@corbet-labs/ccht 0.1.0

package/README.md

@@ -0,0 +1,185 @@
+# ccht
+
+Reusable conversations for Rust applications, terminals and web frontends.
+**ccht** keeps the conversation model in Rust and compiles
+that same model to Wasm. Native hosts connect to installed agents using the
+[official ACP Rust SDK](https://github.com/agentclientprotocol/rust-sdk).
+
+```text
+Web UI ── @corbet-labs/ccht (Wasm) ── application transport/storage
+                                              │
+TUI / native UI ── ccht::Conversation ── ccht::native ── upstream ACP agent
+```
+
+The library owns structured conversation events, ordered replay, native sessions,
+streaming, cancellation and permission requests. Your application owns its UI,
+instructions, context, tools, user authorization, storage and HTTP/WebSocket/SSE
+transport. No Corbet-specific prompts or database are required.
+
+Agent reasoning, tools, authentication and protocol translation remain upstream.
+ccht does not implement an agent loop, read provider credentials, install agents,
+call paid model HTTP APIs or select an API-key fallback.
+
+## Rust
+
+```toml
+[dependencies]
+ccht = "0.1"
+tokio = { version = "1", features = ["macros", "rt-multi-thread"] }
+```
+
+`native` is the default feature. For the portable model alone:
+
+```toml
+ccht = { version = "0.1", default-features = false }
+```
+
+```rust
+use ccht::{Conversation, Event, WireEvent, acp};
+
+let mut conversation = Conversation::new("workspace/creator");
+conversation.apply(WireEvent::new(
+    "workspace/creator", "turn-1", 1,
+    Event::Update {
+        update: acp::SessionUpdate::AgentMessageChunk(
+            acp::ContentChunk::new("Hello".into()),
+        ),
+    },
+)).unwrap();
+assert_eq!(conversation.turns()[0].text, "Hello");
+```
+
+[examples/native.rs](source/examples/native.rs) shows streaming from an explicitly
+supplied installed ACP executable. It requires native agent authentication already
+configured by the operator. Use `codex-acp`, `claude-agent-acp`, or `opencode acp`
+as separate, reviewed runtime installations. Generic ACP executables also work.
+No agent/runtime is bundled in the crate or browser package.
+
+`NativeClient::connect` initializes the protocol. Create a session with its working
+directory, explicit model (if desired) and application MCP servers. Take the event
+receiver before prompting and consume it concurrently with the prompt future.
+A session accepts one active prompt; another returns `Busy`. Different sessions
+have separate streams and permission identities. History load/resume and model
+selection require the agent's advertised capabilities; unsupported requests fail.
+
+Permissions default to denial. Applications that opt into asking must render the
+request, check their authority and respond with one of the advertised choices.
+A permission callback is not a sandbox: agent-owned tools may have separate runtime
+policy. Configure filesystem/network confinement in the host for your use case.
+ccht advertises no client filesystem or terminal capabilities.
+
+Cancellation asks the upstream agent to stop. If it does not stop within the
+configured shutdown timeout, ccht closes the SDK connection, affecting **all**
+sessions on that connection. Dropping an active prompt also closes its connection.
+Use one connection per independent workload when cancellation must be isolated.
+Bounded event channels fail explicitly on an unresponsive consumer.
+
+`AgentCommand::with_working_directory` sets the actual agent startup directory
+using installed Linux/macOS `env` launchers. Windows currently reports this helper
+as unsupported because the SDK launch configuration lacks a startup-directory
+field. Session cwd alone does not constrain files read during agent startup.
+Linux is covered by process-level tests; macOS support is source-reviewed.
+
+ACP enables `serde_json`'s `preserve_order` feature through Cargo feature
+unification. Applications that hash or sign JSON must explicitly canonicalize
+object keys; depending on a `Value` map's incidental iteration order is unsafe.
+
+## Browser
+
+```sh
+npm install @corbet-labs/ccht
+```
+
+```js
+import { createConversation } from '@corbet-labs/ccht';
+// Vite example: emit the Wasm as a separately replaceable asset.
+import wasmUrl from '@corbet-labs/ccht/ccht_bg.wasm?url';
+
+const conversation = await createConversation('workspace/creator', { wasm: wasmUrl });
+// After your authenticated application transport delivers a ccht WireEvent:
+const snapshot = conversation.applyEvent(event);
+render(snapshot.turns);
+// When the view is destroyed:
+conversation.free();
+```
+
+Without an explicit `wasm` option, initialization loads `wasm/ccht_bg.wasm`
