<abstract>This document defines an XMPP protocol extension for advertising and executing application-specific commands, such as those related to a configuration workflow. Typically the commands contain data forms (XEP-0004) in order to structure the information exchange.</abstract>
<remark>Corrected typos and other small errors.</remark>
</revision>
<revision>
<version>1.1.1</version>
<date>2004-01-02</date>
<initials>lw</initials>
<remark>Cleaned up errors in schema; added more clarifications about actions</remark>
</revision>
<revision>
<version>1.1</version>
<date>2003-12-30</date>
<initials>lw</initials>
<remark>More strict usage of the terms "requester" and "responder"; added explicit flow-control information; cleaned up i18n and l10n based on IETF efforts</remark>
</revision>
<revision>
<version>1.0</version>
<date>2003-05-19</date>
<initials>psa</initials>
<remark>Per a vote of the Jabber Council, advanced status to Draft.</remark>
</revision>
<revision>
<version>0.13</version>
<date>2003-04-28</date>
<initials>lw</initials>
<remark>More clarity on security; added notes about i18n and l10n; included xml:lang in XML-Schema.</remark>
</revision>
<revision>
<version>0.12</version>
<date>2003-04-22</date>
<initials>lw</initials>
<remark>Fixed typos; removed references to &PRESENCE;; added more security condiderations; added notes about <command/> child precedence.</remark>
</revision>
<revision>
<version>0.11</version>
<date>2003-02-20</date>
<initials>lw</initials>
<remark>Created XML Schema.</remark>
</revision>
<revision>
<version>0.10</version>
<date>2003-02-20</date>
<initials>lw</initials>
<remark>Relaxed and clarified <command/> payload requirements; Fixed minor errors in examples.</remark>
</revision>
<revision>
<version>0.9.1</version>
<date>2003-02-12</date>
<initials>lw</initials>
<remark>Fixed disco examples to reflect specification text.</remark>
</revision>
<revision>
<version>0.9</version>
<date>2003-02-09</date>
<initials>lw</initials>
<remark>Added "Implementation Notes" section; Removed syntax requirements for disco <item/> "node" attributes; Added "disclaimer" with regards to "node" values; Added clarifications regarding predefined/required commands; Added clarifications for command payloads; Added clarifications for command success versus failure; Added clarifications on "sessionid"; Fixed "x:data" errors.</remark>
</revision>
<revision>
<version>0.8</version>
<date>2003-01-26</date>
<initials>lw</initials>
<remark>Fixed minor grammatical errors; Changed some MUSTs to SHOULDs.</remark>
<remark>Consistency in the usage of the "x-commands" short name; Added "Discovering Support" usecase; made other disco usage more "disco-like".</remark>
</revision>
<revision>
<version>0.5</version>
<date>2003-01-18</date>
<initials>lw</initials>
<remark>Fixed minor errors; Removed "complete" action value from <command/>; Removed <list/> in favor of disco.</remark>
<remark>Fixed minor errors with examples; Changed position of DTD to be more consistent with other XEPs by this author; Added details for "disco" support; Added section on "Security Considerations", "IANA Considerations", and "JANA Considerations".</remark>
<remark>Fixed minor errors with examples; Changed from using <query/> and <x/> to <list/> for command lists; Made the "cancel" use-case more explicit.</remark>
</revision>
<revision>
<version>0.2</version>
<date>2002-10-10</date>
<initials>lw</initials>
<remark>Changed namespace from "jabber:x:commands" to "http://jabber.org/protocol/commands"; Changed execution to use <iq/> instead of any packet element; Changed execution to contain extensions; Reorganized for better clarity; Corrected spelling and grammar errors.</remark>
<p>This document specifies an XMPP protocol extension that enables an entity to initiate a command session where there is no preferred namespace. It also specifies a protocol extension for describing the types of ad hoc sessions, similar in concept to a menu.</p>
<p>The motivation for such a protocol comes from the desire to expand Jabber technologies outside the domain of instant messaging. Similar to web applications, these "Jabber applications" are systems in which, via a compliant Jabber client, a user (or automated process) can interact with the application. The client need not be specially-written in order to take advantage of this Jabber application.</p>
<p>This mechanism allows for a larger base of Jabber entities to participate as part of larger application architectures. Although specialized clients would be preferred in many environments, this protocol allows for applications to have a wider audience (i.e., any compliant Jabber client).</p>
<p>The namespace governing this protocol is "http://jabber.org/protocol/commands" (hereafter referred to as x-commands). This namespace relies on the &IQ; element for execution, and can use the &MESSAGE; element for announcing command lists. This protocol depends on &xep0030; for reporting and announcing command lists. This namespace is intended to complement &xep0004; (jabber:x:data), but is not necessarily dependent upon it.</p>
<p>Support of x-commands implies support for "jabber:x:data" (although this requirement may be replaced and/or amended with a requirement to support &xep0020; by performing the appropriate negotations before executing commands). x-commands provides a bootstrap for performing ad-hoc "jabber:x:data" processes, while the data itself is conveyed using "jabber:x:data".</p>
<p>The x-commands namespace is not designed to replace machine-to-machine oriented RPC systems such as &xep0009;, where the two entities fully understand the command's purpose and behavior prior to execution. x-commands is oriented more for human interaction, where the user agent (such as a compliant Jabber client) most likely has no prior knowledge of the command's purpose and behavior.</p>
<p>To determine if an entity supports x-commands, the requester uses Service Discovery. The requester makes an "#info" query to the responder. If supported, the responder includes a <feature/> with the "var" of "http://jabber.org/protocol/commands".</p>
<examplecaption='Disco request for information'><![CDATA[
<section2topic='Retrieving the Command List'anchor='retrieve'>
<p>To find what commands an entity provides, the requester uses Service Discovery. Each command is a node of the responder, under the fixed node "http://jabber.org/protocol/commands" (for which the service discovery identity category is "automation" and type is "command-list"). Use of a fixed node for all commands of an entity allows for immediate retrieval of commands.</p>
<p>Each command is a disco item. The node attribute of <item/> identifies the command, and the name attribute is the label for the command.</p>
<p>The requester retrieves the list of commands by querying for the responder's items for the node "http://jabber.org/protocol/commands":</p>
<examplecaption='Disco request for items'><![CDATA[
<p>The result can then be used by the client to populate a menu, a dialog of buttons, or whatever is appropriate to the current user interface. The responder is not required to send the same list of commands to all requesters.</p>
<p>If additional information about a command is desired, the requester queries for disco information on the command node:</p>
<examplecaption='Disco request for command information'><![CDATA[
<p>A responder MUST at least provide <identity category='automation' type='command-node'/> and <feature var='http://jabber.org/protocol/commands'/>, and SHOULD include <feature var='jabber:x:data'/>. It is not required to support additional information about a command. If the command is not available to the requester, the responder SHOULD respond with a 403 "Forbidden" error.</p>
</section2>
<section2topic='Announcing the Command List'anchor='announce'>
<p>In some cases, a responder entity may find it appropriate to automatically push this information (e.g. a subscribed entity becomes available). In this case, the entity sends a &MESSAGE; containing the proper disco#items &QUERY;:</p>
<p>The only portion required is <query xmlns='http://jabber.org/protocol/disco#items'/>. Any other information (such as the <subject/> in the foregoing example) is OPTIONAL.</p>
<p>The above example shows the command execution resulting in a "jabber:x:data" form. It is also possible that one or more URLs (specified via &xep0066;) could be returned.</p>
<p>If the command requires more interaction, the responder sends a result &IQ; that contains the command information and the form to be filled out:</p>
<p>The <command/> SHOULD include an <actions/> element, which specifies the details of what the allowed actions are for this stage of execution. Each element within <action/> matches a possible value for the <command/> element's "action" attribute. The "execute" attribute defines which of the included actions is considered the equivalent to "execute" for this stage. In the above example, the only allowed action is to progress to the next stage, which is also the default.</p>
<p>The requester then submits the form, maintaining the command node and sessionid:</p>
<p>The responder then provides the next stage's form in the result <note>Note that the second stage can be reverted to the first stage or completed (signaled by the inclusion of the <prev/> and <complete/> elements), and that the default action is to complete execution (signaled by the "execute" attribute's value of "complete").</note>:</p>
<examplecaption='Execute command result (stage 2)'><![CDATA[
<p>If the responder accepts this, it responds with the previous stage's command <note>The responder MAY present "remembered" field values, but doing so is OPTIONAL.</note>:</p>
<examplecaption='Execute command result (revert from stage 2 to stage 1)'><![CDATA[
<p>In the case where a command has multiple stages, the requester may wish to cancel at some point. To cancel, the requester sends the continuing command request with an "action='cancel'":</p>
<p>Each command is identified by its 'node' attribute. This matches the 'node' attribute from the service discovery <item/> element. Service Discovery requires that all 'node' values be unique within a given JID. This document requires that the 'node' value used in <command/> exactly match the value used in the <item/> element. It is the responsibility of the responder implementation to ensure each command's node is unique for their JID.</p>
<p>The execution of a command exists within the concept of a session. Each session is identified by the 'sessionid' attribute, and SHOULD be valid only between one requester/responder pair. The responder is responsible for determining the session lifetime, with some help from the requester.</p>
<p>The requester starts a new session for a command by simply sending a <command/> with the 'node' attribute (and optionally the 'status' attribute with a value of "execute"). Once the 'sessionid' attribute is given to the requester, it is the requester's responsibility to maintain it for the session's lifetime. A session ends when the responder sends a <command status='completed'/> or the requester sends a <command action='cancel'/> with the provided 'sessionid' value.</p>
<p>Once a session has ended, its 'sessionid' value SHOULD NOT be used again. It is the responder's responsibility to ensure that each 'sessionid' value is unique.</p>
<p>It may be possible for a requester to be executing more than one session of the same command with a given responder. If the responder does not allow more than one session of the same command with the same requester, the responder MUST return a ¬allowed; error (see &xep0086;).</p>
<p>The result for each stage (other than the last) of a command's execution SHOULD include an <actions/> element. The user-agent can use this information to present a more-intelligent user interface, such as a "druid" or "wizard".</p>
<p>For a user-agent, a typical interpretation of the <actions/> information (or lack thereof) would be the following:</p>
<ol>
<li>The action "cancel" is always allowed.</li>
<li>If there is no <actions/> element, the user-agent can use a single-stage dialog or view.
<ul>
<li>The action "execute" is equivalent to the action "complete".</li>
</ul>
</li>
<li>If there is an <actions/> element, the user-agent usually uses a multi-stage dialog or view, such as a wizard.
<li>The action "execute" is always allowed, and is equivalent to the action "next". A form that has an <actions/> element, no "execute" attribute, and for which <next/> is not an available action is therefore invalid.</li>
<li>The "prev" action is typically the "back" or "previous" button or option in a wizard. If <prev/> is not contained by the <actions/>, it is disabled.</li>
<li>The "next" action is typically the "next" button or option in a wizard. If <next/> is not contained by the <actions/>, it is disabled.</li>
<li>The "complete" action is typically the "finish" or "done" button or option in a wizard. If <complete/> is not contained by the <actions/>, it is disabled.</li>
<li>If the <actions/> possesses the "execute" attribute, that value is the default button or option. If the <actions/> does not possess the "execute" attribute, there is no default button or option.</li>
<li>As the "execute" command is equivalent to another command ("next" in the absence of an "execute" attribute), it is not suggested that a user-agent shows both the "execute" and the command that "execute" is an alias of in their interface.</li>
<li>As user-agents treat the absence of an "execute" attribute as equivalent to "next", when the <actions/> element is provided, it is invalid to return a command that has no "execute" attribute, an actions element, and no <next/> action</li>
<p>On its own, the <command/> has very little usefulness. It relies on its payload to give full meaning to its use. The payload can be elements in any namespace that makes sense and is understood (such as "jabber:x:data"), and/or one or more <note/> elements. Any namespaced elements can be used within a <command/>. The only limitations are that the elements not require certain parent elements (such as &IQ;), or specifically allow for <command/> qualified by the "http://jabber.org/protocol/commands" namespace as a possible parent element.</p>
<p>As a general rule, the payload is provided only by the responder. The primary exception to this rule is with the "jabber:x:data" extension (and other namespaces with similar semantics). In this case, if the responder provides a form to submit, the requester SHOULD respond with the submitted data (using the semantics from XEP-0004).</p>
<p>When the precedence of these payload elements becomes important (such as when both "jabber:x:data" and "jabber:x:oob" elements are present), the order of the elements SHOULD be used. Those elements that come earlier in the child list take precedence over those later in the child list. The requester SHOULD consider those elements qualified by the same namespace as having an equivalent precedence (such as if multiple "jabber:x:oob" elements are included).</p>
<section3topic='Use of Data Forms'anchor='impl-forms'>
<p>When the payload is "jabber:x:data", there are certain conditions applied. The requester SHOULD NOT use a "jabber:x:data" type other than "submit". Responders SHOULD consider any <x type='cancel'/> to be <x type='submit'/>.</p>
<p>The status of command execution signals only if the command is executing, has been completed, or been canceled. If completed, the "status" attribute does not specify if it completed successfully or not. If a command completes but fails, the responder MUST include at least one <note type='error'/> with the <command status='completed'/> it returns.</p>
</section2>
<section2topic='Internationalization and Localization'anchor='impl-i18n'>
<p>The requester SHOULD provide its locale information using the "xml:lang" attribute on either the &IQ; (RECOMMENDED) or <command/> element. Each execution session (identified by the "sessionid" attribute) SHOULD use only one language/locale, and requesters and responders SHOULD assume the first language/locale specified applies. The responder SHOULD specify the language/locale with the every command session's response.</p>
<p>Within the "http://jabber.org/protocol/commands" schema, the language/locale applies only to the human-readable character data for <info/> elements. It SHOULD also apply to all payload elements, appropriate to their respective specifications.</p>
<p>Responders MUST take this into consideration, and properly account for the language/locale settings within payloads. If the responder cannot accomodate the requested language/locale, it SHOULD respond with a <bad-request/> (<bad-locale/>) error condition.</p>
<p>The focal element in x-commands is <command/>. It is the element used to guide the process, and the element used to report command options.</p>
<p>Each <command/> contains attributes for a node, a "session id", an action type, a status type, and a language/locale specifier. A command MAY contain zero or more <note/> elements and MAY contain other namespaced elements as payload. Elements qualified by the "jabber:x:data" and "jabber:x:oob" namespaces are the typical payload.</p>
<p>The "node" attribute uniquely identifies the command. This attribute MUST be present.</p>
<p>The "sessionid" attribute helps to track a command execution across multiple stages. This attribute MUST be present for subsequent stages, and the responder SHOULD initialize (if not provided) or maintain this attribute. The value of this attribute MUST NOT be empty or null, but otherwise can be any string value. This value MUST be maintained by a requester while executing a command.</p>
<p>The "status" attribute describes the current status of this command. This value SHOULD be set only by the responder. If specified by the requester, the responder MUST ignore it. The value of "status" MUST be one of the following:</p>
<tablecaption='Possible "status" values'>
<tr>
<th>Status</th>
<th>Description</th>
</tr>
<tr>
<td>executing</td>
<td>The command is being executed.</td>
</tr>
<tr>
<td>completed</td>
<td>The command has completed. The command session has ended.</td>
</tr>
<tr>
<td>canceled</td>
<td>The command has been canceled. The command session has ended.</td>
</tr>
</table>
<p>The "action" attribute specifies the action to undertake with the given command. This value SHOULD be set only by the requester. If specified by the responder, the requester MUST ignore it. The value of "action" MUST be one of the following:</p>
<tablecaption='Possible "action" values'>
<tr>
<th>Action</th>
<th>Description</th>
</tr>
<tr>
<td>execute</td>
<td>The command should be executed or continue to be executed. This is the default value.</td>
</tr>
<tr>
<td>cancel</td>
<td>The command should be canceled.</td>
</tr>
<tr>
<td>prev</td>
<td>The command should be digress to the previous stage of execution.</td>
</tr>
<tr>
<td>next</td>
<td>The command should progress to the next stage of execution.</td>
</tr>
<tr>
<td>complete</td>
<td>The command should be completed (if possible).</td>
<p>The "xml:lang" attribute specifies the language/locale this <command/> is intended for. This attribute MAY be specified by the requester to request a specific language/locale, and SHOULD be included by the responder to indicate the language/locale in use.</p>
<p>The children of a <command/> element (other than <actions/> and <note/>) pertain to the command's execution. The order of these elements denote their precedence, so that those elements earlier in the list have higher precedence.</p>
<p>The allowed actions for a particular stage of execution are provided by the <actions/> element. This element SHOULD be provided by the responder if the command's execution is not complete, and SHOULD NOT ever be provided by the requester. It contains a single attribute to specify what the "execute" action equals. It contains child elements to specify what the allowed actions are.</p>
<p>The "execute" attribute specifies what the action "execute" is equivalent to. In user-agent interfaces, this represents the default behavior. This attribute MAY be specified by the responder, and MUST equal one of the "action" attribute values for <command/>. The value of this attribute SHOULD match the local name of one of the contained child elements.</p>
<p>The child elements contained by <action/> specify the allowed actions. The name of each child element MUST be one of the following:</p>
<p>Notes about the current status of commands are provided by <note/> elements. This element contains information about current conditions in a command sequence. This element has an attribute that defines the type of note. The body of a <note/> should contain a user-readable text message.</p>
<p>The "type" attribute specifies the severity of the note. This attribute is OPTIONAL, and implies "info" if not present. The value of this attribute MUST be one of the following:</p>
<tablecaption='Possible "type" values'>
<tr>
<th>Type</th>
<th>Description</th>
</tr>
<tr>
<td>info</td>
<td>The note is informational only. This is not really an exceptional condition.</td>
</tr>
<tr>
<td>warn</td>
<td>The note indicates a warning. Possibly due to illogical (yet valid) data.</td>
</tr>
<tr>
<td>error</td>
<td>The note indicates an error. The text should indicate the reason for the error.</td>
<p>To simplify the discussion on error conditions, this document uses the following mapping between namespace URIs and namespace prefixes <note>This mapping is provided solely for the purpose of simplifying this discussion.</note>:</p>
<tablecaption='Namespace Mappings'>
<tr>
<th>Prefix</th>
<th>URI</th>
</tr>
<tr>
<td>xmpp</td>
<td>urn:ietf:params:xml:ns:xmpp-stanzas</td>
</tr>
<tr>
<td>cmd</td>
<td>http://jabber.org/protocol/commands</td>
</tr>
</table>
<p>Below are the possible errors that can occur during execution.</p>
<tablecaption='Command execution errors'>
<tr>
<th>Error Type</th>
<th>General Condition</th>
<th>Specific Condition</th>
<th>Description</th>
</tr>
<tr>
<td>modify</td>
<td><xmpp:bad-request/></td>
<td><cmd:malformed-action/></td>
<td>The responding JID does not understand the specified action.</td>
</tr>
<tr>
<td>modify</td>
<td><xmpp:bad-request/></td>
<td><cmd:bad-action/></td>
<td>The responding JID cannot accept the specified action.</td>
</tr>
<tr>
<td>modify</td>
<td><xmpp:bad-request/></td>
<td><cmd:bad-locale/></td>
<td>The responding JID cannot accept the specified language/locale.</td>
</tr>
<tr>
<td>modify</td>
<td><xmpp:bad-request/></td>
<td><cmd:bad-payload/></td>
<td>The responding JID cannot accept the specified payload (e.g. the data form did not provide one or more required fields).</td>
</tr>
<tr>
<td>modify</td>
<td><xmpp:bad-request/></td>
<td><cmd:bad-sessionid/></td>
<td>The responding JID cannot accept the specified sessionid.</td>
</tr>
<tr>
<td>cancel</td>
<td><xmpp:not-allowed/></td>
<td><cmd:session-expired/></td>
<td>The requesting JID specified a sessionid that is no longer active (either because it was completed, canceled, or timed out).</td>
</tr>
<tr>
<td>cancel</td>
<td><xmpp:forbidden/></td>
<td>NONE</td>
<td>The requesting JID is not allowed to execute the command.</td>
</tr>
<tr>
<td>cancel</td>
<td><xmpp:item-not-found/></td>
<td>NONE</td>
<td>The responding JID cannot find the requested command node.</td>
</tr>
<tr>
<td>cancel</td>
<td><xmpp:feature-not-implemented/></td>
<td>NONE</td>
<td>The responding JID does not support "http://jabber.org/protocol/commands".</td>
<p>Determining when a command can be executed based on permissions or rights is considered outside the scope of this document. Although such mechanisms are considered specific to the application and/or implementation of this document, future specifications may address these concerns.</p>
<p>When processing reported commands, the requester SHOULD consider any command node that does not match the JID of the responder to be suspicious, and ignore those command nodes. Responders MUST report their own command nodes only, and not the command nodes of other entities. This can help prevent limited cases of spoofing and "social engineering".</p>
<p>The XMPP Registrar includes "automation" in its registry of Service Discovery categories for use for any entities and nodes that provide automated or programmed interaction. This category has the following types:</p>
<p>The "command" querytype is defined herein for interaction with entities that support the ad-hoc command protocol, with keys of "action" and "node".</p>