1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
{
"lexicon": 1,
"id": "com.fedfork.exec.composition",
"defs": {
"main": {
"type": "record",
"key": "any",
"description": "Wasm module instances composed into one program: which instance may call which other instance's entry or which caller-supplied handler, over which NSID, for which reason, under which policy modules. Anything not granted here is refused.",
"record": {
"type": "object",
"required": ["name", "instances"],
"properties": {
"name": { "type": "string", "maxLength": 2560, "maxGraphemes": 256 },
"description": { "type": "string", "maxLength": 30000, "maxGraphemes": 3000 },
"instances": { "type": "array", "minLength": 1, "maxLength": 256, "items": { "type": "ref", "ref": "#instance" } },
"handlers": { "type": "array", "maxLength": 256, "items": { "type": "ref", "ref": "#handler" } },
"edges": { "type": "array", "maxLength": 1024, "items": { "type": "ref", "ref": "#edge" } },
"limits": { "type": "ref", "ref": "#limits" },
"parameters": { "type": "array", "maxLength": 256, "items": { "type": "ref", "ref": "#parameter" }, "description": "Values a binding fills: {\"$param\": key} in an instance's input; {\"$host\": name} the host fills." },
"exports": { "type": "array", "maxLength": 256, "items": { "type": "ref", "ref": "#export" }, "description": "The entry that serves each contract." },
"createdAt": { "type": "string", "format": "datetime" }
}
}
},
"instance": {
"type": "object",
"description": "A module under a name. One module may back several instances with different config, session and grants.",
"required": ["name", "module"],
"properties": {
"name": { "type": "string", "maxLength": 256, "description": "Unique in the composition; [A-Za-z0-9_-]." },
"module": { "type": "string", "maxLength": 2048, "description": "A com.fedfork.exec.wasm.module AT-URI, or a staged module key (modules/<key>.wasm)." },
"pin": { "type": "string", "minLength": 64, "maxLength": 64, "description": "The module's pin, 64 lowercase hex: sha256 of its wasm's hex sha256, a newline and its grant fields (calls, anyRecords, hooks, implements, anyHooks, didkey, http; those present) as JSON with sorted keys. A record whose grants change no longer matches. An instance with a pin gets no hook default (route its hooks to pinned instances)." },
"session": { "type": "string", "maxLength": 512, "description": "The session name this instance's XRPC calls use." },
"input": { "type": "unknown", "description": "Static config merged under every call's input: an object whose keys are the module's config fields, of their types." },
"calls": { "type": "array", "maxLength": 256, "items": { "type": "string", "format": "nsid" }, "description": "Narrows the module's calls allowlist for this instance; never widens it." },
"policies": { "type": "array", "maxLength": 256, "items": { "type": "ref", "ref": "#policy" }, "description": "Run before every call this instance makes." },
"budget": { "type": "unknown", "description": "Overrides of the step protocol run budget for runs of this instance." }
}
},
"handler": {
"type": "object",
"description": "A handler the caller of the composition must supply (a JS function in the host).",
"required": ["name"],
"properties": {
"name": { "type": "string", "maxLength": 256 },
"description": { "type": "string", "maxLength": 30000, "maxGraphemes": 3000 }
}
},
"edge": {
"type": "object",
"description": "Instance `from` may call `nsid`; the host routes it to instance `to` (at the entry its module implements for `nsid`: a module that does not implement it is refused), or to `handler`. The reason is logged and shown to the callee and to policies. `nsid` must be one of the `from` module's hooks or in its calls; one edge per (from, nsid), except for a hook with combine all-allow: its edges are its routes, run in this order.",
"required": ["from", "nsid", "reason"],
"properties": {
"from": { "type": "string", "maxLength": 256 },
"nsid": { "type": "string", "format": "nsid" },
"to": { "type": "string", "maxLength": 256 },
"handler": { "type": "string", "maxLength": 256 },
"reason": { "type": "string", "maxLength": 30000, "maxGraphemes": 3000 },
"policies": { "type": "array", "maxLength": 256, "items": { "type": "ref", "ref": "#policy" } }
}
},
"policy": {
"type": "object",
"description": "A policy instance run before a call: its entry (default evaluate) gets { args, call } and returns { allow, violations: [{ msg, policyId }] }. Anything but allow: true refuses the call.",
"required": ["instance"],
"properties": {
"instance": { "type": "string", "maxLength": 256 },
"entry": { "type": "string", "maxLength": 256 },
"args": { "type": "unknown" }
}
},
"limits": {
"type": "object",
"description": "Across the whole call graph of one root run.",
"properties": {
"depth": { "type": "integer", "minimum": 1, "maximum": 64, "description": "Nested runs, default 8." },
"calls": { "type": "integer", "minimum": 1, "description": "Routed calls, handler calls, capability calls and policy runs, default 100." }
}
},
"parameter": {
"type": "object",
"required": ["key"],
"properties": {
"key": { "type": "string", "maxLength": 64, "description": "[A-Za-z_][A-Za-z0-9_]*, unique." },
"label": { "type": "string", "maxLength": 2560, "maxGraphemes": 256 },
"type": { "type": "string", "knownValues": ["string", "integer", "number", "boolean", "object", "array"], "description": "As module.json action fields; default string." },
"required": { "type": "boolean" },
"description": { "type": "string", "maxLength": 30000, "maxGraphemes": 3000 },
"secret": { "type": "boolean", "description": "Filled from the host's secrets, never a record; no default." },
"minimum": { "type": "integer" },
"maximum": { "type": "integer" },
"values": { "type": "unknown", "description": "{default?, enum?}: JSON values of the parameter's type." }
}
},
"export": {
"type": "object",
"required": ["nsid", "instance", "entry"],
"properties": {
"nsid": { "type": "string", "format": "nsid" },
"instance": { "type": "string", "maxLength": 256 },
"entry": { "type": "string", "maxLength": 256 }
}
}
}
}
