specriot

README

SpecRiot

Dependency-aware stateful API fuzzing from OpenAPI specs. (Go-native)

SpecRiot turns an OpenAPI document into meaningful, deterministic attack paths instead of firing isolated random requests. It is inspired by the ideas behind Schemathesis and RESTler, but designed as a Go-native toolkit: a reusable library you can import, a single CLI binary, and a path toward go test integration.

Status: v0.3 (Dependency Graph) implemented. This release parses an OpenAPI 3 document, generates valid and boundary/invalid values, executes requests, validates responses against the spec, and infers producer-consumer dependency relationships between operations. Stateful fuzzing, shrinking and replay are planned in ROADMAP.md.

Why

Most API fuzzers are good at generating strange values for one endpoint at a time. Real backend bugs often live in sequences:

POST /users
    ↓ response.id
POST /orders { user_id: $user.id }
    ↓ response.id
DELETE /orders/{id}
    ↓
DELETE /orders/{id}   ← 500

A valid OpenAPI document already contains much of the information needed to explore these workflows: path parameters, request/response schemas, object identifiers, enums, validation constraints, and relationships between values produced by one operation and consumed by another.

SpecRiot's roadmap is: execute → validate → understand dependencies → explore state → shrink & replay → handle real systems → CI → feedback-guided exploration → stabilize (v0.1 → v1.0).

Install

go get github.com/MouXiaoJun/specriot

Or install the CLI:

go install github.com/MouXiaoJun/specriot/cmd/specriot@latest

Quick start (CLI)

specriot run openapi.yaml --url http://localhost:8080 --seed 42 --iterations 5 --fuzz-ratio 0.3

Output:

SpecRiot

✓ 6 operations discovered
  spec: Pet Store API 1.0.0
  seed: 42

executed: 30 requests
failures: 0

status summary:
  createOrder   executed=5   statuses=201:5
  ...

When a server error is found:

BUGS FOUND

[1] DELETE /orders/{id}
    status: 500
    generated:
      path:id: 29856e01-f2b5-4476-9bfa-0f9272a479dd
specriot: 1 API failure(s) found   # exit code 1

Run with --help for all flags (-H for extra headers, --timeout, …).

Library usage

package main

import (
	"context"
	"fmt"

	"github.com/MouXiaoJun/specriot"
)

func main() {
	s, err := specriot.Load("openapi.yaml")
	if err != nil {
		panic(err)
	}

	report, err := s.Run(context.Background(), "http://localhost:8080",
		specriot.WithSeed(42),
		specriot.WithIterations(10),
		specriot.WithFuzzRatio(0.3),
		specriot.WithHeader("X-Tenant-ID", "42"),
	)
	if err != nil {
		panic(err)
	}

	fmt.Printf("executed %d requests across %d operations\n",
		report.Executed, report.Operations)
	for _, f := range report.Failures {
		fmt.Printf("BUG: %s %s -> %d (%s)\n", f.Method, f.Path, f.StatusCode, f.Class())
	}
}

Because it is a plain library, you can use it inside go test immediately:

func TestAPI(t *testing.T) {
	s, err := specriot.Load("openapi.yaml")
	if err != nil {
		t.Fatal(err)
	}
	report, err := s.Run(context.Background(), server.URL,
		specriot.WithSeed(1),
		specriot.WithFuzzRatio(0.3), // generate ~30% boundary/invalid values
	)
	if err != nil {
		t.Fatal(err)
	}
	for _, f := range report.Failures {
		t.Errorf("%s %s: %s", f.Method, f.Path, f.Class())
		for _, finding := range f.Findings {
			t.Logf("  [%s] %s", finding.Class, finding.Message)
		}
	}
}

Determinism

Generation is fully deterministic. The same spec, options and seed always produce the same inputs in the same order:

• operations are executed in a fixed order (paths sorted, then method rank get < put < post < delete < …);
• the PRNG is seeded with --seed / WithSeed;
• object properties and required fields are emitted in sorted order;
• even UUIDs are derived from the seeded PRNG rather than crypto/rand.

This is what makes a discovered failure reproducible.

Value generation

Given an OpenAPI schema, SpecRiot generates a valid value that respects:

Category	Supported
Types	string, integer, number, boolean, object, array
Strings	minLength / maxLength, pattern (best effort), format: uuid, email, date-time, date, ipv4, ipv6, hostname, uri/url, byte, password
Numbers	minimum / maximum, exclusiveMinimum / exclusiveMaximum, multipleOf
Arrays	minItems / maxItems, uniqueItems, nested items
Objects	required, optional properties (50%), recursion depth guard
Others	enum, const, default/example reuse, nullable (occasionally null, never top-level), oneOf / anyOf (random branch), allOf (merged)

Boundary and deliberately invalid value generation is the next milestone (v0.2, Contract Fuzzing).

Report & failure classification

Report exposes:

• Executed / Operations / Iterations totals;
• Stats — per-operation execution count and status-code histogram;
• Failures — each with Method, Path, URL, StatusCode, Body, Err and the generated Params used for the request.

Failure.Class() returns the most severe finding class. Each failure carries a Findings list with detailed oracle results:

Class	Meaning
server_error	HTTP 5xx response
request_error	transport failure (connection refused, timeout, …)
undocumented_status	status code not declared in the operation's responses
invalid_content_type	response Content-Type does not match the declared media type
malformed_response	response body is not valid JSON when JSON is expected
invalid_response_body	response body violates the declared response schema

Contract fuzzing (v0.2)

SpecRiot can generate both valid and boundary/invalid values. Control the mix with WithFuzzRatio(ratio) (library) or --fuzz-ratio (CLI):

• 0 — all values are valid (v0.1 behavior);
• 0.3 — recommended fuzzing default: ~30% of leaf values are boundary or invalid;
• 1 — always generate interesting (boundary/invalid) values.

For an integer field with minimum: 18, maximum: 60, interesting values include 18, 19, 59, 60 (boundaries), 17, 61 (just outside), 0, -1, and MaxInt. For strings: empty, too-short, too-long, malformed formats (not-an-email, not-a-uuid), and special characters. For objects: missing required fields and wrong-typed values. For arrays: too-few, too-many, and duplicate items when uniqueItems is set.

Every response is then validated against the spec: undocumented status codes, wrong Content-Type, malformed JSON, and schema violations are all reported as findings. This means SpecRiot can find bugs like:

POST /users  age=-1  →  500 Internal Server Error  (server_error)
GET  /users/1         →  200 but body missing required "email"  (invalid_response_body)
DELETE /orders/abc    →  418  (undocumented_status)

Dependency graph (v0.3)

SpecRiot can infer producer-consumer dependencies between operations without executing any requests. It analyzes response schemas (producers) and request parameters/bodies (consumers), then matches them using name, type and path signals to produce confidence-scored edges.

g := s.Graph()
fmt.Print(g.Text())          // human-readable report
fmt.Println(g.Mermaid())     // Mermaid flowchart
jsonStr, _ := g.JSON()       // structured JSON

CLI:

specriot graph openapi.yaml                     # text report
specriot graph openapi.yaml --format mermaid    # Mermaid diagram
specriot graph openapi.yaml --format json       # JSON
specriot graph openapi.yaml --min-confidence 0.8

Example output for a CRUD API:

[1] POST /users.response.id
    ↓ confidence=0.80  (id_suffix, type_compatible, path_resource)
    POST /orders.body.user_id

[2] POST /orders.response.id
    ↓ confidence=0.99  (exact_name, type_compatible, format_compatible, path_resource)
    GET /orders/{id}.path.id

Matching signals:

Signal	Confidence	Description
exact_name	0.85	producer and consumer field names match exactly
normalized_name	0.70	names match after case/separator normalization (user_id ↔ userId)
id_suffix	0.60	producer id matches consumer <resource>_id with path resource overlap
type_compatible	+0.10	schema types are compatible (integer↔integer, integer↔number)
format_compatible	+0.05	schema formats match (uuid, email, etc.)
path_resource	+0.10	producer path resource matches consumer field or path context

Stateful fuzzing (v0.4)

SpecRiot can build and execute dependency-aware request sequences that maintain resource state across steps. This discovers bugs that require multiple related requests and cannot be reproduced by isolated endpoint fuzzing — for example, deleting an already-deleted resource returns 500 instead of 404.