+relative to the generated module. A browser cannot launch native processes: its
+application server or desktop host runs `ccht::native`. The package makes no
+network connection apart from loading its Wasm module. The host decides which
+backend is available and how users authenticate to the application.
+
+## Event and persistence contract
+
+`WireEvent` version 1 contains `conversation_id`, `request_id`, a per-request
+`sequence` starting at 1, and `event`. Retain the original structured ACP updates:
+text, non-text content, tool calls, thought chunks, plans, permissions and errors
+are distinct. The model returns a serializable snapshot for your renderer.
+
+Assign identities and sequences on a trusted application host. Never let a browser
+select another user's conversation without server-side authorization. Sequence
+numbers are **not** SSE cursors or database row IDs. The app stores its own event
+log and replays each request in order. Already-applied sequences are ignored;
+gaps, a different conversation, malformed events and new events after completion
+fail without mutating state. Delivery identity must not be reused for another turn.
+
+A model holds at most 256 turns, 8 MiB per turn and 1 MiB per event. Applications
+should page long histories into separate models and limit streamed inputs before
+parsing them. Durable transcript storage and reconnection are application concerns;
+a serialized snapshot is a render result, not a native-agent session checkpoint.
+
+Namer is the first integration: Creator/Critic have independent conversation
+scopes, durable application events, authenticated SSE and cancellation. Its queue
+uses a fresh native session per turn with bounded role history supplied by Namer.
+CareerVector's TUI reuses the native session API while keeping CV tools, prompts
+and revision checks in its own code. Explicit local inference can emit the same
+`WireEvent` contract through an application-owned backend.
+
+## Building the Wasm package
+
+Use Rust with `wasm32-unknown-unknown` installed. The checked-in generator uses the
+same exact `wasm-bindgen` version as the Rust crate; no global Wasm CLI is required.
+
+```sh
+cargo build --locked --release --no-default-features --features web --target wasm32-unknown-unknown
+cargo run --locked --release -p ccht-wasm-bundle -- target/wasm32-unknown-unknown/release/ccht.wasm web/wasm
+```
+
+Published browser archives include the corresponding Rust source and generator
+under `source/`, original notices, and the full locked dependency sources in
+`source/dependencies.tar.gz`. Cargo's vendor checksums are preserved inside that
+archive. To rebuild from the distributed package, extract it inside `source/`:
+
+```sh
+cd source
+tar -xzf dependencies.tar.gz
+cargo build --locked --offline --release --no-default-features --features web --target wasm32-unknown-unknown
+cargo run --locked --offline --release -p ccht-wasm-bundle -- target/wasm32-unknown-unknown/release/ccht.wasm ../wasm
+```
+
+The supplied `.cargo/config.toml` uses only those vendored sources. The installed
+Rust toolchain must include the Wasm target and linker. CI rebuilds this kit with
+an empty Cargo cache and tests the replacement module through the same npm API.
+Keep that exported interface compatible when replacing the library.
+
+CI verifies the portable Rust model, actual Wasm compilation and packaged Node
+consumer, native protocol/process fixtures, dependency notices and an independent
+Rust crate consumer. Native fixtures do not call a model or access an account.
+Live runtime support must additionally be checked against the installed agent,
+its advertised capabilities, login state and execution policy.
+
+## License
+
+ccht is **LGPL-3.0-only**. See [LICENSE.md](LICENSE.md) and
+[THIRD-PARTY.md](THIRD-PARTY.md). Applications may use different licenses while
+preserving the LGPL library rights. Distributing a combined Rust binary requires
+a compliant relinking route; making source available somewhere is not by itself
+sufficient. Keep the browser's Wasm replaceable and provide its corresponding
+source and notices. Review the complete license for your distribution method.
+
+ACP and an account's subscription do not guarantee a billing mode. The operator
+must configure the native agent/account and disable unwanted paid usage. Known
+ambient API-key variables are cleared at launch and explicit API-key overrides
+are rejected, but ccht cannot attest saved agent credentials or account billing
+settings. Native runtimes and hosted services retain their own terms; a library
+license does not authorize pooling subscriptions or product-specific login flows.

package/THIRD-PARTY.md

@@ -0,0 +1,45 @@
+# Third-party components
+
+ccht uses the official `agent-client-protocol` Rust SDK and
+`agent-client-protocol-schema` under Apache-2.0. `wasm-bindgen` and the generated
+binding toolchain retain their MIT/Apache-2.0 grants. The exact locked dependency
+inventory is generated by `.ci/license_inventory.py`; browser distributions carry
+original dependency notices in `LICENSES/dependencies/`.
+No Zed editor source is included. Zed's external-agent architecture is a reference;
+its GPL editor code is not relicensed by ccht's LGPL grant.
+
+External runtimes are separately supplied by the operator:
+
+| Runtime | Source license / terms |
+| --- | --- |
+| Codex ACP adapter and Codex | Apache-2.0; OpenAI account/service terms remain applicable |
+| OpenCode | MIT; configured provider/account terms remain applicable |
+| Claude ACP adapter | Apache-2.0 wrapper; the Claude Agent SDK/runtime has separate proprietary Anthropic terms |
+
+ccht does not redistribute these executables. Preserve their original notices and
+comply with their runtime and service conditions when packaging them yourself.
+Do not infer permission to offer a customer-facing subscription login or pooled
+account service from the wrapper's permissive license.
+
+Upstream sources: [ACP SDK](https://github.com/agentclientprotocol/rust-sdk),
+[Codex ACP](https://github.com/agentclientprotocol/codex-acp),
+[Claude ACP](https://github.com/agentclientprotocol/claude-agent-acp),
+[OpenCode](https://github.com/anomalyco/opencode),
+[wasm-bindgen](https://github.com/wasm-bindgen/wasm-bindgen).
+
+The published ACP SDK and derive 2.1.0, ACP schema 1.7.0, defmt-parser 1.0.0,
+wasm-encoder 0.245.1, and wasmparser 0.245.1 archives omit their repositories'
+root license files. Their unchanged original notices are retained under
+`.ci/upstream-notices/<package>-<version>/` for inclusion in browser artifacts.
+This preserves Zed's copyright notices, both defmt license alternatives, and all
+three wasm-tools license alternatives, including the LLVM exception.
+
+The r-efi 6.0.0 archive already includes its full MIT grant, copyright notices,
+and Apache-2.0/LGPL-2.1-or-later alternative notices in `AUTHORS`. That unchanged
+file is also retained as a supplemental notice because its filename is outside
+the usual `LICENSE`/`NOTICE` convention. All these notices were verified against
+the exact upstream revisions recorded in the published crates'
+`.cargo_vcs_info.json`; their crate archive checksums match `Cargo.lock`.
+[Notice provenance](.ci/upstream-notices/PROVENANCE.json) records immutable source
+URLs, revisions, upstream paths, Git blob hashes, and SHA-256 hashes. No upstream
+implementation source or license alternatives were modified.

