wasm-capability-contract 0.4.0

//! [`CapabilityScope`] — what a granted capability is actually allowed to reach.

use serde::{Deserialize, Serialize};

/// A granted capability's own allowlist, carried on a [`crate::CapabilityGrant`].
///
/// Deliberately generic: this contract has no knowledge of what a
/// specific capability's `allowed` entries mean (hostnames, method
/// names, model ids, tool names, query names, secret names, or anything
/// else), nor of which capabilities may accept a literal `"*"` entry as
/// an explicit "unrestricted" opt-in versus which must never accept one
/// under any circumstance. That interpretation, and any enforcement of
/// it, belongs entirely to the real `ComponentValidator` implementor
/// that actually knows the capability, checked again on every call, not
/// just once at grant-registration time.
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct CapabilityScope {
    /// What this grant is allowed to reach. Empty means nothing is
    /// reachable; a specific consumer's own validator decides what (if
    /// anything) a literal `"*"` entry means for a given capability.
    pub allowed: Vec<String>,
}