Search Apps Documentation Source Content File Folder Download Copy Actions Download State String Boolean Number Struct Map Slice Pointer Function Closure Reference Nil Package Type Interface Unknown

service_registry source realm

Constants 1

const MaxServices, MaxServicesPerOwner, MaxNameLen, MaxTypeLen, MaxPkgPathLen, MaxDescriptionLen, MaxMetadataLen, pkgPathPrefix, ReservationPeriod, MaxRenderServices, renderDescLen

 1const (
 2	// MaxServices is a pure state bound, not an anti-squat defense —
 3	// MaxServicesPerOwner is what makes monopolization expensive
 4	// (pearl audit R1). Kept at 1000 rather than raised further so the
 5	// linear scans over `names` (Deregister, ListServices, ListByType)
 6	// stay bounded at a size one transaction can comfortably pay for.
 7	MaxServices = 1000
 8
 9	// MaxServicesPerOwner caps how many names one address may hold at
10	// once. Enforced at registration and, for a handoff, at the moment
11	// the recipient CONSENTS (see AcceptOwnership).
12	MaxServicesPerOwner = 20
13
14	MaxNameLen        = 64
15	MaxTypeLen        = 32
16	MaxPkgPathLen     = 128
17	MaxDescriptionLen = 500
18	MaxMetadataLen    = 2000
19
20	pkgPathPrefix = "gno.land/"
21
22	// ReservationPeriod is how long a deregistered name stays reserved.
23	// Long enough for integrators to notice the deregistration; finite
24	// so tombstones cannot lock the namespace forever.
25	ReservationPeriod = int64(90 * 24 * 3600) // 90 days
26
27	// MaxRenderServices bounds the gnoweb table. Render is reachable by
28	// any viewer, so its cost lands on third parties rather than on
29	// whoever grew the state (pearl audit Y3). Complete data comes from
30	// the bounded queries named in the truncation notice.
31	MaxRenderServices = 25
32
33	// renderDescLen is the per-row description budget, applied to the
34	// RAW text before escaping so an escape sequence is never split.
35	renderDescLen = 60
36)
source

Functions 15

func AcceptOwnership

crossing Action
1func AcceptOwnership(cur realm, name string)
source

AcceptOwnership completes a nominated handoff. Only the nominee can accept, and the nominee's own quota is checked HERE — at consent — so a nomination can never push an account past MaxServicesPerOwner without that account agreeing to it.

func Deregister

crossing Action
1func Deregister(cur realm, name string)
source

Deregister removes a service from the registry. Only the owner can deregister. The name stays reserved for the former owner and the original registrant for ReservationPeriod — it cannot be re-registered by anyone else in that window, so integrators who still resolve it can never be silently redirected by a squatter.

func GetPendingOwner

Action
1func GetPendingOwner(name string) string
source

GetPendingOwner returns the nominated-but-not-yet-accepted owner of a service, or "none" when no handoff is open.

func GetService

Action
1func GetService(name string) string
source

GetService returns a formatted summary of a registered service. Free text is escaped for a single-line markdown slot.

func ListByType

Action
1func ListByType(serviceType string) string
source

ListByType returns all service names matching a given type. Same cost note as ListServices.

func ListServices

Action
1func ListServices() string
source

ListServices returns all registered service names as a comma-separated string in registration order.

COST NOTE: this is O(MaxServices) and is deliberately NOT truncated — an integrator enumerating the registry needs the complete set, and the caller pays for its own read. Render, whose cost lands on third-party viewers instead, IS bounded.

func OwnerServiceCount

Action
1func OwnerServiceCount(owner address) (count, limit int)
source

OwnerServiceCount returns how many services an address currently holds and the per-owner cap.

func RegisterService

crossing Action
1func RegisterService(cur realm, name, pkgPath, description, serviceType, metadata string)
source

RegisterService adds a new service to the registry. The caller becomes the owner. Name must be unique, lowercase alphanumeric/underscores. pkgPath is the realm the service lives at — the field integrators resolve — and must look like a gno.land package path. A name that was deregistered stays reserved for its former owner and its original registrant for ReservationPeriod.

NOTE: this realm does NOT and cannot verify that pkgPath exists or that the caller controls it. See the INTEGRATOR CONTRACT on Resolve.

func Render

1func Render(path string) string
source

Render returns a markdown overview, bounded to MaxRenderServices rows (pearl audit Y3). Never panics. All free text goes through the ecosystem sanitizer rather than a bespoke escaper: the hand-rolled replacement of backticks and pipes it replaces left `[`, `]`, `(`, `)` and `!` live, so any registrant could inject a working markdown link or image into a table cell and phish every viewer of this page.

func Resolve

Action
1func Resolve(name string) string
source

Resolve returns the pkgpath a service name points to — the primary integration query. Panics on unknown names so a consumer can never silently integrate against a missing entry.

INTEGRATOR CONTRACT — read this before trusting a resolution:

  1. A resolution is an ATTESTATION, NOT A PROOF. This realm records that some address claimed a name for some package path. It does NOT verify that the path exists, that it is deployed, or that the registrant controls it. Contrast r/demo/defi/grc20reg, which proves control by requiring the registered token object to originate from the calling realm; no equivalent proof exists for a bare path string, and requiring one would mean only realms — never their operators — could ever register a name, which is not this registry's model.

  2. A NAME IS NOT AN AUTHORIZATION. Never grant a privilege, route a payment, or admit a caller because Resolve returned its path. Resolution answers "where does this name point", never "may this caller act". Derive authority from your own crossing entrypoint's cur.Previous(), or from an explicit access-control realm.

  3. THE TARGET CAN CHANGE. The owner may repoint a name at any time via UpdateService, and ownership itself is transferable. Treat a resolution as valid only for the transaction that read it; cache it and you inherit whatever the name points at later. The ServiceUpdated and OwnershipTransferred events exist so movement is detectable.

func ServiceCount

Action
1func ServiceCount() (count, limit int)
source

ServiceCount returns how many services are registered and the global cap, so a caller can check headroom without pulling the whole list.

func TransferOwnership

crossing Action
1func TransferOwnership(cur realm, name string, newOwner address)
source

TransferOwnership NOMINATES a new owner for a service entry; the nominee must call AcceptOwnership to take control (pearl audit Y4).

The one-step form this replaces was a permanent-brick hazard: address.IsValid() only checks bech32 form, so a well-formed but unowned destination passed the check and committed immediately, after which the entry could never again be updated, transferred or deregistered — and because it could never be deregistered it could never enter the reservation window either, so the NAME became a permanent hole in a shared global namespace.

Nomination changes nothing: the sitting owner keeps full control until the nominee consents. Passing "" clears a pending nomination.

func TryResolve

Action
1func TryResolve(name string) (string, bool)
source

TryResolve is the non-panicking variant for consumers that need to degrade gracefully when a name disappears (re-audit: a panicking-only read path bricks any consumer realm that calls it inline). The INTEGRATOR CONTRACT documented on Resolve applies here identically.

func UpdateService

crossing Action
1func UpdateService(cur realm, name, pkgPath, description, serviceType, metadata string)
source

UpdateService modifies a service's pkgpath, description, type, and metadata. Only the registered owner can update. Name cannot change.

An update MAY REPOINT the name at a different package path. That is a deliberate capability (services move, and versions supersede), but it also means a name an integrator trusts today can point elsewhere tomorrow. The ServiceUpdated event carries both the old and the new path specifically so a repoint is observable in the transaction log rather than something a consumer has to poll for.

Types 2

type Reservation

struct
1type Reservation struct {
2	Owner      address
3	Registrant address
4	Expires    time.Time
5}
source

Reservation holds a deregistered name for its former owner AND its original registrant, and EXPIRES (re-audit 2026-09-02): an eternal reservation let an attacker cycle register/deregister to lock the whole namespace forever, and a hostile transferee could strand a name against its original registrant permanently.

type Service

struct
1type Service struct {
2	Name        string
3	Owner       address
4	Registrant  address // ORIGINAL registrant; immutable through transfers
5	PkgPath     string  // the realm the service lives at — what integrators resolve
6	Description string
7	ServiceType string // e.g. "token", "dex", "oracle", "dao", "nft", "bridge"
8	Metadata    string // freeform key=value pairs or JSON blob
9}
source

Service represents a registered on-chain service.

Imports 6

Source Files 2