification, and host-wasm plumbing.

Recent updates tighten the runtime permission model and lifecycle cleanup, generate the wasm host bridge from platform trait metadata, switch the JS host callback surface to namespaces, and update dotli to consume that surface.

Reviewable Stack

This PR is the cumulative view. Please review and merge the active child PRs bottom-up; the top child PR has the same tree as this umbrella branch.

feat(truapi): add testing API and versioned wiring #248 - layer 1/9, merged historical: truapi testing API and versioned wiring.
feat(truapi-platform): add host capability traits #249 - layer 2/9, merged historical: truapi-platform host capability traits.
feat(truapi-codegen): emit Rust dispatcher, wire table, and host callbacks #254 - layer 3/9, merged historical: codegen Rust dispatcher, wire table, and host callbacks.
feat(truapi-server): add host logic primitives #255 - layer 4/9, merged historical: server host logic primitives.
feat(truapi-server): add wire and chain infrastructure #256 - layer 5/9, merged historical: server wire and chain infrastructure.
feat(truapi-server): add platform runtime and host bridge #250 - active layer 1/4: server runtime, permissions, lifecycle, and permission-flow docs.
feat(codegen): generate wasm bridge callbacks #265 - active layer 2/4: generic wasm bridge/codegen layer.
feat(host-wasm): add @parity/truapi-host-wasm runtime #252 - active layer 3/4: @parity/truapi-host-wasm namespaced callback consumer.
chore: docs, CI, tooling, and dotli integration for the Rust core #253 - active layer 4/4, top: docs, CI/tooling, playground, and dotli integration.

This umbrella is the cumulative review target for the whole port; active child #253 is kept tree-equivalent with it.

Architecture

Vision: Shared Core SDK
Design: Shared Rust Core Host Architecture

Validation

cargo fmt --all --check
cargo check -p truapi-server
cargo test -p truapi-codegen golden_
cargo test -p truapi-server
cd js/packages/truapi-host-wasm && npm run build && npm test
make dev
cd hosts/dotli && bun run typecheck && bun run test

The remote top stack tree was verified equal to this umbrella tree locally before push.

socket-security · 2026-05-17T01:21:39Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/jsqr@1.4.0
	npm/@parity/truapi-host@0.1.0	N/A	N/A	N/A	N/A	N/A

View full report

@Suppress

Bug fixes: - Makefile uniffi target now writes Swift bindings through a tempdir and copies into the actual SwiftPM layout (Sources/TrUAPIHost/ for the .swift file, Sources/truapi_serverFFI/include/ for the C header and module.modulemap). Cdylib path picks .dylib on macOS. - electron provider: onClose sets disposed=true and clears listener sets so subsequent postMessage no-ops cleanly and close listeners don't fire twice if the caller also calls dispose(). - web worker provider: init-failure paths call worker.terminate() before rejecting so a failed core init doesn't leak the worker. - createWebSocketProvider: subscribe / subscribeClose use Set instead of Array+indexOf so double-registration of the same callback is idempotent (matches the other providers in the package). Test coverage: - New js/packages/truapi/test/ws-provider.test.mjs exercises the WS provider against a stubbed WebSocket constructor (queue+flush, fan-out, set semantics, close fan-out, post-after-close throws). Doc + style fixes: - docs/design/dotli-architecture-change.md describes featureSupported as a current callback with a planned removal, matching the platform trait and the host shells. The implementation-vs-doc contradiction is gone. - Migration narrative stripped from runtime.rs, wasm.rs, native.rs, host_logic/features.rs, the Kotlin shell, and the Swift shell. - Em-dashes swept from 18 PR-scope files (CLAUDE.md, both design docs, both native READMEs, the TS host packages, a few platform doc comments). - create-iframe-host.ts comment now describes current behaviour without referencing the "legacy fallback". - tests/object_safety.rs renamed to tests/bounds.rs with a docstring that matches what the test actually asserts (the trait isn't object-safe; the bound check is on Send + Sync + 'static). - iOS: drop dead `_ = self.callbackRetainer` line; explain the retainer in plain prose instead of via a no-op suppression. - Android: drop redundant @Suppress("unused") on a property that is read in init. Deferred to follow-up issues (#105-#111).

