🥮 mooncakes.io

    #Provider snapshot byte contract

    This package encodes and checks the one-shot binary Ion 1.0 contract implemented by morphir-package/provider-snapshot/0.1.0-draft.1. A decoded Snapshot checks correlation, profile, policy/lock identities and retained native/context hashes. It does not authenticate a service or grant access to saved bytes. Its host must qualify the selected executable and freshly complete the scoped operation before installing its views.

    Requests are capped at 4 MiB and responses at 16 MiB. Binary structure is bounded before materialization. Closed structs reject unknown/duplicate fields, nested annotations and wrong types. The graph allows 128 Libraries, 256 contexts per Library and 1024 contexts in total.

    Original native JSON bytes and their revision stay separate from the checked v4.0 JSON core and raw document metadata. Both remain supported JSON artifacts, carried as exact Ion blobs. Context resolution uses only the retained inventory, including relative imports, with no filesystem or network fallback. A digest that identifies different inventory bases refuses rather than choosing relative import semantics by order; use an inventory-relative reference from its admitted base in that case. Returned semantic views are reparsed so mutation cannot alter the retained response.

    shared_fixture_wbtest.mbt embeds binary responses emitted by the Rust service at af6d3b36cd393c8cc9fa4e5f0ddf0b31674642fa, from its known-key test fixture. Those keys are never production defaults. The fixture qualifies byte and naming interoperability on all targets, not installed authenticated-host behavior.

    TransportError

    source
    pub(all) suberror TransportError {
      Invalid(String)
    }

    An untrusted frame never establishes provider authenticity. The process host must first qualify its executable and freshly complete the scoped operation.

    Expected

    source
    pub(all) struct Expected {
      invocation : String
      project_scope : String
      release : String
      policy_sha256 : String
      lock_sha256 : String
    }

    Frozen correlation and identities expected by this host operation.

    Snapshot

    source
    pub struct Snapshot {
      // private fields
    }

    A shape-checked wire response, NOT an authenticated capability. Only a host that freshly completed its qualified service may install its views. All original graph buffers remain retained; returned core/metadata are reparsed so caller mutation cannot change this response's accepted inventory.

    Snapshot::context

    source
    fn Snapshot::context(self : Snapshot, resource : String, base : String) -> 
    ContextDocument     raise

    Resolve only retained inventory bytes. A document URI is not a filesystem grant. Relative imports remain within their selected Library's inventory.

    Snapshot::decode

    source
    fn Snapshot::decode(bytes : Bytes, expected : Expected) -> Snapshot raise

    Validate one correlated response and retain its complete graph. This checks transport identities only; it does not independently verify signatures.

    Snapshot::native_revision

    source
    fn Snapshot::native_revision(self : Snapshot) -> String

    Raw retained native identity. A decoded snapshot alone grants no authority.

    Snapshot::restored

    source

    Return a fresh semantic view after the host has granted this response.

    MAX_REQUEST_BYTES

    source
    let MAX_REQUEST_BYTES : Int

    MAX_RESPONSE_BYTES

    source
    let MAX_RESPONSE_BYTES : Int

    SERVICE_ID

    source
    let SERVICE_ID : String

    admit_capabilities

    source
    fn admit_capabilities(bytes : Bytes, invocation : String, project_scope : String) -> Unit raise

    Check this exact protocol revision. A response is not executable attestation.

    capabilities_request

    source
    fn capabilities_request(invocation : String, project_scope : String) -> Bytes raise

    Encode an effect-free one-shot capability probe.

    snapshot_request

    source
    fn snapshot_request(expected : Expected, policy : Bytes, lock : Bytes, registry : String, state : String, output : String) -> Bytes raise

    Encode granted roots and immutable policy/lock snapshots as binary Ion blobs. Caller must qualify the selected service and grant these paths independently.

    Source Files