Crate wasm_capability_contract 

wasm-capability-contract — the capability-sandbox contract (ADR-001): trait/DTO surface only. See wasm-capability-core (this repo) for this pattern’s own default implementation, and docs/3-architecture/adr/ADR-001-capability-layer-design.md at the repo root for the full design this crate is a direct contract for.

No api/ wrapper directory: a contract crate has exactly one real layer by construction (swearchitect#388) — its own src/ already is that layer, so nesting everything one level deeper under a same-purpose api/ folder is redundant, not a second, distinct SEA layer being introduced.

CapabilityDispatcher/CapabilityRegistry keep their real, deliberate signatures (a multi-parameter dispatch, a non-Result descriptor lookup) rather than being forced into arch’s generic *Request/ *Response shape — see docs/known-exceptions.md for why.

Structs

ArtifactProvenance

Identifies and verifies the .wasm artifact a crate::ComponentManifest describes.

CapabilityDescriptor

What a CapabilityRegistry returns for one capability name: the host import name a granted, structurally-present capability wires to, and which dispatcher family handles it.

CapabilityGrant

One capability granted to a component’s route, by name and scope.

ComponentHandle

Opaque handle to a loaded component instance.

ComponentInvokeRequest

Request to invoke a loaded component’s handler export once.

ComponentInvokeResponse

Response from a successful crate::CapabilityEngine::invoke call.

ComponentLoadRequest

Request to load an already-validated component artifact into the engine.

ComponentLoadResponse

Response from a successful crate::CapabilityEngine::load call.

ComponentManifest

Declares what a Wasm component is, what route it wants, what it declares it needs, and where it came from.

ResourceLimits

Resource bounds a component’s host must enforce on every invocation.

ValidateComponentRequest

Everything a ComponentValidator needs to check one component before its route is registered: the manifest it claims, the real bytes it ships, and what the route was actually granted.

Enums

CapabilityError

Everything ComponentValidator::validate or a real CapabilityEngine can fail with, named so the message alone tells the caller what to fix.

CapabilityProtocol

One variant per capability kind ADR-001 defines — tells whichever Linker-wiring code holds a CapabilityDescriptor which CapabilityDispatcher family to route a granted capability’s host import to. Registry-internal, never serialized: a CapabilityRegistry is assembled from Rust code at Builder composition time, not read from a manifest file.

CapabilityScope

Per-capability-kind scope, carried on a crate::CapabilityGrant.

EgressIdentity

Which identity mechanism an Http/Grpc egress call presents to its target, decided statically when the crate::CapabilityGrant is authored — never resolved dynamically at call time. See ADR-002 (agent-to-agent identity via edge-a2ac) and ADR-003 (control-plane and M2M identity via SST) for what each variant actually wires to; this port only carries the choice.

Traits

CapabilityDispatcher

Executes one capability call: decode payload, call the real implementor injected behind this dispatcher, encode the result back to bytes. A leaf operation (ADR-001) — never triggers a second capability call on the guest’s behalf.

CapabilityEngine

Loads a validated component and invokes its handler export.

CapabilityRegistry

Resolves a capability name (e.g. "http-egress", or a deployer-scoped instance like "grpc-egress:inventory-svc") to the descriptor describing how it dispatches.

ComponentValidator

Checks a Wasm component’s manifest and real bytes before its route is registered. A real implementor enforces two gates, per ADR-001: