{ "schema_version": 1, "generator": "Tree-sitter declared Rust module traversal", "packages": [ { "name": "agent-capability-token", "url": "/reference/rust/agent-capability-token", "modules": [ { "module": "crate", "source": "act/agent-capability-token/src/lib.rs", "sha256": "a326ce327fca34441b760e229ef3b7ac9d9ae536c1899365dd538ac56ebd6918", "attributes": "", "items": [ { "name": "claims", "kind": "module", "signature": "pub mod claims;", "docs": "", "attributes": "", "line": 63 }, { "name": "error", "kind": "module", "signature": "pub mod error;", "docs": "", "attributes": "", "line": 64 }, { "name": "scope", "kind": "module", "signature": "pub mod scope;", "docs": "", "attributes": "", "line": 65 }, { "name": "wire", "kind": "module", "signature": "pub mod wire;", "docs": "", "attributes": "", "line": 66 }, { "name": "pub use claims::{ActClaims, Confirmation, Delegation};", "kind": "use_declaration", "signature": "pub use claims::{ActClaims, Confirmation, Delegation};", "docs": "", "attributes": "", "line": 68 }, { "name": "pub use error::{ActError, ActResult};", "kind": "use_declaration", "signature": "pub use error::{ActError, ActResult};", "docs": "", "attributes": "", "line": 69 }, { "name": "pub use scope::{Scope, SCOPE_SEGMENTS, WILDCARD};", "kind": "use_declaration", "signature": "pub use scope::{Scope, SCOPE_SEGMENTS, WILDCARD};", "docs": "", "attributes": "", "line": 70 }, { "name": "pub use wire::{\n claims_to_signing_payload, envelope_from_parts, verify, ActEnvelope, PublicKeyBytes, Verifier,\n ALGORITHM_ED25519, FORMAT_VERSION, MAX_ACT_BYTES,\n};", "kind": "use_declaration", "signature": "pub use wire::{\n claims_to_signing_payload, envelope_from_parts, verify, ActEnvelope, PublicKeyBytes, Verifier,\n ALGORITHM_ED25519, FORMAT_VERSION, MAX_ACT_BYTES,\n};", "docs": "", "attributes": "", "line": 71 }, { "name": "pub use wire::sign;", "kind": "use_declaration", "signature": "pub use wire::sign;", "docs": "", "attributes": "#[cfg(feature = \"sign\")]", "line": 77 } ], "parseErrors": false }, { "module": "claims", "source": "act/agent-capability-token/src/claims.rs", "sha256": "86db89e62b3fa97ec758d96d606bec63495b139630cc33fc19854b074155732d", "attributes": "", "items": [ { "name": "claims::Confirmation", "kind": "struct_item", "signature": "pub struct Confirmation {\n/// Fingerprint of the key the holder must demonstrate control of.\n\npub key_fingerprint: String,\n/// Algorithm the fingerprint and possession proof use, for example\n\n/// `\"Ed25519\"`.\n\npub alg: String\n}", "docs": "Proof-of-possession binding.\n\nANVIL section 5.2 requires that an ACT be bound to the agent's OAS DID by\nproof-of-possession. A verifier that ignores this claim cannot tell a\nlegitimate holder from someone replaying a captured token, which is why it\nis typed here rather than left to the extension map.", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]", "line": 31 }, { "name": "claims::Delegation", "kind": "struct_item", "signature": "pub struct Delegation {\n/// Whether onward delegation is permitted at all.\n\npub allow_delegation: bool,\n/// Remaining delegation depth. Zero forbids further delegation.\n\npub max_depth: u8,\n/// Subset of scopes that may be delegated. `None` means the holder's full\n\n/// scope set is delegatable, subject to `allow_delegation`.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub delegatable_scopes: Option>,\n/// Whether any recipient may receive a delegation.\n\npub allow_any_delegate: bool,\n/// DIDs permitted to receive a delegation when `allow_any_delegate` is\n\n/// false.\n\n#[serde(default, skip_serializing_if = \"Vec::is_empty\")]\npub allowed_delegates: Vec,\n/// Minimum reduction in lifetime, in seconds, that a delegated token must\n\n/// apply relative to this one.\n\n#[serde(default)]\npub min_ttl_reduction_seconds: i64\n}", "docs": "Constraints governing whether and how this token may be delegated onward.\n\nANVIL section 5.2 requires that an agent not delegate capabilities it does\nnot hold, and that child capabilities be a strict subset of the parent's.", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]", "line": 44 }, { "name": "claims::ActClaims", "kind": "struct_item", "signature": "pub struct ActClaims {\n/// Token identifier, unique per issuance. Text, not bytes - a UUID here is\n\n/// carried in its canonical hyphenated form.\n\npub jti: String,\n/// Subject: the OAS DID of the agent this token was issued to.\n\npub sub: String,\n/// Issuer: the broker instance that minted this token.\n\npub iss: String,\n/// Audiences this token is valid for.\n\n///\n\n/// Decodes from either a single string or an array of strings, since a\n\n/// single-audience token is the common case and writing it as a bare string\n\n/// is the conventional CBOR/JWT shorthand.\n\n#[serde(deserialize_with = \"audience_from_string_or_array\")]\npub aud: Vec,\n/// Issued-at time, in seconds since the Unix epoch.\n\npub iat: i64,\n/// Not-before time, in seconds since the Unix epoch.\n\n#[serde(default)]\npub nbf: i64,\n/// Expiry time, in seconds since the Unix epoch.\n\npub exp: i64,\n/// Tenant this token is scoped to.\n\npub tenant_id: String,\n/// Granted capability scopes, as a flat array.\n\npub scope: Vec,\n/// Proof-of-possession binding. See [`Confirmation`].\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub cnf: Option,\n/// Onward delegation constraints. See [`Delegation`].\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub delegation: Option,\n/// Issuer-defined claims, carried inside the signature and passed through\n\n/// unaltered.\n\n///\n\n/// This is where rate limits, budgets, device and network bindings, and\n\n/// audit trace belong. A verifier that does not understand a key here must\n\n/// preserve it rather than drop it, so that a downstream component which\n\n/// does understand it still receives an intact, signed value.\n\n#[serde(default, skip_serializing_if = \"BTreeMap::is_empty\")]\npub ext: BTreeMap\n}", "docs": "The claim set carried inside an ACT envelope.\n\nField names are the wire keys. Unknown top-level keys are ignored on decode\nso that a newer issuer can add typed claims without breaking existing\nverifiers; issuer-specific claims belong in [`ActClaims::ext`] instead.", "attributes": "#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]", "line": 71 }, { "name": "claims::ActClaims::validate_structure", "kind": "function_item", "signature": "pub fn validate_structure(&self) -> ActResult<()>;", "docs": "Checks the claim set is structurally sound, independent of signature or\nclock.\n\nCalled during verification before any policy check. Kept public so an\nissuer can reject a malformed claim set at mint time rather than\ndiscovering it at the verifier.\n\n# Errors\n\nReturns [`ActError::EmptyClaim`] for a required claim that is blank, and\n[`ActError::EmptyValidityWindow`] if `nbf` is not before `exp`.", "attributes": "", "line": 155 }, { "name": "claims::ActClaims::authorizes", "kind": "function_item", "signature": "pub fn authorizes(&self, requested: &Scope) -> bool;", "docs": "Whether the granted scopes authorize `requested`.\n\nWildcards in the grant expand; wildcards in the request do not. See\n[`Scope::covers`].", "attributes": "#[must_use]", "line": 186 }, { "name": "claims::ActClaims::has_audience", "kind": "function_item", "signature": "pub fn has_audience(&self, audience: &str) -> bool;", "docs": "Whether this token lists `audience` among its audiences.", "attributes": "#[must_use]", "line": 192 } ], "parseErrors": false }, { "module": "error", "source": "act/agent-capability-token/src/error.rs", "sha256": "0f6e05a67798b4bd4503b6522a733e617a9aef0893ef65185684ed1a8f1bc6cc", "attributes": "", "items": [ { "name": "error::ActError", "kind": "enum_item", "signature": "pub enum ActError {\n /// The encoded token exceeded [`crate::MAX_ACT_BYTES`].\n ///\n /// Checked before any parsing, so a hostile payload cannot force\n /// unbounded allocation.\n #[error(\"token is {actual} bytes, exceeding the {limit}-byte maximum\")]\n TooLarge {\n /// Size of the rejected input.\n actual: usize,\n /// The configured ceiling.\n limit: usize,\n },\n\n /// The outer envelope was not well-formed CBOR, or did not match the\n /// envelope schema.\n #[error(\"envelope decode failed: {0}\")]\n EnvelopeDecode(String),\n\n /// The claims payload inside the envelope was not well-formed CBOR, or did\n /// not match the claims schema.\n #[error(\"claims decode failed: {0}\")]\n ClaimsDecode(String),\n\n /// The envelope declared a format version this build does not implement.\n ///\n /// Carried explicitly so a rollout can distinguish \"forged\" from \"newer\n /// than me\", which are operationally opposite situations.\n #[error(\"unsupported ACT format version {found}, this build supports {supported}\")]\n UnsupportedVersion {\n /// Version declared by the envelope.\n found: u64,\n /// Version this build implements.\n supported: u64,\n },\n\n /// The envelope declared a signature algorithm this build does not\n /// implement.\n #[error(\"unsupported signature algorithm {0:?}, this build implements Ed25519\")]\n UnsupportedAlgorithm(String),\n\n /// The signature field was absent.\n #[error(\"envelope carries no signature\")]\n MissingSignature,\n\n /// The signature was present but not 64 bytes.\n #[error(\"signature is {0} bytes, expected exactly 64\")]\n MalformedSignature(usize),\n\n /// A configured trusted key was not a valid Ed25519 public key.\n ///\n /// Distinguished from a verification failure because it is a\n /// misconfiguration on the verifier's side, not a problem with the token.\n #[error(\"trusted key at index {index} is not a valid Ed25519 key: {reason}\")]\n MalformedTrustedKey {\n /// Position in the supplied key set.\n index: usize,\n /// Underlying reason.\n reason: String,\n },\n\n /// No trusted keys were supplied, so no token could ever verify.\n #[error(\"at least one trusted issuer key is required\")]\n NoTrustedKeys,\n\n /// The signature did not validate against any trusted key.\n #[error(\"signature did not validate against any of {tried} trusted keys\")]\n SignatureInvalid {\n /// Number of keys attempted.\n tried: usize,\n },\n\n /// `exp` is at or before the current time.\n #[error(\"token expired at {expired_at} (now {now})\")]\n Expired {\n /// The `exp` claim.\n expired_at: i64,\n /// Time used for the comparison.\n now: i64,\n },\n\n /// `nbf` is after the current time.\n #[error(\"token not valid until {valid_from} (now {now})\")]\n NotYetValid {\n /// The `nbf` claim.\n valid_from: i64,\n /// Time used for the comparison.\n now: i64,\n },\n\n /// `iss` did not match the expected issuer.\n #[error(\"issuer mismatch: expected {expected:?}, found {found:?}\")]\n IssuerMismatch {\n /// Issuer the verifier requires.\n expected: String,\n /// Issuer the token carries.\n found: String,\n },\n\n /// `aud` did not include the expected audience.\n #[error(\"audience mismatch: expected {expected:?}, found {found:?}\")]\n AudienceMismatch {\n /// Audience the verifier requires.\n expected: String,\n /// Audiences the token carries.\n found: Vec,\n },\n\n /// A required scope was absent from `scope`.\n #[error(\"missing required scope {0:?}\")]\n MissingScope(String),\n\n /// A scope did not match the `service:resource:action` grammar.\n #[error(\"scope {value:?} is malformed: {reason}\")]\n MalformedScope {\n /// The offending scope string.\n value: String,\n /// Why it was rejected.\n reason: &'static str,\n },\n\n /// A structurally required claim was empty.\n #[error(\"claim {0} must not be empty\")]\n EmptyClaim(&'static str),\n\n /// `exp` was not after `nbf`, so the token has no valid window.\n #[error(\"token validity window is empty: nbf {nbf} is not before exp {exp}\")]\n EmptyValidityWindow {\n /// The `nbf` claim.\n nbf: i64,\n /// The `exp` claim.\n exp: i64,\n },\n\n /// Serializing claims or an envelope failed.\n #[error(\"encode failed: {0}\")]\n Encode(String),\n}", "docs": "Error types for ACT encoding, decoding and verification.\nFailures encountered while decoding or verifying an ACT.\n\nVariants are deliberately specific so callers can distinguish an expired\ntoken from a forged one in logs and metrics. A verifier that collapses these\ninto a single \"invalid token\" outcome loses the ability to alarm on forgery\nwhile staying quiet about ordinary expiry.", "attributes": "#[derive(Debug, thiserror::Error)]\n#[non_exhaustive]", "line": 11 }, { "name": "error::ActResult", "kind": "type_item", "signature": "pub type ActResult = Result;", "docs": "Result alias for ACT operations.", "attributes": "", "line": 150 } ], "parseErrors": false }, { "module": "scope", "source": "act/agent-capability-token/src/scope.rs", "sha256": "4958ce88d532883b39de4c8600bbf1dc51733ad13e92e0dc5c4b82b3b66ece7d", "attributes": "", "items": [ { "name": "scope::WILDCARD", "kind": "const_item", "signature": "pub const WILDCARD: &str;", "docs": "The wildcard segment, which matches any value in its position.", "attributes": "", "line": 14 }, { "name": "scope::SCOPE_SEGMENTS", "kind": "const_item", "signature": "pub const SCOPE_SEGMENTS: usize;", "docs": "Number of colon-separated segments in a well-formed scope.", "attributes": "", "line": 17 }, { "name": "scope::Scope", "kind": "struct_item", "signature": "pub struct Scope {\n\n}", "docs": "A validated capability scope in `service:resource:action` form.\n\nSerializes as a plain string, so the wire representation is a flat array of\nstrings rather than a nested structure.\n\n# Examples\n\n```\nuse agent_capability_token::Scope;\n\nlet scope: Scope = \"tools:calendar:invoke\".parse()?;\nassert_eq!(scope.service(), \"tools\");\nassert_eq!(scope.action(), \"invoke\");\n\n// A granted wildcard covers a specific request.\nlet granted: Scope = \"runtime:platform:*\".parse()?;\nlet requested: Scope = \"runtime:platform:spawn\".parse()?;\nassert!(granted.covers(&requested));\n# Ok::<(), agent_capability_token::ActError>(())\n```", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]", "line": 40 }, { "name": "scope::Scope::parse", "kind": "function_item", "signature": "pub fn parse(value: impl Into) -> ActResult;", "docs": "Parses and validates a scope string.\n\n# Errors\n\nReturns [`ActError::MalformedScope`] unless the input has exactly three\nnon-empty colon-separated segments.", "attributes": "", "line": 54 }, { "name": "scope::Scope::service", "kind": "function_item", "signature": "pub fn service(&self) -> &str;", "docs": "The service segment.", "attributes": "#[must_use]", "line": 91 }, { "name": "scope::Scope::resource", "kind": "function_item", "signature": "pub fn resource(&self) -> &str;", "docs": "The resource segment.", "attributes": "#[must_use]", "line": 97 }, { "name": "scope::Scope::action", "kind": "function_item", "signature": "pub fn action(&self) -> &str;", "docs": "The action segment.", "attributes": "#[must_use]", "line": 103 }, { "name": "scope::Scope::as_str", "kind": "function_item", "signature": "pub fn as_str(&self) -> &str;", "docs": "The scope as it appears on the wire.", "attributes": "#[must_use]", "line": 109 }, { "name": "scope::Scope::covers", "kind": "function_item", "signature": "pub fn covers(&self, requested: &Self) -> bool;", "docs": "Whether this scope, treated as a grant, authorizes `requested`.\n\nA [`WILDCARD`] segment in the grant matches any value in the same\nposition. The comparison is directional: a wildcard in `requested` is\nmatched literally, so a caller cannot widen its own authority by asking\nfor `*`.", "attributes": "#[must_use]", "line": 120 } ], "parseErrors": false }, { "module": "wire", "source": "act/agent-capability-token/src/wire.rs", "sha256": "c72d2909a9791584b9c5611732b7cc6b43de3de6a3ac4002e4359870c358d24f", "attributes": "", "items": [ { "name": "wire::FORMAT_VERSION", "kind": "const_item", "signature": "pub const FORMAT_VERSION: u64;", "docs": "Current ACT format version.", "attributes": "", "line": 34 }, { "name": "wire::ALGORITHM_ED25519", "kind": "const_item", "signature": "pub const ALGORITHM_ED25519: &str;", "docs": "The only signature algorithm this version defines.", "attributes": "", "line": 37 }, { "name": "wire::MAX_ACT_BYTES", "kind": "const_item", "signature": "pub const MAX_ACT_BYTES: usize;", "docs": "Maximum accepted size of an encoded ACT, in bytes.\n\nEnforced before parsing so an oversized payload cannot drive allocation.", "attributes": "", "line": 42 }, { "name": "wire::PublicKeyBytes", "kind": "type_item", "signature": "pub type PublicKeyBytes = [u8; 32];", "docs": "A raw Ed25519 public key.\n\nKept as a plain array so this crate does not impose a key-handle type on\ncallers, who typically hold a rotating set loaded from their issuer's key\nendpoint.", "attributes": "", "line": 52 }, { "name": "wire::ActEnvelope", "kind": "struct_item", "signature": "pub struct ActEnvelope {\n/// Format version.\n\npub v: u64,\n/// Signature algorithm identifier.\n\npub alg: String,\n/// CBOR-encoded claims. These exact bytes are what the signature covers.\n\npub claims: serde_bytes::ByteBuf,\n/// Raw signature over `claims`.\n\npub sig: serde_bytes::ByteBuf,\n/// Optional key identifier, so a verifier can select a key during rotation\n\n/// instead of trying every trusted key.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub kid: Option\n}", "docs": "The outer envelope, as it appears on the wire.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 56 }, { "name": "wire::ActEnvelope::decode", "kind": "function_item", "signature": "pub fn decode(bytes: &[u8]) -> ActResult;", "docs": "Decodes an envelope without verifying its signature.\n\nUseful for reading `kid` in order to select a verification key. The\nclaims inside are unauthenticated until [`verify`] succeeds, and must not\nbe used for any authorization decision.\n\n# Errors\n\nReturns [`ActError::TooLarge`] above [`MAX_ACT_BYTES`],\n[`ActError::EnvelopeDecode`] for malformed CBOR,\n[`ActError::UnsupportedVersion`] or [`ActError::UnsupportedAlgorithm`]\nfor a format this build does not implement.", "attributes": "", "line": 84 }, { "name": "wire::ActEnvelope::encode", "kind": "function_item", "signature": "pub fn encode(&self) -> ActResult>;", "docs": "Serializes this envelope to CBOR.\n\n# Errors\n\nReturns [`ActError::Encode`] if serialization fails.", "attributes": "", "line": 113 }, { "name": "wire::Verifier", "kind": "struct_item", "signature": "pub struct Verifier {\n\n}", "docs": "What a verifier requires of a token.", "attributes": "#[derive(Debug, Clone)]", "line": 122 }, { "name": "wire::Verifier::new", "kind": "function_item", "signature": "pub fn new(\n trusted_keys: Vec,\n expected_issuer: impl Into,\n expected_audience: impl Into,\n ) -> ActResult;", "docs": "Builds a verifier.\n\n# Errors\n\nReturns [`ActError::NoTrustedKeys`] if `trusted_keys` is empty, since no\ntoken could then ever verify and the misconfiguration should surface at\nconstruction rather than as a stream of signature failures.", "attributes": "", "line": 139 }, { "name": "wire::Verifier::requiring_scopes", "kind": "function_item", "signature": "pub fn requiring_scopes(mut self, scopes: impl IntoIterator) -> Self;", "docs": "Requires that the token grant every scope in `scopes`.", "attributes": "#[must_use]", "line": 159 }, { "name": "wire::Verifier::with_leeway_seconds", "kind": "function_item", "signature": "pub fn with_leeway_seconds(mut self, seconds: i64) -> Self;", "docs": "Allows `seconds` of clock skew on the `nbf` and `exp` checks.\n\nApplied symmetrically. Callers running across hosts without tightly\nsynchronized clocks need a small allowance here; leaving it at zero makes\na token minted moments ago fail at a verifier whose clock trails the\nissuer's.", "attributes": "#[must_use]", "line": 171 }, { "name": "wire::Verifier::with_clock", "kind": "function_item", "signature": "pub fn with_clock(mut self, now_unix_seconds: i64) -> Self;", "docs": "Pins the time used for temporal checks, in seconds since the Unix epoch.\n\nIntended for tests and for replaying a decision at a known instant.", "attributes": "#[must_use]", "line": 180 }, { "name": "wire::verify", "kind": "function_item", "signature": "pub fn verify(token_bytes: &[u8], verifier: &Verifier) -> ActResult;", "docs": "Verifies an encoded ACT and returns its claims.\n\nThe order matters. Signature verification precedes every claim check, so a\nforged token is rejected before any of its unauthenticated content is used to\nmake a decision or shape a log line.\n\n1. Enforce the size ceiling and decode the envelope.\n2. Verify the Ed25519 signature over the raw `claims` bytes.\n3. Decode the claims and check they are structurally sound.\n4. Check the temporal window, issuer, audience, and required scopes.\n\n# Errors\n\nReturns the [`ActError`] variant describing the first failed step.\n\n# Examples\n\n```\nuse agent_capability_token::{verify, ActError, Verifier};\n\nlet verifier = Verifier::new(vec![[0u8; 32]], \"arsenal:broker:prod-1\", \"omerta\")?;\n// An empty payload is not a valid envelope.\nassert!(matches!(verify(&[], &verifier), Err(ActError::EnvelopeDecode(_))));\n# Ok::<(), ActError>(())\n```", "attributes": "", "line": 232 }, { "name": "wire::claims_to_signing_payload", "kind": "function_item", "signature": "pub fn claims_to_signing_payload(claims: &ActClaims) -> ActResult>;", "docs": "Encodes claims into the exact byte string the signature must cover.\n\nExposed so an issuer holding its key in an HSM, or any other signer that\ncannot hand over private key material, can produce the payload here and sign\nit elsewhere.\n\n# Errors\n\nReturns [`ActError::Encode`] if serialization fails.", "attributes": "", "line": 341 }, { "name": "wire::envelope_from_parts", "kind": "function_item", "signature": "pub fn envelope_from_parts(\n claims_bytes: Vec,\n signature: &[u8],\n kid: Option,\n) -> ActResult>;", "docs": "Assembles an envelope from claims bytes and a detached signature.\n\nPairs with [`claims_to_signing_payload`] for signers that hold their key\noutside the process.\n\n# Errors\n\nReturns [`ActError::MalformedSignature`] unless `signature` is 64 bytes, and\n[`ActError::TooLarge`] if the assembled token exceeds [`MAX_ACT_BYTES`].", "attributes": "", "line": 357 }, { "name": "wire::sign", "kind": "function_item", "signature": "pub fn sign(\n claims: &ActClaims,\n signing_key: &ed25519_dalek::SigningKey,\n kid: Option,\n) -> ActResult>;", "docs": "Signs claims with an in-process key and returns an encoded ACT.\n\nBehind the `sign` feature: a verifier has no reason to link signing code, and\nmost deployments verify in far more places than they mint.\n\n# Errors\n\nReturns [`ActError::Encode`] if serialization fails, or [`ActError::TooLarge`]\nif the assembled token exceeds [`MAX_ACT_BYTES`].", "attributes": "#[cfg(feature = \"sign\")]", "line": 394 } ], "parseErrors": false } ] }, { "name": "aegis-auth", "url": "/reference/rust/aegis-auth", "modules": [ { "module": "crate", "source": "aegis/aegis-auth/src/lib.rs", "sha256": "7b6f26da034daf413490a387eddccc9114ecb69734dba161516cf589b27c158c", "attributes": "", "items": [ { "name": "challenge", "kind": "module", "signature": "pub mod challenge;", "docs": "", "attributes": "", "line": 10 }, { "name": "provider", "kind": "module", "signature": "pub mod provider;", "docs": "", "attributes": "", "line": 11 }, { "name": "session", "kind": "module", "signature": "pub mod session;", "docs": "", "attributes": "", "line": 12 }, { "name": "store", "kind": "module", "signature": "pub mod store;", "docs": "", "attributes": "", "line": 13 }, { "name": "pub use challenge::{build_challenge_payload, Challenge, ChallengeVerifier};", "kind": "use_declaration", "signature": "pub use challenge::{build_challenge_payload, Challenge, ChallengeVerifier};", "docs": "", "attributes": "", "line": 15 }, { "name": "pub use provider::{ApiKeyProvider, ChallengeResponseProvider};", "kind": "use_declaration", "signature": "pub use provider::{ApiKeyProvider, ChallengeResponseProvider};", "docs": "", "attributes": "", "line": 16 }, { "name": "pub use session::SessionManager;", "kind": "use_declaration", "signature": "pub use session::SessionManager;", "docs": "", "attributes": "", "line": 17 }, { "name": "pub use store::{InMemoryNonceStore, InMemorySessionStore, NonceStore, SessionStore};", "kind": "use_declaration", "signature": "pub use store::{InMemoryNonceStore, InMemorySessionStore, NonceStore, SessionStore};", "docs": "", "attributes": "", "line": 18 } ], "parseErrors": false }, { "module": "challenge", "source": "aegis/aegis-auth/src/challenge.rs", "sha256": "39efc24b239da3aaa326a390e3b735a62a45b9e8b57dcb25ada5e0992ecebba3", "attributes": "", "items": [ { "name": "challenge::Challenge", "kind": "struct_item", "signature": "pub struct Challenge {\n/// 32 cryptographically random bytes.\n\npub challenge_bytes: [u8; 32],\n/// ISO 8601 timestamp of challenge creation.\n\npub timestamp: DateTime,\n/// Verifier-generated nonce (UUID v7) to prevent replay attacks.\n\npub nonce: String,\n/// When this challenge expires (creation time + 60 seconds).\n\npub expires_at: DateTime\n}", "docs": "A challenge issued by the verifier to an authenticating entity.\n\nThe prover must sign a JCS-canonical payload containing the challenge bytes,\ntheir DID, the nonce, and the timestamp. The signed response must arrive\nbefore `expires_at`.", "attributes": "#[derive(Debug, Clone)]", "line": 33 }, { "name": "challenge::Challenge::generate", "kind": "function_item", "signature": "pub fn generate() -> Self;", "docs": "Generate a new random challenge.\n\nFills 32 bytes from the OS CSPRNG, generates a UUID v7 nonce, and\nsets expiry to 60 seconds from now.", "attributes": "", "line": 49 }, { "name": "challenge::ChallengeVerifier", "kind": "struct_item", "signature": "pub struct ChallengeVerifier {\n\n}", "docs": "Challenge-response verifier.\n\nTracks recently used nonces to prevent replay attacks within a 5-minute\nwindow. Thread-safe via interior `RwLock`.", "attributes": "", "line": 70 }, { "name": "challenge::ChallengeVerifier::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Create a new verifier with an empty nonce set.", "attributes": "", "line": 79 }, { "name": "challenge::ChallengeVerifier::verify_response", "kind": "function_item", "signature": "pub fn verify_response(\n &self,\n challenge: &Challenge,\n did: &str,\n signature_b64: &str,\n public_key: &VerifyingKey,\n ) -> Result<(), AuthError>;", "docs": "Verify a challenge response.\n\nPerforms the following checks in order:\n1. Challenge has not expired.\n2. Timestamp is within +/- 30 seconds of current time.\n3. Nonce has not been used before.\n4. Constructs JCS-canonical payload and verifies the Ed25519 signature.\n5. Marks the nonce as used.\n\n# Arguments\n\n* `challenge` - The challenge that was issued to the prover.\n* `did` - The DID claimed by the prover.\n* `signature_b64` - Base64url-encoded Ed25519 signature over the canonical payload.\n* `public_key` - The prover's Ed25519 verifying key (resolved from their DID document).\n\n# Errors\n\nReturns [`AuthError::ChallengeInvalid`] if any check fails.\nReturns [`AuthError::InvalidCredential`] if the signature is malformed or invalid.", "attributes": "", "line": 105 }, { "name": "challenge::ChallengeVerifier::clear_nonces", "kind": "function_item", "signature": "pub fn clear_nonces(&self) -> Result<(), AuthError>;", "docs": "Remove all nonces from the set.\n\nIn a production system, nonces would expire via TTL. This method\nprovides a manual reset for testing or periodic cleanup.", "attributes": "", "line": 186 }, { "name": "challenge::build_challenge_payload", "kind": "function_item", "signature": "pub fn build_challenge_payload(challenge: &Challenge, did: &str) -> Result, AuthError>;", "docs": "Build the JCS-canonical payload bytes for challenge signing/verification.\n\nThe canonical form is a JSON object with keys in alphabetical order:\n```json\n{\"challenge\":\"\",\"did\":\"\",\"nonce\":\"\",\"timestamp\":\"\"}\n```\n\nJCS (RFC 8785) handles the key ordering automatically via `serde_jcs`.\n\n# Arguments\n\n* `challenge` - The challenge containing the random bytes, nonce, and timestamp.\n* `did` - The DID of the entity signing the challenge.\n\n# Returns\n\nThe canonical JSON bytes ready for Ed25519 signing.\n\n# Errors\n\nReturns [`AuthError::Internal`] if JCS serialization fails.", "attributes": "", "line": 225 } ], "parseErrors": false }, { "module": "provider", "source": "aegis/aegis-auth/src/provider.rs", "sha256": "446ccd58e86eaa6fd49ff6546b97b563275cd301d2b9206efc9d7aabc0b7571e", "attributes": "", "items": [ { "name": "provider::ChallengeResponseProvider", "kind": "struct_item", "signature": "pub struct ChallengeResponseProvider {\n\n}", "docs": "Auth provider implementing the AEGIS challenge-response protocol.\n\nValidates `AuthCredential::SignedChallenge` credentials by:\n1. Resolving the DID to obtain the OAS Identity Document.\n2. Extracting the authentication public key from the document.\n3. Reconstructing the challenge and verifying the Ed25519 signature.\n\nRequires a DID resolver to look up the entity's public key from\ntheir DID document.", "attributes": "", "line": 35 }, { "name": "provider::ChallengeResponseProvider::new", "kind": "function_item", "signature": "pub fn new(resolver: Arc) -> Self;", "docs": "Create a new challenge-response provider.\n\n# Arguments\n\n* `resolver` - A DID resolver for looking up entity public keys.", "attributes": "", "line": 46 }, { "name": "provider::ChallengeResponseProvider::verifier", "kind": "function_item", "signature": "pub fn verifier(&self) -> &ChallengeVerifier;", "docs": "Returns a reference to the inner challenge verifier.\n\nUseful for generating challenges via `Challenge::generate()` and\nmanaging nonce state.", "attributes": "", "line": 57 }, { "name": "provider::ApiKeyProvider", "kind": "struct_item", "signature": "pub struct ApiKeyProvider {\n\n}", "docs": "Simple API key auth provider for service-to-service communication.\n\nMaps opaque API keys to DIDs. Suitable for internal services that\nauthenticate via pre-shared keys rather than challenge-response.", "attributes": "", "line": 185 }, { "name": "provider::ApiKeyProvider::new", "kind": "function_item", "signature": "pub fn new(keys: HashMap) -> Self;", "docs": "Create a new API key provider.\n\n# Arguments\n\n* `keys` - Map from API key strings to DID strings.", "attributes": "", "line": 196 }, { "name": "provider::ApiKeyProvider::register_key", "kind": "function_item", "signature": "pub fn register_key(&mut self, key: String, did: String);", "docs": "Register an API key for a DID.", "attributes": "", "line": 201 }, { "name": "provider::ApiKeyProvider::revoke_key", "kind": "function_item", "signature": "pub fn revoke_key(&mut self, key: &str) -> bool;", "docs": "Remove an API key.", "attributes": "", "line": 206 } ], "parseErrors": false }, { "module": "session", "source": "aegis/aegis-auth/src/session.rs", "sha256": "a25c8ec6b3c94cbbd424956d697d6f5d9c1021be33374f4cb703c1857052ffe9", "attributes": "", "items": [ { "name": "session::SessionManager", "kind": "struct_item", "signature": "pub struct SessionManager {\n/// Max lifetime for human sessions.\n\npub human_max_lifetime: Duration,\n/// Max lifetime for agent sessions.\n\npub agent_max_lifetime: Duration\n}", "docs": "Session manager with in-memory storage.\n\nProvides create, get, revoke, and cleanup operations for authentication\nsessions. Agent sessions are shorter-lived (1 hour default) than human\nsessions (24 hours default) per the AEGIS specification.", "attributes": "", "line": 28 }, { "name": "session::SessionManager::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Create a new session manager with default lifetimes.\n\n- Human sessions: 24 hours\n- Agent sessions: 1 hour", "attributes": "", "line": 41 }, { "name": "session::SessionManager::with_lifetimes", "kind": "function_item", "signature": "pub fn with_lifetimes(human_max_lifetime: Duration, agent_max_lifetime: Duration) -> Self;", "docs": "Create a new session manager with custom lifetimes.\n\n# Arguments\n\n* `human_max_lifetime` - Maximum lifetime for human sessions.\n* `agent_max_lifetime` - Maximum lifetime for agent sessions.", "attributes": "", "line": 55 }, { "name": "session::SessionManager::create_session", "kind": "function_item", "signature": "pub fn create_session(\n &self,\n did: &str,\n provider: &str,\n scope: Vec,\n is_agent: bool,\n device_binding: Option,\n ) -> Result;", "docs": "Create a new authenticated session.\n\nGenerates a UUID v7 session identifier and computes the expiry time\nbased on the entity type (agent or human).\n\n# Arguments\n\n* `did` - DID of the authenticated entity.\n* `provider` - Name of the auth provider that validated the credential.\n* `scope` - List of authorized scopes for this session.\n* `is_agent` - Whether the entity is an agent (shorter session lifetime).\n* `device_binding` - Optional device fingerprint to bind this session to.\n\n# Returns\n\nThe newly created [`Session`].\n\n# Errors\n\nReturns [`AuthError::Internal`] if the session lock is poisoned.", "attributes": "", "line": 83 }, { "name": "session::SessionManager::get_session", "kind": "function_item", "signature": "pub fn get_session(&self, session_id: &str) -> Result;", "docs": "Retrieve a session by ID.\n\nReturns the session if it exists and has not expired. If the session\nhas expired, it is automatically removed and a `SessionExpired` error\nis returned.\n\n# Arguments\n\n* `session_id` - The session identifier to look up.\n\n# Errors\n\nReturns [`AuthError::SessionExpired`] if the session exists but has expired.\nReturns [`AuthError::InvalidCredential`] if the session does not exist.\nReturns [`AuthError::Internal`] if the session lock is poisoned.", "attributes": "", "line": 132 }, { "name": "session::SessionManager::revoke_session", "kind": "function_item", "signature": "pub fn revoke_session(&self, session_id: &str) -> Result<(), AuthError>;", "docs": "Revoke a session by removing it from storage.\n\n# Arguments\n\n* `session_id` - The session identifier to revoke.\n\n# Errors\n\nReturns [`AuthError::InvalidCredential`] if the session does not exist.\nReturns [`AuthError::Internal`] if the session lock is poisoned.", "attributes": "", "line": 164 }, { "name": "session::SessionManager::is_valid", "kind": "function_item", "signature": "pub fn is_valid(&self, session_id: &str) -> bool;", "docs": "Quick validity check for a session.\n\nReturns `true` if the session exists and has not expired, `false`\notherwise. Does not modify state (does not remove expired sessions).", "attributes": "", "line": 182 }, { "name": "session::SessionManager::cleanup_expired", "kind": "function_item", "signature": "pub fn cleanup_expired(&self) -> usize;", "docs": "Remove all expired sessions from storage.\n\nReturns the number of sessions removed. This should be called\nperiodically to prevent unbounded memory growth.", "attributes": "", "line": 198 }, { "name": "session::SessionManager::session_count", "kind": "function_item", "signature": "pub fn session_count(&self) -> usize;", "docs": "Returns the number of active sessions (includes expired ones not yet cleaned).", "attributes": "", "line": 211 } ], "parseErrors": false }, { "module": "store", "source": "aegis/aegis-auth/src/store.rs", "sha256": "e56e013658859f28040b06b7de74fcdff41bf5d01d95a2fd1b476032bb93ebe3", "attributes": "", "items": [ { "name": "store::SessionStore", "kind": "trait_item", "signature": "pub trait SessionStore: Send + Sync {\n /// Persist a session. Overwrites any existing session with the same ID.\n async fn store_session(&self, session: &Session) -> Result<(), AuthError>;\n\n /// Retrieve a session by its unique identifier.\n ///\n /// Returns `None` if no session with the given ID exists.\n async fn get_session(&self, session_id: &str) -> Result, AuthError>;\n\n /// Delete a session by ID.\n ///\n /// Returns `true` if a session was found and removed, `false` if no\n /// session with the given ID existed.\n async fn delete_session(&self, session_id: &str) -> Result;\n\n /// List sessions belonging to a specific DID with pagination.\n async fn list_by_did(\n &self,\n did: &str,\n pagination: Pagination,\n ) -> Result, AuthError>;\n\n /// Remove all expired sessions from the store.\n ///\n /// Returns the number of sessions removed.\n async fn cleanup_expired(&self) -> Result;\n}", "docs": "Pluggable storage backend for authentication sessions.\n\nImplementations may use in-memory storage, databases, or distributed\ncaches. All operations are async to accommodate network-backed stores.", "attributes": "#[async_trait]", "line": 25 }, { "name": "store::InMemorySessionStore", "kind": "struct_item", "signature": "pub struct InMemorySessionStore {\n\n}", "docs": "In-memory session store backed by a `RwLock`.\n\nSuitable for development, testing, and single-instance deployments.\nFor production multi-node deployments, use a database-backed or\ndistributed cache implementation of [`SessionStore`].", "attributes": "", "line": 62 }, { "name": "store::InMemorySessionStore::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Creates a new empty in-memory session store.", "attributes": "", "line": 68 }, { "name": "store::NonceStore", "kind": "trait_item", "signature": "pub trait NonceStore: Send + Sync {\n /// Record a nonce as used.\n ///\n /// Returns `true` if the nonce was newly recorded, `false` if it was\n /// already present (indicating a replay attempt).\n async fn record_nonce(&self, nonce: &str) -> Result;\n\n /// Check whether a nonce has already been recorded.\n async fn has_nonce(&self, nonce: &str) -> Result;\n\n /// Remove old nonces. Returns the number of entries removed.\n ///\n /// The cleanup strategy is implementation-defined. In-memory stores\n /// clear all entries; persistent stores may use TTL-based eviction.\n async fn cleanup(&self) -> Result;\n}", "docs": "Pluggable storage backend for cryptographic nonce tracking.\n\nUsed to prevent challenge replay attacks. Each nonce should be recorded\nexactly once; subsequent attempts to record the same nonce indicate a\nreplay and should be rejected.", "attributes": "#[async_trait]", "line": 144 }, { "name": "store::InMemoryNonceStore", "kind": "struct_item", "signature": "pub struct InMemoryNonceStore {\n\n}", "docs": "In-memory nonce store backed by a `RwLock`.\n\nRecords nonces in a set. Cleanup clears all recorded nonces;\ncallers should schedule cleanup periodically to bound memory usage.", "attributes": "", "line": 169 }, { "name": "store::InMemoryNonceStore::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Creates a new empty in-memory nonce store.", "attributes": "", "line": 175 } ], "parseErrors": false } ] }, { "name": "aegis-delegate", "url": "/reference/rust/aegis-delegate", "modules": [ { "module": "crate", "source": "aegis/aegis-delegate/src/lib.rs", "sha256": "adf9fb968b0e47f2f75c16d0639492179568b181572a17f794496e7046a5c654", "attributes": "", "items": [ { "name": "delegation_store", "kind": "module", "signature": "pub mod delegation_store;", "docs": "", "attributes": "", "line": 5 }, { "name": "proof", "kind": "module", "signature": "pub mod proof;", "docs": "", "attributes": "", "line": 6 }, { "name": "revocation", "kind": "module", "signature": "pub mod revocation;", "docs": "", "attributes": "", "line": 7 }, { "name": "scope", "kind": "module", "signature": "pub mod scope;", "docs": "", "attributes": "", "line": 8 }, { "name": "session_key", "kind": "module", "signature": "pub mod session_key;", "docs": "", "attributes": "", "line": 9 }, { "name": "store", "kind": "module", "signature": "pub mod store;", "docs": "", "attributes": "", "line": 10 }, { "name": "tree", "kind": "module", "signature": "pub mod tree;", "docs": "", "attributes": "", "line": 11 }, { "name": "pub use delegation_store::{DelegationStore, InMemoryDelegationStore};", "kind": "use_declaration", "signature": "pub use delegation_store::{DelegationStore, InMemoryDelegationStore};", "docs": "", "attributes": "", "line": 13 }, { "name": "pub use store::{InMemoryRevocationStore, RevocationStore};", "kind": "use_declaration", "signature": "pub use store::{InMemoryRevocationStore, RevocationStore};", "docs": "", "attributes": "", "line": 14 } ], "parseErrors": false }, { "module": "delegation_store", "source": "aegis/aegis-delegate/src/delegation_store.rs", "sha256": "54ccefdfa3f530fe12cd3e2c32102be1d7ff7f37b7c3c9b04ff5b04037ae25be", "attributes": "", "items": [ { "name": "delegation_store::DelegationStore", "kind": "trait_item", "signature": "pub trait DelegationStore: Send + Sync {\n /// Persist a delegation. Overwrites any existing delegation with the same ID.\n async fn store_delegation(&self, delegation: &Delegation) -> Result<(), DelegationError>;\n\n /// Retrieve a delegation by its unique identifier.\n ///\n /// Returns `None` if no delegation with the given ID exists.\n async fn get_delegation(&self, id: &str) -> Result, DelegationError>;\n\n /// List delegations granted by a specific delegator DID with pagination.\n async fn list_by_delegator(\n &self,\n delegator_did: &str,\n pagination: Pagination,\n ) -> Result, DelegationError>;\n\n /// List delegations received by a specific delegate DID with pagination.\n async fn list_by_delegate(\n &self,\n delegate_did: &str,\n pagination: Pagination,\n ) -> Result, DelegationError>;\n\n /// Delete a delegation by ID.\n ///\n /// Returns `true` if a delegation was found and removed, `false` if no\n /// delegation with the given ID existed.\n async fn delete_delegation(&self, id: &str) -> Result;\n}", "docs": "Pluggable storage backend for delegation records.\n\nImplementations may use in-memory storage, databases, or distributed\ncaches. All operations are async to accommodate network-backed stores.\n\nThis trait provides CRUD operations on individual delegations, separate\nfrom the tree-based structural operations in [`crate::tree::DelegationTree`].", "attributes": "#[async_trait]", "line": 27 }, { "name": "delegation_store::InMemoryDelegationStore", "kind": "struct_item", "signature": "pub struct InMemoryDelegationStore {\n\n}", "docs": "In-memory delegation store backed by a `RwLock`.\n\nSuitable for development, testing, and single-instance deployments.\nFor production multi-node deployments, use a database-backed\nimplementation of [`DelegationStore`].", "attributes": "", "line": 66 }, { "name": "delegation_store::InMemoryDelegationStore::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Creates a new empty in-memory delegation store.", "attributes": "", "line": 72 } ], "parseErrors": false }, { "module": "proof", "source": "aegis/aegis-delegate/src/proof.rs", "sha256": "2c5d8b0abe8f720355b2244a5b8da6b1ceaa9de670921a3d7cfedec71503dfd5", "attributes": "", "items": [ { "name": "proof::create_delegation_proof", "kind": "function_item", "signature": "pub fn create_delegation_proof(\n delegator_did: &str,\n delegate_did: &str,\n scope: DelegationScope,\n expires: Option>,\n signing_key: &SigningKey,\n verification_method: &str,\n) -> Result;", "docs": "Creates a delegation proof by signing the delegation with the delegator's key.\n\nSteps per spec \u00a79.7:\n1. Construct delegation object (excluding proof field)\n2. Canonicalize via JCS (RFC 8785)\n3. Sign canonical bytes with delegator's delegation key (Ed25519)\n\nReturns a fully formed [`Delegation`] with an attached cryptographic proof.", "attributes": "", "line": 43 }, { "name": "proof::verify_delegation_proof", "kind": "function_item", "signature": "pub fn verify_delegation_proof(\n delegation: &Delegation,\n delegator_public_key: &VerifyingKey,\n) -> Result;", "docs": "Verifies a delegation proof against the delegator's public key.\n\nReconstructs the canonical form of the delegation (without the proof),\nthen verifies the Ed25519 signature contained in the proof's JWS field.", "attributes": "", "line": 95 } ], "parseErrors": false }, { "module": "revocation", "source": "aegis/aegis-delegate/src/revocation.rs", "sha256": "7f38fdd0004282852e07d180595441146d8837ea3f2ae230fbec8a6924f37471", "attributes": "", "items": [ { "name": "revocation::RevocationRegistry", "kind": "struct_item", "signature": "pub struct RevocationRegistry {\n\n}", "docs": "Tracks revoked delegation IDs.\n\nAll operations are thread-safe via an internal [`RwLock`].\nThis is an in-memory registry; for persistence, a backing store\nshould be layered on top.", "attributes": "", "line": 16 }, { "name": "revocation::RevocationRegistry::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Creates a new empty revocation registry.", "attributes": "", "line": 22 }, { "name": "revocation::RevocationRegistry::revoke", "kind": "function_item", "signature": "pub fn revoke(&self, delegation_id: &str);", "docs": "Marks a single delegation as revoked.", "attributes": "", "line": 29 }, { "name": "revocation::RevocationRegistry::is_revoked", "kind": "function_item", "signature": "pub fn is_revoked(&self, delegation_id: &str) -> bool;", "docs": "Checks whether a delegation has been revoked.", "attributes": "", "line": 36 }, { "name": "revocation::RevocationRegistry::revoke_cascade", "kind": "function_item", "signature": "pub fn revoke_cascade(&self, ids: &[String]);", "docs": "Revokes multiple delegations at once (cascade revocation).\n\nThis is typically used after\n[`DelegationTree::revoke`](crate::tree::DelegationTree::revoke) returns\na list of all transitively affected delegation IDs.", "attributes": "", "line": 51 } ], "parseErrors": false }, { "module": "scope", "source": "aegis/aegis-delegate/src/scope.rs", "sha256": "4229dada749b1877d8702352262536497079b1ae88cc65baed226f73040228f0", "attributes": "", "items": [ { "name": "scope::is_scope_subset", "kind": "function_item", "signature": "pub fn is_scope_subset(child: &DelegationScope, parent: &DelegationScope) -> bool;", "docs": "Checks if `child` scope is a subset of `parent` scope (no-amplification rule \u00a79.6).\n\nA child scope is a subset when:\n- Every action in child is present in parent (or parent has no actions, meaning wildcard)\n- Every resource in child is present in parent (or parent has no restrictions)\n- Every chain in child is present in parent (or parent has no restrictions)\n- Child limits are at least as restrictive as parent limits", "attributes": "", "line": 17 }, { "name": "scope::intersect_scopes", "kind": "function_item", "signature": "pub fn intersect_scopes(a: &DelegationScope, b: &DelegationScope) -> DelegationScope;", "docs": "Computes the intersection of two scopes (intersection narrowing rule \u00a79.6).\n\nFor each dimension:\n- If either side is empty (wildcard), use the other side's restriction\n- Otherwise, take the set intersection\n- For limits, take the most restrictive value", "attributes": "", "line": 131 }, { "name": "scope::validate_scope", "kind": "function_item", "signature": "pub fn validate_scope(scope: &DelegationScope) -> Result<(), DelegationError>;", "docs": "Validates that a delegation scope is well-formed.\n\nA scope is well-formed if:\n- Actions, resources, and chains contain no empty strings\n- If limits are present, numeric fields parse as valid numbers", "attributes": "", "line": 257 } ], "parseErrors": false }, { "module": "session_key", "source": "aegis/aegis-delegate/src/session_key.rs", "sha256": "76d7efb78b87181ecc07a35c09843cc3cea1e89c94cc505e4c1ad73237f60753", "attributes": "", "items": [ { "name": "session_key::create_session_key", "kind": "function_item", "signature": "pub fn create_session_key(\n principal_did: &str,\n scope: DelegationScope,\n max_transactions: Option,\n lifetime: Duration,\n principal_signing_key: &SigningKey,\n verification_method: &str,\n) -> Result<(SessionKey, SigningKey), DelegationError>;", "docs": "Creates a session key (temporary, scoped, max 24h).\n\nGenerates a fresh Ed25519 keypair for the session. The public key is\nencoded as multibase (base64url) and stored in the [`SessionKey`] struct.\nThe session key grant is signed by the principal's identity key.\n\n# Errors\n\nReturns [`DelegationError`] if:\n- The requested lifetime exceeds 24 hours\n- JCS canonicalization fails\n\n# Returns\n\nA tuple of `(SessionKey, SigningKey)` where the `SigningKey` is the\nephemeral private key for the session.", "attributes": "", "line": 54 } ], "parseErrors": false }, { "module": "store", "source": "aegis/aegis-delegate/src/store.rs", "sha256": "b554fa623706e5d6e65dd8a3bc058a232c020a72187b6058305becf4ebb7f80d", "attributes": "", "items": [ { "name": "store::RevocationStore", "kind": "trait_item", "signature": "pub trait RevocationStore: Send + Sync {\n /// Mark a delegation as revoked.\n ///\n /// Revoking an already-revoked delegation is idempotent and does not\n /// return an error.\n async fn revoke(&self, delegation_id: &str) -> Result<(), DelegationError>;\n\n /// Check whether a delegation has been revoked.\n async fn is_revoked(&self, delegation_id: &str) -> Result;\n\n /// Revoke multiple delegations at once (batch/cascade revocation).\n ///\n /// This is typically used after cascade revocation computes the full\n /// set of transitively affected delegation IDs.\n async fn revoke_batch(&self, ids: &[String]) -> Result<(), DelegationError>;\n}", "docs": "Pluggable storage backend for tracking revoked delegation IDs.\n\nImplementations may use in-memory storage, databases, or distributed\ncaches. All operations are async to accommodate network-backed stores.\n\nThis trait complements [`crate::revocation::RevocationRegistry`] by\nproviding an async, error-aware interface suitable for production\npersistence backends.", "attributes": "#[async_trait]", "line": 28 }, { "name": "store::InMemoryRevocationStore", "kind": "struct_item", "signature": "pub struct InMemoryRevocationStore {\n\n}", "docs": "In-memory revocation store backed by a `RwLock`.\n\nSuitable for development, testing, and single-instance deployments.\nFor production multi-node deployments, use a database-backed\nimplementation of [`RevocationStore`].", "attributes": "", "line": 54 }, { "name": "store::InMemoryRevocationStore::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Creates a new empty in-memory revocation store.", "attributes": "", "line": 60 } ], "parseErrors": false }, { "module": "tree", "source": "aegis/aegis-delegate/src/tree.rs", "sha256": "1c3cc47d0b40fb63bfbc6ecc4dc089718fe7432bdf751511ad976de283c916a4", "attributes": "", "items": [ { "name": "tree::DelegationTree", "kind": "struct_item", "signature": "pub struct DelegationTree {\n\n}", "docs": "A delegation tree rooted at a human root.\n\nStores delegations indexed by delegate DID and by delegation ID.\nMax depth is configurable (default 8).", "attributes": "", "line": 17 }, { "name": "tree::DelegationTree::new", "kind": "function_item", "signature": "pub fn new(max_depth: u32) -> Self;", "docs": "Creates a new empty delegation tree with the given maximum depth.", "attributes": "", "line": 28 }, { "name": "tree::DelegationTree::add_delegation", "kind": "function_item", "signature": "pub fn add_delegation(&mut self, delegation: Delegation) -> Result<(), DelegationError>;", "docs": "Adds a delegation to the tree.\n\nValidates:\n- The delegation depth does not exceed max_depth\n- The delegation scope is a subset of the delegator's effective scope\n (no-amplification rule, \u00a79.6)", "attributes": "", "line": 42 }, { "name": "tree::DelegationTree::get_delegation_chain", "kind": "function_item", "signature": "pub fn get_delegation_chain(&self, delegate_did: &str) -> Vec<&Delegation>;", "docs": "Gets the delegation chain from a delegate up to the root.\n\nReturns delegations in order from the immediate delegation (closest to\nthe delegate) up to the root delegation.", "attributes": "", "line": 85 }, { "name": "tree::DelegationTree::effective_scope", "kind": "function_item", "signature": "pub fn effective_scope(&self, delegate_did: &str) -> Option;", "docs": "Computes the effective scope for a delegate.\n\nThis is the intersection of all scopes in the delegation chain,\nimplementing the intersection narrowing rule (\u00a79.6 rule 2).", "attributes": "", "line": 115 }, { "name": "tree::DelegationTree::depth", "kind": "function_item", "signature": "pub fn depth(&self, delegate_did: &str) -> u32;", "docs": "Returns the depth of a delegate in the tree.\n\nA root entity (not a delegate of anyone) has depth 0.\nA direct delegate of a root has depth 1, and so on.", "attributes": "", "line": 133 }, { "name": "tree::DelegationTree::revoke", "kind": "function_item", "signature": "pub fn revoke(&mut self, delegation_id: &str) -> Result, DelegationError>;", "docs": "Revokes a delegation and all sub-delegations (cascade revocation).\n\nReturns the list of all revoked delegation IDs, including the original\nand all transitively dependent delegations.", "attributes": "", "line": 141 } ], "parseErrors": false } ] }, { "name": "aegis-keys", "url": "/reference/rust/aegis-keys", "modules": [ { "module": "crate", "source": "aegis/aegis-keys/src/lib.rs", "sha256": "c19c72128fbfcee36aad4232c4ce0414a1896bb0ab18984d3cd405ab4d1ce947", "attributes": "", "items": [ { "name": "derivation", "kind": "module", "signature": "pub mod derivation;", "docs": "", "attributes": "", "line": 13 }, { "name": "generation", "kind": "module", "signature": "pub mod generation;", "docs": "", "attributes": "", "line": 14 }, { "name": "recovery", "kind": "module", "signature": "pub mod recovery;", "docs": "", "attributes": "", "line": 15 }, { "name": "rotation", "kind": "module", "signature": "pub mod rotation;", "docs": "", "attributes": "", "line": 16 }, { "name": "storage", "kind": "module", "signature": "pub mod storage;", "docs": "", "attributes": "", "line": 17 }, { "name": "threshold", "kind": "module", "signature": "pub mod threshold;", "docs": "", "attributes": "", "line": 18 }, { "name": "pub use derivation::{derivation_path, derive_lineage_key};", "kind": "use_declaration", "signature": "pub use derivation::{derivation_path, derive_lineage_key};", "docs": "", "attributes": "", "line": 21 }, { "name": "pub use generation::{EncryptedKey, KeyGenerator, ManagedKey};", "kind": "use_declaration", "signature": "pub use generation::{EncryptedKey, KeyGenerator, ManagedKey};", "docs": "", "attributes": "", "line": 22 }, { "name": "pub use recovery::{GuardianAuthorization, RecoveryCeremony};", "kind": "use_declaration", "signature": "pub use recovery::{GuardianAuthorization, RecoveryCeremony};", "docs": "", "attributes": "", "line": 23 }, { "name": "pub use rotation::{KeyRotation, RotationRequest, RotationResult};", "kind": "use_declaration", "signature": "pub use rotation::{KeyRotation, RotationRequest, RotationResult};", "docs": "", "attributes": "", "line": 24 }, { "name": "pub use storage::{InMemoryKeyStore, KeyStore};", "kind": "use_declaration", "signature": "pub use storage::{InMemoryKeyStore, KeyStore};", "docs": "", "attributes": "", "line": 25 }, { "name": "pub use threshold::{generate_shares, sign_with_threshold, verify_threshold_signature};", "kind": "use_declaration", "signature": "pub use threshold::{generate_shares, sign_with_threshold, verify_threshold_signature};", "docs": "", "attributes": "", "line": 26 } ], "parseErrors": false }, { "module": "derivation", "source": "aegis/aegis-keys/src/derivation.rs", "sha256": "bf2ba0570408be6fdb11d6e4d93fdfc51255b5970f1a9c2911e6203cbe2bd2de", "attributes": "", "items": [ { "name": "derivation::derive_lineage_key", "kind": "function_item", "signature": "pub fn derive_lineage_key(\n parent_private: &[u8; 32],\n child_did: &str,\n generation: u32,\n) -> Result<[u8; 32], KeyError>;", "docs": "Derive a lineage key from a parent private key using HKDF-SHA256.\n\nThis implements the OAS lineage key derivation scheme where child keys\nare deterministically derived from parent keys, enabling cryptographic\nproof of the lineage chain.\n\n# Algorithm\n\n```text\nHKDF-SHA256(\n IKM = parent_private_key (32 bytes),\n Salt = child_did_utf8,\n Info = \"oas-lineage-v1\" || generation_be32,\n L = 32\n)\n```\n\n# Arguments\n\n* `parent_private` - The parent entity's 32-byte Ed25519 private key material.\n* `child_did` - The child entity's DID string, used as salt.\n* `generation` - The lineage generation number (distance from human root).\n\n# Returns\n\n32 bytes of derived key material suitable for constructing a child Ed25519 signing key.\n\n# Errors\n\nReturns `KeyError::DerivationFailed` if HKDF expansion fails.", "attributes": "", "line": 43 }, { "name": "derivation::derivation_path", "kind": "function_item", "signature": "pub fn derivation_path(chain: Chain, account: u32, index: u32) -> String;", "docs": "Build a BIP-44 derivation path for a given blockchain chain.\n\nReturns the standard `m/44'/coin_type'/account'/0/index` path\nused for HD key derivation across different blockchains.\n\n# Arguments\n\n* `chain` - The target blockchain (determines the coin type).\n* `account` - The account index.\n* `index` - The address index within the account.\n\n# Returns\n\nA BIP-44 derivation path string like `m/44'/60'/0'/0/0` for Ethereum.", "attributes": "", "line": 82 } ], "parseErrors": false }, { "module": "generation", "source": "aegis/aegis-keys/src/generation.rs", "sha256": "269bc2cd45a672afd924e928f31b343efb09b3ea812d06d0ffce261ae1bc4a35", "attributes": "", "items": [ { "name": "generation::ManagedKey", "kind": "struct_item", "signature": "pub struct ManagedKey {\n/// Unique key identifier (UUID v7-based).\n\npub key_id: String,\n/// Role of this key within the AEGIS identity framework.\n\npub role: KeyRole,\n/// How this key was generated.\n\npub generation_mode: KeyGenerationMode,\n/// The Ed25519 verifying (public) key.\n\npub public_key: VerifyingKey,\n/// Timestamp when this key was created.\n\npub created_at: DateTime\n}", "docs": "A managed key with metadata (AEGIS Spec SS6.2).\n\nThe private key is stored in encrypted form and never exposed directly.\nAll access to the signing key requires the encryption key.", "attributes": "#[derive(Debug)]", "line": 26 }, { "name": "generation::ManagedKey::from_stored_parts", "kind": "function_item", "signature": "pub fn from_stored_parts(\n key_id: String,\n role: KeyRole,\n generation_mode: KeyGenerationMode,\n public_key: VerifyingKey,\n ciphertext: Vec,\n nonce: Vec,\n created_at: DateTime,\n ) -> Result;", "docs": "Reconstruct a `ManagedKey` from its serialized components.\n\nThis constructor is intended for storage backends that need to\nreconstitute a `ManagedKey` from persisted columns.\n\n# Errors\n\nReturns `KeyError::StorageError` if the nonce length is invalid or\nthe public key bytes are malformed.", "attributes": "", "line": 51 }, { "name": "generation::ManagedKey::public_key_multibase", "kind": "function_item", "signature": "pub fn public_key_multibase(&self) -> String;", "docs": "Returns the public key encoded as multibase base58btc (with `z` prefix).\n\nThis is the canonical format for `publicKeyMultibase` in OAS Identity Documents.", "attributes": "", "line": 74 }, { "name": "generation::ManagedKey::decrypt_private", "kind": "function_item", "signature": "pub fn decrypt_private(&self, encryption_key: &[u8; 32]) -> Result;", "docs": "Decrypt the private key using the provided encryption key.\n\nThe caller is responsible for zeroizing the returned `SigningKey` when done.", "attributes": "", "line": 81 }, { "name": "generation::ManagedKey::encrypted_ciphertext", "kind": "function_item", "signature": "pub fn encrypted_ciphertext(&self) -> &[u8];", "docs": "Returns the encrypted private key ciphertext bytes (for serialization/storage).", "attributes": "", "line": 86 }, { "name": "generation::ManagedKey::encrypted_nonce", "kind": "function_item", "signature": "pub fn encrypted_nonce(&self) -> &[u8];", "docs": "Returns the encrypted private key nonce bytes (for serialization/storage).", "attributes": "", "line": 91 }, { "name": "generation::EncryptedKey", "kind": "struct_item", "signature": "pub struct EncryptedKey {\n\n}", "docs": "An encrypted private key blob (AEGIS Spec SS6.8).\n\nUses AES-256-GCM with a random 96-bit nonce. The ciphertext contains\nthe 32-byte Ed25519 signing key material plus a 16-byte authentication tag.", "attributes": "#[derive(Debug)]", "line": 101 }, { "name": "generation::EncryptedKey::encrypt", "kind": "function_item", "signature": "pub fn encrypt(signing_key: &SigningKey, encryption_key: &[u8; 32]) -> Result;", "docs": "Encrypt an Ed25519 signing key with AES-256-GCM.\n\n# Arguments\n\n* `signing_key` - The signing key to encrypt.\n* `encryption_key` - A 32-byte AES-256 key.\n\n# Errors\n\nReturns `KeyError::GenerationFailed` if AES-256-GCM encryption fails.", "attributes": "", "line": 117 }, { "name": "generation::EncryptedKey::decrypt", "kind": "function_item", "signature": "pub fn decrypt(&self, encryption_key: &[u8; 32]) -> Result;", "docs": "Decrypt the private key using the provided AES-256 encryption key.\n\n# Arguments\n\n* `encryption_key` - The 32-byte AES-256 key used during encryption.\n\n# Errors\n\nReturns `KeyError::GenerationFailed` if decryption fails (wrong key or tampered data).", "attributes": "", "line": 151 }, { "name": "generation::EncryptedKey::ciphertext", "kind": "function_item", "signature": "pub fn ciphertext(&self) -> &[u8];", "docs": "Returns the ciphertext bytes (for serialization/storage).", "attributes": "", "line": 192 }, { "name": "generation::EncryptedKey::nonce", "kind": "function_item", "signature": "pub fn nonce(&self) -> &[u8];", "docs": "Returns the nonce bytes (for serialization/storage).", "attributes": "", "line": 197 }, { "name": "generation::EncryptedKey::from_parts", "kind": "function_item", "signature": "pub fn from_parts(ciphertext: Vec, nonce: Vec) -> Result;", "docs": "Reconstruct an `EncryptedKey` from stored ciphertext and nonce.\n\n# Errors\n\nReturns `KeyError::StorageError` if the nonce length is invalid.", "attributes": "", "line": 206 }, { "name": "generation::KeyGenerator", "kind": "struct_item", "signature": "pub struct KeyGenerator;", "docs": "Key generator supporting multiple generation modes (AEGIS Spec SS6.2).\n\nCurrently implements the `Direct` generation mode using OS CSPRNG.\nMPC, TEE, and HSM modes will be added as their respective backends\nbecome available.", "attributes": "", "line": 239 }, { "name": "generation::KeyGenerator::generate_direct", "kind": "function_item", "signature": "pub fn generate_direct(\n role: KeyRole,\n encryption_key: &[u8; 32],\n ) -> Result;", "docs": "Generate a new Ed25519 keypair using CSPRNG (direct generation mode).\n\nThe generated signing key is immediately encrypted with the provided\nencryption key and stored inside the returned `ManagedKey`. The raw\nsigning key material never leaves memory unencrypted beyond the\nscope of this function.\n\n# Arguments\n\n* `role` - The role this key will serve (identity, authentication, etc.).\n* `encryption_key` - A 32-byte AES-256 key used to encrypt the private key at rest.\n\n# Errors\n\nReturns `KeyError::GenerationFailed` if key encryption fails.", "attributes": "", "line": 257 }, { "name": "generation::KeyGenerator::generate_key_id", "kind": "function_item", "signature": "pub fn generate_key_id() -> String;", "docs": "Generate a UUID v7-based key identifier.\n\nUUID v7 is time-ordered, which allows keys to be naturally sorted\nby creation time. The format is `key-`.", "attributes": "", "line": 283 } ], "parseErrors": false }, { "module": "recovery", "source": "aegis/aegis-keys/src/recovery.rs", "sha256": "036f0e6d4f999ac13319be0ac49b2584670a98441175ad504dda798b518bb14d", "attributes": "", "items": [ { "name": "recovery::RecoveryCeremony", "kind": "struct_item", "signature": "pub struct RecoveryCeremony {\n/// Unique identifier for this recovery ceremony.\n\npub ceremony_id: String,\n/// Recovery configuration (guardians, threshold, timelock).\n\npub config: RecoveryConfig,\n/// Accumulated guardian authorizations.\n\npub authorizations: Vec,\n/// When the ceremony was initiated.\n\npub initiated_at: DateTime,\n/// Timestamp before which recovery cannot execute (timelock expiry).\n\npub timelock_until: DateTime\n}", "docs": "A recovery ceremony state machine (AEGIS Spec SS6.7).\n\nRecovery is a multi-phase process:\n1. Ceremony is initiated with a `RecoveryConfig` specifying guardians and threshold.\n2. Guardians provide signed authorizations, each adding their weight.\n3. Once total weight reaches the threshold, the ceremony is \"threshold met.\"\n4. A mandatory timelock period must also elapse before execution is permitted.\n5. Only when BOTH conditions are met (`can_execute()`) may recovery proceed.\n\nThe timelock prevents immediate recovery, giving the legitimate key holder\ntime to detect and abort unauthorized recovery attempts.", "attributes": "#[derive(Debug)]", "line": 25 }, { "name": "recovery::GuardianAuthorization", "kind": "struct_item", "signature": "pub struct GuardianAuthorization {\n/// The guardian providing authorization.\n\npub guardian: Guardian,\n/// When the authorization was provided.\n\npub authorized_at: DateTime,\n/// Cryptographic signature proving the guardian's consent.\n\npub signature: String\n}", "docs": "A signed authorization from a recovery guardian.", "attributes": "#[derive(Debug, Clone)]", "line": 40 }, { "name": "recovery::RecoveryCeremony::new", "kind": "function_item", "signature": "pub fn new(config: RecoveryConfig) -> Self;", "docs": "Create a new recovery ceremony.\n\nInitializes the ceremony with a unique ID, records the initiation time,\nand computes the timelock expiry based on the config's timelock duration.\n\n# Arguments\n\n* `config` - The recovery configuration specifying guardians, threshold, and timelock.\n\n# Returns\n\nA new `RecoveryCeremony` with no authorizations accumulated.", "attributes": "", "line": 62 }, { "name": "recovery::RecoveryCeremony::add_authorization", "kind": "function_item", "signature": "pub fn add_authorization(&mut self, auth: GuardianAuthorization) -> Result<(), KeyError>;", "docs": "Add a guardian's authorization to the ceremony.\n\nThe guardian must be listed in the recovery config. Duplicate\nauthorizations from the same guardian are rejected.\n\n# Arguments\n\n* `auth` - The guardian's signed authorization.\n\n# Errors\n\nReturns `KeyError::RecoveryFailed` if:\n- The guardian is not in the recovery config\n- The guardian has already authorized", "attributes": "", "line": 90 }, { "name": "recovery::RecoveryCeremony::is_threshold_met", "kind": "function_item", "signature": "pub fn is_threshold_met(&self) -> bool;", "docs": "Check whether the accumulated guardian weight meets the threshold.\n\nEach guardian has a weight; this returns `true` when the sum of\nweights from authorized guardians reaches or exceeds the configured threshold.", "attributes": "", "line": 130 }, { "name": "recovery::RecoveryCeremony::is_timelock_expired", "kind": "function_item", "signature": "pub fn is_timelock_expired(&self) -> bool;", "docs": "Check whether the mandatory timelock period has expired.\n\nThe timelock prevents immediate recovery execution, giving the\nlegitimate owner time to detect and abort unauthorized attempts.", "attributes": "", "line": 140 }, { "name": "recovery::RecoveryCeremony::can_execute", "kind": "function_item", "signature": "pub fn can_execute(&self) -> bool;", "docs": "Check whether recovery can proceed.\n\nRecovery requires BOTH conditions to be met:\n1. The accumulated guardian weight reaches the threshold.\n2. The timelock period has elapsed.", "attributes": "", "line": 149 }, { "name": "recovery::RecoveryCeremony::accumulated_weight", "kind": "function_item", "signature": "pub fn accumulated_weight(&self) -> u32;", "docs": "Returns the total accumulated authorization weight.", "attributes": "", "line": 154 }, { "name": "recovery::RecoveryCeremony::authorization_count", "kind": "function_item", "signature": "pub fn authorization_count(&self) -> usize;", "docs": "Returns the number of guardians who have authorized.", "attributes": "", "line": 159 } ], "parseErrors": false }, { "module": "rotation", "source": "aegis/aegis-keys/src/rotation.rs", "sha256": "dd629129b75d43cfb74e0fa4b837843ceda291b2df3487d6efb5c12c44a320c6", "attributes": "", "items": [ { "name": "rotation::KeyRotation", "kind": "struct_item", "signature": "pub struct KeyRotation;", "docs": "Key rotation coordinator (AEGIS Spec SS6.6).\n\nManages the lifecycle of key rotation events. When a rotation is initiated,\na new key is generated and both keys remain valid for the duration of the\ngrace period.", "attributes": "", "line": 20 }, { "name": "rotation::RotationRequest", "kind": "struct_item", "signature": "pub struct RotationRequest {\n/// The key ID being rotated.\n\npub key_id: String,\n/// Grace period during which both old and new keys are valid.\n\npub grace_period: Duration\n}", "docs": "A request to rotate a key.", "attributes": "", "line": 23 }, { "name": "rotation::RotationResult", "kind": "struct_item", "signature": "pub struct RotationResult {\n/// The ID of the key being replaced.\n\npub old_key_id: String,\n/// The newly generated replacement key.\n\npub new_key: ManagedKey,\n/// Timestamp when the grace period ends and the old key is fully retired.\n\npub grace_period_ends: DateTime\n}", "docs": "The result of a successful key rotation.", "attributes": "", "line": 31 }, { "name": "rotation::KeyRotation::initiate", "kind": "function_item", "signature": "pub fn initiate(\n old: &ManagedKey,\n encryption_key: &[u8; 32],\n ) -> Result;", "docs": "Initiate key rotation for an existing managed key.\n\nGenerates a new key with the same role as the old key. Both the old\nand new keys are considered valid until the grace period expires.\nAfter the grace period, the old key should be decommissioned.\n\n# Arguments\n\n* `old` - The existing managed key to rotate away from.\n* `encryption_key` - A 32-byte AES-256 key for encrypting the new key's private material.\n\n# Returns\n\nA `RotationResult` containing the new key and grace period metadata.\n\n# Errors\n\nReturns `KeyError::RotationFailed` if the new key could not be generated.", "attributes": "", "line": 59 }, { "name": "rotation::KeyRotation::initiate_with_grace", "kind": "function_item", "signature": "pub fn initiate_with_grace(\n old: &ManagedKey,\n encryption_key: &[u8; 32],\n grace_period: Duration,\n ) -> Result;", "docs": "Initiate key rotation with a custom grace period.\n\n# Arguments\n\n* `old` - The existing managed key to rotate away from.\n* `encryption_key` - A 32-byte AES-256 key for encrypting the new key's private material.\n* `grace_period` - Duration during which both old and new keys are valid.\n\n# Errors\n\nReturns `KeyError::RotationFailed` if the new key could not be generated.", "attributes": "", "line": 77 }, { "name": "rotation::KeyRotation::is_grace_period_expired", "kind": "function_item", "signature": "pub fn is_grace_period_expired(result: &RotationResult) -> bool;", "docs": "Check whether a grace period has expired.\n\nReturns `true` if the current time is past the grace period end,\nmeaning the old key should be decommissioned.", "attributes": "", "line": 101 }, { "name": "rotation::is_rotation_eligible", "kind": "function_item", "signature": "pub fn is_rotation_eligible(role: KeyRole) -> bool;", "docs": "Convenience function to check if a key role is eligible for rotation.\n\nSession keys are not rotated -- they are short-lived and simply expire.\nRecovery keys require a special ceremony rather than standard rotation.", "attributes": "", "line": 110 } ], "parseErrors": false }, { "module": "storage", "source": "aegis/aegis-keys/src/storage.rs", "sha256": "4a9430472f0b46e26843f729358c3202623f174053dcc5b212667a966422f103", "attributes": "", "items": [ { "name": "storage::KeyStore", "kind": "trait_item", "signature": "pub trait KeyStore: Send + Sync {\n /// Store a managed key.\n ///\n /// If a key with the same `key_id` already exists, it is overwritten.\n ///\n /// # Errors\n ///\n /// Returns `KeyError::StorageError` if the storage operation fails.\n async fn store(&self, key: &ManagedKey) -> Result<(), KeyError>;\n\n /// Load a managed key by its ID.\n ///\n /// # Errors\n ///\n /// Returns `KeyError::NotFound` if no key with the given ID exists.\n /// Returns `KeyError::StorageError` if the load operation fails.\n async fn load(&self, key_id: &str) -> Result;\n\n /// Delete a managed key by its ID.\n ///\n /// # Errors\n ///\n /// Returns `KeyError::NotFound` if no key with the given ID exists.\n /// Returns `KeyError::StorageError` if the delete operation fails.\n async fn delete(&self, key_id: &str) -> Result<(), KeyError>;\n\n /// List key IDs, optionally filtered by role.\n ///\n /// # Arguments\n ///\n /// * `role` - If `Some`, only keys with this role are returned.\n /// If `None`, all key IDs are returned.\n ///\n /// # Errors\n ///\n /// Returns `KeyError::StorageError` if the list operation fails.\n async fn list(\n &self,\n role: Option,\n pagination: Pagination,\n ) -> Result, KeyError>;\n}", "docs": "Trait for key storage backends (AEGIS Spec SS6.8).\n\nAll key storage backends must be thread-safe (`Send + Sync`) and support\nasync operations. Implementations may store keys in memory, on disk,\nin a database, or in a hardware security module.\n\nThe stored `ManagedKey` already contains the encrypted private key material,\nso the storage backend does not need to perform additional encryption.", "attributes": "#[async_trait]", "line": 26 }, { "name": "storage::InMemoryKeyStore", "kind": "struct_item", "signature": "pub struct InMemoryKeyStore {\n\n}", "docs": "In-memory key store for testing and development.\n\nKeys are stored in a `HashMap` protected by a `std::sync::RwLock`.\nThis implementation is NOT suitable for production use as keys\nare lost when the process exits.", "attributes": "", "line": 125 }, { "name": "storage::InMemoryKeyStore::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Create a new empty in-memory key store.", "attributes": "", "line": 131 }, { "name": "storage::InMemoryKeyStore::len", "kind": "function_item", "signature": "pub fn len(&self) -> usize;", "docs": "Returns the number of keys currently stored.", "attributes": "", "line": 138 }, { "name": "storage::InMemoryKeyStore::is_empty", "kind": "function_item", "signature": "pub fn is_empty(&self) -> bool;", "docs": "Returns `true` if the store contains no keys.", "attributes": "", "line": 144 } ], "parseErrors": false }, { "module": "threshold", "source": "aegis/aegis-keys/src/threshold.rs", "sha256": "eb57d17d0e98d3cd7804edb24fa1ddeb9ac82eeaaa46f2495595d4f5fe48b8a0", "attributes": "", "items": [ { "name": "threshold::ThresholdKeyPackages", "kind": "struct_item", "signature": "pub struct ThresholdKeyPackages {\n/// Per-participant key packages (one per signer).\n\npub key_packages: BTreeMap,\n/// The group public key (verifying key for the threshold group).\n\npub public_key_package: frost::keys::PublicKeyPackage\n}", "docs": "Result of threshold key generation.", "attributes": "", "line": 15 }, { "name": "threshold::generate_shares", "kind": "function_item", "signature": "pub fn generate_shares(\n min_signers: u16,\n max_signers: u16,\n) -> Result;", "docs": "Generate threshold key shares using FROST trusted dealer.\n\nCreates a t-of-n threshold key setup where `min_signers` (t) out of\n`max_signers` (n) participants are required to produce a valid signature.\n\n# Arguments\n* `min_signers` - Minimum number of signers required (threshold t)\n* `max_signers` - Total number of participants (n)\n\n# Errors\nReturns `KeyError::GenerationFailed` if FROST key generation fails.", "attributes": "", "line": 33 }, { "name": "threshold::sign_with_threshold", "kind": "function_item", "signature": "pub fn sign_with_threshold(\n message: &[u8],\n key_packages: &BTreeMap,\n public_key_package: &frost::keys::PublicKeyPackage,\n) -> Result;", "docs": "Perform a complete threshold signing round (for testing/single-process use).\n\nIn production, each step would happen on a separate machine. This function\nruns the full 2-round FROST protocol in a single process for validation.\n\n# Arguments\n* `message` - The message bytes to sign\n* `key_packages` - Per-participant key packages (at least t of them)\n* `public_key_package` - The group public key package\n\n# Errors\nReturns `KeyError::SigningFailed` if any round fails.", "attributes": "", "line": 77 }, { "name": "threshold::verify_threshold_signature", "kind": "function_item", "signature": "pub fn verify_threshold_signature(\n message: &[u8],\n signature: &frost::Signature,\n public_key_package: &frost::keys::PublicKeyPackage,\n) -> bool;", "docs": "Verify a FROST threshold signature against the group public key.\n\n# Arguments\n* `message` - The original message bytes\n* `signature` - The aggregated FROST signature\n* `public_key_package` - The group public key package\n\n# Returns\n`true` if the signature is valid, `false` otherwise.", "attributes": "", "line": 130 } ], "parseErrors": false } ] }, { "name": "aegis-store-pg", "url": "/reference/rust/aegis-store-pg", "modules": [ { "module": "crate", "source": "aegis/aegis-store-pg/src/lib.rs", "sha256": "77c32f388a08e399d52ad6f089fb8463130401d3a0d9f64121bb06621360d40d", "attributes": "", "items": [ { "name": "cache", "kind": "module", "signature": "pub mod cache;", "docs": "", "attributes": "", "line": 13 }, { "name": "delegations", "kind": "module", "signature": "pub mod delegations;", "docs": "", "attributes": "", "line": 14 }, { "name": "keys", "kind": "module", "signature": "pub mod keys;", "docs": "", "attributes": "", "line": 15 }, { "name": "nonces", "kind": "module", "signature": "pub mod nonces;", "docs": "", "attributes": "", "line": 16 }, { "name": "revocations", "kind": "module", "signature": "pub mod revocations;", "docs": "", "attributes": "", "line": 17 }, { "name": "sessions", "kind": "module", "signature": "pub mod sessions;", "docs": "", "attributes": "", "line": 18 }, { "name": "pub use cache::PgVerificationCacheStore;", "kind": "use_declaration", "signature": "pub use cache::PgVerificationCacheStore;", "docs": "", "attributes": "", "line": 20 }, { "name": "pub use delegations::PgDelegationStore;", "kind": "use_declaration", "signature": "pub use delegations::PgDelegationStore;", "docs": "", "attributes": "", "line": 21 }, { "name": "pub use keys::PgKeyStore;", "kind": "use_declaration", "signature": "pub use keys::PgKeyStore;", "docs": "", "attributes": "", "line": 22 }, { "name": "pub use nonces::PgNonceStore;", "kind": "use_declaration", "signature": "pub use nonces::PgNonceStore;", "docs": "", "attributes": "", "line": 23 }, { "name": "pub use revocations::PgRevocationStore;", "kind": "use_declaration", "signature": "pub use revocations::PgRevocationStore;", "docs": "", "attributes": "", "line": 24 }, { "name": "pub use sessions::PgSessionStore;", "kind": "use_declaration", "signature": "pub use sessions::PgSessionStore;", "docs": "", "attributes": "", "line": 25 }, { "name": "::run_migrations", "kind": "function_item", "signature": "pub async fn run_migrations(pool: &sqlx::PgPool) -> Result<(), sqlx::Error>;", "docs": "Run the AEGIS migration SQL against the provided PostgreSQL connection pool.\n\nCreates all required tables and indexes if they do not already exist.\n\n# Errors\n\nReturns `sqlx::Error` if the migration SQL fails to execute.", "attributes": "", "line": 34 } ], "parseErrors": false }, { "module": "cache", "source": "aegis/aegis-store-pg/src/cache.rs", "sha256": "547eebeb30ac81b9b3b3e59b462b3ec398e94155ae70f2d389e94fe6340f27da", "attributes": "", "items": [ { "name": "cache::PgVerificationCacheStore", "kind": "struct_item", "signature": "pub struct PgVerificationCacheStore {\n\n}", "docs": "PostgreSQL-backed verification cache store.\n\nCaches `VerificationResult` records in the `aegis_verification_cache` table.\nThe result is serialized as a JSONB column. Expiration is tracked via the\n`expires_at` column; expired entries are not returned by `get_cached`.", "attributes": "", "line": 17 }, { "name": "cache::PgVerificationCacheStore::new", "kind": "function_item", "signature": "pub fn new(pool: PgPool, ttl_secs: i64) -> Self;", "docs": "Create a new PostgreSQL verification cache store with the given\nconnection pool and TTL (in seconds).\n\nThe TTL is capped at 300 seconds per the AEGIS specification.", "attributes": "", "line": 31 } ], "parseErrors": false }, { "module": "delegations", "source": "aegis/aegis-store-pg/src/delegations.rs", "sha256": "680f56788d96f0965c598ef298a9899b1e3cee93a739af9b386bd568dff7834e", "attributes": "", "items": [ { "name": "delegations::PgDelegationStore", "kind": "struct_item", "signature": "pub struct PgDelegationStore {\n\n}", "docs": "PostgreSQL-backed delegation store.\n\nStores `Delegation` records in the `aegis_delegations` table. The `scope`\nand `proof` fields are serialized as JSONB columns.", "attributes": "", "line": 18 }, { "name": "delegations::PgDelegationStore::new", "kind": "function_item", "signature": "pub fn new(pool: PgPool) -> Self;", "docs": "Create a new PostgreSQL delegation store with the given connection pool.", "attributes": "", "line": 24 } ], "parseErrors": false }, { "module": "keys", "source": "aegis/aegis-store-pg/src/keys.rs", "sha256": "a2bae48bb084336fe461aa32c18eb5b6ab03ff2d9c0b2456c66c9c6dd71e73be", "attributes": "", "items": [ { "name": "keys::PgKeyStore", "kind": "struct_item", "signature": "pub struct PgKeyStore {\n\n}", "docs": "PostgreSQL-backed key store.\n\nStores `ManagedKey` records in the `aegis_keys` table. The encrypted\nprivate key material (ciphertext + nonce) is stored as `BYTEA` columns.", "attributes": "", "line": 17 }, { "name": "keys::PgKeyStore::new", "kind": "function_item", "signature": "pub fn new(pool: PgPool) -> Self;", "docs": "Create a new PostgreSQL key store with the given connection pool.", "attributes": "", "line": 23 } ], "parseErrors": false }, { "module": "nonces", "source": "aegis/aegis-store-pg/src/nonces.rs", "sha256": "a099b856aa257643b6db7d2b951e16b6365fda223b694d29aa0d21d3727710f7", "attributes": "", "items": [ { "name": "nonces::PgNonceStore", "kind": "struct_item", "signature": "pub struct PgNonceStore {\n\n}", "docs": "PostgreSQL-backed nonce store.\n\nRecords nonces in the `aegis_nonces` table. The primary key constraint\non `nonce` ensures that duplicate insertions are detected, which is\nused to identify replay attempts.", "attributes": "", "line": 17 }, { "name": "nonces::PgNonceStore::new", "kind": "function_item", "signature": "pub fn new(pool: PgPool, ttl_secs: i64) -> Self;", "docs": "Create a new PostgreSQL nonce store with the given connection pool\nand TTL for cleanup.\n\nThe `ttl_secs` parameter controls how old a nonce must be before\n`cleanup()` will remove it. A value of 0 means cleanup removes all\nnonces.", "attributes": "", "line": 31 } ], "parseErrors": false }, { "module": "revocations", "source": "aegis/aegis-store-pg/src/revocations.rs", "sha256": "0d29d60c44af9fe3227dc5a913c4c7b81cb8ffdb67f88f9307a1d38b7d214baa", "attributes": "", "items": [ { "name": "revocations::PgRevocationStore", "kind": "struct_item", "signature": "pub struct PgRevocationStore {\n\n}", "docs": "PostgreSQL-backed revocation store.\n\nRecords revoked delegation IDs in the `aegis_revocations` table.\nUses `ON CONFLICT DO NOTHING` for idempotent revocation.", "attributes": "", "line": 16 }, { "name": "revocations::PgRevocationStore::new", "kind": "function_item", "signature": "pub fn new(pool: PgPool) -> Self;", "docs": "Create a new PostgreSQL revocation store with the given connection pool.", "attributes": "", "line": 22 } ], "parseErrors": false }, { "module": "sessions", "source": "aegis/aegis-store-pg/src/sessions.rs", "sha256": "4d1266a446ccc3d8c9d65b987bed63bd3bcfcf6cd6929637db9a28d54ec98eda", "attributes": "", "items": [ { "name": "sessions::PgSessionStore", "kind": "struct_item", "signature": "pub struct PgSessionStore {\n\n}", "docs": "PostgreSQL-backed session store.\n\nStores `Session` records in the `aegis_sessions` table. Scope is\nserialized as a JSON array and device binding as an optional TEXT column.", "attributes": "", "line": 16 }, { "name": "sessions::PgSessionStore::new", "kind": "function_item", "signature": "pub fn new(pool: PgPool) -> Self;", "docs": "Create a new PostgreSQL session store with the given connection pool.", "attributes": "", "line": 22 } ], "parseErrors": false } ] }, { "name": "aegis-verify", "url": "/reference/rust/aegis-verify", "modules": [ { "module": "crate", "source": "aegis/aegis-verify/src/lib.rs", "sha256": "c8d798fb66648c528b91bacec4feac289043d5ed59797674eebc49676330f1df", "attributes": "", "items": [ { "name": "cache", "kind": "module", "signature": "pub mod cache;", "docs": "", "attributes": "", "line": 14 }, { "name": "pipeline", "kind": "module", "signature": "pub mod pipeline;", "docs": "", "attributes": "", "line": 15 }, { "name": "store", "kind": "module", "signature": "pub mod store;", "docs": "", "attributes": "", "line": 16 }, { "name": "pub use cache::VerificationCache;", "kind": "use_declaration", "signature": "pub use cache::VerificationCache;", "docs": "", "attributes": "", "line": 18 }, { "name": "pub use pipeline::VerificationPipeline;", "kind": "use_declaration", "signature": "pub use pipeline::VerificationPipeline;", "docs": "", "attributes": "", "line": 19 }, { "name": "pub use store::{InMemoryVerificationCacheStore, VerificationCacheStore};", "kind": "use_declaration", "signature": "pub use store::{InMemoryVerificationCacheStore, VerificationCacheStore};", "docs": "", "attributes": "", "line": 20 } ], "parseErrors": false }, { "module": "cache", "source": "aegis/aegis-verify/src/cache.rs", "sha256": "b43d476e5c7adaa9f355df896ee1e0382f6d5d87adb6d3d12a6be942e79124ee", "attributes": "", "items": [ { "name": "cache::VerificationCache", "kind": "struct_item", "signature": "pub struct VerificationCache {\n\n}", "docs": "A TTL-based cache for OAS document verification results.\n\nStores [`VerificationResult`] entries keyed by DID string. Each entry\nexpires after a configurable duration (capped at 300 seconds per\nAEGIS Specification \u00a75.8).\n\n# Thread Safety\n\nUses `RwLock` for interior mutability, allowing concurrent reads\nwith exclusive writes.", "attributes": "", "line": 44 }, { "name": "cache::VerificationCache::new", "kind": "function_item", "signature": "pub fn new(ttl_secs: u64) -> Self;", "docs": "Creates a new cache with the specified TTL in seconds.\n\nThe TTL is capped at 300 seconds per the AEGIS specification.\nValues exceeding this limit are silently clamped.\n\n# Arguments\n\n* `ttl_secs` - Time-to-live in seconds (capped at 300).", "attributes": "", "line": 71 }, { "name": "cache::VerificationCache::get", "kind": "function_item", "signature": "pub fn get(&self, did: &str) -> Option;", "docs": "Returns a cached verification result if present and not expired.\n\nExpired entries are lazily evicted: if a cached entry is found\nbut has exceeded its TTL, it is not returned but remains in\nthe map until the next write operation or explicit invalidation.\n\n# Arguments\n\n* `did` - The DID to look up.\n\n# Returns\n\n`Some(VerificationResult)` if a valid, non-expired entry exists.\n`None` if the DID is not cached or the entry has expired.", "attributes": "", "line": 93 }, { "name": "cache::VerificationCache::insert", "kind": "function_item", "signature": "pub fn insert(&self, did: &str, result: VerificationResult);", "docs": "Inserts a verification result into the cache.\n\nIf an entry already exists for the given DID, it is replaced.\n\n# Arguments\n\n* `did` - The DID to cache.\n* `result` - The verification result to store.", "attributes": "", "line": 111 }, { "name": "cache::VerificationCache::invalidate", "kind": "function_item", "signature": "pub fn invalidate(&self, did: &str);", "docs": "Removes a specific entry from the cache.\n\n# Arguments\n\n* `did` - The DID to invalidate.", "attributes": "", "line": 129 }, { "name": "cache::VerificationCache::clear", "kind": "function_item", "signature": "pub fn clear(&self);", "docs": "Removes all entries from the cache.", "attributes": "", "line": 136 }, { "name": "cache::VerificationCache::len", "kind": "function_item", "signature": "pub fn len(&self) -> usize;", "docs": "Returns the number of entries currently in the cache (including expired).", "attributes": "", "line": 143 }, { "name": "cache::VerificationCache::is_empty", "kind": "function_item", "signature": "pub fn is_empty(&self) -> bool;", "docs": "Returns true if the cache contains no entries.", "attributes": "", "line": 148 }, { "name": "cache::VerificationCache::ttl", "kind": "function_item", "signature": "pub fn ttl(&self) -> Duration;", "docs": "Returns the configured TTL duration.", "attributes": "", "line": 153 } ], "parseErrors": false }, { "module": "pipeline", "source": "aegis/aegis-verify/src/pipeline.rs", "sha256": "ae488b14dd9bfc2ea06b1b97ae7f8bf769baa207de423ba1e81e1a190b56393a", "attributes": "", "items": [ { "name": "pipeline::VerificationPipeline", "kind": "struct_item", "signature": "pub struct VerificationPipeline {\n\n}", "docs": "The AEGIS Verification Pipeline.\n\nPerforms complete verification of OAS identity documents per\nAEGIS Specification \u00a75. The pipeline:\n\n1. Resolves the DID via registered resolver plugins\n2. Validates the document structure\n3. Verifies the Ed25519Signature2020 document proof\n4. Checks revocation status\n5. Verifies lineage chain to human root\n6. Checks human root liveness\n7. Computes the verified conformance level\n\nResults are cached with a configurable TTL (max 300 seconds).", "attributes": "", "line": 85 }, { "name": "pipeline::VerificationPipeline::new", "kind": "function_item", "signature": "pub fn new(registry: Arc, config: VerificationConfig) -> Self;", "docs": "Creates a new verification pipeline.\n\n# Arguments\n\n* `registry` - The AEGIS plugin registry containing DID resolvers.\n* `config` - Verification configuration (timeouts, depth, cache TTL).", "attributes": "", "line": 101 }, { "name": "pipeline::VerificationPipeline::verify", "kind": "function_item", "signature": "pub async fn verify(&self, did: &str) -> Result;", "docs": "Performs a full verification of an OAS identity document.\n\nReturns a cached result if available and not expired. Otherwise,\nruns the complete verification pipeline and caches the result.\n\n# Arguments\n\n* `did` - The `did:oas` identifier to verify.\n\n# Returns\n\nA [`VerificationResult`] containing the verification outcome.\n\n# Errors\n\nReturns [`VerificationError`] if any step of the pipeline fails\nwith an unrecoverable error (e.g., resolution failure, invalid signature).", "attributes": "", "line": 127 }, { "name": "pipeline::VerificationPipeline::verify_force_refresh", "kind": "function_item", "signature": "pub async fn verify_force_refresh(\n &self,\n did: &str,\n ) -> Result;", "docs": "Performs a full verification bypassing the cache.\n\nAlways runs the complete pipeline regardless of cached results.\nThe fresh result is stored in the cache, replacing any previous entry.\n\n# Arguments\n\n* `did` - The `did:oas` identifier to verify.\n\n# Returns\n\nA fresh [`VerificationResult`].\n\n# Errors\n\nReturns [`VerificationError`] if verification fails.", "attributes": "", "line": 155 }, { "name": "pipeline::VerificationPipeline::cache", "kind": "function_item", "signature": "pub fn cache(&self) -> &VerificationCache;", "docs": "Returns a reference to the internal cache for inspection.", "attributes": "", "line": 166 } ], "parseErrors": false }, { "module": "store", "source": "aegis/aegis-verify/src/store.rs", "sha256": "ee67ee8eec84a09c8a2662d8802c49e56c61f669e5d0a200b33b1fdabe569cea", "attributes": "", "items": [ { "name": "store::VerificationCacheStore", "kind": "trait_item", "signature": "pub trait VerificationCacheStore: Send + Sync {\n /// Retrieve a cached verification result for the given DID.