Harden the Rust core runtime and host SDKs against the review of the core port. No change to the wire protocol or the generated artifacts (codegen regenerates byte-identically; the committed WASM bundle is rebuilt). truapi-server: - Subscriptions use generation-stamped reservation slots: a reused or raced request_id stops-and-replaces instead of leaking an unstoppable stream, and a _stop arriving before activation cancels the pending subscription. Unregistered methods answer Unsupported instead of leaving the caller to hang. Dead negotiated_version slot and interrupt API removed. - chainHead-v1 runtime: single-flight follow setup (no duplicate or leaked remote subscriptions), the close-vs-insert race in request_value is closed so a caller can no longer hang forever, the pending follow-event buffer is bounded, and an orphaned remote follow is unfollowed when its local follow is torn down mid-setup. - WS bridge: constant-time token comparison, bounded inbound message size, bounded outbound queue and connection count, documented loopback trust model. - wasm surface registers a panic hook and surfaces non-boolean / non-string host returns as errors; permissions persist only genuine user decisions, so a transient prompt-callback error no longer locks a capability out; dotns classifies trailing-dot FQDNs and lowercases/de-dupes remote domains; navigate_to returns an error instead of panicking on a contract violation. - smoldot provider is wired into the runtime behind its feature (with a platform fallback), with finite json-rpc ceilings, a distinguishable reconnect error, and Apache-2.0 attribution (SPDX headers + THIRD_PARTY_NOTICES.md). - Tests: subscription-race regressions, malformed-frame drop, subscription lifecycle through the wire boundary, and a hardened Rust<->TS wire-table parity check (panics on unparseable ids, compares all four subscription ids, asserts a row-count floor). codegen: Rust dispatcher/wire-table emitters use writedoc!/formatdoc! (byte-identical output); TS host-callbacks handles bare trait-object returns. JS hosts: worker-runtime faults now reach close subscribers; the WebSocket provider is built on the shared close-once base provider; the electron provider detaches port listeners on remote close; new tests for the node WASM round-trip, WS error/non-binary/CLOSING paths, and the iframe handshake/origin/dispose paths. native: Android and iOS HostBridge document that callbacks fire on the truapi-ws-bridge worker thread; the iOS bootstrap uses a JSONEncoder-based JS string-literal escaper; Maven coordinates reconciled across build.gradle.kts, jitpack.yml, and the README. CI/docs: host-packages CI runs the host-shared smoke test against the freshly built WASM bundle and triggers on truapi-platform changes; the Makefile wasm target no longer hides the committed bundle; design docs and the truapi-platform README are reconciled to the shipped trait set.

pgherveou · 2026-06-12T03:43:44Z

Superseded by a 3-PR stack carved from this branch, each independently reviewable and green on CI:

feat(core): port Rust core runtime, codegen, and WASM host #210 — feat(core): Rust core runtime, codegen, and WASM host (base main). Smallest slice that runs the dotli playground diagnosis e2e.
feat(mobile): add iOS and Android UniFFI host packages #211 — feat(mobile): iOS + Android UniFFI host packages (base feat(core): port Rust core runtime, codegen, and WASM host #210).
docs: add design docs, RFCs, and refresh top-level docs #212 — docs: design docs, RFCs, and refreshed top-level docs (base feat(mobile): add iOS and Android UniFFI host packages #211).

Review bottom-up. Authored with assistance from Claude Code.

pgherveou · 2026-06-12T13:25:25Z

Follow-up update: PR #214 was merged back into this PR branch so the parent can run e2e, and #214 is now closed as superseded. Mobile host scaffolding/config/CI moved to child PR #215.

The truapi-ready/truapi-init handshake pairs with the WASM host's createIframeHost (#104). Keep sandbox.ts at base so merging to main does not break the deployed playground against the current host.

…igner, new review/storage variants)

…SO (2 tests parked pending #104/#264)

…ductRuntimeConfig, WasmPairingHostRuntime, mock.dot id)

pairing-host runtime

Publish the host runtime as @parity/truapi-host and move the dotli diagnosis harness into the playground repo.