POST /users              → creates user id=1
    ↓ (bind user_id=1)
POST /orders             → creates order id=order-7
    ↓ (bind path id=order-7)
DELETE /orders/{id}      → deletes order (marked deleted in state store)
    ↓ (stale: reuse deleted id=order-7)
DELETE /orders/{id}      → BUG: server returns 500 (should be 404)

How it works:

1. Dependency graph (v0.3) infers producer→consumer edges.
2. Sequence builder performs a dependency-guided weighted random walk: producers (POST/create) are executed before consumers; producer operations get higher selection weight.
3. State store captures response values from producer operations (e.g. createUser.response.id).
4. Variable binding feeds captured values into consumer operations (e.g. createOrder.body.user_id, getOrder.path.id).
5. Mutations include stale-value reuse (use-after-delete) and step repetition (double DELETE), controlled by --stale-rate.

Library:

report, err := s.RunStateful(ctx, "http://localhost:8080",
    specriot.WithSeed(42),
    specriot.WithSequences(20),
    specriot.WithMaxSequenceLength(12),
    specriot.WithStaleRate(0.3),
)
for _, f := range report.Failures {
    fmt.Printf("BUG step %d: %s %s -> %d\n", f.StepIndex, f.Method, f.Path, f.StatusCode)
    for _, s := range f.Sequence {
        marker := ""
        if s.UseStale {
            marker = " [stale]"
        }
        fmt.Printf("  %s %s%s\n", s.Method, s.Path, marker)
    }
}

CLI:

specriot fuzz openapi.yaml --url http://localhost:8080
specriot fuzz openapi.yaml --url http://localhost:8080 \
    --seed 42 --sequences 20 --max-length 12 --stale-rate 0.3

Example failure output:

STATEFUL BUGS FOUND

[1] step 8: DELETE /orders/{id}
    status: 500
    findings:
      [server_error] HTTP 500
      [undocumented_status] status 500 is not declared in the operation's responses
    sequence:
      1. POST /users
      2. POST /orders
      3. GET /orders/{id}
      4. DELETE /orders/{id}
      5. DELETE /orders/{id} [stale]  ← FAILURE

Architecture

OpenAPI
   │
   ▼
┌──────────────┐      ┌──────────────────────┐
│ Spec Parser  │ ───► │ Schema / Constraint  │
│ (openapi)    │      │ Model (schema)       │
└──────┬───────┘      └──────────┬───────────┘
       │                         │
       ▼                         ▼
┌──────────────────┐   ┌──────────────────┐
│ HTTP Executor    │◄──┤ Value Generator  │
│ (execute)        │   │ (generate)       │
└────────┬─────────┘   └──────────────────┘
         │
         ▼
┌──────────────────┐
│     Oracles      │  status / content-type / schema / malformed / 5xx
└────────┬─────────┘
         │
         ▼
┌──────────────────┐
│  Dependency Graph │  producer→consumer inference (v0.3)
└────────┬─────────┘
         ▼
┌──────────────────┐
│  Sequence Builder │  dependency-guided random walk (v0.4)
└────────┬─────────┘
         ▼
┌──────────────────┐
│   State Store    │  response values + resource lifecycle (v0.4)
└────────┬─────────┘
         ▼
┌──────────────────┐
│ Report / Failure │  (public API)
└──────────────────┘

Package layout:

specriot/
  specriot.go            # public API: Load / Run / RunStateful / Graph / Options / Report
  internal/openapi/      # OpenAPI loading + normalization
  internal/schema/       # normalized constraint model + kin-openapi conversion
  internal/generate/     # deterministic value generation (valid + boundary/invalid)
  internal/execute/      # net/http execution
  internal/oracle/       # response validation oracles
  internal/graph/        # dependency graph inference
  internal/state/        # state store, response-value extraction, variable binding
  internal/sequence/     # sequence builder + executor
  cmd/specriot/          # CLI (run / graph / fuzz / version)

Roadmap

The authoritative plan lives in ROADMAP.md. v0.4 (this release) covers Stateful Fuzzing; the next milestone is Shrink & Replay (v0.5).

Non-goals

SpecRiot is not a load-testing tool, a generic vulnerability scanner, a web crawler, or a replacement for handwritten business tests. Its focus is narrow:

Find stateful API correctness bugs from an API specification.

License

Dual-licensed under MIT and Mulan PSL v2. You may choose either license.

• MIT — MIT License (root, recognized by pkg.go.dev)
• Mulan PSL v2 — 木兰宽松许可证 v2（OSI 认证）

Documentation

Overview

Package specriot turns an OpenAPI document into deterministic, executable HTTP requests and reports anomalies.

It is designed to be used both as a library and from the CLI:

import "github.com/MouXiaoJun/specriot"

func TestAPI(t *testing.T) {
    s, err := specriot.Load("openapi.yaml")
    if err != nil {
        t.Fatal(err)
    }
    report, err := s.Run(context.Background(), "http://localhost:8080",
        specriot.WithSeed(42),
        specriot.WithIterations(10),
    )
    if err != nil {
        t.Fatal(err)
    }
    if len(report.Failures) > 0 {
        t.Errorf("found %d API failures", len(report.Failures))
    }
}

Generation is deterministic: the same spec, options and seed always produce the same inputs in the same order.

Example

This example shows the intended library usage: load a spec, run generated requests against a target, and inspect the report.

package main

import (
	"context"
	"fmt"
	"log"
	"net/http"
	"net/http/httptest"
	"path/filepath"
	"strings"

	"github.com/MouXiaoJun/specriot"
)

func main() {
	// A target that returns schema-compliant responses for the petstore spec.
	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.Header().Set("Content-Type", "application/json")
		switch {
		case r.Method == http.MethodPost && r.URL.Path == "/users":
			w.WriteHeader(http.StatusCreated)
			_, _ = w.Write([]byte(`{"id":1,"email":"u@e.com","role":"admin","age":30}`))
		case r.Method == http.MethodGet && r.URL.Path == "/users":
			w.WriteHeader(http.StatusOK)
			_, _ = w.Write([]byte(`[]`))
		case r.Method == http.MethodGet && strings.HasPrefix(r.URL.Path, "/users/"):
			w.WriteHeader(http.StatusOK)
			_, _ = w.Write([]byte(`{"id":1,"email":"u@e.com","role":"admin","age":30}`))
		case r.Method == http.MethodPost && r.URL.Path == "/orders":
			w.WriteHeader(http.StatusCreated)
			_, _ = w.Write([]byte(`{"id":"11111111-2222-3333-4444-555555555555","user_id":1,"status":"pending","items":["a"],"created_at":"2026-01-01T00:00:00Z"}`))
		case r.Method == http.MethodGet && strings.HasPrefix(r.URL.Path, "/orders/"):
			w.WriteHeader(http.StatusOK)
			_, _ = w.Write([]byte(`{"id":"11111111-2222-3333-4444-555555555555","user_id":1,"status":"pending","items":["a"],"created_at":"2026-01-01T00:00:00Z"}`))
		case r.Method == http.MethodDelete && strings.HasPrefix(r.URL.Path, "/orders/"):
			w.WriteHeader(http.StatusNoContent)
		default:
			w.WriteHeader(http.StatusNotFound)
		}
	}))
	defer srv.Close()

	path := filepath.Join("testdata", "petstore.yaml")
	s, err := specriot.Load(path)
	if err != nil {
		log.Fatal(err)
	}

	report, err := s.Run(context.Background(), srv.URL,
		specriot.WithSeed(42),
		specriot.WithIterations(3),
	)
	if err != nil {
		log.Fatal(err)
	}

	fmt.Printf("operations: %d\n", report.Operations)
	fmt.Printf("executed: %d\n", report.Executed)
	fmt.Printf("failures: %d\n", len(report.Failures))

}

Output:
operations: 6
executed: 18
failures: 0

Index

• Constants
• type Config
  • func DefaultConfig() Config
• type Dependency
• type Failure
  • func (f *Failure) Class() string
• type Finding
• type Graph
• type OperationInfo
• type OperationStat
• type Option
  • func WithFuzzRatio(ratio float64) Option
  • func WithHeader(key, value string) Option
  • func WithIterations(n int) Option
  • func WithMaxSequenceLength(n int) Option
  • func WithSeed(seed int64) Option
  • func WithSequences(n int) Option
  • func WithStaleRate(rate float64) Option
  • func WithTimeout(d time.Duration) Option
• type Reason
• type Report
  • func (r *Report) Failed() bool
• type SequenceFailure
• type Signal
• type Spec
  • func Load(path string) (*Spec, error)
  • func LoadBytes(data []byte) (*Spec, error)
  • func (s *Spec) Graph() *Graph
  • func (s *Spec) Operations() []OperationInfo
  • func (s *Spec) Run(ctx context.Context, target string, opts ...Option) (*Report, error)
  • func (s *Spec) RunStateful(ctx context.Context, target string, opts ...Option) (*StatefulReport, error)
• type StatefulReport
  • func (r *StatefulReport) Failed() bool
• type StepInfo
• type ValueRef

Examples

• Package
• Spec.Operations

Constants

const DefaultSeed int64 = 0

DefaultSeed is used when no seed is supplied.

