Developer Guide

Get started with Steel in a few lines of Rust. Create a runtime, load a plugin, and start executing with policy enforcement.

Quick Start

use steel_runtime::SteelContext;

// Create a runtime
let ctx = SteelContext::new();

// Add a Rego policy
ctx.policy_engine().add_policy(
    "allow_ls",
    r#"package data.steel.auth.allow
default allow = false
allow {
    input.method_name == "execute"
    input.positional[0] == "ls"
}"#,
);

// Load a plugin from an OCI archive
let loader = steel_runtime::OciPluginLoader::new(&ctx);
let plugin = loader.load_from_archive("my-plugin.oci.tar.gz")?;

// Each loaded object is ready for binding
for obj in plugin.objects() {
    println!("Loaded: {}", obj.world());
}

Crate Dependency

[dependencies]
steel-runtime = { path = "../steel-runtime" }

Enable the default-session feature for development sessions:

[dependencies]
steel-runtime = { path = "../steel-runtime", features = ["default-session"] }

Key Types

Type	What It Does
`SteelContext`	Per-runtime singleton. Shares the Wasm engine and policy engine across sessions.
`SteelState`	Per-store state. Holds WASI context, resource table, and policy engine.
`SteelSession`	Trait for resource provision. Creates stores, linkers, and compiles components.
`SteelObject`	Runtime representation of a plugin. Routes calls with policy enforcement.
`OciPluginLoader`	Loads plugins from OCI archives or registries.

Building Plugins

Use the steel-tools CLI to build Wasm components into OCI packages:

# Build
steel-tools build --input plugin.wasm --output my-plugin.oci.tar.gz

# Inspect
steel-tools inspect my-plugin.oci.tar.gz

Writing Policies

Policies are Rego files loaded into the policy engine. See the Policy page for examples and details.

C-Compatible FFI

Steel provides an extern "C" API for embedding in non-Rust applications. All functions use opaque handles and return error codes.

// Create a runtime
SteelRuntime* rt = steel_init();

// Add a policy
steel_add_policy(rt, "allow_ls", "...rego...");

// Load a plugin
SteelPlugin* plugin = steel_load_plugin(rt, "plugin.oci.tar.gz");

// Query objects
size_t count = steel_plugin_object_count(plugin);

// Clean up
steel_destroy_plugin(plugin);
steel_destroy(rt);

The FFI uses thread-local error handling. Call steel_get_last_error() to retrieve the last error message.

SDK and Bindgen

The steel-sdk provides a bindgen! macro that generates Rust bindings from WIT definitions. It produces ComponentBinder and ObjectInvoker implementations automatically.