\n ///\n /// Returns `None` if no cached result exists or if the cached entry\n /// has expired. Implementations should not return expired entries.\n async fn get_cached(&self, did: &str) -> Result, VerificationError>;\n\n /// Store a verification result in the cache for the given DID.\n ///\n /// If an entry already exists for the DID, it is replaced.\n async fn store_cached(\n &self,\n did: &str,\n result: &VerificationResult,\n ) -> Result<(), VerificationError>;\n\n /// Invalidate (remove) a cached entry for the given DID.\n ///\n /// Does not return an error if no entry existed.\n async fn invalidate(&self, did: &str) -> Result<(), VerificationError>;\n\n /// Remove all expired entries from the cache.\n ///\n /// Returns the number of entries removed.\n async fn cleanup_expired(&self) -> Result;\n}", "docs": "Pluggable storage backend for verification result caching.\n\nImplementations may use in-memory storage, databases, or distributed\ncaches. All operations are async to accommodate network-backed stores.\n\nThis trait complements [`crate::cache::VerificationCache`] by providing\nan async, error-aware interface suitable for production persistence\nbackends. The existing `VerificationCache` can be adapted to use a\n`VerificationCacheStore` internally.", "attributes": "#[async_trait]", "line": 30 }, { "name": "store::InMemoryVerificationCacheStore", "kind": "struct_item", "signature": "pub struct InMemoryVerificationCacheStore {\n\n}", "docs": "In-memory verification cache store backed by a `RwLock`.\n\nStores [`VerificationResult`] entries keyed by DID string with a\nconfigurable TTL (capped at 300 seconds per specification).\n\nSuitable for development, testing, and single-instance deployments.\nFor production multi-node deployments, use a database-backed or\ndistributed cache implementation of [`VerificationCacheStore`].", "attributes": "", "line": 85 }, { "name": "store::InMemoryVerificationCacheStore::new", "kind": "function_item", "signature": "pub fn new(ttl_secs: u64) -> Self;", "docs": "Creates a new in-memory verification cache store with the specified\nTTL in seconds.\n\nThe TTL is capped at 300 seconds per the AEGIS specification.\nValues exceeding this limit are silently clamped.", "attributes": "", "line": 96 }, { "name": "store::InMemoryVerificationCacheStore::ttl", "kind": "function_item", "signature": "pub fn ttl(&self) -> Duration;", "docs": "Returns the configured TTL duration.", "attributes": "", "line": 105 } ], "parseErrors": false } ] }, { "name": "aegis-wallet", "url": "/reference/rust/aegis-wallet", "modules": [ { "module": "crate", "source": "aegis/aegis-wallet/src/lib.rs", "sha256": "81f68cbce49fa14207778757db13fdc987e7290653f90b4c20e41dbad27a6ad2", "attributes": "", "items": [ { "name": "address", "kind": "module", "signature": "pub mod address;", "docs": "", "attributes": "", "line": 5 }, { "name": "batch", "kind": "module", "signature": "pub mod batch;", "docs": "", "attributes": "", "line": 6 }, { "name": "ceremony", "kind": "module", "signature": "pub mod ceremony;", "docs": "", "attributes": "", "line": 7 }, { "name": "external", "kind": "module", "signature": "pub mod external;", "docs": "", "attributes": "", "line": 8 }, { "name": "pipeline", "kind": "module", "signature": "pub mod pipeline;", "docs": "", "attributes": "", "line": 9 } ], "parseErrors": false }, { "module": "address", "source": "aegis/aegis-wallet/src/address.rs", "sha256": "5191155b4074c5a8a3c9cedc9d0e284b069ee4360046f048bb84f9d72fc58b18", "attributes": "", "items": [ { "name": "address::WalletAddress", "kind": "struct_item", "signature": "pub struct WalletAddress {\n/// The blockchain chain this address targets.\n\npub chain: Chain,\n/// The derived address string in chain-native format.\n\npub address: String,\n/// The BIP-44/SLIP-0010 derivation path used.\n\npub derivation_path: String,\n/// Hex-encoded public key used for derivation.\n\npub public_key_hex: String\n}", "docs": "A derived wallet address for a specific chain.", "attributes": "#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]", "line": 15 }, { "name": "address::AddressDeriver", "kind": "struct_item", "signature": "pub struct AddressDeriver;", "docs": "Multi-chain address deriver.\n\nComputes addresses from raw public key bytes for each supported chain,\nusing chain-specific encoding rules.", "attributes": "", "line": 30 }, { "name": "address::AddressDeriver::derivation_path", "kind": "function_item", "signature": "pub fn derivation_path(chain: Chain, account: u32, index: u32) -> String;", "docs": "Returns the BIP-44/SLIP-0010 derivation path for a given chain.\n\nPath format follows BIP-44: `m/44'/'/'/0/`\nwith chain-specific variations for SLIP-0010 chains (Solana, Aptos, Sui).", "attributes": "", "line": 37 }, { "name": "address::AddressDeriver::derive_address", "kind": "function_item", "signature": "pub fn derive_address(\n chain: Chain,\n public_key_bytes: &[u8],\n ) -> Result;", "docs": "Derive a wallet address from raw public key bytes for a given chain.\n\nEach chain uses its own address encoding:\n- Ethereum/EVM: `0x` + hex of last 20 bytes of Keccak-256 hash\n- Solana: base58-encoded public key\n- Bitcoin: BIP-173 bech32 P2WPKH over HASH160(public key)\n- Cosmos: bech32 over HASH160(public key)\n- Osmosis: bech32 over HASH160(public key)\n- Aptos/Sui: `0x` + hex of SHA-256 of public key\n- StarkNet: `0x0` + hex prefix", "attributes": "", "line": 80 }, { "name": "address::AddressDeriver::derive_all", "kind": "function_item", "signature": "pub fn derive_all(\n public_key_bytes: &[u8],\n chains: &[Chain],\n ) -> Result, WalletError>;", "docs": "Derive addresses for multiple chains from the same public key.", "attributes": "", "line": 104 }, { "name": "address::hex::encode", "kind": "function_item", "signature": "pub fn encode(bytes: &[u8]) -> String;", "docs": "", "attributes": "", "line": 283 } ], "parseErrors": false }, { "module": "batch", "source": "aegis/aegis-wallet/src/batch.rs", "sha256": "96a13662307da6923a4bd7ad5e97ad451e8c2a5d47a6afea43f1b4b174cd4590", "attributes": "", "items": [ { "name": "batch::BatchResult", "kind": "struct_item", "signature": "pub struct BatchResult {\n/// The batch mode that was used.\n\npub mode: BatchMode,\n/// Per-transaction results (Ok for signed, Err for failures).\n\npub results: Vec>,\n/// Total number of transactions in the batch.\n\npub total: usize,\n/// Number of transactions that were successfully signed.\n\npub succeeded: usize\n}", "docs": "Result of a batch signing operation.", "attributes": "#[derive(Debug)]", "line": 15 }, { "name": "batch::execute_batch", "kind": "function_item", "signature": "pub async fn execute_batch(\n pipeline: &TransactionPipeline,\n transactions: Vec<(Transaction, AuthContext, PolicyDecision)>,\n mode: BatchMode,\n) -> Result;", "docs": "Execute batch transaction signing through the authorization pipeline.\n\n# Modes\n\n- `AllOrNothing`: Pre-validates all transactions first (dry-run). If any\n would fail, returns an error without signing any. If all pass validation,\n signs all of them.\n\n- `BestEffort`: Attempts each transaction independently. Failures are\n recorded in the results vec but do not prevent other transactions\n from being signed.\n\n# Errors\n\nIn `AllOrNothing` mode, returns `WalletError::BatchPartialFailure` if\nany transaction in the batch fails authorization or signing.\n\nIn `BestEffort` mode, the function itself only returns `Err` for\ncatastrophic/infrastructure failures. Individual transaction failures\nare captured in `BatchResult::results`.", "attributes": "", "line": 46 } ], "parseErrors": false }, { "module": "ceremony", "source": "aegis/aegis-wallet/src/ceremony.rs", "sha256": "a055fca11bc466142b5dd1c9b53c850fcd5abd683995151fedd37f61341c366a", "attributes": "", "items": [ { "name": "ceremony::SigningRequest", "kind": "struct_item", "signature": "pub struct SigningRequest {\n/// Raw message bytes to sign.\n\npub message: Vec,\n/// DID of the entity requesting the signature.\n\npub signer_did: String,\n/// Optional chain context (for chain-specific signing rules).\n\npub chain: Option\n}", "docs": "A request to sign a message within a signing ceremony.", "attributes": "#[derive(Debug, Clone)]", "line": 15 }, { "name": "ceremony::SigningResult", "kind": "struct_item", "signature": "pub struct SigningResult {\n/// The raw signature bytes.\n\npub signature: Vec,\n/// The public key of the signer.\n\npub public_key: Vec,\n/// The signing mode used.\n\npub mode: SigningMode\n}", "docs": "The result of a signing ceremony.", "attributes": "#[derive(Debug, Clone)]", "line": 26 }, { "name": "ceremony::SigningBackend", "kind": "trait_item", "signature": "pub trait SigningBackend: Send + Sync {\n /// Execute a signing ceremony for the given request.\n async fn sign(&self, request: &SigningRequest) -> Result;\n\n /// Return the public key bytes for this signer.\n fn public_key(&self) -> &[u8];\n\n /// The signing mode this backend implements.\n fn mode(&self) -> SigningMode;\n}", "docs": "Trait for pluggable signing backends.\n\nImplementations include direct key signing, MPC threshold signing,\nTEE-enclave signing, and external KMS delegation.", "attributes": "#[async_trait]", "line": 40 }, { "name": "ceremony::DirectSigner", "kind": "struct_item", "signature": "pub struct DirectSigner {\n\n}", "docs": "Direct signing backend using a single Ed25519 key.\n\nThe key material is zeroized when the struct is dropped.", "attributes": "#[derive(ZeroizeOnDrop)]", "line": 55 }, { "name": "ceremony::DirectSigner::new", "kind": "function_item", "signature": "pub fn new(signing_key: SigningKey) -> Self;", "docs": "Create a new direct signer from an Ed25519 signing key.", "attributes": "", "line": 66 }, { "name": "ceremony::DirectSigner::verifying_key", "kind": "function_item", "signature": "pub fn verifying_key(&self) -> VerifyingKey;", "docs": "Return the Ed25519 verifying (public) key.", "attributes": "", "line": 75 }, { "name": "ceremony::verify_signature", "kind": "function_item", "signature": "pub fn verify_signature(\n public_key_bytes: &[u8],\n message: &[u8],\n signature_bytes: &[u8],\n) -> Result;", "docs": "Verify an Ed25519 signature against a message and public key.\n\nConvenience function for verifying signatures produced by `DirectSigner`.", "attributes": "", "line": 114 } ], "parseErrors": false }, { "module": "external", "source": "aegis/aegis-wallet/src/external.rs", "sha256": "6c01aa5e92517f9a44fcbf3a8ec698289ab07be900c3e615f1ebb6aebcd1cbe8", "attributes": "", "items": [ { "name": "external::ExternalSigner", "kind": "trait_item", "signature": "pub trait ExternalSigner: Send + Sync {\n /// Sign an arbitrary message using the external signing service.\n async fn sign(&self, message: &[u8]) -> Result, WalletError>;\n\n /// Return the public key bytes from the external signer.\n fn get_public_key(&self) -> Vec;\n}", "docs": "External signer interface for organizations with existing KMS/HSM.\n\nImplementors provide their own signing logic (AWS KMS, GCP Cloud KMS,\nHashicorp Vault, hardware tokens, etc.) and expose a uniform interface\nto the AEGIS wallet infrastructure.", "attributes": "#[async_trait]", "line": 20 }, { "name": "external::ExternalSignerAdapter", "kind": "struct_item", "signature": "pub struct ExternalSignerAdapter {\n\n}", "docs": "Adapter that wraps any `ExternalSigner` into a `SigningBackend`.\n\nThis allows external KMS implementations to participate in the\nstandard AEGIS signing ceremony and transaction pipeline.", "attributes": "", "line": 32 }, { "name": "external::ExternalSignerAdapter::new", "kind": "function_item", "signature": "pub fn new(signer: Box) -> Self;", "docs": "Create a new adapter wrapping the given external signer.", "attributes": "", "line": 41 } ], "parseErrors": false }, { "module": "pipeline", "source": "aegis/aegis-wallet/src/pipeline.rs", "sha256": "1f47e8f5e14516e501da3b8918bb652f9eb88ed911433066fbeff83b12a1fbea", "attributes": "", "items": [ { "name": "pipeline::Transaction", "kind": "struct_item", "signature": "pub struct Transaction {\n/// Unique transaction identifier.\n\npub tx_id: String,\n/// DID of the sender.\n\npub from_did: String,\n/// Destination address or DID.\n\npub to: String,\n/// Target blockchain network.\n\npub chain: String,\n/// Transaction payload (calldata, transfer encoding, etc.).\n\npub data: Vec,\n/// Optional value being transferred (chain-native representation).\n\npub value: Option\n}", "docs": "A transaction to authorize and sign.", "attributes": "#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]", "line": 26 }, { "name": "pipeline::Transaction::new", "kind": "function_item", "signature": "pub fn new(from_did: String, to: String, chain: String, data: Vec) -> Self;", "docs": "Create a new transaction with an auto-generated UUIDv7 identifier.", "attributes": "", "line": 43 }, { "name": "pipeline::Transaction::with_value", "kind": "function_item", "signature": "pub fn with_value(mut self, value: String) -> Self;", "docs": "Create a new transaction with an explicit value.", "attributes": "", "line": 55 }, { "name": "pipeline::AuthorizedTransaction", "kind": "struct_item", "signature": "pub struct AuthorizedTransaction {\n/// The original transaction.\n\npub transaction: Transaction,\n/// The cryptographic signature over the transaction data.\n\npub signature: Vec,\n/// Obligations that were fulfilled during authorization.\n\npub fulfilled_obligations: Vec\n}", "docs": "The result of a fully authorized and signed transaction.", "attributes": "#[derive(Debug, Clone)]", "line": 63 }, { "name": "pipeline::TransactionPipeline", "kind": "struct_item", "signature": "pub struct TransactionPipeline {\n\n}", "docs": "The full transaction authorization pipeline per AEGIS Spec SS10.4.\n\nEnforces a strict five-step process:\n 1. Verify the caller's identity is valid (not expired).\n 2. Check delegation scope for direct or delegated authorization.\n 3. Evaluate policy decision (must be allowed).\n 4. Fulfill all obligations (log obligations are recorded;\n others that cannot be fulfilled immediately cause failure).\n 5. Sign the transaction data via the configured signing backend.\n\nIf any step fails, the pipeline returns an error and the\ntransaction is NOT signed.", "attributes": "", "line": 84 }, { "name": "pipeline::TransactionPipeline::new", "kind": "function_item", "signature": "pub fn new(signer: Arc) -> Self;", "docs": "Create a new transaction pipeline with the given signing backend.", "attributes": "", "line": 91 }, { "name": "pipeline::TransactionPipeline::authorize_and_sign", "kind": "function_item", "signature": "pub async fn authorize_and_sign(\n &self,\n tx: Transaction,\n auth: &AuthContext,\n policy_decision: &PolicyDecision,\n ) -> Result;", "docs": "Execute the full authorization pipeline for a single transaction.\n\n# Errors\n\nReturns `WalletError::AuthorizationFailed` if identity verification\nfails, `WalletError::PolicyDenied` if policy denies the transaction,\n`WalletError::ObligationFailed` if an obligation cannot be fulfilled,\nor `WalletError::SigningFailed` if the signing ceremony fails.", "attributes": "", "line": 103 } ], "parseErrors": false } ] }, { "name": "openagent-aegis-core", "url": "/reference/rust/openagent-aegis-core", "modules": [ { "module": "crate", "source": "aegis/openagent-aegis-core/src/lib.rs", "sha256": "88d7730fc7e6ae32363a1c3e20c911711e49b185bd5482f35302a01053d22c78", "attributes": "", "items": [ { "name": "error", "kind": "module", "signature": "pub mod error;", "docs": "", "attributes": "", "line": 8 }, { "name": "plugin", "kind": "module", "signature": "pub mod plugin;", "docs": "", "attributes": "", "line": 9 }, { "name": "types", "kind": "module", "signature": "pub mod types;", "docs": "", "attributes": "", "line": 10 }, { "name": "pub use error::*;", "kind": "use_declaration", "signature": "pub use error::*;", "docs": "", "attributes": "", "line": 12 }, { "name": "pub use plugin::*;", "kind": "use_declaration", "signature": "pub use plugin::*;", "docs": "", "attributes": "", "line": 13 }, { "name": "pub use types::*;", "kind": "use_declaration", "signature": "pub use types::*;", "docs": "", "attributes": "", "line": 14 } ], "parseErrors": false }, { "module": "error", "source": "aegis/openagent-aegis-core/src/error.rs", "sha256": "de788643c270b4ca24b0ecb740416c4c537f2576e7bbe7f3730ceb6a409e6938", "attributes": "", "items": [ { "name": "error::ResolverError", "kind": "enum_item", "signature": "pub enum ResolverError {\n /// DID does not exist in the resolver's namespace.\n #[error(\"DID not found: {did}\")]\n NotFound { did: String },\n\n /// DID string is malformed.\n #[error(\"invalid DID format: {reason}\")]\n InvalidFormat { reason: String },\n\n /// Resolution did not complete within the timeout.\n #[error(\"resolution timed out after {timeout_ms}ms for DID: {did}\")]\n ResolutionTimeout { did: String, timeout_ms: u64 },\n\n /// DID has been deactivated.\n #[error(\"DID has been deactivated: {did}\")]\n Deactivated { did: String },\n\n /// Resolution failed due to network issues.\n #[error(\"network error resolving DID {did}: {reason}\")]\n NetworkError { did: String, reason: String },\n\n /// This resolver does not support DID creation.\n #[error(\"DID creation not supported by this resolver\")]\n CreationNotSupported,\n\n /// This resolver does not support DID updates.\n #[error(\"DID update not supported by this resolver\")]\n UpdateNotSupported,\n\n /// This resolver does not support DID deactivation.\n #[error(\"DID deactivation not supported by this resolver\")]\n DeactivationNotSupported,\n}", "docs": "Errors from the DID Resolver plugin interface (AEGIS Spec \u00a74.1).", "attributes": "#[derive(Debug, Error)]", "line": 10 }, { "name": "error::AuthError", "kind": "enum_item", "signature": "pub enum AuthError {\n /// The credential is invalid or could not be verified.\n #[error(\"invalid credential: {reason}\")]\n InvalidCredential { reason: String },\n\n /// The credential has expired.\n #[error(\"credential expired at {expired_at}\")]\n CredentialExpired { expired_at: String },\n\n /// The session has been revoked.\n #[error(\"session revoked: {session_id}\")]\n SessionRevoked { session_id: String },\n\n /// The session has expired.\n #[error(\"session expired: {session_id}\")]\n SessionExpired { session_id: String },\n\n /// The challenge has expired or is invalid.\n #[error(\"challenge invalid: {reason}\")]\n ChallengeInvalid { reason: String },\n\n /// The provider is unavailable.\n #[error(\"auth provider unavailable: {provider}\")]\n ProviderUnavailable { provider: String },\n\n /// Refresh is not supported by this provider.\n #[error(\"refresh not supported by provider: {provider}\")]\n RefreshNotSupported { provider: String },\n\n /// Revocation is not supported by this provider.\n #[error(\"revocation not supported by provider: {provider}\")]\n RevocationNotSupported { provider: String },\n\n /// Internal error within the auth provider.\n #[error(\"auth provider internal error: {reason}\")]\n Internal { reason: String },\n}", "docs": "Errors from the Auth Provider plugin interface (AEGIS Spec \u00a74.2).", "attributes": "#[derive(Debug, Error)]", "line": 46 }, { "name": "error::PolicyError", "kind": "enum_item", "signature": "pub enum PolicyError {\n /// Policy evaluation failed.\n #[error(\"policy evaluation failed: {reason}\")]\n EvaluationFailed { reason: String },\n\n /// Policy engine timed out (must complete within 100ms).\n #[error(\"policy evaluation timed out after {timeout_ms}ms\")]\n Timeout { timeout_ms: u64 },\n\n /// Policy engine is unavailable \u2014 fail closed.\n #[error(\"policy engine unavailable; denying request (fail-closed)\")]\n EngineUnavailable,\n\n /// No policy engine is registered.\n #[error(\"no policy engine registered; denying request (fail-closed)\")]\n NoPolicyEngine,\n\n /// Policy configuration error.\n #[error(\"policy configuration error: {reason}\")]\n ConfigError { reason: String },\n}", "docs": "Errors from the Policy Engine plugin interface (AEGIS Spec \u00a74.3).", "attributes": "#[derive(Debug, Error)]", "line": 86 }, { "name": "error::VerificationError", "kind": "enum_item", "signature": "pub enum VerificationError {\n /// DID resolution failed.\n #[error(\"resolution failed for {did}: {reason}\")]\n ResolutionFailed { did: String, reason: String },\n\n /// OAS schema validation failed.\n #[error(\"schema validation failed for {did}: {reason}\")]\n InvalidSchema { did: String, reason: String },\n\n /// Document signature is invalid.\n #[error(\"invalid document signature for {did}\")]\n InvalidSignature { did: String },\n\n /// Lineage chain verification failed.\n #[error(\"lineage verification failed for {did}: {reason}\")]\n LineageFailed { did: String, reason: String },\n\n /// Maximum lineage depth exceeded.\n #[error(\"lineage depth {depth} exceeds maximum {max_depth} for {did}\")]\n MaxDepthExceeded {\n did: String,\n depth: u32,\n max_depth: u32,\n },\n\n /// Identity has been revoked.\n #[error(\"identity revoked: {did}\")]\n Revoked { did: String },\n\n /// Identity has been suspended.\n #[error(\"identity suspended: {did}\")]\n Suspended { did: String },\n\n /// Human root revoked \u2014 entire lineage invalid.\n #[error(\"human root {human_root} has been revoked\")]\n HumanRootRevoked { human_root: String },\n\n /// Lineage generation number mismatch.\n #[error(\"generation mismatch for {did}: expected {expected}, found {found}\")]\n GenerationMismatch {\n did: String,\n expected: u32,\n found: u32,\n },\n\n /// Verification timed out.\n #[error(\"verification timed out for {did}\")]\n Timeout { did: String },\n\n /// Consistency violation between registries.\n #[error(\"consistency violation for {did}: {reason}\")]\n ConsistencyViolation { did: String, reason: String },\n}", "docs": "Errors from the Verification Infrastructure (AEGIS Spec \u00a75).", "attributes": "#[derive(Debug, Error)]", "line": 110 }, { "name": "error::KeyError", "kind": "enum_item", "signature": "pub enum KeyError {\n /// Key generation failed.\n #[error(\"key generation failed: {reason}\")]\n GenerationFailed { reason: String },\n\n /// Key derivation failed.\n #[error(\"key derivation failed: {reason}\")]\n DerivationFailed { reason: String },\n\n /// Key rotation failed.\n #[error(\"key rotation failed: {reason}\")]\n RotationFailed { reason: String },\n\n /// Key recovery failed.\n #[error(\"key recovery failed: {reason}\")]\n RecoveryFailed { reason: String },\n\n /// MPC ceremony failed.\n #[error(\"MPC ceremony failed: {reason}\")]\n MpcFailed { reason: String },\n\n /// Key not found.\n #[error(\"key not found: {key_id}\")]\n NotFound { key_id: String },\n\n /// Key storage error.\n #[error(\"key storage error: {reason}\")]\n StorageError { reason: String },\n\n /// Signing operation failed.\n #[error(\"signing failed: {reason}\")]\n SigningFailed { reason: String },\n\n /// Unsupported key type.\n #[error(\"unsupported key type: {key_type}\")]\n UnsupportedKeyType { key_type: String },\n}", "docs": "Errors from the Key Management Framework (AEGIS Spec \u00a76).", "attributes": "#[derive(Debug, Error)]", "line": 166 }, { "name": "error::DelegationError", "kind": "enum_item", "signature": "pub enum DelegationError {\n /// Delegation proof is invalid.\n #[error(\"invalid delegation proof: {reason}\")]\n InvalidProof { reason: String },\n\n /// Delegation has been revoked.\n #[error(\"delegation {delegation_id} has been revoked\")]\n Revoked { delegation_id: String },\n\n /// Delegation has expired.\n #[error(\"delegation {delegation_id} has expired\")]\n Expired { delegation_id: String },\n\n /// Delegation depth exceeds maximum.\n #[error(\"delegation depth {depth} exceeds maximum {max_depth}\")]\n MaxDepthExceeded { depth: u32, max_depth: u32 },\n\n /// Scope amplification attempted \u2014 delegate cannot exceed delegator.\n #[error(\"scope amplification not permitted: {reason}\")]\n ScopeAmplification { reason: String },\n\n /// Delegator not found.\n #[error(\"delegator not found: {did}\")]\n DelegatorNotFound { did: String },\n\n /// Delegate not found.\n #[error(\"delegate not found: {did}\")]\n DelegateNotFound { did: String },\n}", "docs": "Errors from the Delegation Model (AEGIS Spec \u00a79).", "attributes": "#[derive(Debug, Error)]", "line": 206 }, { "name": "error::WalletError", "kind": "enum_item", "signature": "pub enum WalletError {\n /// Transaction authorization failed.\n #[error(\"transaction authorization failed: {reason}\")]\n AuthorizationFailed { reason: String },\n\n /// Signing ceremony failed.\n #[error(\"signing ceremony failed: {reason}\")]\n SigningFailed { reason: String },\n\n /// Unsupported chain.\n #[error(\"unsupported chain: {chain}\")]\n UnsupportedChain { chain: String },\n\n /// Address derivation failed.\n #[error(\"address derivation failed for chain {chain}: {reason}\")]\n DerivationFailed { chain: String, reason: String },\n\n /// Policy denied the transaction.\n #[error(\"transaction denied by policy: {reason}\")]\n PolicyDenied { reason: String },\n\n /// Obligation could not be fulfilled.\n #[error(\"obligation fulfillment failed: {reason}\")]\n ObligationFailed { reason: String },\n\n /// Batch operation partially failed.\n #[error(\"batch operation failed: {succeeded} of {total} transactions succeeded\")]\n BatchPartialFailure { succeeded: usize, total: usize },\n}", "docs": "Errors from the Wallet Infrastructure (AEGIS Spec \u00a710).", "attributes": "#[derive(Debug, Error)]", "line": 238 } ], "parseErrors": false }, { "module": "plugin", "source": "aegis/openagent-aegis-core/src/plugin.rs", "sha256": "31309c020db740be017aadfba79c93a91f34f46791eca5b9801d67ff4d0a365a", "attributes": "", "items": [ { "name": "plugin::CreateDidParams", "kind": "struct_item", "signature": "pub struct CreateDidParams {\n/// Entity kind (human, agent, organization).\n\npub entity_kind: String,\n/// Namespace for the DID.\n\npub namespace: String,\n/// Unique identifier within the namespace.\n\npub identifier: String,\n/// Additional creation parameters.\n\npub metadata: HashMap\n}", "docs": "Parameters for creating a new DID.", "attributes": "#[derive(Debug, Clone)]", "line": 25 }, { "name": "plugin::DidCreationResult", "kind": "struct_item", "signature": "pub struct DidCreationResult {\n/// The created DID string.\n\npub did: String,\n/// The initial OAS Identity Document.\n\npub document: OasDocument\n}", "docs": "Result of creating a new DID.", "attributes": "#[derive(Debug, Clone)]", "line": 38 }, { "name": "plugin::DidResolver", "kind": "trait_item", "signature": "pub trait DidResolver: Send + Sync {\n /// Resolve a DID to its DID Document.\n ///\n /// MUST return a valid OAS Document or an error.\n /// MUST complete within 5 seconds (SHOULD within 3 seconds).\n async fn resolve(&self, did: &str) -> Result;\n\n /// Check if this resolver handles the given DID.\n fn handles(&self, did: &str) -> bool;\n\n /// List supported DID methods (e.g., [\"oas\", \"key\"]).\n fn supported_methods(&self) -> Vec;\n\n /// Create a new DID (optional \u2014 not all resolvers support creation).\n async fn create(&self, _params: CreateDidParams) -> Result ;\n\n /// Update a DID Document (optional).\n async fn update(&self, _did: &str, _document: OasDocument) -> Result<(), ResolverError> ;\n\n /// Deactivate a DID (optional).\n async fn deactivate(&self, _did: &str) -> Result<(), ResolverError> ;\n}", "docs": "DID Resolver plugin interface (AEGIS Spec \u00a74.1).\n\nEnables AEGIS to resolve any DID method without coupling to a specific\nresolution mechanism. Each resolver handles one or more DID methods.", "attributes": "#[async_trait]", "line": 50 }, { "name": "plugin::AuthProvider", "kind": "trait_item", "signature": "pub trait AuthProvider: Send + Sync {\n /// Validate a credential and return auth context.\n ///\n /// MUST return a valid `AuthContext` or an error.\n /// MUST verify cryptographic integrity of the credential.\n async fn validate(&self, credential: &AuthCredential) -> Result;\n\n /// Get identity information from auth context.\n async fn get_identity(&self, ctx: &AuthContext) -> Result;\n\n /// Get the provider identifier.\n fn provider_name(&self) -> &str;\n\n /// Refresh a session or token (optional).\n async fn refresh(&self, _ctx: &AuthContext) -> Result ;\n\n /// Revoke a session (optional).\n async fn revoke(&self, _ctx: &AuthContext) -> Result<(), AuthError> ;\n}", "docs": "Auth Provider plugin interface (AEGIS Spec \u00a74.2).\n\nValidates credentials and returns authentication context. Each provider\nhandles specific credential types (OAuth, challenge-response, API keys, etc.).", "attributes": "#[async_trait]", "line": 88 }, { "name": "plugin::PolicyEngine", "kind": "trait_item", "signature": "pub trait PolicyEngine: Send + Sync {\n /// Evaluate a policy request.\n ///\n /// MUST return a `PolicyDecision` including allowed/denied and obligations.\n /// MUST complete within 100ms (SHOULD within 50ms).\n /// Evaluation MUST be deterministic.\n async fn evaluate(&self, request: &PolicyRequest) -> Result;\n\n /// Simple permission check (convenience wrapper).\n async fn check_permission(&self, check: &PermissionCheck) -> Result;\n\n /// Get the engine identifier.\n fn engine_name(&self) -> &str;\n\n /// List policies for an identity (optional).\n async fn get_policies(&self, _did: &str) -> Result, PolicyError> ;\n}", "docs": "Policy Engine plugin interface (AEGIS Spec \u00a74.3).\n\nEvaluates authorization decisions. Only one policy engine is active\nat any time. If unavailable, AEGIS MUST fail-closed (deny all).", "attributes": "#[async_trait]", "line": 125 }, { "name": "plugin::PluginRegistry", "kind": "struct_item", "signature": "pub struct PluginRegistry {\n\n}", "docs": "The Plugin Registry manages all loaded plugins and routes requests\nto the appropriate plugin (AEGIS Spec \u00a74.4).\n\nRequirements:\n- Supports multiple DID Resolvers (routes by `handles()` method matching).\n- Supports multiple Auth Providers (keyed by `provider_name()`).\n- Supports exactly one Policy Engine.\n- Plugin registration order is deterministic.", "attributes": "", "line": 157 }, { "name": "plugin::PluginRegistry::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Create an empty plugin registry.", "attributes": "", "line": 168 }, { "name": "plugin::PluginRegistry::register_resolver", "kind": "function_item", "signature": "pub fn register_resolver(&mut self, resolver: Arc);", "docs": "Register a DID Resolver plugin.\n\nResolvers are tried in registration order. The first resolver\nwhose `handles()` returns true for a given DID is used.", "attributes": "", "line": 180 }, { "name": "plugin::PluginRegistry::register_auth_provider", "kind": "function_item", "signature": "pub fn register_auth_provider(&mut self, provider: Arc);", "docs": "Register an Auth Provider plugin.\n\nProviders are keyed by `provider_name()`. Registering a provider\nwith the same name replaces the previous one.", "attributes": "", "line": 188 }, { "name": "plugin::PluginRegistry::set_policy_engine", "kind": "function_item", "signature": "pub fn set_policy_engine(&mut self, engine: Arc);", "docs": "Set the active Policy Engine plugin.\n\nOnly one policy engine may be active. Setting a new one replaces\nthe previous engine.", "attributes": "", "line": 197 }, { "name": "plugin::PluginRegistry::resolve_did", "kind": "function_item", "signature": "pub async fn resolve_did(&self, did: &str) -> Result;", "docs": "Resolve a DID by routing to the appropriate resolver.\n\nIterates over registered resolvers in order and uses the first\nresolver whose `handles()` method returns true.", "attributes": "", "line": 205 }, { "name": "plugin::PluginRegistry::validate_credential", "kind": "function_item", "signature": "pub async fn validate_credential(\n &self,\n credential: &AuthCredential,\n provider_name: Option<&str>,\n ) -> Result;", "docs": "Validate a credential by routing to the named provider,\nor trying each provider if no explicit name is given.", "attributes": "", "line": 218 }, { "name": "plugin::PluginRegistry::evaluate_policy", "kind": "function_item", "signature": "pub async fn evaluate_policy(\n &self,\n request: &PolicyRequest,\n ) -> Result;", "docs": "Evaluate a policy request.\n\nIf no policy engine is registered, MUST fail-closed.", "attributes": "", "line": 249 }, { "name": "plugin::PluginRegistry::check_permission", "kind": "function_item", "signature": "pub async fn check_permission(&self, check: &PermissionCheck) -> Result;", "docs": "Simple permission check via the policy engine.", "attributes": "", "line": 260 }, { "name": "plugin::PluginRegistry::get_resolver_for", "kind": "function_item", "signature": "pub fn get_resolver_for(&self, did: &str) -> Option<&Arc>;", "docs": "Get a DID resolver by DID method.", "attributes": "", "line": 268 }, { "name": "plugin::PluginRegistry::get_auth_provider", "kind": "function_item", "signature": "pub fn get_auth_provider(&self, name: &str) -> Option<&Arc>;", "docs": "Get an auth provider by name.", "attributes": "", "line": 273 }, { "name": "plugin::PluginRegistry::get_policy_engine", "kind": "function_item", "signature": "pub fn get_policy_engine(&self) -> Option<&Arc>;", "docs": "Get the active policy engine.", "attributes": "", "line": 278 }, { "name": "plugin::PluginRegistry::resolver_count", "kind": "function_item", "signature": "pub fn resolver_count(&self) -> usize;", "docs": "Returns the number of registered DID resolvers.", "attributes": "", "line": 283 }, { "name": "plugin::PluginRegistry::auth_provider_count", "kind": "function_item", "signature": "pub fn auth_provider_count(&self) -> usize;", "docs": "Returns the number of registered auth providers.", "attributes": "", "line": 288 }, { "name": "plugin::PluginRegistry::has_policy_engine", "kind": "function_item", "signature": "pub fn has_policy_engine(&self) -> bool;", "docs": "Returns true if a policy engine is registered.", "attributes": "", "line": 293 } ], "parseErrors": false }, { "module": "types", "source": "aegis/openagent-aegis-core/src/types.rs", "sha256": "180fdeda863a1f5e2265e1497a1672861899b783630464af1ecbeeb940e60c6b", "attributes": "", "items": [ { "name": "types::AuthContext", "kind": "struct_item", "signature": "pub struct AuthContext {\n/// Name of the Auth Provider that validated this credential.\n\npub provider: String,\n/// Unique identifier within the provider's namespace.\n\npub subject: String,\n/// Resolved DID for the authenticated entity.\n\npub did: Option,\n/// Session identifier for stateful authentication.\n\npub session_id: Option,\n/// Expiration time of this authentication context.\n\npub expires_at: Option>,\n/// Provider-specific claims (opaque to AEGIS core).\n\n#[serde(default)]\npub claims: HashMap\n}", "docs": "The output of successful authentication (AEGIS Spec \u00a77.1).\n\nProduced by an Auth Provider plugin and consumed by the Policy Engine.\nBridges \"who is this entity?\" to \"what may this entity do?\"", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 24 }, { "name": "types::AegisIdentity", "kind": "struct_item", "signature": "pub struct AegisIdentity {\n/// The entity's DID.\n\npub did: String,\n/// Entity kind (human, agent, organization, delegated).\n\npub identity_type: IdentityType,\n/// Display name if available.\n\npub display_name: Option,\n/// Verified conformance level.\n\npub conformance_level: Option\n}", "docs": "Identity information extracted from authentication.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 42 }, { "name": "types::IdentityType", "kind": "enum_item", "signature": "pub enum IdentityType {\n Human,\n Agent,\n Organization,\n /// Enterprise identity governed by an MHR (ENR entity).\n Enterprise,\n Delegated,\n}", "docs": "The type of entity being authenticated.", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(rename_all = \"snake_case\")]", "line": 56 }, { "name": "types::AuthCredential", "kind": "enum_item", "signature": "pub enum AuthCredential {\n /// Opaque bearer token (OAuth2, JWT).\n BearerToken { token: String },\n /// HTTP session cookie.\n SessionCookie { cookie: String },\n /// Long-lived API key.\n ApiKey { key: String },\n /// Challenge signed with identity key (AEGIS Spec \u00a77.3).\n SignedChallenge {\n did: String,\n challenge: String,\n signature: String,\n timestamp: String,\n nonce: String,\n },\n /// Scoped, time-bounded capability token.\n CapabilityToken { token: String },\n /// WebAuthn/FIDO2 passkey assertion.\n PasskeyAssertion {\n credential_id: String,\n authenticator_data: String,\n client_data_json: String,\n signature: String,\n },\n /// Plugin-defined custom credential type.\n Custom {\n provider: String,\n data: serde_json::Value,\n },\n}", "docs": "Credential types supported by AEGIS (AEGIS Spec \u00a77.2).", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]\n#[serde(tag = \"type\", rename_all = \"snake_case\")]", "line": 68 }, { "name": "types::Session", "kind": "struct_item", "signature": "pub struct Session {\n/// Unique session identifier.\n\npub session_id: String,\n/// DID of the authenticated entity.\n\npub did: String,\n/// Auth Provider that issued this session.\n\npub provider: String,\n/// Session creation time.\n\npub created_at: DateTime,\n/// Session expiration time.\n\npub expires_at: DateTime,\n/// Authorized scopes for this session.\n\n#[serde(default)]\npub scope: Vec,\n/// Optional device fingerprint binding.\n\npub device_binding: Option\n}", "docs": "Session token structure (AEGIS Spec \u00a77.4).", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 101 }, { "name": "types::PolicyRequest", "kind": "struct_item", "signature": "pub struct PolicyRequest {\n/// DID of the entity requesting the action.\n\npub principal: String,\n/// The action being requested.\n\npub action: String,\n/// The resource being acted upon.\n\npub resource: String,\n/// Additional context for policy evaluation.\n\npub context: PolicyContext\n}", "docs": "Policy request structure (AEGIS Spec \u00a78.1).", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 125 }, { "name": "types::PolicyContext", "kind": "struct_item", "signature": "pub struct PolicyContext {\n/// Authentication context.\n\npub auth_context: Option,\n/// Verified lineage chain summary.\n\npub lineage: Option,\n/// Entity's verified conformance level.\n\npub conformance_level: Option,\n/// Current session information.\n\npub session: Option,\n/// Additional key-value context.\n\n#[serde(default)]\npub extra: HashMap\n}", "docs": "Context provided alongside a policy request.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 138 }, { "name": "types::LineageSummary", "kind": "struct_item", "signature": "pub struct LineageSummary {\n/// Number of hops to human root.\n\npub depth: u32,\n/// DID of the human root.\n\npub human_root: String,\n/// Whether the lineage was cryptographically verified.\n\npub verified: bool\n}", "docs": "Summary of a verified lineage chain.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 154 }, { "name": "types::PolicyDecision", "kind": "struct_item", "signature": "pub struct PolicyDecision {\n/// Whether the action is permitted.\n\npub allowed: bool,\n/// Human-readable explanation.\n\npub reason: Option,\n/// Actions that MUST be performed if allowed.\n\n#[serde(default)]\npub obligations: Vec,\n/// Audit-relevant metadata.\n\npub audit_info: AuditInfo\n}", "docs": "Policy decision structure (AEGIS Spec \u00a78.2).", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 165 }, { "name": "types::Obligation", "kind": "struct_item", "signature": "pub struct Obligation {\n/// Obligation type.\n\npub obligation_type: ObligationType,\n/// Obligation-specific parameters.\n\n#[serde(default)]\npub params: HashMap,\n/// Deadline for fulfillment (ISO 8601 duration).\n\npub deadline: Option\n}", "docs": "An obligation that MUST be fulfilled (AEGIS Spec \u00a78.3).", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 179 }, { "name": "types::ObligationType", "kind": "enum_item", "signature": "pub enum ObligationType {\n /// Record the operation in an audit log.\n Log,\n /// Notify the human root or designated monitor.\n Notify,\n /// Obtain explicit approval before proceeding.\n Approve,\n /// Place funds in escrow pending confirmation.\n Escrow,\n /// Apply a rate or amount limit.\n Limit,\n}", "docs": "Obligation types (AEGIS Spec \u00a78.3).", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(rename_all = \"snake_case\")]", "line": 192 }, { "name": "types::AuditInfo", "kind": "struct_item", "signature": "pub struct AuditInfo {\n/// Unique ID for this audit event.\n\npub audit_id: Uuid,\n/// Timestamp of the decision.\n\npub timestamp: DateTime,\n/// Policy engine that produced the decision.\n\npub engine: String,\n/// Policies that were evaluated.\n\n#[serde(default)]\npub policies_evaluated: Vec\n}", "docs": "Audit information attached to policy decisions.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 207 }, { "name": "types::PermissionCheck", "kind": "struct_item", "signature": "pub struct PermissionCheck {\n/// DID of the entity.\n\npub principal: String,\n/// The permission to check.\n\npub permission: String,\n/// The resource scope.\n\npub resource: Option\n}", "docs": "Permission check (simplified policy query).", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 221 }, { "name": "types::RevocationStatus", "kind": "enum_item", "signature": "pub enum RevocationStatus {\n /// Identity is valid and not revoked.\n Active,\n /// Identity has been explicitly revoked.\n Revoked,\n /// Identity is temporarily suspended.\n Suspended,\n /// Identity has passed its expiration date.\n Expired,\n /// Revocation status cannot be determined.\n Unknown,\n}", "docs": "Revocation status values (AEGIS Spec \u00a75.4).", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(rename_all = \"snake_case\")]", "line": 237 }, { "name": "types::LivenessStatus", "kind": "enum_item", "signature": "pub enum LivenessStatus {\n /// Human root demonstrated liveness within the configured period.\n Active,\n /// Liveness period exceeded \u2014 warning issued.\n Warning,\n /// Liveness period significantly exceeded \u2014 identity is stale.\n Stale,\n /// Liveness status cannot be determined.\n Unknown,\n}", "docs": "Liveness status (AEGIS Spec \u00a75.5).", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(rename_all = \"snake_case\")]", "line": 253 }, { "name": "types::VerificationResult", "kind": "struct_item", "signature": "pub struct VerificationResult {\n/// The verified DID.\n\npub did: String,\n/// Whether the document signature is valid.\n\npub signature_valid: bool,\n/// Whether the lineage chain is valid.\n\npub lineage_valid: bool,\n/// Number of hops to human root.\n\npub lineage_depth: u32,\n/// DID of the human root.\n\npub human_root: Option,\n/// Current revocation status.\n\npub revocation_status: RevocationStatus,\n/// Liveness status.\n\npub liveness_status: LivenessStatus,\n/// Verified conformance level (0, 1, or 2).\n\npub conformance_level: u8,\n/// Non-fatal warnings.\n\n#[serde(default)]\npub warnings: Vec,\n/// Timestamp of verification.\n\npub verified_at: DateTime\n}", "docs": "Verification result structure (AEGIS Spec \u00a75.7).", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 266 }, { "name": "types::VerificationConfig", "kind": "struct_item", "signature": "pub struct VerificationConfig {\n/// Maximum lineage depth (default: 16).\n\n#[serde(default = \"default_max_lineage_depth\")]\npub max_lineage_depth: u32,\n/// Per-hop timeout in seconds (default: 5).\n\n#[serde(default = \"default_per_hop_timeout\")]\npub per_hop_timeout_secs: u64,\n/// Total verification timeout in seconds (default: 30).\n\n#[serde(default = \"default_total_timeout\")]\npub total_timeout_secs: u64,\n/// Verification cache TTL in seconds (default: 300).\n\n#[serde(default = \"default_cache_ttl\")]\npub cache_ttl_secs: u64,\n/// Liveness period in days (default: 90).\n\n#[serde(default = \"default_liveness_period\")]\npub liveness_period_days: u32,\n/// Conformance level to verify against.\n\n#[serde(default)]\npub conformance_level: u8\n}", "docs": "Verification pipeline configuration.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 292 }, { "name": "types::Delegation", "kind": "struct_item", "signature": "pub struct Delegation {\n/// Unique delegation identifier.\n\npub id: String,\n/// DID of the entity granting authority.\n\npub delegator: String,\n/// DID of the entity receiving authority.\n\npub delegate: String,\n/// Permitted actions, resources, and constraints.\n\npub scope: DelegationScope,\n/// Delegation creation time.\n\npub created: DateTime,\n/// Delegation expiration time.\n\npub expires: Option>,\n/// Whether the delegation can be revoked before expiration.\n\npub revocable: bool,\n/// Cryptographic proof of the delegation.\n\npub proof: DelegationProof\n}", "docs": "Delegation structure (AEGIS Spec \u00a79.1).", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 348 }, { "name": "types::DelegationScope", "kind": "struct_item", "signature": "pub struct DelegationScope {\n/// Permitted actions.\n\n#[serde(default)]\npub actions: Vec,\n/// Permitted resources (contract addresses, chain names, etc.).\n\n#[serde(default)]\npub resources: Vec,\n/// Permitted blockchain networks.\n\n#[serde(default)]\npub chains: Vec,\n/// Quantitative constraints.\n\npub limits: Option,\n/// Time-based constraints.\n\npub temporal: Option\n}", "docs": "Delegation scope constraints (AEGIS Spec \u00a79.4).", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 369 }, { "name": "types::SpendingLimits", "kind": "struct_item", "signature": "pub struct SpendingLimits {\n/// Maximum value per transaction.\n\npub max_amount: Option,\n/// Maximum aggregate value per 24-hour period.\n\npub daily_volume: Option,\n/// Permitted asset types.\n\n#[serde(default)]\npub asset_allowlist: Vec,\n/// Permitted destination addresses.\n\n#[serde(default)]\npub recipient_allowlist: Vec,\n/// Value above which owner approval is required.\n\npub approval_threshold: Option\n}", "docs": "Spending limits for delegation and policy (AEGIS Spec \u00a78.4).", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 387 }, { "name": "types::TemporalConstraints", "kind": "struct_item", "signature": "pub struct TemporalConstraints {\n/// Policy effective start time.\n\npub valid_from: Option>,\n/// Policy expiration time.\n\npub valid_until: Option>,\n/// Time-of-day window (business hours).\n\npub active_hours: Option,\n/// Minimum time between successive operations (ISO 8601 duration).\n\npub cooldown: Option\n}", "docs": "Temporal policy constraints (AEGIS Spec \u00a78.6).", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 404 }, { "name": "types::ActiveHours", "kind": "struct_item", "signature": "pub struct ActiveHours {\n/// Start hour (0\u201323).\n\npub start_hour: u8,\n/// End hour (0\u201323).\n\npub end_hour: u8,\n/// Timezone (IANA, e.g. \"America/New_York\").\n\npub timezone: String\n}", "docs": "Active hours window.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 417 }, { "name": "types::DelegationProof", "kind": "struct_item", "signature": "pub struct DelegationProof {\n/// Proof type \u2014 always \"AegisDelegationProof2025\".\n\n#[serde(rename = \"type\")]\npub proof_type: String,\n/// Verification method DID URL.\n\npub verification_method: String,\n/// Proof creation time.\n\npub created: DateTime,\n/// Base64url-encoded signature.\n\npub jws: String\n}", "docs": "Delegation proof (AEGIS Spec \u00a79.7).", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 428 }, { "name": "types::SessionKey", "kind": "struct_item", "signature": "pub struct SessionKey {\n/// The temporary signing public key (multibase-encoded).\n\npub session_key: String,\n/// DID of the identity this session key represents.\n\npub principal: String,\n/// Permitted actions and constraints.\n\npub scope: DelegationScope,\n/// Maximum number of operations.\n\npub max_transactions: Option,\n/// Creation time.\n\npub created: DateTime,\n/// Expiration time (REQUIRED, max 24 hours).\n\npub expires: DateTime,\n/// Signed by the principal's identity key.\n\npub proof: DelegationProof\n}", "docs": "Session key structure (AEGIS Spec \u00a79.3).", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 442 }, { "name": "types::WalletType", "kind": "enum_item", "signature": "pub enum WalletType {\n /// Standard private key-controlled address.\n Eoa,\n /// Account abstraction (ERC-4337) with programmable logic.\n Smart,\n /// Chain-native account abstraction (Aptos, Sui, StarkNet).\n Abstract,\n}", "docs": "Wallet types (AEGIS Spec \u00a710.1).", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(rename_all = \"snake_case\")]", "line": 466 }, { "name": "types::Chain", "kind": "enum_item", "signature": "pub enum Chain {\n Ethereum,\n Polygon,\n Arbitrum,\n Optimism,\n Base,\n Solana,\n Bitcoin,\n Cosmos,\n Osmosis,\n Aptos,\n Sui,\n Starknet,\n}", "docs": "Supported blockchain chains.", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(rename_all = \"snake_case\")]", "line": 478 }, { "name": "types::Chain::coin_type", "kind": "function_item", "signature": "pub fn coin_type(&self) -> u32;", "docs": "Returns the BIP-44 coin type for this chain.", "attributes": "", "line": 495 }, { "name": "types::Chain::derivation_standard", "kind": "function_item", "signature": "pub fn derivation_standard(&self) -> &'static str;", "docs": "Returns the derivation standard name.", "attributes": "", "line": 508 }, { "name": "types::SigningMode", "kind": "enum_item", "signature": "pub enum SigningMode {\n /// Single party holds the complete key.\n Direct,\n /// Multiple parties participate via MPC.\n Mpc,\n /// Key resides in a TEE enclave.\n Tee,\n /// External key management system.\n External,\n}", "docs": "Signing ceremony mode (AEGIS Spec \u00a710.3).", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(rename_all = \"snake_case\")]", "line": 519 }, { "name": "types::BatchMode", "kind": "enum_item", "signature": "pub enum BatchMode {\n /// All transactions must succeed or none are signed.\n AllOrNothing,\n /// Sign only the authorized transactions.\n BestEffort,\n}", "docs": "Batch operation mode (AEGIS Spec \u00a710.6).", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(rename_all = \"snake_case\")]", "line": 533 }, { "name": "types::KeyRole", "kind": "enum_item", "signature": "pub enum KeyRole {\n /// Primary signing key for OAS Identity Documents.\n Identity,\n /// Used in challenge-response authentication.\n Authentication,\n /// Signing assertions and attestations.\n Assertion,\n /// Signing delegation proofs.\n Delegation,\n /// Temporary, scoped signing authority.\n Session,\n /// Used in key recovery procedures.\n Recovery,\n /// Signing blockchain transactions.\n Chain,\n}", "docs": "Key types and roles (AEGIS Spec \u00a76.1).", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(rename_all = \"snake_case\")]", "line": 547 }, { "name": "types::KeyGenerationMode", "kind": "enum_item", "signature": "pub enum KeyGenerationMode {\n /// Single party generates and holds the complete key.\n Direct,\n /// Distributed key generation via MPC.\n Mpc,\n /// Generated inside a TEE enclave.\n Tee,\n /// Generated on an HSM.\n Hsm,\n}", "docs": "Key generation mode (AEGIS Spec \u00a76.2).", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(rename_all = \"snake_case\")]", "line": 567 }, { "name": "types::ThresholdConfig", "kind": "struct_item", "signature": "pub struct ThresholdConfig {\n/// Minimum shares required (t).\n\npub threshold: u16,\n/// Total number of shares (n).\n\npub total_shares: u16\n}", "docs": "MPC threshold configuration (AEGIS Spec \u00a76.3).", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 580 }, { "name": "types::Guardian", "kind": "struct_item", "signature": "pub struct Guardian {\n/// Guardian type.\n\npub guardian_type: GuardianType,\n/// Guardian identifier (DID, email, phone, or device ID).\n\npub identifier: String,\n/// Weight toward the recovery threshold.\n\npub weight: u32\n}", "docs": "Guardian structure for social recovery (AEGIS Spec \u00a76.7).", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 589 }, { "name": "types::GuardianType", "kind": "enum_item", "signature": "pub enum GuardianType {\n /// OAS identity (DID).\n Identity,\n /// Email address.\n Email,\n /// Phone number.\n Phone,\n /// Hardware device.\n Hardware,\n}", "docs": "Guardian types for key recovery.", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(rename_all = \"snake_case\")]", "line": 601 }, { "name": "types::MAX_PAGE_SIZE", "kind": "const_item", "signature": "pub const MAX_PAGE_SIZE: i64;", "docs": "Maximum items per page.", "attributes": "", "line": 617 }, { "name": "types::DEFAULT_PAGE_SIZE", "kind": "const_item", "signature": "pub const DEFAULT_PAGE_SIZE: i64;", "docs": "Default items per page.", "attributes": "", "line": 620 }, { "name": "types::Pagination", "kind": "struct_item", "signature": "pub struct Pagination {\n/// Maximum number of items to return (1..=1000).\n\npub limit: i64,\n/// Number of items to skip (>= 0).\n\npub offset: i64\n}", "docs": "Shared pagination parameters for list queries.\n\n`limit` is clamped to `1..=MAX_PAGE_SIZE` and `offset` is clamped to `>= 0`.", "attributes": "#[derive(Debug, Clone, Copy, Serialize, Deserialize)]", "line": 626 }, { "name": "types::Pagination::new", "kind": "function_item", "signature": "pub fn new(limit: i64, offset: i64) -> Self;", "docs": "Create a new `Pagination` with clamped values.", "attributes": "", "line": 635 }, { "name": "types::RecoveryConfig", "kind": "struct_item", "signature": "pub struct RecoveryConfig {\n/// Designated recovery guardians.\n\npub guardians: Vec,\n/// Minimum total weight required for recovery.\n\npub threshold: u32,\n/// Mandatory delay before recovery executes (ISO 8601 duration).\n\npub timelock: String\n}", "docs": "Social recovery configuration (AEGIS Spec \u00a76.7).", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 654 } ], "parseErrors": false } ] }, { "name": "openagent-aegis-policy", "url": "/reference/rust/openagent-aegis-policy", "modules": [ { "module": "crate", "source": "aegis/openagent-aegis-policy/src/lib.rs", "sha256": "4d0513d5b022efc203ba22a565acaccec45761e802bc4d1102ac476636cdd6ab", "attributes": "", "items": [ { "name": "composition", "kind": "module", "signature": "pub mod composition;", "docs": "", "attributes": "", "line": 5 }, { "name": "contract", "kind": "module", "signature": "pub mod contract;", "docs": "", "attributes": "", "line": 6 }, { "name": "lineage", "kind": "module", "signature": "pub mod lineage;", "docs": "", "attributes": "", "line": 7 }, { "name": "spending", "kind": "module", "signature": "pub mod spending;", "docs": "", "attributes": "", "line": 8 }, { "name": "temporal", "kind": "module", "signature": "pub mod temporal;", "docs": "", "attributes": "", "line": 9 } ], "parseErrors": false }, { "module": "composition", "source": "aegis/openagent-aegis-policy/src/composition.rs", "sha256": "6b4d2e93ec58ba98a74ead0461584ac801c85007e6f5403b77df2ad71db2824a", "attributes": "", "items": [ { "name": "composition::compose_decisions", "kind": "function_item", "signature": "pub fn compose_decisions(decisions: &[PolicyDecision]) -> PolicyDecision;", "docs": "Compose multiple policy decisions into a single decision.\n\nFollows AEGIS composition rules:\n\n1. **Deny overrides**: If any decision has `allowed: false`, the final\n decision is denied. The reason is built from all deny reasons.\n\n2. **Obligations accumulate**: All obligations from allowed decisions\n are collected into the final decision.\n\n3. **Audit trail**: The composed audit info records all engines and\n policies evaluated across all input decisions.\n\nIf the input slice is empty, returns an allowed decision with no obligations\n(vacuous truth: no policies evaluated means no objections).", "attributes": "", "line": 29 } ], "parseErrors": false }, { "module": "contract", "source": "aegis/openagent-aegis-policy/src/contract.rs", "sha256": "9d21e57d47b6f7c9f646d2cf8eba95976db130f12ab31b6a297e6482e9951c03", "attributes": "", "items": [ { "name": "contract::ContractPolicy", "kind": "struct_item", "signature": "pub struct ContractPolicy {\n/// Allowed contract addresses. Empty list means all contracts are permitted.\n\npub contract_allowlist: Vec,\n/// Allowed function names. Empty list means all functions are permitted.\n\npub function_allowlist: Vec,\n/// Allowed blockchain chains. Empty list means all chains are permitted.\n\npub chain_allowlist: Vec,\n/// Maximum gas allowed for the interaction. None means no gas limit.\n\npub gas_limit: Option\n}", "docs": "Contract interaction policy dimensions.", "attributes": "#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]", "line": 15 }, { "name": "contract::ContractInteraction", "kind": "struct_item", "signature": "pub struct ContractInteraction {\n/// The target contract address.\n\npub contract_address: String,\n/// The function being called.\n\npub function_name: String,\n/// The blockchain chain for this interaction.\n\npub chain: String,\n/// Estimated gas usage. None if unknown.\n\npub gas_estimate: Option\n}", "docs": "A contract interaction to evaluate against policy.", "attributes": "#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]", "line": 28 }, { "name": "contract::ContractPolicyEvaluator", "kind": "struct_item", "signature": "pub struct ContractPolicyEvaluator;", "docs": "Evaluates contract interaction policy constraints.", "attributes": "", "line": 40 }, { "name": "contract::ContractPolicyEvaluator::evaluate", "kind": "function_item", "signature": "pub fn evaluate(\n policy: &ContractPolicy,\n interaction: &ContractInteraction,\n ) -> Result;", "docs": "Evaluate a contract interaction against the given policy.\n\nChecks the following dimensions in order:\n1. Contract allowlist -- the contract address must be in the allowed set.\n2. Function allowlist -- the function name must be in the allowed set.\n3. Chain allowlist -- the chain must be in the allowed set.\n4. Gas limit -- the gas estimate must not exceed the limit.\n\nEmpty allowlists are permissive (all values accepted).\nReturns a deny `PolicyDecision` with reason on the first violation found.\nReturns an allow `PolicyDecision` on success.", "attributes": "", "line": 54 } ], "parseErrors": false }, { "module": "lineage", "source": "aegis/openagent-aegis-policy/src/lineage.rs", "sha256": "f8f831d7a059cdd1915b904f69c08c4c2040cb0640998174f1b6bae5c366896c", "attributes": "", "items": [ { "name": "lineage::LineagePolicy", "kind": "struct_item", "signature": "pub struct LineagePolicy {\n/// Minimum conformance level required (0, 1, or 2).\n\npub min_conformance_level: Option,\n/// Maximum allowed lineage depth (hops to human root).\n\npub max_lineage_depth: Option,\n/// Required human root liveness period in days. If the human root's\n\n/// liveness status is not `Active`, the interaction may be denied or\n\n/// warned depending on the status.\n\npub required_human_root_liveness: Option,\n/// Required attestation types that must be present. Currently checked\n\n/// against `VerificationResult::warnings` for documentation purposes;\n\n/// a full implementation would check an attestation registry.\n\npub required_attestations: Vec,\n/// DIDs of human roots that are banned.\n\npub banned_human_roots: Vec\n}", "docs": "Lineage policy dimensions.", "attributes": "#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]", "line": 17 }, { "name": "lineage::LineagePolicyEvaluator", "kind": "struct_item", "signature": "pub struct LineagePolicyEvaluator;", "docs": "Evaluates lineage-aware policy constraints.", "attributes": "", "line": 35 }, { "name": "lineage::LineagePolicyEvaluator::evaluate", "kind": "function_item", "signature": "pub fn evaluate(\n policy: &LineagePolicy,\n verification: &VerificationResult,\n ) -> Result;", "docs": "Evaluate a lineage policy against a verification result.\n\nChecks the following dimensions in order:\n1. Banned human roots -- deny if the human root is in the banned list.\n2. Conformance level -- deny if below minimum.\n3. Lineage depth -- deny if exceeds maximum.\n4. Human root liveness -- deny if liveness status is not Active.\n5. Signature and lineage validity -- deny if not valid.\n\nReturns a deny `PolicyDecision` with reason on the first violation found.\nReturns an allow `PolicyDecision` on success.", "attributes": "", "line": 49 } ], "parseErrors": false }, { "module": "spending", "source": "aegis/openagent-aegis-policy/src/spending.rs", "sha256": "d738d77fb45bbce2138bd6339f2609b54478bbf9c2bea677092eeac3f0e3f302", "attributes": "", "items": [ { "name": "spending::TransactionInfo", "kind": "struct_item", "signature": "pub struct TransactionInfo {\n/// The asset being transferred (e.g. \"ETH\", \"USDC\").\n\npub asset: String,\n/// Decimal string representing the amount (e.g. \"1.5\").\n\npub amount: String,\n/// Recipient address.\n\npub recipient: String,\n/// Blockchain chain identifier.\n\npub chain: String\n}", "docs": "A transaction to evaluate against spending policies.", "attributes": "#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]", "line": 19 }, { "name": "spending::SpendingPolicyEvaluator", "kind": "struct_item", "signature": "pub struct SpendingPolicyEvaluator;", "docs": "Evaluates spending policy constraints against a transaction.", "attributes": "", "line": 31 }, { "name": "spending::SpendingPolicyEvaluator::evaluate", "kind": "function_item", "signature": "pub fn evaluate(\n limits: &SpendingLimits,\n tx: &TransactionInfo,\n daily_spent: &str,\n ) -> Result;", "docs": "Evaluate a transaction against spending limits.\n\nChecks the following dimensions in order:\n1. Asset allowlist -- the transaction asset must be in the allowed set.\n2. Recipient allowlist -- the recipient must be in the allowed set.\n3. Max amount per transaction.\n4. Daily volume (daily_spent + amount must not exceed daily_volume).\n5. Approval threshold -- if amount exceeds threshold, an Approve obligation is added.\n\nEmpty allowlists are permissive (all values accepted).\nReturns a deny `PolicyDecision` with reason on the first violation found.\nReturns an allow `PolicyDecision` on success, possibly with obligations.", "attributes": "", "line": 46 }, { "name": "spending::parse_amount", "kind": "function_item", "signature": "pub fn parse_amount(s: &str) -> Result;", "docs": "Parse a decimal string into an f64.\n\nReturns a `PolicyError::EvaluationFailed` if the string is not a valid number,\nis negative, or is non-finite (NaN / infinity).", "attributes": "", "line": 177 } ], "parseErrors": false }, { "module": "temporal", "source": "aegis/openagent-aegis-policy/src/temporal.rs", "sha256": "1bb6e72f5cc87d20e111ffad01127805ee6e9ff889de94235efcab0ac3737539", "attributes": "", "items": [ { "name": "temporal::TemporalPolicyEvaluator", "kind": "struct_item", "signature": "pub struct TemporalPolicyEvaluator;", "docs": "Evaluates temporal policy constraints.", "attributes": "", "line": 14 }, { "name": "temporal::TemporalPolicyEvaluator::evaluate", "kind": "function_item", "signature": "pub fn evaluate(\n constraints: &TemporalConstraints,\n now: DateTime,\n ) -> Result;", "docs": "Evaluate temporal constraints without cooldown checking.\n\nChecks:\n1. Validity window -- `now` must be between `valid_from` and `valid_until`.\n2. Active hours -- current hour must be within the active hours window.\n\nNote: active_hours check uses UTC hour. The timezone field on `ActiveHours`\nis recorded for documentation purposes but this evaluator operates in UTC\nto maintain determinism. Callers should convert `now` to the appropriate\ntimezone before calling if timezone-aware checks are required.", "attributes": "", "line": 27 }, { "name": "temporal::TemporalPolicyEvaluator::evaluate_with_cooldown", "kind": "function_item", "signature": "pub fn evaluate_with_cooldown(\n constraints: &TemporalConstraints,\n now: DateTime,\n last_operation: Option>,\n ) -> Result;", "docs": "Evaluate temporal constraints with optional cooldown checking.\n\nChecks all constraints from `evaluate` plus:\n3. Cooldown -- if `last_operation` is provided, ensures enough time has\n elapsed since the last operation per the cooldown duration.\n\nThe cooldown is specified as an ISO 8601 duration string. This evaluator\nsupports a simplified subset: `PT{n}S` (seconds), `PT{n}M` (minutes),\n`PT{n}H` (hours), and `P{n}D` (days).", "attributes": "", "line": 43 } ], "parseErrors": false } ] }, { "name": "openagent-aegis-sdk", "url": "/reference/rust/openagent-aegis-sdk", "modules": [ { "module": "crate", "source": "aegis/openagent-aegis-sdk/src/lib.rs", "sha256": "83968235678802fdbfb94a7eb82f2246bb076573da27fa4a3c6ab060e6e44b3a", "attributes": "", "items": [ { "name": "client", "kind": "module", "signature": "pub mod client;", "docs": "", "attributes": "", "line": 8 }, { "name": "config", "kind": "module", "signature": "pub mod config;", "docs": "", "attributes": "", "line": 9 }, { "name": "pub use client::{AegisClient, AegisStores};", "kind": "use_declaration", "signature": "pub use client::{AegisClient, AegisStores};", "docs": "", "attributes": "", "line": 11 }, { "name": "pub use config::{AegisConfig, StorageBackend};", "kind": "use_declaration", "signature": "pub use config::{AegisConfig, StorageBackend};", "docs": "", "attributes": "", "line": 12 }, { "name": "pub use aegis_auth;", "kind": "use_declaration", "signature": "pub use aegis_auth;", "docs": "", "attributes": "", "line": 15 }, { "name": "pub use aegis_delegate;", "kind": "use_declaration", "signature": "pub use aegis_delegate;", "docs": "", "attributes": "", "line": 16 }, { "name": "pub use aegis_keys;", "kind": "use_declaration", "signature": "pub use aegis_keys;", "docs": "", "attributes": "", "line": 17 }, { "name": "pub use aegis_verify;", "kind": "use_declaration", "signature": "pub use aegis_verify;", "docs": "", "attributes": "", "line": 18 }, { "name": "pub use aegis_wallet;", "kind": "use_declaration", "signature": "pub use aegis_wallet;", "docs": "", "attributes": "", "line": 19 }, { "name": "pub use openagent_aegis_core;", "kind": "use_declaration", "signature": "pub use openagent_aegis_core;", "docs": "", "attributes": "", "line": 20 }, { "name": "pub use openagent_aegis_policy;", "kind": "use_declaration", "signature": "pub use openagent_aegis_policy;", "docs": "", "attributes": "", "line": 21 } ], "parseErrors": false }, { "module": "client", "source": "aegis/openagent-aegis-sdk/src/client.rs", "sha256": "6ab6ca8c8d7eaa5cf749ada855fd6f79bf97d236811596e80512d7e1ebe079ce", "attributes": "", "items": [ { "name": "client::AegisStores", "kind": "struct_item", "signature": "pub struct AegisStores {\n/// Session persistence store.\n\npub session_store: Arc,\n/// Nonce tracking store (replay prevention).\n\npub nonce_store: Arc,\n/// Delegation persistence store.\n\npub delegation_store: Arc,\n/// Revocation tracking store.\n\npub revocation_store: Arc,\n/// Key persistence store.\n\npub key_store: Arc,\n/// Verification result cache store.\n\npub verification_cache_store: Arc\n}", "docs": "Collection of pluggable storage backends for the AEGIS client.\n\nAll stores are wrapped in `Arc` for safe shared access. By default\nthe client uses in-memory implementations; callers can provide\nPostgreSQL-backed (or any other) implementations via the\n[`AegisClient::with_stores`] constructor.", "attributes": "", "line": 43 }, { "name": "client::AegisClient", "kind": "struct_item", "signature": "pub struct AegisClient {\n/// Plugin registry for DID resolvers, auth providers, and the policy engine.\n\npub registry: Arc,\n/// Verification pipeline (resolution -> signature -> lineage -> revocation -> liveness -> cache).\n\npub verifier: VerificationPipeline,\n/// Session manager.\n\npub sessions: SessionManager,\n/// Delegation tree for tracking active delegations.\n\npub delegations: DelegationTree,\n/// Transaction authorization pipeline (present only when a signing backend is provided).\n\npub transactions: Option,\n/// Configuration snapshot.\n\npub config: AegisConfig,\n/// Pluggable persistent storage backends.\n\npub stores: AegisStores\n}", "docs": "Unified AEGIS client.\n\nHolds a [`PluginRegistry`], a verification pipeline, a session manager, a\ndelegation tree, and optionally a transaction pipeline. The client also\nexposes pluggable [`AegisStores`] for async persistent storage backends.", "attributes": "", "line": 76 }, { "name": "client::AegisClient::new", "kind": "function_item", "signature": "pub fn new(registry: Arc, config: AegisConfig) -> Self;", "docs": "Create a new AEGIS client with the given plugin registry and config.\n\nUses in-memory storage backends by default. No signing backend is\nattached; call [`with_signer`](Self::with_signer) to enable the\ntransaction pipeline, or [`with_stores`](Self::with_stores) to\ninject custom storage backends.", "attributes": "", "line": 100 }, { "name": "client::AegisClient::with_stores", "kind": "function_item", "signature": "pub fn with_stores(\n registry: Arc,\n config: AegisConfig,\n stores: AegisStores,\n ) -> Self;", "docs": "Create a new AEGIS client with custom storage backends.\n\nThis constructor allows callers to inject PostgreSQL-backed or other\npersistent storage implementations for all AEGIS storage traits.", "attributes": "", "line": 126 }, { "name": "client::AegisClient::with_defaults", "kind": "function_item", "signature": "pub fn with_defaults(registry: Arc) -> Self;", "docs": "Create a client with default configuration.", "attributes": "", "line": 153 }, { "name": "client::AegisClient::with_signer", "kind": "function_item", "signature": "pub fn with_signer(mut self, signer: Arc) -> Self;", "docs": "Attach a signing backend so the transaction pipeline is available.", "attributes": "", "line": 158 }, { "name": "client::AegisClient::verify_identity", "kind": "function_item", "signature": "pub async fn verify_identity(\n &self,\n did: &str,\n ) -> Result;", "docs": "Verify an identity by DID.\n\nRuns the full verification pipeline: resolution -> signature -> lineage ->\nrevocation -> liveness. Results are cached according to the verification\nconfig TTL.", "attributes": "", "line": 170 }, { "name": "client::AegisClient::verify_identity_fresh", "kind": "function_item", "signature": "pub async fn verify_identity_fresh(\n &self,\n did: &str,\n ) -> Result;", "docs": "Verify an identity, bypassing the cache.", "attributes": "", "line": 178 }, { "name": "client::AegisClient::authenticate", "kind": "function_item", "signature": "pub async fn authenticate(\n &self,\n credential: &AuthCredential,\n identity_type: IdentityType,\n ) -> Result;", "docs": "Authenticate a credential through the registered auth providers.\n\nOn success a new [`Session`] is created and returned.", "attributes": "", "line": 190 }, { "name": "client::AegisClient::get_session", "kind": "function_item", "signature": "pub fn get_session(&self, session_id: &str) -> Result;", "docs": "Look up a session by its ID.", "attributes": "", "line": 215 }, { "name": "client::AegisClient::revoke_session", "kind": "function_item", "signature": "pub fn revoke_session(&self, session_id: &str) -> Result<(), AuthError>;", "docs": "Revoke a session.", "attributes": "", "line": 220 }, { "name": "client::AegisClient::is_session_valid", "kind": "function_item", "signature": "pub fn is_session_valid(&self, session_id: &str) -> bool;", "docs": "Check whether a session is still valid (exists and not expired).", "attributes": "", "line": 225 }, { "name": "client::AegisClient::authorize", "kind": "function_item", "signature": "pub async fn authorize(&self, request: &PolicyRequest) -> Result;", "docs": "Evaluate a policy request through the registered policy engine.", "attributes": "", "line": 232 }, { "name": "client::AegisClient::compose_policy_decisions", "kind": "function_item", "signature": "pub fn compose_policy_decisions(&self, decisions: &[PolicyDecision]) -> PolicyDecision;", "docs": "Compose multiple policy decisions using deny-overrides (spec SS8.6).", "attributes": "", "line": 237 }, { "name": "client::AegisClient::delegate", "kind": "function_item", "signature": "pub fn delegate(\n &mut self,\n delegator_did: &str,\n delegate_did: &str,\n scope: DelegationScope,\n expires: Option>,\n signing_key: &SigningKey,\n verification_method: &str,\n ) -> Result;", "docs": "Create a delegation from `delegator_did` to `delegate_did` with the\ngiven scope, signed by the delegator's key.\n\nThe delegation is automatically added to the internal delegation tree.", "attributes": "", "line": 247 }, { "name": "client::AegisClient::verify_delegation", "kind": "function_item", "signature": "pub fn verify_delegation(\n &self,\n delegation: &Delegation,\n delegator_public_key: &VerifyingKey,\n ) -> Result;", "docs": "Verify a delegation proof against the delegator's public key.", "attributes": "", "line": 270 }, { "name": "client::AegisClient::revoke_delegation", "kind": "function_item", "signature": "pub fn revoke_delegation(\n &mut self,\n delegation_id: &str,\n ) -> Result, DelegationError>;", "docs": "Revoke a delegation by ID. Cascading: all child delegations derived\nfrom the revoked delegation are also revoked.\n\nReturns the list of revoked delegation IDs.", "attributes": "", "line": 282 }, { "name": "client::AegisClient::sign_transaction", "kind": "function_item", "signature": "pub async fn sign_transaction(\n &self,\n tx: Transaction,\n auth: &AuthContext,\n policy_decision: &PolicyDecision,\n ) -> Result;", "docs": "Authorize and sign a transaction through the full pipeline:\nverify identity -> check delegation -> evaluate policy -> fulfill\nobligations -> sign.\n\nRequires a signing backend to be attached via [`with_signer`](Self::with_signer).", "attributes": "", "line": 296 } ], "parseErrors": false }, { "module": "config", "source": "aegis/openagent-aegis-sdk/src/config.rs", "sha256": "06a2b6645268ef69be09316360676a4fbdf065ffc1b428de4559bd41fd97615f", "attributes": "", "items": [ { "name": "config::AegisConfig", "kind": "struct_item", "signature": "pub struct AegisConfig {\n/// Verification pipeline settings.\n\n#[serde(default)]\npub verification: VerificationConfig,\n/// Session lifetime settings.\n\n#[serde(default)]\npub sessions: SessionConfig,\n/// Key storage settings.\n\n#[serde(default)]\npub keys: KeyConfig,\n/// Storage backend selection.\n\n#[serde(default)]\npub storage_backend: StorageBackend\n}", "docs": "Top-level AEGIS SDK configuration.\n\nCorresponds to the YAML configuration format defined in AEGIS Spec Appendix B.\nControls verification behaviour, session lifetimes, and key storage parameters.", "attributes": "#[derive(Debug, Clone, Default, Serialize, Deserialize)]", "line": 13 }, { "name": "config::SessionConfig", "kind": "struct_item", "signature": "pub struct SessionConfig {\n/// Maximum lifetime for human sessions in seconds (default: 86400 = 24h).\n\npub human_lifetime_secs: u64,\n/// Maximum lifetime for agent sessions in seconds (default: 3600 = 1h).\n\npub agent_lifetime_secs: u64,\n/// Maximum lifetime for session keys in seconds (default: 86400 = 24h).\n\npub session_key_max_secs: u64\n}", "docs": "Session lifetime configuration.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 33 }, { "name": "config::StorageBackend", "kind": "enum_item", "signature": "pub enum StorageBackend {\n /// In-memory storage (default). Suitable for testing and single-instance\n /// deployments.\n #[default]\n InMemory,\n /// PostgreSQL-backed storage. Requires a valid connection URL.\n Postgres {\n /// PostgreSQL connection URL (e.g., `postgres://user:pass@host/db`).\n url: String,\n },\n}", "docs": "Storage backend selection.\n\nControls which persistence layer the SDK uses for sessions, nonces,\ndelegations, revocations, and verification cache.", "attributes": "#[derive(Debug, Clone, Default, Serialize, Deserialize)]\n#[serde(tag = \"type\", rename_all = \"snake_case\")]", "line": 58 }, { "name": "config::KeyConfig", "kind": "struct_item", "signature": "pub struct KeyConfig {\n/// Encryption algorithm for at-rest keys (default: \"AES-256-GCM\").\n\npub encryption_algorithm: String,\n/// Whether to zeroize key material on drop (default: true).\n\npub zeroize_on_drop: bool\n}", "docs": "Key storage configuration.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 72 } ], "parseErrors": false } ] }, { "name": "arsenal-broker", "url": "/reference/rust/arsenal-broker", "modules": [ { "module": "crate", "source": "arsenal/crates/arsenal-broker/src/lib.rs", "sha256": "96b1bed6734958c5c5c0ce05651f84f2023928d166c7b91899604391a930a526", "attributes": "", "items": [ { "name": "audit_sink", "kind": "module", "signature": "pub mod audit_sink;", "docs": "", "attributes": "", "line": 83 }, { "name": "config", "kind": "module", "signature": "pub mod config;", "docs": "", "attributes": "", "line": 84 }, { "name": "consent_service", "kind": "module", "signature": "pub mod consent_service;", "docs": "", "attributes": "", "line": 85 }, { "name": "handlers", "kind": "module", "signature": "pub mod handlers;", "docs": "", "attributes": "", "line": 86 }, { "name": "metrics", "kind": "module", "signature": "pub mod metrics;", "docs": "", "attributes": "", "line": 87 }, { "name": "middleware", "kind": "module", "signature": "pub mod middleware;", "docs": "", "attributes": "", "line": 88 }, { "name": "proxy_config", "kind": "module", "signature": "pub mod proxy_config;", "docs": "", "attributes": "", "line": 89 }, { "name": "proxy_service", "kind": "module", "signature": "pub mod proxy_service;", "docs": "", "attributes": "", "line": 90 }, { "name": "rate", "kind": "module", "signature": "pub mod rate;", "docs": "", "attributes": "", "line": 91 }, { "name": "revocation", "kind": "module", "signature": "pub mod revocation;", "docs": "", "attributes": "", "line": 92 }, { "name": "server", "kind": "module", "signature": "pub mod server;", "docs": "", "attributes": "", "line": 93 }, { "name": "service", "kind": "module", "signature": "pub mod service;", "docs": "", "attributes": "", "line": 94 }, { "name": "ssrf_guard", "kind": "module", "signature": "pub mod ssrf_guard;", "docs": "", "attributes": "", "line": 95 }, { "name": "pub use config::BrokerConfig;", "kind": "use_declaration", "signature": "pub use config::BrokerConfig;", "docs": "", "attributes": "", "line": 98 }, { "name": "pub use consent_service::ConsentService;", "kind": "use_declaration", "signature": "pub use consent_service::ConsentService;", "docs": "", "attributes": "", "line": 99 }, { "name": "pub use proxy_config::{ConsentConfig, ProxyConfig};", "kind": "use_declaration", "signature": "pub use proxy_config::{ConsentConfig, ProxyConfig};", "docs": "", "attributes": "", "line": 100 }, { "name": "pub use proxy_service::ProxyService;", "kind": "use_declaration", "signature": "pub use proxy_service::ProxyService;", "docs": "", "attributes": "", "line": 101 }, { "name": "pub use server::BrokerServer;", "kind": "use_declaration", "signature": "pub use server::BrokerServer;", "docs": "", "attributes": "", "line": 102 }, { "name": "pub use service::{BrokerService, RegisteredAgent, RequestContext};", "kind": "use_declaration", "signature": "pub use service::{BrokerService, RegisteredAgent, RequestContext};", "docs": "", "attributes": "", "line": 103 }, { "name": "pub use ssrf_guard::SsrfGuard;", "kind": "use_declaration", "signature": "pub use ssrf_guard::SsrfGuard;", "docs": "", "attributes": "", "line": 104 }, { "name": "prelude", "kind": "module", "signature": "pub mod prelude;", "docs": "Prelude for common imports", "attributes": "", "line": 107 }, { "name": "pub use super::config::BrokerConfig;", "kind": "use_declaration", "signature": "pub use super::config::BrokerConfig;", "docs": "", "attributes": "", "line": 108 }, { "name": "pub use super::consent_service::ConsentService;", "kind": "use_declaration", "signature": "pub use super::consent_service::ConsentService;", "docs": "", "attributes": "", "line": 109 }, { "name": "pub use super::proxy_config::{ConsentConfig, ProxyConfig};", "kind": "use_declaration", "signature": "pub use super::proxy_config::{ConsentConfig, ProxyConfig};", "docs": "", "attributes": "", "line": 110 }, { "name": "pub use super::proxy_service::ProxyService;", "kind": "use_declaration", "signature": "pub use super::proxy_service::ProxyService;", "docs": "", "attributes": "", "line": 111 }, { "name": "pub use super::server::BrokerServer;", "kind": "use_declaration", "signature": "pub use super::server::BrokerServer;", "docs": "", "attributes": "", "line": 112 }, { "name": "pub use super::service::{BrokerService, RegisteredAgent};", "kind": "use_declaration", "signature": "pub use super::service::{BrokerService, RegisteredAgent};", "docs": "", "attributes": "", "line": 113 }, { "name": "pub use super::ssrf_guard::SsrfGuard;", "kind": "use_declaration", "signature": "pub use super::ssrf_guard::SsrfGuard;", "docs": "", "attributes": "", "line": 114 } ], "parseErrors": false }, { "module": "audit_sink", "source": "arsenal/crates/arsenal-broker/src/audit_sink.rs", "sha256": "eadf9c8a5735b18817d1a2389c227dd0ae30fc7a73e5869a3039aedb3b1c3e75", "attributes": "", "items": [ { "name": "audit_sink::AuditSinkResult", "kind": "type_item", "signature": "pub type AuditSinkResult = Result;", "docs": "Result type for audit sink operations", "attributes": "", "line": 19 }, { "name": "audit_sink::AuditSinkError", "kind": "enum_item", "signature": "pub enum AuditSinkError {\n /// I/O error\n #[error(\"I/O error: {0}\")]\n IoError(#[from] std::io::Error),\n\n /// Serialization error\n #[error(\"Serialization error: {0}\")]\n SerializationError(String),\n\n /// Connection error\n #[error(\"Connection error: {0}\")]\n ConnectionError(String),\n\n /// Sink is closed\n #[error(\"Sink is closed\")]\n Closed,\n\n /// Buffer overflow\n #[error(\"Buffer overflow\")]\n BufferOverflow,\n}", "docs": "Errors from audit sinks", "attributes": "#[derive(Debug, thiserror::Error)]", "line": 23 }, { "name": "audit_sink::AuditSink", "kind": "trait_item", "signature": "pub trait AuditSink: Send + Sync {\n /// Emit an audit event\n fn emit(&self, event: AuditEvent) -> BoxFuture<'_, AuditSinkResult<()>>;\n\n /// Flush any buffered events\n fn flush(&self) -> BoxFuture<'_, AuditSinkResult<()>>;\n\n /// Close the sink\n fn close(&self) -> BoxFuture<'_, AuditSinkResult<()>>;\n}", "docs": "Trait for audit event sinks (object-safe version)", "attributes": "", "line": 49 }, { "name": "audit_sink::NoOpAuditSink", "kind": "struct_item", "signature": "pub struct NoOpAuditSink;", "docs": "No-op audit sink (for testing or when auditing is disabled)", "attributes": "", "line": 61 }, { "name": "audit_sink::TracingAuditSink", "kind": "struct_item", "signature": "pub struct TracingAuditSink {\n\n}", "docs": "Tracing-based audit sink (logs to tracing framework)", "attributes": "", "line": 78 }, { "name": "audit_sink::TracingAuditSink::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Create a new tracing audit sink\n\n# Returns\nA new tracing audit sink", "attributes": "#[must_use]", "line": 88 }, { "name": "audit_sink::TracingAuditSink::with_full_event", "kind": "function_item", "signature": "pub fn with_full_event(mut self) -> Self;", "docs": "Enable full event logging", "attributes": "#[must_use]", "line": 96 }, { "name": "audit_sink::FileAuditSink", "kind": "struct_item", "signature": "pub struct FileAuditSink {\n\n}", "docs": "File-based audit sink with append-only logging", "attributes": "", "line": 148 }, { "name": "audit_sink::FileAuditSink::new", "kind": "function_item", "signature": "pub fn new(path: impl AsRef) -> Result;", "docs": "Create a new file audit sink\n\n# Parameters\n* `path` - The path to the audit log file\n\n# Errors\n\nReturns an error if the log file cannot be created or opened.\n\n# Returns\nA new file audit sink", "attributes": "", "line": 169 }, { "name": "audit_sink::FileAuditSink::with_buffer_size", "kind": "function_item", "signature": "pub fn with_buffer_size(mut self, size: usize) -> Self;", "docs": "Set the buffer size for the file audit sink\n\n# Parameters\n* `size` - The buffer size\n\n# Returns\nA new file audit sink", "attributes": "#[must_use]", "line": 198 }, { "name": "audit_sink::FileAuditSink::without_hash_chain", "kind": "function_item", "signature": "pub fn without_hash_chain(mut self) -> Self;", "docs": "Disable hash chain for the file audit sink\n\n# Returns\nA new file audit sink", "attributes": "#[must_use]", "line": 208 }, { "name": "audit_sink::FileAuditSink::rotate", "kind": "function_item", "signature": "pub async fn rotate(&self) -> Result;", "docs": "Rotate the audit log file\n\n# Errors\n\nReturns an error if the file cannot be flushed, renamed, or recreated.\n\n# Returns\nThe path to the rotated audit log file", "attributes": "", "line": 221 }, { "name": "audit_sink::CompositeAuditSink", "kind": "struct_item", "signature": "pub struct CompositeAuditSink {\n\n}", "docs": "Composite audit sink that writes to multiple sinks", "attributes": "", "line": 316 }, { "name": "audit_sink::CompositeAuditSink::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Create a new composite audit sink\n\n# Returns\nA new composite audit sink", "attributes": "#[must_use]", "line": 327 }, { "name": "audit_sink::CompositeAuditSink::with_sink", "kind": "function_item", "signature": "pub fn with_sink(mut self, sink: Arc) -> Self;", "docs": "Add a sink to the composite audit sink\n\n# Parameters\n* `sink` - The sink to add\n\n# Returns\nA new composite audit sink", "attributes": "#[must_use]", "line": 342 }, { "name": "audit_sink::CompositeAuditSink::fail_fast", "kind": "function_item", "signature": "pub fn fail_fast(mut self) -> Self;", "docs": "Set the fail fast flag for the composite audit sink\n\n# Returns\nA new composite audit sink", "attributes": "#[must_use]", "line": 352 }, { "name": "audit_sink::AsyncBufferedSink", "kind": "struct_item", "signature": "pub struct AsyncBufferedSink {\n\n}", "docs": "Async buffered sink with background flushing", "attributes": "", "line": 413 }, { "name": "audit_sink::AsyncBufferedSink::new", "kind": "function_item", "signature": "pub fn new(inner: Arc, buffer_size: usize) -> Self;", "docs": "Create a new async buffered audit sink\n\n# Parameters\n* `inner` - The inner audit sink\n* `buffer_size` - The buffer size\n\n# Returns\nA new async buffered audit sink", "attributes": "", "line": 428 } ], "parseErrors": false }, { "module": "config", "source": "arsenal/crates/arsenal-broker/src/config.rs", "sha256": "2db572d12b603005b5072a055012e88c8a2824075307b48b2b83b81a6e84d120", "attributes": "", "items": [ { "name": "config::BrokerConfig", "kind": "struct_item", "signature": "pub struct BrokerConfig {\n/// Server configuration\n\n#[serde(default)]\npub server: ServerConfig,\n/// TLS configuration\n\n#[serde(default)]\npub tls: TlsConfig,\n/// Token configuration\n\n#[serde(default)]\npub token: TokenConfig,\n/// Rate limiting configuration\n\n#[serde(default)]\npub rate_limit: RateLimitConfig,\n/// Authentication / trust boundary configuration\n\n#[serde(default)]\npub auth: AuthConfig,\n/// Audit configuration\n\n#[serde(default)]\npub audit: AuditConfig,\n/// Revocation storage configuration\n\n#[serde(default)]\npub revocation: RevocationConfig,\n/// Credential proxy configuration\n\n#[serde(default)]\npub proxy: ProxyConfig,\n/// Consent service configuration\n\n#[serde(default)]\npub consent: ConsentConfig,\n/// Issuer identifier\n\n#[serde(default = \"default_issuer\")]\npub issuer: String\n}", "docs": "Broker configuration", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 13 }, { "name": "config::BrokerConfig::listen_addr", "kind": "function_item", "signature": "pub fn listen_addr(&self) -> &str;", "docs": "Default listen address", "attributes": "#[must_use]", "line": 62 }, { "name": "config::BrokerConfig::default_token_ttl", "kind": "function_item", "signature": "pub fn default_token_ttl(&self) -> i64;", "docs": "Default token TTL", "attributes": "#[must_use]", "line": 68 }, { "name": "config::BrokerConfig::max_token_ttl", "kind": "function_item", "signature": "pub fn max_token_ttl(&self) -> i64;", "docs": "Maximum token TTL", "attributes": "#[must_use]", "line": 74 }, { "name": "config::AuthConfig", "kind": "struct_item", "signature": "pub struct AuthConfig {\n/// Require a verified client identity on protected endpoints.\n\n///\n\n/// Protected endpoints include:\n\n/// - `/v1/capabilities`\n\n/// - `/v1/secrets`\n\n/// - `/v1/tokens/revoke`\n\n#[serde(default = \"default_require_verified_client_identity\")]\npub require_verified_client_identity: bool,\n/// Trust `X-Client-Cert-Fingerprint` header **only** when requests come from an explicitly\n\n/// allowlisted internal proxy.\n\n///\n\n/// This is intended for deployments where TLS is terminated by an internal, verified proxy\n\n/// that injects the fingerprint header after mutual authentication.\n\n#[serde(default)]\npub trust_fingerprint_header: bool,\n/// Allowlisted proxy IPs permitted to inject `X-Client-Cert-Fingerprint`.\n\n///\n\n/// When `trust_fingerprint_header` is `true`, requests with a remote IP in this list may\n\n/// supply `X-Client-Cert-Fingerprint`. Requests from other IPs will have the header ignored.