…t-core-port # Conflicts: # rust/crates/truapi-codegen/tests/golden/host-callbacks-adapter.ts # rust/crates/truapi-codegen/tests/golden/host-callbacks.ts # rust/crates/truapi-codegen/tests/golden/worker-callbacks.ts # rust/crates/truapi-codegen/tests/golden_rust_emit.rs # rust/crates/truapi-server/src/lib.rs

Add wasm32 CI and make check coverage, avoid leaking signer callbacks, and reject compound codec callback boundaries during codegen.

Subscription and chain response callbacks re-enter the WASM core from the shared worker. If one of those callbacks panicked, the exception escaped the worker message handler and could terminate the shared worker for every tab.\n\nRoute those dispatches through guarded helpers that stop only the affected subscription or chain connection and report a non-fatal worker warning. Add unit coverage for both guarded paths.

Host callback streams previously logged iterator and Result errors and then stopped pumping, leaving the Rust subscription stream waiting forever. Add an explicit sendError sink beside sendItem for raw WASM subscriptions. Direct and worker-backed host callbacks now forward stream failures as GenericError values into the Rust platform stream, so products observe subscription errors instead of hanging.

The iframe host always transferred the capability MessagePort with targetOrigin "*", and the ready gate accepted "null" even for the default same-origin sandbox. That left the handoff relying only on the source-window check. Derive opaque-origin handling from the sandbox attribute. The default allow-same-origin sandbox now pins the port transfer to the product origin and rejects "null" ready messages; only explicitly opaque sandboxes keep the required "*" transfer path.

The sandbox iframe handshake had no product-side tests, accepted opaque init origins even when the parent origin was known, and tied the cached port handshake cleanup to the first caller's AbortSignal. That made the security boundary underspecified and overlapping startup calls fragile. Add focused sandbox handshake tests, reject mismatched init origins when the host origin is resolved, keep the data-free wildcard ready ping documented for hidden-origin browsers, and wrap the shared port promise with per-caller abort handling.

The release job pushed tags before publishing and used tag existence to decide idempotency. With checkout credentials disabled the plain git push could fail, and a pushed tag could make a failed downstream publish skip on retry. Resolve publish targets from npm registry state, attest packed tarballs, dispatch publish before release metadata, and create tags/releases idempotently with explicit GitHub token auth.

The signer-bot helper only scrubbed a literal mnemonic field, and the non-OK pair error included the raw response body. If the bot returns a seed, secret phrase, private key, or similar field, CI logs could expose it. Redact a normalized set of signer secret fields from JSON responses, keep a quoted-field fallback for malformed bodies, and reuse the redacted text when surfacing pair failures.

…t-core-port # Conflicts: # rust/crates/truapi-codegen/src/ts/host_callbacks.rs # rust/crates/truapi-codegen/tests/golden/host-callbacks-adapter.ts # rust/crates/truapi-server/src/lib.rs # rust/crates/truapi-server/src/wasm.rs

pgherveou requested a review from a team May 17, 2026 01:21

pgherveou mentioned this pull request May 17, 2026

Port Rust core (truapi-server + host runtime SDKs) from truapi_next prototype #96

Closed

pgherveou marked this pull request as draft May 17, 2026 16:22

pgherveou mentioned this pull request May 18, 2026

host-electron + host-web: small robustness items from PR review #111

Open

pgherveou changed the title ~~feat: port Rust core runtime from truapi_next prototype~~ feat: port Rust core runtime May 18, 2026

pgherveou mentioned this pull request May 20, 2026

refactor: small cleanups extracted from #96 prep work #124

Merged

This was referenced Jun 11, 2026

feat(core): port Rust core runtime, codegen, and WASM host #210

Closed

feat(mobile): add iOS and Android UniFFI host packages #211

Closed

docs: add design docs, RFCs, and refresh top-level docs #212

Closed

pgherveou closed this Jun 12, 2026

pgherveou reopened this Jun 12, 2026

pgherveou commented Jun 12, 2026

View reviewed changes

pgherveou mentioned this pull request Jun 12, 2026

Move playground iframe host integration #214

Closed

pgherveou force-pushed the worktree-issue-96-rust-core-port branch from 341366d to c5fb5c9 Compare June 14, 2026 09:29