package/index.d.ts

@@ -0,0 +1,47 @@
+/** Upstream ACP payloads are preserved; applications can narrow their supported kinds. */
+export interface AcpUpdate { sessionUpdate: string; [key: string]: unknown }
+export interface AcpToolCall { toolCallId: string; title: string; status?: string; [key: string]: unknown }
+export interface PermissionRequest {
+  sessionId: string;
+  toolCall: { toolCallId: string; [key: string]: unknown };
+  options: Array<{ optionId: string; name: string; kind: string }>;
+  [key: string]: unknown;
+}
+export type CchtEvent =
+  | { kind: 'update'; update: AcpUpdate }
+  | { kind: 'permission'; request_id: string; request: PermissionRequest }
+  | { kind: 'completed'; stop_reason: string }
+  | { kind: 'error'; code: string; message: string };
+export interface WireEvent {
+  version: 1;
+  conversation_id: string;
+  request_id: string;
+  sequence: number;
+  event: CchtEvent;
+}
+export interface TurnState {
+  request_id: string;
+  last_sequence: number;
+  text: string;
+  user_text: string;
+  user_content: Array<Record<string, unknown>>;
+  thought_text: string;
+  thought_content: Array<Record<string, unknown>>;
+  content: Array<Record<string, unknown>>;
+  tools: Record<string, AcpToolCall>;
+  permissions: Array<{ request_id: string; request: PermissionRequest }>;
+  updates: Record<string, unknown>;
+  status: 'streaming' | 'awaiting_permission' | 'completed' | 'cancelled' | 'refused' | 'failed';
+  stop_reason: string | null;
+  error: { code: string; message: string } | null;
+}
+export interface ConversationSnapshot { conversation_id: string; turns: TurnState[] }
+export interface Conversation {
+  applyEvent(event: WireEvent | string): ConversationSnapshot;
+  snapshot(): ConversationSnapshot;
+  free(): void;
+}
+/** Transport/authentication and persistence belong to the embedding application. */
+export function createConversation(conversationId: string, options?: {
+  wasm?: URL | string | Request | Response | BufferSource | WebAssembly.Module;
+}): Promise<Conversation>;

package/index.js

@@ -0,0 +1,28 @@
+// @ts-self-types="./index.d.ts"
+import initialize, { ConversationModel } from './wasm/ccht.js';
+
+let initialization;
+
+/** Initialize the shared Rust/Wasm model. Supply an explicit Wasm URL when bundling. */
+export async function createConversation(conversationId, options = {}) {
+  if (!initialization) {
+    initialization = initialize(options.wasm === undefined ? undefined : { module_or_path: options.wasm })
+      .catch((error) => { initialization = undefined; throw error; });
+  }
+  await initialization;
+  const model = new ConversationModel(conversationId);
+  let disposed = false;
+  const snapshot = () => {
+    if (disposed) throw new Error('ccht conversation has been freed');
+    return JSON.parse(model.snapshot());
+  };
+  return {
+    applyEvent(event) {
+      if (disposed) throw new Error('ccht conversation has been freed');
+      model.applyEvent(typeof event === 'string' ? event : JSON.stringify(event));
+      return snapshot();
+    },
+    snapshot,
+    free() { if (!disposed) { disposed = true; model.free(); } },
+  };
+}

package/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@corbet-labs/ccht",
+  "version": "0.1.0",
+  "description": "Reusable conversations for your applications, powered by the shared Rust/Wasm model",
+  "license": "LGPL-3.0-only",
+  "type": "module",
+  "main": "./index.js",
+  "types": "./index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./index.d.ts",
+      "import": "./index.js"
+    },
+    "./ccht_bg.wasm": "./wasm/ccht_bg.wasm"
+  },
+  "files": [
+    "index.js",
+    "index.d.ts",
+    "wasm/",
+    "source/",
+    "LICENSE",
+    "LICENSE.md",
+    "LICENSES/",
+    "README.md",
+    "THIRD-PARTY.md"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/corbet-labs/ccht.git"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "sideEffects": false,
+  "gitHead": "340b9c2d41c77c2c1448666ddad8cd28307517bd"
+}

package/source/.cargo/config.toml

@@ -0,0 +1,5 @@
+[source.crates-io]
+replace-with = "vendored-sources"
+
+[source.vendored-sources]
+directory = "vendor"

package/source/.ci/upstream-notices/PROVENANCE.json

@@ -0,0 +1,198 @@
+{
+  "schema_version": 1,
+  "verification": "Archive SHA-256 matches Cargo.lock; revision matches the published .cargo_vcs_info.json; unchanged notice bytes match the exact upstream Git blob.",
+  "packages": [
+    {
+      "package": "agent-client-protocol",
+      "version": "2.1.0",
+      "license_expression": "Apache-2.0",
+      "crate_archive_url": "https://static.crates.io/crates/agent-client-protocol/agent-client-protocol-2.1.0.crate",
+      "crate_archive_sha256": "6395d81d91fd2ee93f48ea31cfc511356e75b9061ca0389cefd0308507cc11ba",
+      "repository": "https://github.com/agentclientprotocol/rust-sdk",
+      "revision": "726c5030bfaa88cfdac2fb1f71a63abb331ce586",
+      "path_in_vcs": "src/agent-client-protocol",
+      "files": [
+        {
+          "path": "agent-client-protocol-2.1.0/LICENSE",
+          "upstream_path": "LICENSE",
+          "url": "https://raw.githubusercontent.com/agentclientprotocol/rust-sdk/726c5030bfaa88cfdac2fb1f71a63abb331ce586/LICENSE",
+          "git_blob_sha1": "c24b053560354d8261d5132edaa3d30b2d1cb1f3",
+          "sha256": "6ed4f049cce59e05197d585bdf8a39980b45d546d6ea718ee344555f3a867c3a",
+          "bytes": 10783,
+          "present_in_published_crate": false
+        }
+      ]
+    },
+    {
+      "package": "agent-client-protocol-derive",
+      "version": "2.1.0",
+      "license_expression": "Apache-2.0",
+      "crate_archive_url": "https://static.crates.io/crates/agent-client-protocol-derive/agent-client-protocol-derive-2.1.0.crate",
+      "crate_archive_sha256": "7e8d5f32208cdc11238004bec4e4229d68fb937598f900e153468ca084865fa5",
+      "repository": "https://github.com/agentclientprotocol/rust-sdk",
+      "revision": "726c5030bfaa88cfdac2fb1f71a63abb331ce586",
+      "path_in_vcs": "src/agent-client-protocol-derive",
+      "files": [
+        {
+          "path": "agent-client-protocol-derive-2.1.0/LICENSE",
+          "upstream_path": "LICENSE",
+          "url": "https://raw.githubusercontent.com/agentclientprotocol/rust-sdk/726c5030bfaa88cfdac2fb1f71a63abb331ce586/LICENSE",
+          "git_blob_sha1": "c24b053560354d8261d5132edaa3d30b2d1cb1f3",
+          "sha256": "6ed4f049cce59e05197d585bdf8a39980b45d546d6ea718ee344555f3a867c3a",
+          "bytes": 10783,
+          "present_in_published_crate": false
+        }
+      ]
+    },
+    {
+      "package": "agent-client-protocol-schema",
+      "version": "1.7.0",
+      "license_expression": "Apache-2.0",
+      "crate_archive_url": "https://static.crates.io/crates/agent-client-protocol-schema/agent-client-protocol-schema-1.7.0.crate",
+      "crate_archive_sha256": "ca98360c7bb8cc97d7acd49e2a8a851c3f7bee6b2f0535036d8ab86b5fcd223d",
+      "repository": "https://github.com/agentclientprotocol/agent-client-protocol",
+      "revision": "272bf799f35a258c6a4107a0410ed361e83683d3",
+      "path_in_vcs": "agent-client-protocol-schema",
+      "files": [
+        {
+          "path": "agent-client-protocol-schema-1.7.0/LICENSE",
+          "upstream_path": "LICENSE",
+          "url": "https://raw.githubusercontent.com/agentclientprotocol/agent-client-protocol/272bf799f35a258c6a4107a0410ed361e83683d3/LICENSE",
+          "git_blob_sha1": "1de02305f81f6dc087b6229a1d86a31774d2fa31",
+          "sha256": "f250d08cee4549b22b3b4aaaf3a743473336fd280316df5d0340717e5127a221",
+          "bytes": 10782,
+          "present_in_published_crate": false
+        }
+      ]
+    },
+    {
+      "package": "defmt-parser",
+      "version": "1.0.0",
+      "license_expression": "MIT OR Apache-2.0",
+      "crate_archive_url": "https://static.crates.io/crates/defmt-parser/defmt-parser-1.0.0.crate",
+      "crate_archive_sha256": "10d60334b3b2e7c9d91ef8150abfb6fa4c1c39ebbcf4a81c2e346aad939fee3e",
+      "repository": "https://github.com/knurling-rs/defmt",
+      "revision": "4a8cdb44891ed57b8ff5a023b6bec7137c48708f",
+      "path_in_vcs": "parser",
+      "files": [
+        {
+          "path": "defmt-parser-1.0.0/LICENSE-APACHE",
+          "upstream_path": "LICENSE-APACHE",
+          "url": "https://raw.githubusercontent.com/knurling-rs/defmt/4a8cdb44891ed57b8ff5a023b6bec7137c48708f/LICENSE-APACHE",
+          "git_blob_sha1": "11069edd79019f7dafbe3138841cf289209270dd",
+          "sha256": "8173d5c29b4f956d532781d2b86e4e30f83e6b7878dce18c919451d6ba707c90",
+          "bytes": 10850,
+          "present_in_published_crate": false
+        },
+        {
+          "path": "defmt-parser-1.0.0/LICENSE-MIT",
+          "upstream_path": "LICENSE-MIT",
+          "url": "https://raw.githubusercontent.com/knurling-rs/defmt/4a8cdb44891ed57b8ff5a023b6bec7137c48708f/LICENSE-MIT",
+          "git_blob_sha1": "e68a7ab37c8accca023db5f1505d48e4375d4324",
+          "sha256": "2710a622a896bba67356913d4d0492cab5465f61b2ecce6d880aeb483834fb50",
+          "bytes": 1053,
+          "present_in_published_crate": false
+        }
+      ]
+    },
+    {
+      "package": "r-efi",
+      "version": "6.0.0",
+      "license_expression": "MIT OR Apache-2.0 OR LGPL-2.1-or-later",
+      "crate_archive_url": "https://static.crates.io/crates/r-efi/r-efi-6.0.0.crate",
+      "crate_archive_sha256": "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf",
+      "repository": "https://github.com/r-efi/r-efi",
+      "revision": "7e1b0322d31d625f81a5656096330934f9cd835d",
+      "path_in_vcs": "",
+      "files": [
+        {
+          "path": "r-efi-6.0.0/AUTHORS",
+          "upstream_path": "AUTHORS",
+          "url": "https://raw.githubusercontent.com/r-efi/r-efi/7e1b0322d31d625f81a5656096330934f9cd835d/AUTHORS",
+          "git_blob_sha1": "79c8b7c4a1dabcfbc718b7fe6d43b1892f9850cd",
+          "sha256": "d027e91dbc9cdbb2f1190068e498bd6b61cff022b6a032b191021ba658d96111",
+          "bytes": 3733,
+          "present_in_published_crate": true
+        }
+      ]
+    },
+    {
+      "package": "wasm-encoder",
+      "version": "0.245.1",
+      "license_expression": "Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT",
+      "crate_archive_url": "https://static.crates.io/crates/wasm-encoder/wasm-encoder-0.245.1.crate",
+      "crate_archive_sha256": "3f9dca005e69bf015e45577e415b9af8c67e8ee3c0e38b5b0add5aa92581ed5c",
+      "repository": "https://github.com/bytecodealliance/wasm-tools",
+      "revision": "76927bf4bdbddf4b15f835c5eddfffbdfe3bdbd5",
+      "path_in_vcs": "crates/wasm-encoder",
+      "files": [
+        {
+          "path": "wasm-encoder-0.245.1/LICENSE-APACHE",
+          "upstream_path": "LICENSE-APACHE",
+          "url": "https://raw.githubusercontent.com/bytecodealliance/wasm-tools/76927bf4bdbddf4b15f835c5eddfffbdfe3bdbd5/LICENSE-APACHE",
+          "git_blob_sha1": "16fe87b06e802f094b3fbb0894b137bca2b16ef1",
+          "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
+          "bytes": 10847,
+          "present_in_published_crate": false
+        },
+        {
+          "path": "wasm-encoder-0.245.1/LICENSE-Apache-2.0_WITH_LLVM-exception",
+          "upstream_path": "LICENSE-Apache-2.0_WITH_LLVM-exception",
+          "url": "https://raw.githubusercontent.com/bytecodealliance/wasm-tools/76927bf4bdbddf4b15f835c5eddfffbdfe3bdbd5/LICENSE-Apache-2.0_WITH_LLVM-exception",
+          "git_blob_sha1": "f9d81955f4bcb8f96a025e2ecc46f39ec536d465",
+          "sha256": "268872b9816f90fd8e85db5a28d33f8150ebb8dd016653fb39ef1f94f2686bc5",
+          "bytes": 12243,
+          "present_in_published_crate": false
+        },
+        {
+          "path": "wasm-encoder-0.245.1/LICENSE-MIT",
+          "upstream_path": "LICENSE-MIT",
+          "url": "https://raw.githubusercontent.com/bytecodealliance/wasm-tools/76927bf4bdbddf4b15f835c5eddfffbdfe3bdbd5/LICENSE-MIT",
+          "git_blob_sha1": "31aa79387f27e730e33d871925e152e35e428031",
+          "sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
+          "bytes": 1023,
+          "present_in_published_crate": false
+        }
+      ]
+    },
+    {
+      "package": "wasmparser",
+      "version": "0.245.1",
+      "license_expression": "Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT",
+      "crate_archive_url": "https://static.crates.io/crates/wasmparser/wasmparser-0.245.1.crate",
+      "crate_archive_sha256": "4f08c9adee0428b7bddf3890fc27e015ac4b761cc608c822667102b8bfd6995e",
+      "repository": "https://github.com/bytecodealliance/wasm-tools",
+      "revision": "76927bf4bdbddf4b15f835c5eddfffbdfe3bdbd5",
+      "path_in_vcs": "crates/wasmparser",
+      "files": [
+        {
+          "path": "wasmparser-0.245.1/LICENSE-APACHE",
+          "upstream_path": "LICENSE-APACHE",
+          "url": "https://raw.githubusercontent.com/bytecodealliance/wasm-tools/76927bf4bdbddf4b15f835c5eddfffbdfe3bdbd5/LICENSE-APACHE",
+          "git_blob_sha1": "16fe87b06e802f094b3fbb0894b137bca2b16ef1",
+          "sha256": "a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2",
+          "bytes": 10847,
+          "present_in_published_crate": false
+        },
+        {
+          "path": "wasmparser-0.245.1/LICENSE-Apache-2.0_WITH_LLVM-exception",
+          "upstream_path": "LICENSE-Apache-2.0_WITH_LLVM-exception",
+          "url": "https://raw.githubusercontent.com/bytecodealliance/wasm-tools/76927bf4bdbddf4b15f835c5eddfffbdfe3bdbd5/LICENSE-Apache-2.0_WITH_LLVM-exception",
+          "git_blob_sha1": "f9d81955f4bcb8f96a025e2ecc46f39ec536d465",
+          "sha256": "268872b9816f90fd8e85db5a28d33f8150ebb8dd016653fb39ef1f94f2686bc5",
+          "bytes": 12243,
+          "present_in_published_crate": false
+        },
+        {
+          "path": "wasmparser-0.245.1/LICENSE-MIT",
+          "upstream_path": "LICENSE-MIT",
+          "url": "https://raw.githubusercontent.com/bytecodealliance/wasm-tools/76927bf4bdbddf4b15f835c5eddfffbdfe3bdbd5/LICENSE-MIT",
+          "git_blob_sha1": "31aa79387f27e730e33d871925e152e35e428031",
+          "sha256": "23f18e03dc49df91622fe2a76176497404e46ced8a715d9d2b67a7446571cca3",
+          "bytes": 1023,
+          "present_in_published_crate": false
+        }
+      ]
+    }
+  ]
+}