\n\n#[serde(default)]\npub trusted_proxy_ips: Vec\n}", "docs": "Authentication configuration\n\nProduction defaults are **strict**:\n- Protected endpoints require a verified client identity (mTLS-derived fingerprint)\n- The broker does **not** trust client fingerprint headers unless explicitly configured", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 102 }, { "name": "config::ServerConfig", "kind": "struct_item", "signature": "pub struct ServerConfig {\n/// Listen address\n\n#[serde(default = \"default_listen_addr\")]\npub listen_addr: String,\n/// Request timeout\n\n#[serde(default = \"default_request_timeout\")]\npub request_timeout_secs: u64,\n/// Maximum request body size\n\n#[serde(default = \"default_max_body_size\")]\npub max_body_size: usize,\n/// Enable CORS\n\n#[serde(default)]\npub enable_cors: bool,\n/// Allowed CORS origins\n\n#[serde(default)]\npub cors_origins: Vec,\n/// Graceful shutdown timeout\n\n#[serde(default = \"default_shutdown_timeout\")]\npub shutdown_timeout_secs: u64\n}", "docs": "Server configuration", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 144 }, { "name": "config::TlsConfig", "kind": "struct_item", "signature": "pub struct TlsConfig {\n/// Enable TLS\n\n#[serde(default = \"default_tls_enabled\")]\npub enabled: bool,\n/// TLS certificate path\n\n#[serde(default = \"default_cert_path\")]\npub cert_path: PathBuf,\n/// TLS key path\n\n#[serde(default = \"default_key_path\")]\npub key_path: PathBuf,\n/// CA certificate path for client verification\n\n#[serde(default = \"default_ca_path\")]\npub ca_cert_path: PathBuf,\n/// Require client certificates (mTLS)\n\n#[serde(default = \"default_require_client_cert\")]\npub require_client_cert: bool,\n/// Minimum TLS version (1.2 or 1.3)\n\n#[serde(default = \"default_min_tls_version\")]\npub min_tls_version: String\n}", "docs": "TLS configuration", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 201 }, { "name": "config::TokenConfig", "kind": "struct_item", "signature": "pub struct TokenConfig {\n/// Default token seconds\n\n#[serde(default = \"default_token_ttl\")]\npub default_ttl_seconds: i64,\n/// Maximum token TTL in seconds\n\n#[serde(default = \"default_max_token_ttl\")]\npub max_ttl_seconds: i64,\n/// Minimum token TTL in seconds\n\n#[serde(default = \"default_min_token_ttl\")]\npub min_ttl_seconds: i64,\n/// Require proof-of-possession by default\n\n#[serde(default)]\npub require_pop_by_default: bool,\n/// Token signing algorithm\n\n#[serde(default = \"default_signing_algorithm\")]\npub signing_algorithm: String\n}", "docs": "Token configuration", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 266 }, { "name": "config::RateLimitConfig", "kind": "struct_item", "signature": "pub struct RateLimitConfig {\n/// Enable rate limiting\n\n#[serde(default = \"default_rate_limit_enabled\")]\npub enabled: bool,\n/// Requests per second per agent\n\n#[serde(default = \"default_requests_per_second\")]\npub requests_per_second: u64,\n/// Burst size\n\n#[serde(default = \"default_burst_size\")]\npub burst_size: u64,\n/// Capability request rate limit\n\n#[serde(default = \"default_capability_rate\")]\npub capability_requests_per_minute: u64,\n/// Secret request rate limit\n\n#[serde(default = \"default_secret_rate\")]\npub secret_requests_per_minute: u64\n}", "docs": "Rate limiting configuration", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 318 }, { "name": "config::AuditConfig", "kind": "struct_item", "signature": "pub struct AuditConfig {\n/// Enable audit logging\n\n#[serde(default = \"default_audit_enabled\")]\npub enabled: bool,\n/// Audit log file path\n\n#[serde(default)]\npub log_path: Option,\n/// Enable hash chain for audit integrity\n\n#[serde(default = \"default_hash_chain\")]\npub enable_hash_chain: bool,\n/// Webhook URL for audit events\n\n#[serde(default)]\npub webhook_url: Option,\n/// Webhook authorization header\n\n#[serde(default)]\npub webhook_auth: Option,\n/// Buffer size for async\n\n#[serde(default = \"default_audit_buffer\")]\npub buffer_size: usize\n}", "docs": "Audit configuration", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 374 }, { "name": "config::RevocationConfig", "kind": "struct_item", "signature": "pub struct RevocationConfig {\n/// Storage backend for revocations\n\n#[serde(default)]\npub backend: RevocationBackend,\n/// File path for the file backend (JSONL log + snapshots)\n\n#[serde(default)]\npub file_path: Option,\n/// SQL backend configuration\n\n#[serde(default)]\npub sql: RevocationSqlConfig,\n/// HTTP backend configuration\n\n#[serde(default)]\npub http: RevocationHttpConfig,\n/// Compaction interval in seconds (0 disables)\n\n#[serde(default = \"default_revocation_compaction_interval_secs\")]\npub compaction_interval_secs: u64,\n/// Max entries to retain in memory before forcing cleanup\n\n#[serde(default = \"default_revocation_max_entries\")]\npub max_entries: usize,\n/// fsync on revoke/unrevoke writes (stronger durability, higher latency)\n\n#[serde(default = \"default_revocation_fsync_on_write\")]\npub fsync_on_write: bool\n}", "docs": "Revocation storage configuration", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 427 }, { "name": "config::RevocationBackend", "kind": "enum_item", "signature": "pub enum RevocationBackend {\n /// In-memory only (restart loses revocations)\n #[default]\n Memory,\n /// File-backed (restart-safe on the same node)\n File,\n /// SQL-backed (Postgres/SQLite) revocation store\n Sql,\n /// HTTP-backed revocation store (external service)\n Http,\n}", "docs": "Revocation storage backend.", "attributes": "#[derive(Debug, Clone, Copy, Default, Serialize, Deserialize, PartialEq, Eq)]\n#[serde(rename_all = \"snake_case\")]", "line": 460 }, { "name": "config::RevocationSqlConfig", "kind": "struct_item", "signature": "pub struct RevocationSqlConfig {\n/// Database URL (e.g. `postgres://...` or `sqlite:///...`)\n\n#[serde(default)]\npub database_url: Option,\n/// Table name to use for revocations\n\n#[serde(default = \"default_revocation_sql_table\")]\npub table: String,\n/// Max database connections in the pool\n\n#[serde(default = \"default_revocation_sql_max_connections\")]\npub max_connections: u32,\n/// Connection timeout (seconds)\n\n#[serde(default = \"default_revocation_sql_connect_timeout_secs\")]\npub connect_timeout_secs: u64\n}", "docs": "SQL revocation backend configuration.\n\nSupports `PostgreSQL` and `SQLite` via `sqlx` and a single table.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 504 }, { "name": "config::RevocationHttpConfig", "kind": "struct_item", "signature": "pub struct RevocationHttpConfig {\n/// Base URL of the revocation service (e.g. `https://revocations.internal`)\n\n#[serde(default)]\npub base_url: Option,\n/// Allow insecure `http://` base URLs (default: false).\n\n///\n\n/// Production deployments should prefer mTLS/HTTPS for this integration.\n\n#[serde(default = \"default_revocation_http_allow_insecure\")]\npub allow_insecure: bool,\n/// Optional Authorization header value to include (e.g. `Bearer ...`)\n\n#[serde(default)]\npub auth_header: Option,\n/// Request timeout (seconds)\n\n#[serde(default = \"default_revocation_http_timeout_secs\")]\npub timeout_secs: u64,\n/// Positive cache TTL (seconds) for `is_revoked`/`get` results\n\n#[serde(default = \"default_revocation_http_cache_ttl_secs\")]\npub cache_ttl_secs: u64,\n/// Negative cache TTL (seconds) for not-revoked results\n\n#[serde(default = \"default_revocation_http_negative_cache_ttl_secs\")]\npub negative_cache_ttl_secs: u64,\n/// Maximum TTL (seconds) for positive cache entries when token expiry is known.\n\n///\n\n/// When the HTTP revocation service returns `original_expiry_ms`, the broker can safely cache\n\n/// a *revoked* result until (expiry + grace), capped by this maximum.\n\n#[serde(default = \"default_revocation_http_positive_cache_max_ttl_secs\")]\npub positive_cache_max_ttl_secs: u64\n}", "docs": "HTTP revocation backend configuration.\n\nThe broker will call an external revocation service for checks and writes.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 549 }, { "name": "config::BrokerConfig::from_env", "kind": "function_item", "signature": "pub fn from_env() -> Self;", "docs": "Load configuration from environment variables", "attributes": "#[allow(clippy::too_many_lines)]\n#[must_use]", "line": 624 }, { "name": "config::BrokerConfig::from_file", "kind": "function_item", "signature": "pub fn from_file(path: impl AsRef) -> Result;", "docs": "Load configuration from a TOML file\n\n# Errors\nReturns an error if the file cannot be read or parsed", "attributes": "", "line": 794 }, { "name": "config::BrokerConfig::validate", "kind": "function_item", "signature": "pub fn validate(&self) -> Result<(), ConfigError>;", "docs": "Validate the configuration\n\n# Errors\nReturns an error if the configuration is invalid", "attributes": "#[allow(clippy::too_many_lines)]", "line": 807 }, { "name": "config::ConfigError", "kind": "enum_item", "signature": "pub enum ConfigError {\n /// I/O error\n #[error(\"I/O error: {0}\")]\n IoError(String),\n\n /// Parse error\n #[error(\"Parse error: {0}\")]\n ParseError(String),\n\n /// Validation error\n #[error(\"Validation error: {0}\")]\n ValidationError(String),\n}", "docs": "Configuration errors", "attributes": "#[derive(Debug, thiserror::Error)]", "line": 947 } ], "parseErrors": false }, { "module": "consent_service", "source": "arsenal/crates/arsenal-broker/src/consent_service.rs", "sha256": "d5bc3cfdbde82b3e2544445f990fce58684a28f34883bbf99c3b2e6ff7950a06", "attributes": "", "items": [ { "name": "consent_service::ConsentService", "kind": "struct_item", "signature": "pub struct ConsentService {\n\n}", "docs": "Service for managing consent records.", "attributes": "", "line": 32 }, { "name": "consent_service::ConsentService::new", "kind": "function_item", "signature": "pub fn new(\n consent_store: Arc,\n audit_sink: Arc,\n config: ConsentConfig,\n ) -> Self;", "docs": "Create a new consent service without signature verification.", "attributes": "#[must_use]", "line": 46 }, { "name": "consent_service::ConsentService::with_key_resolver", "kind": "function_item", "signature": "pub fn with_key_resolver(\n consent_store: Arc,\n audit_sink: Arc,\n key_resolver: Arc,\n config: ConsentConfig,\n ) -> Self;", "docs": "Create a consent service with signature verification enabled.", "attributes": "#[must_use]", "line": 61 }, { "name": "consent_service::ConsentService::check_consent", "kind": "function_item", "signature": "pub async fn check_consent(\n &self,\n agent_did: &str,\n variable: &str,\n tenant_id: &TenantId,\n ) -> ArsenalResult;", "docs": "Check if valid consent exists for an agent, variable, and tenant.\n\nConsent records are scoped to a tenant to prevent cross-tenant\nconsent leakage in multi-tenant deployments.\n\n# Errors\n\nReturns an error if the consent store lookup fails.", "attributes": "", "line": 83 }, { "name": "consent_service::ConsentService::approve_consent", "kind": "function_item", "signature": "pub async fn approve_consent(\n &self,\n record: ConsentRecord,\n tenant_id: &TenantId,\n ctx: &RequestContext,\n ) -> ArsenalResult;", "docs": "Store an approved consent record.\n\n# Errors\n\nReturns an error if the record is invalid or storage fails.", "attributes": "", "line": 114 }, { "name": "consent_service::ConsentService::deny_consent", "kind": "function_item", "signature": "pub async fn deny_consent(\n &self,\n request: &ConsentRequest,\n tenant_id: &TenantId,\n ctx: &RequestContext,\n );", "docs": "Deny a consent request.\n\nThis is a no-store operation \u2014 denied requests are only audited,\nnot persisted as records.", "attributes": "", "line": 175 }, { "name": "consent_service::ConsentService::revoke_consent", "kind": "function_item", "signature": "pub async fn revoke_consent(\n &self,\n consent_id: &ConsentId,\n tenant_id: &TenantId,\n ctx: &RequestContext,\n ) -> ArsenalResult<()>;", "docs": "Revoke an existing consent record.\n\n# Errors\n\nReturns an error if the consent ID is not found or storage fails.", "attributes": "", "line": 200 }, { "name": "consent_service::ConsentService::list_consents", "kind": "function_item", "signature": "pub async fn list_consents(&self, agent_did: &str) -> ArsenalResult>;", "docs": "List consent records for an agent.\n\n# Errors\n\nReturns an error if the consent store lookup fails.", "attributes": "", "line": 233 }, { "name": "consent_service::ConsentService::get_consent", "kind": "function_item", "signature": "pub async fn get_consent(\n &self,\n consent_id: &ConsentId,\n ) -> ArsenalResult>;", "docs": "Get a consent record by ID.\n\n# Errors\n\nReturns an error if the consent store lookup fails.", "attributes": "", "line": 245 }, { "name": "consent_service::ConsentService::cleanup_expired", "kind": "function_item", "signature": "pub async fn cleanup_expired(&self) -> u64;", "docs": "Run cleanup of expired consent records.\n\nReturns the number of records cleaned up.", "attributes": "", "line": 258 } ], "parseErrors": false }, { "module": "handlers", "source": "arsenal/crates/arsenal-broker/src/handlers.rs", "sha256": "63d254ec9f76e75e17827d465ba1452cbf72386508c7cbf9ca64eea98b5353d1", "attributes": "", "items": [ { "name": "handlers::BrokerState", "kind": "struct_item", "signature": "pub struct BrokerState {\n/// The broker service\n\npub service: Arc,\n/// Configuration\n\npub config: BrokerConfig,\n/// Proxy service (optional, enabled via config)\n\npub proxy_service: Option>,\n/// Consent service (optional, enabled via config)\n\npub consent_service: Option>\n}", "docs": "Shared broker state", "attributes": "", "line": 41 }, { "name": "handlers::BrokerState::new", "kind": "function_item", "signature": "pub fn new(service: Arc, config: BrokerConfig) -> Self;", "docs": "Create new broker state", "attributes": "#[must_use]", "line": 55 }, { "name": "handlers::BrokerState::with_proxy", "kind": "function_item", "signature": "pub fn with_proxy(\n service: Arc,\n config: BrokerConfig,\n proxy_service: Option>,\n consent_service: Option>,\n ) -> Self;", "docs": "Create broker state with proxy and consent services", "attributes": "#[must_use]", "line": 66 }, { "name": "handlers::ApiError", "kind": "struct_item", "signature": "pub struct ApiError {\n/// Error code\n\npub code: u32,\n/// Error message\n\npub message: String,\n/// Correlation ID for tracing\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub correlation_id: Option,\n/// Retry after seconds (for rate limiting)\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub retry_after: Option\n}", "docs": "API error response", "attributes": "#[derive(Debug, Serialize)]", "line": 83 }, { "name": "handlers::HealthResponse", "kind": "struct_item", "signature": "pub struct HealthResponse {\n/// Service status\n\npub status: String,\n/// Service version\n\npub version: String,\n/// Number of registered agents\n\npub registered_agents: usize,\n/// Number of revoked tokens\n\npub revoked_tokens: usize\n}", "docs": "Health check response", "attributes": "#[derive(Debug, Serialize)]", "line": 205 }, { "name": "handlers::health", "kind": "function_item", "signature": "pub async fn health(State(state): State>) -> Json;", "docs": "Health check handler", "attributes": "", "line": 228 }, { "name": "handlers::metrics", "kind": "function_item", "signature": "pub async fn metrics() -> Response;", "docs": "Prometheus metrics endpoint.", "attributes": "", "line": 234 }, { "name": "handlers::CapabilityRequestPayload", "kind": "struct_item", "signature": "pub struct CapabilityRequestPayload {\n/// Requested scopes\n\npub scopes: Vec,\n/// Requested TTL in seconds\n\n#[serde(default)]\npub ttl_seconds: Option,\n/// Target audience (service)\n\npub audience: String,\n/// Constraints to apply\n\n#[serde(default)]\npub constraints: Option,\n/// `PoP` key fingerprint (hex encoded)\n\n#[serde(default)]\npub pop_key_fingerprint: Option\n}", "docs": "Capability request payload", "attributes": "#[derive(Debug, Deserialize)]", "line": 253 }, { "name": "handlers::ConstraintsPayload", "kind": "struct_item", "signature": "pub struct ConstraintsPayload {\n/// Require proof-of-possession\n\n#[serde(default)]\npub require_pop: bool,\n/// Allowed origins\n\n#[serde(default)]\npub allowed_origins: Option>,\n/// Device ID binding\n\n#[serde(default)]\npub device_id: Option\n}", "docs": "Constraints in API format", "attributes": "#[derive(Debug, Default, Deserialize)]", "line": 271 }, { "name": "handlers::CapabilityResponsePayload", "kind": "struct_item", "signature": "pub struct CapabilityResponsePayload {\n/// Token ID\n\npub token_id: String,\n/// Encoded token (base64)\n\npub token: String,\n/// Expiration timestamp (ISO 8601)\n\npub expires_at: String,\n/// Granted scopes\n\npub granted_scopes: Vec\n}", "docs": "Capability response payload", "attributes": "#[derive(Debug, Serialize)]", "line": 304 }, { "name": "handlers::request_capability", "kind": "function_item", "signature": "pub async fn request_capability(\n State(state): State>,\n ConnectInfo(addr): ConnectInfo,\n Extension(fingerprint): Extension,\n headers: HeaderMap,\n Json(payload): Json,\n) -> Result, ApiError>;", "docs": "Request capability handler\n\n# Errors\n\nReturns an `ApiError` if the capability request is denied or invalid.", "attributes": "", "line": 331 }, { "name": "handlers::SecretRequestPayload", "kind": "struct_item", "signature": "pub struct SecretRequestPayload {\n/// Secret ID\n\npub secret_id: String,\n/// Version (optional, defaults to latest)\n\n#[serde(default)]\npub version: Option,\n/// Capability token authorizing access\n\npub capability_token: String\n}", "docs": "Secret request payload", "attributes": "#[derive(Debug, Deserialize)]", "line": 371 }, { "name": "handlers::WrappedSecretResponsePayload", "kind": "struct_item", "signature": "pub struct WrappedSecretResponsePayload {\n/// Secret ID\n\npub secret_id: String,\n/// Version\n\npub version: u64,\n/// Wrapped (encrypted) secret value (base64)\n\npub wrapped_value: String,\n/// Wrapping key ID\n\npub wrap_key_id: String,\n/// Ephemeral public key for unwrapping (base64)\n\npub ephemeral_public_key: String,\n/// Expiration timestamp (ISO 8601)\n\npub expires_at: String\n}", "docs": "Wrapped secret response payload", "attributes": "#[derive(Debug, Serialize)]", "line": 383 }, { "name": "handlers::request_secret", "kind": "function_item", "signature": "pub async fn request_secret(\n State(state): State>,\n ConnectInfo(addr): ConnectInfo,\n Extension(fingerprint): Extension,\n headers: HeaderMap,\n Json(payload): Json,\n) -> Result, ApiError>;", "docs": "Request secret handler\n\n# Errors\n\nReturns an `ApiError` if the secret request is denied or the secret is not found.", "attributes": "", "line": 416 }, { "name": "handlers::RevokeTokenPayload", "kind": "struct_item", "signature": "pub struct RevokeTokenPayload {\n/// Token ID to revoke\n\npub token_id: String,\n/// Reason for revocation\n\n#[serde(default)]\npub reason: Option\n}", "docs": "Token revocation request", "attributes": "#[derive(Debug, Deserialize)]", "line": 480 }, { "name": "handlers::RevokeTokenResponse", "kind": "struct_item", "signature": "pub struct RevokeTokenResponse {\n/// Whether revocation succeeded\n\npub success: bool,\n/// Message\n\npub message: String\n}", "docs": "Token revocation response", "attributes": "#[derive(Debug, Serialize)]", "line": 490 }, { "name": "handlers::revoke_token", "kind": "function_item", "signature": "pub async fn revoke_token(\n State(state): State>,\n ConnectInfo(addr): ConnectInfo,\n Extension(fingerprint): Extension,\n headers: HeaderMap,\n Json(payload): Json,\n) -> Result, ApiError>;", "docs": "Revoke token handler\n\n# Errors\n\nReturns an `ApiError` if the token ID is invalid or revocation fails.", "attributes": "", "line": 502 }, { "name": "handlers::VerifyTokenPayload", "kind": "struct_item", "signature": "pub struct VerifyTokenPayload {\n/// Token to verify (base64 encoded)\n\npub token: String\n}", "docs": "Token verification request", "attributes": "#[derive(Debug, Deserialize)]", "line": 547 }, { "name": "handlers::VerifyTokenResponse", "kind": "struct_item", "signature": "pub struct VerifyTokenResponse {\n/// Whether the token is valid\n\npub valid: bool,\n/// Token ID\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub token_id: Option,\n/// Subject (agent ID)\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub subject: Option,\n/// Audience\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub audience: Option,\n/// Expiration timestamp\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub expires_at: Option,\n/// Granted scopes\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub scopes: Option>,\n/// Error message if invalid\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub error: Option\n}", "docs": "Token verification response", "attributes": "#[derive(Debug, Serialize)]", "line": 554 }, { "name": "handlers::verify_token", "kind": "function_item", "signature": "pub async fn verify_token(\n State(state): State>,\n Json(payload): Json,\n) -> Json;", "docs": "Verify token handler", "attributes": "", "line": 578 }, { "name": "handlers::ProxyRequestPayload", "kind": "struct_item", "signature": "pub struct ProxyRequestPayload {\n/// HTTP method\n\npub method: String,\n/// Target URL (with {{VARIABLE}} placeholders)\n\npub url: String,\n/// Request headers (may contain {{VARIABLE}} placeholders)\n\n#[serde(default)]\npub headers: Option>,\n/// Request body (base64 encoded, may contain {{VARIABLE}} placeholders)\n\n#[serde(default)]\npub body: Option,\n/// Capability token (base64 encoded ACT)\n\npub capability_token: String,\n/// Request timeout in milliseconds\n\n#[serde(default)]\npub timeout_ms: Option\n}", "docs": "Proxy request payload", "attributes": "#[derive(Debug, Deserialize)]", "line": 613 }, { "name": "handlers::ProxyResponsePayload", "kind": "struct_item", "signature": "pub struct ProxyResponsePayload {\n/// HTTP status code\n\npub status: u16,\n/// Response headers (sanitized)\n\npub headers: std::collections::BTreeMap,\n/// Response body (base64 encoded)\n\npub body: String,\n/// Proxy metadata\n\npub metadata: ProxyMetadataPayload\n}", "docs": "Proxy response payload", "attributes": "#[derive(Debug, Serialize)]", "line": 633 }, { "name": "handlers::ProxyMetadataPayload", "kind": "struct_item", "signature": "pub struct ProxyMetadataPayload {\n/// Variable names that were resolved (never values)\n\npub variables_resolved: Vec,\n/// Whether destination binding was verified\n\npub destination_verified: bool,\n/// Whether fingerprint was verified\n\npub fingerprint_verified: bool,\n/// Consent status\n\npub consent_status: String,\n/// Proxy latency in milliseconds\n\npub latency_ms: u64\n}", "docs": "Proxy metadata payload", "attributes": "#[derive(Debug, Serialize)]", "line": 646 }, { "name": "handlers::proxy_request", "kind": "function_item", "signature": "pub async fn proxy_request(\n State(state): State>,\n ConnectInfo(addr): ConnectInfo,\n Extension(fingerprint): Extension,\n headers: HeaderMap,\n Json(payload): Json,\n) -> Result, ApiError>;", "docs": "Proxy request handler\n\n# Errors\n\nReturns an `ApiError` if proxy is disabled, the agent is not registered, or the request fails.", "attributes": "", "line": 664 }, { "name": "handlers::ConsentApprovalPayload", "kind": "struct_item", "signature": "pub struct ConsentApprovalPayload {\n/// Agent DID\n\npub agent_did: String,\n/// Human root DID\n\npub human_root_did: String,\n/// Variables to consent to\n\npub variables: Vec,\n/// Destination domains\n\npub destination_domains: Vec,\n/// Scopes\n\npub scopes: Vec,\n/// Granted by (identifier of the approver)\n\npub granted_by: String,\n/// Expiration in seconds from now\n\n#[serde(default)]\npub expires_in_seconds: Option,\n/// Ed25519 signature (base64 encoded)\n\npub signature: String\n}", "docs": "Consent approval payload", "attributes": "#[derive(Debug, Deserialize)]", "line": 734 }, { "name": "handlers::ConsentRecordPayload", "kind": "struct_item", "signature": "pub struct ConsentRecordPayload {\n/// Consent ID\n\npub consent_id: String,\n/// Agent DID\n\npub agent_did: String,\n/// Human root DID\n\npub human_root_did: String,\n/// Variables\n\npub variables: Vec,\n/// Destination domains\n\npub destination_domains: Vec,\n/// Scopes\n\npub scopes: Vec,\n/// Granted by\n\npub granted_by: String,\n/// Granted at (ISO 8601)\n\npub granted_at: String,\n/// Expires at (ISO 8601)\n\npub expires_at: String,\n/// Whether revoked\n\npub revoked: bool\n}", "docs": "Consent record response payload", "attributes": "#[derive(Debug, Serialize)]", "line": 756 }, { "name": "handlers::consent_approve", "kind": "function_item", "signature": "pub async fn consent_approve(\n State(state): State>,\n ConnectInfo(addr): ConnectInfo,\n Extension(fingerprint): Extension,\n headers: HeaderMap,\n Json(payload): Json,\n) -> Result, ApiError>;", "docs": "Approve consent handler\n\n# Errors\n\nReturns an `ApiError` if the consent service is disabled, the agent is not found, or approval fails.", "attributes": "", "line": 801 }, { "name": "handlers::ConsentDenialPayload", "kind": "struct_item", "signature": "pub struct ConsentDenialPayload {\n/// Agent DID\n\npub agent_did: String,\n/// Human root DID\n\npub human_root_did: String,\n/// Variables being denied\n\npub variables: Vec,\n/// Destination domains\n\npub destination_domains: Vec,\n/// Scopes\n\npub scopes: Vec\n}", "docs": "Consent denial payload", "attributes": "#[derive(Debug, Deserialize)]", "line": 860 }, { "name": "handlers::consent_deny", "kind": "function_item", "signature": "pub async fn consent_deny(\n State(state): State>,\n ConnectInfo(addr): ConnectInfo,\n Extension(fingerprint): Extension,\n headers: HeaderMap,\n Json(payload): Json,\n) -> Result;", "docs": "Deny consent handler\n\n# Errors\n\nReturns an `ApiError` if the consent service is disabled or the agent is not found.", "attributes": "", "line": 878 }, { "name": "handlers::ConsentRevocationPayload", "kind": "struct_item", "signature": "pub struct ConsentRevocationPayload {\n/// Consent ID to revoke\n\npub consent_id: String\n}", "docs": "Consent revocation payload", "attributes": "#[derive(Debug, Deserialize)]", "line": 919 }, { "name": "handlers::consent_revoke", "kind": "function_item", "signature": "pub async fn consent_revoke(\n State(state): State>,\n ConnectInfo(addr): ConnectInfo,\n Extension(fingerprint): Extension,\n headers: HeaderMap,\n Json(payload): Json,\n) -> Result;", "docs": "Revoke consent handler\n\n# Errors\n\nReturns an `ApiError` if the consent service is disabled, the agent is not found, or revocation fails.", "attributes": "", "line": 929 }, { "name": "handlers::ConsentListParams", "kind": "struct_item", "signature": "pub struct ConsentListParams {\n/// Agent DID to list consents for\n\npub agent_did: String\n}", "docs": "Consent list query parameters", "attributes": "#[derive(Debug, Deserialize)]", "line": 966 }, { "name": "handlers::consent_list", "kind": "function_item", "signature": "pub async fn consent_list(\n State(state): State>,\n axum::extract::Query(params): axum::extract::Query,\n) -> Result>, ApiError>;", "docs": "List consents handler\n\n# Errors\n\nReturns an `ApiError` if the consent service is disabled or the query fails.", "attributes": "", "line": 976 } ], "parseErrors": false }, { "module": "metrics", "source": "arsenal/crates/arsenal-broker/src/metrics.rs", "sha256": "ad03a2d1307a0ea3ecb52d8493a52aae62b1772d8e97ba9e61d905aa14df4d70", "attributes": "", "items": [ { "name": "metrics::RevocationDecisionSource", "kind": "enum_item", "signature": "pub enum RevocationDecisionSource {\n /// Decision was computed by consulting the backend (SQL/file/memory/http).\n Backend,\n /// Decision came from a positive cache entry.\n CachePositive,\n /// Decision came from a negative cache entry.\n CacheNegative,\n}", "docs": "Revocation decision source (cache vs backend).", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq)]", "line": 16 }, { "name": "metrics::RevocationDecisionSource::as_str", "kind": "function_item", "signature": "pub const fn as_str(self) -> &'static str;", "docs": "Convert to a stable label value.", "attributes": "#[must_use]", "line": 28 }, { "name": "metrics::RevocationDecision", "kind": "enum_item", "signature": "pub enum RevocationDecision {\n /// Token is revoked.\n Revoked,\n /// Token is not revoked.\n NotRevoked,\n /// Revocation status could not be determined.\n Unknown,\n}", "docs": "One revocation check outcome (for metrics labeling).", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq)]", "line": 39 }, { "name": "metrics::RevocationDecision::as_str", "kind": "function_item", "signature": "pub const fn as_str(self) -> &'static str;", "docs": "Convert to a stable label value.", "attributes": "#[must_use]", "line": 51 }, { "name": "metrics::init", "kind": "function_item", "signature": "pub fn init();", "docs": "Initialize metrics (Prometheus scrape endpoint).\n\nSafe to call multiple times; initialization occurs once.\nIf the Prometheus exporter cannot be created, a fallback no-op provider\nis used and a warning is logged via `tracing`.", "attributes": "", "line": 91 }, { "name": "metrics::render", "kind": "function_item", "signature": "pub fn render() -> String;", "docs": "Render Prometheus text format.", "attributes": "#[must_use]", "line": 222 }, { "name": "metrics::record_revocation_check", "kind": "function_item", "signature": "pub fn record_revocation_check(\n backend: &'static str,\n endpoint: &'static str,\n result: &'static str,\n decision: RevocationDecision,\n source: RevocationDecisionSource,\n latency_seconds: f64,\n);", "docs": "Record a revocation check.", "attributes": "", "line": 239 }, { "name": "metrics::record_revocation_cache_hit", "kind": "function_item", "signature": "pub fn record_revocation_cache_hit(backend: &'static str, hit_type: &'static str);", "docs": "Record a revocation cache hit (HTTP backend).", "attributes": "", "line": 281 }, { "name": "metrics::record_secret_delivery_denied", "kind": "function_item", "signature": "pub fn record_secret_delivery_denied(reason: &'static str);", "docs": "Record a secret delivery denial.", "attributes": "", "line": 295 }, { "name": "metrics::record_secret_request", "kind": "function_item", "signature": "pub fn record_secret_request(result: &'static str);", "docs": "Record a secret delivery request.", "attributes": "", "line": 304 }, { "name": "metrics::record_http_request", "kind": "function_item", "signature": "pub fn record_http_request(route: &'static str, method: &'static str, status: &'static str);", "docs": "Record an HTTP request (Google-safe labels: templated route + method + status).", "attributes": "", "line": 313 }, { "name": "metrics::record_proxy_request", "kind": "function_item", "signature": "pub fn record_proxy_request(\n target_domain: &str,\n status: u16,\n result: &'static str,\n latency_ms: u64,\n);", "docs": "Record a proxy request.", "attributes": "", "line": 328 }, { "name": "metrics::record_fingerprint_verification", "kind": "function_item", "signature": "pub fn record_fingerprint_verification(result: &'static str);", "docs": "Record a fingerprint verification result.", "attributes": "", "line": 362 }, { "name": "metrics::record_consent_request", "kind": "function_item", "signature": "pub fn record_consent_request(status: &'static str);", "docs": "Record a consent request.", "attributes": "", "line": 371 }, { "name": "metrics::record_dct_issued", "kind": "function_item", "signature": "pub fn record_dct_issued();", "docs": "Record a DCT issuance.", "attributes": "", "line": 380 }, { "name": "metrics::record_destination_violation", "kind": "function_item", "signature": "pub fn record_destination_violation(domain: &str);", "docs": "Record a destination binding violation.", "attributes": "", "line": 388 } ], "parseErrors": false }, { "module": "middleware", "source": "arsenal/crates/arsenal-broker/src/middleware.rs", "sha256": "4d2db1c3c9b5a9b3b3d6c7bce5a31f954b980e622b1a086bcacdf09d5d1ba94b", "attributes": "", "items": [ { "name": "middleware::auth_middleware", "kind": "function_item", "signature": "pub async fn auth_middleware(mut request: Request, next: Next) -> Result;", "docs": "Authentication middleware\n\nExtracts and validates information from mTLS.\nIn production, this extracts the client cert fingerprint from the TLS layer.\nWhen behind a TLS-terminating proxy, it reads from X-Client-Cert-Fingerprint header.\n\n# Errors\n\nReturns `StatusCode::UNAUTHORIZED` if a protected request has no verified client identity.", "attributes": "", "line": 33 }, { "name": "middleware::audit_middleware", "kind": "function_item", "signature": "pub async fn audit_middleware(request: Request, next: Next) -> Response;", "docs": "Audit logging middleware\n\nLogs all requests for security audit with timing information.", "attributes": "", "line": 111 }, { "name": "middleware::rate_limit_middleware", "kind": "function_item", "signature": "pub async fn rate_limit_middleware(request: Request, next: Next) -> Result;", "docs": "Rate limiting middleware\n\nImplements per-agent rate limiting using token bucket algorithm.\nRate limits are enforced based on client certificate fingerprint.\n\n# Errors\n\nReturns `StatusCode` errors if the inner handler returns one.", "attributes": "", "line": 182 }, { "name": "middleware::http_metrics_middleware", "kind": "function_item", "signature": "pub async fn http_metrics_middleware(request: Request, next: Next) -> Response;", "docs": "HTTP request metrics middleware.\n\nRecords a low-cardinality counter suitable for RED dashboards and SLO accounting:\n`arsenal_http_requests_total{route,method,status}`.", "attributes": "", "line": 232 }, { "name": "middleware::validation_middleware", "kind": "function_item", "signature": "pub async fn validation_middleware(request: Request, next: Next) -> Result;", "docs": "Request validation middleware\n\nValidates common request properties like content type and size.\n\n# Errors\n\nReturns `StatusCode::UNSUPPORTED_MEDIA_TYPE` if the content type is missing or invalid.", "attributes": "", "line": 301 }, { "name": "middleware::security_headers_middleware", "kind": "function_item", "signature": "pub async fn security_headers_middleware(request: Request, next: Next) -> Response;", "docs": "Security headers middleware\n\nAdds security-related headers to all responses.", "attributes": "", "line": 337 }, { "name": "middleware::error_handling_middleware", "kind": "function_item", "signature": "pub async fn error_handling_middleware(request: Request, next: Next) -> Response;", "docs": "Error handling middleware\n\nConverts panics and errors to proper API responses.", "attributes": "", "line": 384 } ], "parseErrors": false }, { "module": "proxy_config", "source": "arsenal/crates/arsenal-broker/src/proxy_config.rs", "sha256": "813dfbd8c92accfae90736fb1f9d8d189007d05ec768d594407ef86644c34de9", "attributes": "", "items": [ { "name": "proxy_config::ProxyConfig", "kind": "struct_item", "signature": "pub struct ProxyConfig {\n/// Enable the credential proxy\n\n#[serde(default)]\npub enabled: bool,\n/// Maximum request body size in bytes\n\n#[serde(default = \"default_max_request_body_bytes\")]\npub max_request_body_bytes: usize,\n/// Default request timeout in milliseconds\n\n#[serde(default = \"default_proxy_timeout_ms\")]\npub default_timeout_ms: u64,\n/// Maximum request timeout in milliseconds\n\n#[serde(default = \"default_max_proxy_timeout_ms\")]\npub max_timeout_ms: u64,\n/// Additional blocked IP ranges in CIDR notation for SSRF protection.\n\n///\n\n/// Private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8,\n\n/// `::1`, `169.254.0.0/16`, etc.) are **always** blocked regardless of this list.\n\n#[serde(default)]\npub blocked_domains: Vec,\n/// Require fingerprint verification on proxy requests\n\n#[serde(default = \"default_require_fingerprinting\")]\npub require_fingerprinting: bool,\n/// Require human consent before proxy requests\n\n#[serde(default)]\npub require_consent: bool,\n/// Consent policy granularity\n\n#[serde(default)]\npub consent_policy: ConsentPolicy,\n/// Headers to strip from proxy responses (glob patterns).\n\n///\n\n/// Common sensitive headers (Authorization, Cookie, Set-Cookie, X-Api-Key)\n\n/// are always stripped.\n\n#[serde(default)]\npub additional_sanitize_headers: Vec,\n/// Strip cookies from proxy responses\n\n#[serde(default = \"default_strip_cookies\")]\npub strip_cookies: bool,\n/// `OAuth2` proactive token refresh: refresh this many seconds before expiry\n\n#[serde(default = \"default_oauth2_proactive_refresh\")]\npub oauth2_proactive_refresh_seconds: u64,\n/// Maximum concurrent connections per target domain\n\n#[serde(default = \"default_max_connections_per_domain\")]\npub max_connections_per_domain: usize\n}", "docs": "Proxy service configuration", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]\n#[allow(clippy::struct_excessive_bools)]", "line": 13 }, { "name": "proxy_config::ConsentConfig", "kind": "struct_item", "signature": "pub struct ConsentConfig {\n/// Enable the consent service endpoints\n\n#[serde(default)]\npub enabled: bool,\n/// Default consent expiration in seconds\n\n#[serde(default = \"default_consent_expiry_seconds\")]\npub default_expiry_seconds: u64,\n/// Maximum consent expiration in seconds\n\n#[serde(default = \"default_max_consent_expiry_seconds\")]\npub max_expiry_seconds: u64,\n/// Cleanup interval for expired consent records (seconds)\n\n#[serde(default = \"default_consent_cleanup_interval\")]\npub cleanup_interval_seconds: u64\n}", "docs": "Consent service configuration", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 118 } ], "parseErrors": false }, { "module": "proxy_service", "source": "arsenal/crates/arsenal-broker/src/proxy_service.rs", "sha256": "f371e74d538458acb8fd63bd137522e4febe0880749d8943757765d90898734e", "attributes": "", "items": [ { "name": "proxy_service::ProxyService", "kind": "struct_item", "signature": "pub struct ProxyService {\n\n}", "docs": "The credential proxy service.", "attributes": "", "line": 53 }, { "name": "proxy_service::ProxyService::new", "kind": "function_item", "signature": "pub fn new(\n config: ProxyConfig,\n secret_store: Arc,\n variable_resolver: Arc,\n fingerprint_store: Arc,\n consent_service: Arc,\n token_verifier: TokenVerifier,\n audit_sink: Arc,\n ) -> ArsenalResult;", "docs": "Create a new proxy service.\n\n# Errors\n\nReturns an error if the HTTP client cannot be created.", "attributes": "", "line": 80 }, { "name": "proxy_service::ProxyService::with_ssrf_guard", "kind": "function_item", "signature": "pub fn with_ssrf_guard(\n config: ProxyConfig,\n secret_store: Arc,\n variable_resolver: Arc,\n fingerprint_store: Arc,\n consent_service: Arc,\n token_verifier: TokenVerifier,\n audit_sink: Arc,\n ssrf_guard: SsrfGuard,\n ) -> ArsenalResult;", "docs": "Create a new proxy service with a custom SSRF guard.\n\nUse `SsrfGuard::permissive()` in test environments where the proxy\ntarget is a local mock server.\n\n# Errors\n\nReturns an error if the HTTP client cannot be created.", "attributes": "#[allow(clippy::too_many_arguments)]", "line": 111 }, { "name": "proxy_service::ProxyService::handle_proxy_request", "kind": "function_item", "signature": "pub async fn handle_proxy_request(\n &self,\n _agent_fingerprint: &KeyFingerprint,\n agent_did: &OasDid,\n agent_id: &AgentId,\n tenant_id: &TenantId,\n request: ProxyRequest,\n ctx: &RequestContext,\n ) -> ArsenalResult;", "docs": "Handle a proxy request through the 11-step pipeline.\n\n# Errors\n\nReturns an error at any pipeline step if validation fails.", "attributes": "#[allow(clippy::similar_names)]\n#[allow(clippy::too_many_lines)]", "line": 152 } ], "parseErrors": false }, { "module": "rate", "source": "arsenal/crates/arsenal-broker/src/rate.rs", "sha256": "acf9b257612b3e15bb618bf2c995edb440ab98f13f0d3403486c0a2104e242ec", "attributes": "", "items": [ { "name": "rate::RateLimitResult", "kind": "enum_item", "signature": "pub enum RateLimitResult {\n /// Request is allowed\n Allowed {\n /// Remaining requests in the current window\n remaining: u64,\n },\n /// Request is rate limited\n Limited {\n /// Seconds until the limit resets\n retry_after: u64,\n },\n}", "docs": "Result of a rate limit check", "attributes": "#[derive(Debug, Clone)]", "line": 13 }, { "name": "rate::RateLimiter", "kind": "struct_item", "signature": "pub struct RateLimiter {\n\n}", "docs": "Rate limiter with per-key token buckets", "attributes": "", "line": 99 }, { "name": "rate::RateLimitConfig", "kind": "struct_item", "signature": "pub struct RateLimitConfig {\n/// Maximum tokens\n\npub max_tokens: u64,\n/// Refill rate (tokens per second)\n\npub refill_rate_tokens_per_second: u64\n}", "docs": "Configuration for a specific rate limit key", "attributes": "#[derive(Debug, Clone)]", "line": 112 }, { "name": "rate::RateLimiter::new", "kind": "function_item", "signature": "pub fn new(requests_per_second: u64, burst_size: u64) -> Self;", "docs": "Create a new rate limiter\n\n# Arguments\n* `requests_per_second` - Base rate limit\n* `burst_size` - Maximum burst capacity", "attributes": "#[must_use]", "line": 126 }, { "name": "rate::RateLimiter::set_override", "kind": "function_item", "signature": "pub async fn set_override(&self, key_pattern: impl Into, config: RateLimitConfig);", "docs": "Set a rate limit override for a specific key pattern", "attributes": "", "line": 136 }, { "name": "rate::RateLimiter::check", "kind": "function_item", "signature": "pub async fn check(&self, key: &str) -> RateLimitResult;", "docs": "Check rate limit for a key", "attributes": "", "line": 142 }, { "name": "rate::RateLimiter::peek", "kind": "function_item", "signature": "pub async fn peek(&self, key: &str) -> RateLimitResult;", "docs": "Check rate limit without consuming a token", "attributes": "", "line": 181 }, { "name": "rate::RateLimiter::reset", "kind": "function_item", "signature": "pub async fn reset(&self, key: &str);", "docs": "Reset rate limit for a key", "attributes": "", "line": 204 }, { "name": "rate::RateLimiter::cleanup", "kind": "function_item", "signature": "pub async fn cleanup(&self, max_age: Duration);", "docs": "Clean up expired buckets (call periodically)", "attributes": "", "line": 210 }, { "name": "rate::RateLimiter::status", "kind": "function_item", "signature": "pub async fn status(&self, key: &str) -> Option;", "docs": "Get current status for a key", "attributes": "", "line": 221 }, { "name": "rate::RateLimitStatus", "kind": "struct_item", "signature": "pub struct RateLimitStatus {\n/// Remaining requests\n\npub remaining: u64,\n/// Total limit\n\npub limit: u64,\n/// Seconds until full reset\n\npub reset_in_seconds: u64\n}", "docs": "Rate limit status for a key", "attributes": "#[derive(Debug, Clone, serde::Serialize)]", "line": 238 }, { "name": "rate::SlidingWindowRateLimiter", "kind": "struct_item", "signature": "pub struct SlidingWindowRateLimiter {\n\n}", "docs": "Sliding window rate limiter (alternative implementation)", "attributes": "", "line": 248 }, { "name": "rate::SlidingWindowRateLimiter::new", "kind": "function_item", "signature": "pub fn new(window_size: Duration, max_requests: u64) -> Self;", "docs": "Create a new sliding window rate limiter", "attributes": "#[must_use]", "line": 260 }, { "name": "rate::SlidingWindowRateLimiter::check", "kind": "function_item", "signature": "pub async fn check(&self, key: &str) -> RateLimitResult;", "docs": "Check rate limit", "attributes": "", "line": 269 }, { "name": "rate::SlidingWindowRateLimiter::cleanup", "kind": "function_item", "signature": "pub async fn cleanup(&self);", "docs": "Clean up old entries", "attributes": "", "line": 296 } ], "parseErrors": false }, { "module": "revocation", "source": "arsenal/crates/arsenal-broker/src/revocation.rs", "sha256": "7098533bea972f1c4c2ff16eaf8d0126e95d9fe753270b092b31b52799d2a33f", "attributes": "", "items": [ { "name": "revocation::RevocationReason", "kind": "enum_item", "signature": "pub enum RevocationReason {\n /// User/admin requested revocation\n UserRequested,\n /// Security incident\n SecurityIncident,\n /// Agent deactivated\n AgentDeactivated,\n /// Session ended\n SessionEnded,\n /// Policy violation\n PolicyViolation,\n /// Suspicious activity detected\n SuspiciousActivity,\n /// Key rotation\n KeyRotation,\n /// Other reason with description\n Other(String),\n}", "docs": "Reason for token revocation", "attributes": "#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]\n#[serde(rename_all = \"snake_case\")]", "line": 20 }, { "name": "revocation::RevokedToken", "kind": "struct_item", "signature": "pub struct RevokedToken {\n/// The token ID\n\npub token_id: TokenId,\n/// When the token was revoked\n\npub revoked_at: chrono::DateTime,\n/// Why the token was revoked\n\npub reason: RevocationReason,\n/// Who revoked it (agent ID, admin ID, or \"system\")\n\npub revoked_by: String,\n/// Original\n\npub original_expiry: Option>\n}", "docs": "A revoked token entry", "attributes": "#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]", "line": 41 }, { "name": "revocation::RevocationList", "kind": "struct_item", "signature": "pub struct RevocationList {\n\n}", "docs": "In-memory revocation list", "attributes": "", "line": 55 }, { "name": "revocation::RevocationList::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Create a new revocation list", "attributes": "#[must_use]", "line": 65 }, { "name": "revocation::RevocationList::with_capacity", "kind": "function_item", "signature": "pub fn with_capacity(max_entries: usize) -> Self;", "docs": "Create with custom capacity", "attributes": "#[must_use]", "line": 74 }, { "name": "revocation::RevocationList::revoke", "kind": "function_item", "signature": "pub async fn revoke(&self, token_id: TokenId, reason: RevocationReason);", "docs": "Revoke a token", "attributes": "", "line": 82 }, { "name": "revocation::RevocationList::revoke_with_details", "kind": "function_item", "signature": "pub async fn revoke_with_details(\n &self,\n token_id: TokenId,\n reason: RevocationReason,\n revoked_by: String,\n original_expiry: Option>,\n );", "docs": "Revoke a token with full details", "attributes": "", "line": 88 }, { "name": "revocation::RevocationList::is_revoked", "kind": "function_item", "signature": "pub async fn is_revoked(&self, token_id: &TokenId) -> bool;", "docs": "Check if a token is revoked", "attributes": "", "line": 114 }, { "name": "revocation::RevocationList::get_revocation", "kind": "function_item", "signature": "pub async fn get_revocation(&self, token_id: &TokenId) -> Option;", "docs": "Get revocation details", "attributes": "", "line": 120 }, { "name": "revocation::RevocationList::unrevoke", "kind": "function_item", "signature": "pub async fn unrevoke(&self, token_id: &TokenId) -> Option;", "docs": "Remove a revocation (unrevoke)", "attributes": "", "line": 126 }, { "name": "revocation::RevocationList::count", "kind": "function_item", "signature": "pub async fn count(&self) -> usize;", "docs": "Get count of revoked tokens", "attributes": "", "line": 132 }, { "name": "revocation::RevocationList::cleanup_expired", "kind": "function_item", "signature": "pub async fn cleanup_expired(&self);", "docs": "Clean up entries for tokens that have naturally expired", "attributes": "", "line": 138 }, { "name": "revocation::RevocationList::all", "kind": "function_item", "signature": "pub async fn all(&self) -> Vec;", "docs": "Get all revoked tokens (for sync/backup)", "attributes": "", "line": 162 }, { "name": "revocation::RevocationList::revoke_bulk", "kind": "function_item", "signature": "pub async fn revoke_bulk(&self, token_ids: Vec, reason: RevocationReason);", "docs": "Bulk revoke tokens", "attributes": "", "line": 168 }, { "name": "revocation::RevocationList::load", "kind": "function_item", "signature": "pub async fn load(&self, entries: Vec);", "docs": "Load revocations from a list (for initialization)", "attributes": "", "line": 185 }, { "name": "revocation::RevocationDecisionDetailed", "kind": "struct_item", "signature": "pub struct RevocationDecisionDetailed {\n/// Whether the token is revoked.\n\npub revoked: bool,\n/// Where the decision came from.\n\npub source: crate::metrics::RevocationDecisionSource\n}", "docs": "Detailed revocation decision.", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq)]", "line": 201 }, { "name": "revocation::RevocationStore", "kind": "trait_item", "signature": "pub trait RevocationStore: Send + Sync {\n /// Add a revocation\n fn add(&self, entry: RevokedToken) -> BoxFuture<'_, Result<(), RevocationStoreError>>;\n\n /// Remove a revocation\n fn remove<'a>(\n &'a self,\n token_id: &'a TokenId,\n ) -> BoxFuture<'a, Result, RevocationStoreError>>;\n\n /// Check if a token is revoked\n fn is_revoked<'a>(\n &'a self,\n token_id: &'a TokenId,\n ) -> BoxFuture<'a, Result>;\n\n /// Check if a token is revoked, with decision source detail.\n fn is_revoked_detailed<'a>(\n &'a self,\n token_id: &'a TokenId,\n ) -> BoxFuture<'a, Result> ;\n\n /// Get revocation details\n fn get<'a>(\n &'a self,\n token_id: &'a TokenId,\n ) -> BoxFuture<'a, Result, RevocationStoreError>>;\n\n /// List all revocations (paginated)\n fn list(\n &self,\n limit: usize,\n offset: usize,\n ) -> BoxFuture<'_, Result, RevocationStoreError>>;\n\n /// Clean up expired entries\n fn cleanup(&self) -> BoxFuture<'_, Result>;\n\n /// Compact any persistent storage (no-op for in-memory stores)\n fn compact(&self) -> BoxFuture<'_, Result<(), RevocationStoreError>>;\n\n /// Count current revocations\n fn count(&self) -> BoxFuture<'_, Result>;\n}", "docs": "Trait for persistent revocation storage (object-safe).", "attributes": "", "line": 212 }, { "name": "revocation::RevocationStoreError", "kind": "enum_item", "signature": "pub enum RevocationStoreError {\n /// Storage backend error\n #[error(\"Storage error: {0}\")]\n StorageError(String),\n\n /// Entry not found\n #[error(\"Revocation not found\")]\n NotFound,\n}", "docs": "Errors from revocation store", "attributes": "#[derive(Debug, thiserror::Error)]", "line": 267 }, { "name": "revocation::InMemoryRevocationStore", "kind": "struct_item", "signature": "pub struct InMemoryRevocationStore {\n\n}", "docs": "In-memory implementation of `RevocationStore`", "attributes": "", "line": 278 }, { "name": "revocation::InMemoryRevocationStore::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Create a new in-memory store", "attributes": "#[must_use]", "line": 285 }, { "name": "revocation::FileRevocationStore", "kind": "struct_item", "signature": "pub struct FileRevocationStore {\n\n}", "docs": "File-backed revocation store (restart-safe on a single node).\n\nThis maintains an in-memory index for fast checks, and persists mutations to a JSONL file.\nA periodic compaction rewrites the file as a snapshot to avoid unbounded growth.", "attributes": "", "line": 379 }, { "name": "revocation::SqlRevocationStore", "kind": "struct_item", "signature": "pub struct SqlRevocationStore {\n\n}", "docs": "SQL-backed revocation store (Postgres/SQLite) using `sqlx`.", "attributes": "", "line": 388 }, { "name": "revocation::SqlRevocationStore::connect", "kind": "function_item", "signature": "pub async fn connect(\n database_url: &str,\n table: String,\n max_connections: u32,\n connect_timeout: std::time::Duration,\n ) -> Result;", "docs": "Create a new SQL-backed revocation store and ensure schema exists.\n\n# Errors\nReturns an error if the database cannot be reached or schema init fails.", "attributes": "", "line": 427 }, { "name": "revocation::HttpRevocationStore", "kind": "struct_item", "signature": "pub struct HttpRevocationStore {\n\n}", "docs": "HTTP-backed revocation store (external service).\n\nThe store supports:\n- read-through caching (positive + negative TTL)\n- bounded timeouts\n- basic retry on transient failures", "attributes": "", "line": 859 }, { "name": "revocation::HttpRevocationStore::new", "kind": "function_item", "signature": "pub fn new(\n base_url: &str,\n auth_header: Option,\n timeout: std::time::Duration,\n cache_ttl: std::time::Duration,\n negative_cache_ttl: std::time::Duration,\n positive_cache_max_ttl: std::time::Duration,\n ) -> Result;", "docs": "Create a new HTTP-backed store.\n\n# Errors\nReturns an error if the base URL is invalid or the HTTP client cannot be created.", "attributes": "", "line": 884 }, { "name": "revocation::FileRevocationStore::new", "kind": "function_item", "signature": "pub fn new(\n path: impl Into,\n max_entries: usize,\n fsync_on_write: bool,\n ) -> Result;", "docs": "Create or load a file-backed revocation store.\n\n# Errors\nReturns an error if the log cannot be read or opened.", "attributes": "", "line": 1333 }, { "name": "revocation::FileRevocationStore::compact_snapshot", "kind": "function_item", "signature": "pub async fn compact_snapshot(&self) -> Result<(), RevocationStoreError>;", "docs": "Compact the on-disk log into a snapshot of current revocations.\n\n# Errors\nReturns an error if rewriting fails.", "attributes": "", "line": 1430 } ], "parseErrors": false }, { "module": "server", "source": "arsenal/crates/arsenal-broker/src/server.rs", "sha256": "c0f5d78e3eaf16bf215ea3ad3fd6bf0aa4d925aa785cebea43a33f79c601e8e8", "attributes": "", "items": [ { "name": "server::BrokerServer", "kind": "struct_item", "signature": "pub struct BrokerServer {\n\n}", "docs": "Broker server", "attributes": "", "line": 44 }, { "name": "server::BrokerServer::new", "kind": "function_item", "signature": "pub async fn new(\n config: BrokerConfig,\n secret_store: Arc,\n ) -> Result>;", "docs": "Create a new broker server\n\n# Errors\nReturns an error if initialization fails", "attributes": "", "line": 58 }, { "name": "server::BrokerServer::with_service", "kind": "function_item", "signature": "pub fn with_service(config: BrokerConfig, service: Arc) -> Self;", "docs": "Create with an existing service", "attributes": "#[must_use]", "line": 79 }, { "name": "server::BrokerServer::service", "kind": "function_item", "signature": "pub fn service(&self) -> &Arc;", "docs": "Get a reference to the broker service", "attributes": "#[must_use]", "line": 90 }, { "name": "server::BrokerServer::router", "kind": "function_item", "signature": "pub fn router(&self) -> Router;", "docs": "Build the router", "attributes": "", "line": 95 }, { "name": "server::BrokerServer::run_insecure", "kind": "function_item", "signature": "pub async fn run_insecure(&self) -> Result<(), Box>;", "docs": "Run the server without TLS (for development/testing)\n\n# Errors\nReturns an error if the server fails to start", "attributes": "", "line": 183 }, { "name": "server::BrokerServer::run", "kind": "function_item", "signature": "pub async fn run(&self) -> Result<(), Box>;", "docs": "Run the server with TLS\n\n# Errors\nReturns an error if the server fails to start", "attributes": "", "line": 208 } ], "parseErrors": false }, { "module": "service", "source": "arsenal/crates/arsenal-broker/src/service.rs", "sha256": "fe130c951282730bd7e6bf3e94598bb2f4ce1b1343366db18147306a409479f1", "attributes": "", "items": [ { "name": "service::RegisteredAgent", "kind": "struct_item", "signature": "pub struct RegisteredAgent {\n/// Agent identity\n\npub identity: AgentIdentity,\n/// Public key bytes for signature verification\n\npub public_key: [u8; 32],\n/// Public key bytes for encryption (X25519)\n\n///\n\n/// Used to encrypt secrets to the agent such that only the agent can unwrap them.\n\npub encryption_public_key: [u8; 32],\n/// Maximum allowed scopes for this agent\n\npub allowed_scopes: ScopeSet,\n/// Maximum token TTL in seconds\n\npub max_ttl_seconds: i64,\n/// Whether `PoP` is required\n\npub require_pop: bool\n}", "docs": "Registered agent with its identity and metadata", "attributes": "#[derive(Debug, Clone)]", "line": 46 }, { "name": "service::RequestContext", "kind": "struct_item", "signature": "pub struct RequestContext {\n/// Request ID for tracing\n\npub request_id: uuid::Uuid,\n/// Client IP address\n\npub client_ip: Option,\n/// User agent string\n\npub user_agent: Option,\n/// Origin header\n\npub origin: Option,\n/// Session ID if provided\n\npub session_id: Option,\n/// Timestamp of the request\n\npub timestamp: chrono::DateTime\n}", "docs": "Request context extracted from the incoming request", "attributes": "#[derive(Debug, Clone)]", "line": 65 }, { "name": "service::RequestContext::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Create a new request context", "attributes": "#[must_use]", "line": 83 }, { "name": "service::RequestContext::to_constraint_context", "kind": "function_item", "signature": "pub fn to_constraint_context(&self) -> ConstraintContext;", "docs": "Convert to constraint context for validation", "attributes": "#[must_use]", "line": 96 }, { "name": "service::CapabilityRequest", "kind": "struct_item", "signature": "pub struct CapabilityRequest {\n/// Requested scopes\n\npub scopes: Vec,\n/// Requested TTL in seconds\n\npub ttl_seconds: Option,\n/// Target audience (service)\n\npub audience: String,\n/// Constraints to apply\n\npub constraints: Option,\n/// `PoP` key fingerprint (if providing `PoP`)\n\npub pop_key_fingerprint: Option\n}", "docs": "Capability request from an agent", "attributes": "#[derive(Debug, Clone)]", "line": 119 }, { "name": "service::CapabilityResponse", "kind": "struct_item", "signature": "pub struct CapabilityResponse {\n/// The issued token ID\n\npub token_id: TokenId,\n/// Serialized token (CBOR, base64 encoded)\n\npub token: String,\n/// Expiration timestamp\n\npub expires_at: chrono::DateTime,\n/// Granted scopes (may be narrower than requested)\n\npub granted_scopes: Vec\n}", "docs": "Capability response", "attributes": "#[derive(Debug, Clone)]", "line": 134 }, { "name": "service::SecretRequest", "kind": "struct_item", "signature": "pub struct SecretRequest {\n/// Secret ID\n\npub secret_id: String,\n/// Version (optional, defaults to latest)\n\npub version: Option,\n/// Capability token authorizing access\n\npub capability_token: String,\n/// Proof-of-possession header (base64url JSON), if required by token binding\n\npub pop_proof: Option\n}", "docs": "Secret request from an agent", "attributes": "#[derive(Debug, Clone)]", "line": 147 }, { "name": "service::WrappedSecretResponse", "kind": "struct_item", "signature": "pub struct WrappedSecretResponse {\n/// Secret ID\n\npub secret_id: String,\n/// Version\n\npub version: u64,\n/// Wrapped (encrypted) secret value\n\npub wrapped_value: String,\n/// Wrapping key ID\n\npub wrap_key_id: String,\n/// Ephemeral public key for unwrapping\n\npub ephemeral_public_key: String,\n/// Expiration\n\npub expires_at: chrono::DateTime\n}", "docs": "Wrapped secret response", "attributes": "#[derive(Debug, Clone)]", "line": 160 }, { "name": "service::BrokerService", "kind": "struct_item", "signature": "pub struct BrokerService {\n\n}", "docs": "The core broker service", "attributes": "", "line": 176 }, { "name": "service::BrokerService::new", "kind": "function_item", "signature": "pub async fn new(\n config: BrokerConfig,\n secret_store: Arc,\n audit_sink: Arc,\n ) -> ArsenalResult;", "docs": "Create a new broker service\n\n# Errors\nReturns an error if initialization fails", "attributes": "#[allow(clippy::too_many_lines)]", "line": 218 }, { "name": "service::BrokerService::with_signing_key", "kind": "function_item", "signature": "pub async fn with_signing_key(\n config: BrokerConfig,\n signing_key_seed: [u8; 32],\n secret_store: Arc,\n audit_sink: Arc,\n ) -> ArsenalResult;", "docs": "Create with an existing signing key\n\n# Errors\nReturns an error if the key is invalid", "attributes": "#[allow(clippy::too_many_lines)]", "line": 345 }, { "name": "service::BrokerService::check_http_rate_limit", "kind": "function_item", "signature": "pub async fn check_http_rate_limit(&self, key: &str) -> Option;", "docs": "Coarse front-door rate limit for a caller key.\n\nReturns `Some(retry_after_seconds)` if limited.", "attributes": "", "line": 472 }, { "name": "service::BrokerService::register_agent", "kind": "function_item", "signature": "pub async fn register_agent(&self, agent: RegisteredAgent);", "docs": "Register an agent", "attributes": "", "line": 483 }, { "name": "service::BrokerService::unregister_agent", "kind": "function_item", "signature": "pub async fn unregister_agent(&self, fingerprint: &KeyFingerprint);", "docs": "Unregister an agent", "attributes": "", "line": 490 }, { "name": "service::BrokerService::get_agent", "kind": "function_item", "signature": "pub async fn get_agent(&self, fingerprint: &KeyFingerprint) -> Option;", "docs": "Get a registered agent by fingerprint", "attributes": "", "line": 496 }, { "name": "service::BrokerService::add_policy", "kind": "function_item", "signature": "pub async fn add_policy(&self, policy: PolicyDocument);", "docs": "Add a policy", "attributes": "", "line": 502 }, { "name": "service::BrokerService::request_capability", "kind": "function_item", "signature": "pub async fn request_capability(\n &self,\n agent_fingerprint: &KeyFingerprint,\n request: CapabilityRequest,\n ctx: &RequestContext,\n ) -> ArsenalResult;", "docs": "Request a capability token\n\n# Errors\nReturns an error if the request is denied or invalid", "attributes": "#[allow(clippy::too_many_lines)]", "line": 512 }, { "name": "service::BrokerService::request_secret", "kind": "function_item", "signature": "pub async fn request_secret(\n &self,\n agent_fingerprint: &KeyFingerprint,\n request: SecretRequest,\n ctx: &RequestContext,\n ) -> ArsenalResult;", "docs": "Request a secret\n\n# Errors\nReturns an error if access is denied or the secret doesn't exist", "attributes": "#[allow(clippy::too_many_lines)]", "line": 746 }, { "name": "service::BrokerService::revoke_token", "kind": "function_item", "signature": "pub async fn revoke_token(\n &self,\n agent_fingerprint: &KeyFingerprint,\n token_id: &TokenId,\n reason: RevocationReason,\n ctx: &RequestContext,\n ) -> ArsenalResult<()>;", "docs": "Revoke a token\n\n# Errors\nReturns an error if revocation fails", "attributes": "", "line": 991 }, { "name": "service::BrokerService::verify_token", "kind": "function_item", "signature": "pub async fn verify_token(&self, token_b64: &str) -> ArsenalResult;", "docs": "Verify a token (for external validation)\n\n# Errors\nReturns an error if the token is invalid", "attributes": "", "line": 1037 }, { "name": "service::BrokerService::health", "kind": "function_item", "signature": "pub async fn health(&self) -> BrokerHealth;", "docs": "Get broker health status", "attributes": "", "line": 1108 }, { "name": "service::BrokerService::issue_dct", "kind": "function_item", "signature": "pub async fn issue_dct(\n &self,\n parent_token_b64: &str,\n delegated_variables: Vec,\n child_agent_did: &OasDid,\n child_agent_id: &AgentId,\n ttl_seconds: i64,\n ctx: &RequestContext,\n ) -> ArsenalResult<(String, chrono::DateTime)>;", "docs": "Issue a Delegated Credential Token (DCT).\n\nCreates a child ACT that grants proxy access to a subset of the parent's\ndelegated variables. The child token inherits the parent's constraints\nbut with narrower scope and shorter TTL.\n\n# Errors\n\nReturns an error if:\n- The parent token is invalid or expired\n- The requested variables are not in the parent's delegated set\n- The delegation depth exceeds the maximum\n- The requested TTL exceeds the parent's remaining lifetime\n`child_agent_did` names the token subject; `child_agent_id` keys the audit\nrecord. Both are required because the audit trail is still keyed by local\nsurrogate, which is tracked for migration to DIDs.", "attributes": "#[allow(clippy::similar_names)]", "line": 1136 }, { "name": "service::BrokerService::maintain_revocations", "kind": "function_item", "signature": "pub async fn maintain_revocations(&self);", "docs": "Run revocation store maintenance (cleanup + optional compaction).\n\nThis is safe to run periodically in the background. Compaction is a no-op for in-memory\nstores and will rewrite the on-disk snapshot for file-backed stores.", "attributes": "", "line": 1233 }, { "name": "service::BrokerHealth", "kind": "struct_item", "signature": "pub struct BrokerHealth {\n/// Status string\n\npub status: String,\n/// Version\n\npub version: String,\n/// Number of registered agents\n\npub registered_agents: usize,\n/// Number of revoked tokens\n\npub revoked_tokens: usize\n}", "docs": "Broker health status", "attributes": "#[derive(Debug, Clone, serde::Serialize)]", "line": 1481 } ], "parseErrors": false }, { "module": "ssrf_guard", "source": "arsenal/crates/arsenal-broker/src/ssrf_guard.rs", "sha256": "e8f8c4e2155fa0b45c5066053b61ad07925c471104f651d43455a908a2ad8ce6", "attributes": "", "items": [ { "name": "ssrf_guard::SsrfGuard", "kind": "struct_item", "signature": "pub struct SsrfGuard {\n\n}", "docs": "SSRF guard for validating proxy request destinations.", "attributes": "#[derive(Debug, Clone, Default)]", "line": 26 }, { "name": "ssrf_guard::SsrfGuard::new", "kind": "function_item", "signature": "pub fn new(blocked_domains: Vec) -> Self;", "docs": "Create a new SSRF guard with additional blocked domains.", "attributes": "#[must_use]", "line": 36 }, { "name": "ssrf_guard::SsrfGuard::permissive", "kind": "function_item", "signature": "pub fn permissive() -> Self;", "docs": "Create an SSRF guard that allows ALL destinations.\n\nThis completely disables SSRF protection including private IP blocking\nand HTTPS enforcement. Use ONLY in test environments with mock servers.", "attributes": "#[must_use]", "line": 51 }, { "name": "ssrf_guard::SsrfGuard::validate_ip", "kind": "function_item", "signature": "pub fn validate_ip(&self, ip: &IpAddr) -> ArsenalResult<()>;", "docs": "Check if an IP address is safe for proxy requests.\n\nReturns `Ok(())` if the IP is safe, or an error if it is blocked.\n\n# Errors\n\nReturns `ArsenalError` with `SsrfBlocked` code if the address is unsafe.", "attributes": "", "line": 65 }, { "name": "ssrf_guard::SsrfGuard::validate_host", "kind": "function_item", "signature": "pub fn validate_host(&self, host: &str) -> ArsenalResult<()>;", "docs": "Check if a hostname is safe for proxy requests.\n\nValidates that the hostname is not in the blocklist and does not\nresolve to a private IP range.\n\n# Errors\n\nReturns `ArsenalError` with `SsrfBlocked` code if the hostname is blocked.", "attributes": "", "line": 80 }, { "name": "ssrf_guard::SsrfGuard::validate_url", "kind": "function_item", "signature": "pub fn validate_url(&self, url: &str) -> ArsenalResult<()>;", "docs": "Full validation: validate a URL's host against SSRF protections.\n\n# Errors\n\nReturns `ArsenalError` with `SsrfBlocked` if the URL targets a blocked destination.", "attributes": "", "line": 123 }, { "name": "ssrf_guard::SsrfGuard::validate_url_resolved", "kind": "function_item", "signature": "pub async fn validate_url_resolved(\n &self,\n url: &str,\n ) -> ArsenalResult>;", "docs": "Full validation with DNS resolution: validates a URL and resolves its\nhostname to ensure it does not point to private/internal IP addresses.\n\nReturns the validated resolved socket addresses so that the caller can\n**pin** outbound connections to these IPs, preventing DNS rebinding\n(TOCTOU) attacks where the hostname re-resolves to a different address\nbetween validation and the actual HTTP request.\n\n# Errors\n\nReturns `ArsenalError` with `SsrfBlocked` if:\n- The URL is malformed or uses a non-HTTPS scheme\n- The hostname is in the blocklist\n- DNS resolution fails or returns no results\n- Any resolved IP is in a private/reserved range", "attributes": "", "line": 156 } ], "parseErrors": false } ] }, { "name": "arsenal-core", "url": "/reference/rust/arsenal-core", "modules": [ { "module": "crate", "source": "arsenal/crates/arsenal-core/src/lib.rs", "sha256": "13dfa8779257ee1a963ab68ee6489a3bda7f79157240c782eb47e7493c93d52f", "attributes": "", "items": [ { "name": "act", "kind": "module", "signature": "pub mod act;", "docs": "", "attributes": "", "line": 24 }, { "name": "audit", "kind": "module", "signature": "pub mod audit;", "docs": "", "attributes": "", "line": 25 }, { "name": "consent", "kind": "module", "signature": "pub mod consent;", "docs": "", "attributes": "", "line": 26 }, { "name": "constraints", "kind": "module", "signature": "pub mod constraints;", "docs": "", "attributes": "", "line": 27 }, { "name": "delegation", "kind": "module", "signature": "pub mod delegation;", "docs": "", "attributes": "", "line": 28 }, { "name": "error", "kind": "module", "signature": "pub mod error;", "docs": "", "attributes": "", "line": 29 }, { "name": "fingerprint", "kind": "module", "signature": "pub mod fingerprint;", "docs": "", "attributes": "", "line": 30 }, { "name": "identity", "kind": "module", "signature": "pub mod identity;", "docs": "", "attributes": "", "line": 31 }, { "name": "limits", "kind": "module", "signature": "pub mod limits;", "docs": "", "attributes": "", "line": 32 }, { "name": "policy", "kind": "module", "signature": "pub mod policy;", "docs": "", "attributes": "", "line": 33 }, { "name": "proxy", "kind": "module", "signature": "pub mod proxy;", "docs": "", "attributes": "", "line": 34 }, { "name": "scope", "kind": "module", "signature": "pub mod scope;", "docs": "", "attributes": "", "line": 35 }, { "name": "secret", "kind": "module", "signature": "pub mod secret;", "docs": "", "attributes": "", "line": 36 }, { "name": "session", "kind": "module", "signature": "pub mod session;", "docs": "", "attributes": "", "line": 37 }, { "name": "token", "kind": "module", "signature": "pub mod token;", "docs": "", "attributes": "", "line": 38 }, { "name": "pub use audit::{AuditEvent, AuditEventKind, AuditSeverity};", "kind": "use_declaration", "signature": "pub use audit::{AuditEvent, AuditEventKind, AuditSeverity};", "docs": "", "attributes": "", "line": 40 }, { "name": "pub use consent::{ConsentId, ConsentPolicy, ConsentRecord, ConsentRequest, ConsentStatus};", "kind": "use_declaration", "signature": "pub use consent::{ConsentId, ConsentPolicy, ConsentRecord, ConsentRequest, ConsentStatus};", "docs": "", "attributes": "", "line": 41 }, { "name": "pub use constraints::{BindingType, Constraints, EnvironmentConstraint};", "kind": "use_declaration", "signature": "pub use constraints::{BindingType, Constraints, EnvironmentConstraint};", "docs": "", "attributes": "", "line": 42 }, { "name": "pub use delegation::{DelegationChain, DelegationConstraints};", "kind": "use_declaration", "signature": "pub use delegation::{DelegationChain, DelegationConstraints};", "docs": "", "attributes": "", "line": 43 }, { "name": "pub use error::{ArsenalError, ArsenalResult};", "kind": "use_declaration", "signature": "pub use error::{ArsenalError, ArsenalResult};", "docs": "", "attributes": "", "line": 44 }, { "name": "pub use fingerprint::{FingerprintState, FingerprintVerification};", "kind": "use_declaration", "signature": "pub use fingerprint::{FingerprintState, FingerprintVerification};", "docs": "", "attributes": "", "line": 45 }, { "name": "pub use identity::{AgentIdentity, PrincipalId, TenantId};", "kind": "use_declaration", "signature": "pub use identity::{AgentIdentity, PrincipalId, TenantId};", "docs": "", "attributes": "", "line": 46 }, { "name": "pub use limits::{RateLimits, UsageBudget};", "kind": "use_declaration", "signature": "pub use limits::{RateLimits, UsageBudget};", "docs": "", "attributes": "", "line": 47 }, { "name": "pub use policy::{PolicyDocument, PolicyEffect, PolicyId};", "kind": "use_declaration", "signature": "pub use policy::{PolicyDocument, PolicyEffect, PolicyId};", "docs": "", "attributes": "", "line": 48 }, { "name": "pub use proxy::{\n DestinationBinding, ProxyMetadata, ProxyRequest, ProxyResponse, TemplateVariable,\n VariablePrefix, VariableResolutionTable,\n};", "kind": "use_declaration", "signature": "pub use proxy::{\n DestinationBinding, ProxyMetadata, ProxyRequest, ProxyResponse, TemplateVariable,\n VariablePrefix, VariableResolutionTable,\n};", "docs": "", "attributes": "", "line": 49 }, { "name": "pub use scope::{Permission, Scope, ScopeSet};", "kind": "use_declaration", "signature": "pub use scope::{Permission, Scope, ScopeSet};", "docs": "", "attributes": "", "line": 53 }, { "name": "pub use secret::{SecretId, SecretMetadata, SecretVersion};", "kind": "use_declaration", "signature": "pub use secret::{SecretId, SecretMetadata, SecretVersion};", "docs": "", "attributes": "", "line": 54 }, { "name": "pub use session::{AgentSession, SessionId, SessionState};", "kind": "use_declaration", "signature": "pub use session::{AgentSession, SessionId, SessionState};", "docs": "", "attributes": "", "line": 55 }, { "name": "pub use token::{AgentCapabilityToken, TokenClaims, TokenId};", "kind": "use_declaration", "signature": "pub use token::{AgentCapabilityToken, TokenClaims, TokenId};", "docs": "", "attributes": "", "line": 56 }, { "name": "prelude", "kind": "module", "signature": "pub mod prelude;", "docs": "Re-export commonly used external types", "attributes": "", "line": 59 }, { "name": "pub use super::consent::{ConsentRecord, ConsentStatus};", "kind": "use_declaration", "signature": "pub use super::consent::{ConsentRecord, ConsentStatus};", "docs": "", "attributes": "", "line": 60 }, { "name": "pub use super::error::{ArsenalError, ArsenalResult};", "kind": "use_declaration", "signature": "pub use super::error::{ArsenalError, ArsenalResult};", "docs": "", "attributes": "", "line": 61 }, { "name": "pub use super::fingerprint::{FingerprintState, FingerprintVerification};", "kind": "use_declaration", "signature": "pub use super::fingerprint::{FingerprintState, FingerprintVerification};", "docs": "", "attributes": "", "line": 62 }, { "name": "pub use super::identity::{AgentIdentity, PrincipalId, TenantId};", "kind": "use_declaration", "signature": "pub use super::identity::{AgentIdentity, PrincipalId, TenantId};", "docs": "", "attributes": "", "line": 63 }, { "name": "pub use super::proxy::{DestinationBinding, ProxyRequest, ProxyResponse, TemplateVariable};", "kind": "use_declaration", "signature": "pub use super::proxy::{DestinationBinding, ProxyRequest, ProxyResponse, TemplateVariable};", "docs": "", "attributes": "", "line": 64 }, { "name": "pub use super::scope::{Permission, Scope, ScopeSet};", "kind": "use_declaration", "signature": "pub use super::scope::{Permission, Scope, ScopeSet};", "docs": "", "attributes": "", "line": 65 }, { "name": "pub use super::secret::{SecretId, SecretVersion};", "kind": "use_declaration", "signature": "pub use super::secret::{SecretId, SecretVersion};", "docs": "", "attributes": "", "line": 66 }, { "name": "pub use super::session::{SessionId, SessionState};", "kind": "use_declaration", "signature": "pub use super::session::{SessionId, SessionState};", "docs": "", "attributes": "", "line": 67 }, { "name": "pub use super::token::{AgentCapabilityToken, TokenId};", "kind": "use_declaration", "signature": "pub use super::token::{AgentCapabilityToken, TokenId};", "docs": "", "attributes": "", "line": 68 } ], "parseErrors": false }, { "module": "act", "source": "arsenal/crates/arsenal-core/src/act.rs", "sha256": "d4c5be0a419cb65effe0176715bed4cb77511de0dfd2d985ecd0c8c7d9a016d4", "attributes": "", "items": [ { "name": "act::ext_keys", "kind": "module", "signature": "pub mod ext_keys;", "docs": "Keys under which Arsenal's issuer-specific claims travel in `ext`.\n\nNamespaced, because `ext` is a shared space: another issuer minting ACTs for\nthe same audience must be able to add its own claims without colliding with\nArsenal's.", "attributes": "", "line": 45 }, { "name": "act::ext_keys::CONSTRAINTS", "kind": "const_item", "signature": "pub const CONSTRAINTS: &str;", "docs": "Binding constraints ([`crate::constraints::Constraints`]).", "attributes": "", "line": 47 }, { "name": "act::ext_keys::LIMITS", "kind": "const_item", "signature": "pub const LIMITS: &str;", "docs": "Rate limits ([`crate::limits::RateLimits`]).", "attributes": "", "line": 49 }, { "name": "act::ext_keys::BUDGET", "kind": "const_item", "signature": "pub const BUDGET: &str;", "docs": "Usage budget ([`crate::limits::UsageBudget`]).", "attributes": "", "line": 51 }, { "name": "act::ext_keys::TRACE", "kind": "const_item", "signature": "pub const TRACE: &str;", "docs": "Audit trace ([`crate::token::TokenTrace`]).", "attributes": "", "line": 53 }, { "name": "act::ext_keys::DELEGATED_VARIABLES", "kind": "const_item", "signature": "pub const DELEGATED_VARIABLES: &str;", "docs": "Credential variables reachable through the proxy.", "attributes": "", "line": 55 }, { "name": "act::ext_keys::MAX_DELEGATION_DEPTH", "kind": "const_item", "signature": "pub const MAX_DELEGATION_DEPTH: &str;", "docs": "Delegation depth ceiling for credential tokens.", "attributes": "", "line": 57 }, { "name": "act::ext_keys::DELEGATION_REQUIRE_APPROVAL", "kind": "const_item", "signature": "pub const DELEGATION_REQUIRE_APPROVAL: &str;", "docs": "Whether onward delegation needs explicit human approval.\n\nPart of Arsenal's delegation constraints with no canonical counterpart:\nthe wire format governs whether delegation is *permitted*, while approval\nis a workflow Arsenal runs.", "attributes": "", "line": 63 } ], "parseErrors": false }, { "module": "audit", "source": "arsenal/crates/arsenal-core/src/audit.rs", "sha256": "2ab608239c5af9cc3d66b8ddefc3d5559f66b2d108b566125c05190dee89a546", "attributes": "", "items": [ { "name": "audit::AuditEvent", "kind": "struct_item", "signature": "pub struct AuditEvent {\n/// Unique event ID\n\npub id: AuditEventId,\n/// When the event occurred\n\npub timestamp: chrono::DateTime,\n/// Event kind\n\npub kind: AuditEventKind,\n/// Severity level\n\npub severity: AuditSeverity,\n/// Tenant context\n\npub tenant_id: TenantId,\n/// Agent involved (if any)\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub agent_id: Option,\n/// Session involved (if any)\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub session_id: Option,\n/// Token involved (if any)\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub token_id: Option,\n/// Outcome of the operation\n\npub outcome: AuditOutcome,\n/// Human-readable description\n\npub description: String,\n/// Additional structured data\n\n#[serde(default)]\npub metadata: HashMap,\n/// Client IP address (if available)\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub client_ip: Option,\n/// User agent (if available)\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub user_agent: Option,\n/// Request ID for correlation\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub request_id: Option,\n/// Hash of the previous event (for chain integrity)\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub previous_hash: Option<[u8; 32]>,\n/// Hash of this event\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub event_hash: Option<[u8; 32]>\n}", "docs": "Audit event - a single auditable occurrence", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 20 }, { "name": "audit::AuditEvent::builder", "kind": "function_item", "signature": "pub fn builder(kind: AuditEventKind, tenant_id: TenantId) -> AuditEventBuilder;", "docs": "Create a new audit event builder", "attributes": "#[must_use]", "line": 67 }, { "name": "audit::AuditEvent::compute_hash", "kind": "function_item", "signature": "pub fn compute_hash(&self) -> [u8; 32];", "docs": "Compute the hash of this event", "attributes": "#[must_use]", "line": 73 }, { "name": "audit::AuditEvent::verify_hash", "kind": "function_item", "signature": "pub fn verify_hash(&self) -> bool;", "docs": "Verify the event hash", "attributes": "#[must_use]", "line": 95 }, { "name": "audit::AuditEvent::to_json", "kind": "function_item", "signature": "pub fn to_json(&self) -> Result;", "docs": "Serialize to JSON\n\n# Errors\nReturns an error if serialization fails", "attributes": "", "line": 114 }, { "name": "audit::AuditEvent::to_json_pretty", "kind": "function_item", "signature": "pub fn to_json_pretty(&self) -> Result;", "docs": "Serialize to JSON (pretty)\n\n# Errors\nReturns an error if serialization fails", "attributes": "", "line": 122 }, { "name": "audit::AuditEventId", "kind": "struct_item", "signature": "pub struct AuditEventId(Uuid);", "docs": "Audit event ID", "attributes": "#[derive(Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(transparent)]", "line": 130 }, { "name": "audit::AuditEventId::generate", "kind": "function_item", "signature": "pub fn generate() -> Self;", "docs": "Generate a new event ID", "attributes": "#[must_use]", "line": 135 }, { "name": "audit::AuditEventId::as_uuid", "kind": "function_item", "signature": "pub const fn as_uuid(&self) -> &Uuid;", "docs": "Get the inner UUID", "attributes": "#[must_use]", "line": 141 }, { "name": "audit::AuditEventKind", "kind": "enum_item", "signature": "pub enum AuditEventKind {\n // Authentication events\n /// Agent authentication attempt\n AgentAuthentication,\n /// Session started\n SessionStarted,\n /// Session ended\n SessionEnded,\n /// Session renewed\n SessionRenewed,\n /// Session revoked\n SessionRevoked,\n\n // Token events\n /// Token issued\n TokenIssued,\n /// Token verified\n TokenVerified,\n /// Token rejected\n TokenRejected,\n /// Token revoked\n TokenRevoked,\n /// Token expired\n TokenExpired,\n\n // Capability events\n /// Capability requested\n CapabilityRequested,\n /// Capability granted\n CapabilityGranted,\n /// Capability denied\n CapabilityDenied,\n /// Capability delegated\n CapabilityDelegated,\n\n // Secret events\n /// Secret created\n SecretCreated,\n /// Secret accessed\n SecretAccessed,\n /// Secret rotated\n SecretRotated,\n /// Secret deleted\n SecretDeleted,\n /// Secret unwrapped\n SecretUnwrapped,\n\n // Policy events\n /// Policy created\n PolicyCreated,\n /// Policy updated\n PolicyUpdated,\n /// Policy deleted\n PolicyDeleted,\n /// Policy evaluated\n PolicyEvaluated,\n\n // Administrative events\n /// Agent created\n AgentCreated,\n /// Agent updated\n AgentUpdated,\n /// Agent deactivated\n AgentDeactivated,\n /// Tenant created\n TenantCreated,\n /// Tenant updated\n TenantUpdated,\n /// Tenant suspended\n TenantSuspended,\n\n // Security events\n /// Rate limit exceeded\n RateLimitExceeded,\n /// Budget exhausted\n BudgetExhausted,\n /// Constraint violated\n ConstraintViolated,\n /// Suspicious activity detected\n SuspiciousActivity,\n /// Security alert\n SecurityAlert,\n\n // System events\n /// System startup\n SystemStartup,\n /// System shutdown\n SystemShutdown,\n /// Configuration changed\n ConfigurationChanged,\n /// Key rotation\n KeyRotation,\n\n // Proxy events\n /// Proxy request processed\n ProxyRequest,\n /// Proxy request denied by policy or binding\n ProxyRequestDenied,\n /// Proxy destination binding violated\n ProxyDestinationViolation,\n /// Proxy resolved credential variables for a request\n ProxyCredentialResolved,\n\n // Fingerprint events\n /// Agent fingerprint verified successfully\n FingerprintVerified,\n /// Agent fingerprint mismatch detected (potential key theft)\n FingerprintMismatch,\n /// Agent fingerprint state was reset\n FingerprintReset,\n\n // Consent events\n /// Consent was requested from a human\n ConsentRequested,\n /// Consent was granted by a human\n ConsentGranted,\n /// Consent was denied by a human\n ConsentDenied,\n /// Consent was revoked\n ConsentRevoked,\n\n // Delegated credential token events\n /// Delegated credential token was issued\n DctIssued,\n /// Delegated credential token was used in a proxy request\n DctUsed,\n}", "docs": "Categories of audit events", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(rename_all = \"snake_case\")]", "line": 161 }, { "name": "audit::AuditEventKind::default_severity", "kind": "function_item", "signature": "pub const fn default_severity(&self) -> AuditSeverity;", "docs": "Get the default severity for this event kind", "attributes": "#[must_use]", "line": 292 }, { "name": "audit::AuditEventKind::is_security_relevant", "kind": "function_item", "signature": "pub const fn is_security_relevant(&self) -> bool;", "docs": "Check if this is a security-relevant event", "attributes": "#[must_use]", "line": 329 }, { "name": "audit::AuditSeverity", "kind": "enum_item", "signature": "pub enum AuditSeverity {\n /// Informational - routine operations\n Low,\n /// Medium - notable but expected operations\n Medium,\n /// High - significant security events\n High,\n /// Critical - requires immediate attention\n Critical,\n}", "docs": "Severity levels for audit events", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]\n#[serde(rename_all = \"lowercase\")]", "line": 356 }, { "name": "audit::AuditSeverity::as_str", "kind": "function_item", "signature": "pub const fn as_str(&self) -> &'static str;", "docs": "Get string representation", "attributes": "#[must_use]", "line": 370 }, { "name": "audit::AuditOutcome", "kind": "enum_item", "signature": "pub enum AuditOutcome {\n /// Operation succeeded\n Success,\n /// Operation failed\n Failure,\n /// Operation was denied by policy\n Denied,\n /// Operation timed out\n Timeout,\n /// Operation had an error\n Error,\n}", "docs": "Outcome of an audited operation", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(rename_all = \"lowercase\")]", "line": 389 }, { "name": "audit::AuditOutcome::is_success", "kind": "function_item", "signature": "pub const fn is_success(&self) -> bool;", "docs": "Check if the outcome indicates success", "attributes": "#[must_use]", "line": 405 }, { "name": "audit::AuditEventBuilder", "kind": "struct_item", "signature": "pub struct AuditEventBuilder {\n\n}", "docs": "Builder for audit events", "attributes": "#[derive(Debug)]", "line": 412 }, { "name": "audit::AuditEventBuilder::new", "kind": "function_item", "signature": "pub fn new(kind: AuditEventKind, tenant_id: TenantId) -> Self;", "docs": "Create a new builder", "attributes": "#[must_use]", "line": 431 }, { "name": "audit::AuditEventBuilder::severity", "kind": "function_item", "signature": "pub fn severity(mut self, severity: AuditSeverity) -> Self;", "docs": "Set severity", "attributes": "#[must_use]", "line": 451 }, { "name": "audit::AuditEventBuilder::agent", "kind": "function_item", "signature": "pub fn agent(mut self, agent_id: AgentId) -> Self;", "docs": "Set agent ID", "attributes": "#[must_use]", "line": 458 }, { "name": "audit::AuditEventBuilder::session", "kind": "function_item", "signature": "pub fn session(mut self, session_id: SessionId) -> Self;", "docs": "Set session ID", "attributes": "#[must_use]", "line": 465 }, { "name": "audit::AuditEventBuilder::token", "kind": "function_item", "signature": "pub fn token(mut self, token_id: TokenId) -> Self;", "docs": "Set token ID", "attributes": "#[must_use]", "line": 472 }, { "name": "audit::AuditEventBuilder::outcome", "kind": "function_item", "signature": "pub fn outcome(mut self, outcome: AuditOutcome) -> Self;", "docs": "Set outcome", "attributes": "#[must_use]", "line": 479 }, { "name": "audit::AuditEventBuilder::description", "kind": "function_item", "signature": "pub fn description(mut self, description: impl Into) -> Self;", "docs": "Set description", "attributes": "#[must_use]", "line": 486 }, { "name": "audit::AuditEventBuilder::metadata", "kind": "function_item", "signature": "pub fn metadata(mut self, key: impl Into, value: impl Serialize) -> Self;", "docs": "Add metadata", "attributes": "#[must_use]", "line": 493 }, { "name": "audit::AuditEventBuilder::client_ip", "kind": "function_item", "signature": "pub fn client_ip(mut self, ip: impl Into) -> Self;", "docs": "Set client IP", "attributes": "#[must_use]", "line": 502 }, { "name": "audit::AuditEventBuilder::user_agent", "kind": "function_item", "signature": "pub fn user_agent(mut self, ua: impl Into) -> Self;", "docs": "Set user agent", "attributes": "#[must_use]", "line": 509 }, { "name": "audit::AuditEventBuilder::request_id", "kind": "function_item", "signature": "pub fn request_id(mut self, id: Uuid) -> Self;", "docs": "Set request ID", "attributes": "#[must_use]", "line": 516 }, { "name": "audit::AuditEventBuilder::previous_hash", "kind": "function_item", "signature": "pub fn previous_hash(mut self, hash: [u8; 32]) -> Self;", "docs": "Set previous hash for chain integrity", "attributes": "#[must_use]", "line": 523 }, { "name": "audit::AuditEventBuilder::build", "kind": "function_item", "signature": "pub fn build(self) -> AuditEvent;", "docs": "Build the audit event", "attributes": "#[must_use]", "line": 530 }, { "name": "audit::AuditLog", "kind": "struct_item", "signature": "pub struct AuditLog {\n\n}", "docs": "Audit log for collecting events", "attributes": "#[derive(Debug, Default)]", "line": 563 }, { "name": "audit::AuditLog::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Create a new audit log", "attributes": "#[must_use]", "line": 573 }, { "name": "audit::AuditLog::append", "kind": "function_item", "signature": "pub fn append(&mut self, mut event: AuditEvent);", "docs": "Add an event to the log", "attributes": "", "line": 578 }, { "name": "audit::AuditLog::events", "kind": "function_item", "signature": "pub fn events(&self) -> &[AuditEvent];", "docs": "Get all events", "attributes": "#[must_use]", "line": 589 }, { "name": "audit::AuditLog::events_by_kind", "kind": "function_item", "signature": "pub fn events_by_kind(&self, kind: AuditEventKind) -> Vec<&AuditEvent>;", "docs": "Get events by kind", "attributes": "#[must_use]", "line": 595 }, { "name": "audit::AuditLog::events_by_severity", "kind": "function_item", "signature": "pub fn events_by_severity(&self, min_severity: AuditSeverity) -> Vec<&AuditEvent>;", "docs": "Get events by severity", "attributes": "#[must_use]", "line": 601 }, { "name": "audit::AuditLog::verify_chain", "kind": "function_item", "signature": "pub fn verify_chain(&self) -> bool;", "docs": "Verify chain integrity", "attributes": "#[must_use]", "line": 610 }, { "name": "audit::AuditLog::len", "kind": "function_item", "signature": "pub fn len(&self) -> usize;", "docs": "Get the number of events", "attributes": "#[must_use]", "line": 632 }, { "name": "audit::AuditLog::is_empty", "kind": "function_item", "signature": "pub fn is_empty(&self) -> bool;", "docs": "Check if the log is empty", "attributes": "#[must_use]", "line": 638 } ], "parseErrors": false }, { "module": "consent", "source": "arsenal/crates/arsenal-core/src/consent.rs", "sha256": "7e190e9a4d86a5cd1177f2673c7134f73806ae4a4816fd658f564d477e7db94f", "attributes": "", "items": [ { "name": "consent::ConsentId", "kind": "struct_item", "signature": "pub struct ConsentId(Uuid);", "docs": "Unique identifier for a consent record", "attributes": "#[derive(Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(transparent)]", "line": 38 }, { "name": "consent::ConsentId::generate", "kind": "function_item", "signature": "pub fn generate() -> Self;", "docs": "Generate a new consent ID", "attributes": "#[must_use]", "line": 43 }, { "name": "consent::ConsentId::from_uuid", "kind": "function_item", "signature": "pub const fn from_uuid(uuid: Uuid) -> Self;", "docs": "Create from an existing UUID", "attributes": "#[must_use]", "line": 49 }, { "name": "consent::ConsentId::as_uuid", "kind": "function_item", "signature": "pub const fn as_uuid(&self) -> &Uuid;", "docs": "Get the inner UUID", "attributes": "#[must_use]", "line": 55 }, { "name": "consent::ConsentRecord", "kind": "struct_item", "signature": "pub struct ConsentRecord {\n/// Unique consent record ID\n\npub consent_id: ConsentId,\n/// Tenant this consent record belongs to (multi-tenant isolation)\n\npub tenant_id: TenantId,\n/// DID of the agent granted access\n\npub agent_did: String,\n/// DID of the human who granted consent\n\npub human_root_did: String,\n/// Template variable names the agent may access\n\npub variables: Vec,\n/// Target domains the agent may reach with these credentials\n\npub destination_domains: Vec,\n/// Scopes the consent covers\n\npub scopes: Vec,\n/// Human-readable identifier of who granted consent\n\npub granted_by: String,\n/// When consent was granted\n\npub granted_at: chrono::DateTime,\n/// When this consent expires\n\npub expires_at: chrono::DateTime,\n/// Ed25519 signature by the human over canonical record bytes\n\npub signature: Vec,\n/// Whether this consent can be revoked (always true)\n\n#[serde(default = \"default_revocable\")]\npub revocable: bool,\n/// Whether this consent has been revoked\n\n#[serde(default)]\npub revoked: bool,\n/// When this consent was revoked, if applicable\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub revoked_at: Option>\n}", "docs": "A signed consent record authorizing agent credential access.\n\nConsent records are immutable once created. They can be revoked but\nnever modified. The `signature` field contains an Ed25519 signature\nover the canonical CBOR encoding of the record (excluding the signature\nand revocation fields).", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 79 }, { "name": "consent::ConsentRecord::is_valid", "kind": "function_item", "signature": "pub fn is_valid(&self) -> bool;", "docs": "Check if this consent record is currently valid.\n\nA record is valid if it is not revoked and has not expired.", "attributes": "#[must_use]", "line": 123 }, { "name": "consent::ConsentRecord::covers_variable", "kind": "function_item", "signature": "pub fn covers_variable(&self, variable: &str) -> bool;", "docs": "Check if this consent covers a specific variable.", "attributes": "#[must_use]", "line": 129 }, { "name": "consent::ConsentRecord::covers_domain", "kind": "function_item", "signature": "pub fn covers_domain(&self, domain: &str) -> bool;", "docs": "Check if this consent covers a specific domain.", "attributes": "#[must_use]", "line": 135 }, { "name": "consent::ConsentRecord::revoke", "kind": "function_item", "signature": "pub fn revoke(&mut self);", "docs": "Revoke this consent record.", "attributes": "", "line": 143 }, { "name": "consent::ConsentRecord::signing_bytes", "kind": "function_item", "signature": "pub fn signing_bytes(&self) -> ArsenalResult>;", "docs": "Get the canonical bytes for signing/verification.