open-standards/wai/wai-rs/src/lib.rs
2026-10-18 20:32:06 -04:00

961 lines
48 KiB
Rust
Raw Permalink Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

//! WAI — Web AI media transport + execution.
//!
//! What this crate IS:
//! - the **envelope** (length-prefixed magic + JSON manifest + payload)
//! - the **capability dispatch** model (capability is named, not shipped)
//! - thin, tested **wrappers around standard codec libraries** for
//! the zeroth condition (AVIF / JPEG-XL / PNG / Opus / FLAC / AV1 /
//! zstd / XZ — all royalty-free), behind the `codecs` feature
//! - the WAI-native capability classes (integer codecs, worlds, scores,
//! films, quantum simulation, receipts), each behind its feature
//! - the **FFI surface** so this Rust crate is the SDK other languages
//! consume (C ABI via `extern "C"`, cdylib/staticlib outputs)
//!
//! What this crate is NOT:
//! - a re-implementation of the standard codecs. The zeroth-condition
//! codecs are wrappers around their reference libraries; the WAI-native
//! classes are WAI's own, each with its own conformance criterion.
//!
//! Neural capabilities (`wai.neural.*`) are declared here so the
//! dispatch table knows them; the actual neural model runs in whatever
//! ML runtime the sink has installed (PyTorch / Core ML / ONNX / etc.).
pub mod codecs;
pub mod container;
// Deduplication totals (extensions/staged-measurement.md §9): objects, distinct
// contents, referenced and stored bytes, recomputed from the objects. Pure integer,
// no dependency, so every build (wasm32 included) has it.
pub mod content_dedup;
// Quality per prefix (extensions/staged-measurement.md §4): SSE, luma, a Q32
// structural similarity, PCM and tensor sums, all in integers; decibels for display.
pub mod quality;
// The machine a measurement ran on (extensions/staged-measurement.md §7.4): CPU,
// cores, OS, arch, build, load and power source, as the OS reports them. Native only.
#[cfg(not(target_arch = "wasm32"))]
pub mod bench_env;
// Parameter-set pins (SPEC §3.1): the listing form, and verifying a pin against
// the sets a sink holds. Pure Rust over bytes, so it is always on.
pub mod pin;
// The reader limits the extension formats share with SPEC §2: how many samples, counting
// every channel, and how many frames a reader must be willing to render. Always on.
pub mod limits;
#[cfg(feature = "ffi")]
pub mod ffi;
#[cfg(feature = "codecs")]
pub mod ffi_codecs;
// The integer-exact synthesis decoder lives at the crate root behind the
// light `neural_int` feature: pure i64 arithmetic, no ONNX runtime, so it
// builds (and its cross-hardware bit-exactness is checkable) without `ort`.
// The `neural` module re-exposes it via the `wai.neural.int_synth` capability.
#[cfg(feature = "neural_int")]
pub mod int_synth;
// Fast kernels (convolution, transposed convolution, IGDN, channel attention)
// for the integer decoders, plus the run-time policy that selects them or the
// scalar reference kernels. Output is the same integer for every element either
// way, and an overflow-checked build panics on the same inputs (the message can
// differ); an allocation that fails is outside that claim. Argued and tested, not
// machine-proved: the module docs state the claim precisely. Pure std — no dependency — and single-threaded
// on wasm.
#[cfg(feature = "neural_int")]
pub mod int_kernels;
// The integer decoders' networks through the integer operator set `wai-ops/1`
// (extensions/integer-operators.md): each parameter set lowered to WHG1 graphs and
// loaded under its capability's profile, the bounds certificate included.
#[cfg(feature = "neural_int")]
pub mod int_ops;
// Parameter sets lowered and loaded once, kept between decodes by the SHA-256 of their
// bytes, within a byte budget (extensions/integer-operators.md §8.6).
#[cfg(feature = "neural_int")]
pub mod int_set_cache;
// Integer Gaussian-conditional entropy — the reusable scale→bucket primitive
// that makes a conditional codec's entropy decode hardware-deterministic (the
// integer half of the integer-entropy contract). Pure i64, no `ort`, like
// int_synth; the integer rANS + int_synth are the arithmetic-coder + synthesis
// halves a full `NeuralIntegerExact` conditional codec also needs.
#[cfg(feature = "neural_int")]
pub mod int_entropy;
// The integer rANS arithmetic coder (CompressAI rans64, precision 16) — a pure
// i64 entropy coder, no `ort`, so it sits with the other `neural_int` primitives
// rather than behind the ONNX `neural` feature that also consumes it. The
// encode+decode round-trip is the arithmetic-coder half of a `NeuralIntegerExact`
// conditional codec (with `int_entropy` for bucketing, `int_hyper_synth` for the
// transforms).
#[cfg(feature = "neural_int")]
pub mod rans;
// Integer-exact transform primitives (softmax/layernorm/matmul) — the missing
// piece for a NeuralIntegerExact *attention-based* decode (the attention and
// MetaFormer transform class learned codecs use). Pure i64, no `ort`, like int_synth/int_entropy.
#[cfg(feature = "neural_int")]
pub mod int_transform;
// Integer-exact synthesis of a pretrained learned image codec (per-channel int12
// convs + integer IGDN) — the decode side of a NeuralIntegerExact conditional
// codec (the pretrained mbt2018_mean, exported to integers; quality measured in
// int_hyper_synth.rs). Pure i64, no `ort`. Runs the model the export tool emits.
#[cfg(feature = "neural_int")]
pub mod int_hyper_synth;
// The MLIC++ entropy topology (channel-autoregressive slices × checkerboard passes,
// an entropy network over the latent decoded so far) with every decode-side network
// integer: `wai.neural.int_mlicpp`. Built from int_hyper_synth's networks,
// int_entropy's bucketing and the integer rANS; refuses any stream value outside the
// exact integer range rather than overflowing. Pure integer, no `ort`.
#[cfg(feature = "neural_int")]
pub mod int_mlicpp;
// Byte-exact integer TRANSFORMER kernels (softmax / attention / LayerNorm /
// L2-norm / ELU / Sigmoid / MDTA) — the pure-i64 arithmetic a learned ATTENTION
// image codec (JPEG-AI's Restormer synthesis) needs beyond the conv/IGDN stack
// above. NOTE: distinct from `int_transform` (a signal transform). Pure i64.
