Crate wasm_capability_contract 

wasm-capability-contract — the capability-sandbox contract (ADR-001): trait/DTO surface only. See wasm-capability-core (this repo) for this pattern’s own default implementation, and docs/3-architecture/adr/ADR-001-capability-layer-design.md at the repo root for the full design this crate is a direct contract for.

No api/ wrapper directory: a contract crate has exactly one real layer by construction (swearchitect#388) — its own src/ already is that layer, so nesting everything one level deeper under a same-purpose api/ folder is redundant, not a second, distinct SEA layer being introduced.

CapabilityDispatcher/CapabilityRegistry keep their real, deliberate signatures (a multi-parameter dispatch, a non-Result descriptor lookup) rather than being forced into arch’s generic *Request/ *Response shape — see docs/known-exceptions.md for why.

Structs

CapabilityDescriptor

What a CapabilityRegistry returns for one capability name: the host import name a granted, structurally-present capability wires to.

CapabilityGrant

One capability granted to a component’s route, by name and scope.

CapabilityScope

A granted capability’s own allowlist, carried on a crate::CapabilityGrant.

ComponentHandle

Opaque handle to a loaded component instance.

ComponentInvokeRequest

Request to invoke a loaded component’s handler export once.

ComponentInvokeResponse

Response from a successful crate::CapabilityEngine::invoke call.

ComponentLoadRequest

Request to load an already-validated component artifact into the engine.

ComponentLoadResponse

Response from a successful crate::CapabilityEngine::load call.

ComponentManifest

Declares what a Wasm component is, what it declares it needs to run.

ResourceLimits

Resource bounds a component’s host must enforce on every invocation.

ValidateComponentRequest

Everything a ComponentValidator needs to check one component before its route is registered: the manifest it claims, the real bytes it ships, and what the route was actually granted.

Enums

CapabilityError

Everything ComponentValidator::validate or a real CapabilityEngine can fail with, named so the message alone tells the caller what to fix.

Traits

CapabilityDispatcher

Executes one capability call: decode payload, call the real implementor injected behind this dispatcher, encode the result back to bytes. A leaf operation (ADR-001) — never triggers a second capability call on the guest’s behalf.

CapabilityEngine

Loads a validated component and invokes its handler export.

CapabilityRegistry

Resolves a capability name (e.g. "http-egress", or a deployer-scoped instance like "grpc-egress:inventory-svc") to the descriptor describing how it dispatches.

ComponentValidator

Checks a Wasm component’s manifest and real bytes before its route is registered. A real implementor enforces two gates, per ADR-001: