dx: development-friction debt — shared core crate, generated jco flags, guest wrappers, harness cleanups

[lann]

Every algorithm addition currently costs three implementations, two giant package.json flag lines, manifest entries, and vector suites. Reduce the recurring tax before the surface grows:

• Shared RustCrypto core crate. wasmtime-impl/src/host.rs and guest-impl/src/provider.rs duplicate ~500 lines near-verbatim — the Sha2 and AeadCipher enums, new_aes_gcm_key/new_chacha_key validation, nonce budgets, algorithm-name constants, even error-message strings (compare host.rs:148-224 with provider.rs:117-192). Extract the algorithm cores and minting validation into one crate consumed by both, leaving only bindings/resource-table plumbing per side. Today the conformance suite is the only thing keeping the two in sync, and its coverage has holes exactly where drift would hide (see the coverage-gaps issue).
• Generate the jco transpile flags from the WIT. Renaming an interface touches ~13 sites; the worst are the ~2,900-character --async-imports/--map one-liners duplicated with different contents in examples/jco-demo/package.json:9 and conformance/adapters/jco/package.json:8,11 — unreviewable in diffs, and a typo in an --async-imports string produces a silently-synchronous import and a runtime JSPI failure, not a build error.
• Guest-side convenience libraries. Every consumer re-implements the feed-a-stream-and-await pattern (futures::join! plumbing) to MAC 20 bytes; feed/read_all helpers are already copy-pasted across crypto-demo, timing-lab, and the conformance guests (e.g. examples/crypto-demo/src/lib.rs:554-582 vs timing-lab/src/lib.rs:179-189). Publish thin guest wrappers (Rust crate, JS package) with sign_bytes(&[u8])-style helpers so the correct pattern is written once. (Migrated from TODO.md.)
• Demo-harness and build-plumbing cleanups:
  • The expected-summary gate is self-referential — count and list derive from the same Vec (examples/crypto-demo/src/lib.rs:127-131), asserted identically in two drivers (examples/wasmtime-demo/tests/demo.rs:64-76, examples/jco-demo/src/run.mjs:26-36) and absent from the composed driver (examples/demo-driver/src/lib.rs:29-41). Deleting half the demo's checks passes every gate on every target. Pin an expected check list somewhere, or stop describing it as a gate (AGENTS.md cites it as the exemplar of "a gate asserts it").
  • Dead bindgen with: blocks — examples/wasmtime-demo/src/lib.rs:26-30 maps 3 of 6 resource types, conformance/adapters/wasmtime/src/main.rs:54-57 maps 2; both are dead configuration (imports come from add_to_linker) that misleads readers. Delete or make consistent.
  • The component-build recipe exists twice (examples/wasmtime-demo/tests/demo.rs:26-53 shells out to cargo + wasm-tools; examples/jco-demo/package.json build:component) with no gate against drift — and just build-component routes the pure-Rust build through npm, so just demo-wasmtime requires Node.
  • GNU timeout in recipes makes the justfile silently Linux-only; the 7-crate --exclude lists are hand-duplicated in two recipes (justfile:17, 37) with nothing checking they match members.

From the 2026-07 whole-repo review (convenience libraries migrated from TODO.md).

[lann]

PR #42 implements the first checklist item (the shared RustCrypto core crate, impl-core/), and fixes a drift bug the duplication had already caused — the #21 zeroize sweep missed the guest's MacKey, so HMAC key material in the in-guest provider was dropped unscrubbed until now. Not closing: the generated-jco-flags, guest-wrapper, and harness-cleanup items remain. Will tick the checkbox when it merges.

[lann]

PR #44 lands the guest-side convenience library (Rust): guest-sdk/ (lann-webcrypto-guest) with owned bindings (raw), generic newtypes over per-kind Raw* traits, and mint modules — dogfooded on crypto-demo (world shrinks to its export only; compiled component imports exactly what it calls). Remaining under this checkbox: migrate the conformance guests and timing-lab onto it (deletes the last feed/read_all copies); the JS guest package stays deferred until a JS-authored guest exists. PR #44 also deletes wasmtime-demo's dead bindgen with: block from the harness-cleanups item.

