Module resolve 

Allow-list resolution of the external resources a config names (#881, RFC 0013).

A config can reach outside the process in a handful of ways: a local path, a URL, a command to run, an environment variable, a ${file:} read, or a secret-manager reference. A ReferencePolicy lists what a config of a given origin may reach, and everything it does not list is refused.

Connector config fields that name such a resource carry the RESOURCE_ANNOTATION (x-faucet-resource: path | url | command) in their JSON Schema, so a host can check any connector — including one it has never seen — by walking the schema against the config (annotated_resources). In a connector crate:

#[derive(serde::Deserialize, schemars::JsonSchema)]
pub struct MyConfig {
    #[schemars(extend("x-faucet-resource" = "path"))]
    pub cert_file: Option<String>,
}

Structs

ReferencePolicy

The external resources a config of one origin may reach.

Refusal

Why a reference was refused.

ResourceRef

One resource a config names, found through a schema annotation.

Enums

RefusalKind

What a refused reference was.

ResourceKind

What kind of external resource a config field names.

Constants

RESOURCE_ANNOTATION

The JSON Schema keyword marking a config field that names an external resource. Its value is a ResourceKind ("path", "url", "command").

SANDBOX_ANNOTATION

The JSON Schema keyword (value true) on a top-level boolean config field that, set to true, confines a connector whose own input can otherwise reach host files or the network — a SQL query that can ATTACH or read_csv — to the resources its configuration declares. A host loading a config it does not trust forces every such field on:

Functions

annotated_fields

Every annotated field a schema declares, as dotted paths (tls.ca_path; [] marks an array element, {} a map value) with their kind.

annotated_resources

The resources config names through fields schema annotates with RESOURCE_ANNOTATION. schema is a connector’s config schema (with its own $defs); every oneOf / anyOf / allOf branch is considered, so a tagged-enum field is found whichever variant the config picked.

canonical_host

The canonical, lower-case form of a URL host as a URL parser (and the system resolver) reads it: numeric IPv4 forms (2852039166, 0xa9fea9fe, 0251.0376.0251.0376, 169.254.43518) become dotted quads, IPv6 is bracketed and compressed, and a domain loses its trailing dots. A host the parser rejects (a token, a pattern) is returned lower-cased as written.

declares

Whether a schema declares at least one field of kind.

is_metadata_host

Hosts a URL may name only when a policy lists them explicitly: link-local and cloud instance-metadata endpoints. host is compared in its canonical form (canonical_host), so 2852039166, 0xa9fea9fe or a trailing dot name the same address as 169.254.169.254.

is_metadata_ip

Whether an address is link-local or a cloud instance-metadata endpoint.

sandbox_fields

The top-level config fields schema marks with SANDBOX_ANNOTATION, across every oneOf / anyOf / allOf branch of the root.

url_hosts

The hosts a URL’s authority names (several for h1,h2 connection strings), in canonical form (canonical_host), without userinfo or port. A host taken from a ${…} token is returned lower-cased as written.