Types

type Config

type Config struct {
	// Seed drives the deterministic PRNG.
	Seed int64
	// Iterations is the number of generated executions per operation.
	Iterations int
	// Timeout applies to every request. Zero means no per-request timeout.
	Timeout time.Duration
	// Headers are attached to every request.
	Headers map[string]string
	// FuzzRatio controls how often boundary/invalid values are generated
	// instead of valid ones. 0 (default) = all valid; 0.3 is a good
	// fuzzing default; 1 = always interesting.
	FuzzRatio float64
	// Sequences is the number of stateful sequences to generate and execute.
	// Used by RunStateful. Default 10.
	Sequences int
	// MaxSequenceLength is the maximum number of steps in a stateful sequence.
	// Used by RunStateful. Default 12.
	MaxSequenceLength int
	// StaleRate is the probability (0-1) of a consumer step using deleted/stale
	// values. Used by RunStateful. Default 0.1.
	StaleRate float64
}

Config carries the knobs for a run.

func DefaultConfig

func DefaultConfig() Config

DefaultConfig returns the default run configuration.

type Dependency

type Dependency = graph.Dependency

Dependency is a confidence-scored producer→consumer edge.

type Failure

type Failure struct {
	Key        string
	Method     string
	Path       string
	URL        string
	StatusCode int
	Body       string
	Err        string
	// Params holds the generated values used for this request.
	Params map[string]any
	// Findings holds the oracle findings that classify this failure.
	Findings []Finding
}

Failure describes an executed request that exposed a problem.

func (*Failure) Class

func (f *Failure) Class() string

Class returns the most severe finding class for the failure.

type Finding

type Finding struct {
	// Class is a machine-readable category: server_error, request_error,
	// undocumented_status, invalid_content_type, malformed_response,
	// invalid_response_body.
	Class string
	// Message is a human-readable explanation.
	Message string
}

Finding is a single oracle finding attached to a failure.

type Graph

type Graph = graph.Graph

Graph is an inferred dependency graph for a spec.

type OperationInfo

type OperationInfo struct {
	Key         string
	Method      string
	Path        string
	OperationID string
	Summary     string
	Tags        []string
}

OperationInfo is a lightweight, public description of a discovered operation.

type OperationStat

type OperationStat struct {
	Key      string
	Method   string
	Path     string
	Executed int
	Failures int
	Statuses map[int]int
}

OperationStat aggregates execution results per operation.

type Option

type Option func(*Config)

Option configures a run.

func WithFuzzRatio

func WithFuzzRatio(ratio float64) Option

WithFuzzRatio controls how often boundary/invalid ("interesting") values are generated instead of valid ones. ratio must be in [0, 1]. 0 (the default) produces only valid values; 0.3 is a good fuzzing default; 1 always generates interesting values.

func WithHeader

func WithHeader(key, value string) Option

WithHeader attaches a static header to every request.

func WithIterations

func WithIterations(n int) Option

WithIterations sets how many generated executions run per operation.

func WithMaxSequenceLength

func WithMaxSequenceLength(n int) Option

WithMaxSequenceLength sets the maximum number of steps in a stateful sequence. Used by RunStateful. Default 12.

func WithSeed

func WithSeed(seed int64) Option

WithSeed sets the PRNG seed for deterministic generation.

func WithSequences

func WithSequences(n int) Option

WithSequences sets the number of stateful sequences to generate and execute. Used by RunStateful. Default 10.

func WithStaleRate

func WithStaleRate(rate float64) Option

WithStaleRate sets the probability (0-1) of a consumer step using deleted/stale values. Used by RunStateful. Default 0.1.

func WithTimeout

func WithTimeout(d time.Duration) Option

WithTimeout sets the per-request timeout.

type Reason

type Reason = graph.Reason

Reason describes why a dependency edge was inferred.

type Report

type Report struct {
	Title      string
	Version    string
	Seed       int64
	Iterations int
	Operations int
	Executed   int
	Failures   []Failure
	Stats      []OperationStat
}

Report is the result of a Run.

func (*Report) Failed

func (r *Report) Failed() bool

Failed reports whether any failures were found.

type SequenceFailure

type SequenceFailure struct {
	StepIndex    int
	OperationKey string
	Method       string
	Path         string
	StatusCode   int
	Err          string
	Findings     []Finding
	Params       map[string]any
	// Sequence is the full sequence of steps that led to this failure.
	Sequence []StepInfo
}

SequenceFailure is a failure discovered during stateful fuzzing, with full sequence context for reproduction.

type Signal

type Signal = graph.Signal

Signal is a single piece of evidence supporting a dependency edge.

type Spec

type Spec struct {
	// contains filtered or unexported fields
}

Spec is a loaded, normalized OpenAPI document.

func Load

func Load(path string) (*Spec, error)

Load parses an OpenAPI 3 document from a file path.

func LoadBytes

func LoadBytes(data []byte) (*Spec, error)

LoadBytes parses an OpenAPI 3 document from raw bytes.

func (*Spec) Graph

func (s *Spec) Graph() *Graph

Graph infers the producer-consumer dependency graph between operations. It analyzes response schemas (producers) and request parameters/bodies (consumers), then matches them using name, type and path signals to produce confidence-scored edges.

The returned Graph supports Text(), Mermaid() and JSON() serialization, as well as SortedDependencies() for programmatic access.

func (*Spec) Operations

func (s *Spec) Operations() []OperationInfo

Operations returns the discovered operations in deterministic order.

Example

This example shows discovering the operations of a spec without executing anything.

package main

import (
	"fmt"
	"log"
	"os"
	"path/filepath"

	"github.com/MouXiaoJun/specriot"
)

func main() {
	dir, err := os.MkdirTemp("", "specriot")
	if err != nil {
		log.Fatal(err)
	}
	defer os.RemoveAll(dir)
	specFile := filepath.Join(dir, "mini.yaml")
	_ = os.WriteFile(specFile, []byte(`openapi: 3.0.3
info:
  title: Mini
  version: 0.0.1
paths:
  /ping:
    get:
      operationId: ping
      responses:
        '200':
          description: ok
`), 0o644)

	s, err := specriot.Load(specFile)
	if err != nil {
		log.Fatal(err)
	}
	ops := s.Operations()
	for _, op := range ops {
		fmt.Printf("%s %s (%s)\n", op.Method, op.Path, op.Key)
	}

}

Output:
GET /ping (ping)

func (*Spec) Run

func (s *Spec) Run(ctx context.Context, target string, opts ...Option) (*Report, error)

Run executes deterministic generated requests against target.

target is the base URL (for example "http://localhost:8080"). Requests are executed sequentially in a deterministic order: operations sorted by path and method, then iterations.

func (*Spec) RunStateful

func (s *Spec) RunStateful(ctx context.Context, target string, opts ...Option) (*StatefulReport, error)

RunStateful executes dependency-aware stateful request sequences against target. It builds a dependency graph, generates sequences using a dependency-guided weighted random walk, and executes each sequence with variable binding (response values from producer operations are fed to consumer operations). Mutations include stale-value reuse and step repetition (e.g., double DELETE).

This can discover bugs that require multiple related requests and cannot be reproduced by isolated endpoint fuzzing.

type StatefulReport

type StatefulReport struct {
	Title      string
	Version    string
	Seed       int64
	Sequences  int
	Operations int
	Executed   int
	Failures   []SequenceFailure
	Graph      *Graph
}

StatefulReport holds the results of a stateful fuzzing run.

func (*StatefulReport) Failed

func (r *StatefulReport) Failed() bool

Failed reports whether any sequence failures were found.

type StepInfo

type StepInfo struct {
	OperationKey string `json:"operation"`
	Method       string `json:"method"`
	Path         string `json:"path"`
	UseStale     bool   `json:"use_stale,omitempty"`
}

StepInfo describes a single step in a sequence (for failure context).

type ValueRef

type ValueRef = graph.ValueRef

ValueRef references a value in an operation's input or output.