\n\nSerializes all fields except `signature`, `revoked`, and `revoked_at`\nto a deterministic CBOR representation.\n\n# Errors\n\nReturns an error if serialization fails.", "attributes": "", "line": 156 }, { "name": "consent::ConsentPolicy", "kind": "enum_item", "signature": "pub enum ConsentPolicy {\n /// Consent required for each individual variable\n #[default]\n PerVariable,\n /// Consent required per provider/service\n PerProvider,\n /// Consent required per agent (blanket consent)\n PerAgent,\n}", "docs": "Consent policy determining the granularity of consent checks.", "attributes": "#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(rename_all = \"snake_case\")]", "line": 199 }, { "name": "consent::ConsentPolicy::as_str", "kind": "function_item", "signature": "pub const fn as_str(&self) -> &'static str;", "docs": "Get the string representation", "attributes": "#[must_use]", "line": 212 }, { "name": "consent::ConsentStatus", "kind": "enum_item", "signature": "pub enum ConsentStatus {\n /// Consent was pre-approved (e.g., by policy)\n PreApproved,\n /// Consent has been explicitly approved by a human\n Approved,\n /// Consent is pending human review\n Pending,\n /// Consent was explicitly denied\n Denied,\n /// Consent was previously granted but has been revoked\n Revoked,\n /// Consent is not required for this operation\n NotRequired,\n}", "docs": "Status of consent for a credential operation.", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(rename_all = \"snake_case\")]", "line": 232 }, { "name": "consent::ConsentStatus::allows_operation", "kind": "function_item", "signature": "pub const fn allows_operation(&self) -> bool;", "docs": "Check if this status allows the operation to proceed.", "attributes": "#[must_use]", "line": 250 }, { "name": "consent::ConsentStatus::as_str", "kind": "function_item", "signature": "pub const fn as_str(&self) -> &'static str;", "docs": "Get the string representation", "attributes": "#[must_use]", "line": 256 }, { "name": "consent::ConsentRequest", "kind": "struct_item", "signature": "pub struct ConsentRequest {\n/// Unique request ID\n\npub request_id: Uuid,\n/// DID of the requesting agent\n\npub agent_did: String,\n/// DID of the human who must approve\n\npub human_root_did: String,\n/// Variables the agent wants to access\n\npub variables: Vec,\n/// Destination domains the agent wants to reach\n\npub destination_domains: Vec,\n/// Scopes being requested\n\npub scopes: Vec,\n/// When this request was created\n\npub created_at: chrono::DateTime,\n/// When this request expires if not acted upon\n\npub expires_at: chrono::DateTime\n}", "docs": "A request for consent from an agent.\n\nCreated when an agent attempts to access credentials that require\nhuman consent. The broker holds the proxy request until consent is\ngranted or denied.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 280 }, { "name": "consent::ConsentRequest::new", "kind": "function_item", "signature": "pub fn new(\n agent_did: impl Into,\n human_root_did: impl Into,\n variables: Vec,\n destination_domains: Vec,\n scopes: Vec,\n ) -> ArsenalResult;", "docs": "Create a new consent request.\n\n# Errors\n\nReturns an error if validation fails.", "attributes": "", "line": 305 }, { "name": "consent::ConsentRequest::is_expired", "kind": "function_item", "signature": "pub fn is_expired(&self) -> bool;", "docs": "Check if this consent request has expired.", "attributes": "#[must_use]", "line": 350 } ], "parseErrors": false }, { "module": "constraints", "source": "arsenal/crates/arsenal-core/src/constraints.rs", "sha256": "1d21f4bb1d751b9f986249d128ad97ed164d9f21534029f2cd3c715e61265bda", "attributes": "", "items": [ { "name": "constraints::Constraints", "kind": "struct_item", "signature": "pub struct Constraints {\n/// Device binding - token only valid from specific device\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub device_binding: Option,\n/// Session binding - token bound to a specific session\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub session_binding: Option,\n/// Browser/origin binding - token only valid from specific origins\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub origin_binding: Option,\n/// Network constraints - IP allowlist/denylist\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub network_constraints: Option,\n/// Time-based constraints\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub time_constraints: Option,\n/// Environment constraints\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub environment_constraints: Option,\n/// Proof-of-possession required\n\n#[serde(default)]\npub require_pop: bool\n}", "docs": "Constraints that must be satisfied for a token to be valid", "attributes": "#[derive(Debug, Clone, Default, Serialize, Deserialize)]", "line": 15 }, { "name": "constraints::Constraints::none", "kind": "function_item", "signature": "pub fn none() -> Self;", "docs": "Create empty constraints (no restrictions)", "attributes": "#[must_use]", "line": 48 }, { "name": "constraints::Constraints::with_pop", "kind": "function_item", "signature": "pub fn with_pop() -> Self;", "docs": "Create constraints requiring proof-of-possession", "attributes": "#[must_use]", "line": 54 }, { "name": "constraints::Constraints::with_device", "kind": "function_item", "signature": "pub fn with_device(mut self, device_id: DeviceId) -> Self;", "docs": "Add device binding", "attributes": "#[must_use]", "line": 63 }, { "name": "constraints::Constraints::with_origins", "kind": "function_item", "signature": "pub fn with_origins(mut self, origins: Vec) -> Self;", "docs": "Add origin binding", "attributes": "#[must_use]", "line": 73 }, { "name": "constraints::Constraints::with_time_window", "kind": "function_item", "signature": "pub fn with_time_window(\n mut self,\n not_before: chrono::DateTime,\n not_after: chrono::DateTime,\n ) -> Self;", "docs": "Add time constraints", "attributes": "#[must_use]", "line": 82 }, { "name": "constraints::Constraints::validate", "kind": "function_item", "signature": "pub fn validate(&self, context: &ConstraintContext) -> ArsenalResult<()>;", "docs": "Check if all constraints are satisfied\n\n# Errors\n\nReturns an error if any constraint is violated.", "attributes": "", "line": 101 }, { "name": "constraints::DeviceBinding", "kind": "struct_item", "signature": "pub struct DeviceBinding {\n/// The device this token is bound to\n\npub device_id: DeviceId,\n/// Type of binding\n\npub binding_type: BindingType\n}", "docs": "Device binding configuration", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 126 }, { "name": "constraints::SessionBinding", "kind": "struct_item", "signature": "pub struct SessionBinding {\n/// The session ID this token is bound to\n\npub session_id: String,\n/// Hash of the session key for verification\n\npub session_key_hash: Option<[u8; 32]>\n}", "docs": "Session binding configuration", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 155 }, { "name": "constraints::OriginBinding", "kind": "struct_item", "signature": "pub struct OriginBinding {\n/// Allowed origins\n\npub allowed_origins: HashSet\n}", "docs": "Origin binding configuration", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 192 }, { "name": "constraints::NetworkConstraints", "kind": "struct_item", "signature": "pub struct NetworkConstraints {\n/// Allowed IP addresses\n\n#[serde(default)]\npub allowed_ips: HashSet,\n/// Denied IP addresses\n\n#[serde(default)]\npub denied_ips: HashSet,\n/// Allowed CIDR ranges\n\n#[serde(default)]\npub allowed_cidrs: Vec,\n/// Allowed ASNs\n\n#[serde(default)]\npub allowed_asns: HashSet\n}", "docs": "Network constraints", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 217 }, { "name": "constraints::TimeConstraints", "kind": "struct_item", "signature": "pub struct TimeConstraints {\n/// Token not valid before this time\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub not_before: Option>,\n/// Token not valid after this time\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub not_after: Option>,\n/// Allowed hours of day (0-23)\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub allowed_hours: Option>,\n/// Allowed days of week (0=Sunday, 6=Saturday)\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub allowed_days: Option>\n}", "docs": "Time-based constraints", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 267 }, { "name": "constraints::EnvironmentConstraint", "kind": "struct_item", "signature": "pub struct EnvironmentConstraint {\n/// Required environment\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub required_environment: Option,\n/// Required tags that must be present\n\n#[serde(default)]\npub required_tags: HashSet,\n/// Forbidden tags that must not be present\n\n#[serde(default)]\npub forbidden_tags: HashSet\n}", "docs": "Environment constraints", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 307 }, { "name": "constraints::BindingType", "kind": "enum_item", "signature": "pub enum BindingType {\n /// Binding must be satisfied\n Required,\n /// Binding is preferred but not required\n Preferred,\n}", "docs": "Type of binding enforcement", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"lowercase\")]", "line": 358 }, { "name": "constraints::ConstraintContext", "kind": "struct_item", "signature": "pub struct ConstraintContext {\n/// Current time for time-based checks\n\npub current_time: chrono::DateTime,\n/// Device ID if available\n\npub device_id: Option,\n/// Session ID if available\n\npub session_id: Option,\n/// Session key hash if available\n\npub session_key_hash: Option<[u8; 32]>,\n/// Request origin if available\n\npub origin: Option,\n/// Client IP address if available\n\npub client_ip: Option,\n/// Current environment\n\npub environment: Option,\n/// Current tags\n\npub tags: HashSet\n}", "docs": "Context for constraint validation", "attributes": "#[derive(Debug, Clone, Default)]", "line": 367 }, { "name": "constraints::ConstraintContext::now", "kind": "function_item", "signature": "pub fn now() -> Self;", "docs": "Create a new context with current time", "attributes": "#[must_use]", "line": 389 }, { "name": "constraints::ConstraintContext::with_device", "kind": "function_item", "signature": "pub fn with_device(mut self, device_id: DeviceId) -> Self;", "docs": "Set device ID", "attributes": "#[must_use]", "line": 398 }, { "name": "constraints::ConstraintContext::with_session", "kind": "function_item", "signature": "pub fn with_session(mut self, session_id: impl Into) -> Self;", "docs": "Set session ID", "attributes": "#[must_use]", "line": 405 }, { "name": "constraints::ConstraintContext::with_origin", "kind": "function_item", "signature": "pub fn with_origin(mut self, origin: impl Into) -> Self;", "docs": "Set origin", "attributes": "#[must_use]", "line": 412 }, { "name": "constraints::ConstraintContext::with_client_ip", "kind": "function_item", "signature": "pub fn with_client_ip(mut self, ip: IpAddr) -> Self;", "docs": "Set client IP", "attributes": "#[must_use]", "line": 419 }, { "name": "constraints::ConstraintContext::with_environment", "kind": "function_item", "signature": "pub fn with_environment(mut self, env: impl Into) -> Self;", "docs": "Set environment", "attributes": "#[must_use]", "line": 426 }, { "name": "constraints::ConstraintContext::with_tag", "kind": "function_item", "signature": "pub fn with_tag(mut self, tag: impl Into) -> Self;", "docs": "Add a tag", "attributes": "#[must_use]", "line": 433 } ], "parseErrors": false }, { "module": "delegation", "source": "arsenal/crates/arsenal-core/src/delegation.rs", "sha256": "496b1578b6c1df82d7a5daeb80af45a1debdcf1d398fcac40c4963105d8969e7", "attributes": "", "items": [ { "name": "delegation::DelegationConstraints", "kind": "struct_item", "signature": "pub struct DelegationConstraints {\n/// Whether delegation is allowed at all\n\npub allow_delegation: bool,\n/// Maximum depth of delegation (0 = no further delegation)\n\npub max_depth: u8,\n/// Scopes that can be delegated (must be subset of parent)\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub delegatable_scopes: Option,\n/// Agents that can receive delegation, named by OAS DID\n\n///\n\n/// A DID rather than a local key, because this constraint is a token claim:\n\n/// whoever verifies the delegated token must be able to resolve the identity\n\n/// it names.\n\n#[serde(default)]\npub allowed_delegates: Vec,\n/// Whether any agent can receive delegation\n\npub allow_any_delegate: bool,\n/// Maximum TTL reduction required (seconds)\n\npub min_ttl_reduction: i64,\n/// Require explicit approval for delegation\n\npub require_approval: bool\n}", "docs": "Delegation constraints - what can be delegated", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 23 }, { "name": "delegation::DelegationConstraints::allow", "kind": "function_item", "signature": "pub fn allow(max_depth: u8) -> Self;", "docs": "Create constraints that allow delegation", "attributes": "#[must_use]", "line": 63 }, { "name": "delegation::DelegationConstraints::deny", "kind": "function_item", "signature": "pub fn deny() -> Self;", "docs": "Create constraints that deny delegation", "attributes": "#[must_use]", "line": 77 }, { "name": "delegation::DelegationConstraints::can_delegate_to", "kind": "function_item", "signature": "pub fn can_delegate_to(&self, agent_did: &OasDid) -> bool;", "docs": "Check if delegation to a specific agent is allowed", "attributes": "#[must_use]", "line": 83 }, { "name": "delegation::DelegationConstraints::can_delegate_scope", "kind": "function_item", "signature": "pub fn can_delegate_scope(&self, scope: &ScopeSet) -> bool;", "docs": "Check if a scope can be delegated", "attributes": "#[must_use]", "line": 95 }, { "name": "delegation::DelegationConstraints::validate_delegation", "kind": "function_item", "signature": "pub fn validate_delegation(\n &self,\n target_agent: &OasDid,\n requested_scopes: &ScopeSet,\n current_depth: u8,\n parent_ttl: i64,\n requested_ttl: i64,\n ) -> ArsenalResult<()>;", "docs": "Validate a delegation request\n\n# Errors\nReturns an error if the delegation is not allowed", "attributes": "", "line": 109 }, { "name": "delegation::DelegationLink", "kind": "struct_item", "signature": "pub struct DelegationLink {\n/// Token ID of the delegating token\n\npub parent_token_id: TokenId,\n/// Agent that delegated\n\npub delegator: AgentId,\n/// Agent that received delegation\n\npub delegate: AgentId,\n/// Scopes that were delegated\n\npub delegated_scopes: ScopeSet,\n/// When the delegation occurred\n\npub delegated_at: chrono::DateTime,\n/// Depth in the chain (0 = first delegation)\n\npub depth: u8\n}", "docs": "A link in the delegation chain", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 159 }, { "name": "delegation::DelegationChain", "kind": "struct_item", "signature": "pub struct DelegationChain {\n\n}", "docs": "Complete delegation chain for audit and validation", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 176 }, { "name": "delegation::DelegationChain::new", "kind": "function_item", "signature": "pub fn new(root_token_id: TokenId, root_agent: AgentId) -> Self;", "docs": "Create a new delegation chain starting from a root token", "attributes": "#[must_use]", "line": 188 }, { "name": "delegation::DelegationChain::add_link", "kind": "function_item", "signature": "pub fn add_link(&mut self, link: DelegationLink) -> ArsenalResult<()>;", "docs": "Add a delegation link to the chain\n\n# Errors\nReturns an error if the chain would be too long", "attributes": "", "line": 200 }, { "name": "delegation::DelegationChain::depth", "kind": "function_item", "signature": "pub fn depth(&self) -> u8;", "docs": "Get the current depth of the chain", "attributes": "#[must_use]", "line": 219 }, { "name": "delegation::DelegationChain::root_token_id", "kind": "function_item", "signature": "pub fn root_token_id(&self) -> &TokenId;", "docs": "Get the root token ID", "attributes": "#[must_use]", "line": 225 }, { "name": "delegation::DelegationChain::root_agent", "kind": "function_item", "signature": "pub fn root_agent(&self) -> &AgentId;", "docs": "Get the root agent", "attributes": "#[must_use]", "line": 231 }, { "name": "delegation::DelegationChain::current_delegate", "kind": "function_item", "signature": "pub fn current_delegate(&self) -> &AgentId;", "docs": "Get the current (most recent) delegate", "attributes": "#[must_use]", "line": 237 }, { "name": "delegation::DelegationChain::links", "kind": "function_item", "signature": "pub fn links(&self) -> &[DelegationLink];", "docs": "Get all links in the chain", "attributes": "#[must_use]", "line": 243 }, { "name": "delegation::DelegationChain::validate", "kind": "function_item", "signature": "pub fn validate(&self) -> ArsenalResult<()>;", "docs": "Validate the entire chain\n\n# Errors\nReturns an error if the chain is invalid", "attributes": "", "line": 251 }, { "name": "delegation::DelegationChain::contains_agent", "kind": "function_item", "signature": "pub fn contains_agent(&self, agent_id: &AgentId) -> bool;", "docs": "Check if an agent is in the chain (as delegator or delegate)", "attributes": "#[must_use]", "line": 278 }, { "name": "delegation::DelegationChain::effective_scopes", "kind": "function_item", "signature": "pub fn effective_scopes(&self) -> Option;", "docs": "Get the effective scopes at the end of the chain\n\nThis is the intersection of all delegated scopes", "attributes": "#[must_use]", "line": 291 }, { "name": "delegation::DelegationChain::to_cbor", "kind": "function_item", "signature": "pub fn to_cbor(&self) -> ArsenalResult>;", "docs": "Serialize to CBOR\n\n# Errors\nReturns an error if serialization fails", "attributes": "", "line": 307 }, { "name": "delegation::DelegationChain::from_cbor", "kind": "function_item", "signature": "pub fn from_cbor(bytes: &[u8]) -> ArsenalResult;", "docs": "Deserialize from CBOR\n\n# Errors\nReturns an error if deserialization fails", "attributes": "", "line": 322 }, { "name": "delegation::DelegationRequest", "kind": "struct_item", "signature": "pub struct DelegationRequest {\n/// Agent requesting delegation\n\npub delegator: AgentId,\n/// Target agent to delegate to\n\npub delegate: AgentId,\n/// Scopes to delegate\n\npub scopes: ScopeSet,\n/// Requested TTL in seconds\n\npub ttl_seconds: i64,\n/// Parent token ID\n\npub parent_token_id: TokenId,\n/// Current delegation chain (if any)\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub chain: Option\n}", "docs": "Delegation request for creating a new delegated token", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 346 }, { "name": "delegation::DelegationResult", "kind": "struct_item", "signature": "pub struct DelegationResult {\n/// Whether delegation was approved\n\npub approved: bool,\n/// New token ID (if approved)\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub token_id: Option,\n/// Updated delegation chain\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub chain: Option,\n/// Reason for denial (if not approved)\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub denial_reason: Option\n}", "docs": "Result of a delegation request", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 364 } ], "parseErrors": false }, { "module": "error", "source": "arsenal/crates/arsenal-core/src/error.rs", "sha256": "8bdb49267bc6aecdbc280e3249509568c2de55bf309da38e91d5aef60c209130", "attributes": "", "items": [ { "name": "error::ArsenalResult", "kind": "type_item", "signature": "pub type ArsenalResult = Result;", "docs": "Result type alias for ARSENAL operations", "attributes": "", "line": 14 }, { "name": "error::ErrorCode", "kind": "enum_item", "signature": "pub enum ErrorCode {\n // Authentication errors (1xxx)\n /// Invalid or missing credentials\n AuthenticationFailed = 1001,\n /// Token expired\n TokenExpired = 1002,\n /// Token signature verification failed\n TokenSignatureInvalid = 1003,\n /// Proof-of-possession verification failed\n PopVerificationFailed = 1004,\n /// Identity not found or invalid\n IdentityInvalid = 1005,\n /// Session has expired or been revoked\n SessionExpired = 1006,\n\n // Authorization errors (2xxx)\n /// Insufficient permissions for requested operation\n InsufficientPermissions = 2001,\n /// Requested scope exceeds granted scope\n ScopeExceeded = 2002,\n /// Policy evaluation denied the request\n PolicyDenied = 2003,\n /// Delegation chain is invalid or broken\n DelegationInvalid = 2004,\n /// Rate limit exceeded\n RateLimitExceeded = 2005,\n /// Usage budget exhausted\n BudgetExhausted = 2006,\n\n // Constraint violations (3xxx)\n /// Request violates time-based constraints\n TimeConstraintViolation = 3001,\n /// Request violates environment binding\n EnvironmentBindingViolation = 3002,\n /// Request violates IP/network constraints\n NetworkConstraintViolation = 3003,\n /// Request violates device binding\n DeviceBindingViolation = 3004,\n /// Request violates origin binding\n OriginBindingViolation = 3005,\n\n // Secret management errors (4xxx)\n /// Secret not found\n SecretNotFound = 4001,\n /// Secret version not found\n SecretVersionNotFound = 4002,\n /// Secret has been revoked\n SecretRevoked = 4003,\n /// Secret rotation in progress\n SecretRotationInProgress = 4004,\n /// Secret unwrap limit exceeded\n SecretUnwrapLimitExceeded = 4005,\n /// Encryption/decryption failed\n CryptoOperationFailed = 4006,\n\n // Validation errors (5xxx)\n /// Input validation failed\n ValidationFailed = 5001,\n /// Malformed request\n MalformedRequest = 5002,\n /// Invalid token format\n InvalidTokenFormat = 5003,\n /// Invalid scope format\n InvalidScopeFormat = 5004,\n /// Invalid constraint specification\n InvalidConstraint = 5005,\n\n // Internal errors (6xxx)\n /// Internal service error\n InternalError = 6001,\n /// Storage backend error\n StorageError = 6002,\n /// Configuration error\n ConfigurationError = 6003,\n /// Cryptographic subsystem error\n CryptoSubsystemError = 6004,\n /// Audit subsystem error\n AuditError = 6005,\n /// Serialization failed\n SerializationFailed = 6006,\n\n // Revocation errors (7xxx)\n /// Token has been explicitly revoked\n TokenRevoked = 7001,\n /// Agent has been deactivated\n AgentDeactivated = 7002,\n /// Tenant has been suspended\n TenantSuspended = 7003,\n /// Revocation status could not be determined (fail-closed policy path)\n RevocationStatusUnknown = 7004,\n\n // Proxy errors (8xxx)\n /// Request violates destination binding for the credential\n ProxyDestinationViolation = 8001,\n /// Proxy request to target API failed\n ProxyRequestFailed = 8002,\n /// Proxy request timed out\n ProxyTimeout = 8003,\n /// Request blocked by SSRF protection\n SsrfBlocked = 8004,\n /// Referenced template variable not found in resolution table\n TemplateVariableNotFound = 8005,\n /// Agent does not have permission to access the template variable\n TemplateVariableAccessDenied = 8006,\n /// Template variable name is malformed\n InvalidTemplateVariable = 8007,\n /// OAuth token requires re-authentication\n OAuthReauthRequired = 8008,\n\n // Consent errors (9xxx)\n /// Human consent is required before accessing the credential\n ConsentRequired = 9001,\n /// Consent was explicitly denied\n ConsentDenied = 9002,\n /// Consent record has expired\n ConsentExpired = 9003,\n /// Consent was previously granted but has been revoked\n ConsentRevoked = 9004,\n\n // Fingerprint errors (10xxx)\n /// Agent fingerprint does not match expected hash chain state\n FingerprintMismatch = 10001,\n /// Agent fingerprint state not found (agent not initialized)\n FingerprintStateNotFound = 10002,\n\n // Delegation errors (11xxx)\n /// Delegated credential token attempts scope amplification\n DctScopeAmplification = 11001,\n /// Delegation depth exceeds maximum allowed\n DctDepthExceeded = 11002,\n}", "docs": "Error codes for programmatic handling", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(rename_all = \"SCREAMING_SNAKE_CASE\")]", "line": 19 }, { "name": "error::ErrorCode::as_u32", "kind": "function_item", "signature": "pub const fn as_u32(self) -> u32;", "docs": "Returns the numeric code", "attributes": "#[must_use]", "line": 154 }, { "name": "error::ErrorCode::is_client_error", "kind": "function_item", "signature": "pub const fn is_client_error(self) -> bool;", "docs": "Returns true if this is a client error (retrying won't help)", "attributes": "#[must_use]", "line": 160 }, { "name": "error::ErrorCode::is_server_error", "kind": "function_item", "signature": "pub const fn is_server_error(self) -> bool;", "docs": "Returns true if this is a server error (may be transient)", "attributes": "#[must_use]", "line": 167 }, { "name": "error::ErrorCode::is_proxy_error", "kind": "function_item", "signature": "pub const fn is_proxy_error(self) -> bool;", "docs": "Returns true if this is a proxy-related error", "attributes": "#[must_use]", "line": 174 }, { "name": "error::ErrorCode::is_consent_error", "kind": "function_item", "signature": "pub const fn is_consent_error(self) -> bool;", "docs": "Returns true if this is a consent-related error", "attributes": "#[must_use]", "line": 181 }, { "name": "error::ErrorCode::is_fingerprint_error", "kind": "function_item", "signature": "pub const fn is_fingerprint_error(self) -> bool;", "docs": "Returns true if this is a fingerprint-related error", "attributes": "#[must_use]", "line": 188 }, { "name": "error::ErrorCode::is_permanent", "kind": "function_item", "signature": "pub const fn is_permanent(self) -> bool;", "docs": "Returns true if the error indicates the request should not be retried", "attributes": "#[must_use]", "line": 195 }, { "name": "error::ArsenalError", "kind": "struct_item", "signature": "pub struct ArsenalError {\n\n}", "docs": "Main error type for ARSENAL operations", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 213 }, { "name": "error::ErrorContext", "kind": "struct_item", "signature": "pub struct ErrorContext {\n/// The operation that failed\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub operation: Option,\n/// Resource identifier (sanitized - no full paths or keys)\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub resource: Option,\n/// Constraint that was violated\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub constraint: Option,\n/// Timestamp of the error\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub timestamp: Option>\n}", "docs": "Additional error context (all fields are sanitized)", "attributes": "#[derive(Debug, Clone, Default, Serialize, Deserialize)]", "line": 228 }, { "name": "error::ArsenalError::new", "kind": "function_item", "signature": "pub fn new(code: ErrorCode, message: impl Into) -> Self;", "docs": "Create a new error with the given code and message", "attributes": "#[must_use]", "line": 246 }, { "name": "error::ArsenalError::with_correlation_id", "kind": "function_item", "signature": "pub fn with_correlation_id(mut self, id: Uuid) -> Self;", "docs": "Add a correlation ID for audit trail", "attributes": "#[must_use]", "line": 257 }, { "name": "error::ArsenalError::with_context", "kind": "function_item", "signature": "pub fn with_context(mut self, context: ErrorContext) -> Self;", "docs": "Add context to the error", "attributes": "#[must_use]", "line": 264 }, { "name": "error::ArsenalError::with_operation", "kind": "function_item", "signature": "pub fn with_operation(mut self, operation: impl Into) -> Self;", "docs": "Add operation context", "attributes": "#[must_use]", "line": 271 }, { "name": "error::ArsenalError::with_resource", "kind": "function_item", "signature": "pub fn with_resource(mut self, resource: impl Into) -> Self;", "docs": "Add resource context (will be sanitized)", "attributes": "#[must_use]", "line": 279 }, { "name": "error::ArsenalError::code", "kind": "function_item", "signature": "pub const fn code(&self) -> ErrorCode;", "docs": "Get the error code", "attributes": "#[must_use]", "line": 288 }, { "name": "error::ArsenalError::message", "kind": "function_item", "signature": "pub fn message(&self) -> &str;", "docs": "Get the error message", "attributes": "#[must_use]", "line": 294 }, { "name": "error::ArsenalError::correlation_id", "kind": "function_item", "signature": "pub const fn correlation_id(&self) -> Option;", "docs": "Get the correlation ID if set", "attributes": "#[must_use]", "line": 300 }, { "name": "error::ArsenalError::context", "kind": "function_item", "signature": "pub fn context(&self) -> Option<&ErrorContext>;", "docs": "Get the error context if set", "attributes": "#[must_use]", "line": 306 }, { "name": "error::ArsenalError::authentication_failed", "kind": "function_item", "signature": "pub fn authentication_failed() -> Self;", "docs": "Authentication failed", "attributes": "#[must_use]", "line": 314 }, { "name": "error::ArsenalError::token_expired", "kind": "function_item", "signature": "pub fn token_expired() -> Self;", "docs": "Token expired", "attributes": "#[must_use]", "line": 320 }, { "name": "error::ArsenalError::token_signature_invalid", "kind": "function_item", "signature": "pub fn token_signature_invalid() -> Self;", "docs": "Token signature invalid", "attributes": "#[must_use]", "line": 326 }, { "name": "error::ArsenalError::pop_verification_failed", "kind": "function_item", "signature": "pub fn pop_verification_failed() -> Self;", "docs": "Proof-of-possession failed", "attributes": "#[must_use]", "line": 335 }, { "name": "error::ArsenalError::insufficient_permissions", "kind": "function_item", "signature": "pub fn insufficient_permissions(required_scope: &str) -> Self;", "docs": "Insufficient permissions", "attributes": "#[must_use]", "line": 344 }, { "name": "error::ArsenalError::scope_exceeded", "kind": "function_item", "signature": "pub fn scope_exceeded() -> Self;", "docs": "Scope exceeded", "attributes": "#[must_use]", "line": 356 }, { "name": "error::ArsenalError::policy_denied", "kind": "function_item", "signature": "pub fn policy_denied(policy_id: &str) -> Self;", "docs": "Policy denied", "attributes": "#[must_use]", "line": 365 }, { "name": "error::ArsenalError::rate_limit_exceeded", "kind": "function_item", "signature": "pub fn rate_limit_exceeded(retry_after_secs: Option) -> Self;", "docs": "Rate limit exceeded", "attributes": "#[must_use]", "line": 377 }, { "name": "error::ArsenalError::secret_not_found", "kind": "function_item", "signature": "pub fn secret_not_found() -> Self;", "docs": "Secret not found", "attributes": "#[must_use]", "line": 387 }, { "name": "error::ArsenalError::secret_revoked", "kind": "function_item", "signature": "pub fn secret_revoked() -> Self;", "docs": "Secret revoked", "attributes": "#[must_use]", "line": 393 }, { "name": "error::ArsenalError::validation_failed", "kind": "function_item", "signature": "pub fn validation_failed(field: &str, reason: &str) -> Self;", "docs": "Validation failed", "attributes": "#[must_use]", "line": 399 }, { "name": "error::ArsenalError::internal", "kind": "function_item", "signature": "pub fn internal() -> Self;", "docs": "Internal error (generic, no details leaked)", "attributes": "#[must_use]", "line": 412 }, { "name": "error::ArsenalError::token_revoked", "kind": "function_item", "signature": "pub fn token_revoked() -> Self;", "docs": "Token revoked", "attributes": "#[must_use]", "line": 421 }, { "name": "error::ArsenalError::revocation_status_unknown", "kind": "function_item", "signature": "pub fn revocation_status_unknown() -> Self;", "docs": "Revocation status could not be determined (fail-closed)", "attributes": "#[must_use]", "line": 427 }, { "name": "error::ArsenalError::session_expired", "kind": "function_item", "signature": "pub fn session_expired() -> Self;", "docs": "Session expired", "attributes": "#[must_use]", "line": 436 }, { "name": "error::ArsenalError::proxy_destination_violation", "kind": "function_item", "signature": "pub fn proxy_destination_violation(domain: &str) -> Self;", "docs": "Proxy destination binding violation", "attributes": "#[must_use]", "line": 445 }, { "name": "error::ArsenalError::proxy_request_failed", "kind": "function_item", "signature": "pub fn proxy_request_failed(status: u16) -> Self;", "docs": "Proxy request to target failed", "attributes": "#[must_use]", "line": 457 }, { "name": "error::ArsenalError::ssrf_blocked", "kind": "function_item", "signature": "pub fn ssrf_blocked() -> Self;", "docs": "SSRF protection blocked the request", "attributes": "#[must_use]", "line": 466 }, { "name": "error::ArsenalError::template_variable_not_found", "kind": "function_item", "signature": "pub fn template_variable_not_found(variable: &str) -> Self;", "docs": "Template variable not found", "attributes": "#[must_use]", "line": 475 }, { "name": "error::ArsenalError::template_variable_access_denied", "kind": "function_item", "signature": "pub fn template_variable_access_denied(variable: &str) -> Self;", "docs": "Template variable access denied", "attributes": "#[must_use]", "line": 487 }, { "name": "error::ArsenalError::invalid_template_variable", "kind": "function_item", "signature": "pub fn invalid_template_variable(name: &str) -> Self;", "docs": "Invalid template variable name", "attributes": "#[must_use]", "line": 499 }, { "name": "error::ArsenalError::oauth_reauth_required", "kind": "function_item", "signature": "pub fn oauth_reauth_required() -> Self;", "docs": "OAuth re-authentication required", "attributes": "#[must_use]", "line": 508 }, { "name": "error::ArsenalError::consent_required", "kind": "function_item", "signature": "pub fn consent_required() -> Self;", "docs": "Consent required", "attributes": "#[must_use]", "line": 517 }, { "name": "error::ArsenalError::consent_denied", "kind": "function_item", "signature": "pub fn consent_denied() -> Self;", "docs": "Consent denied", "attributes": "#[must_use]", "line": 526 }, { "name": "error::ArsenalError::consent_expired", "kind": "function_item", "signature": "pub fn consent_expired() -> Self;", "docs": "Consent expired", "attributes": "#[must_use]", "line": 535 }, { "name": "error::ArsenalError::consent_revoked", "kind": "function_item", "signature": "pub fn consent_revoked() -> Self;", "docs": "Consent revoked", "attributes": "#[must_use]", "line": 541 }, { "name": "error::ArsenalError::fingerprint_mismatch", "kind": "function_item", "signature": "pub fn fingerprint_mismatch() -> Self;", "docs": "Fingerprint mismatch \u2014 potential key theft", "attributes": "#[must_use]", "line": 550 }, { "name": "error::ArsenalError::fingerprint_state_not_found", "kind": "function_item", "signature": "pub fn fingerprint_state_not_found() -> Self;", "docs": "Fingerprint state not found", "attributes": "#[must_use]", "line": 559 }, { "name": "error::ArsenalError::dct_scope_amplification", "kind": "function_item", "signature": "pub fn dct_scope_amplification(variable: &str) -> Self;", "docs": "DCT scope amplification attempt", "attributes": "#[must_use]", "line": 568 }, { "name": "error::ArsenalError::dct_depth_exceeded", "kind": "function_item", "signature": "pub fn dct_depth_exceeded() -> Self;", "docs": "DCT depth exceeded", "attributes": "#[must_use]", "line": 580 }, { "name": "error::ArsenalError::crypto_operation_failed", "kind": "function_item", "signature": "pub fn crypto_operation_failed() -> Self;", "docs": "Crypto operation failed (generic message to avoid oracle attacks)", "attributes": "#[must_use]", "line": 589 }, { "name": "error::ArsenalError::storage_error", "kind": "function_item", "signature": "pub fn storage_error() -> Self;", "docs": "Storage error (generic message)", "attributes": "#[must_use]", "line": 598 }, { "name": "error::ArsenalError::configuration_error", "kind": "function_item", "signature": "pub fn configuration_error(component: &str) -> Self;", "docs": "Configuration error", "attributes": "#[must_use]", "line": 604 }, { "name": "error::ArsenalError::invalid_state_transition", "kind": "function_item", "signature": "pub fn invalid_state_transition(from: impl Into, to: impl Into) -> Self;", "docs": "Invalid state transition", "attributes": "#[must_use]", "line": 616 } ], "parseErrors": false }, { "module": "fingerprint", "source": "arsenal/crates/arsenal-core/src/fingerprint.rs", "sha256": "a300fa13494b16c90c849360b645f68426e398d2a2ad8dc28c3a03ef15000c60", "attributes": "", "items": [ { "name": "fingerprint::FingerprintState", "kind": "struct_item", "signature": "pub struct FingerprintState {\n/// Current hash chain state (BLAKE3 output)\n\npub current_state: [u8; 32],\n/// Monotonically increasing sequence number\n\npub sequence_number: u64,\n/// When the chain was last advanced\n\npub last_advanced_at: chrono::DateTime,\n/// Window size for out-of-order tolerance (Strategy A)\n\npub window_size: u8\n}", "docs": "Stateful fingerprint for an agent's hash chain.\n\nThe fingerprint tracks a BLAKE3 hash chain that is advanced with each\nproxy request. The broker verifies the agent's presented fingerprint\nagainst the expected chain state.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 29 }, { "name": "fingerprint::FingerprintState::init", "kind": "function_item", "signature": "pub fn init(\n agent_did: &str,\n timestamp: &chrono::DateTime,\n nonce: &[u8; 32],\n ) -> Self;", "docs": "Initialize a new fingerprint chain.\n\nThe initial state is computed as:\n`BLAKE3(\"arsenal.fingerprint.init\" || agent_did || timestamp || nonce)`", "attributes": "#[must_use]", "line": 46 }, { "name": "fingerprint::FingerprintState::advance", "kind": "function_item", "signature": "pub fn advance(&mut self, request_id: &Uuid, timestamp: &chrono::DateTime);", "docs": "Advance the hash chain by one step.\n\nNew state is computed as:\n`BLAKE3(\"arsenal.fingerprint.advance\" || current_state || request_id || timestamp)`", "attributes": "", "line": 70 }, { "name": "fingerprint::FingerprintState::compute_fingerprint", "kind": "function_item", "signature": "pub fn compute_fingerprint(&self) -> [u8; 32];", "docs": "Compute the fingerprint to send as a header.\n\nThe fingerprint is `BLAKE3(current_state)` \u2014 the raw state is never\ntransmitted, only its hash. This prevents state reconstruction if\nthe fingerprint header is intercepted.", "attributes": "#[must_use]", "line": 82 }, { "name": "fingerprint::FingerprintState::verify_fingerprint", "kind": "function_item", "signature": "pub fn verify_fingerprint(\n &self,\n received: &[u8; 32],\n request_id: &Uuid,\n timestamp: &chrono::DateTime,\n ) -> FingerprintVerification;", "docs": "Verify a received fingerprint against the expected chain state.\n\nUses Strategy A (sliding window): tries the current state and up to\n`window_size` future states to accommodate out-of-order delivery.", "attributes": "#[must_use]", "line": 91 }, { "name": "fingerprint::FingerprintState::set_window_size", "kind": "function_item", "signature": "pub fn set_window_size(&mut self, size: u8);", "docs": "Set the window size (clamped to valid range).", "attributes": "", "line": 125 }, { "name": "fingerprint::FingerprintState::sequence_number", "kind": "function_item", "signature": "pub const fn sequence_number(&self) -> u64;", "docs": "Get the current sequence number.", "attributes": "#[must_use]", "line": 131 }, { "name": "fingerprint::FingerprintState::window_size", "kind": "function_item", "signature": "pub const fn window_size(&self) -> u8;", "docs": "Get the window size.", "attributes": "#[must_use]", "line": 137 }, { "name": "fingerprint::FingerprintVerification", "kind": "enum_item", "signature": "pub enum FingerprintVerification {\n /// Fingerprint matches the expected current state.\n Match {\n /// Sequence number to advance to\n advance_to: u64,\n },\n /// Fingerprint matches a state within the sliding window.\n WindowMatch {\n /// Sequence number to advance to\n advance_to: u64,\n /// Number of states skipped\n skipped: u64,\n },\n /// Fingerprint does not match any expected state \u2014 potential key theft.\n Mismatch,\n}", "docs": "Result of fingerprint verification.", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]", "line": 144 }, { "name": "fingerprint::FingerprintVerification::is_valid", "kind": "function_item", "signature": "pub const fn is_valid(&self) -> bool;", "docs": "Check if verification succeeded (`Match` or `WindowMatch`).", "attributes": "#[must_use]", "line": 164 }, { "name": "fingerprint::FingerprintVerification::is_mismatch", "kind": "function_item", "signature": "pub const fn is_mismatch(&self) -> bool;", "docs": "Check if verification failed.", "attributes": "#[must_use]", "line": 170 } ], "parseErrors": false }, { "module": "identity", "source": "arsenal/crates/arsenal-core/src/identity.rs", "sha256": "ca80b7b23505b8d44b0fac716fa7e24e1f8ae1e1cdba46ec112dccb14014b8ea", "attributes": "", "items": [ { "name": "identity::TenantId", "kind": "struct_item", "signature": "pub struct TenantId(String);", "docs": "Tenant identifier - represents an organization or customer", "attributes": "#[derive(Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(transparent)]", "line": 21 }, { "name": "identity::TenantId::new", "kind": "function_item", "signature": "pub fn new(id: impl Into) -> ArsenalResult;", "docs": "Create a new tenant ID with validation\n\n# Errors\nReturns an error if the ID is empty, too long, or contains invalid characters", "attributes": "", "line": 28 }, { "name": "identity::TenantId::generate", "kind": "function_item", "signature": "pub fn generate() -> Self;", "docs": "Create a new random tenant ID", "attributes": "#[must_use]", "line": 36 }, { "name": "identity::TenantId::as_str", "kind": "function_item", "signature": "pub fn as_str(&self) -> &str;", "docs": "Get the inner string value", "attributes": "#[must_use]", "line": 42 }, { "name": "identity::PrincipalId", "kind": "struct_item", "signature": "pub struct PrincipalId(String);", "docs": "Principal identifier - represents a user, service account, or system principal", "attributes": "#[derive(Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(transparent)]", "line": 101 }, { "name": "identity::PrincipalId::new", "kind": "function_item", "signature": "pub fn new(id: impl Into) -> ArsenalResult;", "docs": "Create a new principal ID with validation\n\n# Errors\nReturns an error if the ID is empty, too long, or contains invalid characters", "attributes": "", "line": 108 }, { "name": "identity::PrincipalId::generate", "kind": "function_item", "signature": "pub fn generate() -> Self;", "docs": "Create a new random principal ID", "attributes": "#[must_use]", "line": 116 }, { "name": "identity::PrincipalId::system", "kind": "function_item", "signature": "pub fn system() -> Self;", "docs": "Create a system principal", "attributes": "#[must_use]", "line": 122 }, { "name": "identity::PrincipalId::is_system", "kind": "function_item", "signature": "pub fn is_system(&self) -> bool;", "docs": "Check if this is the system principal", "attributes": "#[must_use]", "line": 128 }, { "name": "identity::PrincipalId::as_str", "kind": "function_item", "signature": "pub fn as_str(&self) -> &str;", "docs": "Get the inner string value", "attributes": "#[must_use]", "line": 134 }, { "name": "identity::AgentIdentity", "kind": "struct_item", "signature": "pub struct AgentIdentity {\n\n}", "docs": "Agent identity - the cryptographic identity of an agent\n\nThis contains the agent's public key fingerprint and associated metadata.\nThe actual private key is never stored here - only the public identity.\n\n# Two identifiers, two purposes\n\n[`AgentIdentity::did`] is the agent's identity: an OAS DID, assigned by OAS\ngenesis under a human or organizational root, resolvable by any party, and\nthe value that appears as `sub` in a capability token. Arsenal does not mint\nDIDs; it requires one as input, because a capability granted to an identity\nnobody can resolve is not auditable.\n\n[`AgentIdentity::id`] is a local surrogate key. It orders records and keys\nstorage rows. It is deliberately never used as the subject of a token.", "attributes": "#[derive(Clone, Serialize, Deserialize)]", "line": 204 }, { "name": "identity::AgentIdentity::new", "kind": "function_item", "signature": "pub fn new(\n did: OasDid,\n tenant_id: TenantId,\n name: impl Into,\n public_key_fingerprint: KeyFingerprint,\n ) -> ArsenalResult;", "docs": "Create a new agent identity\n\n`did` must be an OAS DID of kind `agent`. Arsenal issues capability\ntokens to agents, so a DID naming a human root, an organization, or a\ntool is rejected here rather than producing a token whose subject cannot\nexercise it.\n\n# Errors\nReturns an error if the name length is invalid, or if `did` is not of\nentity kind `agent`.", "attributes": "", "line": 237 }, { "name": "identity::AgentIdentity::did", "kind": "function_item", "signature": "pub fn did(&self) -> &OasDid;", "docs": "Get the agent's OAS DID\n\nThis is the identity to use as a token subject or in an audit record.", "attributes": "#[must_use]", "line": 272 }, { "name": "identity::AgentIdentity::id", "kind": "function_item", "signature": "pub fn id(&self) -> &AgentId;", "docs": "Get the local surrogate key\n\nFor storage and ordering only. Use [`AgentIdentity::did`] when naming\nthis agent to anything outside Arsenal.", "attributes": "#[must_use]", "line": 281 }, { "name": "identity::AgentIdentity::public_key_fingerprint", "kind": "function_item", "signature": "pub fn public_key_fingerprint(&self) -> &KeyFingerprint;", "docs": "Get the public key fingerprint", "attributes": "#[must_use]", "line": 287 }, { "name": "identity::AgentIdentity::tenant_id", "kind": "function_item", "signature": "pub fn tenant_id(&self) -> &TenantId;", "docs": "Get the tenant ID", "attributes": "#[must_use]", "line": 293 }, { "name": "identity::AgentIdentity::name", "kind": "function_item", "signature": "pub fn name(&self) -> &str;", "docs": "Get the agent name", "attributes": "#[must_use]", "line": 299 }, { "name": "identity::AgentIdentity::is_valid", "kind": "function_item", "signature": "pub fn is_valid(&self) -> bool;", "docs": "Check if the agent is currently valid (active and not expired)", "attributes": "#[must_use]", "line": 305 }, { "name": "identity::AgentIdentity::is_active", "kind": "function_item", "signature": "pub fn is_active(&self) -> bool;", "docs": "Check if the agent is active", "attributes": "#[must_use]", "line": 319 }, { "name": "identity::AgentIdentity::deactivate", "kind": "function_item", "signature": "pub fn deactivate(&mut self);", "docs": "Deactivate this agent", "attributes": "", "line": 324 }, { "name": "identity::AgentIdentity::set_expires_at", "kind": "function_item", "signature": "pub fn set_expires_at(&mut self, expires_at: chrono::DateTime);", "docs": "Set expiration time", "attributes": "", "line": 329 }, { "name": "identity::AgentIdentity::add_tag", "kind": "function_item", "signature": "pub fn add_tag(&mut self, tag: impl Into);", "docs": "Add a tag", "attributes": "", "line": 334 }, { "name": "identity::AgentIdentity::tags", "kind": "function_item", "signature": "pub fn tags(&self) -> &[String];", "docs": "Get tags", "attributes": "#[must_use]", "line": 343 }, { "name": "identity::AgentId", "kind": "struct_item", "signature": "pub struct AgentId(Uuid);", "docs": "Agent identifier", "attributes": "#[derive(Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(transparent)]", "line": 362 }, { "name": "identity::AgentId::from_uuid", "kind": "function_item", "signature": "pub const fn from_uuid(uuid: Uuid) -> Self;", "docs": "Create a new agent ID from a UUID", "attributes": "#[must_use]", "line": 367 }, { "name": "identity::AgentId::generate", "kind": "function_item", "signature": "pub fn generate() -> Self;", "docs": "Generate a new random agent ID", "attributes": "#[must_use]", "line": 373 }, { "name": "identity::AgentId::as_uuid", "kind": "function_item", "signature": "pub const fn as_uuid(&self) -> &Uuid;", "docs": "Get the inner UUID", "attributes": "#[must_use]", "line": 379 }, { "name": "identity::KeyFingerprint", "kind": "struct_item", "signature": "pub struct KeyFingerprint([u8; 32]);", "docs": "Public key fingerprint - BLAKE3 hash of the public key bytes", "attributes": "#[derive(Clone, PartialEq, Eq, Hash, Serialize, Deserialize, Zeroize)]\n#[zeroize(drop)]", "line": 409 }, { "name": "identity::KeyFingerprint::from_bytes", "kind": "function_item", "signature": "pub const fn from_bytes(bytes: [u8; 32]) -> Self;", "docs": "Create a fingerprint from raw bytes", "attributes": "#[must_use]", "line": 414 }, { "name": "identity::KeyFingerprint::from_public_key", "kind": "function_item", "signature": "pub fn from_public_key(public_key: &[u8]) -> Self;", "docs": "Create a fingerprint from a public key", "attributes": "#[must_use]", "line": 420 }, { "name": "identity::KeyFingerprint::as_bytes", "kind": "function_item", "signature": "pub const fn as_bytes(&self) -> &[u8; 32];", "docs": "Get the raw bytes", "attributes": "#[must_use]", "line": 427 }, { "name": "identity::KeyFingerprint::to_hex", "kind": "function_item", "signature": "pub fn to_hex(&self) -> String;", "docs": "Encode as hex string", "attributes": "#[must_use]", "line": 433 }, { "name": "identity::KeyFingerprint::from_hex", "kind": "function_item", "signature": "pub fn from_hex(hex_str: &str) -> ArsenalResult;", "docs": "Parse from hex string\n\n# Errors\nReturns an error if the hex string is invalid", "attributes": "", "line": 441 }, { "name": "identity::KeyFingerprint::ct_eq", "kind": "function_item", "signature": "pub fn ct_eq(&self, other: &Self) -> bool;", "docs": "Constant-time comparison", "attributes": "#[must_use]", "line": 457 }, { "name": "identity::DeviceId", "kind": "struct_item", "signature": "pub struct DeviceId(String);", "docs": "Device identifier for device binding", "attributes": "#[derive(Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]", "line": 482 }, { "name": "identity::DeviceId::new", "kind": "function_item", "signature": "pub fn new(id: impl Into) -> ArsenalResult;", "docs": "Create a new device ID\n\n# Errors\nReturns an error if validation fails", "attributes": "", "line": 489 }, { "name": "identity::DeviceId::as_str", "kind": "function_item", "signature": "pub fn as_str(&self) -> &str;", "docs": "Get the inner string", "attributes": "#[must_use]", "line": 511 } ], "parseErrors": false }, { "module": "limits", "source": "arsenal/crates/arsenal-core/src/limits.rs", "sha256": "e6e5774acca5a12d8950c25c74538fd483f78dc775f91008537bf9cd3f8561d9", "attributes": "", "items": [ { "name": "limits::RateLimits", "kind": "struct_item", "signature": "pub struct RateLimits {\n/// Maximum requests per second\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub requests_per_second: Option,\n/// Maximum requests per minute\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub requests_per_minute: Option,\n/// Maximum requests per hour\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub requests_per_hour: Option,\n/// Maximum concurrent requests\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub max_concurrent: Option,\n/// Maximum request body size in bytes\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub max_request_size: Option,\n/// Maximum response size in bytes\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub max_response_size: Option\n}", "docs": "Rate limiting configuration\n\nEquality is derived so that a round trip through the canonical ACT encoding\ncan be checked for loss: these limits cross the wire as an issuer-defined\nextension claim, and a silently dropped ceiling is the failure mode that\nmatters.", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]", "line": 19 }, { "name": "limits::RateLimits::unlimited", "kind": "function_item", "signature": "pub fn unlimited() -> Self;", "docs": "Create unlimited rate limits (use with caution)", "attributes": "#[must_use]", "line": 56 }, { "name": "limits::RateLimits::strict", "kind": "function_item", "signature": "pub fn strict() -> Self;", "docs": "Create strict rate limits", "attributes": "#[must_use]", "line": 69 }, { "name": "limits::RateLimits::merge", "kind": "function_item", "signature": "pub fn merge(&self, other: &RateLimits) -> RateLimits;", "docs": "Merge with another rate limit configuration (take the more restrictive)", "attributes": "#[must_use]", "line": 82 }, { "name": "limits::UsageBudget", "kind": "struct_item", "signature": "pub struct UsageBudget {\n/// Maximum total requests allowed\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub max_requests: Option,\n/// Maximum total bytes transferred\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub max_bytes: Option,\n/// Maximum total cost units (for metered APIs)\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub max_cost_units: Option,\n/// Maximum secret unwrap operations\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub max_secret_unwraps: Option,\n/// Maximum delegation depth\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub max_delegation_depth: Option\n}", "docs": "Usage budget for a capability token", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 102 }, { "name": "limits::UsageBudget::unlimited", "kind": "function_item", "signature": "pub fn unlimited() -> Self;", "docs": "Create unlimited budget (use with caution)", "attributes": "#[must_use]", "line": 135 }, { "name": "limits::UsageBudget::minimal", "kind": "function_item", "signature": "pub fn minimal() -> Self;", "docs": "Create a minimal budget for testing", "attributes": "#[must_use]", "line": 147 }, { "name": "limits::UsageBudget::merge", "kind": "function_item", "signature": "pub fn merge(&self, other: &UsageBudget) -> UsageBudget;", "docs": "Merge with another budget (take the more restrictive)", "attributes": "#[must_use]", "line": 159 }, { "name": "limits::UsageTracker", "kind": "struct_item", "signature": "pub struct UsageTracker {\n\n}", "docs": "Runtime usage tracker for enforcing limits", "attributes": "#[derive(Debug)]", "line": 175 }, { "name": "limits::UsageTracker::new", "kind": "function_item", "signature": "pub fn new(budget: UsageBudget) -> Self;", "docs": "Create a new usage tracker with the given budget", "attributes": "#[must_use]", "line": 193 }, { "name": "limits::UsageTracker::record_request", "kind": "function_item", "signature": "pub fn record_request(&self) -> ArsenalResult<()>;", "docs": "Record a request and check if within budget\n\n# Errors\nReturns an error if the budget would be exceeded", "attributes": "", "line": 208 }, { "name": "limits::UsageTracker::record_bytes", "kind": "function_item", "signature": "pub fn record_bytes(&self, bytes: u64) -> ArsenalResult<()>;", "docs": "Record bytes transferred and check if within budget\n\n# Errors\nReturns an error if the budget would be exceeded", "attributes": "", "line": 226 }, { "name": "limits::UsageTracker::record_cost", "kind": "function_item", "signature": "pub fn record_cost(&self, units: u64) -> ArsenalResult<()>;", "docs": "Record cost units and check if within budget\n\n# Errors\nReturns an error if the budget would be exceeded", "attributes": "", "line": 244 }, { "name": "limits::UsageTracker::record_secret_unwrap", "kind": "function_item", "signature": "pub fn record_secret_unwrap(&self) -> ArsenalResult<()>;", "docs": "Record a secret unwrap and check if within budget\n\n# Errors\nReturns an error if the budget would be exceeded", "attributes": "", "line": 262 }, { "name": "limits::UsageTracker::get_stats", "kind": "function_item", "signature": "pub fn get_stats(&self) -> UsageStats;", "docs": "Get current usage statistics", "attributes": "#[must_use]", "line": 278 }, { "name": "limits::UsageTracker::remaining", "kind": "function_item", "signature": "pub fn remaining(&self) -> RemainingBudget;", "docs": "Get remaining budget", "attributes": "#[must_use]", "line": 290 }, { "name": "limits::UsageStats", "kind": "struct_item", "signature": "pub struct UsageStats {\n/// Total requests made\n\npub request_count: u64,\n/// Total bytes transferred\n\npub bytes_transferred: u64,\n/// Total cost units consumed\n\npub cost_units: u64,\n/// Total secret unwraps\n\npub secret_unwraps: u64,\n/// Time elapsed since tracking started\n\npub elapsed: Duration\n}", "docs": "Current usage statistics", "attributes": "#[derive(Debug, Clone)]", "line": 315 }, { "name": "limits::RemainingBudget", "kind": "struct_item", "signature": "pub struct RemainingBudget {\n/// Remaining requests (None if unlimited)\n\npub requests: Option,\n/// Remaining bytes (None if unlimited)\n\npub bytes: Option,\n/// Remaining cost units (None if unlimited)\n\npub cost_units: Option,\n/// Remaining secret unwraps (None if unlimited)\n\npub secret_unwraps: Option\n}", "docs": "Remaining budget", "attributes": "#[derive(Debug, Clone)]", "line": 330 }, { "name": "limits::TokenBucketLimiter", "kind": "struct_item", "signature": "pub struct TokenBucketLimiter {\n\n}", "docs": "Token bucket rate limiter for per-second/minute/hour limits", "attributes": "#[derive(Debug)]", "line": 343 }, { "name": "limits::TokenBucketLimiter::new", "kind": "function_item", "signature": "pub fn new(max_tokens: u64, refill_amount: u64, refill_interval: Duration) -> Self;", "docs": "Create a new token bucket limiter", "attributes": "#[must_use]", "line": 361 }, { "name": "limits::TokenBucketLimiter::per_second", "kind": "function_item", "signature": "pub fn per_second(rate: u32) -> Self;", "docs": "Create a limiter for requests per second", "attributes": "#[must_use]", "line": 374 }, { "name": "limits::TokenBucketLimiter::per_minute", "kind": "function_item", "signature": "pub fn per_minute(rate: u32) -> Self;", "docs": "Create a limiter for requests per minute", "attributes": "#[must_use]", "line": 380 }, { "name": "limits::TokenBucketLimiter::per_hour", "kind": "function_item", "signature": "pub fn per_hour(rate: u32) -> Self;", "docs": "Create a limiter for requests per hour", "attributes": "#[must_use]", "line": 386 }, { "name": "limits::TokenBucketLimiter::try_acquire", "kind": "function_item", "signature": "pub fn try_acquire(&self) -> ArsenalResult<()>;", "docs": "Try to acquire a token\n\n# Errors\nReturns an error if rate limited", "attributes": "", "line": 394 }, { "name": "limits::TokenBucketLimiter::available", "kind": "function_item", "signature": "pub fn available(&self) -> u64;", "docs": "Get current available tokens", "attributes": "#[must_use]", "line": 450 }, { "name": "limits::CompositeRateLimiter", "kind": "struct_item", "signature": "pub struct CompositeRateLimiter {\n\n}", "docs": "Composite rate limiter combining multiple time windows", "attributes": "#[derive(Debug)]", "line": 457 }, { "name": "limits::CompositeRateLimiter::from_limits", "kind": "function_item", "signature": "pub fn from_limits(limits: &RateLimits) -> Self;", "docs": "Create from rate limits configuration", "attributes": "#[must_use]", "line": 473 }, { "name": "limits::CompositeRateLimiter::try_acquire", "kind": "function_item", "signature": "pub fn try_acquire(&self) -> ArsenalResult;", "docs": "Try to acquire permission for a request\n\n# Errors\nReturns an error if any rate limit is exceeded", "attributes": "", "line": 491 }, { "name": "limits::RateLimitGuard", "kind": "struct_item", "signature": "pub struct RateLimitGuard {\n\n}", "docs": "Guard that releases concurrent slot on drop", "attributes": "#[derive(Debug)]", "line": 537 } ], "parseErrors": false }, { "module": "policy", "source": "arsenal/crates/arsenal-core/src/policy.rs", "sha256": "83a040bdc4d7f6631dfce58a3d61ba40b22723f7c77fa42497d76a247537f813", "attributes": "", "items": [ { "name": "policy::PolicyId", "kind": "struct_item", "signature": "pub struct PolicyId(String);", "docs": "Policy identifier", "attributes": "#[derive(Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(transparent)]", "line": 29 }, { "name": "policy::PolicyId::new", "kind": "function_item", "signature": "pub fn new(id: impl Into) -> ArsenalResult;", "docs": "Create a new policy ID\n\n# Errors\nReturns an error if the ID is invalid", "attributes": "", "line": 36 }, { "name": "policy::PolicyId::generate", "kind": "function_item", "signature": "pub fn generate() -> Self;", "docs": "Generate a new random policy ID", "attributes": "#[must_use]", "line": 58 }, { "name": "policy::PolicyId::as_str", "kind": "function_item", "signature": "pub fn as_str(&self) -> &str;", "docs": "Get the inner string", "attributes": "#[must_use]", "line": 64 }, { "name": "policy::PolicyDocument", "kind": "struct_item", "signature": "pub struct PolicyDocument {\n/// Policy ID\n\npub id: PolicyId,\n/// Policy version (for updates)\n\npub version: u32,\n/// Tenant this policy belongs to\n\npub tenant_id: TenantId,\n/// Human-readable name\n\npub name: String,\n/// Description\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub description: Option,\n/// Policy rules\n\npub rules: Vec,\n/// Default effect when no rules match\n\npub default_effect: PolicyEffect,\n/// Whether this policy is active\n\npub is_active: bool,\n/// Priority (higher = evaluated first)\n\npub priority: i32,\n/// When the policy was created\n\npub created_at: chrono::DateTime,\n/// When the policy was last modified\n\npub updated_at: chrono::DateTime,\n/// Policy signature (if signed)\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub signature: Option,\n/// Custom labels\n\n#[serde(default)]\npub labels: HashMap\n}", "docs": "Policy document - the complete policy definition", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 83 }, { "name": "policy::PolicyDocument::new", "kind": "function_item", "signature": "pub fn new(tenant_id: TenantId, name: impl Into) -> ArsenalResult;", "docs": "Create a new policy document\n\n# Errors\nReturns an error if validation fails", "attributes": "", "line": 120 }, { "name": "policy::PolicyDocument::add_rule", "kind": "function_item", "signature": "pub fn add_rule(&mut self, rule: PolicyRule) -> ArsenalResult<()>;", "docs": "Add a rule to the policy\n\n# Errors\nReturns an error if too many rules", "attributes": "", "line": 148 }, { "name": "policy::PolicyDocument::evaluate", "kind": "function_item", "signature": "pub fn evaluate(&self, request: &PolicyRequest) -> PolicyDecision;", "docs": "Evaluate the policy for a given request", "attributes": "#[must_use]", "line": 159 }, { "name": "policy::PolicyDocument::to_cbor", "kind": "function_item", "signature": "pub fn to_cbor(&self) -> ArsenalResult>;", "docs": "Serialize to CBOR bytes\n\n# Errors\nReturns an error if serialization fails", "attributes": "", "line": 191 }, { "name": "policy::PolicyDocument::from_cbor", "kind": "function_item", "signature": "pub fn from_cbor(bytes: &[u8]) -> ArsenalResult;", "docs": "Deserialize from CBOR bytes\n\n# Errors\nReturns an error if deserialization fails", "attributes": "", "line": 206 }, { "name": "policy::PolicyRule", "kind": "struct_item", "signature": "pub struct PolicyRule {\n/// Rule ID (unique within policy)\n\npub id: String,\n/// Rule description\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub description: Option,\n/// Effect when rule matches\n\npub effect: PolicyEffect,\n/// Conditions that must be met\n\npub conditions: Vec,\n/// Scopes this rule applies to\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub scopes: Option,\n/// Constraints to apply\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub constraints: Option,\n/// Rate limits to apply\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub rate_limits: Option,\n/// Usage budget to apply\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub budget: Option\n}", "docs": "A single policy rule", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 218 }, { "name": "policy::PolicyRule::new", "kind": "function_item", "signature": "pub fn new(id: impl Into, effect: PolicyEffect) -> Self;", "docs": "Create a new rule", "attributes": "#[must_use]", "line": 245 }, { "name": "policy::PolicyRule::with_condition", "kind": "function_item", "signature": "pub fn with_condition(mut self, condition: PolicyCondition) -> Self;", "docs": "Add a condition", "attributes": "#[must_use]", "line": 260 }, { "name": "policy::PolicyRule::with_scopes", "kind": "function_item", "signature": "pub fn with_scopes(mut self, scopes: ScopeSet) -> Self;", "docs": "Set scopes", "attributes": "#[must_use]", "line": 267 }, { "name": "policy::PolicyRule::matches", "kind": "function_item", "signature": "pub fn matches(&self, request: &PolicyRequest) -> bool;", "docs": "Check if this rule matches the request", "attributes": "#[must_use]", "line": 274 }, { "name": "policy::PolicyCondition", "kind": "enum_item", "signature": "pub enum PolicyCondition {\n /// Match on agent ID\n AgentId {\n /// Operator for comparison\n operator: ConditionOperator,\n /// Value to compare against\n value: String,\n },\n /// Match on tenant ID\n TenantId {\n /// Operator for comparison\n operator: ConditionOperator,\n /// Value to compare against\n value: String,\n },\n /// Match on requested scope\n Scope {\n /// Operator for comparison\n operator: ConditionOperator,\n /// Value to compare against\n value: String,\n },\n /// Match on environment\n Environment {\n /// Operator for comparison\n operator: ConditionOperator,\n /// Value to compare against\n value: String,\n },\n /// Match on time of day\n TimeOfDay {\n /// Allowed hours (0-23)\n allowed_hours: Vec,\n },\n /// Match on day of week\n DayOfWeek {\n /// Allowed days (0=Sunday, 6=Saturday)\n allowed_days: Vec,\n },\n /// Match on IP address\n IpAddress {\n /// Allowed CIDRs\n allowed_cidrs: Vec,\n },\n /// Match on custom attribute\n Attribute {\n /// Attribute key\n key: String,\n /// Operator for comparison\n operator: ConditionOperator,\n /// Value to compare against\n value: String,\n },\n /// Boolean AND of conditions\n And {\n /// Conditions to AND together\n conditions: Vec,\n },\n /// Boolean OR of conditions\n Or {\n /// Conditions to OR together\n conditions: Vec,\n },\n /// Boolean NOT of condition\n Not {\n /// Condition to negate\n condition: Box,\n },\n}", "docs": "Policy condition for rule evaluation", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]\n#[serde(tag = \"type\", rename_all = \"snake_case\")]", "line": 283 }, { "name": "policy::PolicyCondition::evaluate", "kind": "function_item", "signature": "pub fn evaluate(&self, request: &PolicyRequest) -> bool;", "docs": "Evaluate the condition against a request", "attributes": "#[must_use]", "line": 356 }, { "name": "policy::ConditionOperator", "kind": "enum_item", "signature": "pub enum ConditionOperator {\n /// Exact equality\n Equals,\n /// Not equal\n NotEquals,\n /// String contains\n Contains,\n /// String starts with\n StartsWith,\n /// String ends with\n EndsWith,\n /// Regex match\n Matches,\n /// In list\n In,\n /// Not in list\n NotIn,\n}", "docs": "Comparison operator for conditions", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"snake_case\")]", "line": 419 }, { "name": "policy::ConditionOperator::compare", "kind": "function_item", "signature": "pub fn compare(&self, actual: &str, expected: &str) -> bool;", "docs": "two strings using this operator", "attributes": "#[must_use]", "line": 441 }, { "name": "policy::PolicyEffect", "kind": "enum_item", "signature": "pub enum PolicyEffect {\n /// Allow the action\n Allow,\n /// Deny the action\n Deny,\n}", "docs": "Policy effect (allow or deny)", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"lowercase\")]", "line": 482 }, { "name": "policy::PolicyRequest", "kind": "struct_item", "signature": "pub struct PolicyRequest {\n/// Agent ID making the request\n\npub agent_id: String,\n/// Tenant ID\n\npub tenant_id: String,\n/// Requested scope\n\npub requested_scope: String,\n/// Request timestamp\n\npub timestamp: chrono::DateTime,\n/// Environment (e.g., \"production\", \"staging\")\n\npub environment: Option,\n/// Client IP address\n\npub client_ip: Option,\n/// Custom attributes\n\npub attributes: HashMap\n}", "docs": "Request context for policy evaluation", "attributes": "#[derive(Debug, Clone)]", "line": 491 }, { "name": "policy::PolicyRequest::new", "kind": "function_item", "signature": "pub fn new(agent_id: String, tenant_id: String, requested_scope: String) -> Self;", "docs": "Create a new policy request", "attributes": "#[must_use]", "line": 511 }, { "name": "policy::PolicyRequest::with_environment", "kind": "function_item", "signature": "pub fn with_environment(mut self, env: impl Into) -> Self;", "docs": "Set environment", "attributes": "#[must_use]", "line": 525 }, { "name": "policy::PolicyRequest::with_client_ip", "kind": "function_item", "signature": "pub fn with_client_ip(mut self, ip: impl Into) -> Self;", "docs": "Set client IP", "attributes": "#[must_use]", "line": 532 }, { "name": "policy::PolicyRequest::with_attribute", "kind": "function_item", "signature": "pub fn with_attribute(mut self, key: impl Into, value: impl Into) -> Self;", "docs": "Add an attribute", "attributes": "#[must_use]", "line": 539 }, { "name": "policy::PolicyDecision", "kind": "struct_item", "signature": "pub struct PolicyDecision {\n/// The effect (allow/deny)\n\npub effect: PolicyEffect,\n/// ID of the rule that matched (if any)\n\npub matched_rule: Option,\n/// Reason for the decision\n\npub reason: Option\n}", "docs": "Result of policy evaluation", "attributes": "#[derive(Debug, Clone)]", "line": 547 }, { "name": "policy::PolicyDecision::is_allowed", "kind": "function_item", "signature": "pub fn is_allowed(&self) -> bool;", "docs": "Check if the decision allows the action", "attributes": "#[must_use]", "line": 559 }, { "name": "policy::PolicyDecision::is_denied", "kind": "function_item", "signature": "pub fn is_denied(&self) -> bool;", "docs": "Check if the decision denies the action", "attributes": "#[must_use]", "line": 565 }, { "name": "policy::PolicySignature", "kind": "struct_item", "signature": "pub struct PolicySignature {\n/// Signature bytes\n\npub bytes: Vec,\n/// Algorithm used\n\npub algorithm: String,\n/// Key ID used for signing\n\npub key_id: String,\n/// When the signature was created\n\npub signed_at: chrono::DateTime\n}", "docs": "Policy signature for tamper-resistance", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 572 } ], "parseErrors": false }, { "module": "proxy", "source": "arsenal/crates/arsenal-core/src/proxy.rs", "sha256": "90e751496306a0bbe03e31e36b1f8df51ed69fa0c85d22a103c6f590e0e15319", "attributes": "", "items": [ { "name": "proxy::DestinationBinding", "kind": "struct_item", "signature": "pub struct DestinationBinding {\n/// Allowed target domains (e.g., `[\"api.stripe.com\"]`).\n\n/// At least one domain must be specified.\n\npub allowed_domains: Vec,\n/// Optional allowed path patterns. Supports `*` (single segment) and `**` (multi-segment).\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub allowed_paths: Option>,\n/// Optional allowed HTTP methods (e.g., `[\"GET\", \"POST\"]`).\n\n/// If `None`, all methods are allowed.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub allowed_methods: Option>,\n/// Optional allowed ports. Defaults to `[443]` if not specified.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub allowed_ports: Option>,\n/// Whether TLS is required. Defaults to `true`.\n\n#[serde(default = \"default_true\")]\npub require_tls: bool,\n/// Whether subdomains of allowed domains are also allowed. Defaults to `false`.\n\n#[serde(default)]\npub allow_subdomains: bool\n}", "docs": "Destination binding restricts which endpoints a credential can reach.\n\nWhen a secret has a destination binding, proxy requests using that secret\nare validated against the binding before credential injection. This prevents\ncredential misuse even if an agent's capability token is compromised.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 73 }, { "name": "proxy::DestinationBinding::new", "kind": "function_item", "signature": "pub fn new(allowed_domains: Vec) -> ArsenalResult;", "docs": "Create a new destination binding for the given domains.\n\n# Errors\n\nReturns an error if no domains are provided or validation fails.", "attributes": "", "line": 106 }, { "name": "proxy::DestinationBinding::validate", "kind": "function_item", "signature": "pub fn validate(&self) -> ArsenalResult<()>;", "docs": "Validate the destination binding configuration.\n\n# Errors\n\nReturns an error if the configuration is invalid.", "attributes": "", "line": 124 }, { "name": "proxy::DestinationBinding::is_domain_allowed", "kind": "function_item", "signature": "pub fn is_domain_allowed(&self, domain: &str) -> bool;", "docs": "Check if a given domain is allowed by this binding.", "attributes": "#[must_use]", "line": 179 }, { "name": "proxy::DestinationBinding::is_method_allowed", "kind": "function_item", "signature": "pub fn is_method_allowed(&self, method: &str) -> bool;", "docs": "Check if a given HTTP method is allowed by this binding.", "attributes": "#[must_use]", "line": 195 }, { "name": "proxy::DestinationBinding::is_port_allowed", "kind": "function_item", "signature": "pub fn is_port_allowed(&self, port: u16) -> bool;", "docs": "Check if a given port is allowed by this binding.", "attributes": "#[must_use]", "line": 204 }, { "name": "proxy::DestinationBinding::is_path_allowed", "kind": "function_item", "signature": "pub fn is_path_allowed(&self, path: &str) -> bool;", "docs": "Check if a given path matches the allowed path patterns.\n\nSupports `*` (matches a single path segment) and `**` (matches any\nnumber of segments).", "attributes": "#[must_use]", "line": 216 }, { "name": "proxy::VariablePrefix", "kind": "enum_item", "signature": "pub enum VariablePrefix {\n /// OAuth 2.0 token\n OAuth2,\n /// OAuth 1.0 token\n OAuth1,\n /// API key\n ApiKey,\n /// HTTP Basic authentication\n Basic,\n /// Bearer token\n Bearer,\n /// Client certificate\n Cert,\n /// Custom credential type\n Custom,\n}", "docs": "Variable prefix indicating the credential type.\n\nTemplate variables follow the pattern `{{PREFIX_NAME}}`, where the prefix\nindicates the credential type and helps the proxy resolve the correct secret.", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(rename_all = \"SCREAMING_SNAKE_CASE\")]", "line": 232 }, { "name": "proxy::VariablePrefix::as_str", "kind": "function_item", "signature": "pub const fn as_str(&self) -> &'static str;", "docs": "Get the string representation of this prefix.", "attributes": "#[must_use]", "line": 252 }, { "name": "proxy::VariablePrefix::from_str_prefix", "kind": "function_item", "signature": "pub fn from_str_prefix(s: &str) -> ArsenalResult;", "docs": "Parse a prefix from a string.\n\n# Errors\n\nReturns an error if the string does not match a known prefix.", "attributes": "", "line": 269 }, { "name": "proxy::TemplateVariable", "kind": "struct_item", "signature": "pub struct TemplateVariable {\n/// Full variable name (e.g., `OAUTH2_STRIPE_TOKEN`).\n\n/// Must match `[A-Z][A-Z0-9_]{1,63}`.\n\npub name: String,\n/// The credential type prefix parsed from the name.\n\npub prefix: VariablePrefix\n}", "docs": "A parsed template variable from a proxy request.\n\nTemplate variables are placeholders in proxy request URLs, headers, or bodies\nthat the proxy replaces with actual credential values. Agents see only the\nplaceholder name, never the resolved value.", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]", "line": 292 }, { "name": "proxy::TemplateVariable::new", "kind": "function_item", "signature": "pub fn new(name: impl Into) -> ArsenalResult;", "docs": "Create a new template variable with validation.\n\n# Errors\n\nReturns an error if the variable name is invalid.", "attributes": "", "line": 306 }, { "name": "proxy::TemplateVariable::name", "kind": "function_item", "signature": "pub fn name(&self) -> &str;", "docs": "Get the variable name.", "attributes": "#[must_use]", "line": 315 }, { "name": "proxy::TemplateVariable::prefix", "kind": "function_item", "signature": "pub const fn prefix(&self) -> VariablePrefix;", "docs": "Get the credential type prefix.", "attributes": "#[must_use]", "line": 321 }, { "name": "proxy::parse_template_variables", "kind": "function_item", "signature": "pub fn parse_template_variables(input: &str) -> Vec;", "docs": "Parse all template variables from a string containing `{{VARIABLE}}` placeholders.\n\nScans the input for `{{...}}` patterns and returns all valid template variables\nfound. Invalid variable names inside `{{}}` are silently skipped.", "attributes": "#[must_use]", "line": 331 }, { "name": "proxy::validate_variable_name", "kind": "function_item", "signature": "pub fn validate_variable_name(name: &str) -> ArsenalResult<()>;", "docs": "Validate a template variable name.\n\nVariable names must match `[A-Z][A-Z0-9_]{1,63}`.\n\n# Errors\n\nReturns an error if the name is invalid.", "attributes": "", "line": 360 }, { "name": "proxy::ProxyRequest", "kind": "struct_item", "signature": "pub struct ProxyRequest {\n/// HTTP method (GET, POST, PUT, DELETE, etc.)\n\npub method: String,\n/// Target URL (may contain `{{VARIABLE}}` placeholders)\n\npub url: String,\n/// Optional HTTP headers (may contain `{{VARIABLE}}` placeholders)\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub headers: Option>,\n/// Optional request body bytes\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub body: Option>,\n/// Base64-encoded capability token authorizing this request\n\npub capability_token: String,\n/// Optional timeout in milliseconds (default: 30000, max: 300000)\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub timeout_ms: Option\n}", "docs": "A proxy request from an agent to the broker.\n\nThe agent constructs this request using template variables instead of\nactual credentials. The broker resolves the variables, validates\ndestination bindings, and forwards the assembled request.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 408 }, { "name": "proxy::ProxyRequest::validate", "kind": "function_item", "signature": "pub fn validate(&self) -> ArsenalResult<()>;", "docs": "Validate the proxy request structure.\n\n# Errors\n\nReturns an error if the request is malformed.", "attributes": "", "line": 432 }, { "name": "proxy::ProxyRequest::effective_timeout_ms", "kind": "function_item", "signature": "pub fn effective_timeout_ms(&self) -> u64;", "docs": "Get the effective timeout in milliseconds.", "attributes": "#[must_use]", "line": 481 }, { "name": "proxy::ProxyRequest::extract_variables", "kind": "function_item", "signature": "pub fn extract_variables(&self) -> Vec;", "docs": "Extract all template variables from the URL, headers, and body.", "attributes": "#[must_use]", "line": 489 }, { "name": "proxy::ProxyResponse", "kind": "struct_item", "signature": "pub struct ProxyResponse {\n/// HTTP status code from the target API\n\npub status: u16,\n/// Response headers (sanitized \u2014 credential headers stripped)\n\npub headers: BTreeMap,\n/// Response body bytes\n\npub body: Vec,\n/// Metadata about how the proxy processed the request\n\npub proxy_metadata: ProxyMetadata\n}", "docs": "Response from the broker after proxying an API call.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 518 }, { "name": "proxy::ProxyMetadata", "kind": "struct_item", "signature": "pub struct ProxyMetadata {\n/// Names of variables that were resolved (never values)\n\npub variables_resolved: Vec,\n/// Whether the destination binding was verified\n\npub destination_verified: bool,\n/// Whether the agent fingerprint was verified\n\npub fingerprint_verified: bool,\n/// Status of human consent for credential usage\n\npub consent_status: ConsentStatus,\n/// End-to-end proxy latency in milliseconds\n\npub latency_ms: u64,\n/// Unique request ID for audit correlation\n\npub request_id: Uuid\n}", "docs": "Metadata about proxy request processing.\n\nIncluded in every proxy response to give agents visibility into what\nhappened without revealing credential values.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 534 }, { "name": "proxy::ProxyMetadata::new", "kind": "function_item", "signature": "pub fn new(request_id: Uuid) -> Self;", "docs": "Create new proxy metadata for a request.", "attributes": "#[must_use]", "line": 552 }, { "name": "proxy::VariableResolutionTable", "kind": "struct_item", "signature": "pub struct VariableResolutionTable {\n\n}", "docs": "Maps template variable names to secret references.\n\nThe variable resolution table is maintained per-tenant and maps\nagent-visible variable names to the actual secrets they represent.\nThis table is the bridge between the agent's view (template variables)\nand the broker's view (encrypted secrets).", "attributes": "#[derive(Debug, Clone, Default, Serialize, Deserialize)]", "line": 573 }, { "name": "proxy::VariableResolutionTable::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Create an empty resolution table.", "attributes": "#[must_use]", "line": 581 }, { "name": "proxy::VariableResolutionTable::register", "kind": "function_item", "signature": "pub fn register(\n &mut self,\n variable_name: impl Into,\n secret_ref: SecretRef,\n ) -> ArsenalResult<()>;", "docs": "Register a variable-to-secret mapping.\n\n# Errors\n\nReturns an error if the variable name is invalid or the table is full.", "attributes": "", "line": 590 }, { "name": "proxy::VariableResolutionTable::unregister", "kind": "function_item", "signature": "pub fn unregister(&mut self, variable_name: &str) -> bool;", "docs": "Remove a variable mapping. Returns `true` if the variable existed.", "attributes": "", "line": 612 }, { "name": "proxy::VariableResolutionTable::resolve", "kind": "function_item", "signature": "pub fn resolve(&self, variable_name: &str) -> Option<&SecretRef>;", "docs": "Resolve a variable name to its secret reference.", "attributes": "#[must_use]", "line": 618 }, { "name": "proxy::VariableResolutionTable::variable_names", "kind": "function_item", "signature": "pub fn variable_names(&self) -> Vec<&str>;", "docs": "List all registered variable names.", "attributes": "#[must_use]", "line": 624 }, { "name": "proxy::VariableResolutionTable::len", "kind": "function_item", "signature": "pub fn len(&self) -> usize;", "docs": "Get the number of registered variables.", "attributes": "#[must_use]", "line": 630 }, { "name": "proxy::VariableResolutionTable::is_empty", "kind": "function_item", "signature": "pub fn is_empty(&self) -> bool;", "docs": "Check if the table is empty.", "attributes": "#[must_use]", "line": 636 }, { "name": "proxy::VariableResolutionTable::entries", "kind": "function_item", "signature": "pub fn entries(&self) -> &BTreeMap;", "docs": "Get a reference to the underlying entries.", "attributes": "#[must_use]", "line": 642 } ], "parseErrors": false }, { "module": "scope", "source": "arsenal/crates/arsenal-core/src/scope.rs", "sha256": "539edaf85c4dd36b2b1c51fd72109798df47809c623318a4b6370e71dab7f46e", "attributes": "", "items": [ { "name": "scope::Scope", "kind": "struct_item", "signature": "pub struct Scope(String);", "docs": "A single permission scope\n\nFormat: `service:resource:action` or `service:resource:*` for wildcards\nExamples:\n- `stripe:charges:read`\n- `stripe:charges:write`\n- `github:repos:*`\n- `*:*:read` (read access to everything)", "attributes": "#[derive(Clone, PartialEq, Eq, Hash, PartialOrd, Ord, Serialize, Deserialize)]\n#[serde(transparent)]", "line": 29 }, { "name": "scope::Scope::new", "kind": "function_item", "signature": "pub fn new(scope: impl Into) -> ArsenalResult;", "docs": "Create a new scope with validation\n\n# Errors\nReturns an error if the scope format is invalid", "attributes": "", "line": 36 }, { "name": "scope::Scope::wildcard", "kind": "function_item", "signature": "pub fn wildcard() -> Self;", "docs": "Create a wildcard scope that matches everything", "attributes": "#[must_use]", "line": 44 }, { "name": "scope::Scope::read_only", "kind": "function_item", "signature": "pub fn read_only(service: &str) -> Self;", "docs": "Create a read-only scope for a service", "attributes": "#[must_use]", "line": 50 }, { "name": "scope::Scope::full_access", "kind": "function_item", "signature": "pub fn full_access(service: &str) -> Self;", "docs": "Create a full access scope for a service", "attributes": "#[must_use]", "line": 56 }, { "name": "scope::Scope::service", "kind": "function_item", "signature": "pub fn service(&self) -> &str;", "docs": "Get the service component", "attributes": "#[must_use]", "line": 62 }, { "name": "scope::Scope::resource", "kind": "function_item", "signature": "pub fn resource(&self) -> &str;", "docs": "Get the resource component", "attributes": "#[must_use]", "line": 68 }, { "name": "scope::Scope::action", "kind": "function_item", "signature": "pub fn action(&self) -> &str;", "docs": "Get the action component", "attributes": "#[must_use]", "line": 75 }, { "name": "scope::Scope::is_wildcard", "kind": "function_item", "signature": "pub fn is_wildcard(&self) -> bool;", "docs": "Check if this scope is a wildcard (matches everything)", "attributes": "#[must_use]", "line": 82 }, { "name": "scope::Scope::implies", "kind": "function_item", "signature": "pub fn implies(&self, other: &Scope) -> bool;", "docs": "Check if this scope implies (covers) another scope\n\nA scope implies another if it grants equal or greater permissions.\nWildcards (`*`) match any value at that position.", "attributes": "#[must_use]", "line": 91 }, { "name": "scope::Scope::as_str", "kind": "function_item", "signature": "pub fn as_str(&self) -> &str;", "docs": "Get the raw scope string", "attributes": "#[must_use]", "line": 113 }, { "name": "scope::ScopeSet", "kind": "struct_item", "signature": "pub struct ScopeSet {\n\n}", "docs": "A set of scopes representing granted permissions", "attributes": "#[derive(Clone, PartialEq, Eq, Default, Serialize, Deserialize)]", "line": 186 }, { "name": "scope::ScopeSet::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Create an empty scope set", "attributes": "#[must_use]", "line": 193 }, { "name": "scope::ScopeSet::single", "kind": "function_item", "signature": "pub fn single(scope: Scope) -> Self;", "docs": "Create a scope set with a single scope", "attributes": "#[must_use]", "line": 201 }, { "name": "scope::ScopeSet::add", "kind": "function_item", "signature": "pub fn add(&mut self, scope: Scope) -> ArsenalResult<()>;", "docs": "Add a scope to the set\n\n# Errors\nReturns an error if the maximum number of scopes would be exceeded", "attributes": "", "line": 211 }, { "name": "scope::ScopeSet::remove", "kind": "function_item", "signature": "pub fn remove(&mut self, scope: &Scope) -> bool;", "docs": "Remove a scope from the set", "attributes": "", "line": 223 }, { "name": "scope::ScopeSet::contains", "kind": "function_item", "signature": "pub fn contains(&self, scope: &Scope) -> bool;", "docs": "Check if the set contains a specific scope", "attributes": "#[must_use]", "line": 229 }, { "name": "scope::ScopeSet::allows", "kind": "function_item", "signature": "pub fn allows(&self, requested: &Scope) -> bool;", "docs": "Check scope set allows the given scope\n\nReturns true if any scope in the set implies the requested scope", "attributes": "#[must_use]", "line": 237 }, { "name": "scope::ScopeSet::is_superset_of", "kind": "function_item", "signature": "pub fn is_superset_of(&self, other: &ScopeSet) -> bool;", "docs": "Check if this scope set is a superset of another\n\nReturns true if all scopes in `other` are allowed by this set", "attributes": "#[must_use]", "line": 245 }, { "name": "scope::ScopeSet::intersection", "kind": "function_item", "signature": "pub fn intersection(&self, other: &ScopeSet) -> ScopeSet;", "docs": "Get the intersection of two scope sets", "attributes": "#[must_use]", "line": 251 }, { "name": "scope::ScopeSet::union", "kind": "function_item", "signature": "pub fn union(&self, other: &ScopeSet) -> ScopeSet;", "docs": "Get the union of two scope sets", "attributes": "#[must_use]", "line": 259 }, { "name": "scope::ScopeSet::is_empty", "kind": "function_item", "signature": "pub fn is_empty(&self) -> bool;", "docs": "Check if the set is empty", "attributes": "#[must_use]", "line": 267 }, { "name": "scope::ScopeSet::len", "kind": "function_item", "signature": "pub fn len(&self) -> usize;", "docs": "Get the number of scopes in the set", "attributes": "#[must_use]", "line": 273 }, { "name": "scope::ScopeSet::iter", "kind": "function_item", "signature": "pub fn iter(&self) -> impl Iterator;", "docs": "Iterate over the scopes", "attributes": "", "line": 278 }, { "name": "scope::ScopeSet::to_strings", "kind": "function_item", "signature": "pub fn to_strings(&self) -> Vec;", "docs": "Convert to a vector of scope strings", "attributes": "#[must_use]", "line": 284 }, { "name": "scope::ScopeSet::from_strings", "kind": "function_item", "signature": "pub fn from_strings(scopes: Vec) -> ArsenalResult;", "docs": "Create from a vector of scope strings\n\n# Errors\nReturns an error if any scope is invalid or too many scopes are provided", "attributes": "", "line": 292 }, { "name": "scope::Permission", "kind": "enum_item", "signature": "pub enum Permission {\n /// Read/view access\n Read,\n /// Create new resources\n Create,\n /// Update existing resources\n Update,\n /// Delete resources\n Delete,\n /// Full access (all permissions)\n Admin,\n}", "docs": "Permission type for CRUD operations", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(rename_all = \"lowercase\")]", "line": 339 }, { "name": "scope::Permission::as_str", "kind": "function_item", "signature": "pub const fn as_str(&self) -> &'static str;", "docs": "Get the string representation", "attributes": "#[must_use]", "line": 355 }, { "name": "scope::Permission::implies", "kind": "function_item", "signature": "pub const fn implies(&self, other: &Permission) -> bool;", "docs": "Check if this permission implies another", "attributes": "#[must_use]", "line": 367 } ], "parseErrors": false }, { "module": "secret", "source": "arsenal/crates/arsenal-core/src/secret.rs", "sha256": "b680d13ed794de37fa2a5d6719c3b4051d95e8019669cc69eb38a5f340187c34", "attributes": "", "items": [ { "name": "secret::SecretId", "kind": "struct_item", "signature": "pub struct SecretId(Uuid);", "docs": "Secret identifier", "attributes": "#[derive(Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(transparent)]", "line": 24 }, { "name": "secret::SecretId::generate", "kind": "function_item", "signature": "pub fn generate() -> Self;", "docs": "Generate a new secret ID", "attributes": "#[must_use]", "line": 29 }, { "name": "secret::SecretId::from_uuid", "kind": "function_item", "signature": "pub const fn from_uuid(uuid: Uuid) -> Self;", "docs": "Create from an existing UUID", "attributes": "#[must_use]", "line": 35 }, { "name": "secret::SecretId::as_uuid", "kind": "function_item", "signature": "pub const fn as_uuid(&self) -> &Uuid;", "docs": "Get the inner UUID", "attributes": "#[must_use]", "line": 41 }, { "name": "secret::SecretVersion", "kind": "struct_item", "signature": "pub struct SecretVersion(u64);", "docs": "Secret version identifier", "attributes": "#[derive(Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord, Serialize, Deserialize)]\n#[serde(transparent)]", "line": 61 }, { "name": "secret::SecretVersion::initial", "kind": "function_item", "signature": "pub const fn initial() -> Self;", "docs": "Create version 1 (initial version)", "attributes": "#[must_use]", "line": 66 }, { "name": "secret::SecretVersion::new", "kind": "function_item", "signature": "pub const fn new(version: u64) -> Self;", "docs": "Create from a version number", "attributes": "#[must_use]", "line": 72 }, { "name": "secret::SecretVersion::as_u64", "kind": "function_item", "signature": "pub const fn as_u64(&self) -> u64;", "docs": "Get the version number", "attributes": "#[must_use]", "line": 78 }, { "name": "secret::SecretVersion::next", "kind": "function_item", "signature": "pub const fn next(&self) -> Self;", "docs": "Get the next version", "attributes": "#[must_use]", "line": 84 }, { "name": "secret::SecretVersion::is_initial", "kind": "function_item", "signature": "pub const fn is_initial(&self) -> bool;", "docs": "Check if this is the initial version", "attributes": "#[must_use]", "line": 90 }, { "name": "secret::SecretType", "kind": "enum_item", "signature": "pub enum SecretType {\n /// API key (e.g., `OpenAI`, Stripe)\n ApiKey,\n /// `OAuth2` client credentials\n OAuthClientCredentials,\n /// `OAuth2` access token\n OAuthAccessToken,\n /// `OAuth2` refresh token\n OAuthRefreshToken,\n /// Database connection string\n DatabaseCredentials,\n /// SSH private key\n SshKey,\n /// TLS/SSL private key and certificate\n TlsCertificate,\n /// Signing key (e.g., JWT, webhook)\n SigningKey,\n /// Encryption key\n EncryptionKey,\n /// Generic secret\n Generic,\n}", "docs": "Secret type classification", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(rename_all = \"snake_case\")]", "line": 110 }, { "name": "secret::SecretType::should_auto_rotate", "kind": "function_item", "signature": "pub const fn should_auto_rotate(&self) -> bool;", "docs": "Check if this secret type should be automatically rotated", "attributes": "#[must_use]", "line": 136 }, { "name": "secret::SecretType::recommended_rotation_days", "kind": "function_item", "signature": "pub const fn recommended_rotation_days(&self) -> Option;", "docs": "Get recommended rotation period in days", "attributes": "#[must_use]", "line": 145 }, { "name": "secret::SecretMetadata", "kind": "struct_item", "signature": "pub struct SecretMetadata {\n/// Secret ID\n\npub id: SecretId,\n/// Tenant this secret belongs to\n\npub tenant_id: TenantId,\n/// Human-readable name\n\npub name: String,\n/// Description\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub description: Option,\n/// Secret type\n\npub secret_type: SecretType,\n/// Current version\n\npub current_version: SecretVersion,\n/// All versions\n\npub versions: Vec,\n/// When the secret was created\n\npub created_at: chrono::DateTime,\n/// When the secret was last modified\n\npub updated_at: chrono::DateTime,\n/// When the secret expires (if ever)\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub expires_at: Option>,\n/// When the secret was last rotated\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub last_rotated_at: Option>,\n/// Next scheduled rotation\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub next_rotation_at: Option>,\n/// Whether the secret is currently active\n\npub is_active: bool,\n/// Custom labels\n\n#[serde(default)]\npub labels: HashMap,\n/// Associated service (e.g., \"stripe\", \"openai\")\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub service: Option,\n/// Destination binding restricting where this credential can be used\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub destination_binding: Option\n}", "docs": "Secret metadata (does not contain the actual secret value)", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 158 }, { "name": "secret::SecretMetadata::new", "kind": "function_item", "signature": "pub fn new(\n tenant_id: TenantId,\n name: impl Into,\n secret_type: SecretType,\n ) -> ArsenalResult;", "docs": "Create new secret metadata\n\n# Errors\nReturns an error if validation fails", "attributes": "", "line": 205 }, { "name": "secret::SecretMetadata::is_expired", "kind": "function_item", "signature": "pub fn is_expired(&self) -> bool;", "docs": "Check if secret is expired", "attributes": "#[must_use]", "line": 243 }, { "name": "secret::SecretMetadata::needs_rotation", "kind": "function_item", "signature": "pub fn needs_rotation(&self) -> bool;", "docs": "Check if the secret needs rotation", "attributes": "#[must_use]", "line": 253 }, { "name": "secret::SecretMetadata::add_version", "kind": "function_item", "signature": "pub fn add_version(&mut self, created_by: Option) -> SecretVersion;", "docs": "Add a new version", "attributes": "", "line": 262 }, { "name": "secret::SecretMetadata::disable_version", "kind": "function_item", "signature": "pub fn disable_version(&mut self, version: SecretVersion);", "docs": "Disable a specific version", "attributes": "", "line": 288 }, { "name": "secret::SecretMetadata::deactivate", "kind": "function_item", "signature": "pub fn deactivate(&mut self);", "docs": "Deactivate the entire secret", "attributes": "", "line": 298 }, { "name": "secret::SecretMetadata::set_label", "kind": "function_item", "signature": "pub fn set_label(&mut self, key: impl Into, value: impl Into);", "docs": "Set a label", "attributes": "", "line": 304 }, { "name": "secret::SecretVersionInfo", "kind": "struct_item", "signature": "pub struct SecretVersionInfo {\n/// Version number\n\npub version: SecretVersion,\n/// When this version was created\n\npub created_at: chrono::DateTime,\n/// Who created this version\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub created_by: Option,\n/// Current state of this version\n\npub state: SecretVersionState\n}", "docs": "Information about a specific secret version", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 312 }, { "name": "secret::SecretVersionState", "kind": "enum_item", "signature": "pub enum SecretVersionState {\n /// Currently active version\n Active,\n /// Previous version (still valid for grace period)\n Previous,\n /// Disabled (cannot be used)\n Disabled,\n /// Scheduled for deletion\n PendingDeletion,\n}", "docs": "State of a secret version", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"snake_case\")]", "line": 327 }, { "name": "secret::SecretRef", "kind": "struct_item", "signature": "pub struct SecretRef {\n/// Secret ID\n\npub id: SecretId,\n/// Specific version (None = latest)\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub version: Option\n}", "docs": "Secret reference - used to reference a secret without containing it", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 340 }, { "name": "secret::SecretRef::latest", "kind": "function_item", "signature": "pub fn latest(id: SecretId) -> Self;", "docs": "Create a reference to the latest version", "attributes": "#[must_use]", "line": 351 }, { "name": "secret::SecretRef::specific", "kind": "function_item", "signature": "pub fn specific(id: SecretId, version: SecretVersion) -> Self;", "docs": "Create a reference to a specific version", "attributes": "#[must_use]", "line": 357 }, { "name": "secret::WrappedSecret", "kind": "struct_item", "signature": "pub struct WrappedSecret {\n/// Secret ID\n\npub id: SecretId,\n/// Version\n\npub version: SecretVersion,\n/// Encrypted secret bytes\n\npub ciphertext: Vec,\n/// Nonce used for encryption\n\npub nonce: [u8; 12],\n/// Key ID used for wrapping\n\npub wrap_key_id: String,\n/// Algorithm used\n\npub algorithm: String,\n/// When this wrapped secret expires\n\npub expires_at: chrono::DateTime\n}", "docs": "Wrapped secret - encrypted secret value for transport", "attributes": "#[derive(Clone, Serialize, Deserialize)]", "line": 367 }, { "name": "secret::WrappedSecret::is_expired", "kind": "function_item", "signature": "pub fn is_expired(&self) -> bool;", "docs": "Check if this wrapped secret has expired", "attributes": "#[must_use]", "line": 387 }, { "name": "secret::SecretValue", "kind": "struct_item", "signature": "pub struct SecretValue {\n\n}", "docs": "Secret value - holds the actual decrypted secret\n\nThis type is zeroized on drop for security.", "attributes": "#[derive(Clone, zeroize::Zeroize, zeroize::ZeroizeOnDrop)]", "line": 409 }, { "name": "secret::SecretValue::new", "kind": "function_item", "signature": "pub fn new(bytes: Vec) -> ArsenalResult;", "docs": "Create from bytes\n\n# Errors\nReturns an error if the secret is too large", "attributes": "", "line": 419 }, { "name": "secret::SecretValue::from_string", "kind": "function_item", "signature": "pub fn from_string(s: impl Into) -> ArsenalResult;", "docs": "Create from a string\n\n# Errors\nReturns an error if the secret is too large", "attributes": "", "line": 433 }, { "name": "secret::SecretValue::as_bytes", "kind": "function_item", "signature": "pub fn as_bytes(&self) -> &[u8];", "docs": "Get the secret bytes", "attributes": "#[must_use]", "line": 439 }, { "name": "secret::SecretValue::as_str", "kind": "function_item", "signature": "pub fn as_str(&self) -> Option<&str>;", "docs": "Get as UTF-8 string if valid", "attributes": "#[must_use]", "line": 445 }, { "name": "secret::SecretValue::len", "kind": "function_item", "signature": "pub fn len(&self) -> usize;", "docs": "Get the length", "attributes": "#[must_use]", "line": 451 }, { "name": "secret::SecretValue::is_empty", "kind": "function_item", "signature": "pub fn is_empty(&self) -> bool;", "docs": "Check if empty", "attributes": "#[must_use]", "line": 457 }, { "name": "secret::RotationPolicy", "kind": "struct_item", "signature": "pub struct RotationPolicy {\n/// Enable automatic rotation\n\npub auto_rotate: bool,\n/// Rotation interval in days\n\npub rotation_days: u32,\n/// Grace period for old versions in hours\n\npub grace_period_hours: u32,\n/// Maximum number of versions to keep\n\npub max_versions: u32,\n/// Notification settings\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub notification: Option\n}", "docs": "Rotation policy for secrets", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 470 }, { "name": "secret::RotationNotification", "kind": "struct_item", "signature": "pub struct RotationNotification {\n/// Days before rotation to send warning\n\npub warn_days_before: Vec,\n/// Webhook URL for notifications\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub webhook_url: Option,\n/// Email addresses for notifications\n\n#[serde(default)]\npub email_addresses: Vec\n}", "docs": "Rotation notification settings", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 498 } ], "parseErrors": false }, { "module": "session", "source": "arsenal/crates/arsenal-core/src/session.rs", "sha256": "f774575cf6008b05bafb52312b9d92083e0dd30d55e00b467702c72c613f17eb", "attributes": "", "items": [ { "name": "session::SessionId", "kind": "struct_item", "signature": "pub struct SessionId(Uuid);", "docs": "Session identifier", "attributes": "#[derive(Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(transparent)]", "line": 20 }, { "name": "session::SessionId::generate", "kind": "function_item", "signature": "pub fn generate() -> Self;", "docs": "Generate a new session ID", "attributes": "#[must_use]", "line": 25 }, { "name": "session::SessionId::from_uuid", "kind": "function_item", "signature": "pub const fn from_uuid(uuid: Uuid) -> Self;", "docs": "Create from an existing UUID", "attributes": "#[must_use]", "line": 31 }, { "name": "session::SessionId::as_uuid", "kind": "function_item", "signature": "pub const fn as_uuid(&self) -> &Uuid;", "docs": "Get the inner UUID", "attributes": "#[must_use]", "line": 37 }, { "name": "session::SessionState", "kind": "enum_item", "signature": "pub enum SessionState {\n /// Agent has completed identity verification\n AgentBootstrapped,\n /// Session has been established\n SessionStarted,\n /// Capabilities have been granted to the agent\n CapabilitiesGranted,\n /// Agent is actively using tools\n ToolUse,\n /// Session or tokens are being renewed\n Renewal,\n /// Privilege escalation is in progress\n Escalation,\n /// Session has ended\n SessionEnded,\n}", "docs": "Session state machine states\n\nRepresents the lifecycle of an agent session:\n1. `AgentBootstrapped` - Agent has proven identity\n2. `SessionStarted` - Session is active\n3. `CapabilitiesGranted` - Agent has received capabilities\n4. `ToolUse` - Agent is actively using tools\n5. `Renewal` - Session/tokens being renewed\n6. `Escalation` - Privilege escalation requested\n7. `SessionEnded` - Session terminated", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(rename_all = \"snake_case\")]", "line": 66 }, { "name": "session::SessionState::can_use_tools", "kind": "function_item", "signature": "pub const fn can_use_tools(&self) -> bool;", "docs": "Check if this state allows tool usage", "attributes": "#[must_use]", "line": 86 }, { "name": "session::SessionState::can_request_capabilities", "kind": "function_item", "signature": "pub const fn can_request_capabilities(&self) -> bool;", "docs": "Check if this state allows capability requests", "attributes": "#[must_use]", "line": 92 }, { "name": "session::SessionState::is_terminal", "kind": "function_item", "signature": "pub const fn is_terminal(&self) -> bool;", "docs": "Check if this is a terminal state", "attributes": "#[must_use]", "line": 101 }, { "name": "session::SessionState::is_active", "kind": "function_item", "signature": "pub const fn is_active(&self) -> bool;", "docs": "Check if the session is active", "attributes": "#[must_use]", "line": 107 }, { "name": "session::SessionState::valid_transitions", "kind": "function_item", "signature": "pub fn valid_transitions(&self) -> &'static [SessionState];", "docs": "Get valid transitions from this state", "attributes": "#[must_use]", "line": 113 }, { "name": "session::SessionState::can_transition_to", "kind": "function_item", "signature": "pub fn can_transition_to(&self, target: SessionState) -> bool;", "docs": "Check if a transition to the target state is valid", "attributes": "#[must_use]", "line": 137 }, { "name": "session::SessionEndReason", "kind": "enum_item", "signature": "pub enum SessionEndReason {\n /// Normal completion\n Completed,\n /// Explicit logout\n Logout,\n /// Session timeout\n Timeout,\n /// Token expired\n TokenExpired,\n /// Revoked by administrator\n Revoked,\n /// Security violation detected\n SecurityViolation,\n /// Policy violation\n PolicyViolation,\n /// System shutdown\n SystemShutdown,\n /// Error during session\n Error(String),\n}", "docs": "Reason for session termination", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"snake_case\")]", "line": 160 }, { "name": "session::AgentSession", "kind": "struct_item", "signature": "pub struct AgentSession {\n/// Unique session identifier\n\npub id: SessionId,\n/// Tenant this session belongs to\n\npub tenant_id: TenantId,\n/// Agent identity\n\npub agent_id: AgentId,\n/// Principal (user/service) that initiated the session\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub principal_id: Option,\n/// Current state\n\npub state: SessionState,\n/// When the session was created\n\npub created_at: chrono::DateTime,\n/// When the session was last active\n\npub last_activity_at: chrono::DateTime,\n/// When the session expires\n\npub expires_at: chrono::DateTime,\n/// Session metadata\n\n#[serde(default)]\npub metadata: std::collections::HashMap,\n/// Reason for session end (if ended)\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub end_reason: Option\n}", "docs": "Agent session - represents an authenticated agent's session", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 199 }, { "name": "session::AgentSession::new", "kind": "function_item", "signature": "pub fn new(tenant_id: TenantId, agent_id: AgentId, ttl_seconds: u64) -> Self;", "docs": "Create a new session", "attributes": "#[must_use]", "line": 248 }, { "name": "session::AgentSession::with_principal", "kind": "function_item", "signature": "pub fn with_principal(mut self, principal_id: PrincipalId) -> Self;", "docs": "Set the principal ID", "attributes": "#[must_use]", "line": 272 }, { "name": "session::AgentSession::transition_to", "kind": "function_item", "signature": "pub fn transition_to(\n &mut self,\n new_state: SessionState,\n reason: Option,\n ) -> ArsenalResult<()>;", "docs": "Transition to a new state\n\n# Errors\nReturns an error if the transition is invalid", "attributes": "", "line": 281 }, { "name": "session::AgentSession::start", "kind": "function_item", "signature": "pub fn start(&mut self) -> ArsenalResult<()>;", "docs": "Start the session\n\n# Errors\nReturns an error if the session cannot be started", "attributes": "", "line": 311 }, { "name": "session::AgentSession::grant_capabilities", "kind": "function_item", "signature": "pub fn grant_capabilities(&mut self, scopes: &ScopeSet) -> ArsenalResult<()>;", "docs": "Grant capabilities\n\n# Errors\nReturns an error if capabilities cannot be granted", "attributes": "", "line": 322 }, { "name": "session::AgentSession::begin_tool_use", "kind": "function_item", "signature": "pub fn begin_tool_use(&mut self) -> ArsenalResult<()>;", "docs": "Begin tool use\n\n# Errors\nReturns an error if tool use cannot begin", "attributes": "", "line": 335 }, { "name": "session::AgentSession::begin_renewal", "kind": "function_item", "signature": "pub fn begin_renewal(&mut self) -> ArsenalResult<()>;", "docs": "Begin renewal\n\n# Errors\nReturns an error if renewal cannot begin", "attributes": "", "line": 343 }, { "name": "session::AgentSession::complete_renewal", "kind": "function_item", "signature": "pub fn complete_renewal(\n &mut self,\n new_expires_at: chrono::DateTime,\n ) -> ArsenalResult<()>;", "docs": "Complete renewal\n\n# Errors\nReturns an error if renewal cannot be completed", "attributes": "", "line": 351 }, { "name": "session::AgentSession::begin_escalation", "kind": "function_item", "signature": "pub fn begin_escalation(&mut self) -> ArsenalResult<()>;", "docs": "Begin escalation\n\n# Errors\nReturns an error if escalation cannot begin", "attributes": "", "line": 367 }, { "name": "session::AgentSession::end", "kind": "function_item", "signature": "pub fn end(&mut self, reason: SessionEndReason) -> ArsenalResult<()>;", "docs": "End the session\n\n# Errors\nReturns an error if the session cannot be ended", "attributes": "", "line": 378 }, { "name": "session::AgentSession::add_token", "kind": "function_item", "signature": "pub fn add_token(&mut self, token_id: TokenId);", "docs": "Add an active token", "attributes": "", "line": 388 }, { "name": "session::AgentSession::remove_token", "kind": "function_item", "signature": "pub fn remove_token(&mut self, token_id: &TokenId);", "docs": "Remove an active token", "attributes": "", "line": 394 }, { "name": "session::AgentSession::active_tokens", "kind": "function_item", "signature": "pub fn active_tokens(&self) -> &HashSet;", "docs": "Get active token IDs", "attributes": "#[must_use]", "line": 401 }, { "name": "session::AgentSession::granted_scopes", "kind": "function_item", "signature": "pub fn granted_scopes(&self) -> &ScopeSet;", "docs": "Get granted scopes", "attributes": "#[must_use]", "line": 407 }, { "name": "session::AgentSession::is_expired", "kind": "function_item", "signature": "pub fn is_expired(&self) -> bool;", "docs": "Check if the session is expired", "attributes": "#[must_use]", "line": 413 }, { "name": "session::AgentSession::is_active", "kind": "function_item", "signature": "pub fn is_active(&self) -> bool;", "docs": "Check if the session is active", "attributes": "#[must_use]", "line": 419 }, { "name": "session::AgentSession::touch", "kind": "function_item", "signature": "pub fn touch(&mut self);", "docs": "Update last activity timestamp", "attributes": "", "line": 424 }, { "name": "session::AgentSession::state_history_len", "kind": "function_item", "signature": "pub fn state_history_len(&self) -> usize;", "docs": "Get state history", "attributes": "#[must_use]", "line": 430 }, { "name": "session::AgentSession::extend", "kind": "function_item", "signature": "pub fn extend(&mut self, additional_seconds: u64);", "docs": "Extend session expiration", "attributes": "", "line": 435 }, { "name": "session::AgentSession::set_metadata", "kind": "function_item", "signature": "pub fn set_metadata(&mut self, key: impl Into, value: impl Into);", "docs": "Set metadata", "attributes": "", "line": 442 }, { "name": "session::AgentSession::get_metadata", "kind": "function_item", "signature": "pub fn get_metadata(&self, key: &str) -> Option<&String>;", "docs": "Get metadata", "attributes": "#[must_use]", "line": 448 }, { "name": "session::SessionConfig", "kind": "struct_item", "signature": "pub struct SessionConfig {\n/// Default session TTL in seconds\n\npub default_ttl_seconds: u64,\n/// Maximum session TTL in seconds\n\npub max_ttl_seconds: u64,\n/// Idle timeout in seconds\n\npub idle_timeout_seconds: u64,\n/// Maximum concurrent sessions per agent\n\npub max_concurrent_sessions: u32,\n/// Allow session extension\n\npub allow_extension: bool,\n/// Maximum extensions allowed\n\npub max_extensions: u32\n}", "docs": "Session configuration", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 455 } ], "parseErrors": false }, { "module": "token", "source": "arsenal/crates/arsenal-core/src/token.rs", "sha256": "704152225e610b62f9b811548b7cd899d23bedee7514d8222e8073bd31044202", "attributes": "", "items": [ { "name": "token::TokenId", "kind": "struct_item", "signature": "pub struct TokenId(Uuid);", "docs": "Token identifier - unique ID for each token instance", "attributes": "#[derive(Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(transparent)]", "line": 35 }, { "name": "token::TokenId::generate", "kind": "function_item", "signature": "pub fn generate() -> Self;", "docs": "Generate a new random token ID", "attributes": "#[must_use]", "line": 40 }, { "name": "token::TokenId::from_uuid", "kind": "function_item", "signature": "pub const fn from_uuid(uuid: Uuid) -> Self;", "docs": "Create from an existing UUID", "attributes": "#[must_use]", "line": 47 }, { "name": "token::TokenId::as_uuid", "kind": "function_item", "signature": "pub const fn as_uuid(&self) -> &Uuid;", "docs": "Get the inner UUID", "attributes": "#[must_use]", "line": 53 }, { "name": "token::AgentCapabilityToken", "kind": "struct_item", "signature": "pub struct AgentCapabilityToken {\n\n}", "docs": "Agent Capability Token - the main credential type\n\nThis struct represents the claims within a token. The actual signed\ntoken is produced by the crypto layer.", "attributes": "#[derive(Clone, Serialize, Deserialize)]", "line": 75 }, { "name": "token::AgentCapabilityToken::new", "kind": "function_item", "signature": "pub fn new(claims: TokenClaims) -> Self;", "docs": "Create a new unsigned token with the given claims", "attributes": "#[must_use]", "line": 86 }, { "name": "token::AgentCapabilityToken::claims", "kind": "function_item", "signature": "pub fn claims(&self) -> &TokenClaims;", "docs": "Get the token claims", "attributes": "#[must_use]", "line": 95 }, { "name": "token::AgentCapabilityToken::id", "kind": "function_item", "signature": "pub fn id(&self) -> &TokenId;", "docs": "Get the token ID", "attributes": "#[must_use]", "line": 101 }, { "name": "token::AgentCapabilityToken::subject", "kind": "function_item", "signature": "pub fn subject(&self) -> &OasDid;", "docs": "Get the subject (the agent's OAS DID)", "attributes": "#[must_use]", "line": 107 }, { "name": "token::AgentCapabilityToken::audience", "kind": "function_item", "signature": "pub fn audience(&self) -> &str;", "docs": "Get the audience", "attributes": "#[must_use]", "line": 113 }, { "name": "token::AgentCapabilityToken::scopes", "kind": "function_item", "signature": "pub fn scopes(&self) -> &ScopeSet;", "docs": "Get the scopes", "attributes": "#[must_use]", "line": 119 }, { "name": "token::AgentCapabilityToken::is_expired", "kind": "function_item", "signature": "pub fn is_expired(&self) -> bool;", "docs": "Check if the token is expired", "attributes": "#[must_use]", "line": 125 }, { "name": "token::AgentCapabilityToken::is_not_yet_valid", "kind": "function_item", "signature": "pub fn is_not_yet_valid(&self) -> bool;", "docs": "Check if the token is not yet valid", "attributes": "#[must_use]", "line": 131 }, { "name": "token::AgentCapabilityToken::is_time_valid", "kind": "function_item", "signature": "pub fn is_time_valid(&self) -> bool;", "docs": "Check if the token is currently valid (time-wise)", "attributes": "#[must_use]", "line": 137 }, { "name": "token::AgentCapabilityToken::remaining_ttl", "kind": "function_item", "signature": "pub fn remaining_ttl(&self) -> chrono::Duration;", "docs": "Get remaining TTL", "attributes": "#[must_use]", "line": 144 }, { "name": "token::AgentCapabilityToken::is_signed", "kind": "function_item", "signature": "pub fn is_signed(&self) -> bool;", "docs": "Check if token has a valid signature", "attributes": "#[must_use]", "line": 150 }, { "name": "token::AgentCapabilityToken::set_signature", "kind": "function_item", "signature": "pub fn set_signature(&mut self, signature: TokenSignature);", "docs": "Set the signature (called by the crypto layer after signing)", "attributes": "", "line": 155 }, { "name": "token::AgentCapabilityToken::signature", "kind": "function_item", "signature": "pub fn signature(&self) -> Option<&TokenSignature>;", "docs": "Get the signature if present", "attributes": "#[must_use]", "line": 161 }, { "name": "token::AgentCapabilityToken::validate_structure", "kind": "function_item", "signature": "pub fn validate_structure(&self) -> ArsenalResult<()>;", "docs": "Validate token structure (not cryptographic verification)\n\n# Errors\nReturns an error if the token structure is invalid", "attributes": "", "line": 169 }, { "name": "token::AgentCapabilityToken::to_cbor", "kind": "function_item", "signature": "pub fn to_cbor(&self) -> ArsenalResult>;", "docs": "Serialize to the canonical ACT envelope\n\nThe bytes produced here are the interoperable form defined by\n`agent-capability-token`, not Arsenal's internal struct layout. A token\nleaving this process is a standard ACT, so a verifier that has never seen\nArsenal can validate it.\n\n# Errors\nReturns an error if the token is unsigned, if the claims cannot be\nrepresented canonically, or if the encoded token exceeds the size limit.\nAn unsigned token has no envelope form: the envelope carries a signature\nby construction.", "attributes": "", "line": 214 }, { "name": "token::AgentCapabilityToken::claims_to_cbor", "kind": "function_item", "signature": "pub fn claims_to_cbor(&self) -> ArsenalResult>;", "docs": "Serialize just the claims to CBOR bytes (for signing/verification)\n\nProduces the canonical claim encoding, so a signature computed here is a\nsignature over the standard ACT payload. Signing and verification both\nroute through this method, which is what keeps them in agreement.\n\n# Errors\nReturns an error if the claims cannot be represented canonically.", "attributes": "", "line": 242 }, { "name": "token::AgentCapabilityToken::from_cbor", "kind": "function_item", "signature": "pub fn from_cbor(bytes: &[u8]) -> ArsenalResult;", "docs": "Deserialize from the canonical ACT envelope\n\nDecoding does not verify the signature; that is the verifier's job. The\nsignature is carried through so a verifier can check it.\n\n# Errors\nReturns an error if the envelope is malformed, exceeds the size limit, or\ncarries claims Arsenal cannot represent - a multi-audience token, for\ninstance.", "attributes": "", "line": 258 }, { "name": "token::TokenClaims", "kind": "struct_item", "signature": "pub struct TokenClaims {\n/// Token ID (unique identifier)\n\npub jti: TokenId,\n/// Subject - the OAS DID of the agent this token is for\n\n///\n\n/// A DID rather than a local key, so that a verifier outside Arsenal can\n\n/// resolve the identity a capability was granted to. ANVIL section 5.2\n\n/// requires this binding.\n\npub sub: OasDid,\n/// Issuer - who issued this token\n\npub iss: String,\n/// Audience - intended recipient/service\n\npub aud: String,\n/// Issued at timestamp\n\npub iat: chrono::DateTime,\n/// Not before timestamp\n\npub nbf: chrono::DateTime,\n/// Expiration timestamp\n\npub exp: chrono::DateTime,\n/// Tenant ID\n\npub tenant_id: TenantId,\n/// Granted scopes\n\npub scope: ScopeSet,\n/// Binding constraints\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub constraints: Option,\n/// Rate limits\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub limits: Option,\n/// Usage budget\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub budget: Option,\n/// Delegation constraints (if this token can be delegated)\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub delegation: Option,\n/// Trace information\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub trace: Option,\n/// Proof-of-possession key fingerprint\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub cnf: Option,\n/// Delegated credential variables accessible via proxy (DCT extension)\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub delegated_variables: Option>,\n/// Maximum delegation depth for credential tokens (DCT extension)\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub max_delegation_depth: Option\n}", "docs": "Token claims - the payload of an ACT", "attributes": "#[derive(Clone, Serialize, Deserialize)]", "line": 319 }, { "name": "token::TokenClaims::builder", "kind": "function_item", "signature": "pub fn builder() -> TokenClaimsBuilder;", "docs": "Create a new token claims builder", "attributes": "#[must_use]", "line": 371 }, { "name": "token::TokenClaimsBuilder", "kind": "struct_item", "signature": "pub struct TokenClaimsBuilder {\n\n}", "docs": "Builder for token claims", "attributes": "#[derive(Debug)]", "line": 390 }, { "name": "token::TokenClaimsBuilder::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Create a new builder", "attributes": "#[must_use]", "line": 410 }, { "name": "token::TokenClaimsBuilder::subject", "kind": "function_item", "signature": "pub fn subject(mut self, sub: OasDid) -> Self;", "docs": "Set the subject - the agent's OAS DID", "attributes": "#[must_use]", "line": 431 }, { "name": "token::TokenClaimsBuilder::issuer", "kind": "function_item", "signature": "pub fn issuer(mut self, iss: impl Into) -> Self;", "docs": "Set the issuer", "attributes": "#[must_use]", "line": 438 }, { "name": "token::TokenClaimsBuilder::audience", "kind": "function_item", "signature": "pub fn audience(mut self, aud: impl Into) -> Self;", "docs": "Set the audience", "attributes": "#[must_use]", "line": 445 }, { "name": "token::TokenClaimsBuilder::tenant", "kind": "function_item", "signature": "pub fn tenant(mut self, tenant_id: TenantId) -> Self;", "docs": "Set the tenant ID", "attributes": "#[must_use]", "line": 452 }, { "name": "token::TokenClaimsBuilder::scopes", "kind": "function_item", "signature": "pub fn scopes(mut self, scope: ScopeSet) -> Self;", "docs": "Set the scopes", "attributes": "#[must_use]", "line": 459 }, { "name": "token::TokenClaimsBuilder::ttl_seconds", "kind": "function_item", "signature": "pub fn ttl_seconds(mut self, ttl: i64) -> Self;", "docs": "Set the TTL in seconds", "attributes": "#[must_use]", "line": 466 }, { "name": "token::TokenClaimsBuilder::constraints", "kind": "function_item", "signature": "pub fn constraints(mut self, constraints: Constraints) -> Self;", "docs": "Set constraints", "attributes": "#[must_use]", "line": 473 }, { "name": "token::TokenClaimsBuilder::limits", "kind": "function_item", "signature": "pub fn limits(mut self, limits: RateLimits) -> Self;", "docs": "Set rate limits", "attributes": "#[must_use]", "line": 480 }, { "name": "token::TokenClaimsBuilder::budget", "kind": "function_item", "signature": "pub fn budget(mut self, budget: UsageBudget) -> Self;", "docs": "Set usage budget", "attributes": "#[must_use]", "line": 487 }, { "name": "token::TokenClaimsBuilder::delegation", "kind": "function_item", "signature": "pub fn delegation(mut self, delegation: DelegationConstraints) -> Self;", "docs": "Set delegation constraints", "attributes": "#[must_use]", "line": 494 }, { "name": "token::TokenClaimsBuilder::parent_token", "kind": "function_item", "signature": "pub fn parent_token(mut self, parent_id: TokenId) -> Self;", "docs": "Set parent token ID (for delegation chain)", "attributes": "#[must_use]", "line": 501 }, { "name": "token::TokenClaimsBuilder::proof_of_possession", "kind": "function_item", "signature": "pub fn proof_of_possession(mut self, cnf: ProofOfPossession) -> Self;", "docs": "Set proof-of-possession key", "attributes": "#[must_use]", "line": 508 }, { "name": "token::TokenClaimsBuilder::delegated_variables", "kind": "function_item", "signature": "pub fn delegated_variables(mut self, vars: Vec) -> Self;", "docs": "Set delegated credential variables accessible via proxy", "attributes": "#[must_use]", "line": 515 }, { "name": "token::TokenClaimsBuilder::max_delegation_depth", "kind": "function_item", "signature": "pub fn max_delegation_depth(mut self, depth: u8) -> Self;", "docs": "Set maximum delegation depth for credential tokens", "attributes": "#[must_use]", "line": 522 }, { "name": "token::TokenClaimsBuilder::build", "kind": "function_item", "signature": "pub fn build(self) -> ArsenalResult;", "docs": "Build the token claims\n\n# Errors\nReturns an error if required fields are missing", "attributes": "", "line": 531 }, { "name": "token::TokenTrace", "kind": "struct_item", "signature": "pub struct TokenTrace {\n/// Unique issuance ID\n\npub issuance_id: Uuid,\n/// Parent token ID (if delegated)\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub parent_token_id: Option,\n/// Policy ID that authorized this token\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub policy_id: Option,\n/// Delegation depth (0 = original token)\n\npub delegation_depth: u8\n}", "docs": "Token trace information for audit trail", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 599 }, { "name": "token::ProofOfPossession", "kind": "struct_item", "signature": "pub struct ProofOfPossession {\n/// Key fingerprint for `PoP` verification\n\npub key_fingerprint: KeyFingerprint,\n/// Algorithm used for `PoP` (e.g., \"Ed25519\")\n\npub alg: String\n}", "docs": "Proof-of-possession confirmation", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 614 }, { "name": "token::ProofOfPossession::ed25519", "kind": "function_item", "signature": "pub fn ed25519(key_fingerprint: KeyFingerprint) -> Self;", "docs": "Create a new `PoP` confirmation with Ed25519", "attributes": "#[must_use]", "line": 624 }, { "name": "token::TokenSignature", "kind": "struct_item", "signature": "pub struct TokenSignature {\n\n}", "docs": "Token signature", "attributes": "#[derive(Clone, Serialize, Deserialize)]", "line": 634 }, { "name": "token::TokenSignature::new", "kind": "function_item", "signature": "pub fn new(bytes: Vec, algorithm: SignatureAlgorithm) -> Self;", "docs": "Create a new signature", "attributes": "#[must_use]", "line": 646 }, { "name": "token::TokenSignature::with_key_id", "kind": "function_item", "signature": "pub fn with_key_id(mut self, key_id: impl Into) -> Self;", "docs": "Set the key ID", "attributes": "#[must_use]", "line": 656 }, { "name": "token::TokenSignature::bytes", "kind": "function_item", "signature": "pub fn bytes(&self) -> &[u8];", "docs": "Get the signature bytes", "attributes": "#[must_use]", "line": 663 }, { "name": "token::TokenSignature::algorithm", "kind": "function_item", "signature": "pub const fn algorithm(&self) -> &SignatureAlgorithm;", "docs": "Get the algorithm", "attributes": "#[must_use]", "line": 669 }, { "name": "token::TokenSignature::key_id", "kind": "function_item", "signature": "pub fn key_id(&self) -> Option<&str>;", "docs": "Get the key ID", "attributes": "#[must_use]", "line": 675 }, { "name": "token::SignatureAlgorithm", "kind": "enum_item", "signature": "pub enum SignatureAlgorithm {\n /// Ed25519 signature\n Ed25519,\n /// ECDSA with P-256\n Es256,\n /// ECDSA with P-384\n Es384,\n}", "docs": "Signature algorithms supported", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"UPPERCASE\")]", "line": 693 }, { "name": "token::SignatureAlgorithm::signature_length", "kind": "function_item", "signature": "pub const fn signature_length(&self) -> usize;", "docs": "Get the expected signature length", "attributes": "#[must_use]", "line": 705 } ], "parseErrors": false } ] }, { "name": "arsenal-crypto", "url": "/reference/rust/arsenal-crypto", "modules": [ { "module": "crate", "source": "arsenal/crates/arsenal-crypto/src/lib.rs", "sha256": "3322fef81a38819ff0ab7b16d77ee2e93ec14425629eb7719b351f5300c0133c", "attributes": "", "items": [ { "name": "encryption", "kind": "module", "signature": "pub mod encryption;", "docs": "", "attributes": "", "line": 23 }, { "name": "envelope", "kind": "module", "signature": "pub mod envelope;", "docs": "", "attributes": "", "line": 24 }, { "name": "hash", "kind": "module", "signature": "pub mod hash;", "docs": "", "attributes": "", "line": 25 }, { "name": "kdf", "kind": "module", "signature": "pub mod kdf;", "docs": "", "attributes": "", "line": 26 }, { "name": "keys", "kind": "module", "signature": "pub mod keys;", "docs": "", "attributes": "", "line": 27 }, { "name": "random", "kind": "module", "signature": "pub mod random;", "docs": "", "attributes": "", "line": 28 }, { "name": "signing", "kind": "module", "signature": "pub mod signing;", "docs": "", "attributes": "", "line": 29 }, { "name": "token_signer", "kind": "module", "signature": "pub mod token_signer;", "docs": "", "attributes": "", "line": 30 }, { "name": "pub use encryption::{Decryptor, EncryptedData, Encryptor};", "kind": "use_declaration", "signature": "pub use encryption::{Decryptor, EncryptedData, Encryptor};", "docs": "", "attributes": "", "line": 32 }, { "name": "pub use envelope::{EnvelopeEncryption, WrappedKey};", "kind": "use_declaration", "signature": "pub use envelope::{EnvelopeEncryption, WrappedKey};", "docs": "", "attributes": "", "line": 33 }, { "name": "pub use hash::{Hash, Hasher};", "kind": "use_declaration", "signature": "pub use hash::{Hash, Hasher};", "docs": "", "attributes": "", "line": 34 }, { "name": "pub use kdf::{DerivedKey, KeyDerivation};", "kind": "use_declaration", "signature": "pub use kdf::{DerivedKey, KeyDerivation};", "docs": "", "attributes": "", "line": 35 }, { "name": "pub use keys::{EncryptionKeyPair, KeyId, SigningKeyPair};", "kind": "use_declaration", "signature": "pub use keys::{EncryptionKeyPair, KeyId, SigningKeyPair};", "docs": "", "attributes": "", "line": 36 }, { "name": "pub use signing::{Signature, Signer, Verifier};", "kind": "use_declaration", "signature": "pub use signing::{Signature, Signer, Verifier};", "docs": "", "attributes": "", "line": 37 }, { "name": "pub use token_signer::{TokenSigner, TokenVerifier};", "kind": "use_declaration", "signature": "pub use token_signer::{TokenSigner, TokenVerifier};", "docs": "", "attributes": "", "line": 38 }, { "name": "prelude", "kind": "module", "signature": "pub mod prelude;", "docs": "Re-export common types", "attributes": "", "line": 41 }, { "name": "pub use super::encryption::{Decryptor, Encryptor};", "kind": "use_declaration", "signature": "pub use super::encryption::{Decryptor, Encryptor};", "docs": "", "attributes": "", "line": 42 }, { "name": "pub use super::keys::{EncryptionKeyPair, SigningKeyPair};", "kind": "use_declaration", "signature": "pub use super::keys::{EncryptionKeyPair, SigningKeyPair};", "docs": "", "attributes": "", "line": 43 }, { "name": "pub use super::signing::{Signature, Signer, Verifier};", "kind": "use_declaration", "signature": "pub use super::signing::{Signature, Signer, Verifier};", "docs": "", "attributes": "", "line": 44 }, { "name": "pub use super::token_signer::{TokenSigner, TokenVerifier};", "kind": "use_declaration", "signature": "pub use super::token_signer::{TokenSigner, TokenVerifier};", "docs": "", "attributes": "", "line": 45 } ], "parseErrors": false }, { "module": "encryption", "source": "arsenal/crates/arsenal-crypto/src/encryption.rs", "sha256": "0ca517f8ed5758f6c0c4a05cd1e1985c6bebb9c0b52e0135b665d3b8f3e8ecf9", "attributes": "", "items": [ { "name": "encryption::EncryptionAlgorithm", "kind": "enum_item", "signature": "pub enum EncryptionAlgorithm {\n /// XChaCha20-Poly1305 (recommended)\n XChaCha20Poly1305,\n /// AES-256-GCM\n Aes256Gcm,\n}", "docs": "Encryption algorithm", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"SCREAMING_SNAKE_CASE\")]", "line": 20 }, { "name": "encryption::EncryptionAlgorithm::nonce_size", "kind": "function_item", "signature": "pub const fn nonce_size(&self) -> usize;", "docs": "Get the nonce size for this algorithm", "attributes": "#[must_use]", "line": 30 }, { "name": "encryption::EncryptionAlgorithm::key_size", "kind": "function_item", "signature": "pub const fn key_size(&self) -> usize;", "docs": "Get the key size for this algorithm", "attributes": "#[must_use]", "line": 39 }, { "name": "encryption::EncryptionAlgorithm::tag_size", "kind": "function_item", "signature": "pub const fn tag_size(&self) -> usize;", "docs": "Get the auth tag size", "attributes": "#[must_use]", "line": 45 }, { "name": "encryption::EncryptedData", "kind": "struct_item", "signature": "pub struct EncryptedData {\n\n}", "docs": "Encrypted data container", "attributes": "#[derive(Clone, Serialize, Deserialize)]", "line": 52 }, { "name": "encryption::EncryptedData::ciphertext", "kind": "function_item", "signature": "pub fn ciphertext(&self) -> &[u8];", "docs": "Get the ciphertext", "attributes": "#[must_use]", "line": 67 }, { "name": "encryption::EncryptedData::nonce", "kind": "function_item", "signature": "pub fn nonce(&self) -> &[u8];", "docs": "Get the nonce", "attributes": "#[must_use]", "line": 73 }, { "name": "encryption::EncryptedData::algorithm", "kind": "function_item", "signature": "pub fn algorithm(&self) -> EncryptionAlgorithm;", "docs": "Get the algorithm", "attributes": "#[must_use]", "line": 79 }, { "name": "encryption::EncryptedData::total_size", "kind": "function_item", "signature": "pub fn total_size(&self) -> usize;", "docs": "Get the total size (ciphertext + nonce + overhead)", "attributes": "#[must_use]", "line": 85 }, { "name": "encryption::EncryptedData::to_bytes", "kind": "function_item", "signature": "pub fn to_bytes(&self) -> Vec;", "docs": "Serialize to bytes (nonce || ciphertext)", "attributes": "#[must_use]", "line": 91 }, { "name": "encryption::EncryptedData::from_bytes", "kind": "function_item", "signature": "pub fn from_bytes(bytes: &[u8], algorithm: EncryptionAlgorithm) -> ArsenalResult;", "docs": "Deserialize from bytes\n\n# Errors\nReturns an error if the data is malformed", "attributes": "", "line": 102 }, { "name": "encryption::SymmetricKey", "kind": "struct_item", "signature": "pub struct SymmetricKey {\n\n}", "docs": "Symmetric encryption key (zeroized on drop)", "attributes": "#[derive(Clone)]", "line": 132 }, { "name": "encryption::SymmetricKey::new", "kind": "function_item", "signature": "pub fn new(bytes: [u8; 32], algorithm: EncryptionAlgorithm) -> Self;", "docs": "Create a new key from bytes", "attributes": "#[must_use]", "line": 153 }, { "name": "encryption::SymmetricKey::generate", "kind": "function_item", "signature": "pub fn generate(algorithm: EncryptionAlgorithm) -> ArsenalResult;", "docs": "Generate a new random key\n\n# Errors\nReturns an error if random generation fails", "attributes": "", "line": 161 }, { "name": "encryption::SymmetricKey::as_bytes", "kind": "function_item", "signature": "pub fn as_bytes(&self) -> &[u8; 32];", "docs": "Get the key bytes (use carefully)", "attributes": "#[must_use]", "line": 168 }, { "name": "encryption::SymmetricKey::algorithm", "kind": "function_item", "signature": "pub fn algorithm(&self) -> EncryptionAlgorithm;", "docs": "Get the algorithm", "attributes": "#[must_use]", "line": 174 }, { "name": "encryption::Encryptor", "kind": "trait_item", "signature": "pub trait Encryptor {\n /// Encrypt data\n ///\n /// # Errors\n /// Returns an error if encryption fails\n fn encrypt(&self, plaintext: &[u8]) -> ArsenalResult;\n\n /// Encrypt data with associated data (AEAD)\n ///\n /// # Errors\n /// Returns an error if encryption fails\n fn encrypt_with_aad(&self, plaintext: &[u8], aad: &[u8]) -> ArsenalResult;\n}", "docs": "Trait for encryption operations", "attributes": "", "line": 189 }, { "name": "encryption::Decryptor", "kind": "trait_item", "signature": "pub trait Decryptor {\n /// Decrypt data\n ///\n /// # Errors\n /// Returns an error if decryption fails\n fn decrypt(&self, encrypted: &EncryptedData) -> ArsenalResult>;\n\n /// Decrypt data with associated data verification\n ///\n /// # Errors\n /// Returns an error if decryption fails or AAD doesn't match\n fn decrypt_with_aad(&self, encrypted: &EncryptedData, aad: &[u8]) -> ArsenalResult>;\n}", "docs": "Trait for decryption operations", "attributes": "", "line": 204 } ], "parseErrors": false }, { "module": "envelope", "source": "arsenal/crates/arsenal-crypto/src/envelope.rs", "sha256": "2ba8cd6bce3f4c7a97f86fab89bb693cfde4907fb8e79f3e3c7f664161551604", "attributes": "", "items": [ { "name": "envelope::WrappedKey", "kind": "struct_item", "signature": "pub struct WrappedKey {\n/// The encrypted DEK\n\npub encrypted_dek: EncryptedData,\n/// Identifier of the KEK used\n\npub kek_id: String,\n/// Algorithm used for the DEK\n\npub dek_algorithm: EncryptionAlgorithm,\n/// When this wrapped key was created\n\npub created_at: chrono::DateTime,\n/// When this wrapped key expires\n\npub expires_at: chrono::DateTime\n}", "docs": "A wrapped key (DEK encrypted with KEK)", "attributes": "#[derive(Clone, Serialize, Deserialize)]", "line": 44 }, { "name": "envelope::WrappedKey::is_expired", "kind": "function_item", "signature": "pub fn is_expired(&self) -> bool;", "docs": "Check if this wrapped key has expired", "attributes": "#[must_use]", "line": 60 }, { "name": "envelope::EnvelopeEncryption", "kind": "struct_item", "signature": "pub struct EnvelopeEncryption {\n\n}", "docs": "Envelope encryption for protecting secrets", "attributes": "", "line": 76 }, { "name": "envelope::EnvelopeEncryption::new", "kind": "function_item", "signature": "pub fn new(kek: SymmetricKey, kek_id: impl Into) -> Self;", "docs": "Create a new envelope encryption instance", "attributes": "#[must_use]", "line": 88 }, { "name": "envelope::EnvelopeEncryption::with_ttl", "kind": "function_item", "signature": "pub fn with_ttl(mut self, ttl_seconds: i64) -> Self;", "docs": "Create with a specific TTL", "attributes": "#[must_use]", "line": 98 }, { "name": "envelope::EnvelopeEncryption::kek_id", "kind": "function_item", "signature": "pub fn kek_id(&self) -> &str;", "docs": "Get the KEK ID", "attributes": "#[must_use]", "line": 105 }, { "name": "envelope::EnvelopeEncryption::encrypt", "kind": "function_item", "signature": "pub fn encrypt(&self, plaintext: &[u8]) -> ArsenalResult;", "docs": "Encrypt data using envelope encryption\n\n# Errors\nReturns an error if encryption fails", "attributes": "", "line": 113 }, { "name": "envelope::EnvelopeEncryption::encrypt_with_aad", "kind": "function_item", "signature": "pub fn encrypt_with_aad(\n &self,\n plaintext: &[u8],\n aad: &[u8],\n ) -> ArsenalResult;", "docs": "Encrypt data with associated data (AEAD)\n\n# Errors\nReturns an error if encryption fails", "attributes": "", "line": 134 }, { "name": "envelope::EnvelopeEncryption::decrypt", "kind": "function_item", "signature": "pub fn decrypt(&self, envelope: &EnvelopeEncryptedData) -> ArsenalResult>;", "docs": "Decrypt envelope-encrypted data\n\n# Errors\nReturns an error if decryption fails", "attributes": "", "line": 155 }, { "name": "envelope::EnvelopeEncryption::decrypt_with_aad", "kind": "function_item", "signature": "pub fn decrypt_with_aad(\n &self,\n envelope: &EnvelopeEncryptedData,\n aad: &[u8],\n ) -> ArsenalResult>;", "docs": "Decrypt with associated data verification\n\n# Errors\nReturns an error if decryption fails or AAD doesn't match", "attributes": "", "line": 176 }, { "name": "envelope::EnvelopeEncryption::rewrap_key", "kind": "function_item", "signature": "pub fn rewrap_key(\n &self,\n wrapped: &WrappedKey,\n new_kek: &EnvelopeEncryption,\n ) -> ArsenalResult;", "docs": "Re-wrap a key with a new KEK (for key rotation)\n\n# Errors\nReturns an error if re-wrapping fails", "attributes": "", "line": 236 }, { "name": "envelope::EnvelopeEncryptedData", "kind": "struct_item", "signature": "pub struct EnvelopeEncryptedData {\n/// The wrapped DEK\n\npub wrapped_key: WrappedKey,\n/// The encrypted data\n\npub encrypted_data: EncryptedData\n}", "docs": "Data encrypted using envelope encryption", "attributes": "#[derive(Clone, Serialize, Deserialize)]", "line": 257 }, { "name": "envelope::SessionSecretWrapper", "kind": "struct_item", "signature": "pub struct SessionSecretWrapper {\n\n}", "docs": "Session-bound secret wrapping\n\nWraps secrets for delivery to a specific session, ensuring the secret\ncan only be unwrapped within that session.", "attributes": "", "line": 277 }, { "name": "envelope::SessionSecretWrapper::new", "kind": "function_item", "signature": "pub fn new(session_secret: &[u8; 32], session_id: impl Into + Clone) -> Self;", "docs": "Create a new session secret wrapper", "attributes": "#[must_use]", "line": 287 }, { "name": "envelope::SessionSecretWrapper::wrap", "kind": "function_item", "signature": "pub fn wrap(&self, secret: &[u8], ttl_seconds: i64) -> ArsenalResult;", "docs": "Wrap a secret for this session\n\n# Errors\nReturns an error if wrapping fails", "attributes": "", "line": 302 }, { "name": "envelope::SessionSecretWrapper::unwrap", "kind": "function_item", "signature": "pub fn unwrap(&self, wrapped: &SessionWrappedSecret) -> ArsenalResult>;", "docs": "Unwrap a secret\n\n# Errors\nReturns an error if unwrapping fails", "attributes": "", "line": 322 }, { "name": "envelope::SessionWrappedSecret", "kind": "struct_item", "signature": "pub struct SessionWrappedSecret {\n\n}", "docs": "A secret wrapped for a specific session", "attributes": "#[derive(Clone, Serialize, Deserialize)]", "line": 361 }, { "name": "envelope::SessionWrappedSecret::is_expired", "kind": "function_item", "signature": "pub fn is_expired(&self) -> bool;", "docs": "Check if expired", "attributes": "#[must_use]", "line": 375 }, { "name": "envelope::SessionWrappedSecret::session_id", "kind": "function_item", "signature": "pub fn session_id(&self) -> &str;", "docs": "Get the session ID", "attributes": "#[must_use]", "line": 381 }, { "name": "envelope::HybridEncryption", "kind": "struct_item", "signature": "pub struct HybridEncryption;", "docs": "Hybrid encryption using X25519 + XChaCha20-Poly1305\n\nUsed for encrypting data to a recipient's public key.", "attributes": "", "line": 398 }, { "name": "envelope::HybridEncryption::encrypt_to", "kind": "function_item", "signature": "pub fn encrypt_to(\n recipient_public_key: &[u8; 32],\n plaintext: &[u8],\n ) -> ArsenalResult;", "docs": "Encrypt data to a recipient's public key\n\n# Errors\nReturns an error if encryption fails", "attributes": "", "line": 405 }, { "name": "envelope::HybridEncryption::decrypt_with", "kind": "function_item", "signature": "pub fn decrypt_with(\n recipient_key_pair: &EncryptionKeyPair,\n encrypted: &HybridEncryptedData,\n ) -> ArsenalResult>;", "docs": "Decrypt data using recipient's private key\n\n# Errors\nReturns an error if decryption fails", "attributes": "", "line": 433 }, { "name": "envelope::HybridEncryptedData", "kind": "struct_item", "signature": "pub struct HybridEncryptedData {\n/// Ephemeral public key\n\npub ephemeral_public_key: [u8; 32],\n/// The encrypted data\n\npub encrypted: EncryptedData\n}", "docs": "Data encrypted using hybrid encryption", "attributes": "#[derive(Clone, Serialize, Deserialize)]", "line": 453 } ], "parseErrors": false }, { "module": "hash", "source": "arsenal/crates/arsenal-crypto/src/hash.rs", "sha256": "9621f169b03ad4b071e4f054751737da83041277e4cf08f8c2ce264cbc103db1", "attributes": "", "items": [ { "name": "hash::Hash", "kind": "struct_item", "signature": "pub struct Hash([u8; 32]);", "docs": "A 32-byte hash output", "attributes": "#[derive(Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]", "line": 16 }, { "name": "hash::Hash::from_bytes", "kind": "function_item", "signature": "pub const fn from_bytes(bytes: [u8; 32]) -> Self;", "docs": "Create a hash from raw bytes", "attributes": "#[must_use]", "line": 21 }, { "name": "hash::Hash::digest", "kind": "function_item", "signature": "pub fn digest(data: &[u8]) -> Self;", "docs": "Hash some data", "attributes": "#[must_use]", "line": 27 }, { "name": "hash::Hash::digest_many", "kind": "function_item", "signature": "pub fn digest_many(parts: &[&[u8]]) -> Self;", "docs": "Hash multiple pieces of data", "attributes": "#[must_use]", "line": 33 }, { "name": "hash::Hash::keyed", "kind": "function_item", "signature": "pub fn keyed(key: &[u8; 32], data: &[u8]) -> Self;", "docs": "Create a keyed hash (MAC)", "attributes": "#[must_use]", "line": 43 }, { "name": "hash::Hash::as_bytes", "kind": "function_item", "signature": "pub const fn as_bytes(&self) -> &[u8; 32];", "docs": "Get the raw bytes", "attributes": "#[must_use]", "line": 49 }, { "name": "hash::Hash::to_hex", "kind": "function_item", "signature": "pub fn to_hex(&self) -> String;", "docs": "Convert to hex string", "attributes": "#[must_use]", "line": 55 }, { "name": "hash::Hash::from_hex", "kind": "function_item", "signature": "pub fn from_hex(hex_str: &str) -> ArsenalResult;", "docs": "Parse from hex string\n\n# Errors\nReturns an error if the hex string is invalid", "attributes": "", "line": 63 }, { "name": "hash::Hash::ct_eq", "kind": "function_item", "signature": "pub fn ct_eq(&self, other: &Self) -> bool;", "docs": "Constant-time comparison", "attributes": "#[must_use]", "line": 76 }, { "name": "hash::Hash::verify_keyed", "kind": "function_item", "signature": "pub fn verify_keyed(key: &[u8; 32], data: &[u8], expected: &Self) -> bool;", "docs": "Verify a keyed hash", "attributes": "#[must_use]", "line": 86 }, { "name": "hash::Hasher", "kind": "struct_item", "signature": "pub struct Hasher {\n\n}", "docs": "Incremental hasher for large data", "attributes": "", "line": 111 }, { "name": "hash::Hasher::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Create a new hasher", "attributes": "#[must_use]", "line": 118 }, { "name": "hash::Hasher::new_keyed", "kind": "function_item", "signature": "pub fn new_keyed(key: &[u8; 32]) -> Self;", "docs": "Create a keyed hasher", "attributes": "#[must_use]", "line": 126 }, { "name": "hash::Hasher::new_derive_key", "kind": "function_item", "signature": "pub fn new_derive_key(context: &str) -> Self;", "docs": "Create a hasher for key derivation", "attributes": "#[must_use]", "line": 134 }, { "name": "hash::Hasher::update", "kind": "function_item", "signature": "pub fn update(&mut self, data: &[u8]) -> &mut Self;", "docs": "Update the hasher with more data", "attributes": "", "line": 141 }, { "name": "hash::Hasher::finalize", "kind": "function_item", "signature": "pub fn finalize(self) -> Hash;", "docs": "Finalize and get the hash", "attributes": "#[must_use]", "line": 148 }, { "name": "hash::Hasher::finalize_xof", "kind": "function_item", "signature": "pub fn finalize_xof(self, output: &mut [u8]);", "docs": "Finalize with extended output", "attributes": "", "line": 153 }, { "name": "hash::Hasher::reset", "kind": "function_item", "signature": "pub fn reset(&mut self);", "docs": "Reset the hasher for reuse", "attributes": "", "line": 159 }, { "name": "hash::HashChain", "kind": "struct_item", "signature": "pub struct HashChain {\n\n}", "docs": "Hash chain for audit log integrity", "attributes": "#[derive(Debug, Clone)]", "line": 178 }, { "name": "hash::HashChain::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Create a new hash chain with a genesis hash", "attributes": "#[must_use]", "line": 188 }, { "name": "hash::HashChain::from_head", "kind": "function_item", "signature": "pub fn from_head(head: Hash, count: u64) -> Self;", "docs": "Create from an existing head hash", "attributes": "#[must_use]", "line": 199 }, { "name": "hash::HashChain::append", "kind": "function_item", "signature": "pub fn append(&mut self, data: &[u8]) -> Hash;", "docs": "Add an entry to the chain", "attributes": "", "line": 204 }, { "name": "hash::HashChain::head", "kind": "function_item", "signature": "pub fn head(&self) -> &Hash;", "docs": "Get the current head hash", "attributes": "#[must_use]", "line": 216 }, { "name": "hash::HashChain::count", "kind": "function_item", "signature": "pub fn count(&self) -> u64;", "docs": "Get the entry count", "attributes": "#[must_use]", "line": 222 }, { "name": "hash::HashChain::verify_sequence", "kind": "function_item", "signature": "pub fn verify_sequence(entries: &[&[u8]], expected_head: &Hash) -> bool;", "docs": "Verify that a sequence of entries produces the expected head", "attributes": "#[must_use]", "line": 228 }, { "name": "hash::MerkleTree", "kind": "struct_item", "signature": "pub struct MerkleTree {\n\n}", "docs": "Merkle tree for efficient verification of large datasets", "attributes": "#[derive(Debug, Clone)]", "line": 245 }, { "name": "hash::MerkleTree::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Create a new empty Merkle tree", "attributes": "#[must_use]", "line": 257 }, { "name": "hash::MerkleTree::from_leaves", "kind": "function_item", "signature": "pub fn from_leaves(leaf_data: &[&[u8]]) -> Self;", "docs": "Build a Merkle tree from leaf data", "attributes": "#[must_use]", "line": 267 }, { "name": "hash::MerkleTree::add_leaf", "kind": "function_item", "signature": "pub fn add_leaf(&mut self, data: &[u8]);", "docs": "Add a leaf to the tree", "attributes": "", "line": 277 }, { "name": "hash::MerkleTree::compute_root", "kind": "function_item", "signature": "pub fn compute_root(&mut self) -> Option;", "docs": "Compute the root hash", "attributes": "", "line": 283 }, { "name": "hash::MerkleTree::root", "kind": "function_item", "signature": "pub fn root(&self) -> Option<&Hash>;", "docs": "Get the root hash", "attributes": "#[must_use]", "line": 316 }, { "name": "hash::MerkleTree::len", "kind": "function_item", "signature": "pub fn len(&self) -> usize;", "docs": "Get the number of leaves", "attributes": "#[must_use]", "line": 322 }, { "name": "hash::MerkleTree::is_empty", "kind": "function_item", "signature": "pub fn is_empty(&self) -> bool;", "docs": "Check if the tree is empty", "attributes": "#[must_use]", "line": 328 }, { "name": "hash::fingerprint_init", "kind": "function_item", "signature": "pub fn fingerprint_init(\n agent_did: &str,\n timestamp: &chrono::DateTime,\n nonce: &[u8; 32],\n) -> [u8; 32];", "docs": "Initialize a fingerprint hash chain state.\n\nComputes: `BLAKE3(\"arsenal.fingerprint.init\" || agent_did || timestamp || nonce)`\n\nThis is the server-side computation that matches\n[`arsenal_core::fingerprint::FingerprintState::init`].", "attributes": "#[must_use]", "line": 348 }, { "name": "hash::fingerprint_advance", "kind": "function_item", "signature": "pub fn fingerprint_advance(\n current_state: &[u8; 32],\n request_id: &uuid::Uuid,\n timestamp: &chrono::DateTime,\n) -> [u8; 32];", "docs": "Advance a fingerprint hash chain by one step.\n\nComputes: `BLAKE3(\"arsenal.fingerprint.advance\" || state_n || request_id || timestamp)`", "attributes": "#[must_use]", "line": 365 }, { "name": "hash::fingerprint_hash", "kind": "function_item", "signature": "pub fn fingerprint_hash(state: &[u8; 32]) -> [u8; 32];", "docs": "Compute the fingerprint to send as a header from the chain state.\n\nThe fingerprint is `BLAKE3(state_n)` \u2014 the raw state is never transmitted,\nonly its hash. This prevents state reconstruction if the fingerprint header\nis intercepted.", "attributes": "#[must_use]", "line": 384 } ], "parseErrors": false }, { "module": "kdf", "source": "arsenal/crates/arsenal-crypto/src/kdf.rs", "sha256": "f900fbc6fdc13ce45694fea8fe5b1f2c5192433e7e3a9b471f0f92e226a66b34", "attributes": "", "items": [ { "name": "kdf::DerivedKey", "kind": "struct_item", "signature": "pub struct DerivedKey {\n\n}", "docs": "A derived key (zeroized on drop)", "attributes": "#[derive(Clone, Zeroize, ZeroizeOnDrop)]", "line": 16 }, { "name": "kdf::DerivedKey::from_bytes", "kind": "function_item", "signature": "pub fn from_bytes(bytes: Vec) -> Self;", "docs": "Create from bytes", "attributes": "#[must_use]", "line": 23 }, { "name": "kdf::DerivedKey::as_bytes", "kind": "function_item", "signature": "pub fn as_bytes(&self) -> &[u8];", "docs": "Get the key bytes", "attributes": "#[must_use]", "line": 29 }, { "name": "kdf::DerivedKey::as_array_32", "kind": "function_item", "signature": "pub fn as_array_32(&self) -> Option<[u8; 32]>;", "docs": "Get as fixed-size array if length matches", "attributes": "#[must_use]", "line": 35 }, { "name": "kdf::DerivedKey::len", "kind": "function_item", "signature": "pub fn len(&self) -> usize;", "docs": "Get the length", "attributes": "#[must_use]", "line": 47 }, { "name": "kdf::DerivedKey::is_empty", "kind": "function_item", "signature": "pub fn is_empty(&self) -> bool;", "docs": "Check if empty", "attributes": "#[must_use]", "line": 53 }, { "name": "kdf::KeyDerivation", "kind": "trait_item", "signature": "pub trait KeyDerivation {\n /// Derive a key the specified length\n ///\n /// # Errors\n /// Returns an error if derivation fails\n fn derive(&self, length: usize) -> ArsenalResult;\n\n /// Derive a 32-byte key\n ///\n /// # Errors\n /// Returns an error if derivation fails\n fn derive_32(&self) -> ArsenalResult<[u8; 32]> ;\n}", "docs": "Key derivation trait", "attributes": "", "line": 65 }, { "name": "kdf::HkdfDeriver", "kind": "struct_item", "signature": "pub struct HkdfDeriver {\n\n}", "docs": "HKDF key derivation", "attributes": "", "line": 88 }, { "name": "kdf::HkdfDeriver::new", "kind": "function_item", "signature": "pub fn new(ikm: &[u8], salt: Option<&[u8]>) -> Self;", "docs": "Create a new HKDF deriver from input key material", "attributes": "#[must_use]", "line": 96 }, { "name": "kdf::HkdfDeriver::from_shared_secret", "kind": "function_item", "signature": "pub fn from_shared_secret(shared_secret: &[u8], context: &str) -> Self;", "docs": "Create from ad secret (e.g., from Diffie-Hellman)", "attributes": "#[must_use]", "line": 103 }, { "name": "kdf::HkdfDeriver::derive_with_info", "kind": "function_item", "signature": "pub fn derive_with_info(&self, info: &[u8], length: usize) -> ArsenalResult;", "docs": "Derive with additional info\n\n# Errors\nReturns an error if derivation fails", "attributes": "", "line": 113 }, { "name": "kdf::Blake3Deriver", "kind": "struct_item", "signature": "pub struct Blake3Deriver {\n\n}", "docs": "BLAKE3 key derivation (faster alternative to HKDF)", "attributes": "", "line": 135 }, { "name": "kdf::Blake3Deriver::new", "kind": "function_item", "signature": "pub fn new(ikm: &[u8], context: impl Into) -> Self;", "docs": "Create a new BLAKE3 deriver", "attributes": "#[must_use]", "line": 145 }, { "name": "kdf::Blake3Deriver::derive_with_info", "kind": "function_item", "signature": "pub fn derive_with_info(&self, info: &[u8], length: usize) -> DerivedKey;", "docs": "Derive with additional info", "attributes": "#[must_use]", "line": 154 }, { "name": "kdf::Argon2Params", "kind": "struct_item", "signature": "pub struct Argon2Params {\n/// Memory cost in KiB\n\npub memory_kib: u32,\n/// Time cost (iterations)\n\npub time_cost: u32,\n/// Parallelism\n\npub parallelism: u32,\n/// Output length\n\npub output_len: usize\n}", "docs": "Argon2id parameters for password hashing", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 189 }, { "name": "kdf::Argon2Deriver", "kind": "struct_item", "signature": "pub struct Argon2Deriver {\n\n}", "docs": "Argon2id password-based key derivation", "attributes": "", "line": 213 }, { "name": "kdf::Argon2Deriver::new", "kind": "function_item", "signature": "pub fn new(params: Argon2Params) -> ArsenalResult;", "docs": "Create a new Argon2 deriver with random salt\n\n# Errors\nReturns an error if random generation fails", "attributes": "", "line": 223 }, { "name": "kdf::Argon2Deriver::with_salt", "kind": "function_item", "signature": "pub fn with_salt(params: Argon2Params, salt: [u8; 16]) -> Self;", "docs": "Create with a specific salt", "attributes": "#[must_use]", "line": 230 }, { "name": "kdf::Argon2Deriver::salt", "kind": "function_item", "signature": "pub fn salt(&self) -> &[u8; 16];", "docs": "Get the salt (needed for verification)", "attributes": "#[must_use]", "line": 236 }, { "name": "kdf::Argon2Deriver::derive_from_password", "kind": "function_item", "signature": "pub fn derive_from_password(&self, password: &[u8]) -> ArsenalResult;", "docs": "Derive a key from a password\n\n# Errors\nReturns an error if derivation fails", "attributes": "", "line": 244 }, { "name": "kdf::SessionKeyDeriver", "kind": "struct_item", "signature": "pub struct SessionKeyDeriver {\n\n}", "docs": "Session key deriver for deriving session-specific keys", "attributes": "", "line": 280 }, { "name": "kdf::SessionKeyDeriver::new", "kind": "function_item", "signature": "pub fn new(base_key: [u8; 32], session_id: impl Into) -> Self;", "docs": "Create a new session key deriver", "attributes": "#[must_use]", "line": 290 }, { "name": "kdf::SessionKeyDeriver::derive_for_purpose", "kind": "function_item", "signature": "pub fn derive_for_purpose(&self, purpose: &str) -> [u8; 32];", "docs": "Derive a key for a specific purpose", "attributes": "#[must_use]", "line": 299 }, { "name": "kdf::SessionKeyDeriver::derive_encryption_key", "kind": "function_item", "signature": "pub fn derive_encryption_key(&self) -> [u8; 32];", "docs": "Derive encryption key", "attributes": "#[must_use]", "line": 308 }, { "name": "kdf::SessionKeyDeriver::derive_mac_key", "kind": "function_item", "signature": "pub fn derive_mac_key(&self) -> [u8; 32];", "docs": "Derive MAC key", "attributes": "#[must_use]", "line": 314 }, { "name": "kdf::SessionKeyDeriver::derive_wrap_key", "kind": "function_item", "signature": "pub fn derive_wrap_key(&self) -> [u8; 32];", "docs": "Derive wrapping key", "attributes": "#[must_use]", "line": 320 } ], "parseErrors": false }, { "module": "keys", "source": "arsenal/crates/arsenal-crypto/src/keys.rs", "sha256": "87bca94390697ce74aa11e8bb88dd167369ac7e478da8c748f6295524ae8d684", "attributes": "", "items": [ { "name": "keys::KeyId", "kind": "struct_item", "signature": "pub struct KeyId(String);", "docs": "Key identifier for key management", "attributes": "#[derive(Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]", "line": 19 }, { "name": "keys::KeyId::new", "kind": "function_item", "signature": "pub fn new(id: impl Into) -> ArsenalResult;", "docs": "Create a new key ID\n\n# Errors\nReturns an error if the ID is invalid", "attributes": "", "line": 26 }, { "name": "keys::KeyId::generate", "kind": "function_item", "signature": "pub fn generate() -> Self;", "docs": "Generate a new random key ID", "attributes": "#[must_use]", "line": 36 }, { "name": "keys::KeyId::as_str", "kind": "function_item", "signature": "pub fn as_str(&self) -> &str;", "docs": "Get the inner string", "attributes": "#[must_use]", "line": 42 }, { "name": "keys::SigningKeyPair", "kind": "struct_item", "signature": "pub struct SigningKeyPair {\n\n}", "docs": "Ed25519 signing key pair", "attributes": "", "line": 60 }, { "name": "keys::SigningKeyPair::generate", "kind": "function_item", "signature": "pub fn generate() -> ArsenalResult;", "docs": "Generate a new random key pair\n\n# Errors\nReturns an error if random generation fails", "attributes": "", "line": 72 }, { "name": "keys::SigningKeyPair::from_seed", "kind": "function_item", "signature": "pub fn from_seed(seed: &[u8; 32]) -> ArsenalResult;", "docs": "Create from existing seed bytes\n\n# Errors\nReturns an error if the seed is invalid", "attributes": "", "line": 88 }, { "name": "keys::SigningKeyPair::from_seed_with_id", "kind": "function_item", "signature": "pub fn from_seed_with_id(seed: &[u8; 32], key_id: KeyId) -> ArsenalResult;", "docs": "Create from existing seed with a specific key ID\n\n# Errors\nReturns an error if the seed is invalid", "attributes": "", "line": 100 }, { "name": "keys::SigningKeyPair::verifying_key", "kind": "function_item", "signature": "pub fn verifying_key(&self) -> VerifyingKey;", "docs": "Get the public verifying key", "attributes": "#[must_use]", "line": 110 }, { "name": "keys::SigningKeyPair::public_key_bytes", "kind": "function_item", "signature": "pub fn public_key_bytes(&self) -> [u8; 32];", "docs": "Get the public key bytes", "attributes": "#[must_use]", "line": 116 }, { "name": "keys::SigningKeyPair::fingerprint", "kind": "function_item", "signature": "pub fn fingerprint(&self) -> KeyFingerprint;", "docs": "Get the key fingerprint", "attributes": "#[must_use]", "line": 122 }, { "name": "keys::SigningKeyPair::key_id", "kind": "function_item", "signature": "pub fn key_id(&self) -> &KeyId;", "docs": "Get the key ID", "attributes": "#[must_use]", "line": 128 }, { "name": "keys::SigningKeyPair::sign", "kind": "function_item", "signature": "pub fn sign(&self, message: &[u8]) -> [u8; 64];", "docs": "Sign a message", "attributes": "#[must_use]", "line": 134 }, { "name": "keys::SigningKeyPair::export_seed", "kind": "function_item", "signature": "pub fn export_seed(&self) -> [u8; 32];", "docs": "Export the seed (use with extreme caution)\n\nThis returns the private key material. Handle with care!", "attributes": "#[must_use]", "line": 143 }, { "name": "keys::PublicSigningKey", "kind": "struct_item", "signature": "pub struct PublicSigningKey {\n\n}", "docs": "Public key for signature verification", "attributes": "#[derive(Clone, Serialize, Deserialize)]", "line": 159 }, { "name": "keys::PublicSigningKey::from_bytes", "kind": "function_item", "signature": "pub fn from_bytes(bytes: [u8; 32], key_id: KeyId) -> ArsenalResult;", "docs": "Create from bytes\n\n# Errors\nReturns an error if the bytes are invalid", "attributes": "", "line": 171 }, { "name": "keys::PublicSigningKey::from_signing_key", "kind": "function_item", "signature": "pub fn from_signing_key(key_pair: &SigningKeyPair) -> Self;", "docs": "Create from a signing key pair", "attributes": "#[must_use]", "line": 180 }, { "name": "keys::PublicSigningKey::as_bytes", "kind": "function_item", "signature": "pub fn as_bytes(&self) -> &[u8; 32];", "docs": "Get the key bytes", "attributes": "#[must_use]", "line": 189 }, { "name": "keys::PublicSigningKey::key_id", "kind": "function_item", "signature": "pub fn key_id(&self) -> &KeyId;", "docs": "Get the key ID", "attributes": "#[must_use]", "line": 195 }, { "name": "keys::PublicSigningKey::fingerprint", "kind": "function_item", "signature": "pub fn fingerprint(&self) -> KeyFingerprint;", "docs": "Get the fingerprint", "attributes": "#[must_use]", "line": 201 }, { "name": "keys::PublicSigningKey::verify", "kind": "function_item", "signature": "pub fn verify(&self, message: &[u8], signature: &[u8; 64]) -> ArsenalResult<()>;", "docs": "Verify a signature\n\n# Errors\nReturns an error if verification fails", "attributes": "", "line": 209 }, { "name": "keys::EncryptionKeyPair", "kind": "struct_item", "signature": "pub struct EncryptionKeyPair {\n\n}", "docs": "X25519 key pair for key exchange and encryption", "attributes": "", "line": 233 }, { "name": "keys::EncryptionKeyPair::generate", "kind": "function_item", "signature": "pub fn generate() -> ArsenalResult;", "docs": "Generate a new random key pair\n\n# Errors\nReturns an error if random generation fails", "attributes": "", "line": 247 }, { "name": "keys::EncryptionKeyPair::from_seed", "kind": "function_item", "signature": "pub fn from_seed(seed: &[u8; 32]) -> ArsenalResult;", "docs": "Create from existing seed bytes\n\n# Errors\nReturns an error if the seed is invalid", "attributes": "", "line": 265 }, { "name": "keys::EncryptionKeyPair::public_key", "kind": "function_item", "signature": "pub fn public_key(&self) -> &X25519PublicKey;", "docs": "Get the public key", "attributes": "#[must_use]", "line": 278 }, { "name": "keys::EncryptionKeyPair::public_key_bytes", "kind": "function_item", "signature": "pub fn public_key_bytes(&self) -> [u8; 32];", "docs": "Get the public key bytes", "attributes": "#[must_use]", "line": 284 }, { "name": "keys::EncryptionKeyPair::fingerprint", "kind": "function_item", "signature": "pub fn fingerprint(&self) -> KeyFingerprint;", "docs": "Get the key fingerprint", "attributes": "#[must_use]", "line": 290 }, { "name": "keys::EncryptionKeyPair::key_id", "kind": "function_item", "signature": "pub fn key_id(&self) -> &KeyId;", "docs": "Get the key ID", "attributes": "#[must_use]", "line": 296 }, { "name": "keys::EncryptionKeyPair::diffie_hellman", "kind": "function_item", "signature": "pub fn diffie_hellman(&self, their_public: &X25519PublicKey) -> [u8; 32];", "docs": "Perform Diffie-Hellman key exchange", "attributes": "#[must_use]", "line": 302 }, { "name": "keys::EncryptionKeyPair::diffie_hellman_bytes", "kind": "function_item", "signature": "pub fn diffie_hellman_bytes(&self, their_public: &[u8; 32]) -> ArsenalResult<[u8; 32]>;", "docs": "Perform Diffie-Hellman with public key bytes\n\n# Errors\nReturns an error if the public key is invalid", "attributes": "", "line": 310 }, { "name": "keys::PublicEncryptionKey", "kind": "struct_item", "signature": "pub struct PublicEncryptionKey {\n\n}", "docs": "Public encryption key", "attributes": "#[derive(Clone, Serialize, Deserialize)]", "line": 327 }, { "name": "keys::PublicEncryptionKey::from_bytes", "kind": "function_item", "signature": "pub fn from_bytes(bytes: [u8; 32], key_id: KeyId) -> Self;", "docs": "Create from bytes", "attributes": "#[must_use]", "line": 337 }, { "name": "keys::PublicEncryptionKey::from_key_pair", "kind": "function_item", "signature": "pub fn from_key_pair(key_pair: &EncryptionKeyPair) -> Self;", "docs": "Create from an encryption key pair", "attributes": "#[must_use]", "line": 343 }, { "name": "keys::PublicEncryptionKey::as_bytes", "kind": "function_item", "signature": "pub fn as_bytes(&self) -> &[u8; 32];", "docs": "Get the key bytes", "attributes": "#[must_use]", "line": 352 }, { "name": "keys::PublicEncryptionKey::key_id", "kind": "function_item", "signature": "pub fn key_id(&self) -> &KeyId;", "docs": "Get the key ID", "attributes": "#[must_use]", "line": 358 }, { "name": "keys::PublicEncryptionKey::fingerprint", "kind": "function_item", "signature": "pub fn fingerprint(&self) -> KeyFingerprint;", "docs": "Get the fingerprint", "attributes": "#[must_use]", "line": 364 }, { "name": "keys::PublicEncryptionKey::to_x25519", "kind": "function_item", "signature": "pub fn to_x25519(&self) -> X25519PublicKey;", "docs": "Convert to X25519 public key", "attributes": "#[must_use]", "line": 370 }, { "name": "keys::KeyUsage", "kind": "enum_item", "signature": "pub enum KeyUsage {\n /// Key can be used for signing\n Sign,\n /// Key can be used for verification\n Verify,\n /// Key can be used for encryption\n Encrypt,\n /// Key can be used for decryption\n Decrypt,\n /// Key can be used for key wrapping\n WrapKey,\n /// Key can be used for key unwrapping\n UnwrapKey,\n /// Key can be used for key derivation\n DeriveKey,\n}", "docs": "Key usage restrictions", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"snake_case\")]", "line": 387 }, { "name": "keys::KeyMetadata", "kind": "struct_item", "signature": "pub struct KeyMetadata {\n/// Key ID\n\npub key_id: KeyId,\n/// Key algorithm\n\npub algorithm: KeyAlgorithm,\n/// Allowed usages\n\npub usages: Vec,\n/// When the key was created\n\npub created_at: chrono::DateTime,\n/// When the key expires (if ever)\n\npub expires_at: Option>,\n/// Whether the key is currently active\n\npub is_active: bool\n}", "docs": "Key metadata", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 406 }, { "name": "keys::KeyAlgorithm", "kind": "enum_item", "signature": "pub enum KeyAlgorithm {\n /// Ed25519 signing\n Ed25519,\n /// X25519 key exchange\n X25519,\n /// AES-256-GCM encryption\n Aes256Gcm,\n /// XChaCha20-Poly1305 encryption\n XChaCha20Poly1305,\n}", "docs": "Key algorithm", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"UPPERCASE\")]", "line": 424 } ], "parseErrors": false }, { "module": "random", "source": "arsenal/crates/arsenal-crypto/src/random.rs", "sha256": "912c264105e8593542b2c334f0efb08159e93d0491032f70319ea1fa3c53bb39", "attributes": "", "items": [ { "name": "random::fill_random", "kind": "function_item", "signature": "pub fn fill_random(buffer: &mut [u8]) -> ArsenalResult<()>;", "docs": "Fill a buffer with cryptographically secure random bytes\n\n# Errors\nReturns an error if the system random number generator fails", "attributes": "", "line": 14 }, { "name": "random::random_bytes", "kind": "function_item", "signature": "pub fn random_bytes() -> ArsenalResult<[u8; N]>;", "docs": "Generate a fixed-size array of random bytes\n\n# Errors\nReturns an error if the system random number generator fails", "attributes": "", "line": 27 }, { "name": "random::random_key_32", "kind": "function_item", "signature": "pub fn random_key_32() -> ArsenalResult<[u8; 32]>;", "docs": "Generate a random 32-byte key\n\n# Errors\nReturns an error if the system random number generator fails", "attributes": "", "line": 37 }, { "name": "random::random_nonce_12", "kind": "function_item", "signature": "pub fn random_nonce_12() -> ArsenalResult<[u8; 12]>;", "docs": "Generate a random 12-byte nonce (for AES-GCM)\n\n# Errors\nReturns an error if the system random number generator fails", "attributes": "", "line": 45 }, { "name": "random::random_nonce_24", "kind": "function_item", "signature": "pub fn random_nonce_24() -> ArsenalResult<[u8; 24]>;", "docs": "Generate a random 24-byte nonce (for XChaCha20-Poly1305)\n\n# Errors\nReturns an error if the system random number generator fails", "attributes": "", "line": 53 }, { "name": "random::SecureRandom", "kind": "struct_item", "signature": "pub struct SecureRandom {\n\n}", "docs": "Secure random bytes that are zeroized on drop", "attributes": "#[derive(Clone, Zeroize)]\n#[zeroize(drop)]", "line": 60 }, { "name": "random::SecureRandom::generate", "kind": "function_item", "signature": "pub fn generate() -> ArsenalResult;", "docs": "Generate new secure random bytes\n\n# Errors\nReturns an error if the system random number generator fails", "attributes": "", "line": 69 }, { "name": "random::SecureRandom::as_bytes", "kind": "function_item", "signature": "pub fn as_bytes(&self) -> &[u8; N];", "docs": "Get the bytes (use carefully)", "attributes": "#[must_use]", "line": 76 }, { "name": "random::SecureRandom::len", "kind": "function_item", "signature": "pub const fn len(&self) -> usize;", "docs": "Get the length", "attributes": "#[must_use]", "line": 82 }, { "name": "random::SecureRandom::is_empty", "kind": "function_item", "signature": "pub const fn is_empty(&self) -> bool;", "docs": "Check if empty (always false for N > 0)", "attributes": "#[must_use]", "line": 88 }, { "name": "random::random_u64", "kind": "function_item", "signature": "pub fn random_u64() -> ArsenalResult;", "docs": "Generate a random u64 value\n\n# Errors\nReturns an error if the system random number generator fails", "attributes": "", "line": 103 }, { "name": "random::random_u32", "kind": "function_item", "signature": "pub fn random_u32() -> ArsenalResult;", "docs": "Generate a random u32 value\n\n# Errors\nReturns an error if the system random number generator fails", "attributes": "", "line": 112 }, { "name": "random::random_range", "kind": "function_item", "signature": "pub fn random_range(max: u64) -> ArsenalResult;", "docs": "Generate a random value in the range [0, max)\n\n# Errors\nReturns an error if the system random number generator fails", "attributes": "", "line": 121 } ], "parseErrors": false }, { "module": "signing", "source": "arsenal/crates/arsenal-crypto/src/signing.rs", "sha256": "3da22c23604ef895aad9ac28d81e12413f8a25039673e5024fd2f95e6a2309cd", "attributes": "", "items": [ { "name": "signing::Signature", "kind": "struct_item", "signature": "pub struct Signature {\n\n}", "docs": "A detached Ed25519 signature", "attributes": "#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)]", "line": 15 }, { "name": "signing::signature_bytes::serialize", "kind": "function_item", "signature": "pub fn serialize(bytes: &[u8; 64], serializer: S) -> Result\n where\n S: Serializer,;", "docs": "", "attributes": "", "line": 27 }, { "name": "signing::signature_bytes::deserialize", "kind": "function_item", "signature": "pub fn deserialize<'de, D>(deserializer: D) -> Result<[u8; 64], D::Error>\n where\n D: Deserializer<'de>,;", "docs": "", "attributes": "", "line": 40 }, { "name": "signing::Signature::from_bytes", "kind": "function_item", "signature": "pub fn from_bytes(bytes: [u8; 64], key_id: KeyId) -> Self;", "docs": "Create a signature from bytes", "attributes": "#[must_use]", "line": 66 }, { "name": "signing::Signature::as_bytes", "kind": "function_item", "signature": "pub fn as_bytes(&self) -> &[u8; 64];", "docs": "Get the signature bytes", "attributes": "#[must_use]", "line": 72 }, { "name": "signing::Signature::key_id", "kind": "function_item", "signature": "pub fn key_id(&self) -> &KeyId;", "docs": "Get the key ID", "attributes": "#[must_use]", "line": 78 }, { "name": "signing::Signature::to_base64", "kind": "function_item", "signature": "pub fn to_base64(&self) -> String;", "docs": "Encode as base64", "attributes": "#[must_use]", "line": 84 }, { "name": "signing::Signature::from_base64", "kind": "function_item", "signature": "pub fn from_base64(encoded: &str, key_id: KeyId) -> ArsenalResult;", "docs": "Decode from base64\n\n# Errors\nReturns an error if decoding fails", "attributes": "", "line": 93 }, { "name": "signing::Signer", "kind": "trait_item", "signature": "pub trait Signer {\n /// Sign a message\n fn sign(&self, message: &[u8]) -> Signature;\n\n /// Get the key ID\n fn key_id(&self) -> &KeyId;\n}", "docs": "Trait for types that can sign messages", "attributes": "", "line": 122 }, { "name": "signing::Verifier", "kind": "trait_item", "signature": "pub trait Verifier {\n /// Verify a signature\n ///\n /// # Errors\n /// Returns an error if verification fails\n fn verify(&self, message: &[u8], signature: &Signature) -> ArsenalResult<()>;\n\n /// Get the key ID\n fn key_id(&self) -> &KeyId;\n}", "docs": "Trait for types that can verify signatures", "attributes": "", "line": 142 }, { "name": "signing::SignedData", "kind": "struct_item", "signature": "pub struct SignedData {\n/// The data\n\npub data: T,\n/// The signature over the serialized data\n\npub signature: Signature\n}", "docs": "Signed data container", "attributes": "#[derive(Clone, Serialize, Deserialize)]", "line": 165 }, { "name": "signing::SignedData::sign", "kind": "function_item", "signature": "pub fn sign(data: T, signer: &impl Signer) -> ArsenalResult;", "docs": "Create signed data\n\n# Errors\nReturns an error if serialization fails", "attributes": "", "line": 177 }, { "name": "signing::SignedData::verify", "kind": "function_item", "signature": "pub fn verify(&self, verifier: &impl Verifier) -> ArsenalResult<()>;", "docs": "Verify the signature\n\n# Errors\nReturns an error if verification fails", "attributes": "", "line": 189 }, { "name": "signing::MultiSignature", "kind": "struct_item", "signature": "pub struct MultiSignature {\n\n}", "docs": "Multi-signature container for threshold signing", "attributes": "#[derive(Clone, Serialize, Deserialize)]", "line": 218 }, { "name": "signing::MultiSignature::new", "kind": "function_item", "signature": "pub fn new(threshold: usize) -> Self;", "docs": "Create a new multi-signature container", "attributes": "#[must_use]", "line": 228 }, { "name": "signing::MultiSignature::add_signature", "kind": "function_item", "signature": "pub fn add_signature(&mut self, signature: Signature);", "docs": "Add a signature", "attributes": "", "line": 236 }, { "name": "signing::MultiSignature::is_complete", "kind": "function_item", "signature": "pub fn is_complete(&self) -> bool;", "docs": "Check if threshold is met", "attributes": "#[must_use]", "line": 249 }, { "name": "signing::MultiSignature::count", "kind": "function_item", "signature": "pub fn count(&self) -> usize;", "docs": "Get the number of signatures", "attributes": "#[must_use]", "line": 255 }, { "name": "signing::MultiSignature::threshold", "kind": "function_item", "signature": "pub fn threshold(&self) -> usize;", "docs": "Get the threshold", "attributes": "#[must_use]", "line": 261 }, { "name": "signing::MultiSignature::signatures", "kind": "function_item", "signature": "pub fn signatures(&self) -> &[Signature];", "docs": "Get the signatures", "attributes": "#[must_use]", "line": 267 }, { "name": "signing::MultiSignature::verify_all", "kind": "function_item", "signature": "pub fn verify_all(&self, message: &[u8], verifiers: &[&impl Verifier]) -> ArsenalResult<()>;", "docs": "Verify all signatures against a message\n\n# Errors\nReturns an error if any signature is invalid or threshold not met", "attributes": "", "line": 275 }, { "name": "signing::sign_consent_record", "kind": "function_item", "signature": "pub fn sign_consent_record(key: &SigningKeyPair, record_bytes: &[u8]) -> Signature;", "docs": "Sign a consent record's canonical bytes.\n\nThe consent record should be serialized to its canonical form\n(via [`arsenal_core::consent::ConsentRecord::signing_bytes`]) before\ncalling this function.\n\n# Errors\n\nReturns an error if signing fails.", "attributes": "#[must_use]", "line": 328 }, { "name": "signing::verify_consent_signature", "kind": "function_item", "signature": "pub fn verify_consent_signature(\n key: &PublicSigningKey,\n record_bytes: &[u8],\n signature: &Signature,\n) -> ArsenalResult;", "docs": "Verify a consent record's signature.\n\nThe consent record should be serialized to its canonical form\n(via [`arsenal_core::consent::ConsentRecord::signing_bytes`]) before\ncalling this function.\n\n# Errors\n\nReturns an error if verification fails.", "attributes": "", "line": 341 } ], "parseErrors": false }, { "module": "token_signer", "source": "arsenal/crates/arsenal-crypto/src/token_signer.rs", "sha256": "d4f36288952c34e71c4fda2e0009a691212dd6abe71f5a77eed5938fcbe90c18", "attributes": "", "items": [ { "name": "token_signer::TokenSigner", "kind": "struct_item", "signature": "pub struct TokenSigner {\n\n}", "docs": "Token signer for creating signed ACTs", "attributes": "", "line": 46 }, { "name": "token_signer::TokenSigner::new", "kind": "function_item", "signature": "pub fn new(key_pair: SigningKeyPair, issuer: impl Into) -> Self;", "docs": "Create a new token signer", "attributes": "#[must_use]", "line": 56 }, { "name": "token_signer::TokenSigner::key_id", "kind": "function_item", "signature": "pub fn key_id(&self) -> &KeyId;", "docs": "Get the key ID", "attributes": "#[must_use]", "line": 65 }, { "name": "token_signer::TokenSigner::public_key", "kind": "function_item", "signature": "pub fn public_key(&self) -> PublicSigningKey;", "docs": "Get the public key for verification", "attributes": "#[must_use]", "line": 71 }, { "name": "token_signer::TokenSigner::issuer", "kind": "function_item", "signature": "pub fn issuer(&self) -> &str;", "docs": "Get the issuer", "attributes": "#[must_use]", "line": 77 }, { "name": "token_signer::TokenSigner::sign", "kind": "function_item", "signature": "pub fn sign(&self, token: &mut AgentCapabilityToken) -> ArsenalResult<()>;", "docs": "Sign a token\n\n# Errors\nReturns an error if signing fails", "attributes": "", "line": 85 }, { "name": "token_signer::TokenSigner::sign_token", "kind": "function_item", "signature": "pub fn sign_token(\n &self,\n mut token: AgentCapabilityToken,\n ) -> ArsenalResult;", "docs": "Sign and return a new token\n\n# Errors\nReturns an error if signing fails", "attributes": "", "line": 104 }, { "name": "token_signer::TokenVerifier", "kind": "struct_item", "signature": "pub struct TokenVerifier {\n\n}", "docs": "Token verifier for validating signed ACTs", "attributes": "", "line": 123 }, { "name": "token_signer::TokenVerifier::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Create a new token verifier", "attributes": "#[must_use]", "line": 135 }, { "name": "token_signer::TokenVerifier::with_public_key", "kind": "function_item", "signature": "pub fn with_public_key(mut self, key: PublicSigningKey) -> Self;", "docs": "Add a public key for verification", "attributes": "#[must_use]", "line": 145 }, { "name": "token_signer::TokenVerifier::with_public_keys", "kind": "function_item", "signature": "pub fn with_public_keys(mut self, keys: Vec) -> Self;", "docs": "Add multiple public keys", "attributes": "#[must_use]", "line": 152 }, { "name": "token_signer::TokenVerifier::with_expected_issuers", "kind": "function_item", "signature": "pub fn with_expected_issuers(mut self, issuers: Vec) -> Self;", "docs": "Set expected issuers", "attributes": "#[must_use]", "line": 159 }, { "name": "token_signer::TokenVerifier::with_expected_audiences", "kind": "function_item", "signature": "pub fn with_expected_audiences(mut self, audiences: Vec) -> Self;", "docs": "Set expected audiences", "attributes": "#[must_use]", "line": 166 }, { "name": "token_signer::TokenVerifier::verify", "kind": "function_item", "signature": "pub fn verify(&self, token: &AgentCapabilityToken) -> ArsenalResult;", "docs": "Verify a token\n\n# Errors\nReturns an error if verification fails", "attributes": "", "line": 175 }, { "name": "token_signer::VerificationResult", "kind": "struct_item", "signature": "pub struct VerificationResult {\n/// Key ID that verified the token\n\npub verified_by: KeyId,\n/// Whether the claims are valid\n\npub claims_valid: bool\n}", "docs": "Result of token verification", "attributes": "#[derive(Debug, Clone)]", "line": 269 }, { "name": "token_signer::SignedToken", "kind": "struct_item", "signature": "pub struct SignedToken {\n/// The token in CBOR format\n\npub token_cbor: Vec,\n/// Base64-encoded signature\n\npub signature_base64: String,\n/// Key ID used for signing\n\npub key_id: String,\n/// Algorithm\n\npub algorithm: String\n}", "docs": "Signed token for transport", "attributes": "#[derive(Clone, Serialize, Deserialize)]", "line": 278 }, { "name": "token_signer::SignedToken::from_token", "kind": "function_item", "signature": "pub fn from_token(token: &AgentCapabilityToken) -> ArsenalResult;", "docs": "Create from a signed token\n\n# Errors\nReturns an error if the token is not signed", "attributes": "", "line": 294 }, { "name": "token_signer::SignedToken::to_token", "kind": "function_item", "signature": "pub fn to_token(&self) -> ArsenalResult;", "docs": "Restore the token\n\n# Errors\nReturns an error if deserialization fails", "attributes": "", "line": 316 }, { "name": "token_signer::SignedToken::to_compact", "kind": "function_item", "signature": "pub fn to_compact(&self) -> String;", "docs": "Encode as compact string (base64 CBOR)", "attributes": "#[must_use]", "line": 322 }, { "name": "token_signer::SignedToken::from_compact", "kind": "function_item", "signature": "pub fn from_compact(compact: &str) -> ArsenalResult;", "docs": "Decode from compact string\n\n# Errors\nReturns an error if decoding fails", "attributes": "", "line": 331 } ], "parseErrors": false } ] }, { "name": "arsenal-policy", "url": "/reference/rust/arsenal-policy", "modules": [ { "module": "crate", "source": "arsenal/crates/arsenal-policy/src/lib.rs", "sha256": "6c9d8fd45c446ec98067a79fe50ca4abcef78738ee12bdc12d827f20f9f44c8c", "attributes": "", "items": [ { "name": "pub use arsenal_core::policy::{\n ConditionOperator, PolicyCondition, PolicyDecision, PolicyDocument, PolicyEffect, PolicyId,\n PolicyRequest, PolicyRule,\n};", "kind": "use_declaration", "signature": "pub use arsenal_core::policy::{\n ConditionOperator, PolicyCondition, PolicyDecision, PolicyDocument, PolicyEffect, PolicyId,\n PolicyRequest, PolicyRule,\n};", "docs": "", "attributes": "", "line": 13 }, { "name": "::PolicyEngine", "kind": "struct_item", "signature": "pub struct PolicyEngine {\n\n}", "docs": "Policy engine for evaluating multiple policies", "attributes": "", "line": 19 }, { "name": "::PolicyEngine::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Create a new policy engine", "attributes": "#[must_use]", "line": 27 }, { "name": "::PolicyEngine::add_policy", "kind": "function_item", "signature": "pub fn add_policy(&mut self, policy: PolicyDocument);", "docs": "Add a policy", "attributes": "", "line": 34 }, { "name": "::PolicyEngine::remove_policy", "kind": "function_item", "signature": "pub fn remove_policy(&mut self, policy_id: &str) -> Option;", "docs": "Remove a policy", "attributes": "", "line": 39 }, { "name": "::PolicyEngine::evaluate", "kind": "function_item", "signature": "pub fn evaluate(&self, request: &PolicyRequest) -> PolicyDecision;", "docs": "Evaluate all policies for a request\n\nReturns the decision from the highest-priority matching policy.\nIf no policies match, returns Deny by default.", "attributes": "#[must_use]", "line": 48 }, { "name": "::PolicyEngine::get_policy", "kind": "function_item", "signature": "pub fn get_policy(&self, policy_id: &str) -> Option<&PolicyDocument>;", "docs": "Get a policy by ID", "attributes": "#[must_use]", "line": 69 }, { "name": "::PolicyEngine::policy_ids", "kind": "function_item", "signature": "pub fn policy_ids(&self) -> Vec;", "docs": "Get all policy IDs", "attributes": "#[must_use]", "line": 75 } ], "parseErrors": false } ] }, { "name": "arsenal-sdk", "url": "/reference/rust/arsenal-sdk", "modules": [ { "module": "crate", "source": "arsenal/crates/arsenal-sdk/src/lib.rs", "sha256": "bf2efb4b5fed418cbe33f6e12e01871a7227603aed6223a69a5ca287e797d37e", "attributes": "", "items": [ { "name": "broker_client", "kind": "module", "signature": "pub mod broker_client;", "docs": "", "attributes": "", "line": 43 }, { "name": "capability", "kind": "module", "signature": "pub mod capability;", "docs": "", "attributes": "", "line": 44 }, { "name": "client", "kind": "module", "signature": "pub mod client;", "docs": "", "attributes": "", "line": 45 }, { "name": "identity_loader", "kind": "module", "signature": "pub mod identity_loader;", "docs": "", "attributes": "", "line": 46 }, { "name": "proxy_client", "kind": "module", "signature": "pub mod proxy_client;", "docs": "", "attributes": "", "line": 47 }, { "name": "session_manager", "kind": "module", "signature": "pub mod session_manager;", "docs": "", "attributes": "", "line": 48 }, { "name": "tool_caller", "kind": "module", "signature": "pub mod tool_caller;", "docs": "", "attributes": "", "line": 49 }, { "name": "pub use broker_client::BrokerClient;", "kind": "use_declaration", "signature": "pub use broker_client::BrokerClient;", "docs": "", "attributes": "", "line": 51 }, { "name": "pub use capability::{CapabilityHandle, CapabilityRequest};", "kind": "use_declaration", "signature": "pub use capability::{CapabilityHandle, CapabilityRequest};", "docs": "", "attributes": "", "line": 52 }, { "name": "pub use client::{ArsenalClient, ArsenalClientBuilder};", "kind": "use_declaration", "signature": "pub use client::{ArsenalClient, ArsenalClientBuilder};", "docs": "", "attributes": "", "line": 53 }, { "name": "pub use identity_loader::AgentIdentityLoader;", "kind": "use_declaration", "signature": "pub use identity_loader::AgentIdentityLoader;", "docs": "", "attributes": "", "line": 54 }, { "name": "pub use proxy_client::ProxyClient;", "kind": "use_declaration", "signature": "pub use proxy_client::ProxyClient;", "docs": "", "attributes": "", "line": 55 }, { "name": "pub use session_manager::SessionManager;", "kind": "use_declaration", "signature": "pub use session_manager::SessionManager;", "docs": "", "attributes": "", "line": 56 }, { "name": "pub use tool_caller::{Tool, ToolCallRequest, ToolCallResponse, ToolCaller};", "kind": "use_declaration", "signature": "pub use tool_caller::{Tool, ToolCallRequest, ToolCallResponse, ToolCaller};", "docs": "", "attributes": "", "line": 57 }, { "name": "prelude", "kind": "module", "signature": "pub mod prelude;", "docs": "Re-export common types", "attributes": "", "line": 60 }, { "name": "pub use super::capability::{CapabilityHandle, CapabilityRequest};", "kind": "use_declaration", "signature": "pub use super::capability::{CapabilityHandle, CapabilityRequest};", "docs": "", "attributes": "", "line": 61 }, { "name": "pub use super::client::{ArsenalClient, ArsenalClientBuilder};", "kind": "use_declaration", "signature": "pub use super::client::{ArsenalClient, ArsenalClientBuilder};", "docs": "", "attributes": "", "line": 62 }, { "name": "pub use super::identity_loader::AgentIdentityLoader;", "kind": "use_declaration", "signature": "pub use super::identity_loader::AgentIdentityLoader;", "docs": "", "attributes": "", "line": 63 }, { "name": "pub use super::proxy_client::ProxyClient;", "kind": "use_declaration", "signature": "pub use super::proxy_client::ProxyClient;", "docs": "", "attributes": "", "line": 64 }, { "name": "pub use super::session_manager::SessionManager;", "kind": "use_declaration", "signature": "pub use super::session_manager::SessionManager;", "docs": "", "attributes": "", "line": 65 }, { "name": "pub use arsenal_core::prelude::*;", "kind": "use_declaration", "signature": "pub use arsenal_core::prelude::*;", "docs": "", "attributes": "", "line": 68 } ], "parseErrors": false }, { "module": "broker_client", "source": "arsenal/crates/arsenal-sdk/src/broker_client.rs", "sha256": "31f8a91c90e0c4af3a52b899bd085073fb13ca70a5f34780bda2c3d5220cb17d", "attributes": "", "items": [ { "name": "broker_client::BrokerClient", "kind": "struct_item", "signature": "pub struct BrokerClient {\n\n}", "docs": "HTTP client for broker communication", "attributes": "", "line": 15 }, { "name": "broker_client::CapabilityRequestPayload", "kind": "struct_item", "signature": "pub struct CapabilityRequestPayload {\n/// Requested scopes\n\npub scopes: Vec,\n/// Requested TTL in seconds\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub ttl_seconds: Option,\n/// Target audience (service)\n\npub audience: String,\n/// Constraints to apply\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub constraints: Option,\n/// `PoP` key fingerprint (hex encoded)\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub pop_key_fingerprint: Option\n}", "docs": "Request payload for capability requests", "attributes": "#[derive(Debug, Clone, Serialize)]", "line": 26 }, { "name": "broker_client::ConstraintsPayload", "kind": "struct_item", "signature": "pub struct ConstraintsPayload {\n/// Require proof-of-possession\n\n#[serde(skip_serializing_if = \"std::ops::Not::not\")]\npub require_pop: bool,\n/// Allowed origins\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub allowed_origins: Option>,\n/// Device ID binding\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub device_id: Option\n}", "docs": "Constraints payload for API", "attributes": "#[derive(Debug, Clone, Default, Serialize)]", "line": 44 }, { "name": "broker_client::CapabilityResponsePayload", "kind": "struct_item", "signature": "pub struct CapabilityResponsePayload {\n/// Token ID\n\npub token_id: String,\n/// Encoded token (base64)\n\npub token: String,\n/// Expiration timestamp (ISO 8601)\n\npub expires_at: String,\n/// Granted scopes\n\npub granted_scopes: Vec\n}", "docs": "Response payload from capability requests", "attributes": "#[derive(Debug, Deserialize)]", "line": 58 }, { "name": "broker_client::SecretRequestPayload", "kind": "struct_item", "signature": "pub struct SecretRequestPayload {\n/// Secret ID\n\npub secret_id: String,\n/// Version (optional, defaults to latest)\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub version: Option,\n/// Capability token authorizing access\n\npub capability_token: String\n}", "docs": "Request payload for secret requests", "attributes": "#[derive(Debug, Serialize)]", "line": 71 }, { "name": "broker_client::SecretResponsePayload", "kind": "struct_item", "signature": "pub struct SecretResponsePayload {\n/// Secret ID\n\npub secret_id: String,\n/// Version\n\npub version: u64,\n/// Wrapped (encrypted) secret value (base64)\n\npub wrapped_value: String,\n/// Wrapping key ID\n\npub wrap_key_id: String,\n/// Ephemeral public key for unwrapping (base64)\n\npub ephemeral_public_key: String,\n/// Expiration timestamp (ISO 8601)\n\npub expires_at: String\n}", "docs": "Response payload from secret requests", "attributes": "#[derive(Debug, Deserialize)]", "line": 83 }, { "name": "broker_client::RevokeTokenPayload", "kind": "struct_item", "signature": "pub struct RevokeTokenPayload {\n/// Token ID to revoke\n\npub token_id: String,\n/// Reason for revocation\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub reason: Option\n}", "docs": "Request payload for token revocation", "attributes": "#[derive(Debug, Serialize)]", "line": 100 }, { "name": "broker_client::RevokeTokenResponse", "kind": "struct_item", "signature": "pub struct RevokeTokenResponse {\n/// Whether revocation succeeded\n\npub success: bool,\n/// Message\n\npub message: String\n}", "docs": "Response from token revocation", "attributes": "#[derive(Debug, Deserialize)]", "line": 110 }, { "name": "broker_client::ApiErrorResponse", "kind": "struct_item", "signature": "pub struct ApiErrorResponse {\n/// Error code\n\npub code: u32,\n/// Error message\n\npub message: String,\n/// Correlation ID\n\n#[serde(default)]\npub correlation_id: Option,\n/// Retry after (seconds)\n\n#[serde(default)]\npub retry_after: Option\n}", "docs": "API error response from broker", "attributes": "#[derive(Debug, Deserialize)]", "line": 119 }, { "name": "broker_client::HealthResponse", "kind": "struct_item", "signature": "pub struct HealthResponse {\n/// Service status\n\npub status: String,\n/// Service version\n\npub version: String\n}", "docs": "Health check response", "attributes": "#[derive(Debug, Deserialize)]", "line": 134 }, { "name": "broker_client::BrokerClient::new", "kind": "function_item", "signature": "pub fn new(base_url: impl Into, client: reqwest::Client) -> ArsenalResult;", "docs": "Create a new broker client\n\n# Arguments\n* `base_url` - Base URL of the broker (e.g., `https://broker.example.com`)\n* `client` - Preconfigured HTTP client (must include mTLS identity for production)\n\n# Errors\nReturns an error if the broker URL is invalid", "attributes": "", "line": 150 }, { "name": "broker_client::BrokerClient::with_timeout", "kind": "function_item", "signature": "pub fn with_timeout(mut self, timeout: Duration) -> Self;", "docs": "Create with custom timeout", "attributes": "#[must_use]", "line": 160 }, { "name": "broker_client::BrokerClient::health", "kind": "function_item", "signature": "pub async fn health(&self) -> ArsenalResult;", "docs": "Check broker health\n\n# Errors\nReturns an error if the health check fails\n\n# Returns\nThe health response", "attributes": "", "line": 172 }, { "name": "broker_client::BrokerClient::request_capability", "kind": "function_item", "signature": "pub async fn request_capability(\n &self,\n payload: CapabilityRequestPayload,\n ) -> ArsenalResult;", "docs": "Request a capability token from the broker\n\n# Arguments\n* `payload` - The capability request payload\n\n# Errors\nReturns an error if the request fails or is denied", "attributes": "", "line": 210 }, { "name": "broker_client::BrokerClient::request_secret", "kind": "function_item", "signature": "pub async fn request_secret(\n &self,\n payload: SecretRequestPayload,\n ) -> ArsenalResult;", "docs": "Request a secret from the broker\n\n# Arguments\n* `payload` - The secret request payload\n\n# Errors\nReturns an error if the request fails or is denied", "attributes": "", "line": 241 }, { "name": "broker_client::BrokerClient::revoke_token", "kind": "function_item", "signature": "pub async fn revoke_token(\n &self,\n token_id: &str,\n reason: Option<&str>,\n ) -> ArsenalResult;", "docs": "Revoke a token\n\n# Arguments\n* `token_id` - The token ID to revoke\n* `reason` - Optional reason for revocation\n\n# Errors\nReturns an error if revocation fails", "attributes": "", "line": 273 }, { "name": "broker_client::BrokerClient::proxy_request", "kind": "function_item", "signature": "pub async fn proxy_request(\n &self,\n request: arsenal_core::proxy::ProxyRequest,\n fingerprint_hex: Option<&str>,\n ) -> ArsenalResult;", "docs": "Send a proxy request through the broker.\n\n# Arguments\n* `request` - The proxy request\n* `fingerprint_hex` - Optional hex-encoded fingerprint for chain verification\n\n# Errors\nReturns an error if the request fails or is rejected.", "attributes": "", "line": 311 }, { "name": "broker_client::BrokerClient::approve_consent", "kind": "function_item", "signature": "pub async fn approve_consent(\n &self,\n payload: ConsentApprovalPayload,\n ) -> ArsenalResult;", "docs": "Approve a consent request.\n\n# Errors\nReturns an error if the approval fails.", "attributes": "", "line": 385 }, { "name": "broker_client::BrokerClient::list_consents", "kind": "function_item", "signature": "pub async fn list_consents(&self, agent_did: &str) -> ArsenalResult>;", "docs": "List consent records for an agent.\n\n# Errors\nReturns an error if the request fails.", "attributes": "", "line": 413 }, { "name": "broker_client::ProxyRequestPayload", "kind": "struct_item", "signature": "pub struct ProxyRequestPayload {\n/// HTTP method\n\npub method: String,\n/// Target URL (may contain `{{VARIABLE}}` placeholders)\n\npub url: String,\n/// Optional HTTP headers\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub headers: Option>,\n/// Optional request body (base64-encoded)\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub body: Option,\n/// Capability token authorizing this request\n\npub capability_token: String,\n/// Optional timeout in milliseconds\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub timeout_ms: Option\n}", "docs": "Request payload for proxy requests", "attributes": "#[derive(Debug, Serialize)]", "line": 489 }, { "name": "broker_client::ProxyResponsePayload", "kind": "struct_item", "signature": "pub struct ProxyResponsePayload {\n/// HTTP status code from target API\n\npub status: u16,\n/// Response headers (sanitized)\n\npub headers: std::collections::BTreeMap,\n/// Response body (base64-encoded)\n\npub body: String,\n/// Proxy processing metadata\n\npub proxy_metadata: ProxyMetadataPayload\n}", "docs": "Response payload from proxy requests", "attributes": "#[derive(Debug, Deserialize)]", "line": 509 }, { "name": "broker_client::ProxyMetadataPayload", "kind": "struct_item", "signature": "pub struct ProxyMetadataPayload {\n/// Variable names that were resolved\n\npub variables_resolved: Vec,\n/// Whether destination binding was verified\n\npub destination_verified: bool,\n/// Whether agent fingerprint was verified\n\npub fingerprint_verified: bool,\n/// Consent status\n\npub consent_status: String,\n/// End-to-end latency in milliseconds\n\npub latency_ms: u64,\n/// Request ID for audit correlation\n\npub request_id: String\n}", "docs": "Metadata about proxy processing", "attributes": "#[derive(Debug, Deserialize)]", "line": 522 }, { "name": "broker_client::ConsentApprovalPayload", "kind": "struct_item", "signature": "pub struct ConsentApprovalPayload {\n/// Agent DID\n\npub agent_did: String,\n/// Human root DID\n\npub human_root_did: String,\n/// Variables to authorize\n\npub variables: Vec,\n/// Destination domains\n\npub destination_domains: Vec,\n/// Scopes\n\npub scopes: Vec,\n/// TTL in seconds\n\npub ttl_seconds: u64,\n/// Ed25519 signature (base64)\n\npub signature: String\n}", "docs": "Request payload for consent approval", "attributes": "#[derive(Debug, Serialize)]", "line": 539 }, { "name": "broker_client::ConsentRecordPayload", "kind": "struct_item", "signature": "pub struct ConsentRecordPayload {\n/// Consent record ID\n\npub consent_id: String,\n/// Agent DID\n\npub agent_did: String,\n/// Granted at timestamp (ISO 8601)\n\npub granted_at: String,\n/// Expires at timestamp (ISO 8601)\n\npub expires_at: String,\n/// Variables authorized\n\npub variables: Vec\n}", "docs": "Response payload from consent approval", "attributes": "#[derive(Debug, Deserialize)]", "line": 558 }, { "name": "broker_client::ConsentListPayload", "kind": "struct_item", "signature": "pub struct ConsentListPayload {\n/// List of consent records\n\npub consents: Vec\n}", "docs": "Summary payload for consent listing", "attributes": "#[derive(Debug, Deserialize)]", "line": 573 }, { "name": "broker_client::decode_capability_token", "kind": "function_item", "signature": "pub fn decode_capability_token(\n response: &CapabilityResponsePayload,\n) -> ArsenalResult;", "docs": "Decode a capability token from the broker response\n\n# Arguments\n* `response` - The capability response from the broker\n\n# Errors\nReturns an error if the token cannot be decoded", "attributes": "", "line": 597 } ], "parseErrors": false }, { "module": "capability", "source": "arsenal/crates/arsenal-sdk/src/capability.rs", "sha256": "b7881bbba9b47c3c8eff9d4396c08c7615331729b09d6caf7e11c9ffeac6723b", "attributes": "", "items": [ { "name": "capability::CapabilityRequest", "kind": "struct_item", "signature": "pub struct CapabilityRequest {\n\n}", "docs": "Builder for capability requests", "attributes": "#[derive(Debug)]", "line": 18 }, { "name": "capability::CapabilityRequest::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Create a new capability request", "attributes": "#[must_use]", "line": 36 }, { "name": "capability::CapabilityRequest::scope", "kind": "function_item", "signature": "pub fn scope(mut self, scope: &str) -> ArsenalResult;", "docs": "Add a scope to the request\n\n# Errors\nReturns an error if the scope is invalid", "attributes": "", "line": 51 }, { "name": "capability::CapabilityRequest::scopes", "kind": "function_item", "signature": "pub fn scopes(mut self, scopes: &[&str]) -> ArsenalResult;", "docs": "Add multiple scopes\n\n# Errors\nReturns an error if any scope is invalid", "attributes": "", "line": 61 }, { "name": "capability::CapabilityRequest::ttl_seconds", "kind": "function_item", "signature": "pub fn ttl_seconds(mut self, ttl: i64) -> Self;", "docs": "Set the TTL", "attributes": "#[must_use]", "line": 71 }, { "name": "capability::CapabilityRequest::audience", "kind": "function_item", "signature": "pub fn audience(mut self, audience: impl Into) -> Self;", "docs": "Set the audience (target service identifier)", "attributes": "#[must_use]", "line": 78 }, { "name": "capability::CapabilityRequest::constraints", "kind": "function_item", "signature": "pub fn constraints(mut self, constraints: Constraints) -> Self;", "docs": "Set constraints", "attributes": "#[must_use]", "line": 85 }, { "name": "capability::CapabilityRequest::require_pop", "kind": "function_item", "signature": "pub fn require_pop(mut self) -> Self;", "docs": "Require proof-of-possession", "attributes": "#[must_use]", "line": 92 }, { "name": "capability::CapabilityRequest::rate_limits", "kind": "function_item", "signature": "pub fn rate_limits(mut self, limits: RateLimits) -> Self;", "docs": "Set rate limits", "attributes": "#[must_use]", "line": 100 }, { "name": "capability::CapabilityRequest::budget", "kind": "function_item", "signature": "pub fn budget(mut self, budget: UsageBudget) -> Self;", "docs": "Set usage budget", "attributes": "#[must_use]", "line": 107 }, { "name": "capability::CapabilityRequest::get_scopes", "kind": "function_item", "signature": "pub fn get_scopes(&self) -> &ScopeSet;", "docs": "Get the requested scopes", "attributes": "#[must_use]", "line": 114 }, { "name": "capability::CapabilityRequest::get_ttl", "kind": "function_item", "signature": "pub fn get_ttl(&self) -> i64;", "docs": "Get the requested TTL", "attributes": "#[must_use]", "line": 120 }, { "name": "capability::CapabilityRequest::get_audience", "kind": "function_item", "signature": "pub fn get_audience(&self) -> &str;", "docs": "Get the requested audience", "attributes": "#[must_use]", "line": 126 }, { "name": "capability::CapabilityRequest::constraints_ref", "kind": "function_item", "signature": "pub fn constraints_ref(&self) -> Option<&Constraints>;", "docs": "Get constraints", "attributes": "#[must_use]", "line": 132 }, { "name": "capability::CapabilityRequest::build_claims", "kind": "function_item", "signature": "pub fn build_claims(\n self,\n agent_did: OasDid,\n tenant_id: TenantId,\n issuer: &str,\n audience: &str,\n ) -> ArsenalResult;", "docs": "Build token claims (for local use - normally the broker does this)\n\n# Errors\nReturns an error if the request is invalid", "attributes": "", "line": 140 }, { "name": "capability::CapabilityHandle", "kind": "struct_item", "signature": "pub struct CapabilityHandle {\n\n}", "docs": "Handle for using a granted capability", "attributes": "", "line": 175 }, { "name": "capability::CapabilityHandle::new", "kind": "function_item", "signature": "pub fn new(token: AgentCapabilityToken) -> Self;", "docs": "Create a new capability handle", "attributes": "#[must_use]", "line": 187 }, { "name": "capability::CapabilityHandle::token_id", "kind": "function_item", "signature": "pub fn token_id(&self) -> &TokenId;", "docs": "Get the token ID", "attributes": "#[must_use]", "line": 198 }, { "name": "capability::CapabilityHandle::token", "kind": "function_item", "signature": "pub fn token(&self) -> &AgentCapabilityToken;", "docs": "Get the token", "attributes": "#[must_use]", "line": 204 }, { "name": "capability::CapabilityHandle::is_valid", "kind": "function_item", "signature": "pub async fn is_valid(&self) -> bool;", "docs": "Check if the capability is valid", "attributes": "", "line": 209 }, { "name": "capability::CapabilityHandle::is_expired", "kind": "function_item", "signature": "pub fn is_expired(&self) -> bool;", "docs": "Check if the capability is expired", "attributes": "#[must_use]", "line": 215 }, { "name": "capability::CapabilityHandle::remaining_ttl", "kind": "function_item", "signature": "pub fn remaining_ttl(&self) -> chrono::Duration;", "docs": "Get remaining TTL", "attributes": "#[must_use]", "line": 221 }, { "name": "capability::CapabilityHandle::allows_scope", "kind": "function_item", "signature": "pub fn allows_scope(&self, scope: &Scope) -> bool;", "docs": "Check if a scope is allowed", "attributes": "#[must_use]", "line": 227 }, { "name": "capability::CapabilityHandle::record_request", "kind": "function_item", "signature": "pub fn record_request(&self) -> ArsenalResult<()>;", "docs": "Record a request (for budget tracking)\n\n# Errors\nReturns an error if the budget is exceeded", "attributes": "", "line": 235 }, { "name": "capability::CapabilityHandle::record_bytes", "kind": "function_item", "signature": "pub fn record_bytes(&self, bytes: u64) -> ArsenalResult<()>;", "docs": "Record bytes transferred\n\n# Errors\nReturns an error if the budget is exceeded", "attributes": "", "line": 243 }, { "name": "capability::CapabilityHandle::record_cost", "kind": "function_item", "signature": "pub fn record_cost(&self, units: u64) -> ArsenalResult<()>;", "docs": "Record cost units\n\n# Errors\nReturns an error if the budget is exceeded", "attributes": "", "line": 251 }, { "name": "capability::CapabilityHandle::usage_stats", "kind": "function_item", "signature": "pub fn usage_stats(&self) -> arsenal_core::limits::UsageStats;", "docs": "Get usage statistics", "attributes": "#[must_use]", "line": 257 }, { "name": "capability::CapabilityHandle::remaining_budget", "kind": "function_item", "signature": "pub fn remaining_budget(&self) -> arsenal_core::limits::RemainingBudget;", "docs": "Get remaining budget", "attributes": "#[must_use]", "line": 263 }, { "name": "capability::CapabilityHandle::revoke", "kind": "function_item", "signature": "pub async fn revoke(&self);", "docs": "Revoke this capability", "attributes": "", "line": 268 }, { "name": "capability::CapabilityValidator", "kind": "struct_item", "signature": "pub struct CapabilityValidator {\n\n}", "docs": "Capability validator for checking requests", "attributes": "", "line": 284 }, { "name": "capability::CapabilityValidator::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Create a new validator", "attributes": "#[must_use]", "line": 296 }, { "name": "capability::CapabilityValidator::with_allowed_scopes", "kind": "function_item", "signature": "pub fn with_allowed_scopes(mut self, scopes: ScopeSet) -> Self;", "docs": "Set allowed scopes", "attributes": "#[must_use]", "line": 306 }, { "name": "capability::CapabilityValidator::with_max_ttl", "kind": "function_item", "signature": "pub fn with_max_ttl(mut self, seconds: i64) -> Self;", "docs": "Set maximum TTL", "attributes": "#[must_use]", "line": 313 }, { "name": "capability::CapabilityValidator::require_pop", "kind": "function_item", "signature": "pub fn require_pop(mut self) -> Self;", "docs": "Require proof-of-possession", "attributes": "#[must_use]", "line": 320 }, { "name": "capability::CapabilityValidator::validate", "kind": "function_item", "signature": "pub fn validate(&self, request: &CapabilityRequest) -> ArsenalResult<()>;", "docs": "Validate a capability request\n\n# Errors\nReturns an error if the request is invalid", "attributes": "", "line": 329 } ], "parseErrors": false }, { "module": "client", "source": "arsenal/crates/arsenal-sdk/src/client.rs", "sha256": "777c7783f6c127277d54e40c822d1b5b3916608a3306affde415af33ac66626c", "attributes": "", "items": [ { "name": "client::ArsenalClient", "kind": "struct_item", "signature": "pub struct ArsenalClient {\n\n}", "docs": "Arsenal client for agent key management", "attributes": "", "line": 26 }, { "name": "client::ClientConfig", "kind": "struct_item", "signature": "pub struct ClientConfig {\n/// Broker URL (for remote broker)\n\npub broker_url: Option,\n/// Broker TLS configuration (required when `broker_url` is set)\n\npub broker_tls: Option,\n/// Session configuration\n\npub session_config: SessionConfig,\n/// Auto-renew tokens\n\npub auto_renew: bool,\n/// Issuer\n\npub issuer: String,\n/// Default audience for broker-issued tokens\n\npub default_audience: String\n}", "docs": "Client configuration", "attributes": "#[derive(Debug, Clone)]", "line": 45 }, { "name": "client::BrokerTlsConfig", "kind": "struct_item", "signature": "pub struct BrokerTlsConfig {\n/// PEM-encoded client certificate chain\n\npub client_cert_path: PathBuf,\n/// PEM-encoded client private key\n\npub client_key_path: PathBuf,\n/// Optional PEM-encoded CA certificate to trust for the broker server\n\npub ca_cert_path: Option\n}", "docs": "Broker TLS configuration for mTLS + custom trust roots.", "attributes": "#[derive(Debug, Clone)]", "line": 62 }, { "name": "client::ArsenalClientBuilder", "kind": "struct_item", "signature": "pub struct ArsenalClientBuilder {\n\n}", "docs": "Builder for Arsenal client", "attributes": "", "line": 85 }, { "name": "client::ArsenalClientBuilder::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Create a new Arsenal client builder\n\n# Returns\nA new Arsenal client builder", "attributes": "#[must_use]", "line": 96 }, { "name": "client::ArsenalClientBuilder::identity", "kind": "function_item", "signature": "pub fn identity(mut self, identity: AgentIdentityLoader) -> Self;", "docs": "Set the agent identity\n\n# Parameters\n* `identity` - The agent identity\n\n# Returns\nA new Arsenal client builder", "attributes": "#[must_use]", "line": 111 }, { "name": "client::ArsenalClientBuilder::broker_url", "kind": "function_item", "signature": "pub fn broker_url(mut self, url: impl Into) -> Self;", "docs": "Set the broker URL\n\n# Parameters\n* `url` - The broker URL\n\n# Returns\nA new Arsenal client builder", "attributes": "#[must_use]", "line": 124 }, { "name": "client::ArsenalClientBuilder::broker_mtls", "kind": "function_item", "signature": "pub fn broker_mtls(\n mut self,\n client_cert_path: impl Into,\n client_key_path: impl Into,\n ) -> Self;", "docs": "Configure mTLS for broker communication (required when using a broker).", "attributes": "#[must_use]", "line": 131 }, { "name": "client::ArsenalClientBuilder::broker_ca_cert_path", "kind": "function_item", "signature": "pub fn broker_ca_cert_path(mut self, ca_cert_path: impl Into) -> Self;", "docs": "Configure a custom CA bundle for broker server validation.", "attributes": "#[must_use]", "line": 153 }, { "name": "client::ArsenalClientBuilder::default_audience", "kind": "function_item", "signature": "pub fn default_audience(mut self, audience: impl Into) -> Self;", "docs": "Set the default audience for broker-issued tokens.", "attributes": "#[must_use]", "line": 169 }, { "name": "client::ArsenalClientBuilder::session_config", "kind": "function_item", "signature": "pub fn session_config(mut self, config: SessionConfig) -> Self;", "docs": "Set session configuration\n\n# Parameters\n* `config` - The session configuration\n\n# Returns\nA new Arsenal client builder", "attributes": "#[must_use]", "line": 182 }, { "name": "client::ArsenalClientBuilder::auto_renew", "kind": "function_item", "signature": "pub fn auto_renew(mut self, auto_renew: bool) -> Self;", "docs": "Set auto-renew\n\n# Parameters\n* `auto_renew` - Whether to auto-renew tokens\n\n# Returns\nA new Arsenal client builder", "attributes": "#[must_use]", "line": 195 }, { "name": "client::ArsenalClientBuilder::issuer", "kind": "function_item", "signature": "pub fn issuer(mut self, issuer: impl Into) -> Self;", "docs": "Set issuer\n\n# Parameters\n* `issuer` - The issuer\n\n# Returns\nA new Arsenal client builder", "attributes": "#[must_use]", "line": 208 }, { "name": "client::ArsenalClientBuilder::build", "kind": "function_item", "signature": "pub fn build(self) -> ArsenalResult;", "docs": "Build the client\n\n# Errors\nReturns an error if identity is not set\n\n# Returns\nThe Arsenal client", "attributes": "", "line": 220 }, { "name": "client::ArsenalClient::builder", "kind": "function_item", "signature": "pub fn builder() -> ArsenalClientBuilder;", "docs": "Create a new Arsenal client builder\n\n# Returns\nA new Arsenal client builder", "attributes": "#[must_use]", "line": 319 }, { "name": "client::ArsenalClient::identity", "kind": "function_item", "signature": "pub fn identity(&self) -> &AgentIdentityLoader;", "docs": "Get the agent identity\n\n# Returns\nThe agent identity", "attributes": "#[must_use]", "line": 328 }, { "name": "client::ArsenalClient::tenant_id", "kind": "function_item", "signature": "pub fn tenant_id(&self) -> &TenantId;", "docs": "Get the tenant ID\n\n# Returns\nThe tenant ID", "attributes": "#[must_use]", "line": 337 }, { "name": "client::ArsenalClient::start_session", "kind": "function_item", "signature": "pub async fn start_session(&self) -> ArsenalResult;", "docs": "Start a new session\n\n# Errors\nReturns an error if session creation fails\n\n# Returns\nThe session ID", "attributes": "", "line": 348 }, { "name": "client::ArsenalClient::session_id", "kind": "function_item", "signature": "pub async fn session_id(&self) -> ArsenalResult;", "docs": "Get current session ID\n\n# Errors\nReturns an error if no session is active\n\n# Returns\nThe session ID", "attributes": "", "line": 359 }, { "name": "client::ArsenalClient::has_active_session", "kind": "function_item", "signature": "pub async fn has_active_session(&self) -> bool;", "docs": "Check if a session is active\n\n# Returns\nWhether a session is active", "attributes": "", "line": 367 }, { "name": "client::ArsenalClient::session_stats", "kind": "function_item", "signature": "pub async fn session_stats(&self) -> SessionStats;", "docs": "Get session statistics\n\n# Returns\nThe session statistics", "attributes": "", "line": 375 }, { "name": "client::ArsenalClient::request_capability", "kind": "function_item", "signature": "pub async fn request_capability(\n &self,\n request: CapabilityRequest,\n ) -> ArsenalResult;", "docs": "Request a capability\n\n# Errors\nReturns an error if the request fails\n\n# Returns\nThe capability handle", "attributes": "", "line": 386 }, { "name": "client::ArsenalClient::request_capability_for_scopes", "kind": "function_item", "signature": "pub async fn request_capability_for_scopes(\n &self,\n scopes: &[&str],\n ttl_seconds: i64,\n ) -> ArsenalResult;", "docs": "Request a capability with scope strings\n\n# Errors\nReturns an error if the request fails\n\n# Parameters\n* `scopes` - The scopes\n* `ttl_seconds` - The TTL in seconds\n\n# Returns\nThe capability handle", "attributes": "", "line": 485 }, { "name": "client::ArsenalClient::current_token", "kind": "function_item", "signature": "pub async fn current_token(&self) -> Option;", "docs": "Get current capability token\n\n# Returns\nThe current capability token", "attributes": "", "line": 501 }, { "name": "client::ArsenalClient::register_tool", "kind": "function_item", "signature": "pub fn register_tool(&mut self, tool: Arc);", "docs": "Register a tool\n\n# Parameters\n* `tool` - The tool to register", "attributes": "", "line": 509 }, { "name": "client::ArsenalClient::call_tool", "kind": "function_item", "signature": "pub async fn call_tool(\n &mut self,\n request: &ToolCallRequest,\n ) -> ArsenalResult;", "docs": "Call a tool\n\n# Errors\nReturns an error if the call fails\n\n# Parameters\n* `request` - The tool call request\n\n# Returns\nThe tool call response", "attributes": "", "line": 523 }, { "name": "client::ArsenalClient::unwrap_secret_response", "kind": "function_item", "signature": "pub fn unwrap_secret_response(\n &self,\n wrapped: &SecretResponsePayload,\n ) -> ArsenalResult>;", "docs": "Unwrap a broker-wrapped secret using this agent's encryption key.\n\nThe broker encrypts secrets to the agent's derived X25519 public key and includes an\nephemeral public key for DH key agreement. This helper performs the full decrypt locally.\n\n# Errors\nReturns an error if decoding or decryption fails.", "attributes": "", "line": 554 }, { "name": "client::ArsenalClient::call_tool_simple", "kind": "function_item", "signature": "pub async fn call_tool_simple(\n &mut self,\n tool_id: &str,\n method: &str,\n params: serde_json::Value,\n ) -> ArsenalResult;", "docs": "Call a tool with simple interface\n\n# Errors\nReturns an error if the call fails", "attributes": "", "line": 645 }, { "name": "client::ArsenalClient::proxy_http", "kind": "function_item", "signature": "pub async fn proxy_http(\n &self,\n request: arsenal_core::proxy::ProxyRequest,\n ) -> ArsenalResult;", "docs": "Send a proxy request through the broker's credential proxy.\n\nThe proxy resolves `{{VARIABLE}}` placeholders server-side, so agents\nnever see raw credentials. Requires a valid capability token with\nappropriate proxy scopes.\n\n# Errors\nReturns an error if no proxy client is configured, the request is\ninvalid, or the broker rejects it.", "attributes": "", "line": 675 }, { "name": "client::ArsenalClient::proxy_client", "kind": "function_item", "signature": "pub fn proxy_client(&self) -> Option<&Arc>;", "docs": "Get a reference to the proxy client (if configured).", "attributes": "#[must_use]", "line": 691 }, { "name": "client::ArsenalClient::approve_consent", "kind": "function_item", "signature": "pub async fn approve_consent(\n &self,\n payload: ConsentApprovalPayload,\n ) -> ArsenalResult;", "docs": "Approve a consent request for credential access.\n\n# Errors\nReturns an error if no broker is configured or the approval fails.", "attributes": "", "line": 699 }, { "name": "client::ArsenalClient::list_consents", "kind": "function_item", "signature": "pub async fn list_consents(&self) -> ArsenalResult>;", "docs": "List consent records for this agent.\n\n# Errors\nReturns an error if no broker is configured or the request fails.", "attributes": "", "line": 717 }, { "name": "client::ArsenalClient::end_session", "kind": "function_item", "signature": "pub async fn end_session(&self) -> ArsenalResult<()>;", "docs": "End the current session\n\n# Errors\nReturns an error if ending fails", "attributes": "", "line": 733 }, { "name": "client::ArsenalClient::revoke_session", "kind": "function_item", "signature": "pub async fn revoke_session(&self);", "docs": "Revoke the current session", "attributes": "", "line": 738 } ], "parseErrors": false }, { "module": "identity_loader", "source": "arsenal/crates/arsenal-sdk/src/identity_loader.rs", "sha256": "882083d9db10928df481928cbebf1f27555436a15f8e30f00f5977c265cdefcb", "attributes": "", "items": [ { "name": "identity_loader::AgentIdentityLoader", "kind": "struct_item", "signature": "pub struct AgentIdentityLoader {\n\n}", "docs": "Loaded agent identity with signing capability", "attributes": "", "line": 15 }, { "name": "identity_loader::AgentIdentityLoader::generate", "kind": "function_item", "signature": "pub fn generate(\n did: OasDid,\n tenant_id: TenantId,\n name: impl Into,\n ) -> ArsenalResult;", "docs": "Create a new agent identity with a fresh key pair\n\n`did` is the agent's OAS DID, issued by OAS genesis. This loader mints\nkey material, not identity: a DID must already exist for the agent whose\nkeys these are.\n\n# Errors\nReturns an error if key generation fails, or if `did` is not of entity\nkind `agent`.", "attributes": "", "line": 43 }, { "name": "identity_loader::AgentIdentityLoader::from_seed_file", "kind": "function_item", "signature": "pub async fn from_seed_file(\n path: impl AsRef,\n did: OasDid,\n tenant_id: TenantId,\n name: impl Into,\n ) -> ArsenalResult;", "docs": "Load from a seed file\n\nThe file should contain 32 bytes of seed material.\n\n# Errors\nReturns an error if the file cannot be read or the seed is invalid", "attributes": "", "line": 79 }, { "name": "identity_loader::AgentIdentityLoader::from_env", "kind": "function_item", "signature": "pub fn from_env(\n env_var: &str,\n did: OasDid,\n tenant_id: TenantId,\n name: impl Into,\n ) -> ArsenalResult;", "docs": "Load from environment variable\n\nThe environment variable should contain hex-encoded 32-byte seed.\n\n# Errors\nReturns an error if the environment variable is not set or invalid", "attributes": "", "line": 140 }, { "name": "identity_loader::AgentIdentityLoader::identity", "kind": "function_item", "signature": "pub fn identity(&self) -> &AgentIdentity;", "docs": "Get the agent identity", "attributes": "#[must_use]", "line": 200 }, { "name": "identity_loader::AgentIdentityLoader::fingerprint", "kind": "function_item", "signature": "pub fn fingerprint(&self) -> KeyFingerprint;", "docs": "Get the public key fingerprint", "attributes": "#[must_use]", "line": 206 }, { "name": "identity_loader::AgentIdentityLoader::public_key_bytes", "kind": "function_item", "signature": "pub fn public_key_bytes(&self) -> [u8; 32];", "docs": "Get the public key bytes", "attributes": "#[must_use]", "line": 212 }, { "name": "identity_loader::AgentIdentityLoader::encryption_public_key_bytes", "kind": "function_item", "signature": "pub fn encryption_public_key_bytes(&self) -> [u8; 32];", "docs": "Get the encryption public key bytes (X25519)", "attributes": "#[must_use]", "line": 218 }, { "name": "identity_loader::AgentIdentityLoader::encryption_key_pair", "kind": "function_item", "signature": "pub fn encryption_key_pair(&self) -> &EncryptionKeyPair;", "docs": "Get the encryption key pair (X25519)", "attributes": "#[must_use]", "line": 224 }, { "name": "identity_loader::AgentIdentityLoader::sign", "kind": "function_item", "signature": "pub fn sign(&self, message: &[u8]) -> [u8; 64];", "docs": "Sign a message", "attributes": "#[must_use]", "line": 230 }, { "name": "identity_loader::AgentIdentityLoader::export_seed", "kind": "function_item", "signature": "pub fn export_seed(&self) -> [u8; 32];", "docs": "Export the seed for backup (handle with extreme care!)\n\nThis returns the private key material.", "attributes": "#[must_use]", "line": 238 }, { "name": "identity_loader::AgentIdentityLoader::save_seed", "kind": "function_item", "signature": "pub async fn save_seed(&self, path: impl AsRef) -> ArsenalResult<()>;", "docs": "Save the seed to a file\n\n# Errors\nReturns an error if the file cannot be written", "attributes": "", "line": 246 } ], "parseErrors": false }, { "module": "proxy_client", "source": "arsenal/crates/arsenal-sdk/src/proxy_client.rs", "sha256": "853d49b5c3ae77fd8c4c12fbab3a36a6eacaecc65a611e6de85fd3e4b1577b83", "attributes": "", "items": [ { "name": "proxy_client::ProxyClient", "kind": "struct_item", "signature": "pub struct ProxyClient {\n\n}", "docs": "Client-side proxy integration with automatic fingerprint management.", "attributes": "", "line": 38 }, { "name": "proxy_client::ProxyClient::new", "kind": "function_item", "signature": "pub fn new(broker_client: Arc) -> Self;", "docs": "Create a new proxy client.", "attributes": "#[must_use]", "line": 50 }, { "name": "proxy_client::ProxyClient::with_persistence", "kind": "function_item", "signature": "pub fn with_persistence(broker_client: Arc, path: PathBuf) -> Self;", "docs": "Create a new proxy client with fingerprint persistence.", "attributes": "#[must_use]", "line": 60 }, { "name": "proxy_client::ProxyClient::init_fingerprint", "kind": "function_item", "signature": "pub async fn init_fingerprint(&self, agent_did: &str) -> ArsenalResult<()>;", "docs": "Initialize fingerprint state for an agent.\n\nThis should be called once when the agent starts. If a persistence\npath was configured and a saved state exists, it will be loaded\ninstead of creating a new chain.\n\n# Errors\n\nReturns an error if loading persisted state fails.", "attributes": "", "line": 77 }, { "name": "proxy_client::ProxyClient::proxy_request", "kind": "function_item", "signature": "pub async fn proxy_request(&self, request: ProxyRequest) -> ArsenalResult;", "docs": "Send a proxy request through the broker.\n\nAutomatically attaches the current fingerprint and advances\nthe chain on success.\n\n# Errors\n\nReturns an error if the proxy request fails or the broker rejects it.", "attributes": "", "line": 108 }, { "name": "proxy_client::ProxyClient::fingerprint_sequence", "kind": "function_item", "signature": "pub async fn fingerprint_sequence(&self) -> Option;", "docs": "Get the current fingerprint state sequence number.", "attributes": "", "line": 148 }, { "name": "proxy_client::ProxyClient::save_fingerprint_state", "kind": "function_item", "signature": "pub async fn save_fingerprint_state(&self) -> ArsenalResult<()>;", "docs": "Save fingerprint state to disk (if persistence path is configured).\n\n# Errors\n\nReturns an error if serialization or file write fails.", "attributes": "", "line": 158 } ], "parseErrors": false }, { "module": "session_manager", "source": "arsenal/crates/arsenal-sdk/src/session_manager.rs", "sha256": "2689b01839e16765db0e6c17b6ef8bb0e4624fb3816e56a4104578b0d5576e2c", "attributes": "", "items": [ { "name": "session_manager::SessionManager", "kind": "struct_item", "signature": "pub struct SessionManager {\n\n}", "docs": "Session manager for handling agent sessions", "attributes": "", "line": 18 }, { "name": "session_manager::SessionConfig", "kind": "struct_item", "signature": "pub struct SessionConfig {\n/// Default session TTL in seconds\n\npub session_ttl_seconds: u64,\n/// Token TTL in seconds\n\npub token_ttl_seconds: i64,\n/// Renewal threshold in permille (renew when this fraction of TTL remains).\n\n///\n\n/// Example: `200` = renew when 20% of TTL remains.\n\npub renewal_threshold_permille: u16,\n/// Maximum renewal attempts\n\npub max_renewal_attempts: u32,\n/// Renewal backoff base in milliseconds\n\npub renewal_backoff_ms: u64\n}", "docs": "Session configuration", "attributes": "#[derive(Debug, Clone)]", "line": 43 }, { "name": "session_manager::SessionManager::new", "kind": "function_item", "signature": "pub fn new(identity: Arc, config: SessionConfig) -> Self;", "docs": "Create a new session manager", "attributes": "#[must_use]", "line": 73 }, { "name": "session_manager::SessionManager::with_defaults", "kind": "function_item", "signature": "pub fn with_defaults(identity: Arc) -> Self;", "docs": "Create with default configuration", "attributes": "#[must_use]", "line": 83 }, { "name": "session_manager::SessionManager::start_session", "kind": "function_item", "signature": "pub async fn start_session(&self) -> ArsenalResult;", "docs": "Start a new session\n\n# Errors\nReturns an error if session creation fails", "attributes": "", "line": 91 }, { "name": "session_manager::SessionManager::session_id", "kind": "function_item", "signature": "pub async fn session_id(&self) -> ArsenalResult;", "docs": "Get the current session ID\n\n# Errors\nReturns an error if no session is active", "attributes": "", "line": 132 }, { "name": "session_manager::SessionManager::has_active_session", "kind": "function_item", "signature": "pub async fn has_active_session(&self) -> bool;", "docs": "Check if a session is active", "attributes": "", "line": 141 }, { "name": "session_manager::SessionManager::session_state", "kind": "function_item", "signature": "pub async fn session_state(&self) -> Option;", "docs": "Get session state", "attributes": "", "line": 149 }, { "name": "session_manager::SessionManager::record_activity", "kind": "function_item", "signature": "pub async fn record_activity(&self);", "docs": "Record activity (updates last activity time)", "attributes": "", "line": 155 }, { "name": "session_manager::SessionManager::set_current_token", "kind": "function_item", "signature": "pub async fn set_current_token(&self, token: AgentCapabilityToken) -> ArsenalResult<()>;", "docs": "Set the current capability token\n\n# Errors\nReturns an error if no session is active", "attributes": "", "line": 167 }, { "name": "session_manager::SessionManager::current_token", "kind": "function_item", "signature": "pub async fn current_token(&self) -> Option;", "docs": "Get the current capability token", "attributes": "", "line": 187 }, { "name": "session_manager::SessionManager::needs_token_renewal", "kind": "function_item", "signature": "pub async fn needs_token_renewal(&self) -> bool;", "docs": "Check if the current token needs renewal", "attributes": "", "line": 193 }, { "name": "session_manager::SessionManager::needs_session_renewal", "kind": "function_item", "signature": "pub async fn needs_session_renewal(&self) -> bool;", "docs": "Check if the session needs renewal", "attributes": "", "line": 212 }, { "name": "session_manager::SessionManager::sign_with_session_key", "kind": "function_item", "signature": "pub async fn sign_with_session_key(&self, message: &[u8]) -> ArsenalResult<[u8; 64]>;", "docs": "Sign a message with the session key (for `PoP`)\n\n# Errors\nReturns an error if no session is active", "attributes": "", "line": 231 }, { "name": "session_manager::SessionManager::end_session", "kind": "function_item", "signature": "pub async fn end_session(&self) -> ArsenalResult<()>;", "docs": "End the current session\n\n# Errors\nReturns an error if ending fails", "attributes": "", "line": 244 }, { "name": "session_manager::SessionManager::revoke_session", "kind": "function_item", "signature": "pub async fn revoke_session(&self);", "docs": "Revoke the current session (immediate termination)", "attributes": "", "line": 257 }, { "name": "session_manager::SessionManager::stats", "kind": "function_item", "signature": "pub async fn stats(&self) -> SessionStats;", "docs": "Get session statistics", "attributes": "", "line": 269 }, { "name": "session_manager::SessionStats", "kind": "struct_item", "signature": "pub struct SessionStats {\n/// Current session ID\n\npub session_id: Option,\n/// Session state\n\npub state: SessionState,\n/// Number of active tokens\n\npub active_tokens: u64,\n/// Session age in seconds\n\npub session_age_secs: u64,\n/// Seconds since last activity\n\npub idle_secs: u64,\n/// Whether there's a valid token\n\npub has_valid_token: bool\n}", "docs": "Session statistics", "attributes": "#[derive(Debug, Clone)]", "line": 291 } ], "parseErrors": false }, { "module": "tool_caller", "source": "arsenal/crates/arsenal-sdk/src/tool_caller.rs", "sha256": "20def8c456e3c475caa03ec679b3be2c1055286604feb2c92095814f67a34d10", "attributes": "", "items": [ { "name": "tool_caller::Tool", "kind": "trait_item", "signature": "pub trait Tool: Send + Sync {\n /// Get the tool's unique identifier\n fn id(&self) -> &str;\n\n /// Get the tool's description\n fn description(&self) -> &str;\n\n /// Get the required scope pattern for this tool\n fn required_scope(&self) -> &str;\n\n /// Get available methods\n fn methods(&self) -> &[&str];\n\n /// Execute a method on this tool\n ///\n /// # Errors\n /// Returns an error if the method is not found or execution fails\n fn execute(&self, method: &str, params: serde_json::Value) -> ArsenalResult;\n}", "docs": "Tool trait for implementing callable tools", "attributes": "", "line": 16 }, { "name": "tool_caller::ToolCallRequest", "kind": "struct_item", "signature": "pub struct ToolCallRequest {\n/// Tool identifier\n\npub tool_id: String,\n/// Method to call\n\npub method: String,\n/// Parameters\n\npub params: serde_json::Value,\n/// Request ID for tracing\n\npub request_id: Option\n}", "docs": "Request to call a tool", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 38 }, { "name": "tool_caller::ToolCallRequest::new", "kind": "function_item", "signature": "pub fn new(tool_id: impl Into, method: impl Into) -> Self;", "docs": "Create a new tool call request", "attributes": "#[must_use]", "line": 52 }, { "name": "tool_caller::ToolCallRequest::with_params", "kind": "function_item", "signature": "pub fn with_params(mut self, params: serde_json::Value) -> Self;", "docs": "Set parameters", "attributes": "#[must_use]", "line": 63 }, { "name": "tool_caller::ToolCallRequest::with_request_id", "kind": "function_item", "signature": "pub fn with_request_id(mut self, request_id: impl Into) -> Self;", "docs": "Set request ID", "attributes": "#[must_use]", "line": 70 }, { "name": "tool_caller::ToolCallResponse", "kind": "struct_item", "signature": "pub struct ToolCallResponse {\n/// Whether the call succeeded\n\npub success: bool,\n/// Response data\n\npub data: serde_json::Value,\n/// Error message if failed\n\npub error: Option,\n/// Request ID if provided\n\npub request_id: Option\n}", "docs": "Response from a tool call", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 78 }, { "name": "tool_caller::ToolCallResponse::success", "kind": "function_item", "signature": "pub fn success(data: serde_json::Value) -> Self;", "docs": "Create a successful response", "attributes": "#[must_use]", "line": 92 }, { "name": "tool_caller::ToolCallResponse::error", "kind": "function_item", "signature": "pub fn error(message: impl Into) -> Self;", "docs": "Create an error response", "attributes": "#[must_use]", "line": 103 }, { "name": "tool_caller::ToolCallResponse::with_request_id", "kind": "function_item", "signature": "pub fn with_request_id(mut self, request_id: impl Into) -> Self;", "docs": "Set request ID", "attributes": "#[must_use]", "line": 114 }, { "name": "tool_caller::ToolCaller", "kind": "struct_item", "signature": "pub struct ToolCaller {\n\n}", "docs": "Tool caller for invoking tools with capability checking", "attributes": "", "line": 121 }, { "name": "tool_caller::ToolCaller::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Create a new tool caller", "attributes": "#[must_use]", "line": 131 }, { "name": "tool_caller::ToolCaller::register_tool", "kind": "function_item", "signature": "pub fn register_tool(&mut self, tool: Arc);", "docs": "Register a tool", "attributes": "", "line": 139 }, { "name": "tool_caller::ToolCaller::unregister_tool", "kind": "function_item", "signature": "pub fn unregister_tool(&mut self, tool_id: &str);", "docs": "Unregister a tool", "attributes": "", "line": 144 }, { "name": "tool_caller::ToolCaller::get_tool", "kind": "function_item", "signature": "pub fn get_tool(&self, tool_id: &str) -> Option>;", "docs": "Get a registered tool", "attributes": "#[must_use]", "line": 150 }, { "name": "tool_caller::ToolCaller::tool_ids", "kind": "function_item", "signature": "pub fn tool_ids(&self) -> Vec;", "docs": "List registered tool IDs", "attributes": "#[must_use]", "line": 156 }, { "name": "tool_caller::ToolCaller::set_capability", "kind": "function_item", "signature": "pub fn set_capability(&mut self, capability: Arc);", "docs": "Set the current capability", "attributes": "", "line": 161 }, { "name": "tool_caller::ToolCaller::clear_capability", "kind": "function_item", "signature": "pub fn clear_capability(&mut self);", "docs": "Clear the current capability", "attributes": "", "line": 166 }, { "name": "tool_caller::ToolCaller::call", "kind": "function_item", "signature": "pub fn call(&self, request: &ToolCallRequest) -> ArsenalResult;", "docs": "Call a tool\n\n# Errors\nReturns an error if the tool is not found, capability is missing,\nor the call fails", "attributes": "", "line": 175 } ], "parseErrors": false } ] }, { "name": "arsenal-store", "url": "/reference/rust/arsenal-store", "modules": [ { "module": "crate", "source": "arsenal/crates/arsenal-store/src/lib.rs", "sha256": "9eef468c92a9dc9b45700316aa160791082cc0d1e66682d9a61faead9a37b6dc", "attributes": "", "items": [ { "name": "consent_store", "kind": "module", "signature": "pub mod consent_store;", "docs": "", "attributes": "", "line": 21 }, { "name": "encrypted_file", "kind": "module", "signature": "pub mod encrypted_file;", "docs": "", "attributes": "", "line": 22 }, { "name": "fingerprint_store", "kind": "module", "signature": "pub mod fingerprint_store;", "docs": "", "attributes": "", "line": 23 }, { "name": "key_resolver", "kind": "module", "signature": "pub mod key_resolver;", "docs": "", "attributes": "", "line": 24 }, { "name": "key_wrapper", "kind": "module", "signature": "pub mod key_wrapper;", "docs": "", "attributes": "", "line": 25 }, { "name": "memory", "kind": "module", "signature": "pub mod memory;", "docs": "", "attributes": "", "line": 26 }, { "name": "traits", "kind": "module", "signature": "pub mod traits;", "docs": "", "attributes": "", "line": 27 }, { "name": "variable_resolver", "kind": "module", "signature": "pub mod variable_resolver;", "docs": "", "attributes": "", "line": 28 }, { "name": "pub use consent_store::{ConsentStore, InMemoryConsentStore};", "kind": "use_declaration", "signature": "pub use consent_store::{ConsentStore, InMemoryConsentStore};", "docs": "", "attributes": "", "line": 30 }, { "name": "pub use encrypted_file::EncryptedFileStore;", "kind": "use_declaration", "signature": "pub use encrypted_file::EncryptedFileStore;", "docs": "", "attributes": "", "line": 31 }, { "name": "pub use fingerprint_store::{FingerprintStore, InMemoryFingerprintStore};", "kind": "use_declaration", "signature": "pub use fingerprint_store::{FingerprintStore, InMemoryFingerprintStore};", "docs": "", "attributes": "", "line": 32 }, { "name": "pub use key_resolver::{InMemoryKeyResolver, PublicKeyResolver};", "kind": "use_declaration", "signature": "pub use key_resolver::{InMemoryKeyResolver, PublicKeyResolver};", "docs": "", "attributes": "", "line": 33 }, { "name": "pub use key_wrapper::{KeyWrapper, SoftwareKeyWrapper};", "kind": "use_declaration", "signature": "pub use key_wrapper::{KeyWrapper, SoftwareKeyWrapper};", "docs": "", "attributes": "", "line": 34 }, { "name": "pub use memory::InMemorySecretStore;", "kind": "use_declaration", "signature": "pub use memory::InMemorySecretStore;", "docs": "", "attributes": "", "line": 35 }, { "name": "pub use traits::{SecretStore, SecretStoreError, SecretStoreResult};", "kind": "use_declaration", "signature": "pub use traits::{SecretStore, SecretStoreError, SecretStoreResult};", "docs": "", "attributes": "", "line": 36 }, { "name": "pub use variable_resolver::{InMemoryVariableResolver, VariableResolver};", "kind": "use_declaration", "signature": "pub use variable_resolver::{InMemoryVariableResolver, VariableResolver};", "docs": "", "attributes": "", "line": 37 }, { "name": "pub use consent_store::SqlConsentStore;", "kind": "use_declaration", "signature": "pub use consent_store::SqlConsentStore;", "docs": "", "attributes": "#[cfg(any(feature = \"sqlite\", feature = \"postgres\"))]", "line": 40 }, { "name": "pub use fingerprint_store::SqlFingerprintStore;", "kind": "use_declaration", "signature": "pub use fingerprint_store::SqlFingerprintStore;", "docs": "", "attributes": "#[cfg(any(feature = \"sqlite\", feature = \"postgres\"))]", "line": 42 }, { "name": "pub use variable_resolver::SqlVariableResolver;", "kind": "use_declaration", "signature": "pub use variable_resolver::SqlVariableResolver;", "docs": "", "attributes": "#[cfg(any(feature = \"sqlite\", feature = \"postgres\"))]", "line": 44 }, { "name": "prelude", "kind": "module", "signature": "pub mod prelude;", "docs": "Re-export common types", "attributes": "", "line": 47 }, { "name": "pub use super::consent_store::{ConsentStore, InMemoryConsentStore};", "kind": "use_declaration", "signature": "pub use super::consent_store::{ConsentStore, InMemoryConsentStore};", "docs": "", "attributes": "", "line": 48 }, { "name": "pub use super::fingerprint_store::{FingerprintStore, InMemoryFingerprintStore};", "kind": "use_declaration", "signature": "pub use super::fingerprint_store::{FingerprintStore, InMemoryFingerprintStore};", "docs": "", "attributes": "", "line": 49 }, { "name": "pub use super::key_resolver::{InMemoryKeyResolver, PublicKeyResolver};", "kind": "use_declaration", "signature": "pub use super::key_resolver::{InMemoryKeyResolver, PublicKeyResolver};", "docs": "", "attributes": "", "line": 50 }, { "name": "pub use super::key_wrapper::KeyWrapper;", "kind": "use_declaration", "signature": "pub use super::key_wrapper::KeyWrapper;", "docs": "", "attributes": "", "line": 51 }, { "name": "pub use super::memory::InMemorySecretStore;", "kind": "use_declaration", "signature": "pub use super::memory::InMemorySecretStore;", "docs": "", "attributes": "", "line": 52 }, { "name": "pub use super::traits::{SecretStore, SecretStoreResult};", "kind": "use_declaration", "signature": "pub use super::traits::{SecretStore, SecretStoreResult};", "docs": "", "attributes": "", "line": 53 }, { "name": "pub use super::variable_resolver::{InMemoryVariableResolver, VariableResolver};", "kind": "use_declaration", "signature": "pub use super::variable_resolver::{InMemoryVariableResolver, VariableResolver};", "docs": "", "attributes": "", "line": 54 } ], "parseErrors": false }, { "module": "consent_store", "source": "arsenal/crates/arsenal-store/src/consent_store.rs", "sha256": "3c5a1606ecd36ea252f54a56d288b95864e895588b58701a11e1cf06c22ed07c", "attributes": "", "items": [ { "name": "consent_store::ConsentStoreResult", "kind": "type_item", "signature": "pub type ConsentStoreResult = Result;", "docs": "Result type for consent store operations", "attributes": "", "line": 22 }, { "name": "consent_store::ConsentStore", "kind": "trait_item", "signature": "pub trait ConsentStore: Send + Sync {\n /// Store a new consent record\n fn store_consent<'a>(\n &'a self,\n record: ConsentRecord,\n ) -> Pin> + Send + 'a>>;\n\n /// Get a consent record by ID\n fn get_consent<'a>(\n &'a self,\n consent_id: &'a ConsentId,\n ) -> Pin>> + Send + 'a>>;\n\n /// Find a valid consent record for an agent and variable\n fn find_consent<'a>(\n &'a self,\n agent_did: &'a str,\n variable: &'a str,\n ) -> Pin>> + Send + 'a>>;\n\n /// Revoke a consent record\n fn revoke_consent<'a>(\n &'a self,\n consent_id: &'a ConsentId,\n ) -> Pin> + Send + 'a>>;\n\n /// List all consent records for an agent\n fn list_consents<'a>(\n &'a self,\n agent_did: &'a str,\n ) -> Pin>> + Send + 'a>>;\n\n /// Remove expired consent records, returning the count removed\n fn cleanup_expired<'a>(\n &'a self,\n ) -> Pin> + Send + 'a>>;\n}", "docs": "Trait for consent record storage backends", "attributes": "", "line": 25 }, { "name": "consent_store::InMemoryConsentStore", "kind": "struct_item", "signature": "pub struct InMemoryConsentStore {\n\n}", "docs": "In-memory consent store for development and testing", "attributes": "#[derive(Debug, Clone)]", "line": 65 }, { "name": "consent_store::InMemoryConsentStore::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Create a new empty in-memory consent store", "attributes": "#[must_use]", "line": 72 }, { "name": "consent_store::SqlConsentStore", "kind": "struct_item", "signature": "pub struct SqlConsentStore {\n\n}", "docs": "SQL-backed consent store (Postgres/SQLite) using `sqlx`.", "attributes": "#[cfg(any(feature = \"sqlite\", feature = \"postgres\"))]", "line": 180 }, { "name": "consent_store::SqlConsentStore::connect", "kind": "function_item", "signature": "pub async fn connect(\n database_url: &str,\n table: String,\n max_connections: u32,\n connect_timeout: std::time::Duration,\n ) -> ConsentStoreResult;", "docs": "Create a new SQL-backed consent store and ensure schema exists.\n\n# Errors\nReturns an error if the database cannot be reached or schema init fails.", "attributes": "#[cfg(any(feature = \"sqlite\", feature = \"postgres\"))]", "line": 242 } ], "parseErrors": false }, { "module": "encrypted_file", "source": "arsenal/crates/arsenal-store/src/encrypted_file.rs", "sha256": "7f84dce81d01e01ff29bd839b8362ee2194ad47c3fa27557dc45e5ad7c9a09eb", "attributes": "", "items": [ { "name": "encrypted_file::EncryptedFileStore", "kind": "struct_item", "signature": "pub struct EncryptedFileStore {\n\n}", "docs": "Encrypted file-based secret store", "attributes": "", "line": 27 }, { "name": "encrypted_file::EncryptedFileStore::new", "kind": "function_item", "signature": "pub async fn new(\n base_dir: impl AsRef,\n key_wrapper: Arc,\n ) -> SecretStoreResult;", "docs": "Create a new encrypted file store\n\n# Errors\nReturns an error if the directory cannot be created", "attributes": "", "line": 61 }, { "name": "encrypted_file::EncryptedFileStore::without_cache", "kind": "function_item", "signature": "pub fn without_cache(mut self) -> Self;", "docs": "Disable caching (useful for testing)", "attributes": "#[must_use]", "line": 82 }, { "name": "encrypted_file::EncryptedFileStore::load_cache", "kind": "function_item", "signature": "pub async fn load_cache(&self, tenant_id: &TenantId) -> SecretStoreResult<()>;", "docs": "Load metadata cache from disk\n\n# Errors\nReturns an error if reading from disk fails", "attributes": "", "line": 225 } ], "parseErrors": false }, { "module": "fingerprint_store", "source": "arsenal/crates/arsenal-store/src/fingerprint_store.rs", "sha256": "4aac1a706971c702a45d583a81089130863c80ba0a0614eb7b58d0dc6056959e", "attributes": "", "items": [ { "name": "fingerprint_store::FingerprintStoreResult", "kind": "type_item", "signature": "pub type FingerprintStoreResult = Result;", "docs": "Result type for fingerprint store operations", "attributes": "", "line": 19 }, { "name": "fingerprint_store::FingerprintStore", "kind": "trait_item", "signature": "pub trait FingerprintStore: Send + Sync {\n /// Get the fingerprint state for an agent\n fn get_state<'a>(\n &'a self,\n agent_did: &'a str,\n ) -> Pin>> + Send + 'a>>;\n\n /// Create or update the fingerprint state for an agent\n fn update_state<'a>(\n &'a self,\n agent_did: &'a str,\n state: FingerprintState,\n ) -> Pin> + Send + 'a>>;\n\n /// Delete the fingerprint state for an agent\n fn delete_state<'a>(\n &'a self,\n agent_did: &'a str,\n ) -> Pin> + Send + 'a>>;\n\n /// Reset the fingerprint state for an agent (delete and recreate)\n fn reset_state<'a>(\n &'a self,\n agent_did: &'a str,\n new_state: FingerprintState,\n ) -> Pin> + Send + 'a>>;\n}", "docs": "Trait for fingerprint state storage backends", "attributes": "", "line": 22 }, { "name": "fingerprint_store::InMemoryFingerprintStore", "kind": "struct_item", "signature": "pub struct InMemoryFingerprintStore {\n\n}", "docs": "In-memory fingerprint store for development and testing", "attributes": "#[derive(Debug, Clone)]", "line": 52 }, { "name": "fingerprint_store::InMemoryFingerprintStore::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Create a new empty in-memory fingerprint store", "attributes": "#[must_use]", "line": 59 }, { "name": "fingerprint_store::SqlFingerprintStore", "kind": "struct_item", "signature": "pub struct SqlFingerprintStore {\n\n}", "docs": "SQL-backed fingerprint state store (Postgres / `SQLite`) using `sqlx`.\n\nMirrors the pattern established by `SqlRevocationStore` in `arsenal-broker`.", "attributes": "#[cfg(any(feature = \"sqlite\", feature = \"postgres\"))]", "line": 136 }, { "name": "fingerprint_store::SqlFingerprintStore::connect", "kind": "function_item", "signature": "pub async fn connect(\n database_url: &str,\n table: String,\n max_connections: u32,\n connect_timeout: std::time::Duration,\n ) -> Result;", "docs": "Create a new SQL-backed fingerprint store and ensure the schema exists.\n\n# Errors\nReturns an error if the database cannot be reached or schema creation fails.", "attributes": "#[cfg(any(feature = \"sqlite\", feature = \"postgres\"))]", "line": 180 } ], "parseErrors": false }, { "module": "key_resolver", "source": "arsenal/crates/arsenal-store/src/key_resolver.rs", "sha256": "6fab98ceac09d802887f16520ce1f1d4c030124a181c530a2c17e11befef58a8", "attributes": "", "items": [ { "name": "key_resolver::PublicKeyResolver", "kind": "trait_item", "signature": "pub trait PublicKeyResolver: Send + Sync {\n /// Look up the public signing key for a given DID.\n ///\n /// Returns `Ok(Some(key))` if found, `Ok(None)` if not found,\n /// or an error if the resolution process itself fails.\n fn resolve_public_key(\n &self,\n did: &str,\n ) -> Pin>> + Send + '_>>;\n}", "docs": "Resolves a DID (Decentralized Identifier) to a public signing key.\n\nImplementations may resolve keys from local storage, DID documents,\nor remote key servers.", "attributes": "", "line": 19 }, { "name": "key_resolver::InMemoryKeyResolver", "kind": "struct_item", "signature": "pub struct InMemoryKeyResolver {\n\n}", "docs": "In-memory public key resolver for testing and development.", "attributes": "#[derive(Debug, Clone)]", "line": 32 }, { "name": "key_resolver::InMemoryKeyResolver::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Create an empty resolver.", "attributes": "#[must_use]", "line": 40 }, { "name": "key_resolver::InMemoryKeyResolver::register", "kind": "function_item", "signature": "pub async fn register(&self, did: &str, key: PublicSigningKey);", "docs": "Register a public key for a DID.", "attributes": "", "line": 47 } ], "parseErrors": false }, { "module": "key_wrapper", "source": "arsenal/crates/arsenal-store/src/key_wrapper.rs", "sha256": "dfd726b12e16e9c9fe04621c2784e80f7aa16ac08a0076fe2817c195ca0b6259", "attributes": "", "items": [ { "name": "key_wrapper::KeyWrapper", "kind": "trait_item", "signature": "pub trait KeyWrapper: Send + Sync {\n /// Wrap a key\n fn wrap<'a>(\n &'a self,\n key_id: &'a str,\n plaintext_key: &'a [u8],\n ) -> Pin> + Send + 'a>>;\n\n /// Unwrap a key\n fn unwrap<'a>(\n &'a self,\n wrapped: &'a WrappedKeyData,\n ) -> Pin, SecretStoreError>> + Send + 'a>>;\n\n /// Get the wrapper's key ID\n fn key_id(&self) -> &str;\n\n /// Check if this wrapper can unwrap data wrapped by the given key ID\n fn can_unwrap(&self, key_id: &str) -> bool ;\n}", "docs": "Trait for key wrapping operations\n\nImplementations can use software encryption, HSM, KMS, etc.", "attributes": "", "line": 21 }, { "name": "key_wrapper::WrappedKeyData", "kind": "struct_item", "signature": "pub struct WrappedKeyData {\n/// The encrypted key\n\npub ciphertext: Vec,\n/// Nonce used for encryption\n\npub nonce: Vec,\n/// ID of the wrapping key\n\npub wrapper_key_id: String,\n/// Algorithm used\n\npub algorithm: String\n}", "docs": "Wrapped key data", "attributes": "#[derive(Clone, serde::Serialize, serde::Deserialize)]", "line": 46 }, { "name": "key_wrapper::SoftwareKeyWrapper", "kind": "struct_item", "signature": "pub struct SoftwareKeyWrapper {\n\n}", "docs": "Software-based key wrapper using XChaCha20-Poly1305", "attributes": "", "line": 68 }, { "name": "key_wrapper::SoftwareKeyWrapper::new", "kind": "function_item", "signature": "pub fn new(kek_bytes: [u8; 32], key_id: impl Into) -> Self;", "docs": "Create a new software key wrapper", "attributes": "", "line": 77 }, { "name": "key_wrapper::SoftwareKeyWrapper::generate", "kind": "function_item", "signature": "pub fn generate(key_id: impl Into) -> Result;", "docs": "Create with a randomly generated KEK\n\n# Errors\nReturns an error if random generation fails", "attributes": "", "line": 88 }, { "name": "key_wrapper::SoftwareKeyWrapper::export_kek", "kind": "function_item", "signature": "pub fn export_kek(&self) -> [u8; 32];", "docs": "Export the KEK (for backup - handle with extreme care!)", "attributes": "#[must_use]", "line": 95 }, { "name": "key_wrapper::MultiKeyWrapper", "kind": "struct_item", "signature": "pub struct MultiKeyWrapper {\n\n}", "docs": "Multi-key wrapper that supports multiple KEKs for rotation", "attributes": "", "line": 148 }, { "name": "key_wrapper::MultiKeyWrapper::new", "kind": "function_item", "signature": "pub fn new(current: Arc) -> Self;", "docs": "Create a new multi-key wrapper", "attributes": "", "line": 157 }, { "name": "key_wrapper::MultiKeyWrapper::add_previous", "kind": "function_item", "signature": "pub fn add_previous(&mut self, wrapper: Arc);", "docs": "Add a previous wrapper (for key rotation)", "attributes": "", "line": 165 }, { "name": "key_wrapper::MultiKeyWrapper::rotate", "kind": "function_item", "signature": "pub fn rotate(&mut self, new_wrapper: Arc);", "docs": "Rotate to a new primary wrapper", "attributes": "", "line": 170 }, { "name": "key_wrapper::MultiKeyWrapper::current_key_id", "kind": "function_item", "signature": "pub fn current_key_id(&self) -> &str;", "docs": "Get the current wrapper's key ID", "attributes": "#[must_use]", "line": 182 }, { "name": "key_wrapper::DerivedKeyWrapper", "kind": "struct_item", "signature": "pub struct DerivedKeyWrapper {\n\n}", "docs": "Derived key wrapper that derives KEKs from a master key", "attributes": "", "line": 231 }, { "name": "key_wrapper::DerivedKeyWrapper::new", "kind": "function_item", "signature": "pub fn new(master_key: [u8; 32], key_id_prefix: impl Into) -> Self;", "docs": "Create a new derived key wrapper", "attributes": "", "line": 240 } ], "parseErrors": false }, { "module": "memory", "source": "arsenal/crates/arsenal-store/src/memory.rs", "sha256": "c2c9de33edaacd6480db7b26b298e44a069345ddf0b89dab31e8d1e3cc511459", "attributes": "", "items": [ { "name": "memory::InMemorySecretStore", "kind": "struct_item", "signature": "pub struct InMemorySecretStore {\n\n}", "docs": "In-memory secret store", "attributes": "", "line": 22 }, { "name": "memory::InMemorySecretStore::new", "kind": "function_item", "signature": "pub fn new() -> SecretStoreResult;", "docs": "Create a new in-memory store with a random encryption key\n\n# Errors\nReturns an error if key generation fails", "attributes": "", "line": 44 }, { "name": "memory::InMemorySecretStore::with_key", "kind": "function_item", "signature": "pub fn with_key(key_bytes: [u8; 32]) -> Self;", "docs": "Create with a specific encryption key", "attributes": "#[must_use]", "line": 56 }, { "name": "memory::InMemorySecretStore::clear", "kind": "function_item", "signature": "pub async fn clear(&self);", "docs": "Clear all secrets (for testing)", "attributes": "", "line": 96 }, { "name": "memory::InMemorySecretStore::count", "kind": "function_item", "signature": "pub async fn count(&self, tenant_id: &TenantId) -> usize;", "docs": "Get count of secrets", "attributes": "", "line": 102 } ], "parseErrors": false }, { "module": "traits", "source": "arsenal/crates/arsenal-store/src/traits.rs", "sha256": "f1e8cf49bdd881de6ca0f5bb1ae623cd2dbccf466665c1f375de947185c28ac3", "attributes": "", "items": [ { "name": "traits::SecretStoreResult", "kind": "type_item", "signature": "pub type SecretStoreResult = Result;", "docs": "Result type for secret store operations", "attributes": "", "line": 16 }, { "name": "traits::SecretStoreError", "kind": "enum_item", "signature": "pub enum SecretStoreError {\n /// Secret not found\n #[error(\"Secret not found: {0}\")]\n NotFound(String),\n\n /// Secret version not found\n #[error(\"Secret version not found: {0} v{1}\")]\n VersionNotFound(String, u64),\n\n /// Secret already exists\n #[error(\"Secret already exists: {0}\")]\n AlreadyExists(String),\n\n /// Access denied\n #[error(\"Access denied: {0}\")]\n AccessDenied(String),\n\n /// Storage backend error\n #[error(\"Storage error: {0}\")]\n StorageError(String),\n\n /// Encryption error\n #[error(\"Encryption error: {0}\")]\n EncryptionError(String),\n\n /// Validation error\n #[error(\"Validation error: {0}\")]\n ValidationError(String),\n\n /// Configuration error\n #[error(\"Configuration error: {0}\")]\n ConfigurationError(String),\n\n /// Wrapped arsenal error\n #[error(transparent)]\n Arsenal(#[from] ArsenalError),\n}", "docs": "Errors specific to secret storage", "attributes": "#[derive(Debug, thiserror::Error)]", "line": 20 }, { "name": "traits::SecretStoreError::not_found", "kind": "function_item", "signature": "pub fn not_found(id: impl Into) -> Self;", "docs": "Create a not found error", "attributes": "", "line": 60 }, { "name": "traits::SecretStoreError::storage", "kind": "function_item", "signature": "pub fn storage(msg: impl Into) -> Self;", "docs": "Create a storage error", "attributes": "", "line": 65 }, { "name": "traits::SecretStoreError::encryption", "kind": "function_item", "signature": "pub fn encryption(msg: impl Into) -> Self;", "docs": "Create an encryption error", "attributes": "", "line": 70 }, { "name": "traits::SecretStoreError::validation", "kind": "function_item", "signature": "pub fn validation(msg: impl Into) -> Self;", "docs": "Create a validation error", "attributes": "", "line": 75 }, { "name": "traits::SecretStoreError::is_not_found", "kind": "function_item", "signature": "pub fn is_not_found(&self) -> bool;", "docs": "Check if this is a not found error", "attributes": "#[must_use]", "line": 81 }, { "name": "traits::SecretStore", "kind": "trait_item", "signature": "pub trait SecretStore: Send + Sync {\n /// Create a new secret\n fn create<'a>(\n &'a self,\n tenant_id: &'a TenantId,\n name: &'a str,\n secret_type: SecretType,\n value: SecretValue,\n ) -> Pin> + Send + 'a>>;\n\n /// Get secret metadata (without the value)\n fn get_metadata<'a>(\n &'a self,\n tenant_id: &'a TenantId,\n secret_id: &'a SecretId,\n ) -> Pin> + Send + 'a>>;\n\n /// Get a secret value\n fn get_value<'a>(\n &'a self,\n tenant_id: &'a TenantId,\n secret_ref: &'a SecretRef,\n ) -> Pin> + Send + 'a>>;\n\n /// Update a secret (creates a new version)\n fn update<'a>(\n &'a self,\n tenant_id: &'a TenantId,\n secret_id: &'a SecretId,\n new_value: SecretValue,\n ) -> Pin> + Send + 'a>>;\n\n /// Delete a secret (all versions)\n fn delete<'a>(\n &'a self,\n tenant_id: &'a TenantId,\n secret_id: &'a SecretId,\n ) -> Pin> + Send + 'a>>;\n\n /// List secrets for a tenant\n fn list<'a>(\n &'a self,\n tenant_id: &'a TenantId,\n filter: Option<&'a SecretFilter>,\n ) -> Pin>> + Send + 'a>>;\n\n /// Disable a specific version\n fn disable_version<'a>(\n &'a self,\n tenant_id: &'a TenantId,\n secret_id: &'a SecretId,\n version: SecretVersion,\n ) -> Pin> + Send + 'a>>;\n\n /// Check if a secret exists\n fn exists<'a>(\n &'a self,\n tenant_id: &'a TenantId,\n secret_id: &'a SecretId,\n ) -> Pin> + Send + 'a>>;\n}", "docs": "Trait for secret storage backends\n\nAll methods async to support both local and remote backends.", "attributes": "", "line": 89 }, { "name": "traits::SecretFilter", "kind": "struct_item", "signature": "pub struct SecretFilter {\n/// Filter by secret type\n\npub secret_type: Option,\n/// Filter by name prefix\n\npub name_prefix: Option,\n/// Filter by service\n\npub service: Option,\n/// Filter by label key\n\npub label_key: Option,\n/// Filter by label value (requires `label_key`)\n\npub label_value: Option,\n/// Only active secrets\n\npub active_only: bool,\n/// Maximum results\n\npub limit: Option,\n/// Offset for pagination\n\npub offset: Option\n}", "docs": "Filter for listing secrets", "attributes": "#[derive(Debug, Clone, Default)]", "line": 153 }, { "name": "traits::SecretFilter::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Create a new filter", "attributes": "#[must_use]", "line": 175 }, { "name": "traits::SecretFilter::with_type", "kind": "function_item", "signature": "pub fn with_type(mut self, secret_type: SecretType) -> Self;", "docs": "Filter by secret type", "attributes": "#[must_use]", "line": 181 }, { "name": "traits::SecretFilter::with_name_prefix", "kind": "function_item", "signature": "pub fn with_name_prefix(mut self, prefix: impl Into) -> Self;", "docs": "Filter by name prefix", "attributes": "#[must_use]", "line": 188 }, { "name": "traits::SecretFilter::with_service", "kind": "function_item", "signature": "pub fn with_service(mut self, service: impl Into) -> Self;", "docs": "Filter by service", "attributes": "#[must_use]", "line": 195 }, { "name": "traits::SecretFilter::active_only", "kind": "function_item", "signature": "pub fn active_only(mut self) -> Self;", "docs": "Only active secrets", "attributes": "#[must_use]", "line": 202 }, { "name": "traits::SecretFilter::with_limit", "kind": "function_item", "signature": "pub fn with_limit(mut self, limit: usize) -> Self;", "docs": "Set limit", "attributes": "#[must_use]", "line": 209 }, { "name": "traits::SecretFilter::with_offset", "kind": "function_item", "signature": "pub fn with_offset(mut self, offset: usize) -> Self;", "docs": "Set offset", "attributes": "#[must_use]", "line": 216 }, { "name": "traits::SecretFilter::matches", "kind": "function_item", "signature": "pub fn matches(&self, metadata: &SecretMetadata) -> bool;", "docs": "Check if a secret matches this filter", "attributes": "#[must_use]", "line": 223 }, { "name": "traits::SecretStoreStats", "kind": "struct_item", "signature": "pub struct SecretStoreStats {\n/// Total number of secrets\n\npub total_secrets: u64,\n/// Number of active secrets\n\npub active_secrets: u64,\n/// Total number of versions across all secrets\n\npub total_versions: u64,\n/// Number of secrets needing rotation\n\npub needs_rotation: u64,\n/// Storage size in bytes (if available)\n\npub storage_bytes: Option\n}", "docs": "Statistics about the secret store", "attributes": "#[derive(Debug, Clone, Default)]", "line": 271 }, { "name": "traits::SecretStoreExt", "kind": "trait_item", "signature": "pub trait SecretStoreExt: SecretStore {\n /// Get store statistics\n fn stats<'a>(\n &'a self,\n tenant_id: &'a TenantId,\n ) -> Pin> + Send + 'a>>;\n\n /// Find secrets by name\n fn find_by_name<'a>(\n &'a self,\n tenant_id: &'a TenantId,\n name: &'a str,\n ) -> Pin>> + Send + 'a>>;\n\n /// Rotate a secret (convenience method)\n fn rotate<'a>(\n &'a self,\n tenant_id: &'a TenantId,\n secret_id: &'a SecretId,\n new_value: SecretValue,\n ) -> Pin> + Send + 'a>> ;\n}", "docs": "Extended secret store trait with additional operations", "attributes": "", "line": 285 } ], "parseErrors": false }, { "module": "variable_resolver", "source": "arsenal/crates/arsenal-store/src/variable_resolver.rs", "sha256": "d20f8680464033e18d84d462ef627d5ab542791643cc94740744a31f9016ebff", "attributes": "", "items": [ { "name": "variable_resolver::VariableResolverResult", "kind": "type_item", "signature": "pub type VariableResolverResult = Result;", "docs": "Result type for variable resolver operations", "attributes": "", "line": 21 }, { "name": "variable_resolver::VariableMappings", "kind": "type_item", "signature": "pub type VariableMappings = BTreeMap;", "docs": "Variable mappings (variable name -> secret reference)", "attributes": "", "line": 24 }, { "name": "variable_resolver::VariableResolver", "kind": "trait_item", "signature": "pub trait VariableResolver: Send + Sync {\n /// Resolve a variable name to a secret reference\n fn resolve<'a>(\n &'a self,\n tenant_id: &'a TenantId,\n variable: &'a str,\n ) -> Pin>> + Send + 'a>>;\n\n /// Register a variable-to-secret mapping\n fn register<'a>(\n &'a self,\n tenant_id: &'a TenantId,\n variable: &'a str,\n secret_ref: SecretRef,\n ) -> Pin> + Send + 'a>>;\n\n /// Remove a variable mapping\n fn unregister<'a>(\n &'a self,\n tenant_id: &'a TenantId,\n variable: &'a str,\n ) -> Pin> + Send + 'a>>;\n\n /// List all variable mappings for a tenant\n fn list<'a>(\n &'a self,\n tenant_id: &'a TenantId,\n ) -> Pin> + Send + 'a>>;\n}", "docs": "Trait for template variable resolution backends", "attributes": "", "line": 27 }, { "name": "variable_resolver::InMemoryVariableResolver", "kind": "struct_item", "signature": "pub struct InMemoryVariableResolver {\n\n}", "docs": "In-memory variable resolver for development and testing", "attributes": "#[derive(Debug, Clone)]", "line": 59 }, { "name": "variable_resolver::InMemoryVariableResolver::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Create a new empty in-memory variable resolver", "attributes": "#[must_use]", "line": 67 }, { "name": "variable_resolver::SqlVariableResolver", "kind": "struct_item", "signature": "pub struct SqlVariableResolver {\n\n}", "docs": "SQL-backed variable resolver (Postgres / `SQLite`) using `sqlx`.\n\nStores variable-to-secret mappings in a SQL table with the `SecretRef`\nserialized as JSON TEXT. Follows the same dual-pool pattern as\n`SqlRevocationStore` in arsenal-broker.", "attributes": "#[cfg(any(feature = \"sqlite\", feature = \"postgres\"))]", "line": 157 }, { "name": "variable_resolver::SqlVariableResolver::connect", "kind": "function_item", "signature": "pub async fn connect(\n database_url: &str,\n table: String,\n max_connections: u32,\n connect_timeout: std::time::Duration,\n ) -> VariableResolverResult;", "docs": "Create a new SQL-backed variable resolver and ensure the schema exists.\n\n# Errors\nReturns an error if the database cannot be reached or schema init fails.", "attributes": "#[cfg(any(feature = \"sqlite\", feature = \"postgres\"))]", "line": 201 } ], "parseErrors": false } ] }, { "name": "oas-anchor-eas", "url": "/reference/rust/oas-anchor-eas", "modules": [ { "module": "crate", "source": "oas/oas/oas-anchor-eas/src/lib.rs", "sha256": "e7376745ce2cffd53d2c9f3cf749659adda88ebdb14f08c69180db258380d5f7", "attributes": "", "items": [ { "name": "abi", "kind": "module", "signature": "pub mod abi;", "docs": "`oas-anchor-eas` \u2014 Ethereum Attestation Service (EAS) adapter for the\nOAS [`oas_resolve::LineageAnchor`] trait.\n\n# What this adapter is (and is not)\n\nThis crate is the **resolver**: the verifier-side path that reads lineage\nauthority from EAS. Root anchors are attestations under a dedicated OAS\nlineage schema; revocation and status changes are newer attestations\nsuperseding older ones for the same subject.\n\nPublishing (writing anchors) is the issuer-side path and lives in the\nTypeScript adapter (`@openagentid/anchor-eas`), which uses the maintained\nEAS SDK for transaction signing and submission. Writing transactions\ncorrectly \u2014 RLP encoding, EIP-1559 fees, replacement semantics \u2014 is a\nproblem best left to the maintained SDK; this crate deliberately does\nnot hand-roll it.\n\n# The anchoring model\n\n- **Schema**: [`abi::SCHEMA_STRING`] registered on EAS; its UID is\n configuration, not code, because a schema UID is per-chain.\n- **Recipient**: attestations are addressed to a deterministic address\n derived from the subject DID (`did_recipient`): BLAKE3 of the DID's\n UTF-8 bytes, first 20 bytes. That makes \"all attestations about this\n DID\" an exact-match GraphQL query without a server-side index.\n- **Supersession**: the latest attestation for a subject wins. A\n `status: \"revoked\"` attestation, or a revoked latest attestation,\n means the subject is revoked.\n- **Finality**: `current_finalized_block` is `eth_blockNumber` minus\n the configured confirmation depth, so \"finalized\" is a policy knob,\n not a hardcoded number.\n- **Org roots**: not modeled in v1. `get_org_root` returns `None`, so\n rule 7 (org Merkle inclusion) is skipped against this backend \u2014 the\n honest answer rather than a wrong one.", "attributes": "", "line": 36 }, { "name": "eas", "kind": "module", "signature": "pub mod eas;", "docs": "", "attributes": "", "line": 37 }, { "name": "error", "kind": "module", "signature": "pub mod error;", "docs": "", "attributes": "", "line": 38 }, { "name": "pub use eas::{did_recipient, EasAnchor, EasConfig};", "kind": "use_declaration", "signature": "pub use eas::{did_recipient, EasAnchor, EasConfig};", "docs": "", "attributes": "", "line": 40 }, { "name": "pub use error::EasError;", "kind": "use_declaration", "signature": "pub use error::EasError;", "docs": "", "attributes": "", "line": 41 } ], "parseErrors": false }, { "module": "abi", "source": "oas/oas/oas-anchor-eas/src/abi.rs", "sha256": "26b9f9f5b77b3394ff5ee5889295e3b39445082cf2ac9d8652c97b23ad1ac7ff", "attributes": "", "items": [ { "name": "abi::SCHEMA_STRING", "kind": "const_item", "signature": "pub const SCHEMA_STRING: &str;", "docs": "", "attributes": "", "line": 17 }, { "name": "abi::AnchorData", "kind": "struct_item", "signature": "pub struct AnchorData {\npub did: String,\npub kind: String,\npub status: String,\npub metadata_commitment: String,\npub anchored_at_block: u64\n}", "docs": "The attestation's decoded data fields.", "attributes": "#[derive(Debug, Clone, PartialEq, Eq)]", "line": 22 }, { "name": "abi::encode", "kind": "function_item", "signature": "pub fn encode(data: &AnchorData) -> Vec;", "docs": "ABI-encode the anchor data for an `attest` call.", "attributes": "", "line": 49 }, { "name": "abi::decode", "kind": "function_item", "signature": "pub fn decode(data: &[u8]) -> Result;", "docs": "ABI-decode an attestation's data field.", "attributes": "", "line": 125 } ], "parseErrors": false }, { "module": "eas", "source": "oas/oas/oas-anchor-eas/src/eas.rs", "sha256": "78657c38a52d183f2665b0c1ec30057c5f505bbd627f57fdbc62775a669efd50", "attributes": "", "items": [ { "name": "eas::MAINNET_GRAPHQL", "kind": "const_item", "signature": "pub const MAINNET_GRAPHQL: &str;", "docs": "Default GraphQL endpoints by network name.", "attributes": "", "line": 10 }, { "name": "eas::SEPOLIA_GRAPHQL", "kind": "const_item", "signature": "pub const SEPOLIA_GRAPHQL: &str;", "docs": "Sepolia GraphQL endpoint.", "attributes": "", "line": 12 }, { "name": "eas::did_recipient", "kind": "function_item", "signature": "pub fn did_recipient(did: &str) -> String;", "docs": "Derive the deterministic recipient address for a subject DID: the first\n20 bytes of the BLAKE3 digest of the DID's UTF-8 bytes.\n\nAttestations about a DID are addressed to this recipient, which makes\n\"every attestation about this subject\" an exact-match GraphQL query\nwithout a server-side index. This mapping is normative: publishers and\nresolvers MUST use the same derivation.", "attributes": "", "line": 21 }, { "name": "eas::EasConfig", "kind": "struct_item", "signature": "pub struct EasConfig {\n/// The OAS lineage schema UID on this chain. Per-chain; never hardcoded\n\n/// as a global constant because schema registration is per deployment.\n\npub schema_uid: String,\n/// EAS GraphQL endpoint.\n\npub graphql_url: String,\n/// Chain JSON-RPC endpoint (for `eth_blockNumber`).\n\npub rpc_url: String,\n/// Confirmations subtracted from the head to define \"finalized\".\n\npub confirmation_depth: u64\n}", "docs": "Configuration for an [`EasAnchor`].", "attributes": "#[derive(Debug, Clone)]", "line": 29 }, { "name": "eas::EasConfig::mainnet", "kind": "function_item", "signature": "pub fn mainnet(schema_uid: impl Into, rpc_url: impl Into) -> Self;", "docs": "A mainnet-shaped config (schema UID still required).", "attributes": "", "line": 43 }, { "name": "eas::EasConfig::sepolia", "kind": "function_item", "signature": "pub fn sepolia(schema_uid: impl Into, rpc_url: impl Into) -> Self;", "docs": "A Sepolia-shaped config.", "attributes": "", "line": 53 }, { "name": "eas::EasAnchor", "kind": "struct_item", "signature": "pub struct EasAnchor {\n\n}", "docs": "The EAS adapter: implements [`LineageAnchor`] over EAS GraphQL plus\nJSON-RPC finality.", "attributes": "", "line": 65 }, { "name": "eas::EasAnchor::new", "kind": "function_item", "signature": "pub fn new(config: EasConfig) -> Result;", "docs": "Build the adapter.\n\n# Errors\n\nReturns an error if the HTTP client cannot be constructed, or if the\nschema UID is blank.", "attributes": "", "line": 77 }, { "name": "eas::EasAnchor::config", "kind": "function_item", "signature": "pub fn config(&self) -> &EasConfig;", "docs": "The configuration this anchor was built with.", "attributes": "", "line": 91 } ], "parseErrors": false }, { "module": "error", "source": "oas/oas/oas-anchor-eas/src/error.rs", "sha256": "82d4d9420b8634bd02ed098d756ec061b168e538b67a44e38806665192875b4b", "attributes": "", "items": [ { "name": "error::EasError", "kind": "enum_item", "signature": "pub enum EasError {\n /// GraphQL or JSON-RPC transport failure.\n #[error(\"eas transport error: {0}\")]\n Transport(String),\n\n /// The backend returned a structurally invalid record or an unexpected\n /// response shape.\n #[error(\"invalid eas record: {0}\")]\n InvalidRecord(String),\n\n /// ABI encode/decode failure for attestation data.\n #[error(\"eas abi error: {0}\")]\n Abi(String),\n}", "docs": "Error types for the EAS anchor adapter.\nErrors returned by the EAS adapter. Mapped into `oas_resolve::AnchorError`\nat the trait boundary.", "attributes": "#[derive(Debug, thiserror::Error)]", "line": 6 } ], "parseErrors": false } ] }, { "name": "oas-attestation", "url": "/reference/rust/oas-attestation", "modules": [ { "module": "crate", "source": "oas/oas/oas-attestation/src/lib.rs", "sha256": "7effa9fd9902e4f2a6dfbb5e56081f02fd2f4eb2f75299648ce58a5cb9c64078", "attributes": "", "items": [ { "name": "credential", "kind": "module", "signature": "pub mod credential;", "docs": "# oas-attestation\n\nW3C Verifiable Credential attestation support for the Open Agent Specification (OAS).\n\nThis crate implements OAS Specification \u00a713 \u2014 Attestation Integration, providing\ncreation, signing, and verification of attestations about autonomous entities.\n\n## Key Types\n\n- [`OasCredential`](credential::OasCredential) \u2014 W3C VC with OAS constraints\n- [`AttestationType`](types::AttestationType) \u2014 The six standard attestation types\n- [`CredentialProof`](credential::CredentialProof) \u2014 Ed25519Signature2020 proof\n- [`AttestationError`] \u2014 Attestation-specific errors\n\n## Attestation Types (\u00a713.2)\n\n| Type | Description |\n|------|-------------|\n| `SecurityAudit` | Results of security analysis |\n| `BehaviorAttestation` | Observed runtime behavior |\n| `CapabilityVerification` | Capability verification results |\n| `ComplianceAttestation` | Regulatory compliance |\n| `ExpertEndorsement` | Domain expert endorsement |\n| `CommunityReview` | Community-sourced review |\n\n## Example\n\n```\nuse oas_attestation::credential::OasCredential;\nuse oas_attestation::types::AttestationType;\nuse oas_attestation::sign::sign_credential;\nuse oas_attestation::verify::verify_credential;\nuse oas_crypto::keypair::OasKeyPair;\n\n// Build a credential\nlet keypair = OasKeyPair::generate();\nlet cred = OasCredential::builder()\n .issuer(\"did:oas:test:hmr:auditor\")\n .subject_id(\"did:oas:test:agent:target\")\n .attestation_type(AttestationType::SecurityAudit)\n .issuance_date(\"2026-01-15T00:00:00Z\")\n .subject_claim(\"auditType\", serde_json::json!(\"codeAudit\"))\n .subject_claim(\"result\", serde_json::json!(\"pass\"))\n .subject_claim(\"severityFindings\", serde_json::json!({\"critical\": 0}))\n .subject_claim(\"toolOrMethodology\", serde_json::json!(\"OWASP\"))\n .subject_claim(\"auditDate\", serde_json::json!(\"2026-01-15T00:00:00Z\"))\n .build()\n .unwrap();\n\n// Sign it\nlet signed = sign_credential(\n &cred, &keypair,\n \"did:oas:test:hmr:auditor#key-1\",\n \"2026-01-15T00:00:00Z\",\n).unwrap();\n\n// Verify it\nlet result = verify_credential(&signed, &keypair.verifying_key_bytes());\nassert!(result.is_ok());\n```", "attributes": "", "line": 62 }, { "name": "data_integrity_2025", "kind": "module", "signature": "pub mod data_integrity_2025;", "docs": "", "attributes": "", "line": 63 }, { "name": "error", "kind": "module", "signature": "pub mod error;", "docs": "", "attributes": "", "line": 64 }, { "name": "lineage_vc", "kind": "module", "signature": "pub mod lineage_vc;", "docs": "", "attributes": "", "line": 65 }, { "name": "oid4vp", "kind": "module", "signature": "pub mod oid4vp;", "docs": "", "attributes": "", "line": 66 }, { "name": "presentation", "kind": "module", "signature": "pub mod presentation;", "docs": "", "attributes": "", "line": 67 }, { "name": "proof_formats", "kind": "module", "signature": "pub mod proof_formats;", "docs": "", "attributes": "", "line": 68 }, { "name": "sd_jwt_vc", "kind": "module", "signature": "pub mod sd_jwt_vc;", "docs": "", "attributes": "", "line": 69 }, { "name": "sign", "kind": "module", "signature": "pub mod sign;", "docs": "", "attributes": "", "line": 70 }, { "name": "signer", "kind": "module", "signature": "pub mod signer;", "docs": "", "attributes": "", "line": 71 }, { "name": "types", "kind": "module", "signature": "pub mod types;", "docs": "", "attributes": "", "line": 72 }, { "name": "vc_jose", "kind": "module", "signature": "pub mod vc_jose;", "docs": "", "attributes": "", "line": 73 }, { "name": "verify", "kind": "module", "signature": "pub mod verify;", "docs": "", "attributes": "", "line": 74 }, { "name": "pub use credential::ContextMode;", "kind": "use_declaration", "signature": "pub use credential::ContextMode;", "docs": "", "attributes": "", "line": 76 }, { "name": "pub use data_integrity_2025::{\n algorithm_to_cryptosuite, cryptosuite_to_algorithm, sign_credential_data_integrity,\n verify_credential_data_integrity, CRYPTOSUITE_BBS_2023, CRYPTOSUITE_ECDSA_2019,\n CRYPTOSUITE_EDDSA_2022, DATA_INTEGRITY_PROOF_TYPE,\n};", "kind": "use_declaration", "signature": "pub use data_integrity_2025::{\n algorithm_to_cryptosuite, cryptosuite_to_algorithm, sign_credential_data_integrity,\n verify_credential_data_integrity, CRYPTOSUITE_BBS_2023, CRYPTOSUITE_ECDSA_2019,\n CRYPTOSUITE_EDDSA_2022, DATA_INTEGRITY_PROOF_TYPE,\n};", "docs": "", "attributes": "", "line": 77 }, { "name": "pub use error::AttestationError;", "kind": "use_declaration", "signature": "pub use error::AttestationError;", "docs": "", "attributes": "", "line": 82 }, { "name": "pub use lineage_vc::{\n lineage_proof_from_credential, lineage_proof_to_credential, LineageAttestationContext,\n LineageAttestationData, LineageRootKind,\n};", "kind": "use_declaration", "signature": "pub use lineage_vc::{\n lineage_proof_from_credential, lineage_proof_to_credential, LineageAttestationContext,\n LineageAttestationData, LineageRootKind,\n};", "docs": "", "attributes": "", "line": 83 }, { "name": "pub use oid4vp::{\n create_authorization_request, create_oid4vp_response, verify_oid4vp_response,\n AuthorizationRequest, Constraints, DescriptorMap, InputDescriptor, InputField, Oid4vpResponse,\n PresentationDefinition, PresentationSubmission,\n};", "kind": "use_declaration", "signature": "pub use oid4vp::{\n create_authorization_request, create_oid4vp_response, verify_oid4vp_response,\n AuthorizationRequest, Constraints, DescriptorMap, InputDescriptor, InputField, Oid4vpResponse,\n PresentationDefinition, PresentationSubmission,\n};", "docs": "", "attributes": "", "line": 87 }, { "name": "pub use presentation::{\n is_authority_bearing, sign_presentation, verify_presentation,\n verify_presentation_holder_binding, verify_presentation_holder_binding_with_lineage,\n verify_presentation_holder_binding_with_resolved_lineage, OasPresentation, PresentationProof,\n};", "kind": "use_declaration", "signature": "pub use presentation::{\n is_authority_bearing, sign_presentation, verify_presentation,\n verify_presentation_holder_binding, verify_presentation_holder_binding_with_lineage,\n verify_presentation_holder_binding_with_resolved_lineage, OasPresentation, PresentationProof,\n};", "docs": "", "attributes": "", "line": 92 }, { "name": "pub use proof_formats::{Ed25519Signature2020Format, ProofFormat, ProofFormatId};", "kind": "use_declaration", "signature": "pub use proof_formats::{Ed25519Signature2020Format, ProofFormat, ProofFormatId};", "docs": "", "attributes": "", "line": 97 }, { "name": "pub use sd_jwt_vc::{\n present_sd_jwt_vc, sign_credential_sd_jwt_vc, verify_sd_jwt_vc, Disclosure, SdJwtVc,\n SdJwtVcHeader, SdJwtVcPayload, SdJwtVcSignOptions,\n};", "kind": "use_declaration", "signature": "pub use sd_jwt_vc::{\n present_sd_jwt_vc, sign_credential_sd_jwt_vc, verify_sd_jwt_vc, Disclosure, SdJwtVc,\n SdJwtVcHeader, SdJwtVcPayload, SdJwtVcSignOptions,\n};", "docs": "", "attributes": "", "line": 98 }, { "name": "pub use signer::{OasKeyPairSigner, OasKeyPairVerifier, Signer, Verifier, ALG_EDDSA};", "kind": "use_declaration", "signature": "pub use signer::{OasKeyPairSigner, OasKeyPairVerifier, Signer, Verifier, ALG_EDDSA};", "docs": "", "attributes": "", "line": 102 }, { "name": "pub use vc_jose::{\n parse_jwt_vc, sign_credential_jwt_vc, verify_jwt_vc, JwtVc, JwtVcHeader, JwtVcPayload,\n JwtVcSignOptions,\n};", "kind": "use_declaration", "signature": "pub use vc_jose::{\n parse_jwt_vc, sign_credential_jwt_vc, verify_jwt_vc, JwtVc, JwtVcHeader, JwtVcPayload,\n JwtVcSignOptions,\n};", "docs": "", "attributes": "", "line": 103 } ], "parseErrors": false }, { "module": "credential", "source": "oas/oas/oas-attestation/src/credential.rs", "sha256": "63826d2acf8654122b01fedcc8b64fb39e08923edb9fc1d741bbdfdb14ef16f9", "attributes": "", "items": [ { "name": "credential::VC_CONTEXT", "kind": "const_item", "signature": "pub const VC_CONTEXT: &str;", "docs": "The W3C Verifiable Credentials v1.1 context URI.\n\nPer OAS Specification \u00a714.1 (v1.2.0), this context is **deprecated** and\nwill be removed in OAS v2.0.0 or after 2027-04-06, whichever occurs first.\nNew credentials SHOULD declare [`VC_CONTEXT_V2`]; verifiers MUST accept\neither or both during the transition period.", "attributes": "", "line": 21 }, { "name": "credential::VC_CONTEXT_V2", "kind": "const_item", "signature": "pub const VC_CONTEXT_V2: &str;", "docs": "The W3C Verifiable Credentials Data Model v2.0 context URI.\n\nPer OAS Specification \u00a714.1 (v1.2.0), credentials SHOULD declare this\ncontext. The legacy [`VC_CONTEXT`] (v1.1) MAY be additionally declared\nduring the deprecation transition period that ends 2027-04-06 or upon\npublication of OAS v2.0.0, whichever occurs first.", "attributes": "", "line": 29 }, { "name": "credential::OAS_ATTESTATION_CONTEXT", "kind": "const_item", "signature": "pub const OAS_ATTESTATION_CONTEXT: &str;", "docs": "The OAS attestation context URI.", "attributes": "", "line": 32 }, { "name": "credential::ATTESTATION_PROOF_TYPE", "kind": "const_item", "signature": "pub const ATTESTATION_PROOF_TYPE: &str;", "docs": "The fixed proof type for `Ed25519Signature2020` (the OAS baseline).", "attributes": "", "line": 35 }, { "name": "credential::ContextMode", "kind": "enum_item", "signature": "pub enum ContextMode {\n /// Emit both v2.0 and v1.1 contexts in canonical order\n /// (v2.0 first, then v1.1, then the OAS attestation context).\n ///\n /// **Default during the transition period** per Spec \u00a714.1. Maximizes\n /// interoperability with both v1.1-only and v2.0-aware verifiers.\n #[default]\n Both,\n /// Emit only the v2.0 context plus the OAS attestation context.\n ///\n /// Use this mode when targeting verifiers that explicitly require v2.0\n /// or after the v1.1 deprecation period ends (2027-04-06).\n V2Only,\n /// Emit only the v1.1 context plus the OAS attestation context.\n ///\n /// **Deprecated.** Reserved for migration tooling and legacy verifier\n /// compatibility. New code SHOULD use [`ContextMode::Both`] or\n /// [`ContextMode::V2Only`]. This mode will be removed in OAS v2.0.0.\n V1Only,\n}", "docs": "JSON-LD context declaration mode for an [`OasCredential`].\n\nPer OAS Specification \u00a714.1 (v1.2.0), credentials SHOULD declare the W3C\nVerifiable Credentials v2.0 context. For backward compatibility, they MAY\nadditionally declare the v1.1 context until **2027-04-06** or until\npublication of OAS v2.0.0, whichever occurs first. Verifiers MUST accept\neither or both during the transition period.\n\nThe default is [`ContextMode::Both`], which emits both v2.0 and v1.1\ncontexts. This is the safest choice during the transition period \u2014\nv1.1-only verifiers still accept the credential and v2.0-aware verifiers\nsee the preferred context.\n\n# Examples\n\n```\nuse oas_attestation::credential::{ContextMode, OasCredential, VC_CONTEXT, VC_CONTEXT_V2};\nuse oas_attestation::types::AttestationType;\n\n// Default mode (Both) emits the v2.0 context first, then v1.1 for back-compat.\nlet cred = OasCredential::builder()\n .issuer(\"did:oas:test:hmr:auditor\")\n .subject_id(\"did:oas:test:agent:target\")\n .issuance_date(\"2026-01-15T00:00:00Z\")\n .attestation_type(AttestationType::SecurityAudit)\n .subject_claim(\"auditType\", serde_json::json!(\"codeAudit\"))\n .subject_claim(\"result\", serde_json::json!(\"pass\"))\n .subject_claim(\"severityFindings\", serde_json::json!({\"critical\": 0}))\n .subject_claim(\"toolOrMethodology\", serde_json::json!(\"OWASP\"))\n .subject_claim(\"auditDate\", serde_json::json!(\"2026-01-15T00:00:00Z\"))\n .build()\n .unwrap();\n\nassert!(cred.context.contains(&VC_CONTEXT_V2.to_string()));\nassert!(cred.context.contains(&VC_CONTEXT.to_string()));\n```", "attributes": "#[derive(Debug, Default, Clone, Copy, PartialEq, Eq, Hash)]", "line": 74 }, { "name": "credential::ContextMode::context_uris", "kind": "function_item", "signature": "pub fn context_uris(self) -> Vec<&'static str>;", "docs": "Returns the JSON-LD context URIs this mode emits, in canonical order.\n\nThe OAS attestation context is always appended last regardless of\nmode. The W3C VC context (v1.1, v2.0, or both) precedes it in the\norder defined by the variant.\n\n# Examples\n\n```\nuse oas_attestation::credential::{\n ContextMode, OAS_ATTESTATION_CONTEXT, VC_CONTEXT, VC_CONTEXT_V2,\n};\n\nassert_eq!(\n ContextMode::Both.context_uris(),\n vec![VC_CONTEXT_V2, VC_CONTEXT, OAS_ATTESTATION_CONTEXT]\n);\nassert_eq!(\n ContextMode::V2Only.context_uris(),\n vec![VC_CONTEXT_V2, OAS_ATTESTATION_CONTEXT]\n);\nassert_eq!(\n ContextMode::V1Only.context_uris(),\n vec![VC_CONTEXT, OAS_ATTESTATION_CONTEXT]\n);\n```", "attributes": "", "line": 122 }, { "name": "credential::OasCredential", "kind": "struct_item", "signature": "pub struct OasCredential {\n/// The JSON-LD context array.\n\n#[serde(rename = \"@context\")]\npub context: Vec,\n/// The credential types (always includes `\"VerifiableCredential\"`).\n\n#[serde(rename = \"type\")]\npub credential_type: Vec,\n/// The issuer's `did:oas` identifier.\n\npub issuer: String,\n/// ISO 8601 timestamp when the credential was issued.\n\npub issuance_date: String,\n/// Optional ISO 8601 expiration timestamp.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub expiration_date: Option,\n/// The credential subject containing the attestation claims.\n\npub credential_subject: serde_json::Value,\n/// The OAS attestation type per \u00a713.2.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub oas_attestation_type: Option,\n/// The Ed25519Signature2020 proof (populated after signing).\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub proof: Option\n}", "docs": "An OAS Verifiable Credential per Specification \u00a713.1.\n\nCombines the W3C VC Data Model v2.0 structure with OAS-specific constraints\nincluding `did:oas` issuer/subject requirements and the `oasAttestationType` field.\n\n# Examples\n\n```\nuse oas_attestation::credential::OasCredential;\nuse oas_attestation::types::AttestationType;\n\nlet cred = OasCredential::builder()\n .issuer(\"did:oas:test:hmr:auditor\")\n .subject_id(\"did:oas:test:agent:target\")\n .attestation_type(AttestationType::SecurityAudit)\n .issuance_date(\"2026-01-15T00:00:00Z\")\n .subject_claim(\"auditType\", serde_json::json!(\"codeAudit\"))\n .subject_claim(\"result\", serde_json::json!(\"pass\"))\n .subject_claim(\"severityFindings\", serde_json::json!({\"critical\": 0}))\n .subject_claim(\"toolOrMethodology\", serde_json::json!(\"OWASP\"))\n .subject_claim(\"auditDate\", serde_json::json!(\"2026-01-15T00:00:00Z\"))\n .build();\nassert!(cred.is_ok());\n```", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 157 }, { "name": "credential::CredentialProof", "kind": "struct_item", "signature": "pub struct CredentialProof {\n/// Either `\"Ed25519Signature2020\"` (baseline) or `\"DataIntegrityProof\"`\n\n/// (Spec \u00a714.4 `data-integrity-2025` format).\n\n#[serde(rename = \"type\")]\npub proof_type: String,\n/// Cryptosuite identifier \u2014 REQUIRED for `DataIntegrityProof`,\n\n/// MUST be omitted for `Ed25519Signature2020`. Examples: `\"eddsa-2022\"`,\n\n/// `\"ecdsa-2019\"`, `\"bbs-2023\"`.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub cryptosuite: Option,\n/// ISO 8601 timestamp when the proof was created.\n\npub created: String,\n/// Reference to the verification method used.\n\npub verification_method: String,\n/// The purpose of this proof (e.g., `\"assertionMethod\"`).\n\npub proof_purpose: String,\n/// The multibase-encoded (base58btc, `z` prefix) signature bytes.\n\npub proof_value: String\n}", "docs": "A credential proof per OAS Specification \u00a713.1 / \u00a714.4.\n\nCarries either an `Ed25519Signature2020` proof (the OAS baseline) or a\nW3C `DataIntegrityProof` (the \u00a714.4 `data-integrity-2025` registered\nformat). The optional [`cryptosuite`](Self::cryptosuite) field\ndistinguishes the two: `Ed25519Signature2020` proofs MUST omit it (so\nthe on-wire JSON is byte-identical to v1.1.0), while `DataIntegrityProof`\nproofs MUST set it (e.g., `\"eddsa-2022\"`).\n\nSee OAS Specification \u00a714.4 for the proof format registry that\nenumerates the supported `(proof_type, cryptosuite)` pairs.", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 201 }, { "name": "credential::OasCredential::builder", "kind": "function_item", "signature": "pub fn builder() -> CredentialBuilder;", "docs": "Creates a new [`CredentialBuilder`] for constructing credentials.\n\n# Returns\n\nA builder with default context and type values pre-populated.", "attributes": "", "line": 232 }, { "name": "credential::OasCredential::subject_id", "kind": "function_item", "signature": "pub fn subject_id(&self) -> Option<&str>;", "docs": "Returns the subject DID from the credential subject.\n\n# Returns\n\nThe `id` field value from `credentialSubject`, or `None` if absent.", "attributes": "", "line": 241 }, { "name": "credential::OasCredential::to_json_without_proof", "kind": "function_item", "signature": "pub fn to_json_without_proof(&self) -> Result;", "docs": "Returns a JSON representation of this credential without the proof field.\n\nUsed during proof generation and verification \u2014 the proof field must\nbe absent from the canonical form.\n\n# Returns\n\nA [`serde_json::Value`] with the `proof` field removed.\n\n# Errors\n\nReturns [`AttestationError::Json`] if serialization fails.", "attributes": "", "line": 260 }, { "name": "credential::OasCredential::validate", "kind": "function_item", "signature": "pub fn validate(&self) -> Result<(), AttestationError>;", "docs": "Validates this credential's structure per OAS \u00a713.1 constraints.\n\nChecks:\n- Issuer is a valid `did:oas` identifier\n- Credential subject `id` is a valid `did:oas` identifier\n- Required attestation-type fields are present (if type is set)\n\n# Returns\n\n`Ok(())` if the credential is structurally valid.\n\n# Errors\n\nReturns an [`AttestationError`] variant describing the validation failure.", "attributes": "", "line": 282 }, { "name": "credential::CredentialBuilder", "kind": "struct_item", "signature": "pub struct CredentialBuilder {\n\n}", "docs": "Builder for constructing [`OasCredential`] instances.\n\nProvides a fluent API for setting credential fields, with validation\nperformed at build time.\n\n# Examples\n\n```\nuse oas_attestation::credential::OasCredential;\nuse oas_attestation::types::AttestationType;\n\nlet cred = OasCredential::builder()\n .issuer(\"did:oas:test:hmr:auditor\")\n .subject_id(\"did:oas:test:agent:target\")\n .attestation_type(AttestationType::SecurityAudit)\n .issuance_date(\"2026-01-15T00:00:00Z\")\n .subject_claim(\"auditType\", serde_json::json!(\"codeAudit\"))\n .subject_claim(\"result\", serde_json::json!(\"pass\"))\n .subject_claim(\"severityFindings\", serde_json::json!({\"critical\": 0}))\n .subject_claim(\"toolOrMethodology\", serde_json::json!(\"OWASP\"))\n .subject_claim(\"auditDate\", serde_json::json!(\"2026-01-15T00:00:00Z\"))\n .build();\nassert!(cred.is_ok());\n```", "attributes": "#[derive(Debug, Default)]", "line": 336 }, { "name": "credential::CredentialBuilder::issuer", "kind": "function_item", "signature": "pub fn issuer(mut self, issuer: &str) -> Self;", "docs": "Sets the issuer DID.\n\n# Arguments\n\n* `issuer` - A `did:oas` identifier for the entity issuing this credential.", "attributes": "", "line": 352 }, { "name": "credential::CredentialBuilder::subject_id", "kind": "function_item", "signature": "pub fn subject_id(mut self, subject_id: &str) -> Self;", "docs": "Sets the credential subject DID.\n\n# Arguments\n\n* `subject_id` - A `did:oas` identifier for the entity this credential is about.", "attributes": "", "line": 362 }, { "name": "credential::CredentialBuilder::attestation_type", "kind": "function_item", "signature": "pub fn attestation_type(mut self, attestation_type: AttestationType) -> Self;", "docs": "Sets the attestation type.\n\n# Arguments\n\n* `attestation_type` - The OAS \u00a713.2 attestation type.", "attributes": "", "line": 372 }, { "name": "credential::CredentialBuilder::issuance_date", "kind": "function_item", "signature": "pub fn issuance_date(mut self, date: &str) -> Self;", "docs": "Sets the issuance date.\n\n# Arguments\n\n* `date` - ISO 8601 timestamp.", "attributes": "", "line": 382 }, { "name": "credential::CredentialBuilder::expiration_date", "kind": "function_item", "signature": "pub fn expiration_date(mut self, date: &str) -> Self;", "docs": "Sets an optional expiration date.\n\n# Arguments\n\n* `date` - ISO 8601 timestamp.", "attributes": "", "line": 392 }, { "name": "credential::CredentialBuilder::subject_claim", "kind": "function_item", "signature": "pub fn subject_claim(mut self, key: &str, value: serde_json::Value) -> Self;", "docs": "Adds a claim to the credential subject.\n\n# Arguments\n\n* `key` - The claim name.\n* `value` - The claim value.", "attributes": "", "line": 403 }, { "name": "credential::CredentialBuilder::context_mode", "kind": "function_item", "signature": "pub fn context_mode(mut self, mode: ContextMode) -> Self;", "docs": "Sets the JSON-LD context declaration mode per OAS Spec \u00a714.1.\n\nThe default is [`ContextMode::Both`], which emits both the v2.0 and\nv1.1 W3C VC contexts during the deprecation transition period that\nends 2027-04-06 or upon publication of OAS v2.0.0, whichever occurs\nfirst.\n\n# Arguments\n\n* `mode` - The [`ContextMode`] to use for this credential.\n\n# Examples\n\n```\nuse oas_attestation::credential::{ContextMode, OasCredential, VC_CONTEXT, VC_CONTEXT_V2};\nuse oas_attestation::types::AttestationType;\n\nlet cred = OasCredential::builder()\n .issuer(\"did:oas:test:hmr:auditor\")\n .subject_id(\"did:oas:test:agent:target\")\n .issuance_date(\"2026-01-15T00:00:00Z\")\n .context_mode(ContextMode::V2Only)\n .attestation_type(AttestationType::SecurityAudit)\n .subject_claim(\"auditType\", serde_json::json!(\"codeAudit\"))\n .subject_claim(\"result\", serde_json::json!(\"pass\"))\n .subject_claim(\"severityFindings\", serde_json::json!({\"critical\": 0}))\n .subject_claim(\"toolOrMethodology\", serde_json::json!(\"OWASP\"))\n .subject_claim(\"auditDate\", serde_json::json!(\"2026-01-15T00:00:00Z\"))\n .build()\n .unwrap();\n\nassert!(cred.context.contains(&VC_CONTEXT_V2.to_string()));\nassert!(!cred.context.contains(&VC_CONTEXT.to_string()));\n```", "attributes": "", "line": 442 }, { "name": "credential::CredentialBuilder::build", "kind": "function_item", "signature": "pub fn build(self) -> Result;", "docs": "Builds the credential, validating all constraints.\n\n# Returns\n\nA validated [`OasCredential`] ready for signing.\n\n# Errors\n\nReturns an [`AttestationError`] if required fields are missing or invalid.", "attributes": "", "line": 456 } ], "parseErrors": false }, { "module": "data_integrity_2025", "source": "oas/oas/oas-attestation/src/data_integrity_2025.rs", "sha256": "28cb729f15f34a8b2c6b569850b60134f9aba33eee273babf7a3e549089422f8", "attributes": "", "items": [ { "name": "data_integrity_2025::DATA_INTEGRITY_PROOF_TYPE", "kind": "const_item", "signature": "pub const DATA_INTEGRITY_PROOF_TYPE: &str;", "docs": "Fixed proof type literal for W3C `DataIntegrityProof`.", "attributes": "", "line": 90 }, { "name": "data_integrity_2025::ASSERTION_METHOD", "kind": "const_item", "signature": "pub const ASSERTION_METHOD: &str;", "docs": "Fixed proof purpose literal for issuer assertions.", "attributes": "", "line": 93 }, { "name": "data_integrity_2025::CRYPTOSUITE_EDDSA_2022", "kind": "const_item", "signature": "pub const CRYPTOSUITE_EDDSA_2022: &str;", "docs": "W3C cryptosuite identifier for Ed25519 over JCS canonicalization.", "attributes": "", "line": 100 }, { "name": "data_integrity_2025::CRYPTOSUITE_ECDSA_2019", "kind": "const_item", "signature": "pub const CRYPTOSUITE_ECDSA_2019: &str;", "docs": "W3C cryptosuite identifier for ECDSA P-256 over JCS canonicalization.", "attributes": "", "line": 103 }, { "name": "data_integrity_2025::CRYPTOSUITE_BBS_2023", "kind": "const_item", "signature": "pub const CRYPTOSUITE_BBS_2023: &str;", "docs": "W3C cryptosuite identifier for BBS+ (selective disclosure capable).", "attributes": "", "line": 106 }, { "name": "data_integrity_2025::algorithm_to_cryptosuite", "kind": "function_item", "signature": "pub fn algorithm_to_cryptosuite(algorithm: &str) -> Option<&'static str>;", "docs": "Maps a JOSE-style algorithm identifier (as returned by [`Signer::algorithm`])\nto its W3C Data Integrity cryptosuite identifier.\n\n# Examples\n\n```\nuse oas_attestation::data_integrity_2025::algorithm_to_cryptosuite;\n\nassert_eq!(algorithm_to_cryptosuite(\"EdDSA\"), Some(\"eddsa-2022\"));\nassert_eq!(algorithm_to_cryptosuite(\"ES256\"), Some(\"ecdsa-2019\"));\nassert_eq!(algorithm_to_cryptosuite(\"BBS\"), Some(\"bbs-2023\"));\nassert_eq!(algorithm_to_cryptosuite(\"RS256\"), None);\n```", "attributes": "", "line": 121 }, { "name": "data_integrity_2025::cryptosuite_to_algorithm", "kind": "function_item", "signature": "pub fn cryptosuite_to_algorithm(cryptosuite: &str) -> Option<&'static str>;", "docs": "Reverse mapping \u2014 given a W3C cryptosuite identifier, returns the\nexpected JOSE-style algorithm identifier the verifier MUST report.", "attributes": "", "line": 132 }, { "name": "data_integrity_2025::sign_credential_data_integrity", "kind": "function_item", "signature": "pub fn sign_credential_data_integrity(\n credential: &OasCredential,\n signer: &dyn Signer,\n verification_method_id: &str,\n created: &str,\n) -> Result;", "docs": "Signs an [`OasCredential`] with a W3C `DataIntegrityProof` per\nOAS Spec \u00a714.4 `data-integrity-2025`.\n\nThe signing payload is the JCS canonicalization of the credential\n**without** the `proof` field \u2014 the same scheme used by\n[`crate::sign::sign_credential`]. The cryptosuite identifier is derived\nfrom the signer's algorithm via [`algorithm_to_cryptosuite`].\n\n# Arguments\n\n* `credential` - The unsigned credential.\n* `signer` - Any [`Signer`] implementation.\n* `verification_method_id` - The full verification method ID\n (e.g., `\"did:oas:test:hmr:auditor#key-1\"`).\n* `created` - ISO 8601 timestamp for the proof.\n\n# Errors\n\n- [`AttestationError::ProofGenerationFailed`] if canonicalization or\n signing fails.\n- [`AttestationError::UnknownProofFormat`] if the signer's algorithm has\n no registered cryptosuite mapping.", "attributes": "", "line": 167 }, { "name": "data_integrity_2025::verify_credential_data_integrity", "kind": "function_item", "signature": "pub fn verify_credential_data_integrity(\n credential: &OasCredential,\n verifier: &dyn Verifier,\n) -> Result<(), AttestationError>;", "docs": "Verifies an [`OasCredential`] signed with a `DataIntegrityProof` per\nOAS Spec \u00a714.4 `data-integrity-2025`.\n\n1. Validates the credential structure.\n2. Checks the proof exists and uses `DataIntegrityProof`.\n3. Checks the proof has a `cryptosuite` field.\n4. Cross-validates that the cryptosuite matches the verifier's\n `algorithm()` via [`cryptosuite_to_algorithm`] \u2014 preventing the\n verifier from accidentally accepting a proof signed with the wrong\n suite.\n5. Reconstructs the JCS canonical bytes (without proof) and verifies\n the signature.\n\n# Errors\n\n- [`AttestationError::MissingProof`] if no proof is present.\n- [`AttestationError::InvalidProofSignature`] for any structural,\n suite-mismatch, or cryptographic failure.", "attributes": "", "line": 234 }, { "name": "data_integrity_2025::format_id", "kind": "function_item", "signature": "pub const fn format_id() -> ProofFormatId;", "docs": "Returns the registered OAS proof format ID for `data-integrity-2025`.", "attributes": "", "line": 311 }, { "name": "data_integrity_2025::format_url", "kind": "function_item", "signature": "pub const fn format_url() -> &'static str;", "docs": "Returns the canonical OAS format identifier URL.", "attributes": "", "line": 316 } ], "parseErrors": false }, { "module": "error", "source": "oas/oas/oas-attestation/src/error.rs", "sha256": "ee13cdd8789399eec1bea08dfe05a8b1d5a9074549b2fa08c0d807b470697e30", "attributes": "", "items": [ { "name": "error::AttestationError", "kind": "enum_item", "signature": "pub enum AttestationError {\n /// The issuer DID is not a valid `did:oas` identifier.\n #[error(\"invalid issuer DID: {issuer}\")]\n InvalidIssuer {\n /// The invalid issuer DID.\n issuer: String,\n },\n\n /// The credential subject DID is not a valid `did:oas` identifier.\n #[error(\"invalid credential subject DID: {subject}\")]\n InvalidSubject {\n /// The invalid subject DID.\n subject: String,\n },\n\n /// The attestation type is not recognized.\n #[error(\"unrecognized attestation type: '{found}'\")]\n UnknownAttestationType {\n /// The unrecognized type.\n found: String,\n },\n\n /// The credential proof is missing.\n #[error(\"credential proof is missing\")]\n MissingProof,\n\n /// The credential proof signature is invalid.\n #[error(\"credential proof signature invalid: {reason}\")]\n InvalidProofSignature {\n /// Details about the signature failure.\n reason: String,\n },\n\n /// Proof generation failed.\n #[error(\"credential proof generation failed: {reason}\")]\n ProofGenerationFailed {\n /// Details about the failure.\n reason: String,\n },\n\n /// The credential has expired.\n #[error(\"credential expired at {expiration}\")]\n Expired {\n /// The expiration timestamp.\n expiration: String,\n },\n\n /// The credential is not yet valid.\n #[error(\"credential not valid until {valid_from}\")]\n NotYetValid {\n /// The earliest valid timestamp.\n valid_from: String,\n },\n\n /// A required field is missing from the credential subject.\n #[error(\"credential subject missing required field: '{field}'\")]\n MissingField {\n /// The missing field name.\n field: String,\n },\n\n /// The presentation's challenge (nonce) does not match the verifier's\n /// expected value. Per OAS Spec \u00a714.5, replay protection requires the\n /// presentation proof to bind a verifier-supplied nonce; mismatches MUST\n /// cause rejection.\n #[error(\n \"presentation challenge mismatch: expected '{expected}', got '{actual}' (replay \\\n protection per OAS Spec \u00a714.5)\"\n )]\n PresentationChallengeMismatch {\n /// The verifier-supplied nonce.\n expected: String,\n /// The nonce embedded in the presentation proof.\n actual: String,\n },\n\n /// The presentation's domain (audience) does not match the verifier's\n /// identifier. Per OAS Spec \u00a714.5, the audience prevents cross-verifier\n /// replay; mismatches MUST cause rejection.\n #[error(\n \"presentation domain mismatch: expected '{expected}', got '{actual}' (audience \\\n binding per OAS Spec \u00a714.5)\"\n )]\n PresentationDomainMismatch {\n /// The verifier's identifier.\n expected: String,\n /// The domain embedded in the presentation proof.\n actual: String,\n },\n\n /// A holder lineage chain submitted for \u00a714.5.1 descendant-form holder\n /// binding check is structurally invalid: chain continuity is broken\n /// (a proof's `parent_did` does not match the next proof's `child_did`),\n /// the chain does not start at the presentation holder, or one of the\n /// proofs failed cryptographic verification.\n #[error(\"holder lineage chain invalid: {reason} (OAS Spec \u00a714.5.1)\")]\n LineageChainInvalid {\n /// Specific reason the chain failed validation.\n reason: String,\n },\n\n /// The presentation violates the Holder Binding Rule from OAS Spec\n /// \u00a714.5.1: an authority-bearing attestation (e.g., `CapabilityVerification`)\n /// is being presented by a holder whose DID is neither the credential\n /// subject nor a lineage descendant of the subject.\n #[error(\n \"holder binding violation: holder '{holder}' is not the subject (or a lineage \\\n descendant of) authority-bearing credential subject '{subject}' for attestation \\\n type '{attestation_type}' (OAS Spec \u00a714.5.1)\"\n )]\n HolderBindingViolation {\n /// The presentation holder DID.\n holder: String,\n /// The authority-bearing credential subject DID.\n subject: String,\n /// The credential's attestation type (e.g., `CapabilityVerification`).\n attestation_type: String,\n },\n\n /// The proof format identifier is not in the OAS proof format registry\n /// (Spec \u00a714.4). Per spec, verifiers MUST reject credentials whose proof\n /// format is unrecognized; callers SHOULD propagate this error.\n #[error(\n \"unknown proof format identifier: '{format_id}' is not in the OAS \\\n \u00a714.4 registry; expected one of \\\n 'https://openagent.id/proof/ed25519-2020', \\\n 'https://openagent.id/proof/vc-jose', \\\n 'https://openagent.id/proof/sd-jwt-vc', \\\n 'https://openagent.id/proof/data-integrity-2025'\"\n )]\n UnknownProofFormat {\n /// The unrecognized format identifier as presented on the wire.\n format_id: String,\n },\n\n /// A JSON serialization error.\n #[error(\"JSON error: {0}\")]\n Json(#[from] serde_json::Error),\n\n /// An underlying cryptographic error.\n #[error(\"cryptographic error: {0}\")]\n Crypto(#[from] oas_crypto::CryptoError),\n}", "docs": "Errors that can occur during attestation operations.\n\nCovers credential creation, signing, and verification.", "attributes": "#[derive(Debug, Error)]", "line": 10 } ], "parseErrors": false }, { "module": "lineage_vc", "source": "oas/oas/oas-attestation/src/lineage_vc.rs", "sha256": "ad645c49dca7878d8e4a9e1c805951c07f48b18ef627edb4315b95a2fdb76e3a", "attributes": "", "items": [ { "name": "lineage_vc::LineageRootKind", "kind": "enum_item", "signature": "pub enum LineageRootKind {\n /// Human Root (HMR) per OAS Spec \u00a76 \u2014 single human accountability anchor.\n Hmr,\n /// Multi-Human Root (MHR) per OAS Spec \u00a77 \u2014 threshold-signed multi-party anchor.\n Mhr,\n /// Enterprise Root (ENR) per OAS Spec \u00a78 \u2014 MHR-governed enterprise anchor.\n Enr,\n}", "docs": "The kind of root anchor a lineage chain terminates at, per OAS Spec \u00a714.7.1.\n\nOn the wire, encoded as the lowercase string `\"hmr\"`, `\"mhr\"`, or `\"enr\"`\nto match the spec example in \u00a714.7.1.\n\n# Examples\n\n```\nuse oas_attestation::lineage_vc::LineageRootKind;\n\nassert_eq!(LineageRootKind::Hmr.as_str(), \"hmr\");\nassert_eq!(LineageRootKind::Mhr.as_str(), \"mhr\");\nassert_eq!(LineageRootKind::Enr.as_str(), \"enr\");\n\nassert_eq!(\"hmr\".parse::().unwrap(), LineageRootKind::Hmr);\nassert!(\"invalid\".parse::().is_err());\n```", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(rename_all = \"lowercase\")]", "line": 95 }, { "name": "lineage_vc::LineageRootKind::as_str", "kind": "function_item", "signature": "pub const fn as_str(self) -> &'static str;", "docs": "Returns the canonical lowercase string form used on the wire.", "attributes": "", "line": 106 }, { "name": "lineage_vc::LineageAttestationContext", "kind": "struct_item", "signature": "pub struct LineageAttestationContext {\n/// Generation depth from the nearest root, where 1 is the first\n\n/// derivation from the root and increases by 1 per hop. Must be in\n\n/// the range `[1, MAX_GENERATION]` per OAS Spec \u00a710 (`MAX_GENERATION = 16`).\n\npub generation_depth: u32,\n/// Root anchor DID \u2014 the topmost ancestor in the lineage chain. MUST be\n\n/// a valid `did:oas` identifier of kind `hmr`, `mhr`, or `enr`.\n\npub root_anchor: String,\n/// The root kind matching `root_anchor`'s entity kind.\n\npub root_kind: LineageRootKind,\n/// ISO 8601 UTC timestamp marking when the derivation occurred.\n\npub derived_at: String\n}", "docs": "Per-link metadata that [`AgentLineageProof`] does not carry but the\nLineageAttestation credential subject schema requires.\n\nPer OAS Spec \u00a714.7.1, the credential subject MUST contain `generationDepth`,\n`rootAnchor`, `rootKind`, and `derivedAt`. The native\n[`AgentLineageProof2025`](AgentLineageProof) does not encode these fields,\nso callers using the bridge MUST supply them. The values are typically\nderived from the lineage walking context: `generation_depth` from the\nchain walker's depth counter, `root_anchor` from the topmost ancestor's\nDID, `root_kind` from inspecting that ancestor's identity document, and\n`derived_at` from the parent's derivation log.", "attributes": "#[derive(Debug, Clone, PartialEq, Eq)]", "line": 158 }, { "name": "lineage_vc::LineageAttestationData", "kind": "struct_item", "signature": "pub struct LineageAttestationData {\n/// Parent DID (matches `AgentLineageProof::parent_did` and the credential\n\n/// `issuer`).\n\npub parent_did: String,\n/// Child DID (matches `AgentLineageProof::child_did` and the credential\n\n/// `credentialSubject.id`).\n\npub child_did: String,\n/// HKDF derivation path (matches `AgentLineageProof::derivation_path`).\n\npub derivation_path: String,\n/// Generation depth from the root (caller-supplied, not in\n\n/// `AgentLineageProof`).\n\npub generation_depth: u32,\n/// Root anchor DID (caller-supplied).\n\npub root_anchor: String,\n/// Root kind (caller-supplied).\n\npub root_kind: LineageRootKind,\n/// Derivation timestamp (caller-supplied).\n\npub derived_at: String\n}", "docs": "All lineage data extracted from a `LineageAttestation` credential by\n[`lineage_proof_from_credential`].\n\nThis is the round-trip target type. Calling\n`lineage_proof_to_credential(proof, ctx)` then\n`lineage_proof_from_credential(...)` MUST produce a value where every\nfield matches the original `proof` and `ctx` exactly. This guarantee is\nenforced by the round-trip property test in this module.", "attributes": "#[derive(Debug, Clone, PartialEq, Eq)]", "line": 185 }, { "name": "lineage_vc::lineage_proof_to_credential", "kind": "function_item", "signature": "pub fn lineage_proof_to_credential(\n proof: &AgentLineageProof,\n ctx: &LineageAttestationContext,\n) -> Result;", "docs": "Converts an [`AgentLineageProof2025`](AgentLineageProof) into an\n[`OasCredential`] of type `LineageAttestation` per OAS Spec \u00a714.7.\n\nThe returned credential is **unsigned** \u2014 callers who need a signed VC\nMUST sign it separately using [`crate::sign::sign_credential`] (or the\nequivalent [`crate::proof_formats::Ed25519Signature2020Format`] trait\ndispatch). Per Spec \u00a714.7.2, the signature MUST be produced by the\nparent's signing key, the same key authorized to produce the equivalent\n`AgentLineageProof2025`.\n\nThe [`AttestationContext`](LineageAttestationContext) parameter supplies\nthe four spec-required subject fields that [`AgentLineageProof`] does not\nitself carry: `generation_depth`, `root_anchor`, `root_kind`, `derived_at`.\n\n# Arguments\n\n* `proof` - The native lineage proof to bridge.\n* `ctx` - The per-link metadata required by Spec \u00a714.7.1.\n\n# Returns\n\nAn unsigned [`OasCredential`] with `oasAttestationType: LineageAttestation`\nand all six required subject fields populated.\n\n# Errors\n\nReturns [`AttestationError`] if the resulting credential fails structural\nvalidation (e.g., parent or child DIDs are not valid `did:oas`\nidentifiers).\n\n# Examples\n\n```\nuse oas_attestation::lineage_vc::{\n lineage_proof_to_credential, LineageAttestationContext, LineageRootKind,\n};\nuse oas_attestation::types::AttestationType;\nuse oas_crypto::keypair::OasKeyPair;\nuse oas_crypto::proof::AgentLineageProof;\n\nlet parent = OasKeyPair::generate();\nlet proof = AgentLineageProof::generate(\n &parent,\n \"did:oas:test:hmr:alice\",\n \"did:oas:test:agent:bot\",\n \"/agent-bot\",\n).unwrap();\n\nlet ctx = LineageAttestationContext {\n generation_depth: 1,\n root_anchor: \"did:oas:test:hmr:alice\".to_string(),\n root_kind: LineageRootKind::Hmr,\n derived_at: \"2026-04-06T00:00:00Z\".to_string(),\n};\n\nlet cred = lineage_proof_to_credential(&proof, &ctx).unwrap();\nassert_eq!(cred.issuer, \"did:oas:test:hmr:alice\");\nassert_eq!(cred.oas_attestation_type, Some(AttestationType::LineageAttestation));\n```", "attributes": "", "line": 268 }, { "name": "lineage_vc::lineage_proof_from_credential", "kind": "function_item", "signature": "pub fn lineage_proof_from_credential(\n credential: &OasCredential,\n) -> Result;", "docs": "Extracts [`LineageAttestationData`] from an [`OasCredential`] previously\nproduced by [`lineage_proof_to_credential`] (or any other source that\nfollows the OAS Spec \u00a714.7.1 schema).\n\nThis is the inverse of [`lineage_proof_to_credential`]. Round-trip\n(`to_credential` \u2192 `from_credential`) is byte-equivalent in all shared\nfields and is enforced by the property test in this module.\n\n# Arguments\n\n* `credential` - A credential whose `oasAttestationType` is\n `LineageAttestation` and whose subject contains all six required fields.\n\n# Returns\n\nA populated [`LineageAttestationData`].\n\n# Errors\n\n- [`AttestationError::UnknownAttestationType`] if the credential's\n `oasAttestationType` is not `LineageAttestation`.\n- [`AttestationError::MissingField`] if any required subject field is\n missing or has the wrong JSON type.\n- [`AttestationError::InvalidSubject`] if the subject `id` is missing or\n not a valid `did:oas` identifier.\n\n# Examples\n\n```\nuse oas_attestation::lineage_vc::{\n lineage_proof_from_credential, lineage_proof_to_credential,\n LineageAttestationContext, LineageRootKind,\n};\nuse oas_crypto::keypair::OasKeyPair;\nuse oas_crypto::proof::AgentLineageProof;\n\nlet parent = OasKeyPair::generate();\nlet proof = AgentLineageProof::generate(\n &parent,\n \"did:oas:test:hmr:alice\",\n \"did:oas:test:agent:bot\",\n \"/agent-bot\",\n).unwrap();\n\nlet ctx = LineageAttestationContext {\n generation_depth: 1,\n root_anchor: \"did:oas:test:hmr:alice\".to_string(),\n root_kind: LineageRootKind::Hmr,\n derived_at: \"2026-04-06T00:00:00Z\".to_string(),\n};\n\nlet cred = lineage_proof_to_credential(&proof, &ctx).unwrap();\nlet data = lineage_proof_from_credential(&cred).unwrap();\n\nassert_eq!(data.parent_did, proof.parent_did);\nassert_eq!(data.child_did, proof.child_did);\nassert_eq!(data.derivation_path, proof.derivation_path);\nassert_eq!(data.generation_depth, ctx.generation_depth);\n```", "attributes": "", "line": 363 } ], "parseErrors": false }, { "module": "oid4vp", "source": "oas/oas/oas-attestation/src/oid4vp.rs", "sha256": "93be1a5e1335c2ba0bd9657bc94547d8becc78be721afa638c2fc6722af37854", "attributes": "", "items": [ { "name": "oid4vp::RESPONSE_TYPE_VP_TOKEN", "kind": "const_item", "signature": "pub const RESPONSE_TYPE_VP_TOKEN: &str;", "docs": "Default OID4VP `response_type` value for verifiable presentations.", "attributes": "", "line": 140 }, { "name": "oid4vp::RESPONSE_MODE_DIRECT_POST", "kind": "const_item", "signature": "pub const RESPONSE_MODE_DIRECT_POST: &str;", "docs": "Default OID4VP `response_mode` value for direct POST responses.", "attributes": "", "line": 143 }, { "name": "oid4vp::PresentationDefinition", "kind": "struct_item", "signature": "pub struct PresentationDefinition {\n/// Unique identifier for this definition.\n\npub id: String,\n/// Optional human-readable name (shown to the holder during consent).\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub name: Option,\n/// Optional human-readable purpose explaining why the verifier needs\n\n/// the credentials.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub purpose: Option,\n/// One or more input descriptors, each describing a credential the\n\n/// verifier requires.\n\npub input_descriptors: Vec\n}", "docs": "Verifier-side declaration of what credentials a holder must present.\n\nPer the OID4VP / DIF Presentation Exchange spec, a presentation\ndefinition is the contract between the verifier and the holder: it\nnames a set of input descriptors, each describing one credential the\nverifier wants to see.", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]", "line": 156 }, { "name": "oid4vp::InputDescriptor", "kind": "struct_item", "signature": "pub struct InputDescriptor {\n/// Unique identifier for this descriptor (the holder's\n\n/// [`DescriptorMap`] entries reference it by ID).\n\npub id: String,\n/// Optional name shown to the holder.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub name: Option,\n/// Optional human-readable purpose.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub purpose: Option,\n/// Constraints \u2014 field path expressions and filters the credential\n\n/// must satisfy.\n\n#[serde(default, skip_serializing_if = \"Constraints::is_empty\")]\npub constraints: Constraints\n}", "docs": "A single credential requirement within a [`PresentationDefinition`].", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]", "line": 176 }, { "name": "oid4vp::Constraints", "kind": "struct_item", "signature": "pub struct Constraints {\n/// One or more required field path expressions and filters.\n\n#[serde(default, skip_serializing_if = \"Vec::is_empty\")]\npub fields: Vec\n}", "docs": "Constraint set for an [`InputDescriptor`].", "attributes": "#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]", "line": 197 }, { "name": "oid4vp::Constraints::is_empty", "kind": "function_item", "signature": "pub fn is_empty(&self) -> bool;", "docs": "Returns `true` if no constraints are declared.", "attributes": "", "line": 205 }, { "name": "oid4vp::InputField", "kind": "struct_item", "signature": "pub struct InputField {\n/// JSONPath expressions pointing to candidate locations in the credential.\n\npub path: Vec,\n/// Optional human-readable purpose.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub purpose: Option,\n/// Optional JSON Schema filter the resolved value must satisfy.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub filter: Option\n}", "docs": "A single field constraint within a [`Constraints`] block.\n\nPer DIF Presentation Exchange, each field carries a list of JSONPath\nexpressions identifying where the value should be found in the\ncredential, plus an optional JSON Schema filter the value must satisfy.", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]", "line": 216 }, { "name": "oid4vp::AuthorizationRequest", "kind": "struct_item", "signature": "pub struct AuthorizationRequest {\n/// OAuth 2.0 `response_type` \u2014 fixed to `\"vp_token\"` for OID4VP.\n\npub response_type: String,\n/// OAuth 2.0 `response_mode` \u2014 typically `\"direct_post\"` for OID4VP.\n\npub response_mode: String,\n/// Verifier identifier (audience). Becomes `proof.domain` on the\n\n/// holder's signed presentation. MUST be cross-checked at verify time.\n\npub client_id: String,\n/// Verifier-supplied nonce. Becomes `proof.challenge` on the holder's\n\n/// signed presentation. MUST be cross-checked at verify time.\n\npub nonce: String,\n/// Optional opaque state echoed back unchanged in the response.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub state: Option,\n/// The presentation definition the holder must satisfy.\n\npub presentation_definition: PresentationDefinition\n}", "docs": "OID4VP Authorization Request \u2014 issued by the verifier and delivered to\nthe holder over any transport (URL query string, custom messaging, QR\ncode, deep link).", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]", "line": 237 }, { "name": "oid4vp::create_authorization_request", "kind": "function_item", "signature": "pub fn create_authorization_request(\n definition: PresentationDefinition,\n nonce: impl Into,\n client_id: impl Into,\n) -> AuthorizationRequest;", "docs": "Constructs an [`AuthorizationRequest`] with default `response_type` and\n`response_mode` values.", "attributes": "", "line": 262 }, { "name": "oid4vp::PresentationSubmission", "kind": "struct_item", "signature": "pub struct PresentationSubmission {\n/// Unique identifier for this submission.\n\npub id: String,\n/// Identifier of the presentation definition this submission satisfies.\n\npub definition_id: String,\n/// One descriptor map entry per credential in `vp_token`.\n\npub descriptor_map: Vec\n}", "docs": "Holder-side mapping from the credentials in `vp_token` back to the\nverifier's input descriptors.", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]", "line": 284 }, { "name": "oid4vp::DescriptorMap", "kind": "struct_item", "signature": "pub struct DescriptorMap {\n/// Identifier of the [`InputDescriptor`] this credential satisfies.\n\npub id: String,\n/// Proof format identifier from the OAS Spec \u00a714.4 registry. Verifiers\n\n/// route the credential to the matching verification routine based on\n\n/// this value.\n\npub format: String,\n/// JSONPath expression pointing to the credential within the `vp_token`.\n\n/// `\"$\"` means the entire `vp_token` IS the credential (single-credential\n\n/// case).\n\npub path: String\n}", "docs": "A single entry in a [`PresentationSubmission`]'s descriptor map.\n\nTells the verifier where to find a credential within the `vp_token`\nand which proof format to use to verify it.", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]", "line": 300 }, { "name": "oid4vp::Oid4vpResponse", "kind": "struct_item", "signature": "pub struct Oid4vpResponse {\n/// The signed [`OasPresentation`] (or, for non-OAS formats, an opaque\n\n/// JSON value). For OAS attestation flows this is the W3C VP from\n\n/// [`crate::presentation::sign_presentation`].\n\npub vp_token: serde_json::Value,\n/// Submission map \u2014 one entry per credential in `vp_token`.\n\npub presentation_submission: PresentationSubmission,\n/// Echoed `state` from the request, if the request included one.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub state: Option\n}", "docs": "The holder's full OID4VP response carrying the signed presentation,\nthe submission descriptor map, and the echoed state.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 322 }, { "name": "oid4vp::create_oid4vp_response", "kind": "function_item", "signature": "pub fn create_oid4vp_response(\n request: &AuthorizationRequest,\n presentation: OasPresentation,\n descriptor_map: Vec,\n) -> Result;", "docs": "Constructs an [`Oid4vpResponse`] from a verifier request and a\nholder-signed presentation.\n\nThe function:\n1. Cross-checks the presentation's `proof.challenge` against\n `request.nonce` so the response cannot be built with a stale or\n mismatched VP.\n2. Cross-checks the presentation's `proof.domain` against\n `request.client_id` for the same reason.\n3. Serializes the presentation as the `vp_token`.\n4. Echoes the request's `state`.\n\n# Errors\n\n- [`AttestationError::PresentationChallengeMismatch`] if the VP's\n challenge doesn't match the request nonce.\n- [`AttestationError::PresentationDomainMismatch`] if the VP's domain\n doesn't match the request client_id.\n- [`AttestationError::MissingProof`] if the VP is unsigned.", "attributes": "", "line": 355 }, { "name": "oid4vp::verify_oid4vp_response", "kind": "function_item", "signature": "pub fn verify_oid4vp_response(\n response: &Oid4vpResponse,\n request: &AuthorizationRequest,\n holder_public_key: &[u8],\n) -> Result;", "docs": "Validates an [`Oid4vpResponse`] against an [`AuthorizationRequest`] and\nthe holder's public key.\n\n1. Validates that `response.presentation_submission.definition_id`\n matches `request.presentation_definition.id`.\n2. Parses `response.vp_token` as an [`OasPresentation`].\n3. Calls [`crate::presentation::verify_presentation`] with the request's\n nonce and client_id, which enforces the cryptographic challenge +\n domain replay protection per Spec \u00a714.5.\n4. Confirms the descriptor map is non-empty (the verifier's input\n descriptors must be satisfied \u2014 a presentation with zero descriptors\n is rejected).\n\nOn success, returns the parsed [`OasPresentation`] for further\ninspection (e.g., to apply the holder binding rule from \u00a714.5.1).\n\n# Errors\n\n- [`AttestationError::MissingField`] if the definition IDs don't match\n or the descriptor map is empty.\n- [`AttestationError::Json`] if `vp_token` doesn't parse as a presentation.\n- Any error from [`verify_presentation`] (signature, challenge, domain).", "attributes": "", "line": 416 } ], "parseErrors": false }, { "module": "presentation", "source": "oas/oas/oas-attestation/src/presentation.rs", "sha256": "b987664d14728ebd7f56f3d60db3ab60cc953031fa55d7a29ba0f0d2a8af7a7e", "attributes": "", "items": [ { "name": "presentation::PRESENTATION_TYPE", "kind": "const_item", "signature": "pub const PRESENTATION_TYPE: &str;", "docs": "The credential / presentation type literal `\"VerifiablePresentation\"`.", "attributes": "", "line": 108 }, { "name": "presentation::OAS_PRESENTATION_TYPE", "kind": "const_item", "signature": "pub const OAS_PRESENTATION_TYPE: &str;", "docs": "The credential / presentation type literal `\"OasPresentation\"`.", "attributes": "", "line": 111 }, { "name": "presentation::AUTHENTICATION_PURPOSE", "kind": "const_item", "signature": "pub const AUTHENTICATION_PURPOSE: &str;", "docs": "The fixed proof purpose for presentation proofs (per W3C VP spec).", "attributes": "", "line": 114 }, { "name": "presentation::OasPresentation", "kind": "struct_item", "signature": "pub struct OasPresentation {\n/// JSON-LD context array.\n\n#[serde(rename = \"@context\")]\npub context: Vec,\n/// VP type array (always includes `\"VerifiablePresentation\"` and\n\n/// `\"OasPresentation\"`).\n\n#[serde(rename = \"type\")]\npub presentation_type: Vec,\n/// The holder's `did:oas` identifier \u2014 the entity presenting this VP.\n\npub holder: String,\n/// One or more verifiable credentials wrapped by this presentation.\n\npub verifiable_credential: Vec,\n/// The presentation proof (populated by [`sign_presentation`]).\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub proof: Option\n}", "docs": "An OAS Verifiable Presentation per Spec \u00a714.5.\n\nWraps one or more [`OasCredential`]s for transmission from a holder to a\nverifier. The presentation carries its own [`PresentationProof`] (separate\nfrom the per-credential proofs) that binds the holder's signing key, the\nverifier-supplied challenge, and the verifier's domain \u2014 providing replay\nprotection across sessions and verifiers.\n\n# Examples\n\n```\nuse oas_attestation::credential::OasCredential;\nuse oas_attestation::presentation::OasPresentation;\nuse oas_attestation::types::AttestationType;\n\nlet cred = OasCredential::builder()\n .issuer(\"did:oas:test:hmr:auditor\")\n .subject_id(\"did:oas:test:agent:bot\")\n .attestation_type(AttestationType::SecurityAudit)\n .issuance_date(\"2026-04-06T00:00:00Z\")\n .subject_claim(\"auditType\", serde_json::json!(\"codeAudit\"))\n .subject_claim(\"result\", serde_json::json!(\"pass\"))\n .subject_claim(\"severityFindings\", serde_json::json!({\"critical\": 0}))\n .subject_claim(\"toolOrMethodology\", serde_json::json!(\"OWASP\"))\n .subject_claim(\"auditDate\", serde_json::json!(\"2026-04-06T00:00:00Z\"))\n .build()\n .unwrap();\n\nlet vp = OasPresentation::builder()\n .holder(\"did:oas:test:agent:bot\")\n .add_credential(cred)\n .build()\n .unwrap();\n\nassert_eq!(vp.holder, \"did:oas:test:agent:bot\");\nassert_eq!(vp.verifiable_credential.len(), 1);\n```", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 159 }, { "name": "presentation::PresentationProof", "kind": "struct_item", "signature": "pub struct PresentationProof {\n/// Fixed: `\"Ed25519Signature2020\"` (the OAS baseline format).\n\n#[serde(rename = \"type\")]\npub proof_type: String,\n/// ISO 8601 timestamp when the proof was created.\n\npub created: String,\n/// Reference to the verification method used by the holder.\n\npub verification_method: String,\n/// Fixed: `\"authentication\"` (W3C VP convention for VP proofs).\n\npub proof_purpose: String,\n/// Verifier-supplied nonce \u2014 bound into the signature for replay\n\n/// protection across sessions.\n\npub challenge: String,\n/// Verifier audience identifier \u2014 bound into the signature for replay\n\n/// protection across verifiers.\n\npub domain: String,\n/// Multibase base58btc-encoded Ed25519 signature.\n\npub proof_value: String\n}", "docs": "An Ed25519Signature2020 proof on a [`OasPresentation`].\n\nPer Spec \u00a714.5, the proof structure includes a `challenge` (verifier\nnonce) and `domain` (verifier audience identifier), both of which are\npart of the signed payload. Tampering with either invalidates the\nsignature.", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 188 }, { "name": "presentation::OasPresentation::builder", "kind": "function_item", "signature": "pub fn builder() -> PresentationBuilder;", "docs": "Creates a new [`PresentationBuilder`] with sensible defaults.", "attributes": "", "line": 216 }, { "name": "presentation::OasPresentation::validate", "kind": "function_item", "signature": "pub fn validate(&self) -> Result<(), AttestationError>;", "docs": "Validates the presentation's structural invariants per Spec \u00a714.5.\n\nChecks:\n- `holder` is a valid `did:oas` identifier\n- At least one credential is present\n- Every contained credential individually validates per \u00a714.1\n\n# Errors\n\nReturns [`AttestationError`] on the first failure.", "attributes": "", "line": 230 }, { "name": "presentation::PresentationBuilder", "kind": "struct_item", "signature": "pub struct PresentationBuilder {\n\n}", "docs": "Builder for [`OasPresentation`].", "attributes": "#[derive(Debug, Default)]", "line": 260 }, { "name": "presentation::PresentationBuilder::holder", "kind": "function_item", "signature": "pub fn holder(mut self, holder: &str) -> Self;", "docs": "Sets the holder DID \u2014 the `did:oas` identifier of the presenting entity.", "attributes": "", "line": 267 }, { "name": "presentation::PresentationBuilder::add_credential", "kind": "function_item", "signature": "pub fn add_credential(mut self, credential: OasCredential) -> Self;", "docs": "Adds a credential to the presentation. Multiple credentials may be\nincluded; all are covered by the single presentation proof.", "attributes": "", "line": 274 }, { "name": "presentation::PresentationBuilder::add_credentials", "kind": "function_item", "signature": "pub fn add_credentials(mut self, credentials: impl IntoIterator) -> Self;", "docs": "Adds multiple credentials at once.", "attributes": "", "line": 280 }, { "name": "presentation::PresentationBuilder::build", "kind": "function_item", "signature": "pub fn build(self) -> Result;", "docs": "Builds an unsigned [`OasPresentation`].\n\n# Errors\n\nReturns [`AttestationError`] if the holder is missing or invalid, or\nif no credentials were added.", "attributes": "", "line": 291 }, { "name": "presentation::sign_presentation", "kind": "function_item", "signature": "pub fn sign_presentation(\n mut presentation: OasPresentation,\n holder_keypair: &OasKeyPair,\n verification_method_id: &str,\n created: &str,\n challenge: &str,\n domain: &str,\n) -> Result;", "docs": "Signs an [`OasPresentation`], producing a new presentation with an\nattached [`PresentationProof`].\n\nPer OAS Spec \u00a714.5:\n1. Validates the presentation structure\n2. Constructs the proof with the supplied challenge and domain\n3. Sets `proof.proofValue` to empty string\n4. JCS-canonicalizes the entire presentation\n5. Signs the canonical bytes with the holder's Ed25519 key\n6. Encodes the signature as multibase base58btc and stores it in\n `proof.proofValue`\n\n# Arguments\n\n* `presentation` - The unsigned presentation.\n* `holder_keypair` - The holder's signing keypair.\n* `verification_method_id` - Full verification method ID\n (e.g., `\"did:oas:test:agent:bot#key-1\"`).\n* `created` - ISO 8601 timestamp for the proof.\n* `challenge` - Verifier-supplied nonce (Spec \u00a714.5 replay protection).\n* `domain` - Verifier audience identifier (Spec \u00a714.5 replay protection).\n\n# Returns\n\nA new [`OasPresentation`] with the proof field populated.\n\n# Errors\n\nReturns [`AttestationError`] if validation, canonicalization, or signing\nfails.", "attributes": "", "line": 373 }, { "name": "presentation::verify_presentation", "kind": "function_item", "signature": "pub fn verify_presentation(\n presentation: &OasPresentation,\n holder_public_key: &[u8],\n expected_challenge: &str,\n expected_domain: &str,\n) -> Result<(), AttestationError>;", "docs": "Verifies an [`OasPresentation`] against a holder public key, with\nchallenge and domain replay protection.\n\nPer OAS Spec \u00a714.5:\n1. Validates the presentation structure\n2. Checks the proof exists and uses Ed25519Signature2020\n3. Checks the challenge matches the verifier's expected nonce\n4. Checks the domain matches the verifier's expected audience\n5. Reconstructs the canonical bytes (with proofValue set to empty)\n6. Verifies the Ed25519 signature against the holder's public key\n\nThis function does NOT enforce the \u00a714.5.1 Holder Binding Rule. Use\n[`verify_presentation_holder_binding`] for that check, or call this\nfunction followed by the binding check.\n\n# Arguments\n\n* `presentation` - The signed presentation to verify.\n* `holder_public_key` - The holder's 32-byte Ed25519 public key.\n* `expected_challenge` - The nonce the verifier originally issued.\n* `expected_domain` - The verifier's audience identifier.\n\n# Errors\n\n- [`AttestationError::MissingProof`] if the presentation has no proof.\n- [`AttestationError::PresentationChallengeMismatch`] on nonce mismatch.\n- [`AttestationError::PresentationDomainMismatch`] on audience mismatch.\n- [`AttestationError::InvalidProofSignature`] on signature failure.", "attributes": "", "line": 435 }, { "name": "presentation::is_authority_bearing", "kind": "function_item", "signature": "pub fn is_authority_bearing(attestation_type: &AttestationType) -> bool;", "docs": "Returns `true` if the given attestation type is authority-bearing per\nSpec \u00a714.5.1, meaning the strict-equality holder binding rule applies.\n\nPer Spec \u00a714.5.1, only `CapabilityVerification` is authority-bearing among\nthe standard types. Custom attestation types may opt in to authority-\nbearing classification via their registered schema; this function does\nnot currently consult an external schema registry, so all `Custom` types\ndefault to factual. Callers needing custom-schema-aware classification\nshould wrap this function and override for their custom types.", "attributes": "", "line": 508 }, { "name": "presentation::verify_presentation_holder_binding", "kind": "function_item", "signature": "pub fn verify_presentation_holder_binding(\n presentation: &OasPresentation,\n) -> Result<(), AttestationError>;", "docs": "Enforces the \u00a714.5.1 Holder Binding Rule (strict-equality form) on a\npresentation.\n\nPer Spec \u00a714.5.1:\n- **Authority-bearing** attestations (`CapabilityVerification` and any\n custom type marked authority-bearing): the holder MUST be the credential\n subject, OR a lineage descendant of the subject.\n- **Factual** attestations (`SecurityAudit`, `BehaviorAttestation`,\n `ComplianceAttestation`, `ExpertEndorsement`, `CommunityReview`,\n `LineageAttestation`): any holder MAY present.\n\nThis function enforces only the **strict-equality** branch\n(`holder == subject`). For the descendant branch, use\n[`verify_presentation_holder_binding_with_lineage`], which accepts a\nholder lineage chain and accepts the binding when the credential subject\nis any ancestor of the holder.\n\n# Arguments\n\n* `presentation` - The presentation to check.\n\n# Returns\n\n`Ok(())` if the rule is satisfied for every contained credential.\n\n# Errors\n\nReturns [`AttestationError::HolderBindingViolation`] on the first\nauthority-bearing credential whose subject DID does not match the holder.", "attributes": "", "line": 541 }, { "name": "presentation::verify_presentation_holder_binding_with_lineage", "kind": "function_item", "signature": "pub fn verify_presentation_holder_binding_with_lineage(\n presentation: &OasPresentation,\n holder_lineage_chain: &[oas_crypto::proof::AgentLineageProof],\n) -> Result<(), AttestationError>;", "docs": "Legacy raw-proof entry point for the \u00a714.5.1 Holder Binding Rule.\n\nNon-empty raw proof chains fail closed because they do not carry validated\nparent documents or verifier root policy. Use\n[`verify_presentation_holder_binding_with_resolved_lineage`] for\ndescendant-aware authorization.\n\n# Arguments\n\n* `presentation` - The signed presentation to check.\n* `holder_lineage_chain` - Legacy raw proofs. Only an empty slice is\n accepted, yielding strict-equality semantics.\n\n# Errors\n\n- [`AttestationError::LineageChainInvalid`] if any raw proof is supplied.\n- [`AttestationError::HolderBindingViolation`] if any authority-bearing\n credential's subject is neither the holder nor any ancestor proven by\n the chain.\n\n# Examples\n\n```\nuse oas_attestation::credential::OasCredential;\nuse oas_attestation::presentation::{\n verify_presentation_holder_binding_with_lineage, OasPresentation,\n};\nuse oas_attestation::sign::sign_credential;\nuse oas_attestation::types::AttestationType;\nuse oas_crypto::keypair::OasKeyPair;\nuse oas_crypto::proof::AgentLineageProof;\n\n// Parent issues a CapabilityVerification credential about itself.\nlet parent_kp = OasKeyPair::generate();\nlet cred = OasCredential::builder()\n .issuer(\"did:oas:test:hmr:parent\")\n .subject_id(\"did:oas:test:hmr:parent\")\n .attestation_type(AttestationType::CapabilityVerification)\n .issuance_date(\"2026-04-06T00:00:00Z\")\n .subject_claim(\"capabilities\", serde_json::json!([\"data-extraction\"]))\n .subject_claim(\"verificationMethod\", serde_json::json!(\"benchmark\"))\n .subject_claim(\"verificationDate\", serde_json::json!(\"2026-04-06T00:00:00Z\"))\n .build()\n .unwrap();\nlet signed = sign_credential(\n &cred, &parent_kp,\n \"did:oas:test:hmr:parent#key-1\",\n \"2026-04-06T00:00:00Z\",\n).unwrap();\n\n// Parent derives a child agent and the child holds the proof of descent.\nlet lineage = AgentLineageProof::generate(\n &parent_kp,\n \"did:oas:test:hmr:parent\",\n \"did:oas:test:agent:child\",\n \"/agent-child\",\n).unwrap();\n\n// Child holds a presentation containing the parent's capability \u2014 this is\n// legitimate because the child is a lineage descendant of the parent.\nlet vp = OasPresentation::builder()\n .holder(\"did:oas:test:agent:child\")\n .add_credential(signed)\n .build()\n .unwrap();\n\n// Raw proofs cannot select their own verification authority.\nassert!(verify_presentation_holder_binding_with_lineage(&vp, &[lineage]).is_err());\n```", "attributes": "", "line": 668 }, { "name": "presentation::verify_presentation_holder_binding_with_resolved_lineage", "kind": "function_item", "signature": "pub fn verify_presentation_holder_binding_with_resolved_lineage(\n presentation: &OasPresentation,\n holder_document: &oas_document::OasDocument,\n provider: &dyn oas_lineage::provider::DocumentProvider,\n config: &oas_lineage::config::VerifyConfig,\n) -> Result<(), AttestationError>;", "docs": "Verifies descendant holder binding through the strict lineage verifier.\n\nThis is the authorizing descendant-aware API. It resolves and validates the\ncomplete holder lineage, including parent document keys, signed bindings,\nchain continuity, current status, and verifier-controlled root anchors,\nbefore considering any ancestor credential subject covered.\n\n# Errors\n\nReturns [`AttestationError::LineageChainInvalid`] if the holder document\ndoes not match the presentation or strict lineage verification fails.\nReturns [`AttestationError::HolderBindingViolation`] when an\nauthority-bearing credential subject is outside the verified chain.", "attributes": "", "line": 689 } ], "parseErrors": false }, { "module": "proof_formats", "source": "oas/oas/oas-attestation/src/proof_formats.rs", "sha256": "958972941e10c17fae5359fed57dc1d21160a60a60bc1560f21a121015c423bb", "attributes": "", "items": [ { "name": "proof_formats::ED25519_2020", "kind": "const_item", "signature": "pub const ED25519_2020: &str;", "docs": "Identifier for the `Ed25519Signature2020` proof format (baseline).\n\nThis is the baseline format every conformant OAS implementation MUST\nsupport per Spec \u00a714.4. JSON-LD encoded, no selective disclosure, no\nholder key binding. The signature is multibase base58btc encoded under\nthe `proofValue` field of [`crate::credential::CredentialProof`].", "attributes": "", "line": 68 }, { "name": "proof_formats::VC_JOSE", "kind": "const_item", "signature": "pub const VC_JOSE: &str;", "docs": "Identifier for the `vc-jose` (JWT-VC, VC-JOSE-COSE) proof format.\n\nCompact JWS encoding suitable for transports that prefer JWT. Holder key\nbinding is provided via the `cnf` (confirmation) claim per [RFC 7800].\nImplementations supporting this format MUST decline selective disclosure\nrequests on credentials encoded with it; use [`SD_JWT_VC`] for selective\ndisclosure.", "attributes": "", "line": 77 }, { "name": "proof_formats::SD_JWT_VC", "kind": "const_item", "signature": "pub const SD_JWT_VC: &str;", "docs": "Identifier for the `sd-jwt-vc` (SD-JWT VC) proof format.\n\nCompact serialization with salted-hash selective disclosure. Holder key\nbinding via the `cnf` claim per [RFC 7800]. Implementations using this\nformat MUST use a freshly generated salt per disclosable claim per\nissuance, per OAS Spec \u00a714.6.2.\n\nThe non-selective fields enumerated in Spec \u00a714.6.1 (`issuer`,\n`credentialSubject.id`, `oasAttestationType`, `issuanceDate`, and any\npresent `expirationDate`) MUST always be disclosed to preserve verifier\npolicy enforcement.", "attributes": "", "line": 90 }, { "name": "proof_formats::DATA_INTEGRITY_2025", "kind": "const_item", "signature": "pub const DATA_INTEGRITY_2025: &str;", "docs": "Identifier for the `data-integrity-2025` (`DataIntegrityProof`) format.\n\nJSON-LD encoded with optional selective disclosure via BBS+ signature\nsuites. Holder key binding via proof options. Implementations using BBS+\nMAY produce unlinkable presentations that prevent correlation across\nmultiple presentations of the same underlying credential.", "attributes": "", "line": 98 }, { "name": "proof_formats::ProofFormatId", "kind": "enum_item", "signature": "pub enum ProofFormatId {\n /// `Ed25519Signature2020` \u2014 the OAS baseline. JSON-LD, no SD, no holder\n /// key binding. Identifier: [`ED25519_2020`].\n Ed25519Signature2020,\n /// `vc-jose` \u2014 JWT-VC compact JWS encoding. Holder key binding via `cnf`.\n /// Identifier: [`VC_JOSE`].\n VcJose,\n /// `sd-jwt-vc` \u2014 SD-JWT VC with salted-hash selective disclosure.\n /// Identifier: [`SD_JWT_VC`].\n SdJwtVc,\n /// `data-integrity-2025` \u2014 JSON-LD `DataIntegrityProof` with optional BBS+\n /// selective disclosure. Identifier: [`DATA_INTEGRITY_2025`].\n DataIntegrity2025,\n}", "docs": "A registered OAS proof format identifier.\n\nPer OAS Specification \u00a714.4, this enum enumerates the four format\nidentifiers reserved by spec version 1.2.0. Implementations MAY register\nadditional formats via the IANA registration procedure described in \u00a718 or\nin a future spec version; future identifiers will be added as variants here.\n\nVerifiers MUST reject credentials whose proof format identifier is not in\nthis registry. Implementations MUST NOT silently ignore unknown proof types.\n\n# Examples\n\n```\nuse oas_attestation::proof_formats::{ProofFormatId, ED25519_2020};\n\nlet id = ProofFormatId::Ed25519Signature2020;\nassert_eq!(id.url(), ED25519_2020);\nassert!(id.is_baseline());\nassert!(!id.supports_selective_disclosure());\n```", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]", "line": 125 }, { "name": "proof_formats::ProofFormatId::url", "kind": "function_item", "signature": "pub const fn url(self) -> &'static str;", "docs": "Returns the dereferenceable HTTPS identifier URL for this format.\n\nPer OAS Spec \u00a714.4, implementations MAY abbreviate format identifiers\nin code-level constants but MUST emit and accept the full HTTPS\nidentifier on the wire.\n\n# Returns\n\nA `&'static str` containing the canonical HTTPS URL.\n\n# Examples\n\n```\nuse oas_attestation::proof_formats::ProofFormatId;\n\nassert_eq!(\n ProofFormatId::Ed25519Signature2020.url(),\n \"https://openagent.id/proof/ed25519-2020\"\n);\n```", "attributes": "", "line": 161 }, { "name": "proof_formats::ProofFormatId::from_url", "kind": "function_item", "signature": "pub fn from_url(url: &str) -> Result;", "docs": "Parses a [`ProofFormatId`] from its dereferenceable HTTPS identifier.\n\n# Arguments\n\n* `url` - The HTTPS format identifier as published in OAS Spec \u00a714.4.\n\n# Returns\n\n`Ok(ProofFormatId)` if the URL matches a registered format.\n\n# Errors\n\nReturns [`AttestationError::UnknownProofFormat`] if the URL is not in\nthe registry. Per Spec \u00a714.4, verifiers encountering an unrecognized\nformat MUST reject the credential \u2014 callers SHOULD propagate this\nerror and refuse the credential.\n\n# Examples\n\n```\nuse oas_attestation::proof_formats::{ProofFormatId, SD_JWT_VC};\n\nlet parsed = ProofFormatId::from_url(SD_JWT_VC).unwrap();\nassert_eq!(parsed, ProofFormatId::SdJwtVc);\n\nlet unknown = ProofFormatId::from_url(\"https://example.com/unknown\");\nassert!(unknown.is_err());\n```", "attributes": "", "line": 198 }, { "name": "proof_formats::ProofFormatId::is_baseline", "kind": "function_item", "signature": "pub const fn is_baseline(self) -> bool;", "docs": "Returns `true` if this format is the OAS baseline.\n\nPer Spec \u00a714.4, every conformant implementation MUST support the\nbaseline format. Currently only `Ed25519Signature2020` is the\nbaseline.\n\n# Examples\n\n```\nuse oas_attestation::proof_formats::ProofFormatId;\n\nassert!(ProofFormatId::Ed25519Signature2020.is_baseline());\nassert!(!ProofFormatId::SdJwtVc.is_baseline());\n```", "attributes": "", "line": 231 }, { "name": "proof_formats::ProofFormatId::supports_selective_disclosure", "kind": "function_item", "signature": "pub const fn supports_selective_disclosure(self) -> bool;", "docs": "Returns `true` if this format supports selective disclosure.\n\nPer Spec \u00a714.6, only formats with this capability flag set MAY be\nused to issue credentials whose claims will be selectively disclosed\nat presentation time.\n\n# Examples\n\n```\nuse oas_attestation::proof_formats::ProofFormatId;\n\nassert!(!ProofFormatId::Ed25519Signature2020.supports_selective_disclosure());\nassert!(!ProofFormatId::VcJose.supports_selective_disclosure());\nassert!(ProofFormatId::SdJwtVc.supports_selective_disclosure());\n// data-integrity-2025 supports SD only when the BBS+ suite is used;\n// the registry flag indicates capability, not unconditional support.\nassert!(ProofFormatId::DataIntegrity2025.supports_selective_disclosure());\n```", "attributes": "", "line": 253 }, { "name": "proof_formats::ProofFormatId::supports_holder_key_binding", "kind": "function_item", "signature": "pub const fn supports_holder_key_binding(self) -> bool;", "docs": "Returns `true` if this format supports holder key binding at\npresentation time.\n\nPer Spec \u00a714.5, presentations of authority-bearing attestations\n(`CapabilityVerification` and any custom type that opts in) MUST be\nbound to the holder's key. Formats that do not support holder key\nbinding cannot be used for authority-bearing attestations that may be\npresented by a descendant of the subject.\n\n# Examples\n\n```\nuse oas_attestation::proof_formats::ProofFormatId;\n\nassert!(!ProofFormatId::Ed25519Signature2020.supports_holder_key_binding());\nassert!(ProofFormatId::VcJose.supports_holder_key_binding());\nassert!(ProofFormatId::SdJwtVc.supports_holder_key_binding());\nassert!(ProofFormatId::DataIntegrity2025.supports_holder_key_binding());\n```", "attributes": "", "line": 276 }, { "name": "proof_formats::ProofFormatId::legacy_proof_type", "kind": "function_item", "signature": "pub const fn legacy_proof_type(self) -> Option<&'static str>;", "docs": "Returns the legacy proof `type` string used in JSON-LD encoded\ncredentials, if applicable.\n\nOnly JSON-LD formats (`Ed25519Signature2020` and\n`data-integrity-2025`) carry a proof `type` field in the credential\ndocument. Compact-encoded formats (JWT-VC, SD-JWT VC) do not.\n\n# Returns\n\n`Some(&str)` for JSON-LD formats, `None` for compact-encoded formats.\n\n# Examples\n\n```\nuse oas_attestation::proof_formats::ProofFormatId;\n\nassert_eq!(\n ProofFormatId::Ed25519Signature2020.legacy_proof_type(),\n Some(\"Ed25519Signature2020\")\n);\nassert_eq!(\n ProofFormatId::DataIntegrity2025.legacy_proof_type(),\n Some(\"DataIntegrityProof\")\n);\nassert_eq!(ProofFormatId::SdJwtVc.legacy_proof_type(), None);\nassert_eq!(ProofFormatId::VcJose.legacy_proof_type(), None);\n```", "attributes": "", "line": 307 }, { "name": "proof_formats::ProofFormat", "kind": "trait_item", "signature": "pub trait ProofFormat: Send + Sync {\n /// Returns the registered format identifier per Spec \u00a714.4.\n fn format_id(&self) -> ProofFormatId;\n\n /// Returns `true` if this format supports selective disclosure of claims\n /// per Spec \u00a714.6. Default delegates to the format identifier's\n /// capability flag.\n fn supports_selective_disclosure(&self) -> bool ;\n\n /// Returns `true` if this format supports holder key binding at\n /// presentation time per Spec \u00a714.5. Default delegates to the format\n /// identifier's capability flag.\n fn supports_holder_key_binding(&self) -> bool ;\n\n /// Signs an OAS credential with this proof format and returns a new\n /// credential with the proof field populated.\n ///\n /// # Arguments\n ///\n /// * `credential` - The unsigned credential to sign.\n /// * `keypair` - The issuer's signing keypair.\n /// * `verification_method_id` - Full ID of the verification method\n /// (e.g., `\"did:oas:test:hmr:auditor#key-1\"`).\n /// * `created` - ISO 8601 timestamp for the proof.\n ///\n /// # Returns\n ///\n /// A new [`OasCredential`] with the `proof` field populated.\n ///\n /// # Errors\n ///\n /// Returns [`AttestationError`] if validation, canonicalization, or\n /// signing fails.\n fn sign(\n &self,\n credential: &OasCredential,\n keypair: &OasKeyPair,\n verification_method_id: &str,\n created: &str,\n ) -> Result;\n\n /// Verifies a signed credential against a known issuer public key.\n ///\n /// # Arguments\n ///\n /// * `credential` - The signed credential to verify.\n /// * `issuer_public_key` - The 32-byte Ed25519 public key of the issuer.\n ///\n /// # Returns\n ///\n /// `Ok(())` if the credential is valid and the proof verifies.\n ///\n /// # Errors\n ///\n /// Returns [`AttestationError`] on any validation or signature failure.\n /// Per Spec \u00a714.4, verifiers encountering an unrecognized format MUST\n /// reject the credential.\n fn verify(\n &self,\n credential: &OasCredential,\n issuer_public_key: &[u8],\n ) -> Result<(), AttestationError>;\n}", "docs": "Trait abstraction for OAS credential proof formats.\n\nPer OAS Specification \u00a714.4 (v1.2.0), this trait is the dispatch surface\nevery proof format implementation MUST satisfy. Implementations are\nstateless, reusable across many credentials, and `Send + Sync` so they can\nbe stored in registry maps shared across threads or trait objects.\n\nThe baseline implementation is [`Ed25519Signature2020Format`], which every\nconformant OAS implementation MUST support per \u00a714.4.\n\n# Future Format Implementations\n\nAdditional proof formats (`vc-jose`, `sd-jwt-vc`, `data-integrity-2025`)\nwill implement this trait in subsequent crate versions. Each new format\nwill live in its own submodule behind a feature flag and will conform to\nthe same `sign` / `verify` shape defined here.\n\n# Examples\n\n```\nuse oas_attestation::credential::OasCredential;\nuse oas_attestation::proof_formats::{Ed25519Signature2020Format, ProofFormat};\nuse oas_attestation::types::AttestationType;\nuse oas_crypto::keypair::OasKeyPair;\n\nlet format = Ed25519Signature2020Format;\nlet keypair = OasKeyPair::generate();\nlet cred = OasCredential::builder()\n .issuer(\"did:oas:test:hmr:auditor\")\n .subject_id(\"did:oas:test:agent:target\")\n .attestation_type(AttestationType::SecurityAudit)\n .issuance_date(\"2026-01-15T00:00:00Z\")\n .subject_claim(\"auditType\", serde_json::json!(\"codeAudit\"))\n .subject_claim(\"result\", serde_json::json!(\"pass\"))\n .subject_claim(\"severityFindings\", serde_json::json!({\"critical\": 0}))\n .subject_claim(\"toolOrMethodology\", serde_json::json!(\"OWASP\"))\n .subject_claim(\"auditDate\", serde_json::json!(\"2026-01-15T00:00:00Z\"))\n .build()\n .unwrap();\n\nlet signed = format.sign(\n &cred, &keypair,\n \"did:oas:test:hmr:auditor#key-1\",\n \"2026-01-15T00:00:00Z\",\n).unwrap();\n\nassert!(format.verify(&signed, &keypair.verifying_key_bytes()).is_ok());\n```", "attributes": "", "line": 378 }, { "name": "proof_formats::Ed25519Signature2020Format", "kind": "struct_item", "signature": "pub struct Ed25519Signature2020Format;", "docs": "The baseline `Ed25519Signature2020` proof format implementation per\nSpec \u00a714.4.\n\nThis is the format every conformant OAS implementation MUST support. It\nuses JCS canonicalization (RFC 8785) and Ed25519 signatures with multibase\nbase58btc encoding for the proof value, as defined in Spec \u00a713.1.\n\nThe implementation delegates to the existing module-level\n[`crate::sign::sign_credential`] and [`crate::verify::verify_credential`]\nfunctions, preserving the existing public API while adding trait-based\ndispatch for users who need to swap formats at runtime.\n\n# Examples\n\n```\nuse oas_attestation::credential::OasCredential;\nuse oas_attestation::proof_formats::{Ed25519Signature2020Format, ProofFormat, ProofFormatId};\nuse oas_attestation::types::AttestationType;\nuse oas_crypto::keypair::OasKeyPair;\n\nlet format = Ed25519Signature2020Format;\nassert_eq!(format.format_id(), ProofFormatId::Ed25519Signature2020);\nassert!(format.format_id().is_baseline());\nassert!(!format.supports_selective_disclosure());\nassert!(!format.supports_holder_key_binding());\n\nlet keypair = OasKeyPair::generate();\nlet cred = OasCredential::builder()\n .issuer(\"did:oas:test:hmr:auditor\")\n .subject_id(\"did:oas:test:agent:target\")\n .attestation_type(AttestationType::SecurityAudit)\n .issuance_date(\"2026-01-15T00:00:00Z\")\n .subject_claim(\"auditType\", serde_json::json!(\"codeAudit\"))\n .subject_claim(\"result\", serde_json::json!(\"pass\"))\n .subject_claim(\"severityFindings\", serde_json::json!({\"critical\": 0}))\n .subject_claim(\"toolOrMethodology\", serde_json::json!(\"OWASP\"))\n .subject_claim(\"auditDate\", serde_json::json!(\"2026-01-15T00:00:00Z\"))\n .build()\n .unwrap();\n\nlet signed = format.sign(\n &cred, &keypair,\n \"did:oas:test:hmr:auditor#key-1\",\n \"2026-01-15T00:00:00Z\",\n).unwrap();\n\nassert!(format.verify(&signed, &keypair.verifying_key_bytes()).is_ok());\n```", "attributes": "#[derive(Debug, Default, Clone, Copy)]", "line": 495 } ], "parseErrors": false }, { "module": "sd_jwt_vc", "source": "oas/oas/oas-attestation/src/sd_jwt_vc.rs", "sha256": "030aa958aaddddb462b84a41e56bec4b794538a7f12304be56759d3537fa1a9d", "attributes": "", "items": [ { "name": "sd_jwt_vc::SD_JWT_VC_TYP", "kind": "const_item", "signature": "pub const SD_JWT_VC_TYP: &str;", "docs": "SD-JWT VC media type per draft-ietf-oauth-sd-jwt-vc.", "attributes": "", "line": 125 }, { "name": "sd_jwt_vc::VC_CLAIM", "kind": "const_item", "signature": "pub const VC_CLAIM: &str;", "docs": "JWT payload claim name carrying the OAS credential body.", "attributes": "", "line": 128 }, { "name": "sd_jwt_vc::SD_CLAIM", "kind": "const_item", "signature": "pub const SD_CLAIM: &str;", "docs": "JWT payload claim name carrying the array of disclosure hashes.", "attributes": "", "line": 131 }, { "name": "sd_jwt_vc::SD_ALG_CLAIM", "kind": "const_item", "signature": "pub const SD_ALG_CLAIM: &str;", "docs": "JWT payload claim name declaring the hash algorithm used for `_sd`.", "attributes": "", "line": 134 }, { "name": "sd_jwt_vc::SD_ALG_SHA256", "kind": "const_item", "signature": "pub const SD_ALG_SHA256: &str;", "docs": "Hash algorithm used for `_sd` digests (`\"sha-256\"` per the IETF spec).", "attributes": "", "line": 137 }, { "name": "sd_jwt_vc::SALT_BYTE_LENGTH", "kind": "const_item", "signature": "pub const SALT_BYTE_LENGTH: usize;", "docs": "Salt length in bytes (16 bytes = 128 bits, matching the IETF reference).", "attributes": "", "line": 140 }, { "name": "sd_jwt_vc::NON_SELECTIVE_SUBJECT_FIELDS", "kind": "const_item", "signature": "pub const NON_SELECTIVE_SUBJECT_FIELDS: &[&str];", "docs": "Fields that MUST always be disclosed per OAS Spec \u00a714.6.1.\n\nThese are emitted as plain payload claims, not as `_sd` hashes, so they\nare visible to every verifier regardless of which disclosures the holder\nchooses to present.", "attributes": "", "line": 147 }, { "name": "sd_jwt_vc::Disclosure", "kind": "struct_item", "signature": "pub struct Disclosure {\n/// Base64url-encoded random salt (16 bytes raw).\n\npub salt: String,\n/// The claim name being disclosed.\n\npub claim_name: String,\n/// The claim value being disclosed.\n\npub claim_value: serde_json::Value\n}", "docs": "A single SD-JWT VC disclosure: a salted commitment to one credential\nclaim, in the form `[salt, claim_name, claim_value]`.", "attributes": "#[derive(Debug, Clone, PartialEq, Eq)]", "line": 156 }, { "name": "sd_jwt_vc::Disclosure::new_with_random_salt", "kind": "function_item", "signature": "pub fn new_with_random_salt(\n claim_name: impl Into,\n claim_value: serde_json::Value,\n ) -> Self;", "docs": "Constructs a disclosure with a freshly generated 16-byte random salt\nvia `OsRng`. Per Spec \u00a714.6.2, implementations MUST use a fresh salt\nper claim per issuance.", "attributes": "", "line": 169 }, { "name": "sd_jwt_vc::Disclosure::with_salt", "kind": "function_item", "signature": "pub fn with_salt(\n salt: impl Into,\n claim_name: impl Into,\n claim_value: serde_json::Value,\n ) -> Self;", "docs": "Constructs a disclosure with a caller-supplied salt. Use this only\nfor deterministic test fixtures; production code MUST use\n[`Self::new_with_random_salt`].", "attributes": "", "line": 185 }, { "name": "sd_jwt_vc::Disclosure::to_b64", "kind": "function_item", "signature": "pub fn to_b64(&self) -> Result;", "docs": "Encodes the disclosure as base64url(JSON([salt, claim_name, claim_value])).", "attributes": "", "line": 198 }, { "name": "sd_jwt_vc::Disclosure::from_b64", "kind": "function_item", "signature": "pub fn from_b64(b64: &str) -> Result;", "docs": "Parses a disclosure from its base64url(JSON) form.", "attributes": "", "line": 209 }, { "name": "sd_jwt_vc::Disclosure::hash", "kind": "function_item", "signature": "pub fn hash(&self) -> Result;", "docs": "Returns the base64url-encoded SHA-256 hash of the disclosure's\nbase64url string. This is the value placed in the payload's `_sd`\narray per Spec \u00a714.6 + draft-ietf-oauth-sd-jwt-vc.", "attributes": "", "line": 252 }, { "name": "sd_jwt_vc::SdJwtVcPayload", "kind": "struct_item", "signature": "pub struct SdJwtVcPayload {\npub iss: String,\npub sub: String,\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub nbf: Option,\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub exp: Option,\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub jti: Option,\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub cnf: Option,\n/// Hash algorithm declaration \u2014 fixed to `\"sha-256\"`.\n\n#[serde(rename = \"_sd_alg\")]\npub sd_alg: String,\n/// Disclosure hash digests, in arbitrary order.\n\n#[serde(rename = \"_sd\")]\npub sd: Vec,\n/// The OAS credential body, with selectively disclosable claims removed\n\n/// from `credentialSubject`. The non-selective fields per Spec \u00a714.6.1\n\n/// remain in place.\n\npub vc: serde_json::Value\n}", "docs": "SD-JWT VC payload \u2014 JWT registered claims plus `_sd` (disclosure hashes),\n`_sd_alg` (hash algorithm), and the always-disclosed `vc` body.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 268 }, { "name": "sd_jwt_vc::SdJwtVcHeader", "kind": "struct_item", "signature": "pub struct SdJwtVcHeader {\npub alg: String,\npub typ: String,\npub kid: String\n}", "docs": "JOSE header for an SD-JWT VC.", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]", "line": 297 }, { "name": "sd_jwt_vc::SdJwtVcHeader::new", "kind": "function_item", "signature": "pub fn new(alg: impl Into, kid: impl Into) -> Self;", "docs": "", "attributes": "", "line": 304 }, { "name": "sd_jwt_vc::SdJwtVcSignOptions", "kind": "struct_item", "signature": "pub struct SdJwtVcSignOptions {\npub verification_method_id: String,\npub issuance_unix_seconds: Option,\npub jwt_id: Option,\npub holder_public_key_jwk: Option\n}", "docs": "Caller-supplied options for [`sign_credential_sd_jwt_vc`].", "attributes": "#[derive(Debug, Clone)]", "line": 319 }, { "name": "sd_jwt_vc::SdJwtVc", "kind": "struct_item", "signature": "pub struct SdJwtVc {\n\n}", "docs": "An issuer-signed SD-JWT VC, including all original disclosures.\n\nAt presentation time, the holder uses [`present_sd_jwt_vc`] to produce a\nnew compact form containing only a subset of disclosures.", "attributes": "#[derive(Debug, Clone)]", "line": 335 }, { "name": "sd_jwt_vc::SdJwtVc::header", "kind": "function_item", "signature": "pub fn header(&self) -> &SdJwtVcHeader;", "docs": "", "attributes": "", "line": 348 }, { "name": "sd_jwt_vc::SdJwtVc::payload", "kind": "function_item", "signature": "pub fn payload(&self) -> &SdJwtVcPayload;", "docs": "", "attributes": "", "line": 351 }, { "name": "sd_jwt_vc::SdJwtVc::disclosures", "kind": "function_item", "signature": "pub fn disclosures(&self) -> &[Disclosure];", "docs": "", "attributes": "", "line": 354 }, { "name": "sd_jwt_vc::SdJwtVc::as_compact_string", "kind": "function_item", "signature": "pub fn as_compact_string(&self) -> &str;", "docs": "", "attributes": "", "line": 357 }, { "name": "sd_jwt_vc::SdJwtVc::issuer", "kind": "function_item", "signature": "pub fn issuer(&self) -> &str;", "docs": "", "attributes": "", "line": 360 }, { "name": "sd_jwt_vc::SdJwtVc::subject", "kind": "function_item", "signature": "pub fn subject(&self) -> &str;", "docs": "", "attributes": "", "line": 363 }, { "name": "sd_jwt_vc::SdJwtVc::algorithm", "kind": "function_item", "signature": "pub fn algorithm(&self) -> &str;", "docs": "", "attributes": "", "line": 366 }, { "name": "sd_jwt_vc::SdJwtVc::disclosed_claim", "kind": "function_item", "signature": "pub fn disclosed_claim(&self, claim_name: &str) -> Option<&serde_json::Value>;", "docs": "Returns a disclosed claim by name, or `None` if it isn't included\nin the disclosures (either because the holder didn't include it or\nbecause it was never disclosable).", "attributes": "", "line": 373 }, { "name": "sd_jwt_vc::SdJwtVc::format_id", "kind": "function_item", "signature": "pub const fn format_id() -> ProofFormatId;", "docs": "", "attributes": "", "line": 380 }, { "name": "sd_jwt_vc::SdJwtVc::format_url", "kind": "function_item", "signature": "pub const fn format_url() -> &'static str;", "docs": "", "attributes": "", "line": 383 }, { "name": "sd_jwt_vc::sign_credential_sd_jwt_vc", "kind": "function_item", "signature": "pub fn sign_credential_sd_jwt_vc(\n credential: &OasCredential,\n signer: &dyn Signer,\n options: &SdJwtVcSignOptions,\n) -> Result;", "docs": "Issues an SD-JWT VC for the given credential.\n\nPer Spec \u00a714.6.1, the non-selective fields (`issuer`, `credentialSubject.id`,\n`oasAttestationType`, `issuanceDate`, `expirationDate`) remain in plain\nview. All other `credentialSubject` fields become selectively disclosable\ndisclosures.\n\nThe returned [`SdJwtVc`] holds the full set of disclosures so the\nholder can later choose which subset to present via [`present_sd_jwt_vc`].", "attributes": "", "line": 426 }, { "name": "sd_jwt_vc::verify_sd_jwt_vc", "kind": "function_item", "signature": "pub fn verify_sd_jwt_vc(\n compact: &str,\n verifier: &dyn Verifier,\n) -> Result;", "docs": "Verifies an SD-JWT VC compact string against an issuer [`Verifier`].\n\nPer Spec \u00a714.6 + draft-ietf-oauth-sd-jwt-vc:\n1. Splits the compact form on `~` \u2014 first segment is the JWT, remaining\n are disclosures (with the trailing tilde producing an empty final\n element which is dropped).\n2. Validates the JOSE header type is `vc+sd-jwt`.\n3. Enforces algorithm match between header and verifier.\n4. Verifies the JWT signature over `header.payload`.\n5. For each presented disclosure, recomputes its hash and confirms the\n hash is in the payload's `_sd` array. **Disclosures whose hash is\n not in `_sd` cause rejection** \u2014 this is the integrity binding that\n prevents holders from injecting unrelated claims.\n\nOn success, returns an [`SdJwtVc`] populated with the disclosures\nincluded in the input. The verifier can then call `disclosed_claim` to\ninspect individual revealed claims.", "attributes": "", "line": 544 }, { "name": "sd_jwt_vc::present_sd_jwt_vc", "kind": "function_item", "signature": "pub fn present_sd_jwt_vc(\n issued: &SdJwtVc,\n claims_to_disclose: &[&str],\n) -> Result;", "docs": "Builds a derived SD-JWT VC presentation containing only the disclosures\nfor the requested claim names.\n\nPer Spec \u00a714.6, the holder can selectively reveal a subset of the\noriginally disclosed claims at presentation time. The verifier still\nvalidates the JWT signature against the issuer key \u2014 the `_sd` hashes\ncommit to all disclosures the issuer attached, so the holder cannot\ninvent new claims, only choose which to hide.\n\nClaim names not present in the original disclosures are silently\nskipped (they may be non-selective fields that are already plain-view\nin the payload).", "attributes": "", "line": 657 } ], "parseErrors": false }, { "module": "sign", "source": "oas/oas/oas-attestation/src/sign.rs", "sha256": "86ff420604f984017407bd53da44360939390bafb44649efcca0007c2c9bff30", "attributes": "", "items": [ { "name": "sign::sign_credential", "kind": "function_item", "signature": "pub fn sign_credential(\n credential: &OasCredential,\n keypair: &OasKeyPair,\n verification_method_id: &str,\n created: &str,\n) -> Result;", "docs": "Signs an OAS credential, producing a new credential with an attached proof.\n\nImplements the Ed25519Signature2020 proof suite per OAS Specification \u00a713.1:\n1. Validates the credential structure\n2. Serializes to JSON without the `proof` field\n3. Canonicalizes via JCS (RFC 8785)\n4. Signs the canonical bytes with Ed25519\n5. Encodes the signature as multibase base58btc (`z` prefix)\n\n# Arguments\n\n* `credential` - The unsigned credential to sign.\n* `keypair` - The issuer's Ed25519 keypair.