Struct FunctionConfig 

pub struct FunctionConfig {

    pub imports: Vec<String>,
    pub limits: Option<HandlerLimits>,
    pub env: BTreeMap<String, String>,
    pub secrets: BTreeMap<String, String>,
    pub runtime: Runtime,
    pub quota: FunctionQuota,
    pub webhook: Option<WebhookConfig>,
    pub invoke_targets: Vec<String>,
    pub stats_topics: Vec<String>,
    pub tenant_secret_names: Vec<String>,
    pub upload_containers: Vec<String>,
    pub blobstore_containers: Vec<String>,
    pub egress_allowlist: Vec<String>,
    pub blob_upload_site: Option<String>,
    pub blob_site: Option<String>,
    pub tenancy: Option<Tenancy>,
    pub token_claims: Option<HandlerGraphqlTokenClaims>,
}

A function’s binding/capability config — the HandlerConfig capability fields (imports, resource limits, static env) minus its trigger (route/methods, which become a Trigger), plus the Runtime knob. A HandlerConfig is a function’s config, so the engine has one path.

Fields

imports: Vec<String>

Requested host capabilities (interface names).

limits: Option<HandlerLimits>

Optional resource limits (mem / timeout / fuel).

env: BTreeMap<String, String>

Static, non-secret environment.

secrets: BTreeMap<String, String>

Env-var name → secret reference (ENV_VAR → HOST_ENV), resolved server-side from the serve env at instantiation; the value is a reference, never stored in the manifest or the control-plane store (mirrors a site handler’s [handlers].secrets).

runtime: Runtime

Execution substrate (default wasm).

quota: FunctionQuota

Usage quota (FA-4). Absent / all-None ⇒ unlimited.

webhook: Option<WebhookConfig>

Signed inbound-webhook ingress (FA-5). Absent ⇒ no webhook endpoint.

invoke_targets: Vec<String>

Function-to-function invoke allowlist (FI): the target names this function may call through the invoke capability. Each entry may use * wildcards (* = any sibling, img-* = a family, resize = one literal). Deny by default: empty ⇒ the function cannot invoke anything, even if it imports invoke. Only consulted when imports contains invoke.

stats_topics: Vec<String>

Declared bus: stats-topic templates for the read-only messaging-stats capability: each a bus:-relative topic with an optional literal {tenant} placeholder the HOST fills with this invocation’s resolved tenant (e.g. sync/{tenant}/import). A guest’s messaging-stats call for a bus: topic must name one of these verbatim; the host substitutes the tenant, so the guest can never read another tenant’s bus stats. Deny by default: empty ⇒ no bus stats readable. Only consulted when imports contains messaging-stats.

tenant_secret_names: Vec<String>

Per-component name allowlist for the per-tenant sealed-secret capability (boatramp:handlers/tenant-secrets, task #493): the secret names this function may address for its resolved tenant. Least-privilege: empty ⇒ deny-all. A name not in the list is access-denied; the resolved tenant is always host-supplied. Only consulted when imports contains a tenant-secrets:* right.

upload_containers: Vec<String>

Per-component container allowlist for the guest blob-upload mint capability (boatramp:handlers/blob-upload, S3 external ingress): the blob containers this function may mint an upload credential for. Least-privilege: empty ⇒ deny-all. A container not in the list is access-denied; the project is always host-forced from the resolved invocation scope, and the site is host-forced from blob_upload_site. Only consulted when imports contains a blob-upload:* right.

blobstore_containers: Vec<String>

Per-component container allowlist for the plain wasi:blobstore capability (host-enforced tenant confinement; same contract as crate::config::HandlerConfig::blobstore_containers): the blob containers this function may open, {tenant}-templated against its host-resolved OWN tenant. SEPARATE from upload_containers — no inheritance/fallback. Empty on a multi-tenant function ⇒ deny-all (fail-closed); empty single-tenant ⇒ permissive. Only consulted when imports contains wasi:blobstore.

egress_allowlist: Vec<String>

Per-component outbound-TCP allowlist for the gated wasi:sockets capability (same contract as crate::config::HandlerConfig::egress_allowlist): the host:port / ip:port / CIDR:port targets this function may connect to. Empty ⇒ deny-all. A standalone top-level function opts into outbound TCP by naming targets here; the engine’s socket_addr_check then enforces it connect-only + SSRF-floored, and ONLY when the node posture allow_guest_tcp_egress is on. Only consulted when imports contains wasi:sockets.

blob_upload_site: Option<String>

The site a standalone top-level function mints blob-upload credentials for (boatramp:handlers/blob-upload, S3 external ingress). A site handler mints for its own host-routed site, but a standalone function has no single resolved site — so it names one here, in its config (host-forced, never guest-supplied: the WIT surface still has no project/site parameter). At bind time the host validates the named site actually exists in the function’s (host-forced) project; the credential then lands objects at hblob/{project-qualified-site}/{container}/{key} — the exact prefix the guest compat::blob read path serves, so nothing new is invented. Absent, or naming a site that does not exist in the project ⇒ fail-closed (no-resolved-site, the binding is not attached). A guest can never override it. Only consulted when imports contains a blob-upload:* right.

blob_site: Option<String>

Bind the plain wasi:blobstore capability to a NAMED SITE’s shared blob container namespace (hblob/{project-qualified-site}/{container}/) instead of this function’s private hblob/{project-qualified-fn}/… one — the blob analog of binding a shared sql database by name (#13). A bus-triggered standalone function (the only path whose wasi:blobstore is fn-private; a routing.consumers consumer is already site-scoped) can then read/write the SAME objects a same-site HTTP handler and a compute bind-blob --site producer use — e.g. a delivery worker reading the body the MX edge wrote. HOST-FORCED to this function’s project (the guest never names a project/site); the named site must EXIST in the project AND grant wasi:blobstore in its [handlers].allow_imports (the same least-privilege consent a site’s own consumer passes) — else the blob binding fails closed (not attached; a guest blob op is access-denied, never silently served from the fn-private namespace). The blobstore_containers allowlist, {tenant} confinement, and object-key screening all still apply unchanged on top of the site scope, so a blob_site binding gets EXACTLY what a same-site handler gets, never more. Absent ⇒ the function’s private fn/<name> blob scope (no regression). Only consulted when imports contains wasi:blobstore.

tenancy: Option<Tenancy>

In-site tenancy decision for this function’s sql/orm access (Dimension 0). Absent ⇒ undeclared (refused under the multi-tenant posture, treated as Disabled — plain queries — under single-tenant/dev). Scoped opts into host-injected row scoping. Parsed via the crate::tenancy::de_opt_tenancy bridge so it reads from RON (project.cfg) as well as the stored JSON.

token_claims: Option<HandlerGraphqlTokenClaims>

JWKS/issuer config verifying the app bearer for a crate::tenancy::TenantSource::Token tenant source when this function is invoked over HTTP (the function analogue of a site’s [handlers.graphql.data].claims_from_token). Absent ⇒ the token source can’t verify, so it resolves no value (fail-closed); the domain/none sources don’t need it.

Trait Implementations

impl Clone for FunctionConfig

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for FunctionConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for FunctionConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for FunctionConfig

where FunctionConfig: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for FunctionConfig

impl PartialEq for FunctionConfig

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for FunctionConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for FunctionConfig