// Test-only (`legacy_int`): the direct networks of `jpegai_synthesis`, which the decode
// runs through the integer operator set (integer-operators §13.6.2), are built on it.
#[cfg(all(feature = "neural_int", any(test, feature = "legacy_int")))]
pub mod int_transformer;
// Whole-net byte-exact integer JPEG-AI synthesis (Restormer, model_y) — threads the
// real traced topology through int_transformer + int_hyper_synth ops on sink-supplied
// 16-bit-PTQ weights → Y plane. Pure i64. (Structural; PSNR-vs-float pending.)
#[cfg(feature = "neural_int")]
pub mod jpegai_synthesis;
// The direct mANS entropy decoder for JPEG-AI (a port of the reference decompressor):
// the decode `wai.image.jpegai` ran before its entropy decodes went through the integer
// operator set (`jpegai_ops`, E8). Test-only, the reference the differential and the
// refusal-parity tests hold E8 to; it panics on a stream that runs out.
#[cfg(all(feature = "neural_int", any(test, feature = "legacy_int")))]
pub mod jpegai_mans;
// JPEG-AI decode-pipeline glue (dequant + reconstruction wiring).
#[cfg(feature = "neural_int")]
pub mod jpegai_pipeline;
// JPEG-AI eICCI post-filter: the Haar wavelet domain its CNN operates in.
#[cfg(feature = "neural_int")]
pub mod jpegai_icci;
// JPEG-AI bitstream container (marker segments) + the MSB-first header bit reader —
// the decoder's entry point.
#[cfg(feature = "neural_int")]
pub mod jpegai_bitstream;
// Float functions (exp, rounding) built only from IEEE-754 basic operations, so their
// bits are fixed by the source rather than by a platform math library. The JPEG-AI
// exact decoder's float stages use them.
#[cfg(feature = "neural_int")]
pub mod float_repro;
// JPEG-AI whole-decoder entry point: composes the entropy, value, synthesis and
// post-filter stages into `decode(codestream, weights, norm) -> Rgb`.
#[cfg(feature = "neural_int")]
pub mod jpegai_decode;
// JPEG-AI's integer stages through the integer operator set
// (`extensions/integer-operators.md` §13.6, lowered by `jpegai-int/1`): the scale path and
// its two entropy decodes, and the hyper decoders, context stages and synthesis.
#[cfg(feature = "neural_int")]
pub mod jpegai_ops;
// Deterministic integer generative synthesis (`wai.generate.*`) — the
// `intent=create` analog of the integer-exact codecs: a generator whose entire
// pipeline is integer/fixed-point, pinned to (model, prompt, seed, steps), so the
// generated image is byte-identical on every machine (its hash is portable, can
// go in a receipt). Pure i64, no float/ONNX; compiles to wasm32.
#[cfg(feature = "generate")]
pub mod generate;
// Deterministic integer inter-frame video (`wai.video.int_motion`) — byte-exact
// frame-by-frame decode: integer block motion compensation + integer-quantized
// residual over the rANS coder. Frame-state-equivalence (per-frame portable hash),
// the temporal extension of the integer contract. Pure i64, no float/ONNX.
#[cfg(feature = "video_int")]
pub mod int_video;
// The integer video encoder: RGB8 frames to a WIV1 keyframe-0 payload, with integer
// motion search and a closed-loop reconstruction the decoder reproduces. The one
// encoder of the format; int_payload::encode_wiv1_zero_motion is its zero-motion case.
#[cfg(feature = "video_int")]
pub mod int_video_enc;
// Integer-exact LEARNED audio codec (`wai.audio.int_codec`) — a learned 1-D
// transform codec whose synthesis is a stack of integer transposed convolutions +
// integer IGDN, decoding to int16 PCM byte-identically on every machine
// (NeuralIntegerExact; *sample-equivalence*, a portable PCM hash). The audio analog
// of int_hyper. Pure i64, no float/ONNX; compiles to wasm32.
#[cfg(feature = "audio_int")]
pub mod int_audio;
// Integer-exact INTERACTIVE WORLD MODEL (`int_world`) — the byte-exact renderer for
// wai.world.model: an action-conditioned next-frame model (transition + synthesis are
// both int_hyper IntModels), so given (model, z0, action trace) every generated frame
// is byte-identical on every machine. Pure i64; compiles to wasm32.
#[cfg(feature = "world_int")]
pub mod int_world;
// Integer-exact LEARNED Gaussian-splat ATTRIBUTE codec (`int_splat`) — "the int_hyper
// of 3D": a learned transform over the [14,S,S] attribute image, integer synthesis →
// byte-exact attribute tensor (splat-equivalence). Pure i64; compiles to wasm32.
#[cfg(feature = "splat_int")]
pub mod int_splat;
// The parsers and writers of the integer payload formats (`WIV1`, `WIH1`, `WIA1`,
// `WIS1`), with no dependency on the rest of the crate and no feature: the container's
// emit paths check a payload with them (`container::check_int_payload_framing`), and
// `int_payload` re-exports them as `int_payload::wire`.
#[doc(hidden)]
#[path = "int_payload/wire.rs"]
pub mod int_wire;
// The payloads of the WAI-native integer codecs (`extensions/integer-payloads.md`):
// the WIV1, WIH1, WIA1 and WIS1 parsers and writers, the JSON converters, and
// `decode_int`, the one integer decode path, with the pin and key-log checks over
// parameter sets held in memory. No ONNX runtime and no filesystem: the neural sink
// delegates the integer capabilities to it, and it builds for wasm32. Its video, audio
// and splat arms sit behind their own features.
#[cfg(feature = "neural_int")]
pub mod int_payload;
#[cfg(feature = "neural")]
pub mod neural;
// The neural C FFI uses the `ffi` feature's shared buffer and error types, so it
// builds with `neural` and `ffi`; it needs no codec library. The Rust neural
// decoders (above) need neither the C ABI nor the codec chain.
#[cfg(all(feature = "neural", feature = "ffi"))]
pub mod ffi_neural;
// Shared deterministic ONNX session loader, used by both ort-backed paths.
#[cfg(any(feature = "neural", feature = "semantic"))]
pub(crate) mod ort_session;
// The perceptual / generative-semantic path: transmit a compact
// "understanding" (CLIP embedding + thumb + edges), regenerate at the sink
// with any conforming generator, conform by CLIP similarity (not byte
// identity). The Rust port of the moved-out `wai-neural` prototype — the
// generator and embedder are sink-supplied traits, never bundled.
#[cfg(feature = "semantic")]
pub mod semantic;
// Interactive worlds (extensions/interactive-worlds): media that consumes
// input. A world is a deterministic content-addressed artifact; every event
// is a signed CausalOp; conformance is replay-equivalence — identical
// state hash at every checkpoint, no tolerance parameter. Pure Rust,
// closed-form fixed-point; no ML dep chain.
#[cfg(feature = "world")]
pub mod world;
// Object-based spatial audio (extensions/spatial-audio): the deterministic
// Fx mixdown engine. Conformance is mixdown-equivalence — same scene +
// declared layout → identical canonical PCM. Reuses the world `Fx` floor.
#[cfg(feature = "audio_scene")]
pub mod audio_scene;
// Haptics (extensions/haptics): touch as instructions — a keyframed
// intensity/sharpness envelope reconstructed in the Fx floor.
#[cfg(feature = "haptic")]
pub mod haptic;
// Volumetric / 4D temporal Gaussian splats (extensions/volumetric): each
// Gaussian carries keyframed tracks; the sink interpolates the cloud at
// frame N in the Fx floor (frame-state-equivalence). Reuses the world Fx
// floor + blake3; the EWA render stays the sink's.
#[cfg(feature = "splat4d")]
pub mod splat4d;
// Music as instructions (extensions/score): a score of note events
// reconstructed to a canonical PCM mixdown by a deterministic trig-free
// synth in the Fx floor (mixdown-equivalence). The soundfont/neural
// instrument render stays the sink's. Reuses the world Fx floor + blake3.
#[cfg(feature = "score")]
pub mod score;
// Asset provenance (extensions/provenance): the "verify whatever it
// carries" half — a signed, energy-accounted lineage for opaque captured
// content WAI does not reconstruct. Reuses the JWP Merkle + Ed25519.
#[cfg(feature = "provenance")]
pub mod provenance;
// Reproducible-reconstruction binding: a C2PA/JPEG-Trust hard binding over the
// deterministically decoded pixels (the reconstruct-side analogue of `provenance`).
#[cfg(feature = "provenance")]
pub mod reconstruction_binding;
// The acquisition class an energy figure is sealed beside — one definition
// shared by every receipt here that carries `joules_micro`: always present in the
// C2PA energy binding, the int_motion receipt and the OTT receipts; an optional
// label (absent = legacy, unlabelled) in the families that predate it. Splits hardware evidence into an on-chip counter class and a calibrated
// external-instrument class, each with a required declared uncertainty, and keeps
// the legacy `HwShunt` label verifiable. Pure std with no optional
// dependencies, so it is compiled unconditionally.
pub mod energy_class;
// The integers a measurement report carries for a figure obtained under the
// bracketed protocol, the exact arithmetic every reader applies to them (the figure
// they give, the least declaration they support, the derived attribution verdict),
// the liveness rule a power reader's rail must meet, and the build record
// (energy-measurement §3.1, §6.2). Integer only, pure std, compiled unconditionally.
pub mod energy_report;
// What build.rs records about the build, shared with build.rs through `#[path]`;
// compiled into the crate for its tests.
#[cfg(test)]
mod build_info;
// The bracketed marginal protocol (energy-measurement §3) every reference meter
// runs: idle bracket, a burst released from a start barrier, busy bracket, and
// the §4 / §2.3 rules for when a figure may be sealed under a hardware class.
// Native only — it spawns threads and runs the power reader as a subprocess.
#[cfg(not(target_arch = "wasm32"))]
pub mod energy_burst;
// Signed-byte pins for the receipt families that seal `joules_micro`: an
// unlabelled receipt must keep the exact bytes it had before the optional
// acquisition class existed. Test-only.
#[cfg(all(test, feature = "world"))]
mod receipt_pins;
// The joules a reconstruction cost, bound to that reconstruction. Fills the slot
// C2PA 2.4's `c2pa.environmental-sustainability` opened but left self-declared:
// same digest as the reconstruction binding, plus the acquisition class and
// coverage the standard assertion cannot express (extensions/energy-binding.md).
#[cfg(feature = "provenance")]
pub mod energy_binding;
/// Writes a real, signed C2PA manifest carrying those bindings.
///
/// [`energy_binding`] and [`reconstruction_binding`] define assertion *shapes*; this
/// emits them into an actual manifest, and enforces the one rule the C2PA SDK cannot —
/// that the two digests in a manifest must name the same decode.
#[cfg(feature = "c2pa_emit")]
pub mod c2pa_emit;
// Ed25519 verified strictly (RFC 8032 §5.1.7 with a canonical key of large order, S < L,
// and R of large order compared byte for byte, SPEC §7 *Signatures*): the one routine
// every signature check written in this crate calls but OER/2's (oer-receipts §5). Built
// whenever ed25519-dalek is, under the `ed25519` feature every signing feature enables.
#[cfg(feature = "ed25519")]
pub mod sig;
// RFC 8785 canonical JSON over the subset WAI signs and digests (integers up to
// 2^53 − 1, no floats). Needs serde_json alone, so it is ungated: claims, key logs,
// energy figures and packaging policies canonicalise through this one function.
pub mod jcs;
// jwp-receipts §2.1: an object's content hash, BLAKE3 over a domain and the envelope.
// One module, gated only on BLAKE3, so every receipt family computes it in one place.
#[cfg(feature = "jwp_hash")]
pub mod jwp_hash;
// SPEC §7.1: a WAI2 component exploded into its WAI1 envelope, WAI1 envelopes packed
// into a WAI2, and the check of an entry's envelope_manifest. Content hashes need BLAKE3.
#[cfg(feature = "jwp_hash")]
mod container_explode;
// Staged delivery (extensions/staged-delivery.md): a base first, then refinements as
// their own objects, bound to what they refine by content hash; the residual payload
// WIR1, its predictors, the per-unit application algorithm and the live schedule.
#[cfg(feature = "staged")]
pub mod staged;
// HTTP delivery (extensions/http-delivery.md): the head proof, verified component range
// fetch, the codecs union and floor, and an origin's responses.
#[cfg(feature = "http")]
pub mod http_binding;
// Staged-delivery measurement (extensions/staged-measurement.md): the output tree
// (Appendix C), the counted bytes of an envelope (§3), and the evaluation of a staged
// title (§3–§6, §9) through the staged sink. The output tree is also what a session
// claim commits to (jwp-receipts §2.4.12), and a session verifier holding envelopes
// counts them, so `receipt_claims` builds both.
#[cfg(any(feature = "stage_measure", feature = "receipt_claims"))]
pub mod output_tree;
#[cfg(any(feature = "stage_measure", feature = "receipt_claims"))]
pub mod measure_framing;
#[cfg(feature = "stage_measure")]
pub mod stage_measure;
// The terms of delivery telemetry other extensions read (its §5 switch reasons): ungated,
// so a session claim's verifier names them without the telemetry module.
pub mod delivery_terms;
// Delivery telemetry (extensions/delivery-telemetry.md): advisory, unsigned observations
// about delivery, as CMCD version 2 and CMSD reports, and session metrics.
#[cfg(feature = "telemetry")]
pub mod telemetry;
// Live events (extensions/live-events.md): `wai.live.events`, a signed, hash-chained,
// timeline-bound event track. Cues, chat, reactions, polls, markers, remote control,
// captions, moderation decisions and room lifecycle are one record, `WEV1`, with its
// policy (`WEP1`), its verifier, poll tallies replayed as feed state, and the field
// mappings onto an MSF event timeline, EXT-X-DATERANGE and a version 1 emsg.
// Its constants are Rust-only: names like VERSION, IN, OUT and BREAK must not
// become macros in include/wai.h.
/// cbindgen:ignore
#[cfg(feature = "live_events")]
pub mod live_events;
// Live rooms (extensions/live-rooms.md): `wai.live.room` — the signed room descriptor and
// room grant, revocation through the room authority's key log, track naming, takeover and
// failover over slots, publish profiles, and the room verifier that replays every
// principal's events under the grant in effect at each room-clock instant. Rust-only, like
// live_events: its constants must not become macros in include/wai.h.
/// cbindgen:ignore
#[cfg(feature = "live_room")]
pub mod live_room;
// Capture binding (extensions/capture-binding.md): `wai.capture.take` — a device's master
// recording bound to a live room by rolling take_commit events in the room's event track,
// the store's upload receipts, the take manifest, consent records with guardians for
// minors, and the take verifier's single-take, aligned, complete and publishable verdicts.
// Rust-only, like live_events and live_room: its constants must not become macros in
// include/wai.h.
/// cbindgen:ignore
#[cfg(feature = "capture_take")]
pub mod capture_take;
// Live composition (extensions/live-compose.md): `wai.live.compose` — the signed
// composition descriptor, the participant set the room's lifecycle replay gives at each
// room-clock instant, the integer layout function and mixer that every sink runs alike,
// and the receipt a server compositor signs for a composed track. Rust-only, like the
// other live modules: its constants must not become macros in include/wai.h.
/// cbindgen:ignore
#[cfg(feature = "live_compose")]
pub mod live_compose;
// Live recording (extensions/live-recording.md): `wai.live.recording` — a finished room session
// as one WAI package whose components are the room, its events, each participant's take and
// the composite, under a signed recording manifest, and provable clips: a span of a take, or an
// aligned span of several, carrying range proofs against the take's commitments, checkable
// without the take. Rust-only, like capture_take: its constants must not become macros in
// include/wai.h.
/// cbindgen:ignore
#[cfg(feature = "live_record")]
pub mod live_record;
// Live metering (extensions/live-metering.md): `wai.live.metering` — the per-hop session record a
// relay, compositor or ingest gateway signs, batched per session with a size bound independent of
// the audience and a ledger of the grants its sessions ran under; the room-session receipt in units
// (publisher-, subscriber-, composition- and recorded-seconds, events sent and delivered), joules per
// hop with their acquisition class and a total per class, each grant's consumption against its
// ceilings, and the QoE cell. Rust-only, like the other live modules: its constants must not become
// macros in include/wai.h.
/// cbindgen:ignore
#[cfg(feature = "live_metering")]
pub mod live_metering;
// Energy-aware content steering (extensions/energy-steering.md): `wai.live.steering` — a signed
// steering policy (WSP1) and a signed steering decision (WSD1) that chooses each client's pathway
// from the joules its hops' per-hop records state, compared only within an acquisition class, a
// pathway with no figure never ranked above one with a figure, and writes the HLS and DASH steering
// manifests exactly. Rust-only, like the other live modules: its constants must not become macros in
// include/wai.h.
/// cbindgen:ignore
#[cfg(feature = "energy_steering")]
pub mod energy_steering;
// Timed text and live captions (extensions/timed-text.md): `wai.text.timed` — the cue model
// both WebVTT and the IMSC1 Text Profile express, live caption revisions as `caption`
// events of `wai.live.events` with the WTX1 annotation, and the exact mappings onto WebVTT
// documents and segments, IMSC1 documents, the MoQ caption timelines, CTA-608 and HLS,
// with the machine-generation disclosure carried through each. Rust-only, like
// live_events: its constants must not become macros in include/wai.h.
/// cbindgen:ignore
#[cfg(feature = "timed_text")]
pub mod timed_text;
// Typed receipt classes (extensions/jwp-receipts.md §2.4.3–§2.4.12, §2.6, §3.1–§3.2):
// energy, lawful-basis, log-inclusion, soft-binding, binding-recovery, measurement,
// operating-point, stage, delivery-gap and reconstruct-session statements about
// delivered objects, on one `claim` envelope and one signature rule beside the
// delivery class `group`/`object` carry. A recovery through a soft binding attests the
// ancestor, never the object in hand. An OER receipt an energy claim names is read and
// verified by `oer` under oer-receipts' own rules.
#[cfg(feature = "receipt_claims")]
pub mod claim_receipt;
// §3.1 step 1's reading of a claim's JSON text: RFC 8259 with a claim's own limits
// (no repeated member name, no unpaired surrogate escape, 32 levels), each number read
// from its spelling. Claims, and §7's key logs, grants and statuses, which jwp-receipts
// reads the same way; an OER receipt is read by `oer::load`.
#[cfg(feature = "receipt_claims")]
mod claim_text;
// JWP delivery receipts (extensions/jwp-receipts.md §2.2–§2.4.2, §3, §3.3): group and
// object receipts read and verified, in the legacy forms and the labelled ones — an
// object's figure, class and origin in its Merkle leaf, a group total's class under a
// versioned signing payload — with the position check, the group-total reading and the
// WAI_RECEIPT property's readings (moq-streaming-format §5).
#[cfg(feature = "receipt_claims")]
pub mod jwp_delivery;
// Figure profiles (energy-measurement §6.1): how a measurement or operating-point claim
// names the receipt that seals its figure, by that receipt's identity domain, and the
// figures each receipt family shows a report — read without changing any family.
#[cfg(feature = "receipt_claims")]
pub mod energy_figure;
// A sink's record of one session, tallied and sealed as a `reconstruct-session` claim
// (jwp-receipts §2.4.12) and checked against what it recorded before it leaves the sink.
#[cfg(feature = "receipt_claims")]
pub mod session_recorder;
// jwp-receipts §7.1: what a `signer_id` names — an origin-bound `did:web`, an Ed25519
// `did:key`, or a label. Ungated and dependency-free, so every surface that shows a
// signer can say which.
pub mod signer_id;
// jwp-receipts §7: key discovery and signing authority — origin key logs, anchors, the
// confirmation reported beside a verdict and never in it, and the authorisation and
// revocation of decoder and reconstruct modules (§7.9). No network, no clock.
#[cfg(feature = "key_discovery")]
pub mod key_log;
// wai.world.model — generative-world transport: a signed, replay-equivalent action
// trace (the world CausalOp log) + per-frame provenance. The wire carries the
// action trace + a declared model_id, not the pixels; the sink renders. The neural
// sibling of wai.world.replay.
#[cfg(feature = "world_model")]
pub mod world_model;
// Linear film (extensions/linear-film): "a film is a sealed, camera-on-rails
// world." The world replay (replay-equivalence) + a keyframed camera track in
// the Fx floor + a frame schedule; verified frame-by-frame (film-equivalence).
// Reuses the world engine + JWP Merkle + Ed25519; the render stays the sink's.
#[cfg(feature = "film")]
pub mod film;
// Deterministic quantum-circuit SIMULATION as transportable content
// (extensions/quantum-sim, `wai.quantum.circuit2` and the frozen
// `wai.quantum.circuit`): the wire carries a compact gate op-log (WQC container),
// the sink classically simulates it in a fixed-point complex floor (Amp = i64
// re/im at 2^FRAC), and the reconstructed statevector is byte-identical on every
// machine (statevector-equivalence). Clifford+T + dyadic phase; circuit2's
// correctly rounded phase table gives the controlled-phase ladder of the QFT
// ("quantum FFT"). Pure i64, no float/ONNX; compiles to wasm32. Quantum HARDWARE is
// deliberately absent — NISQ noise breaks the determinism the standard rests on.
#[cfg(feature = "quantum")]
pub use wai_quantum::quantum;
#[cfg(feature = "quantum")]
pub mod quantum_envelope;
// The energy-accounted seal for a quantum reconstruction (extensions/quantum-sim
// § Receipt): a signed receipt separating the portable-exact WORK (n_ops·2^n
// amplitude updates, recomputable by anyone) from the measured-attested ENERGY
// (joules_micro from the sink's meter, and the class that labels it), both bound to a
// re-simulatable statevector
// hash. A JWP profile — reuses the world Merkle + Ed25519.
#[cfg(feature = "quantum_receipt")]
pub use wai_quantum::quantum_receipt;
// The acquisition class of a quantum receipt's joule figure, as an optional
// signed label (`Labelled`, `LabelledQbom`). Present with any quantum feature
// that seals receipts; unlabelled receipts keep their exact bytes.
#[cfg(any(feature = "quantum_receipt", feature = "quantum_ops", feature = "quantum_phasor_meter"))]
pub use wai_quantum::quantum_energy;
#[cfg(feature = "video_receipt")]
pub mod video_receipt;
// Balanced-ternary matrix-product-state transform (extensions/ternary-tt,
// `wai.ternary.tt`): quantum-INSPIRED (tensor-network) compression. The ternary
// weight fabric (BitNet-b1.58, 5 trits/byte) + MPS are ported, not reinvented;
// the one change is an INTEGER core scale, so the whole decode is pure i64/i128
// and a reconstruction is byte-identical on every machine (portable recon hash).
// Lossy codec, deterministic decode; encoder-side float SVD only.
#[cfg(feature = "ternary")]
pub mod ternary;
// The energy-accounted seal for a ternary-MPS reconstruction (extensions/ternary-tt
// § Receipt): a signed receipt separating portable-exact WORK (trit_macs) from
// measured-attested ENERGY (joules_micro and the class that labels it), bound to the
// WQTT payload hash and a
// re-decodable reconstruction hash. A JWP profile — reuses the world Merkle + Ed25519.
#[cfg(feature = "ternary_receipt")]
pub mod ternary_receipt;
// Quantum-operations attestation (extensions/quantum-ops): signed, content-
// addressed, joule-metered, grant-authorized receipts of calibration runs
// (`wai.quantum.calibration`) and QPU jobs (`wai.quantum.job`) — the verify-half
// of WAI applied to the quantum-control industry. A job binds the exact
// calibration state it ran under; verify() enforces the grant's joule ceiling.
// WAI owns the receipt, not the hardware. Reuses the world Merkle + Ed25519.
#[cfg(feature = "quantum_ops")]
pub use wai_quantum::quantum_ops;
// HLS media playlist text: a pure function of the segments and the rendering
// parameters (`render_hls`, and `render_hls_with` for on-demand, live and low-latency
// WAI playlists). No dependency, so the HTTP binding renders playlists with it alone
// and wai.video.manifest seals what it renders.
pub mod hls_render;
// Attested per-session manifest (wai.video.manifest): the incumbent OTT 1:1
// manifest, made deterministic (a pure function of the session *class*, so it
// dedups across viewers), energy-accounted, and sealed in a signed receipt that
// binds the JCP grant, the stitched ads and the blackouts applied. Reuses the
// world Merkle + Ed25519 and the GrantRef from quantum_ops — no pixel decode.
#[cfg(feature = "video_manifest")]
pub mod wai_video_manifest;
// Where a receipt's joules_micro actually comes from. Makes the provenance
// ladder mechanical: only a counter meter can yield a hardware class (on-chip,
// or a calibrated instrument when constructed with a certificate reference),
// each with its declared uncertainty; a model meter can only ever say
// ModelBased; and a meter with no hardware returns None rather than a
// fabricated figure.
#[cfg(feature = "energy_meter")]
pub mod energy_meter;
// Attested server-side ad insertion (wai.video.ssai): a deterministic ad
// decision + per-impression signed receipt. Budget enforcement is a checkable
// fact — verify() recomputes the billable spend and rejects it over the grant's
// funds_ceiling. Links to a manifest by manifest_hash; reuses the manifest
// module's EnergyProvenance and the world Merkle + Ed25519.
// Pure decision policy for the video capabilities — no crypto, no I/O, so a
// model checker can reach it. Holds `decide` and the spend accounting, whose
// limits are proved rather than sampled; the signing layer lives in
// wai_video_ssai and re-exports these types so the public surface is unchanged.
#[cfg(feature = "video_policy")]
pub mod wai_video_policy;
#[cfg(feature = "video_ssai")]
pub mod wai_video_ssai;
// Attested content-key release (wai.video.keys): every DRM key release — and
// every refusal — is a signed receipt whose decision verify() recomputes from
// the bound (grant, entitlement, times), with a BLAKE3 key-commitment that
// proves which key was released without carrying it. The content-protection
// audit trail as a checkable fact.
#[cfg(feature = "video_keys")]
pub mod wai_video_keys;
// Deterministic packaging + attested SegmentMap (wai.video.package): a source is
// sliced into content-hashed segments; the signed Merkle SegmentMap is what a
// manifest reference is checked against, and identical content (ads, bumpers,
// replays, simulcast overlap) dedups to one stored/encoded copy — a saving
// verify() recomputes rather than takes on trust.
#[cfg(feature = "video_package")]
pub mod wai_video_package;
// The packaging extension's stage index (extensions/packaging.md §6, `WSIX`) and the
// version-2 package receipt over it (§9): per component, every WAI object of a package
// by content hash, its role, layer, prefix tier and digest, and the class plan; one
// signed receipt binding the policy digest, each index by digest and stage root, and
// counts every verifier recomputes.
#[cfg(feature = "video_package")]
pub mod stage_index;
#[cfg(feature = "video_package")]
pub mod package;
// Virtual linear / FAST channel assembly (wai.video.channel): the capstone. A
// continuous schedule (gapless, non-overlapping — verify() rejects dead air)
// whose program-as-run per window is recomputed, not logged. Windows chain via
// parent_receipt_hash, so a channel's history is a hash chain: operational
// accountability as a cryptographic artifact rather than an operator's log.
#[cfg(feature = "video_channel")]
pub mod wai_video_channel;
// Deterministic autonomous CALIBRATION engines (extensions/quantum-ops § Calibration):
// a fixed-point qubit-device simulator + autonomous tune-up algorithms (Rabi π-pulse)
// (autonomous gate tune-up), done byte-exactly and reproducibly, sealing a
// wai.quantum.calibration receipt per run. Pure integer.
#[cfg(feature = "quantum_cal")]
pub use wai_quantum::quantum_cal;
// Deterministic quantum ERROR MITIGATION (extensions/quantum-ops § Mitigation,
// `wai.quantum.mitigate`): the classical post-processing layer between raw QPU
// counts and the reported number — zero-noise extrapolation, tensored readout
// inversion, classical shadows. Pure fixed-point, byte-exact on every machine,
// each step sealing a signed, joule-metered MitigationReceipt binding
// (raw data, noise-model hash, method, seed) → (mitigated estimate ± error).
#[cfg(feature = "quantum_mitigate")]
pub use wai_quantum::quantum_mitigate;
// Deterministic quantum LDPC DECODING (extensions/quantum-ops § Decoding,
// `wai.quantum.decode`): a fixed-point Relay-BP (normalized min-sum) decoder for
// qLDPC codes — toric + bivariate-bicycle. Plain BP fails on quantum codes
// (degeneracy + short cycles); relay legs with disordered per-node memory break
// the symmetry. Byte-exact on every machine; each decode seals a signed,
// joule-metered DecodeReceipt carrying joules-per-decode.
#[cfg(feature = "quantum_qec")]
pub use wai_quantum::quantum_qec;
// Deterministic FILTER-FUNCTION control + NOISE SPECTROSCOPY (extensions/quantum-ops
// § Calibration, frequency domain): the coherence-decay overlap χ = (1/π)∫S(ω)F(ω)/ω².
// DD noise spectroscopy reconstructs the hidden PSD from a filter bank (Richardson–
// Lucy); filter-function robust control reshapes a DD sequence to push its stopband
// over the noise. Fully offline, byte-exact, each sealing a wai.quantum.calibration
// receipt — the matched pair that extends the calibration suite to 1/f noise.
#[cfg(feature = "quantum_control")]
pub use wai_quantum::quantum_control;
// Deterministic NOISE LEARNING (extensions/quantum-ops § Calibration, noise model,
// `wai.quantum.cal.noise_learn`): Cycle Benchmarking + Cycle Error Reconstruction
// of a sparse Pauli–Lindblad model. Recovers a hidden device's Pauli error rates
// from a simulated twirled-cycle experiment (fixed f_a = exp(-2Σλ), inverted by
// multiplicative NNLS), byte-exact, sealing a signed model whose content hash is
// exactly the noise_model_hash a MitigationReceipt binds — the producer for the
// PEC/PEA hook the mitigation layer already exposes.
#[cfg(feature = "quantum_noise")]
pub use wai_quantum::quantum_noise;
// Deterministic circuit COMPILATION + equivalence proof (extensions/quantum-ops
// § Compilation, `wai.quantum.compile`): a coupling-graph router (SWAP insertion)
// + a byte-exact Clifford stabilizer-tableau equivalence check. Two Cliffords are
// equal iff they conjugate every Pauli identically; routing preserves semantics up
// to the final qubit permutation. Seals a signed CompileReceipt that a routed
// circuit is equivalent to its source — compilation correctness, unsigned today.
