Backend module SDK 1.0 reference
Use the versioned Rust, Go, and Python guest interfaces for the blinkhost-wasi-1 host ABI.
Last updated 2026-08-07
What you'll achieve
- Choose the correct SDK 1.0 call
- Understand policy-bound host capabilities
- Handle guest and host failures explicitly
Version and compatibility
Rust and Go SDK 1.0.0 are GA. The Python SDK 1.0.0 uses the same blinkhost-wasi-1 ABI but remains Production Preview with narrower package and startup compatibility. All three run as WASI Preview 1 guests. Compiler images are digest-pinned, network denied, and contain the supported SDK bytes.
Capability map
| Capability | Rust | Go/TinyGo | Python Preview |
|---|---|---|---|
| Read request | Request::from_host() |
ReadRequest() |
Request.from_host() |
| Write response | respond(Response) |
Respond(Response) |
respond(Response) |
| Named database query | query(binding, sql, params_json) |
Query(binding, sql, params) |
query(binding, sql, params) |
| Read permitted secret | secret(name) |
Secret(name) |
secret(name) |
| Structured log | log_record(level, message, attributes) |
Log(level, message, attributes) |
log(level, message, attributes) |
| Argon2 password hash | hash_password(password) |
HashPassword(password) |
hash_password(password) |
| Policy-bound fetch | fetch(request_json) |
Fetch(FetchRequest) |
fetch(method, url, headers, body) |
Every privileged call crosses the host ABI and remains subject to the signed runtime policy, plan limits, input/output bounds, timeouts, and platform security floors. Having a function in the SDK does not automatically authorize the capability for every module.
Request and response rules
Read the bounded request once and return a structured response with an explicit status. Treat header and cookie values as untrusted input. Cookie output is honored only when the active policy permits it. Do not log bodies, authorization headers, cookies, secrets, connection strings, or personal data.
Database, secret, and fetch rules
Database calls use the exact project binding name and parameterized values. Secrets are write-only at the control-plane boundary and only permitted named values reach a guest. Fetch destinations, methods, body size, redirects, and timing remain policy bounded. Never embed provider credentials as an alternative to a denied host capability.
Error handling
Rust returns the SDK Error variants, Go returns errors, and Python raises exceptions from the host bridge. Handle rejection, invalid input, missing secret, invalid JSON, timeout, and resource exhaustion without echoing sensitive input. A runtime denial is not fixed by retrying indefinitely or weakening a platform security floor.
The Rust, Go, and Python hello, request/response, and database examples are compiled to Wasm and independently verified in platform CI. Use the language guide for a complete starter and the troubleshooting guide for build, ABI, and runtime failures.
Help improve this page
Sign in to send page-specific feedback. For account-specific help, email support@blinkhost.me.