[lann]

PR #44 (updated) now fully integrates the guest library: crypto-demo and both conformance guests consume lann:webcrypto through lann-webcrypto-guest (worlds shrink to exports only, deps symlinks deleted), and every duplicated feed/read_all copy is removed. One documented exception: timing-lab keeps self-contained bindings — wasip3 0.7 pins wit-bindgen 0.57 (incompatible runtime with the library's 0.59), and the measurement harness wants its stream plumbing inline. When wasip3 catches up to the workspace's wit-bindgen, timing-lab (and the drivers) can migrate too.

[lann]

PR #57 reworks the Rust guest wrapper crate's public interface from external feedback (bindings/root-module restructure, DataSource inputs, stream returns, crate-owned error, docs). The guest-side convenience libraries checkbox stays open: the JS package half is still outstanding.

[lann]

Accuracy note on the guest-side convenience libraries box: it is half done, and the half that remains is the one that pays.

Published since this was filed:

• Rust: lann-webcrypto-guest (guest-sdk/) in Add lann-webcrypto-guest: guest-side bindings and byte-buffer wrappers #44, reworked from external feedback in guest-sdk: rework the public interface from external feedback #57.
• JS: componentize-sdk/webcrypto.js in JS WebCrypto-subset library for componentize-js guests, gated by WPT #56, gated by the vendored WPT suites.

Not done: migrating the consumers. futures::join! feed-and-await plumbing is still hand-rolled where the box says it is — examples/crypto-demo/src/lib.rs (6 sites, plus its own feed) and timing-lab/src/lib.rs (5 sites, plus its own read_all) — both of which import the SDK crate for bindings while bypassing its wrappers. The conformance guests are the ones that actually use them.

So the recurring tax this box is about is still being paid by two of the four consumers; leaving it open, with the note that the work left is migration rather than design.

Unaffected by #64: nothing in the demo-harness and build-plumbing bullet referenced the WPT component machinery, so those four sub-items stand as written. (#64 did delete just update-wpt-component, which is one fewer recipe in the justfile it complains about, but none of the specific findings there.)

[lann]

dx addition from #105: no aarch64 componentize-js toolchain is published — the componentize-js-toolchain workflow hardcodes ubuntu-latest/linux-x86_64 — so every componentize-path gate (test-webcrypto-componentize-wpt, wpt-parity) is unrunnable on arm64 dev boxes without the COMPONENTIZE_JS escape hatch (locally worked around by running the digest-verified x86_64 binary under Rosetta with the cross-libc loader). GitHub now offers free ubuntu-24.04-arm runners for public repos, so the fix is a platform matrix in the workflow plus recording the new digests with just update-toolchain-digest linux-aarch64.

[lann]

Status update from the simplification series (#110–#114, all merged):

• Guest-side convenience libraries — ticked. The wrappers exist and are consumed (lann-webcrypto-guest with DataSource; componentize-sdk on the JS side), and the copy-pasted feed plumbing this item cites is consolidated: the conformance guests share one generic runner in conformance-harness::stream (conformance: deduplicate the suites through the harness #110), and crypto-demo's nine helpers collapsed onto one local run_chunked (examples: collapse the demo's stream helpers and error assertions; one error spelling #114 — local deliberately: its chunking-invariance checks need per-check chunk sizes DataSource cannot express). The one remaining hand-rolled feed is timing-lab's, which is deliberate twice over: it is pinned to the wasip3 crate's older wit-bindgen (mixing runtimes in one component is unsupported), and the SDK's scratch-buffer feeder would sit inside the timed windows.
• Component-build recipe — resolved by test hosts: one wire-shape crate, one wasmtime embedding, clap, one composition recipe #112: build-component is now plain cargo + wasm-tools in the justfile (no npm on the Rust path, so just demo-wasmtime no longer requires Node), examples/jco-demo's build:component delegates to it, and the wasmtime-demo integration test shells to it. One definition, no drift to gate against.
• Dead bindgen with: blocks — already gone from both cited files (verified on main; both were rewritten in test hosts: one wire-shape crate, one wasmtime embedding, clap, one composition recipe #112 without them).
• Converted item 4's sub-bullets to checkboxes so the remainder is visible; still open: the jco transpile-flag generation, the self-referential expected-summary gate, and GNU timeout + the duplicated --exclude lists.

Related consolidation the series added beyond this list: conformance-report (one definition of the results/lockfile wire shapes across the Rust adapters and runner), wasmtime_webcrypto::standalone (the host setup the demo host and conformance adapter duplicated), one parameterized wac plug composition recipe, and impl_conversions! for the bindings glue both Rust implementations wrote by hand.