#[cfg(feature = "quantum_compile")]
pub use wai_quantum::quantum_compile;
// OER/2 OUTCOME-AND-ENERGY RECEIPTS (extensions/oer-receipts): a receipt that says
// what a unit of work was, what it cost, how that cost is GRADED (projected /
// simulated / derived / measured — the evidential standing, alongside the
// acquisition class of energy-measurement.md), and what it rests on; canonicalised,
// content-addressed, hash-chained and Ed25519-signed. This is the third verifier of
// the draft, beside the reference Python and the portable C kernel; conformance is
// the SAME REASON SET for every vector in oer-conformance/, not a pass/fail bit.
#[cfg(feature = "oer")]
pub mod oer;
// MIXED STATES (extensions/quantum-sim § Information): density matrices, the
// partial trace, purity, exact Pauli expectations, and CHSH against the classical
// and Tsirelson bounds. A state vector cannot describe a subsystem — half a Bell
// pair has no state vector at all — so this is what makes "what did the other end
// receive" an answerable question.
#[cfg(feature = "quantum_info")]
pub use wai_quantum::quantum_info;
// QUBITS AND QUTRITS (extensions/quantum-sim § Qudits): the Weyl–Heisenberg group,
// the Fourier gate over `Z_d`, the controlled sum. Exact for `d = 2` and `3` — at
// d = 2 it reproduces the qubit simulator exactly, which is how it is checked.
#[cfg(feature = "quantum_qudit")]
pub use wai_quantum::quantum_qudit;
// KEY DISTRIBUTION AND SECURITY (extensions/quantum-sim § Communication): BB84
// with an intercept-resend eavesdropper — a quiet channel yields a perfect key,
// interception costs a quarter of it — and the no-cloning theorem priced.
#[cfg(feature = "quantum_comm")]
pub use wai_quantum::quantum_comm;
// THE LIMITS ON ENCODING AND TRANSPORT (extensions/quantum-sim § Source): von
// Neumann entropy, the Schumacher limit, and the Holevo bound. Holevo says `n`
// qubits carry at most `n` classical bits, so quantum does NOT compress classical
// media; where it genuinely wins is protocols, not codecs. Computing the limits is
// what lets WAI state what is possible instead of overclaiming.
#[cfg(feature = "quantum_source")]
pub use wai_quantum::quantum_source;
// TRANSPORT ITSELF (extensions/quantum-sim § Channel): Kraus channels — bit flip,
// dephasing, depolarizing, amplitude damping — and linear-inversion tomography to
// see what actually arrived. The law that matters: push an ensemble through a
// channel and its Holevo bound can only fall. Noise never creates information, and
// nothing downstream recovers what the channel discarded.
#[cfg(feature = "quantum_channel")]
pub use wai_quantum::quantum_channel;
// Deterministic neutral-atom REARRANGEMENT (extensions/quantum-ops § Register
// preparation, `wai.quantum.rearrange`): a Hungarian / LSAP solver over integer
// Manhattan costs that assigns every defect-free target site a distinct loaded
// atom minimizing total move distance, turning a stochastic ~half-full load into a
// defect-free register. Seals a signed RearrangeReceipt whose success verdict
// (every target covered by a valid bijection of present atoms) is re-checkable.
#[cfg(feature = "quantum_atom")]
pub use wai_quantum::quantum_atom;
// WAI Quantum Toolchain (`wai.quantum.toolchain`) — the compute core of a
// classical-hardware quantum IDE: algorithm library + state analysis + backend
// selection (Clifford → statevector → tensor-network) + OpenQASM interop, over the
// byte-exact fixed-point simulator. Framework-neutral and offline.
#[cfg(feature = "quantum_toolchain")]
pub use wai_quantum::quantum_toolchain;
// Matrix Product State backend (`wai.quantum.mps`) — the tensor-network classical
// referee: a bounded-bond MPS evolved with a deterministic complex Jacobi SVD
// truncation, bit-reproducible on every machine, reporting max bond + retained
// weight (an approximate method's honest contract), verified against the dense sim.
#[cfg(feature = "quantum_mps")]
pub use wai_quantum::quantum_mps;
// Stabilizer / CHP backend (`wai.quantum.stabilizer`) — the O(n²) Clifford tier:
// the Aaronson–Gottesman tableau simulates and samples Clifford circuits far past
// the dense 2^n wall (thousands of qubits), exact integer arithmetic, deterministic
// histograms. Rejects non-Clifford gates so the caller falls back to a universal
// backend.
#[cfg(feature = "quantum_stabilizer")]
pub use wai_quantum::quantum_stabilizer;
// Sparse-Pauli / Heisenberg propagation (`wai.quantum.pauli`) — the observable
// referee: propagate an observable backward through the circuit as a truncated sum
// of Pauli strings (Clifford → 1 term, diagonal rotation → 2), computing ⟨O⟩ on
// large low-magic circuits where no 2^n state vector exists. Verified vs dense.
#[cfg(feature = "quantum_pauli")]
pub use wai_quantum::quantum_pauli;
#[cfg(feature = "quantum_spd")]
pub use wai_quantum::quantum_spd;
#[cfg(feature = "quantum_spd_receipt")]
pub use wai_quantum::quantum_spd_receipt;
#[cfg(feature = "quantum_bptn")]
pub use wai_quantum::quantum_bptn;
#[cfg(feature = "quantum_resource")]
pub use wai_quantum::quantum_resource;
#[cfg(feature = "quantum_resource_receipt")]
pub use wai_quantum::quantum_resource_receipt;
#[cfg(feature = "quantum_frame")]
pub use wai_quantum::quantum_frame;
#[cfg(feature = "quantum_frame")]
pub use wai_quantum::quantum_match;
#[cfg(feature = "quantum_frame")]
pub use wai_quantum::quantum_uf;
#[cfg(feature = "quantum_tn")]
pub use wai_quantum::quantum_tn;
#[cfg(feature = "quantum_gbs")]
pub use wai_quantum::quantum_gbs;
#[cfg(feature = "quantum_sv")]
pub use wai_quantum::quantum_sv;
#[cfg(feature = "quantum_sv")]
pub use wai_quantum::quantum_noisy;
#[cfg(feature = "quantum_arch")]
pub use wai_quantum::quantum_arch;
#[cfg(feature = "quantum_ldpc")]
pub use wai_quantum::quantum_ldpc;
#[cfg(feature = "quantum_fabric")]
pub use wai_quantum::quantum_fabric;
// The fabric's WebGPU member: natively, and in a browser on
// wasm32-unknown-unknown. No other wasm32 target has a GPU interface.
