Add the universal WASIp2 Resource executor

Cargo.toml

@@ -2,7 +2,7 @@
 # `package.version` out of this file as the single source of truth for the
 # build, and a virtual root has no `[package]` to read.
 [workspace]
-members = ["crates/agent-spec", "crates/st2-resource-protocol", "crates/st2-wire", "crates/demo-resolver-wasm"]
+members = ["crates/agent-spec", "crates/st2-resource-protocol", "crates/st2-resource-wasip2", "crates/st2-wire", "crates/demo-resolver-wasm"]
 default-members = [".", "crates/agent-spec", "crates/st2-resource-protocol", "crates/st2-wire"]
 
 [package]

crates/st2-resource-protocol/src/lib.rs

@@ -719,7 +719,7 @@ pub struct Publication {
 }
 
 impl Publication {
-    fn validate(&self) -> Result<(), ProtocolError> {
+    pub fn validate(&self) -> Result<(), ProtocolError> {
         validate_topics(&self.topics)?;
         validate_facts(self.facts.as_deref().unwrap_or_default())
     }
@@ -742,6 +742,25 @@ pub enum ObservationResult {
     },
 }
 
+impl ObservationResult {
+    pub fn validate(&self) -> Result<(), ProtocolError> {
+        match self {
+            Self::Unchanged => Ok(()),
+            Self::Failed { diagnostic } => {
+                if let Some(diagnostic) = diagnostic
+                    && diagnostic.len() > MAX_OBSERVATION_DIAGNOSTIC_BYTES
+                {
+                    return Err(ProtocolError::ObservationDiagnosticTooLarge {
+                        actual: diagnostic.len(),
+                    });
+                }
+                Ok(())
+            }
+            Self::Published { publication } => publication.validate(),
+        }
+    }
+}
+
 #[derive(Deserialize)]
 #[serde(
     tag = "status",
@@ -1042,20 +1061,7 @@ fn validate_runtime_message(message: &RuntimeMessage) -> Result<(), ProtocolErro
             if *demand_watermark == 0 {
                 return Err(ProtocolError::InvalidDemandWatermark);
             }
-            match result {
-                ObservationResult::Unchanged => Ok(()),
-                ObservationResult::Failed { diagnostic } => {
-                    if let Some(diagnostic) = diagnostic
-                        && diagnostic.len() > MAX_OBSERVATION_DIAGNOSTIC_BYTES
-                    {
-                        return Err(ProtocolError::ObservationDiagnosticTooLarge {
-                            actual: diagnostic.len(),
-                        });
-                    }
-                    Ok(())
-                }
-                ObservationResult::Published { publication } => publication.validate(),
-            }
+            result.validate()
         }
     }
 }
@@ -1071,7 +1077,7 @@ fn validate_facts(facts: &[ResourceFact]) -> Result<(), ProtocolError> {
         .map_err(ProtocolError::InvalidFacts)
 }
 
-fn validate_topics(topics: &[String]) -> Result<(), ProtocolError> {
+pub fn validate_topics(topics: &[String]) -> Result<(), ProtocolError> {
     let mut unique = BTreeSet::new();
     for topic in topics {
         if topic.is_empty() {
@@ -1272,6 +1278,27 @@ mod tests {
         );
     }
 
+    #[test]
+    fn observation_result_validation_is_reusable_outside_line_framing() {
+        assert!(ObservationResult::Unchanged.validate().is_ok());
+        assert!(matches!(
+            ObservationResult::Failed {
+                diagnostic: Some("x".repeat(MAX_OBSERVATION_DIAGNOSTIC_BYTES + 1)),
+            }
+            .validate(),
+            Err(ProtocolError::ObservationDiagnosticTooLarge { .. })
+        ));
+        let mut invalid = publication(b"duplicate topic");
+        invalid.topics = vec!["same".to_owned(), "same".to_owned()];
+        assert!(matches!(
+            ObservationResult::Published {
+                publication: invalid,
+            }
+            .validate(),
+            Err(ProtocolError::InvalidTopics(_))
+        ));
+    }
+
     #[test]
     fn fact_wire_shape_distinguishes_omission_from_explicit_null() {
         let mut message = publish(b"fact");

crates/st2-resource-wasip2/Cargo.toml

@@ -0,0 +1,32 @@
+[package]
+name = "st2-resource-wasip2"
+version = "0.1.0"
+edition = "2024"
+description = "Wasmtime Component Model executor for typed st2 resource observations."
+license = "MIT"
+build = "build.rs"
+
+[dependencies]
+libc = { version = "0.2", optional = true }
+serde = { version = "1", features = ["derive"], optional = true }
+serde_json = "1"
+sha2 = { version = "0.10", optional = true }
+st2-resource-protocol = { path = "../st2-resource-protocol" }
+wasmtime = { version = "=48.0.1", optional = true, default-features = false, features = [
+    "component-model",
+    "cranelift",
+    "runtime",
+    "std",
+] }
+
+[dev-dependencies]
+tempfile = "3"
+wat = "1"
+
+[features]
+default = []
+runtime = ["dep:libc", "dep:serde", "dep:sha2", "dep:wasmtime"]
+
+[[test]]
+name = "executor"
+required-features = ["runtime"]

crates/st2-resource-wasip2/build.rs

@@ -0,0 +1,5 @@
+fn main() {
+    let target = std::env::var("TARGET").expect("Cargo always supplies TARGET to build scripts");
+    println!("cargo:rustc-env=ST2_WASIP2_TARGET={target}");
+    println!("cargo:rerun-if-env-changed=ST2_EXECUTOR_BUILD_IDENTITY");
+}

crates/st2-resource-wasip2/src/bindings.rs

@@ -0,0 +1,4 @@
+wasmtime::component::bindgen!({
+    path: "wit",
+    world: "provider",
+});