Architecture
How the SDK, protocol, and provider packages compose.
Application boundary
Your application owns the requested action and its required scope, tenant, audience and authority policy. It chooses trusted issuer keys and providers, supplies custody/storage, and prevents execution when verification fails.
SDK boundary
The six SDKs expose language-specific APIs. TypeScript separates IdentityProvider, ArsenalClient, VerificationClient, and privileged authority verification. Rust separates optional Arsenal/AEGIS integration through Cargo features. Other languages have their own verifier, facade and middleware coverage.
Protocol packages
| Family | Main responsibilities |
|---|---|
| OAS | DID/document/crypto/lineage/resolution/attestation |
| Canonical ACT | Capability byte format and verification |
| Arsenal | Credentials, broker, policy, consent and storage |
| AEGIS | Verification, keys, auth, delegation, policy and wallet modules |
| Core auth and adapters | Challenge/proof/session models and transport bindings |
Integration boundary
MCP and lifecycle hooks connect authorization to tools. OIDC/SCIM bridges connect enterprise identity flows while requiring real identity/key callbacks. Deployment examples show runtime wiring; they do not provision every required backend or secret.
Source reference
The 64-package catalog gives source versions and installation boundaries. Rust modules and TypeScript exported symbols expose concrete signatures and options. Source availability, registry publication, deployed service availability and production verification are separate evidence.