wasm-capability-contract 0.3.0

Generic, domain-agnostic capability pattern: CapabilityEngine/CapabilityRegistry/CapabilityDispatcher trait shapes + component/capability types. Trait definitions only -- see wasm-capability-core for this pattern's own default implementation, extracted from agent-runtime's ADR-001 (agent-runtime#31, ADR-011).
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64

//! [`CapabilityScope`] — what a granted capability is actually allowed to reach.

use serde::{Deserialize, Serialize};

use crate::EgressIdentity;

/// Per-capability-kind scope, carried on a [`crate::CapabilityGrant`].
///
/// Each variant's allowlist is the deny-by-default boundary a real
/// `ComponentValidator` implementor enforces (ADR-001): a capability call
/// naming a target outside its own allowlist is rejected, checked again on
/// every call, not just once at grant-registration time.
///
/// `["*"]` is a real, explicit opt-in to "unrestricted" for `Http`/`Grpc`/
/// `Complete`/`Mcp` only. **`Database`/`Secrets` never accept a wildcard,
/// under any circumstance** — every entry in `allowed_queries`/
/// `allowed_secrets` must individually name one specific, deployer-
/// pre-registered query or secret. This is a permanent security boundary
/// of the design (no raw-SQL capability is ever offered to a guest, and no
/// blanket secret-store access), not a v1 limitation a future grant format
/// might relax.
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(tag = "type", rename_all = "snake_case")]
pub enum CapabilityScope {
    /// Scopes `http-egress`: the hostnames this grant may reach, and which
    /// identity mechanism to present.
    Http {
        /// Hostnames this grant may reach. `["*"]` opts into unrestricted.
        allowed_hosts: Vec<String>,
        /// Which identity mechanism the call presents to `allowed_hosts`.
        identity: EgressIdentity,
    },
    /// Scopes `grpc-egress`: the fully-qualified `"pkg.Service/Method"`
    /// names this grant may invoke, and which identity mechanism to present.
    Grpc {
        /// Methods this grant may invoke. `["*"]` opts into unrestricted.
        allowed_methods: Vec<String>,
        /// Which identity mechanism the call presents to the bound target.
        identity: EgressIdentity,
    },
    /// Scopes `llm-complete`: the model ids this grant may call.
    Complete {
        /// Model ids this grant may call. `["*"]` opts into unrestricted.
        allowed_models: Vec<String>,
    },
    /// Scopes `mcp-egress`: the remote tool names this grant may call.
    Mcp {
        /// Tool names this grant may call. `["*"]` opts into unrestricted.
        allowed_tools: Vec<String>,
    },
    /// Scopes `database`: the deployer-pre-registered, parameterized query
    /// names this grant may invoke. Never accepts a wildcard — see this
    /// type's own doc comment.
    Database {
        /// Named queries this grant may invoke. No wildcard, ever.
        allowed_queries: Vec<String>,
    },
    /// Scopes `secrets`: the individually-named secrets this grant may
    /// read. Never accepts a wildcard — see this type's own doc comment.
    Secrets {
        /// Secret names this grant may read. No wildcard, ever.
        allowed_secrets: Vec<String>,
    },
}