This was referenced Jun 25, 2026

Port the dot.li web host to the shared TrUAPI Rust core paritytech/dotli-community#54

Draft

Playground e2e harness + SCALE codec additions #238

Merged

pgherveou changed the base branch from main to slim/js-playground-extract June 26, 2026 10:22

Base automatically changed from slim/js-playground-extract to main June 26, 2026 10:48

pgherveou force-pushed the worktree-issue-96-rust-core-port branch from a0793b9 to 5f03570 Compare June 28, 2026 10:00

pgherveou added 5 commits July 8, 2026 14:45

fix: harden login and preimage failures

27f420b

chore: update dotli error formatting

f6e4fc9

fix(runtime): simplify pairing statement outcome

c98684d

ci: refresh CI workflow config

319e867

ci: enforce codegen parity checks

1656382

decrypto21 added a commit that referenced this pull request Jul 8, 2026

fix(mock): port MockPlatform + through-core tests onto rewritten #104

ec4cab8

decrypto21 added a commit that referenced this pull request Jul 8, 2026

fix(host-wasm): adapt createMockHost to #104's host-callbacks

d8fc8f6

decrypto21 added a commit that referenced this pull request Jul 8, 2026

fix(mock): port MockPlatform to #104 API (connect [u8;32], preimage s…

8dd2e21

…igner, new review/storage variants)

decrypto21 added a commit that referenced this pull request Jul 8, 2026

feat(mock): in-process mock wallet + through-core, ported onto #104 S…

8937f64

…SO (2 tests parked pending #104/#264)

decrypto21 added a commit that referenced this pull request Jul 8, 2026

fix(host-wasm): port createMockHost + wasm-bridge test onto #104 (Pro…

c68127e

…ductRuntimeConfig, WasmPairingHostRuntime, mock.dot id)

decrypto21 added a commit that referenced this pull request Jul 8, 2026

feat(mock-e2e): browser E2E harness + createMockClient, ported onto #104

4fc7fec

pairing-host runtime

decrypto21 mentioned this pull request Jul 8, 2026

feat(mock-e2e): browser E2E harness + createMockClient testing export #261

Draft

6 tasks

pgherveou added 13 commits July 8, 2026 15:33

ci: refresh workflow pins

d0ef238

refactor: rename truapi host package

31dc8f1

Publish the host runtime as @parity/truapi-host and move the dotli diagnosis harness into the playground repo.

feat: tighten wasm size profile

a7bf860

refactor: remove flat host callbacks

4391181

test(host): cover worker permission auth

920ba81

fix(host-wasm): address review feedback

6989db6

Add wasm32 CI and make check coverage, avoid leaking signer callbacks, and reject compound codec callback boundaries during codegen.

pgherveou force-pushed the worktree-issue-96-rust-core-port branch from d37c86b to f341d5b Compare July 10, 2026 11:34

pgherveou added 2 commits July 10, 2026 15:14

fix(e2e): surface preimage authority failures

52fee3d

pgherveou force-pushed the worktree-issue-96-rust-core-port branch from 30f6d60 to 72094ac Compare July 10, 2026 13:49

pgherveou closed this Jul 10, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: port Rust core runtime#104

feat: port Rust core runtime#104
pgherveou wants to merge 138 commits into
mainfrom
worktree-issue-96-rust-core-port

pgherveou commented May 17, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented May 17, 2026 •

edited

Loading

Uh oh!

pgherveou commented Jun 12, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

pgherveou commented Jun 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

pgherveou commented May 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Reviewable Stack

Architecture

Validation

Uh oh!

socket-security Bot commented May 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pgherveou commented Jun 12, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

pgherveou commented Jun 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

pgherveou commented May 17, 2026 •

edited

Loading

socket-security Bot commented May 17, 2026 •

edited

Loading