#[cfg(all(feature = "quantum_fabric_webgpu", any(not(target_arch = "wasm32"), target_os = "unknown")))]
pub use wai_quantum::quantum_fabric_webgpu;
#[cfg(feature = "quantum_qio")]
pub use wai_quantum::quantum_qio;
#[cfg(feature = "quantum_qio")]
pub use wai_quantum::quantum_dmrg;
#[cfg(feature = "quantum_qio")]
pub use wai_quantum::quantum_tdvp;
#[cfg(feature = "quantum_qio")]
pub use wai_quantum::quantum_chem;
#[cfg(feature = "quantum_qio")]
pub use wai_quantum::quantum_nqs;
#[cfg(any(feature = "quantum_tn", feature = "quantum_sv"))]
pub use wai_quantum::gates;
#[cfg(feature = "quantum_qir")]
pub use wai_quantum::quantum_qir;
// Variational quantum machine learning (`wai.quantum.vml`) — the interference-based
// ML the thermodynamic pivot left behind: a Quantum Circuit Born Machine trained by
// exact parameter-shift gradient on the classical state vector, plus a
// barren-plateau probe (the honest limit). Deterministic f64.
#[cfg(feature = "quantum_vml")]
pub use wai_quantum::quantum_vml;
// The phasor bridge (`wai.quantum.phasor`) — a quantum feature-map model is exactly
// a Fourier series of phasors; compute it on the state vector, extract the spectrum,
// and reproduce the identical function as a classical phasor sum (FHRR/HDC) + a
// qFHRR quantized-phase variant. Same interference, two substrates.
#[cfg(feature = "quantum_phasor")]
pub use wai_quantum::quantum_phasor;
// The full Born machine on the qFHRR substrate (`wai.quantum.qfhrr`) — run the whole
// generative distribution with amplitude phases at qFHRR (b-bit) resolution: a
// trained Born machine deployed end-to-end on the phasor substrate, converging to
// the exact state vector as phase bits grow.
#[cfg(feature = "quantum_qfhrr")]
pub use wai_quantum::quantum_qfhrr;
// Phasor-feature classifier (`wai.quantum.kernel`) — the quantum kernel as random
// Fourier / FHRR phasor features + a ridge classifier: separates nonlinearly-
// separable data a linear model cannot, at qFHRR resolution, with counted phasor
// ops for joule pricing.
#[cfg(feature = "quantum_kernel")]
pub use wai_quantum::quantum_kernel;
// Phasor energy meter (extensions/quantum-sim § Receipt, `wai.quantum.phasor`): the
// energy-accounted seal for an interference computation — portable-exact phasor
// work (linear, recomputable) split from measured-attested joules and their class, so
// qFHRR is an
// accountable substrate, not merely a fast one. Reuses the JWP Merkle + Ed25519.
#[cfg(feature = "quantum_phasor_meter")]
pub use wai_quantum::quantum_phasor_meter;
// Learning from quantum data (extensions/quantum-sim § QData, `wai.quantum.qdata`):
// the exponential sample-complexity separation for Pauli-channel learning — Ω(2^n)
// copies without quantum memory vs O(1/ε²) n-independent copies with a two-copy Bell
// measurement (Chen–Cotler–Huang–Li). The advantage that survives dequantization and
// makes `noise_learn`'s Bell/CB sampling data-efficient. Pure f64, deterministic.
#[cfg(feature = "quantum_qdata")]
pub use wai_quantum::quantum_qdata;
// Quantum Bill of Materials (extensions/quantum-ops § Provenance,
// `wai.quantum.qbom`): assemble the stage receipts of one quantum computation into
// a single signed, content-addressed provenance manifest — the audit sidecar the
// operations layer doesn't sign. Exposes a provenance root + total energy, and
// binds each listed stage to a receipt that itself verifies (a swapped or forged
// stage breaks the bill). The synthesis of the quantum-ops receipt family.
#[cfg(feature = "quantum_qbom")]
pub use wai_quantum::quantum_qbom;
pub use codecs::{
sink_capabilities,
CAP_AUDIO_FLAC, CAP_AUDIO_OPUS,
CAP_IMAGE_AVIF, CAP_IMAGE_JPEG, CAP_IMAGE_JXL, CAP_IMAGE_PNG,
CAP_NEURAL_BMSHJ2018, CAP_NEURAL_DAC, CAP_NEURAL_DCVC_RT, CAP_NEURAL_ENCODEC32,
CAP_NEURAL_GLC, CAP_NEURAL_MIMI, CAP_NEURAL_VIDEO_BMSHJ2018, CAP_NEURAL_WAVTOKENIZER,
CAP_TEXT_XZ, CAP_TEXT_ZSTD,
CAP_VIDEO_AV1, CAP_VIDEO_AV1_LOSSLESS,
};
pub use container::{Conditioning, Manifest, ModelRequirement, Wai};
#[cfg(all(test, feature = "codecs"))]
mod integration_tests {
use super::*;
#[test]
fn end_to_end_image_jxl_lossless() {
// build an image, encode as JXL lossless, wrap in a WAI envelope,
// round-trip the envelope, decode, byte-compare.
let h = 64u32;
let w = 64u32;
let mut rgb = vec![0u8; (h * w * 3) as usize];
for i in 0..h as usize {
for j in 0..w as usize {
let p = (i * w as usize + j) * 3;
rgb[p] = (i * 4) as u8;
rgb[p + 1] = (j * 4) as u8;
rgb[p + 2] = ((i + j) * 2) as u8;
}
}
let payload = codecs::image::jxl_encode(&rgb, h, w, None).unwrap();
let manifest = Manifest::new(
"image",
"replicate",
ModelRequirement::new(CAP_IMAGE_JXL).with_fallback(CAP_IMAGE_PNG),
Conditioning::new("jxl"),
)
.with_target(serde_json::json!({"h": h, "w": w}));
let wai = Wai::new(manifest, payload);
let bytes = wai.to_bytes().unwrap();
let recovered = Wai::from_bytes(&bytes).unwrap();
assert_eq!(recovered.capability(), CAP_IMAGE_JXL);
let (rec_rgb, rh, rw) = codecs::image::jxl_decode(&recovered.payload).unwrap();
assert_eq!((rh, rw), (h, w));
assert_eq!(rec_rgb, rgb, "JXL lossless via WAI envelope must round-trip exactly");
}
}