\n* `verification_method_id` - Full ID of the verification method\n (e.g., `\"did:oas:test:hmr:auditor#key-1\"`).\n* `created` - ISO 8601 timestamp for the proof.\n\n# Returns\n\nA new [`OasCredential`] with the `proof` field populated.\n\n# Errors\n\nReturns [`AttestationError::ProofGenerationFailed`] if canonicalization or signing fails.\nReturns other [`AttestationError`] variants if validation fails.\n\n# Examples\n\n```\nuse oas_attestation::credential::OasCredential;\nuse oas_attestation::types::AttestationType;\nuse oas_attestation::sign::sign_credential;\nuse oas_crypto::keypair::OasKeyPair;\n\nlet keypair = OasKeyPair::generate();\nlet cred = OasCredential::builder()\n .issuer(\"did:oas:test:hmr:auditor\")\n .subject_id(\"did:oas:test:agent:target\")\n .issuance_date(\"2026-01-15T00:00:00Z\")\n .subject_claim(\"auditType\", serde_json::json!(\"codeAudit\"))\n .subject_claim(\"result\", serde_json::json!(\"pass\"))\n .subject_claim(\"severityFindings\", serde_json::json!({\"critical\": 0}))\n .subject_claim(\"toolOrMethodology\", serde_json::json!(\"OWASP\"))\n .subject_claim(\"auditDate\", serde_json::json!(\"2026-01-15T00:00:00Z\"))\n .attestation_type(AttestationType::SecurityAudit)\n .build()\n .unwrap();\n\nlet signed = sign_credential(\n &cred,\n &keypair,\n \"did:oas:test:hmr:auditor#key-1\",\n \"2026-01-15T00:00:00Z\",\n);\nassert!(signed.is_ok());\nassert!(signed.unwrap().proof.is_some());\n```", "attributes": "", "line": 73 } ], "parseErrors": false }, { "module": "signer", "source": "oas/oas/oas-attestation/src/signer.rs", "sha256": "d2a2ec0b3933204d3390bd7082e07d8f69c3dae636de1758df836561b09db857", "attributes": "", "items": [ { "name": "signer::ALG_EDDSA", "kind": "const_item", "signature": "pub const ALG_EDDSA: &str;", "docs": "JOSE algorithm identifier for Ed25519 (`EdDSA`).", "attributes": "", "line": 58 }, { "name": "signer::Signer", "kind": "trait_item", "signature": "pub trait Signer: Send + Sync {\n /// Returns the JOSE-style algorithm identifier for this signer\n /// (e.g., `\"EdDSA\"`, `\"ES256\"`, `\"RS256\"`).\n ///\n /// Verifiers consume this string to route the signature bytes to a\n /// matching verification routine.\n fn algorithm(&self) -> &'static str;\n\n /// Signs the given message and returns the raw signature bytes.\n ///\n /// # Arguments\n ///\n /// * `message` - The message bytes to sign. Typically this is the\n /// JCS-canonicalized credential or presentation payload.\n ///\n /// # Returns\n ///\n /// The signature bytes in the algorithm's natural binary form (not\n /// base-encoded). For Ed25519 this is 64 bytes.\n ///\n /// # Errors\n ///\n /// Returns [`AttestationError`] if the underlying signing operation\n /// fails. Pure-software signers typically do not fail; HSM-backed or\n /// remote signers may.\n fn sign(&self, message: &[u8]) -> Result, AttestationError>;\n\n /// Returns the public key bytes for this signer in the algorithm's\n /// canonical form.\n ///\n /// For Ed25519 this is the 32-byte verifying key. For ECDSA P-256 this\n /// is typically the SEC1 uncompressed point. The caller decides how to\n /// encode the bytes for transport.\n fn public_key_bytes(&self) -> Vec;\n}", "docs": "A cryptographic signer for OAS attestation and presentation proofs.\n\nImplementations are stateless with respect to the message being signed:\nthe same `Signer` instance can be reused across many sign calls. They are\n`Send + Sync` so they can be shared across threads and stored as\n`Box` trait objects in proof format dispatch tables.\n\nThe trait is intentionally minimal \u2014 `algorithm()`, `sign()`,\n`public_key_bytes()` \u2014 so it can adapt to any of the algorithm families\nreferenced by the OAS proof format registry (Ed25519 / ECDSA P-256\nRSA / BBS+ / etc.).\n\n# Examples\n\n```\nuse oas_attestation::signer::{OasKeyPairSigner, Signer};\nuse oas_crypto::keypair::OasKeyPair;\n\nlet keypair = OasKeyPair::generate();\nlet signer = OasKeyPairSigner::new(&keypair);\nlet signature = signer.sign(b\"hello\").unwrap();\nassert!(!signature.is_empty());\n```", "attributes": "", "line": 87 }, { "name": "signer::Verifier", "kind": "trait_item", "signature": "pub trait Verifier: Send + Sync {\n /// Returns the JOSE-style algorithm identifier for this verifier.\n fn algorithm(&self) -> &'static str;\n\n /// Verifies that `signature` is a valid signature over `message` under\n /// this verifier's public key.\n ///\n /// # Arguments\n ///\n /// * `message` - The message bytes that were signed.\n /// * `signature` - The raw signature bytes.\n ///\n /// # Errors\n ///\n /// Returns [`AttestationError::InvalidProofSignature`] if the signature\n /// fails verification for any reason (wrong key, tampered message,\n /// malformed signature, etc.).\n fn verify(&self, message: &[u8], signature: &[u8]) -> Result<(), AttestationError>;\n}", "docs": "A cryptographic verifier for OAS attestation and presentation proofs.\n\nLike [`Signer`], `Verifier` is stateless and `Send + Sync`. It exposes\nthe same algorithm identifier so dispatch tables can match a credential's\ndeclared proof format against a registered verifier.", "attributes": "", "line": 132 }, { "name": "signer::OasKeyPairSigner", "kind": "struct_item", "signature": "pub struct OasKeyPairSigner<'a> {\n\n}", "docs": "Adapter that implements [`Signer`] for an existing\n[`oas_crypto::keypair::OasKeyPair`].\n\nThis is the bridge between the existing Ed25519-only OAS APIs and the\nalgorithm-agnostic `Signer` trait. It uses the `\"EdDSA\"` JOSE algorithm\nidentifier and the existing `OasKeyPair::sign` routine, so producing a\nsignature through this adapter is byte-equivalent to calling the keypair\ndirectly.\n\nThe adapter borrows the keypair, so the signer's lifetime is tied to the\nkeypair's lifetime. This avoids any clone or zeroize concerns for the\nsecret key material.\n\n# Examples\n\n```\nuse oas_attestation::signer::{OasKeyPairSigner, Signer, ALG_EDDSA};\nuse oas_crypto::keypair::OasKeyPair;\n\nlet keypair = OasKeyPair::generate();\nlet signer = OasKeyPairSigner::new(&keypair);\nassert_eq!(signer.algorithm(), ALG_EDDSA);\n\nlet signature = signer.sign(b\"hello\").unwrap();\nassert_eq!(signature.len(), 64); // Ed25519 signatures are 64 bytes\n```", "attributes": "#[derive(Debug)]", "line": 183 }, { "name": "signer::OasKeyPairSigner<'a>::new", "kind": "function_item", "signature": "pub fn new(keypair: &'a OasKeyPair) -> Self;", "docs": "Creates a new Ed25519 signer from an [`OasKeyPair`] reference.", "attributes": "", "line": 189 }, { "name": "signer::OasKeyPairVerifier", "kind": "struct_item", "signature": "pub struct OasKeyPairVerifier<'a> {\n\n}", "docs": "Adapter that implements [`Verifier`] for a borrowed Ed25519 public key.\n\nVerification uses the existing\n[`oas_crypto::keypair::OasKeyPair::verify_with_key`] routine, so accepting\na signature through this adapter is byte-equivalent to calling the\nunderlying function directly.\n\n# Examples\n\n```\nuse oas_attestation::signer::{OasKeyPairSigner, OasKeyPairVerifier, Signer, Verifier};\nuse oas_crypto::keypair::OasKeyPair;\n\nlet keypair = OasKeyPair::generate();\nlet signer = OasKeyPairSigner::new(&keypair);\nlet public_key = keypair.verifying_key_bytes();\nlet verifier = OasKeyPairVerifier::new(&public_key);\n\nlet signature = signer.sign(b\"important payload\").unwrap();\nassert!(verifier.verify(b\"important payload\", &signature).is_ok());\nassert!(verifier.verify(b\"tampered payload\", &signature).is_err());\n```", "attributes": "#[derive(Debug)]", "line": 235 }, { "name": "signer::OasKeyPairVerifier<'a>::new", "kind": "function_item", "signature": "pub fn new(public_key: &'a [u8]) -> Self;", "docs": "Creates a new Ed25519 verifier from a borrowed public key byte slice.\n\nThe slice MUST be 32 bytes (the Ed25519 verifying key length).\nVerification will fail with `InvalidProofSignature` if it is not.", "attributes": "", "line": 244 } ], "parseErrors": false }, { "module": "types", "source": "oas/oas/oas-attestation/src/types.rs", "sha256": "c1a59688117ef835c95ecb653755d55fe6ab510ead834be9d686a0d69ccd360b", "attributes": "", "items": [ { "name": "types::AttestationType", "kind": "enum_item", "signature": "pub enum AttestationType {\n /// Results of a security analysis (vulnerability scan, code audit, penetration test).\n SecurityAudit,\n /// Attestation about observed runtime behavior over a period.\n BehaviorAttestation,\n /// Verification that an entity possesses claimed capabilities.\n CapabilityVerification,\n /// Attestation of compliance with a regulatory framework or standard.\n ComplianceAttestation,\n /// Endorsement by a verified domain expert.\n ExpertEndorsement,\n /// Community-sourced review with aggregated trust score.\n CommunityReview,\n /// Lineage Attestation Bridge per OAS Spec \u00a714.7 \u2014 opt-in lossless export\n /// of an `AgentLineageProof2025` (\u00a710) into W3C VC form for\n /// interoperability with VC-native verifiers.\n LineageAttestation,\n /// A custom attestation type not defined in the specification.\n ///\n /// The string value SHOULD be published at a well-known URI within\n /// the issuer's namespace.\n Custom(String),\n}", "docs": "An OAS attestation type per Specification \u00a713.2.\n\nSix standard types are defined. Implementations MAY register custom\nattestation types by defining a new value and publishing its schema.\n\n# Examples\n\n```\nuse oas_attestation::types::AttestationType;\n\nlet at = AttestationType::SecurityAudit;\nassert_eq!(at.as_str(), \"SecurityAudit\");\n\nlet parsed: AttestationType = \"BehaviorAttestation\".parse().unwrap();\nassert_eq!(parsed, AttestationType::BehaviorAttestation);\n```", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]", "line": 30 }, { "name": "types::AttestationType::as_str", "kind": "function_item", "signature": "pub fn as_str(&self) -> &str;", "docs": "Returns the canonical string representation of this attestation type.\n\n# Returns\n\nThe OAS \u00a713.2 type name (e.g., `\"SecurityAudit\"`) or the custom value.", "attributes": "", "line": 60 }, { "name": "types::AttestationType::required_fields", "kind": "function_item", "signature": "pub fn required_fields(&self) -> &[&str];", "docs": "Returns the required `credentialSubject` fields for this attestation type.\n\nPer OAS Specification \u00a713.2, each standard type defines a minimum\nset of fields. Implementations MAY extend these schemas.\n\n# Returns\n\nA slice of field names that MUST be present in the credential subject.\nDoes not include `\"id\"` and `\"attestationType\"` which are always required.", "attributes": "", "line": 82 }, { "name": "types::AttestationType::validate_subject", "kind": "function_item", "signature": "pub fn validate_subject(&self, subject: &serde_json::Value) -> Result<(), AttestationError>;", "docs": "Validates that a credential subject contains all required fields for this type.\n\n# Arguments\n\n* `subject` - The credential subject as a JSON object.\n\n# Returns\n\n`Ok(())` if all required fields are present.\n\n# Errors\n\nReturns [`AttestationError::MissingField`] if a required field is absent.", "attributes": "", "line": 129 } ], "parseErrors": false }, { "module": "vc_jose", "source": "oas/oas/oas-attestation/src/vc_jose.rs", "sha256": "bc53b9e6bf836e08e39faab3f7f89f73044baba653623da2e60db6d53fa8e70a", "attributes": "", "items": [ { "name": "vc_jose::JWT_VC_TYP", "kind": "const_item", "signature": "pub const JWT_VC_TYP: &str;", "docs": "JWT-VC media type per W3C VC-JOSE-COSE.", "attributes": "", "line": 92 }, { "name": "vc_jose::VC_CLAIM", "kind": "const_item", "signature": "pub const VC_CLAIM: &str;", "docs": "JWT-VC payload claim name carrying the OAS credential body.", "attributes": "", "line": 95 }, { "name": "vc_jose::JwtVcHeader", "kind": "struct_item", "signature": "pub struct JwtVcHeader {\n/// Algorithm identifier (matches the [`Signer::algorithm`] used).\n\npub alg: String,\n/// Media type \u2014 fixed to `\"vc+jwt\"`.\n\npub typ: String,\n/// Verification method ID (the `did:oas:...#key-id` of the issuer key).\n\npub kid: String\n}", "docs": "JOSE header for a JWT-VC compact serialization.", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]", "line": 103 }, { "name": "vc_jose::JwtVcHeader::new", "kind": "function_item", "signature": "pub fn new(alg: impl Into, kid: impl Into) -> Self;", "docs": "Constructs the canonical header for a given algorithm and verification\nmethod ID.", "attributes": "", "line": 115 }, { "name": "vc_jose::JwtVcPayload", "kind": "struct_item", "signature": "pub struct JwtVcPayload {\n/// Issuer DID (RFC 7519 \u00a74.1.1).\n\npub iss: String,\n/// Subject DID (RFC 7519 \u00a74.1.2).\n\npub sub: String,\n/// \"Not before\" \u2014 Unix seconds, derived from credential issuance date.\n\n/// (RFC 7519 \u00a74.1.5).\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub nbf: Option,\n/// JWT ID (RFC 7519 \u00a74.1.7).\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub jti: Option,\n/// Holder confirmation key per RFC 7800 (`cnf.jwk`).\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub cnf: Option,\n/// The OAS credential body (without its native Ed25519Signature2020\n\n/// proof \u2014 the JWT signature replaces it).\n\npub vc: serde_json::Value\n}", "docs": "JWT-VC payload \u2014 JWT registered claims plus the `vc` claim carrying the\nOAS credential body.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 131 }, { "name": "vc_jose::JwtVcSignOptions", "kind": "struct_item", "signature": "pub struct JwtVcSignOptions {\n/// Full verification method ID\n\n/// (e.g., `\"did:oas:test:hmr:auditor#key-1\"`).\n\npub verification_method_id: String,\n/// Optional explicit `nbf` claim (Unix seconds). If `None`, the function\n\n/// attempts to parse the credential's `issuanceDate` (ISO 8601) and\n\n/// converts it to Unix seconds. If parsing fails, `nbf` is omitted.\n\npub issuance_unix_seconds: Option,\n/// Optional JWT ID. If `None`, no `jti` claim is emitted.\n\npub jwt_id: Option,\n/// Optional holder confirmation key per RFC 7800. If supplied, embedded\n\n/// under `payload.cnf.jwk`. Used by verifiers to enforce the \u00a714.5.1\n\n/// holder binding rule for authority-bearing credentials presented over\n\n/// JWT-VC.\n\npub holder_public_key_jwk: Option\n}", "docs": "Caller-supplied options for [`sign_credential_jwt_vc`].", "attributes": "#[derive(Debug, Clone)]", "line": 157 }, { "name": "vc_jose::JwtVc", "kind": "struct_item", "signature": "pub struct JwtVc {\n\n}", "docs": "A parsed JWT-VC ready for inspection.\n\nReturned by [`verify_jwt_vc`] (after the signature has been validated)\nand by [`parse_jwt_vc`] (without verification \u2014 for inspection only).", "attributes": "#[derive(Debug, Clone)]", "line": 186 }, { "name": "vc_jose::JwtVc::header", "kind": "function_item", "signature": "pub fn header(&self) -> &JwtVcHeader;", "docs": "Returns the JOSE header.", "attributes": "", "line": 195 }, { "name": "vc_jose::JwtVc::payload", "kind": "function_item", "signature": "pub fn payload(&self) -> &JwtVcPayload;", "docs": "Returns the JWT payload.", "attributes": "", "line": 200 }, { "name": "vc_jose::JwtVc::as_compact_string", "kind": "function_item", "signature": "pub fn as_compact_string(&self) -> &str;", "docs": "Returns the compact serialization (`header.payload.signature`).", "attributes": "", "line": 205 }, { "name": "vc_jose::JwtVc::issuer", "kind": "function_item", "signature": "pub fn issuer(&self) -> &str;", "docs": "Returns the issuer DID from the payload.", "attributes": "", "line": 210 }, { "name": "vc_jose::JwtVc::subject", "kind": "function_item", "signature": "pub fn subject(&self) -> &str;", "docs": "Returns the subject DID from the payload.", "attributes": "", "line": 215 }, { "name": "vc_jose::JwtVc::algorithm", "kind": "function_item", "signature": "pub fn algorithm(&self) -> &str;", "docs": "Returns the algorithm identifier from the JOSE header.", "attributes": "", "line": 220 }, { "name": "vc_jose::JwtVc::verification_method_id", "kind": "function_item", "signature": "pub fn verification_method_id(&self) -> &str;", "docs": "Returns the verification method ID (`kid`) from the JOSE header.", "attributes": "", "line": 225 }, { "name": "vc_jose::JwtVc::holder_confirmation_key", "kind": "function_item", "signature": "pub fn holder_confirmation_key(&self) -> Option<&serde_json::Value>;", "docs": "Returns the holder confirmation key (`cnf.jwk`) per RFC 7800, if\nthe credential was signed with one.", "attributes": "", "line": 231 }, { "name": "vc_jose::JwtVc::to_credential", "kind": "function_item", "signature": "pub fn to_credential(&self) -> Result;", "docs": "Reconstructs the original [`OasCredential`] body from the `vc` claim.\n\nThe reconstructed credential will not carry an\n`Ed25519Signature2020` proof \u2014 the JWT signature replaces it.\nVerifying this credential structurally (via [`OasCredential::validate`])\nwill succeed; verifying it cryptographically via\n[`crate::verify::verify_credential`] will fail because there is no\nproof field. Use [`verify_jwt_vc`] for cryptographic verification of\nJWT-VC credentials.", "attributes": "", "line": 244 }, { "name": "vc_jose::JwtVc::format_id", "kind": "function_item", "signature": "pub const fn format_id() -> ProofFormatId;", "docs": "Returns the registered OAS proof format identifier this JWT-VC\nrepresents.", "attributes": "", "line": 251 }, { "name": "vc_jose::JwtVc::format_url", "kind": "function_item", "signature": "pub const fn format_url() -> &'static str;", "docs": "Returns the canonical OAS format identifier URL for this format.", "attributes": "", "line": 256 }, { "name": "vc_jose::sign_credential_jwt_vc", "kind": "function_item", "signature": "pub fn sign_credential_jwt_vc(\n credential: &OasCredential,\n signer: &dyn Signer,\n options: &JwtVcSignOptions,\n) -> Result;", "docs": "Signs an [`OasCredential`] as a JWT-VC compact string per OAS Spec \u00a714.4.\n\nThe credential's existing proof (if any) is stripped before encoding \u2014\nthe JWT signature replaces it. The result is a [`JwtVc`] wrapping the\ncompact serialization, the parsed header, and the parsed payload.\n\n# Arguments\n\n* `credential` - The credential to sign.\n* `signer` - Any [`Signer`] implementation. The signer's\n `algorithm()` is used as the `alg` JOSE header value.\n* `options` - Sign options (verification method ID, optional `nbf`\n `jti` / `cnf` claims).\n\n# Errors\n\nReturns [`AttestationError`] on JSON serialization or signing failure.", "attributes": "", "line": 307 }, { "name": "vc_jose::parse_jwt_vc", "kind": "function_item", "signature": "pub fn parse_jwt_vc(compact: &str) -> Result;", "docs": "Parses a JWT-VC compact string **without** verifying its signature.\n\nReturns a [`JwtVc`] for inspection. **Do not** trust any field returned\nby this function until [`verify_jwt_vc`] has succeeded against a known\nissuer public key.", "attributes": "", "line": 370 }, { "name": "vc_jose::verify_jwt_vc", "kind": "function_item", "signature": "pub fn verify_jwt_vc(compact: &str, verifier: &dyn Verifier) -> Result;", "docs": "Verifies a JWT-VC compact string against a known issuer [`Verifier`].\n\nPer OAS Spec \u00a714.4:\n1. Parses the three-segment compact form.\n2. Validates the JOSE header type and decodes the payload.\n3. Decodes the base64url signature.\n4. Routes the signature to the supplied verifier \u2014 the verifier's\n `algorithm()` MUST match the JOSE header `alg`, otherwise this\n function rejects with `InvalidProofSignature`.\n5. Re-derives the signing input (`base64url(header).base64url(payload)`)\n and verifies the signature against the verifier's public key.\n\nOn success, returns the parsed [`JwtVc`] with all claims accessible.\n\n# Errors\n\n- [`AttestationError::InvalidProofSignature`] on any structural,\n parsing, algorithm-mismatch, or cryptographic failure.", "attributes": "", "line": 422 } ], "parseErrors": false }, { "module": "verify", "source": "oas/oas/oas-attestation/src/verify.rs", "sha256": "5bc06575da77ebb7e2a866752baca3b924e8d377a2019837c9e127e080569d69", "attributes": "", "items": [ { "name": "verify::verify_credential", "kind": "function_item", "signature": "pub fn verify_credential(\n credential: &OasCredential,\n issuer_public_key: &[u8],\n) -> Result<(), AttestationError>;", "docs": "Verifies an OAS credential's proof against a known issuer public key.\n\nImplements verification per OAS Specification \u00a713.1:\n1. Validates the credential structure (issuer/subject DIDs, required fields)\n2. Checks that the proof exists and uses `Ed25519Signature2020`\n3. Serializes the credential without proof\n4. Canonicalizes via JCS (RFC 8785)\n5. Decodes the multibase signature\n6. Verifies the Ed25519 signature against the issuer's public key\n\nThis function does NOT check expiration or temporal validity.\nUse [`verify_credential_with_time`] for time-aware verification.\n\n# Arguments\n\n* `credential` - The signed credential to verify.\n* `issuer_public_key` - The 32-byte Ed25519 public key of the issuer.\n\n# Returns\n\n`Ok(())` if the credential is valid and the proof verifies.\n\n# Errors\n\n- [`AttestationError::MissingProof`] if no proof is present.\n- [`AttestationError::InvalidProofSignature`] if the proof type is wrong or signature is invalid.\n- [`AttestationError::InvalidIssuer`] or [`AttestationError::InvalidSubject`] for DID validation failures.\n\n# Examples\n\n```\nuse oas_attestation::credential::OasCredential;\nuse oas_attestation::types::AttestationType;\nuse oas_attestation::sign::sign_credential;\nuse oas_attestation::verify::verify_credential;\nuse oas_crypto::keypair::OasKeyPair;\n\nlet keypair = OasKeyPair::generate();\nlet cred = OasCredential::builder()\n .issuer(\"did:oas:test:hmr:auditor\")\n .subject_id(\"did:oas:test:agent:target\")\n .issuance_date(\"2026-01-15T00:00:00Z\")\n .subject_claim(\"auditType\", serde_json::json!(\"codeAudit\"))\n .subject_claim(\"result\", serde_json::json!(\"pass\"))\n .subject_claim(\"severityFindings\", serde_json::json!({\"critical\": 0}))\n .subject_claim(\"toolOrMethodology\", serde_json::json!(\"OWASP\"))\n .subject_claim(\"auditDate\", serde_json::json!(\"2026-01-15T00:00:00Z\"))\n .attestation_type(AttestationType::SecurityAudit)\n .build()\n .unwrap();\n\nlet signed = sign_credential(\n &cred, &keypair,\n \"did:oas:test:hmr:auditor#key-1\",\n \"2026-01-15T00:00:00Z\",\n).unwrap();\n\nlet result = verify_credential(&signed, &keypair.verifying_key_bytes());\nassert!(result.is_ok());\n```", "attributes": "", "line": 74 }, { "name": "verify::verify_credential_with_time", "kind": "function_item", "signature": "pub fn verify_credential_with_time(\n credential: &OasCredential,\n issuer_public_key: &[u8],\n now: &str,\n) -> Result<(), AttestationError>;", "docs": "Verifies an OAS credential with temporal checks.\n\nPerforms all checks from [`verify_credential`] plus:\n- Checks that `issuanceDate` is not in the future\n- Checks that `expirationDate` (if present) has not passed\n\n# Arguments\n\n* `credential` - The signed credential to verify.\n* `issuer_public_key` - The 32-byte Ed25519 public key of the issuer.\n* `now` - The current time as an ISO 8601 string for comparison.\n\n# Returns\n\n`Ok(())` if the credential is valid, the proof verifies, and temporal constraints hold.\n\n# Errors\n\nAll errors from [`verify_credential`], plus:\n- [`AttestationError::NotYetValid`] if `issuanceDate` is in the future.\n- [`AttestationError::Expired`] if `expirationDate` has passed.\n\n# Examples\n\n```\nuse oas_attestation::credential::OasCredential;\nuse oas_attestation::types::AttestationType;\nuse oas_attestation::sign::sign_credential;\nuse oas_attestation::verify::verify_credential_with_time;\nuse oas_crypto::keypair::OasKeyPair;\n\nlet keypair = OasKeyPair::generate();\nlet cred = OasCredential::builder()\n .issuer(\"did:oas:test:hmr:auditor\")\n .subject_id(\"did:oas:test:agent:target\")\n .issuance_date(\"2026-01-15T00:00:00Z\")\n .expiration_date(\"2027-01-15T00:00:00Z\")\n .attestation_type(AttestationType::SecurityAudit)\n .subject_claim(\"auditType\", serde_json::json!(\"codeAudit\"))\n .subject_claim(\"result\", serde_json::json!(\"pass\"))\n .subject_claim(\"severityFindings\", serde_json::json!({\"critical\": 0}))\n .subject_claim(\"toolOrMethodology\", serde_json::json!(\"OWASP\"))\n .subject_claim(\"auditDate\", serde_json::json!(\"2026-01-15T00:00:00Z\"))\n .build()\n .unwrap();\n\nlet signed = sign_credential(\n &cred, &keypair,\n \"did:oas:test:hmr:auditor#key-1\",\n \"2026-01-15T00:00:00Z\",\n).unwrap();\n\n// Verify at a time when the credential is valid\nlet result = verify_credential_with_time(\n &signed,\n &keypair.verifying_key_bytes(),\n \"2026-06-15T00:00:00Z\",\n);\nassert!(result.is_ok());\n```", "attributes": "", "line": 180 } ], "parseErrors": false } ] }, { "name": "oas-crypto", "url": "/reference/rust/oas-crypto", "modules": [ { "module": "crate", "source": "oas/oas/oas-crypto/src/lib.rs", "sha256": "d41cbcc68d6f87d9c0f487dfe80b5d398691b07a89fe2861a74728317110faaa", "attributes": "", "items": [ { "name": "derivation", "kind": "module", "signature": "pub mod derivation;", "docs": "# oas-crypto\n\nCryptographic primitives for the Open Agent Specification (OAS).\n\nThis crate provides the foundational cryptographic operations required by the OAS\nspecification, including Ed25519 key management, HKDF-SHA256 key derivation,\nBLAKE3 content hashing, JCS canonicalization, and AgentLineageProof2025 generation\nand verification.\n\n## Crate Architecture\n\n- [`keypair`] \u2014 Ed25519 keypair generation, signing, and verification\n- [`derivation`] \u2014 HKDF-SHA256 child key derivation (OAS Spec \u00a79.3)\n- [`proof`] \u2014 AgentLineageProof2025 generation and verification (OAS Spec \u00a79.4, \u00a79.5)\n- [`hashing`] \u2014 BLAKE3 content hashing\n- [`jcs`] \u2014 JSON Canonicalization Scheme (RFC 8785)\n- [`encoding`] \u2014 Multibase (base58btc) and base64url encoding\n\n## Security Properties\n\n- All key types implement [`zeroize::Zeroize`] and [`zeroize::ZeroizeOnDrop`]\n- No `unsafe` code (`#![forbid(unsafe_code)]`)\n- Constant-time signature verification via `ed25519-dalek`\n- Pure Rust \u2014 no C FFI dependencies\n\n## Example\n\n```\nuse oas_crypto::keypair::OasKeyPair;\nuse oas_crypto::derivation::derive_child_keypair;\nuse oas_crypto::proof::{AgentLineageProof, LineageProofBinding};\n\n// Generate a parent (HMR) keypair\nlet parent = OasKeyPair::generate();\n\n// Derive a child keypair\nlet child = derive_child_keypair(&parent, \"/agent-my-bot\").unwrap();\n\n// Generate a lineage proof\nlet child_public_key = child.public_key_multibase();\nlet proof = AgentLineageProof::generate_bound(\n &parent,\n &LineageProofBinding {\n parent_did: \"did:oas:myns:hmr:alice\",\n child_did: \"did:oas:myns:agent:my-bot\",\n derivation_path: \"/agent-my-bot\",\n verification_method: \"did:oas:myns:hmr:alice#key-1\",\n child_verification_method: \"did:oas:myns:agent:my-bot#key-1\",\n child_public_key_multibase: &child_public_key,\n parent_document_digest: \"blake3:abababababababababababababababababababababababababababababababab\",\n parent_document_sequence: 1,\n generation: 1,\n },\n).unwrap();\n\n// Verification requires a key selected by validated external policy.\nassert!(proof.verify_with_key(&parent.verifying_key_bytes()).is_ok());\n```", "attributes": "", "line": 60 }, { "name": "encoding", "kind": "module", "signature": "pub mod encoding;", "docs": "", "attributes": "", "line": 61 }, { "name": "error", "kind": "module", "signature": "pub mod error;", "docs": "", "attributes": "", "line": 62 }, { "name": "frost", "kind": "module", "signature": "pub mod frost;", "docs": "", "attributes": "#[cfg(feature = \"frost\")]", "line": 64 }, { "name": "hashing", "kind": "module", "signature": "pub mod hashing;", "docs": "", "attributes": "", "line": 65 }, { "name": "jcs", "kind": "module", "signature": "pub mod jcs;", "docs": "", "attributes": "", "line": 66 }, { "name": "keypair", "kind": "module", "signature": "pub mod keypair;", "docs": "", "attributes": "", "line": 67 }, { "name": "proof", "kind": "module", "signature": "pub mod proof;", "docs": "", "attributes": "", "line": 68 }, { "name": "pub use error::CryptoError;", "kind": "use_declaration", "signature": "pub use error::CryptoError;", "docs": "", "attributes": "", "line": 70 } ], "parseErrors": false }, { "module": "derivation", "source": "oas/oas/oas-crypto/src/derivation.rs", "sha256": "a0fbf0f5241327fb49081baadd2a77cc308afdff5b6096f9c1f349ac89a67724", "attributes": "", "items": [ { "name": "derivation::derive_child_keypair", "kind": "function_item", "signature": "pub fn derive_child_keypair(\n parent: &OasKeyPair,\n derivation_path: &str,\n) -> Result;", "docs": "Derives a child Ed25519 keypair from a parent keypair using HKDF-SHA256.\n\nImplements the key derivation algorithm from OAS Specification \u00a79.3.\nThe derived key material is clamped per RFC 8032 \u00a75.1.5 by `ed25519-dalek`\nduring key construction.\n\n# Arguments\n\n* `parent` - The parent entity's [`OasKeyPair`].\n* `derivation_path` - The derivation path string (e.g., `\"/agent-analyst-42\"`).\n\n# Returns\n\nA new [`OasKeyPair`] for the child entity.\n\n# Errors\n\nReturns [`CryptoError::DerivationFailed`] if HKDF expansion fails (should not happen\nwith valid 32-byte inputs, but handled defensively).\n\n# Examples\n\n```\nuse oas_crypto::derivation::derive_child_keypair;\nuse oas_crypto::keypair::OasKeyPair;\n\nlet parent = OasKeyPair::generate();\nlet child = derive_child_keypair(&parent, \"/agent-child-1\").unwrap();\nassert_ne!(parent.verifying_key_bytes(), child.verifying_key_bytes());\n```", "attributes": "", "line": 51 }, { "name": "derivation::derive_key_material", "kind": "function_item", "signature": "pub fn derive_key_material(ikm: &[u8], salt: &[u8], info: &str) -> Result<[u8; 32], CryptoError>;", "docs": "Derives raw 32-byte key material using HKDF-SHA256.\n\nThis is the lower-level function that performs the actual HKDF computation.\nUse [`derive_child_keypair`] for the full keypair derivation workflow.\n\n# Arguments\n\n* `ikm` - Input key material (parent private key, 32 bytes).\n* `salt` - Salt (parent public key, 32 bytes).\n* `info` - Info string (derivation path as UTF-8 bytes).\n\n# Returns\n\n32 bytes of derived key material.\n\n# Errors\n\nReturns [`CryptoError::DerivationFailed`] if HKDF fails.\n\n# Examples\n\n```\nuse oas_crypto::derivation::derive_key_material;\n\nlet ikm = [0u8; 32];\nlet salt = [1u8; 32];\nlet okm = derive_key_material(&ikm, &salt, \"/test-path\").unwrap();\nassert_eq!(okm.len(), 32);\n```", "attributes": "", "line": 92 } ], "parseErrors": false }, { "module": "encoding", "source": "oas/oas/oas-crypto/src/encoding.rs", "sha256": "b10d5dd33a132cb8711b3595e6b0f999666d9c74eb5d27f02637159a7e0d4b52", "attributes": "", "items": [ { "name": "encoding::multibase_encode", "kind": "function_item", "signature": "pub fn multibase_encode(bytes: &[u8]) -> String;", "docs": "Encodes bytes as multibase base58btc with the `z` prefix.\n\nThis is the canonical encoding for Ed25519 public keys in OAS Identity Documents\nand AgentLineageProof2025 structures.\n\n# Arguments\n\n* `bytes` - The raw bytes to encode.\n\n# Returns\n\nA string with the `z` prefix followed by base58btc-encoded data.\n\n# Examples\n\n```\nuse oas_crypto::encoding::multibase_encode;\n\nlet encoded = multibase_encode(&[1, 2, 3]);\nassert!(encoded.starts_with('z'));\n```", "attributes": "", "line": 31 }, { "name": "encoding::multibase_decode", "kind": "function_item", "signature": "pub fn multibase_decode(encoded: &str) -> Result, CryptoError>;", "docs": "Decodes a multibase base58btc string (with `z` prefix) into raw bytes.\n\n# Arguments\n\n* `encoded` - A multibase-encoded string that MUST start with `z`.\n\n# Returns\n\nThe decoded raw bytes.\n\n# Errors\n\nReturns [`CryptoError::MultibaseDecodeFailed`] if:\n- The string does not start with `z`\n- The base58btc decoding fails\n\n# Examples\n\n```\nuse oas_crypto::encoding::{multibase_encode, multibase_decode};\n\nlet original = vec![1, 2, 3, 4, 5];\nlet encoded = multibase_encode(&original);\nlet decoded = multibase_decode(&encoded).unwrap();\nassert_eq!(original, decoded);\n```", "attributes": "", "line": 64 }, { "name": "encoding::base64url_encode", "kind": "function_item", "signature": "pub fn base64url_encode(bytes: &[u8]) -> String;", "docs": "Encodes bytes as base64url without padding (RFC 4648 \u00a75).\n\nThis is the canonical encoding for Ed25519 signatures in OAS.\n\n# Arguments\n\n* `bytes` - The raw bytes to encode.\n\n# Returns\n\nA base64url-encoded string without padding.\n\n# Examples\n\n```\nuse oas_crypto::encoding::base64url_encode;\n\nlet encoded = base64url_encode(&[1, 2, 3]);\nassert!(!encoded.contains('='));\n```", "attributes": "", "line": 101 }, { "name": "encoding::base64url_decode", "kind": "function_item", "signature": "pub fn base64url_decode(encoded: &str) -> Result, CryptoError>;", "docs": "Decodes a base64url string (RFC 4648 \u00a75) into raw bytes.\n\nAccepts input with or without padding.\n\n# Arguments\n\n* `encoded` - A base64url-encoded string.\n\n# Returns\n\nThe decoded raw bytes.\n\n# Errors\n\nReturns [`CryptoError::Base64DecodeFailed`] if the input is not valid base64url.\n\n# Examples\n\n```\nuse oas_crypto::encoding::{base64url_encode, base64url_decode};\n\nlet original = vec![10, 20, 30, 40, 50];\nlet encoded = base64url_encode(&original);\nlet decoded = base64url_decode(&encoded).unwrap();\nassert_eq!(original, decoded);\n```", "attributes": "", "line": 133 } ], "parseErrors": false }, { "module": "error", "source": "oas/oas/oas-crypto/src/error.rs", "sha256": "cebc0111a9abeddb65aa444ff3796175d34fc2b8263529c8b1f59ba8f44c1a59", "attributes": "", "items": [ { "name": "error::CryptoError", "kind": "enum_item", "signature": "pub enum CryptoError {\n /// Ed25519 signature verification failed.\n #[error(\"signature verification failed during {context}\")]\n InvalidSignature {\n /// What operation was being performed when verification failed.\n context: String,\n },\n\n /// The provided key bytes have an invalid length.\n #[error(\"invalid key length: expected {expected} bytes, got {actual} bytes\")]\n InvalidKeyLength {\n /// Expected number of bytes.\n expected: usize,\n /// Actual number of bytes provided.\n actual: usize,\n },\n\n /// HKDF key derivation failed.\n #[error(\"HKDF key derivation failed for path '{derivation_path}': {reason}\")]\n DerivationFailed {\n /// The derivation path that was being used.\n derivation_path: String,\n /// Why the derivation failed.\n reason: String,\n },\n\n /// Multibase decoding failed.\n #[error(\"multibase decoding failed: {reason}\")]\n MultibaseDecodeFailed {\n /// Why the decoding failed.\n reason: String,\n },\n\n /// Base64url decoding failed.\n #[error(\"base64url decoding failed: {reason}\")]\n Base64DecodeFailed {\n /// Why the decoding failed.\n reason: String,\n },\n\n /// JSON canonicalization (JCS) failed.\n #[error(\"JCS canonicalization failed: {reason}\")]\n CanonicalizationFailed {\n /// Why canonicalization failed.\n reason: String,\n },\n\n /// The proof payload structure is invalid.\n #[error(\"invalid proof payload: {reason}\")]\n InvalidProofPayload {\n /// Why the payload is invalid.\n reason: String,\n },\n\n /// A legacy lineage proof omits bindings required for authorization.\n #[error(\n \"legacy lineage proof is non-authorizing: {reason}; parse for migration only and issue a fully bound proof\"\n )]\n LegacyInsecureProof {\n /// The missing or insecure legacy property.\n reason: String,\n },\n\n /// Standalone verification was attempted without an external trust decision.\n #[error(\n \"lineage proof verification requires a trusted parent key from a validated DID document or explicit verifier policy\"\n )]\n VerifierTrustRequired,\n\n /// The lineage proof type is not supported.\n #[error(\"unsupported lineage proof type '{found}'; expected '{expected}'\")]\n UnsupportedProofType {\n /// Proof type received from the input.\n found: String,\n /// Proof type supported by this implementation.\n expected: &'static str,\n },\n\n /// The lineage proof algorithm is not supported.\n #[error(\"unsupported lineage proof algorithm '{found}'; expected '{expected}'\")]\n UnsupportedProofAlgorithm {\n /// Algorithm received from the input.\n found: String,\n /// Algorithm supported by this implementation.\n expected: &'static str,\n },\n\n /// The lineage proof canonicalization profile is not supported.\n #[error(\"unsupported lineage proof canonicalization '{found}'; expected '{expected}'\")]\n UnsupportedCanonicalization {\n /// Canonicalization identifier received from the input.\n found: String,\n /// Canonicalization identifier supported by this implementation.\n expected: &'static str,\n },\n\n /// The lineage proof purpose is not authorized for lineage delegation.\n #[error(\"unsupported lineage proof purpose '{found}'; expected '{expected}'\")]\n UnsupportedProofPurpose {\n /// Proof purpose received from the input.\n found: String,\n /// Proof purpose required by this implementation.\n expected: &'static str,\n },\n\n /// The proof's embedded parent key disagrees with the trusted verifier key.\n #[error(\"embedded parent key does not match the externally trusted verification key\")]\n EmbeddedKeyMismatch,\n\n /// Ed25519 key construction failed.\n #[error(\"failed to construct Ed25519 key: {reason}\")]\n KeyConstructionFailed {\n /// Why key construction failed.\n reason: String,\n },\n\n /// FROST threshold key generation failed.\n ///\n /// Returned when the trusted dealer key generation process fails,\n /// typically due to invalid threshold parameters.\n #[error(\"FROST key generation failed for {min_signers}-of-{max_signers} threshold: {reason}\")]\n FrostKeyGenFailed {\n /// The requested minimum number of signers.\n min_signers: u16,\n /// The requested total number of participants.\n max_signers: u16,\n /// Why key generation failed.\n reason: String,\n },\n\n /// FROST signing round failed.\n ///\n /// Returned when a participant fails to produce their signature share\n /// during round 2 of the FROST protocol.\n #[error(\"FROST signing failed: {reason}\")]\n FrostSigningFailed {\n /// Why the signing round failed.\n reason: String,\n },\n\n /// FROST signature aggregation failed.\n ///\n /// Returned when the coordinator fails to combine individual signature\n /// shares into a valid group signature.\n #[error(\"FROST signature aggregation failed: {reason}\")]\n FrostAggregationFailed {\n /// Why aggregation failed.\n reason: String,\n },\n\n /// FROST group signature verification failed.\n ///\n /// Returned when a threshold signature does not verify against\n /// the group public key.\n #[error(\"FROST group signature verification failed: {reason}\")]\n FrostVerificationFailed {\n /// Why verification failed.\n reason: String,\n },\n\n /// Invalid participant selection for FROST signing.\n ///\n /// Returned when the provided participant indices are invalid \u2014\n /// wrong count, out of range, or contain duplicates.\n #[error(\"invalid FROST participant selection: {reason}\")]\n FrostInvalidParticipants {\n /// Why the participant selection is invalid.\n reason: String,\n },\n\n /// FROST signature serialization failed.\n ///\n /// Returned when a FROST signature or key cannot be serialized to bytes.\n #[error(\"FROST serialization failed: {reason}\")]\n FrostSerializationFailed {\n /// Why serialization failed.\n reason: String,\n },\n}", "docs": "Errors arising from OAS cryptographic operations.\n\nEvery variant includes enough context to diagnose the issue without\nrequiring a stack trace or access to private key material.\n\n# Examples\n\n```\nuse oas_crypto::CryptoError;\n\nlet err = CryptoError::InvalidSignature {\n context: \"lineage proof verification\".to_string(),\n};\nassert!(err.to_string().contains(\"lineage proof verification\"));\n```", "attributes": "#[derive(Debug, Error)]", "line": 25 } ], "parseErrors": false }, { "module": "frost", "source": "oas/oas/oas-crypto/src/frost.rs", "sha256": "3912035cf53fba877d0f3104766a7316caa0801ccdd8d5361751c0deb3e85d0c", "attributes": "#[cfg(feature = \"frost\")]", "items": [ { "name": "frost::FrostKeySet", "kind": "struct_item", "signature": "pub struct FrostKeySet {\n\n}", "docs": "A complete FROST threshold key set for a group of participants.\n\nGenerated via trusted dealer key generation using [`frost_keygen`].\nContains individual key packages for each participant and the shared\ngroup public key package used for signature aggregation and verification.\n\n# Security\n\nThe key packages contain secret shares that MUST be distributed securely\nto individual participants. In production, each participant should receive\nonly their own key package. This struct holds all packages together for\ntesting and single-node scenarios.\n\nPrivate key material is redacted in `Debug` output.\n\n# Examples\n\n```\nuse oas_crypto::frost::frost_keygen;\n\nlet key_set = frost_keygen(2, 3).unwrap();\nassert_eq!(key_set.min_signers(), 2);\nassert_eq!(key_set.max_signers(), 3);\nassert_eq!(key_set.group_public_key().len(), 32);\n```", "attributes": "#[cfg(feature = \"frost\")]", "line": 77 }, { "name": "frost::FrostKeySet::group_public_key", "kind": "function_item", "signature": "pub fn group_public_key(&self) -> Vec;", "docs": "Returns the group verifying (public) key as raw bytes.\n\nThis key can verify any threshold signature produced by this key set.\nIt is a standard 32-byte Ed25519 public key.\n\n# Returns\n\n32-byte Ed25519 verifying key for the group.\n\n# Panics\n\nNever panics \u2014 serialization of a valid verifying key always succeeds.\n\n# Examples\n\n```\nuse oas_crypto::frost::frost_keygen;\n\nlet key_set = frost_keygen(2, 3).unwrap();\nassert_eq!(key_set.group_public_key().len(), 32);\n```", "attributes": "#[cfg(feature = \"frost\")]", "line": 119 }, { "name": "frost::FrostKeySet::min_signers", "kind": "function_item", "signature": "pub fn min_signers(&self) -> u16;", "docs": "Returns the minimum number of signers required to produce a signature.\n\n# Returns\n\nThe threshold value `t` from the t-of-n configuration.", "attributes": "#[cfg(feature = \"frost\")]", "line": 133 }, { "name": "frost::FrostKeySet::max_signers", "kind": "function_item", "signature": "pub fn max_signers(&self) -> u16;", "docs": "Returns the total number of participants in the group.\n\n# Returns\n\nThe total participant count `n` from the t-of-n configuration.", "attributes": "#[cfg(feature = \"frost\")]", "line": 142 }, { "name": "frost::FrostKeySet::pubkey_package", "kind": "function_item", "signature": "pub fn pubkey_package(&self) -> &frost::keys::PublicKeyPackage;", "docs": "Returns a reference to the FROST public key package.\n\nUseful for advanced scenarios like manual signature aggregation\nor interoperability with other FROST implementations.", "attributes": "#[cfg(feature = \"frost\")]", "line": 150 }, { "name": "frost::frost_keygen", "kind": "function_item", "signature": "pub fn frost_keygen(min_signers: u16, max_signers: u16) -> Result;", "docs": "Generates a FROST threshold key set using trusted dealer key generation.\n\nCreates a t-of-n threshold configuration where any `min_signers` participants\nout of `max_signers` total can collaboratively sign. The dealer generates all\nsecret shares and distributes them \u2014 the dealer must be trusted.\n\n# Arguments\n\n* `min_signers` - Minimum number of participants required to sign (threshold `t`).\n Must be >= 2 for threshold security.\n* `max_signers` - Total number of participants (`n`). Must be >= `min_signers`.\n\n# Returns\n\nA [`FrostKeySet`] containing all participant key packages and the group public key.\n\n# Errors\n\nReturns [`CryptoError::FrostKeyGenFailed`] if:\n- `min_signers` < 2 (single-signer defeats the purpose of threshold)\n- `max_signers` < `min_signers` (impossible threshold)\n- Internal FROST key generation fails\n\n# Examples\n\n```\nuse oas_crypto::frost::frost_keygen;\n\n// 3-of-5 threshold\nlet key_set = frost_keygen(3, 5).unwrap();\nassert_eq!(key_set.min_signers(), 3);\nassert_eq!(key_set.max_signers(), 5);\nassert_eq!(key_set.group_public_key().len(), 32);\n\n// 2-of-2 is the minimum valid threshold\nlet key_set_2 = frost_keygen(2, 2).unwrap();\nassert_eq!(key_set_2.min_signers(), 2);\n```", "attributes": "#[cfg(feature = \"frost\")]", "line": 193 }, { "name": "frost::frost_sign", "kind": "function_item", "signature": "pub fn frost_sign(\n message: &[u8],\n key_set: &FrostKeySet,\n participant_indices: &[usize],\n) -> Result, CryptoError>;", "docs": "Performs a complete FROST threshold signing operation.\n\nExecutes the full two-round FROST signing protocol with the specified\nparticipants. The result is a standard 64-byte Ed25519 signature that can\nbe verified by any Ed25519 verifier using the group public key.\n\n# Arguments\n\n* `message` - The message bytes to sign.\n* `key_set` - The FROST key set generated by [`frost_keygen`].\n* `participant_indices` - Zero-based indices selecting which participants sign.\n Must contain exactly [`FrostKeySet::min_signers()`] entries, with no duplicates,\n and all indices must be < [`FrostKeySet::max_signers()`].\n\n# Returns\n\nA 64-byte Ed25519 signature.\n\n# Errors\n\nReturns [`CryptoError::FrostInvalidParticipants`] if:\n- Number of participants doesn't equal `min_signers`\n- Any participant index is out of range\n- Duplicate participant indices are provided\n\nReturns [`CryptoError::FrostSigningFailed`] if a signing round fails.\n\nReturns [`CryptoError::FrostAggregationFailed`] if signature aggregation fails.\n\nReturns [`CryptoError::FrostSerializationFailed`] if the signature cannot be serialized.\n\n# Examples\n\n```\nuse oas_crypto::frost::{frost_keygen, frost_sign};\n\nlet key_set = frost_keygen(2, 3).unwrap();\n\n// Any 2 of the 3 participants can sign\nlet sig_01 = frost_sign(b\"hello\", &key_set, &[0, 1]).unwrap();\nlet sig_12 = frost_sign(b\"hello\", &key_set, &[1, 2]).unwrap();\nlet sig_02 = frost_sign(b\"hello\", &key_set, &[0, 2]).unwrap();\n\nassert_eq!(sig_01.len(), 64);\nassert_eq!(sig_12.len(), 64);\nassert_eq!(sig_02.len(), 64);\n```", "attributes": "#[cfg(feature = \"frost\")]", "line": 298 }, { "name": "frost::frost_verify", "kind": "function_item", "signature": "pub fn frost_verify(\n message: &[u8],\n signature_bytes: &[u8],\n group_public_key: &[u8],\n) -> Result<(), CryptoError>;", "docs": "Verifies a FROST threshold signature against a group public key.\n\nSince FROST produces standard Ed25519 signatures, this delegates to the\nsame Ed25519 verification used throughout OAS. The group public key is\nobtained from [`FrostKeySet::group_public_key`].\n\n# Arguments\n\n* `message` - The original message that was signed.\n* `signature_bytes` - The 64-byte Ed25519 signature from [`frost_sign`].\n* `group_public_key` - The 32-byte group verifying key from [`FrostKeySet::group_public_key`].\n\n# Returns\n\n`Ok(())` if the signature is valid.\n\n# Errors\n\nReturns [`CryptoError::FrostVerificationFailed`] if the signature does not\nverify against the group public key.\n\nReturns [`CryptoError::InvalidKeyLength`] if key or signature bytes are the wrong length.\n\n# Examples\n\n```\nuse oas_crypto::frost::{frost_keygen, frost_sign, frost_verify};\n\nlet key_set = frost_keygen(2, 3).unwrap();\nlet sig = frost_sign(b\"test\", &key_set, &[0, 1]).unwrap();\n\n// Valid verification\nassert!(frost_verify(b\"test\", &sig, &key_set.group_public_key()).is_ok());\n\n// Wrong message fails\nassert!(frost_verify(b\"wrong\", &sig, &key_set.group_public_key()).is_err());\n```", "attributes": "#[cfg(feature = \"frost\")]", "line": 441 } ], "parseErrors": false }, { "module": "hashing", "source": "oas/oas/oas-crypto/src/hashing.rs", "sha256": "7043e0367e09a7c6b8bf52cfa75671909b2d72f083d906fb04fb6ae538b0e6d4", "attributes": "", "items": [ { "name": "hashing::blake3_hash", "kind": "function_item", "signature": "pub fn blake3_hash(data: &[u8]) -> [u8; 32];", "docs": "BLAKE3 content hashing for OAS documents and data.\n\nProvides content-addressable hashing used for document integrity\nchecks and content addressing in registries.\nComputes the BLAKE3 hash of the given data.\n\nReturns the 32-byte hash as a fixed-size array.\n\n# Arguments\n\n* `data` - The bytes to hash.\n\n# Returns\n\nA 32-byte BLAKE3 hash.\n\n# Examples\n\n```\nuse oas_crypto::hashing::blake3_hash;\n\nlet hash = blake3_hash(b\"hello world\");\nassert_eq!(hash.len(), 32);\n```", "attributes": "", "line": 27 }, { "name": "hashing::blake3_hash_hex", "kind": "function_item", "signature": "pub fn blake3_hash_hex(data: &[u8]) -> String;", "docs": "Computes the BLAKE3 hash and returns it as a hex string.\n\n# Arguments\n\n* `data` - The bytes to hash.\n\n# Returns\n\nA 64-character lowercase hex string of the BLAKE3 hash.\n\n# Examples\n\n```\nuse oas_crypto::hashing::blake3_hash_hex;\n\nlet hex = blake3_hash_hex(b\"hello world\");\nassert_eq!(hex.len(), 64);\n```", "attributes": "", "line": 49 } ], "parseErrors": false }, { "module": "jcs", "source": "oas/oas/oas-crypto/src/jcs.rs", "sha256": "986712ea5cf59171c3bbecd9190179fa28b95600fc589bbb9c5368fd06f00e35", "attributes": "", "items": [ { "name": "jcs::canonicalize", "kind": "function_item", "signature": "pub fn canonicalize(value: &serde_json::Value) -> Result, CryptoError>;", "docs": "Canonicalizes a JSON value using JCS (RFC 8785).\n\nProduces a deterministic byte representation where object keys are sorted\nlexicographically and no insignificant whitespace is present.\n\n# Arguments\n\n* `value` - A [`serde_json::Value`] to canonicalize.\n\n# Returns\n\nThe canonical JSON bytes.\n\n# Errors\n\nReturns [`CryptoError::CanonicalizationFailed`] if serialization fails.\n\n# Examples\n\n```\nuse oas_crypto::jcs::canonicalize;\nuse serde_json::json;\n\nlet value = json!({\"b\": 1, \"a\": 2});\nlet canonical = canonicalize(&value).unwrap();\nlet s = String::from_utf8(canonical).unwrap();\nassert_eq!(s, r#\"{\"a\":2,\"b\":1}\"#);\n```", "attributes": "", "line": 38 }, { "name": "jcs::canonicalize_to_string", "kind": "function_item", "signature": "pub fn canonicalize_to_string(value: &serde_json::Value) -> Result;", "docs": "Canonicalizes a JSON value and returns it as a UTF-8 string.\n\n# Arguments\n\n* `value` - A [`serde_json::Value`] to canonicalize.\n\n# Returns\n\nThe canonical JSON as a string.\n\n# Errors\n\nReturns [`CryptoError::CanonicalizationFailed`] if serialization fails.\n\n# Examples\n\n```\nuse oas_crypto::jcs::canonicalize_to_string;\nuse serde_json::json;\n\nlet value = json!({\"z\": \"last\", \"a\": \"first\"});\nlet s = canonicalize_to_string(&value).unwrap();\nassert_eq!(s, r#\"{\"a\":\"first\",\"z\":\"last\"}\"#);\n```", "attributes": "", "line": 68 } ], "parseErrors": false }, { "module": "keypair", "source": "oas/oas/oas-crypto/src/keypair.rs", "sha256": "e48a1d5d5de36a4eeda6ecdd09ec08192fd8d71cd34fd2b7d0a88da97643922b", "attributes": "", "items": [ { "name": "keypair::OasKeyPair", "kind": "struct_item", "signature": "pub struct OasKeyPair {\n\n}", "docs": "An Ed25519 keypair for an OAS entity.\n\nHolds both the signing (private) and verifying (public) keys. The signing key\nis zeroized on drop to prevent key material from persisting in memory.\n\n# Security\n\n- Private key bytes are never exposed via `Debug`\n- The signing key implements `ZeroizeOnDrop`\n- All signature operations use constant-time comparison\n\n# Examples\n\n```\nuse oas_crypto::keypair::OasKeyPair;\n\nlet keypair = OasKeyPair::generate();\nlet message = b\"hello OAS\";\nlet signature = keypair.sign(message);\nassert!(OasKeyPair::verify_with_key(&keypair.verifying_key_bytes(), message, &signature).is_ok());\n```", "attributes": "", "line": 36 }, { "name": "keypair::OasKeyPair::generate", "kind": "function_item", "signature": "pub fn generate() -> Self;", "docs": "Generates a new random Ed25519 keypair using the OS CSPRNG.\n\n# Returns\n\nA fresh [`OasKeyPair`] with a cryptographically random signing key.\n\n# Examples\n\n```\nuse oas_crypto::keypair::OasKeyPair;\nlet kp = OasKeyPair::generate();\nassert_eq!(kp.verifying_key_bytes().len(), 32);\n```", "attributes": "", "line": 76 }, { "name": "keypair::OasKeyPair::from_signing_key_bytes", "kind": "function_item", "signature": "pub fn from_signing_key_bytes(bytes: &[u8]) -> Result;", "docs": "Constructs an [`OasKeyPair`] from raw 32-byte signing key material.\n\nThe verifying key is automatically derived from the signing key.\n\n# Arguments\n\n* `bytes` - Exactly 32 bytes of Ed25519 signing key material.\n\n# Returns\n\nAn [`OasKeyPair`] constructed from the provided key material.\n\n# Errors\n\nReturns [`CryptoError::InvalidKeyLength`] if `bytes` is not exactly 32 bytes.\n\n# Examples\n\n```\nuse oas_crypto::keypair::OasKeyPair;\nlet kp1 = OasKeyPair::generate();\nlet bytes = kp1.signing_key_bytes();\nlet kp2 = OasKeyPair::from_signing_key_bytes(&bytes).unwrap();\nassert_eq!(kp1.verifying_key_bytes(), kp2.verifying_key_bytes());\n```", "attributes": "", "line": 111 }, { "name": "keypair::OasKeyPair::verifying_key_from_bytes", "kind": "function_item", "signature": "pub fn verifying_key_from_bytes(bytes: &[u8]) -> Result;", "docs": "Constructs a verifying-only reference from raw 32-byte public key bytes.\n\nThis does NOT create a full keypair \u2014 only the public key is available.\nUse this for signature verification when you don't have the private key.\n\n# Arguments\n\n* `bytes` - Exactly 32 bytes of an Ed25519 verifying (public) key.\n\n# Returns\n\nThe constructed [`VerifyingKey`].\n\n# Errors\n\nReturns [`CryptoError::KeyConstructionFailed`] if the bytes are not a valid Ed25519 point.\n\n# Examples\n\n```\nuse oas_crypto::keypair::OasKeyPair;\nlet kp = OasKeyPair::generate();\nlet vk = OasKeyPair::verifying_key_from_bytes(&kp.verifying_key_bytes()).unwrap();\nassert_eq!(vk.as_bytes(), &kp.verifying_key_bytes());\n```", "attributes": "", "line": 151 }, { "name": "keypair::OasKeyPair::sign", "kind": "function_item", "signature": "pub fn sign(&self, message: &[u8]) -> Vec;", "docs": "Signs a message with this keypair's signing key.\n\n# Arguments\n\n* `message` - The message bytes to sign.\n\n# Returns\n\nA 64-byte Ed25519 signature.\n\n# Examples\n\n```\nuse oas_crypto::keypair::OasKeyPair;\nlet kp = OasKeyPair::generate();\nlet sig = kp.sign(b\"message\");\nassert_eq!(sig.len(), 64);\n```", "attributes": "", "line": 181 }, { "name": "keypair::OasKeyPair::verify_with_key", "kind": "function_item", "signature": "pub fn verify_with_key(\n public_key_bytes: &[u8],\n message: &[u8],\n signature_bytes: &[u8],\n ) -> Result<(), CryptoError>;", "docs": "Verifies an Ed25519 signature against a public key.\n\nUses constant-time comparison internally (provided by `ed25519-dalek`).\n\n# Arguments\n\n* `public_key_bytes` - The 32-byte Ed25519 verifying key.\n* `message` - The original message that was signed.\n* `signature_bytes` - The 64-byte Ed25519 signature.\n\n# Returns\n\n`Ok(())` if the signature is valid.\n\n# Errors\n\nReturns [`CryptoError::InvalidSignature`] if verification fails.\nReturns [`CryptoError::InvalidKeyLength`] if key/signature bytes are wrong length.\n\n# Examples\n\n```\nuse oas_crypto::keypair::OasKeyPair;\nlet kp = OasKeyPair::generate();\nlet sig = kp.sign(b\"test\");\nassert!(OasKeyPair::verify_with_key(&kp.verifying_key_bytes(), b\"test\", &sig).is_ok());\nassert!(OasKeyPair::verify_with_key(&kp.verifying_key_bytes(), b\"wrong\", &sig).is_err());\n```", "attributes": "", "line": 214 }, { "name": "keypair::OasKeyPair::signing_key_bytes", "kind": "function_item", "signature": "pub fn signing_key_bytes(&self) -> [u8; 32];", "docs": "Returns the raw 32-byte signing (private) key bytes.\n\n# Security\n\nHandle with extreme care. Never log, serialize, or transmit this value.\nThe returned array should be zeroized after use.", "attributes": "", "line": 240 }, { "name": "keypair::OasKeyPair::verifying_key_bytes", "kind": "function_item", "signature": "pub fn verifying_key_bytes(&self) -> [u8; 32];", "docs": "Returns the raw 32-byte verifying (public) key bytes.", "attributes": "", "line": 245 }, { "name": "keypair::OasKeyPair::public_key_multibase", "kind": "function_item", "signature": "pub fn public_key_multibase(&self) -> String;", "docs": "Returns the public key encoded as multibase base58btc (with `z` prefix).\n\nThis is the canonical format for `publicKeyMultibase` in OAS Identity Documents.\n\n# Examples\n\n```\nuse oas_crypto::keypair::OasKeyPair;\nlet kp = OasKeyPair::generate();\nlet mb = kp.public_key_multibase();\nassert!(mb.starts_with('z'));\n```", "attributes": "", "line": 261 }, { "name": "keypair::OasKeyPair::signing_key", "kind": "function_item", "signature": "pub fn signing_key(&self) -> &SigningKey;", "docs": "Returns a reference to the inner `ed25519-dalek` [`SigningKey`].", "attributes": "", "line": 266 }, { "name": "keypair::OasKeyPair::verifying_key", "kind": "function_item", "signature": "pub fn verifying_key(&self) -> &VerifyingKey;", "docs": "Returns a reference to the inner `ed25519-dalek` [`VerifyingKey`].", "attributes": "", "line": 271 } ], "parseErrors": false }, { "module": "proof", "source": "oas/oas/oas-crypto/src/proof.rs", "sha256": "bbcf0d5c349f02b368d9f599469e1312b3b9343941aae04f1def95045af08434", "attributes": "", "items": [ { "name": "proof::PROOF_TYPE", "kind": "const_item", "signature": "pub const PROOF_TYPE: &str;", "docs": "The fixed proof type identifier per OAS Specification \u00a79.1.", "attributes": "", "line": 19 }, { "name": "proof::PROOF_ALGORITHM", "kind": "const_item", "signature": "pub const PROOF_ALGORITHM: &str;", "docs": "The fixed algorithm identifier per OAS Specification \u00a79.2.", "attributes": "", "line": 22 }, { "name": "proof::PROOF_CANONICALIZATION", "kind": "const_item", "signature": "pub const PROOF_CANONICALIZATION: &str;", "docs": "The only canonicalization profile accepted for authorizing lineage proofs.", "attributes": "", "line": 25 }, { "name": "proof::PROOF_PURPOSE", "kind": "const_item", "signature": "pub const PROOF_PURPOSE: &str;", "docs": "The verification relationship required for lineage authorization.", "attributes": "", "line": 28 }, { "name": "proof::LineageProofBinding", "kind": "struct_item", "signature": "pub struct LineageProofBinding<'a> {\n/// DID of the parent authorizing the child.\n\npub parent_did: &'a str,\n/// DID of the child receiving authorization.\n\npub child_did: &'a str,\n/// Stable derivation or authorization path.\n\npub derivation_path: &'a str,\n/// Parent verification method authorized for capability delegation.\n\npub verification_method: &'a str,\n/// Child verification method committed by the parent.\n\npub child_verification_method: &'a str,\n/// Child public key committed by the parent.\n\npub child_public_key_multibase: &'a str,\n/// BLAKE3 digest of the complete authenticated parent DID document.\n\npub parent_document_digest: &'a str,\n/// Monotonic sequence of the authenticated parent DID document.\n\npub parent_document_sequence: u64,\n/// Child position in the complete root-to-child chain.\n\npub generation: u32\n}", "docs": "Security bindings required when issuing an authorizing lineage proof.\n\nThe proof signs every field in this structure as well as the proof type,\nalgorithm, canonicalization profile, proof purpose, and parent public key.", "attributes": "#[derive(Debug, Clone, Copy)]", "line": 35 }, { "name": "proof::AgentLineageProof", "kind": "struct_item", "signature": "pub struct AgentLineageProof {\n/// Fixed: `\"AgentLineageProof2025\"`\n\n#[serde(rename = \"type\")]\npub proof_type: String,\n/// DID of the parent entity.\n\npub parent_did: String,\n/// DID of the child entity.\n\npub child_did: String,\n/// The HKDF info parameter used for key derivation (e.g., `\"/agent-child\"`).\n\npub derivation_path: String,\n/// Fixed: `\"HKDF-SHA256-Ed25519\"`\n\npub algorithm: String,\n/// Parent's public key, multibase-encoded (base58btc with `z` prefix).\n\npub public_key_multibase: String,\n/// Parent verification method selected from the authenticated parent document.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub verification_method: Option,\n/// Verification relationship authorizing the parent key for lineage.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub proof_purpose: Option,\n/// Canonicalization profile used to construct the signed payload.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub canonicalization: Option,\n/// Child verification method committed by the parent.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub child_verification_method: Option,\n/// Child public key committed by the parent.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub child_public_key_multibase: Option,\n/// Digest of the authenticated parent document used for issuance.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub parent_document_digest: Option,\n/// Sequence of the authenticated parent document used for issuance.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub parent_document_sequence: Option,\n/// Position of the child in the complete lineage chain.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub generation: Option,\n/// Ed25519 signature by the parent key over the canonical proof payload,\n\n/// encoded as base64url.\n\npub signature: String\n}", "docs": "An AgentLineageProof2025 linking a child entity to its parent.\n\nThis proof establishes cryptographic accountability by demonstrating that\nthe parent entity authorized the creation of the child entity.\n\nSee OAS Specification \u00a79 for the complete proof format.\n\n# Examples\n\n```\nuse oas_crypto::proof::{AgentLineageProof, LineageProofBinding};\nuse oas_crypto::keypair::OasKeyPair;\n\nlet parent = OasKeyPair::generate();\nlet child = OasKeyPair::generate();\nlet proof = AgentLineageProof::generate_bound(\n &parent,\n &LineageProofBinding {\n parent_did: \"did:oas:test:hmr:parent\",\n child_did: \"did:oas:test:agent:child\",\n derivation_path: \"/agent-child\",\n verification_method: \"did:oas:test:hmr:parent#key-1\",\n child_verification_method: \"did:oas:test:agent:child#key-1\",\n child_public_key_multibase: &child.public_key_multibase(),\n parent_document_digest: \"blake3:abababababababababababababababababababababababababababababababab\",\n parent_document_sequence: 1,\n generation: 1,\n },\n).unwrap();\n\nassert!(proof.verify_with_key(&parent.verifying_key_bytes()).is_ok());\n```", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\", deny_unknown_fields)]", "line": 90 }, { "name": "proof::AgentLineageProof::generate", "kind": "function_item", "signature": "pub fn generate(\n parent_keypair: &OasKeyPair,\n parent_did: &str,\n child_did: &str,\n derivation_path: &str,\n ) -> Result;", "docs": "Generates a legacy, non-authorizing AgentLineageProof2025.\n\nImplements OAS Specification \u00a79.4:\n1. Construct the canonical proof payload via JCS\n2. Sign the payload with the parent's Ed25519 signing key\n3. Encode the signature as base64url\n\n# Arguments\n\n* `parent_keypair` - The parent entity's keypair (used for signing).\n* `parent_did` - The parent entity's DID string.\n* `child_did` - The child entity's DID string.\n* `derivation_path` - The HKDF derivation path.\n\n# Returns\n\nA parseable migration proof that strict verification rejects with\n[`CryptoError::LegacyInsecureProof`].\n\n# Errors\n\nReturns [`CryptoError::CanonicalizationFailed`] if JCS canonicalization fails.\n\n# Examples\n\n```\nuse oas_crypto::proof::AgentLineageProof;\nuse oas_crypto::keypair::OasKeyPair;\n\nlet parent = OasKeyPair::generate();\nlet proof = AgentLineageProof::generate(\n &parent,\n \"did:oas:ns:hmr:alice\",\n \"did:oas:ns:agent:bot\",\n \"/agent-bot\",\n).unwrap();\nassert_eq!(proof.proof_type, \"AgentLineageProof2025\");\nassert!(matches!(\n proof.verify(),\n Err(oas_crypto::CryptoError::LegacyInsecureProof { .. })\n));\n```", "attributes": "", "line": 190 }, { "name": "proof::AgentLineageProof::generate_bound", "kind": "function_item", "signature": "pub fn generate_bound(\n parent_keypair: &OasKeyPair,\n binding: &LineageProofBinding<'_>,\n ) -> Result;", "docs": "Generates a fully bound authorizing lineage proof.\n\nThe signature commits to both DIDs, both verification methods and\npublic keys, the authenticated parent document state, suite and proof\npurpose, canonicalization profile, path, and chain position.\n\n# Arguments\n\n* `parent_keypair` - Parent signing key authorized by the parent document.\n* `binding` - Security-relevant fields committed by the signature.\n\n# Returns\n\nA fully bound [`AgentLineageProof`].\n\n# Errors\n\nReturns [`CryptoError::InvalidProofPayload`] for malformed fields or\na canonicalization error if JCS encoding fails.", "attributes": "", "line": 237 }, { "name": "proof::AgentLineageProof::verify", "kind": "function_item", "signature": "pub fn verify(&self) -> Result<(), CryptoError>;", "docs": "Rejects standalone verification without an external trust decision.\n\n# Returns\n\nThis method never returns `Ok(())`. Authorizing verification requires\n[`Self::verify_with_key`] with a key obtained from a validated parent\nDID document or explicit verifier trust policy.\n\n# Errors\n\nReturns [`CryptoError::LegacyInsecureProof`] for an unbound legacy\nproof, or [`CryptoError::VerifierTrustRequired`] for a fully bound proof.", "attributes": "", "line": 277 }, { "name": "proof::AgentLineageProof::verify_with_key", "kind": "function_item", "signature": "pub fn verify_with_key(&self, parent_public_key_bytes: &[u8]) -> Result<(), CryptoError>;", "docs": "Verifies this proof against a specific public key (not the embedded one).\n\nUse this when you have already resolved the parent document and want to\nverify the proof against the known parent public key.\n\n# Arguments\n\n* `parent_public_key_bytes` - The 32-byte Ed25519 public key of the parent.\n\n# Returns\n\n`Ok(())` if the proof is valid against the provided key.\n\n# Errors\n\nReturns an error if the proof is legacy, its suite or bindings are\nunsupported, the embedded parent key disagrees with the trusted key,\nor signature verification fails.", "attributes": "", "line": 300 }, { "name": "proof::AgentLineageProof::validate_security_profile", "kind": "function_item", "signature": "pub fn validate_security_profile(&self) -> Result<(), CryptoError>;", "docs": "Validates mandatory authorizing fields and fixed suite values.\n\n# Errors\n\nReturns a typed profile, suite, purpose, key encoding, or legacy error.", "attributes": "", "line": 326 }, { "name": "proof::canonical_proof_payload", "kind": "function_item", "signature": "pub fn canonical_proof_payload(proof: &AgentLineageProof) -> Result, CryptoError>;", "docs": "Constructs deterministic RFC 8785 bytes for a fully bound proof.\n\nEvery representable security-relevant field except the signature itself is\nincluded. Legacy proofs therefore cannot produce authorizing canonical\nbytes through this function.\n\n# Arguments\n\n* `proof` - Fully bound proof whose signature payload is required.\n\n# Returns\n\nDeterministic JCS UTF-8 bytes.\n\n# Errors\n\nReturns a typed profile or canonicalization error.", "attributes": "", "line": 413 } ], "parseErrors": false } ] }, { "name": "oas-did", "url": "/reference/rust/oas-did", "modules": [ { "module": "crate", "source": "oas/oas/oas-did/src/lib.rs", "sha256": "7d8654202dff400d34a4a1ee2e8293f14d046a389dd847b7781a7b627e945cf0", "attributes": "", "items": [ { "name": "did", "kind": "module", "signature": "pub mod did;", "docs": "# oas-did\n\nDID parsing and validation for the Open Agent Specification (OAS).\n\nThis crate provides the [`OasDid`] type for parsing, validating, and representing\n`did:oas` decentralized identifiers as defined in OAS Specification \u00a73.\n\n## Format\n\n```text\ndid:oas:::\n```\n\n## Entity Kinds\n\nOAS defines 11 entity kinds (OAS Spec \u00a74):\n`hmr`, `mhr`, `ao`, `agent`, `agent:instance`, `tool`, `skill`,\n`workflow`, `model`, `dataset`, `service`\n\n## Example\n\n```\nuse oas_did::OasDid;\nuse std::str::FromStr;\n\nlet did = OasDid::from_str(\"did:oas:acme:agent:support-bot-42\").unwrap();\nassert_eq!(did.namespace(), \"acme\");\nassert_eq!(did.identifier(), \"support-bot-42\");\nassert!(!did.is_root());\n```", "attributes": "", "line": 32 }, { "name": "error", "kind": "module", "signature": "pub mod error;", "docs": "", "attributes": "", "line": 33 }, { "name": "kind", "kind": "module", "signature": "pub mod kind;", "docs": "", "attributes": "", "line": 34 }, { "name": "namespace", "kind": "module", "signature": "pub mod namespace;", "docs": "", "attributes": "", "line": 35 }, { "name": "validation", "kind": "module", "signature": "pub mod validation;", "docs": "", "attributes": "", "line": 36 }, { "name": "pub use did::OasDid;", "kind": "use_declaration", "signature": "pub use did::OasDid;", "docs": "", "attributes": "", "line": 38 }, { "name": "pub use error::DidError;", "kind": "use_declaration", "signature": "pub use error::DidError;", "docs": "", "attributes": "", "line": 39 }, { "name": "pub use kind::EntityKind;", "kind": "use_declaration", "signature": "pub use kind::EntityKind;", "docs": "", "attributes": "", "line": 40 } ], "parseErrors": false }, { "module": "did", "source": "oas/oas/oas-did/src/did.rs", "sha256": "f25910f0bb7b9f5b506496b7757f690bd5c76826b61d953f1e50a6784d019022", "attributes": "", "items": [ { "name": "did::OasDid", "kind": "struct_item", "signature": "pub struct OasDid {\n\n}", "docs": "A parsed and validated `did:oas` decentralized identifier.\n\nAn [`OasDid`] guarantees that the contained identifier conforms to the syntax\nrules in OAS Specification \u00a73.1. It is the primary type for working with\nOAS identifiers throughout the SDK.\n\n# Format\n\n```text\ndid:oas:::\n```\n\nFor the compound kind `agent:instance`:\n```text\ndid:oas::agent:instance:\n```\n\n# Examples\n\n```\nuse oas_did::OasDid;\nuse std::str::FromStr;\n\nlet did = OasDid::from_str(\"did:oas:acme:agent:support-bot-42\").unwrap();\nassert_eq!(did.namespace(), \"acme\");\nassert_eq!(did.kind(), oas_did::kind::EntityKind::Agent);\nassert_eq!(did.identifier(), \"support-bot-42\");\n```", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Hash)]", "line": 43 }, { "name": "did::OasDid::new", "kind": "function_item", "signature": "pub fn new(namespace: &str, kind: EntityKind, identifier: &str) -> Result;", "docs": "Creates a new [`OasDid`] with validation.\n\n# Arguments\n\n* `namespace` - The organizational namespace.\n* `kind` - The entity kind.\n* `identifier` - The unique identifier within the namespace and kind.\n\n# Returns\n\nA validated [`OasDid`].\n\n# Errors\n\nReturns a [`DidError`] if the namespace or identifier fails validation.\n\n# Examples\n\n```\nuse oas_did::OasDid;\nuse oas_did::kind::EntityKind;\n\nlet did = OasDid::new(\"acme\", EntityKind::Agent, \"my-bot\").unwrap();\nassert_eq!(did.to_string(), \"did:oas:acme:agent:my-bot\");\n```", "attributes": "", "line": 75 }, { "name": "did::OasDid::namespace", "kind": "function_item", "signature": "pub fn namespace(&self) -> &str;", "docs": "Returns the namespace component.", "attributes": "", "line": 86 }, { "name": "did::OasDid::kind", "kind": "function_item", "signature": "pub fn kind(&self) -> EntityKind;", "docs": "Returns the entity kind.", "attributes": "", "line": 91 }, { "name": "did::OasDid::identifier", "kind": "function_item", "signature": "pub fn identifier(&self) -> &str;", "docs": "Returns the identifier component.", "attributes": "", "line": 96 }, { "name": "did::OasDid::is_root", "kind": "function_item", "signature": "pub fn is_root(&self) -> bool;", "docs": "Returns `true` if this is a root entity (HMR, MHR, or ENR).\n\nRoot entities have no parent and no lineage section.", "attributes": "", "line": 103 }, { "name": "did::OasDid::as_str", "kind": "function_item", "signature": "pub fn as_str(&self) -> String;", "docs": "Returns the full DID string representation.", "attributes": "", "line": 108 } ], "parseErrors": false }, { "module": "error", "source": "oas/oas/oas-did/src/error.rs", "sha256": "7a732512f4c2b4698eba8e790e92162d2580d494df3e5af8b8afdd06cfadab74", "attributes": "", "items": [ { "name": "error::DidError", "kind": "enum_item", "signature": "pub enum DidError {\n /// The DID string does not start with `did:oas:`.\n #[error(\"invalid DID prefix: expected 'did:oas:', got '{found}'\")]\n InvalidPrefix {\n /// The prefix that was found.\n found: String,\n },\n\n /// The DID does not have enough components.\n #[error(\"DID has {found} components, expected at least 5 (did:oas:namespace:kind:identifier)\")]\n TooFewComponents {\n /// How many components were found.\n found: usize,\n },\n\n /// The namespace is invalid per OAS Spec \u00a73.1.\n #[error(\"invalid namespace '{namespace}': {reason}\")]\n InvalidNamespace {\n /// The invalid namespace value.\n namespace: String,\n /// Why it's invalid.\n reason: String,\n },\n\n /// The entity kind is not recognized.\n #[error(\"unknown entity kind '{found}'; expected one of: hmr, mhr, enr, ao, agent, agent:instance, tool, skill, workflow, model, dataset, service\")]\n UnknownEntityKind {\n /// The unrecognized kind string.\n found: String,\n },\n\n /// The identifier is invalid per OAS Spec \u00a73.1.\n #[error(\"invalid identifier '{identifier}': {reason}\")]\n InvalidIdentifier {\n /// The invalid identifier value.\n identifier: String,\n /// Why it's invalid.\n reason: String,\n },\n\n /// The DID string is empty.\n #[error(\"DID string is empty\")]\n Empty,\n}", "docs": "Errors arising from parsing or validating `did:oas` identifiers.", "attributes": "#[derive(Debug, Error, Clone, PartialEq, Eq)]", "line": 8 } ], "parseErrors": false }, { "module": "kind", "source": "oas/oas/oas-did/src/kind.rs", "sha256": "e37dbf4c5e148ea633b4108909de20c3c0c59aa886bcb14fc4da2117758a717e", "attributes": "", "items": [ { "name": "kind::EntityKind", "kind": "enum_item", "signature": "pub enum EntityKind {\n /// Human Root \u2014 a single verified human being (OAS Spec \u00a76).\n #[serde(rename = \"hmr\")]\n Hmr,\n\n /// Multi-Human Root \u2014 a threshold group of verified humans (OAS Spec \u00a77).\n #[serde(rename = \"mhr\")]\n Mhr,\n\n /// Entity Name Record \u2014 a stable organizational identity governed by an MHR.\n #[serde(rename = \"enr\")]\n Enr,\n\n /// Autonomous Organization \u2014 a group of agents operating as a unit.\n #[serde(rename = \"ao\")]\n Ao,\n\n /// Agent \u2014 an autonomous software entity.\n #[serde(rename = \"agent\")]\n Agent,\n\n /// Agent Instance \u2014 a specific running instance of an agent, identified by UUID.\n #[serde(rename = \"agent:instance\")]\n AgentInstance,\n\n /// Tool \u2014 a capability that agents can invoke.\n #[serde(rename = \"tool\")]\n Tool,\n\n /// Skill \u2014 a composable unit of agent behavior.\n #[serde(rename = \"skill\")]\n Skill,\n\n /// Workflow \u2014 a defined process involving one or more agents.\n #[serde(rename = \"workflow\")]\n Workflow,\n\n /// Model \u2014 a machine learning model with verified provenance.\n #[serde(rename = \"model\")]\n Model,\n\n /// Dataset \u2014 a data collection with verified provenance and lineage.\n #[serde(rename = \"dataset\")]\n Dataset,\n\n /// Service \u2014 an infrastructure service with verified identity.\n #[serde(rename = \"service\")]\n Service,\n}", "docs": "The 12 entity kinds defined in OAS Specification \u00a74.\n\nEach kind represents a category of autonomous entity with distinct\nidentity requirements and lineage constraints.\n\n# Examples\n\n```\nuse oas_did::kind::EntityKind;\nuse std::str::FromStr;\n\nlet kind = EntityKind::from_str(\"agent\").unwrap();\nassert_eq!(kind, EntityKind::Agent);\nassert_eq!(kind.as_str(), \"agent\");\n```", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]", "line": 30 }, { "name": "kind::EntityKind::as_str", "kind": "function_item", "signature": "pub fn as_str(&self) -> &'static str;", "docs": "Returns the string representation of this kind as it appears in a DID.\n\n# Examples\n\n```\nuse oas_did::kind::EntityKind;\nassert_eq!(EntityKind::AgentInstance.as_str(), \"agent:instance\");\nassert_eq!(EntityKind::Hmr.as_str(), \"hmr\");\n```", "attributes": "", "line": 90 }, { "name": "kind::EntityKind::is_root", "kind": "function_item", "signature": "pub fn is_root(&self) -> bool;", "docs": "Returns `true` if this kind is a root entity (HMR, MHR, or ENR).\n\nRoot entities have no parent and no lineage section.\n\n# Examples\n\n```\nuse oas_did::kind::EntityKind;\nassert!(EntityKind::Hmr.is_root());\nassert!(EntityKind::Mhr.is_root());\nassert!(!EntityKind::Agent.is_root());\n```", "attributes": "", "line": 119 }, { "name": "kind::EntityKind::component_count", "kind": "function_item", "signature": "pub fn component_count(&self) -> usize;", "docs": "Returns the number of DID components this kind consumes.\n\nMost kinds are a single component (e.g., `agent`), but `agent:instance`\nis a compound kind that consumes two components (`agent` + `instance`).", "attributes": "", "line": 127 } ], "parseErrors": false }, { "module": "namespace", "source": "oas/oas/oas-did/src/namespace.rs", "sha256": "e9dcb9c4b49416f6d558cc3d0d02dc5184b15dff3d170aef65655dae747cfb13", "attributes": "", "items": [ { "name": "namespace::RESERVED_NAMESPACES", "kind": "const_item", "signature": "pub const RESERVED_NAMESPACES: &[&str];", "docs": "Reserved namespaces per OAS Spec \u00a73.2.", "attributes": "", "line": 7 }, { "name": "namespace::validate_namespace", "kind": "function_item", "signature": "pub fn validate_namespace(namespace: &str) -> Result<(), DidError>;", "docs": "Validates an OAS namespace string.\n\nPer OAS Specification \u00a73.1, a namespace:\n- MUST be 1-63 characters long\n- MUST contain only lowercase alphanumeric characters and hyphens\n- MUST NOT begin or end with a hyphen\n\n# Arguments\n\n* `namespace` - The namespace string to validate.\n\n# Returns\n\n`Ok(())` if the namespace is valid.\n\n# Errors\n\nReturns [`DidError::InvalidNamespace`] with a specific reason if validation fails.\n\n# Examples\n\n```\nuse oas_did::namespace::validate_namespace;\n\nassert!(validate_namespace(\"acme\").is_ok());\nassert!(validate_namespace(\"my-org-123\").is_ok());\nassert!(validate_namespace(\"-starts-with-hyphen\").is_err());\n```", "attributes": "", "line": 37 }, { "name": "namespace::is_reserved", "kind": "function_item", "signature": "pub fn is_reserved(namespace: &str) -> bool;", "docs": "Returns `true` if the namespace is reserved per OAS Spec \u00a73.2.\n\n# Examples\n\n```\nuse oas_did::namespace::is_reserved;\n\nassert!(is_reserved(\"oas\"));\nassert!(is_reserved(\"test\"));\nassert!(!is_reserved(\"acme\"));\n```", "attributes": "", "line": 95 } ], "parseErrors": false }, { "module": "validation", "source": "oas/oas/oas-did/src/validation.rs", "sha256": "a761dd2f3bf3afc274be57deddf282d8f0eab7e549324f0b76c709c775e1c900", "attributes": "", "items": [ { "name": "validation::MAX_IDENTIFIER_LENGTH", "kind": "const_item", "signature": "pub const MAX_IDENTIFIER_LENGTH: usize;", "docs": "Maximum length for an identifier per OAS Spec \u00a73.1.", "attributes": "", "line": 7 }, { "name": "validation::validate_identifier", "kind": "function_item", "signature": "pub fn validate_identifier(identifier: &str) -> Result<(), DidError>;", "docs": "Validates an OAS identifier string.\n\nPer OAS Specification \u00a73.1, an identifier:\n- MUST be 1-128 characters long\n- MUST contain only characters from the set `[a-zA-Z0-9._-]`\n\n# Arguments\n\n* `identifier` - The identifier string to validate.\n\n# Returns\n\n`Ok(())` if the identifier is valid.\n\n# Errors\n\nReturns [`DidError::InvalidIdentifier`] with a specific reason if validation fails.\n\n# Examples\n\n```\nuse oas_did::validation::validate_identifier;\n\nassert!(validate_identifier(\"support-bot-42\").is_ok());\nassert!(validate_identifier(\"my.model_v2\").is_ok());\nassert!(validate_identifier(\"\").is_err());\n```", "attributes": "", "line": 36 } ], "parseErrors": false } ] }, { "name": "oas-document", "url": "/reference/rust/oas-document", "modules": [ { "module": "crate", "source": "oas/oas/oas-document/src/lib.rs", "sha256": "ae6cedb59a5abc8a4b74aaa59115ee9c7fab1f715ea69bf7870a264daf7434d3", "attributes": "", "items": [ { "name": "builder", "kind": "module", "signature": "pub mod builder;", "docs": "# oas-document\n\nOAS Identity Document types and validation for the Open Agent Specification.\n\nThis crate provides the [`OasDocument`] type for representing, constructing,\nand validating OAS Identity Documents as defined in OAS Specification \u00a75.\n\n## Key Types\n\n- [`OasDocument`] \u2014 The core identity document\n- [`DocumentBuilder`](builder::DocumentBuilder) \u2014 Ergonomic document construction\n- [`DocumentProof`](proof_format::DocumentProof) \u2014 Ed25519Signature2020 proofs\n- [`LineageSection`](lineage_section::LineageSection) \u2014 Lineage chain data\n- [`ConformanceLevel`](conformance::ConformanceLevel) \u2014 L0/L1/L2 conformance\n- [`LifecycleStatus`](lifecycle::LifecycleStatus) \u2014 Entity lifecycle states\n\n## Example\n\n```\nuse oas_document::builder::DocumentBuilder;\nuse oas_document::conformance::ConformanceLevel;\nuse oas_crypto::keypair::OasKeyPair;\n\nlet keypair = OasKeyPair::generate();\nlet doc = DocumentBuilder::new(\"did:oas:test:hmr:alice\", \"hmr\")\n .controller(\"did:oas:test:hmr:alice\")\n .conformance_level(ConformanceLevel::L1)\n .add_verification_method(&keypair)\n .name(\"Alice\")\n .build_and_sign(&keypair, \"2026-01-15T00:00:00Z\")\n .unwrap();\n\nassert_eq!(doc.kind, \"hmr\");\nassert!(doc.proof.is_some());\n```", "attributes": "", "line": 37 }, { "name": "calendar", "kind": "module", "signature": "pub mod calendar;", "docs": "", "attributes": "", "line": 38 }, { "name": "compliance", "kind": "module", "signature": "pub mod compliance;", "docs": "", "attributes": "", "line": 39 }, { "name": "conformance", "kind": "module", "signature": "pub mod conformance;", "docs": "", "attributes": "", "line": 40 }, { "name": "contact", "kind": "module", "signature": "pub mod contact;", "docs": "", "attributes": "", "line": 41 }, { "name": "document", "kind": "module", "signature": "pub mod document;", "docs": "", "attributes": "", "line": 42 }, { "name": "error", "kind": "module", "signature": "pub mod error;", "docs": "", "attributes": "", "line": 43 }, { "name": "governance", "kind": "module", "signature": "pub mod governance;", "docs": "", "attributes": "", "line": 44 }, { "name": "interop", "kind": "module", "signature": "pub mod interop;", "docs": "", "attributes": "", "line": 45 }, { "name": "lifecycle", "kind": "module", "signature": "pub mod lifecycle;", "docs": "", "attributes": "", "line": 46 }, { "name": "lineage_section", "kind": "module", "signature": "pub mod lineage_section;", "docs": "", "attributes": "", "line": 47 }, { "name": "operational", "kind": "module", "signature": "pub mod operational;", "docs": "", "attributes": "", "line": 48 }, { "name": "pricing", "kind": "module", "signature": "pub mod pricing;", "docs": "", "attributes": "", "line": 49 }, { "name": "profile", "kind": "module", "signature": "pub mod profile;", "docs": "", "attributes": "", "line": 50 }, { "name": "proof_format", "kind": "module", "signature": "pub mod proof_format;", "docs": "", "attributes": "", "line": 51 }, { "name": "relationships", "kind": "module", "signature": "pub mod relationships;", "docs": "", "attributes": "", "line": 52 }, { "name": "reputation", "kind": "module", "signature": "pub mod reputation;", "docs": "", "attributes": "", "line": 53 }, { "name": "service", "kind": "module", "signature": "pub mod service;", "docs": "", "attributes": "", "line": 54 }, { "name": "verification_method", "kind": "module", "signature": "pub mod verification_method;", "docs": "", "attributes": "", "line": 55 }, { "name": "visibility", "kind": "module", "signature": "pub mod visibility;", "docs": "", "attributes": "", "line": 56 }, { "name": "pub use document::OasDocument;", "kind": "use_declaration", "signature": "pub use document::OasDocument;", "docs": "", "attributes": "", "line": 58 }, { "name": "pub use error::DocumentError;", "kind": "use_declaration", "signature": "pub use error::DocumentError;", "docs": "", "attributes": "", "line": 59 }, { "name": "pub use governance::{\n GovernancePolicy, GovernanceSection, GovernanceTransition, GovernanceTransitionProof,\n};", "kind": "use_declaration", "signature": "pub use governance::{\n GovernancePolicy, GovernanceSection, GovernanceTransition, GovernanceTransitionProof,\n};", "docs": "", "attributes": "", "line": 60 } ], "parseErrors": false }, { "module": "builder", "source": "oas/oas/oas-document/src/builder.rs", "sha256": "4e2c69ae88dc0a619072d629a1b848631be7c9b191d768d3bcd3783d78860646", "attributes": "", "items": [ { "name": "builder::DocumentBuilder", "kind": "struct_item", "signature": "pub struct DocumentBuilder {\n\n}", "docs": "Builder for constructing [`OasDocument`] instances.\n\nProvides an ergonomic API for building OAS Identity Documents\nwith proper defaults and validation.\n\n# Examples\n\n```\nuse oas_document::builder::DocumentBuilder;\nuse oas_document::conformance::ConformanceLevel;\nuse oas_crypto::keypair::OasKeyPair;\n\nlet keypair = OasKeyPair::generate();\nlet doc = DocumentBuilder::new(\"did:oas:test:hmr:alice\", \"hmr\")\n .controller(\"did:oas:test:hmr:alice\")\n .conformance_level(ConformanceLevel::L1)\n .add_verification_method(&keypair)\n .name(\"Alice\")\n .build_and_sign(&keypair, \"2026-01-15T00:00:00Z\")\n .unwrap();\nassert_eq!(doc.kind, \"hmr\");\nassert!(doc.proof.is_some());\n```", "attributes": "", "line": 48 }, { "name": "builder::DocumentBuilder::new", "kind": "function_item", "signature": "pub fn new(id: &str, kind: &str) -> Self;", "docs": "Creates a new builder with the given DID and kind.\n\n# Arguments\n\n* `id` - The `did:oas` identifier.\n* `kind` - The entity kind string (e.g., `\"hmr\"`, `\"agent\"`).", "attributes": "", "line": 84 }, { "name": "builder::DocumentBuilder::controller", "kind": "function_item", "signature": "pub fn controller(mut self, controller: &str) -> Self;", "docs": "Sets the controller DID.", "attributes": "", "line": 115 }, { "name": "builder::DocumentBuilder::add_verification_method", "kind": "function_item", "signature": "pub fn add_verification_method(mut self, keypair: &OasKeyPair) -> Self;", "docs": "Adds a verification method from a keypair.\n\nAutomatically adds the key to authentication, assertionMethod,\ncapabilityInvocation, and capabilityDelegation relationships.", "attributes": "", "line": 124 }, { "name": "builder::DocumentBuilder::conformance_level", "kind": "function_item", "signature": "pub fn conformance_level(mut self, level: ConformanceLevel) -> Self;", "docs": "Sets the conformance level.", "attributes": "", "line": 137 }, { "name": "builder::DocumentBuilder::name", "kind": "function_item", "signature": "pub fn name(mut self, name: &str) -> Self;", "docs": "Sets the human-readable name.", "attributes": "", "line": 143 }, { "name": "builder::DocumentBuilder::description", "kind": "function_item", "signature": "pub fn description(mut self, description: &str) -> Self;", "docs": "Sets the human-readable description.", "attributes": "", "line": 149 }, { "name": "builder::DocumentBuilder::lineage", "kind": "function_item", "signature": "pub fn lineage(mut self, lineage: LineageSection) -> Self;", "docs": "Sets the lineage section.", "attributes": "", "line": 155 }, { "name": "builder::DocumentBuilder::governance", "kind": "function_item", "signature": "pub fn governance(mut self, governance: GovernanceSection) -> Self;", "docs": "Sets the governance section (ENR entities only).", "attributes": "", "line": 161 }, { "name": "builder::DocumentBuilder::lifecycle_status", "kind": "function_item", "signature": "pub fn lifecycle_status(mut self, status: LifecycleStatus) -> Self;", "docs": "Sets the lifecycle status.", "attributes": "", "line": 167 }, { "name": "builder::DocumentBuilder::sequence", "kind": "function_item", "signature": "pub fn sequence(mut self, seq: u64) -> Self;", "docs": "Sets the sequence number.", "attributes": "", "line": 173 }, { "name": "builder::DocumentBuilder::add_service", "kind": "function_item", "signature": "pub fn add_service(mut self, service: ServiceEndpoint) -> Self;", "docs": "Adds a service endpoint.", "attributes": "", "line": 179 }, { "name": "builder::DocumentBuilder::profile", "kind": "function_item", "signature": "pub fn profile(mut self, profile: ProfileSection) -> Self;", "docs": "Sets the profile section (\u00a75.8).", "attributes": "", "line": 185 }, { "name": "builder::DocumentBuilder::contact", "kind": "function_item", "signature": "pub fn contact(mut self, contact: ContactSection) -> Self;", "docs": "Sets the contact directory (\u00a75.9).", "attributes": "", "line": 191 }, { "name": "builder::DocumentBuilder::calendar", "kind": "function_item", "signature": "pub fn calendar(mut self, calendar: CalendarSection) -> Self;", "docs": "Sets the calendar & scheduling section (\u00a75.10).", "attributes": "", "line": 197 }, { "name": "builder::DocumentBuilder::operational", "kind": "function_item", "signature": "pub fn operational(mut self, operational: OperationalSection) -> Self;", "docs": "Sets the operational specification (\u00a75.11).", "attributes": "", "line": 203 }, { "name": "builder::DocumentBuilder::pricing", "kind": "function_item", "signature": "pub fn pricing(mut self, pricing: PricingSection) -> Self;", "docs": "Sets the pricing & economics section (\u00a75.12).", "attributes": "", "line": 209 }, { "name": "builder::DocumentBuilder::interoperability", "kind": "function_item", "signature": "pub fn interoperability(mut self, interop: InteroperabilitySection) -> Self;", "docs": "Sets the interoperability section (\u00a75.13).", "attributes": "", "line": 215 }, { "name": "builder::DocumentBuilder::reputation", "kind": "function_item", "signature": "pub fn reputation(mut self, reputation: ReputationSection) -> Self;", "docs": "Sets the reputation summary (\u00a75.14).", "attributes": "", "line": 221 }, { "name": "builder::DocumentBuilder::compliance", "kind": "function_item", "signature": "pub fn compliance(mut self, compliance: ComplianceSection) -> Self;", "docs": "Sets the compliance & jurisdiction section (\u00a75.15).", "attributes": "", "line": 227 }, { "name": "builder::DocumentBuilder::relationships", "kind": "function_item", "signature": "pub fn relationships(mut self, relationships: RelationshipsSection) -> Self;", "docs": "Sets the relationships & affiliations section (\u00a75.16).", "attributes": "", "line": 233 }, { "name": "builder::DocumentBuilder::build_and_sign", "kind": "function_item", "signature": "pub fn build_and_sign(\n self,\n signing_keypair: &OasKeyPair,\n created: &str,\n ) -> Result;", "docs": "Builds the document and signs it.\n\n# Arguments\n\n* `signing_keypair` - The keypair to sign the document with.\n* `created` - ISO 8601 timestamp for both document creation and proof.\n\n# Returns\n\nA complete, signed [`OasDocument`].\n\n# Errors\n\nReturns [`DocumentError`] if signing fails.", "attributes": "", "line": 252 } ], "parseErrors": false }, { "module": "calendar", "source": "oas/oas/oas-document/src/calendar.rs", "sha256": "a47a74b8f5b6ee89de670909f0e7440e59138bbfcf5445dbd729930b7df83c11", "attributes": "", "items": [ { "name": "calendar::ScheduleWindow", "kind": "struct_item", "signature": "pub struct ScheduleWindow {\n/// Day of week: `\"monday\"` through `\"sunday\"`, or `\"daily\"` for every day.\n\npub day: String,\n/// Start time in 24h format (e.g., `\"09:00\"`).\n\npub start: String,\n/// End time in 24h format (e.g., `\"17:00\"`).\n\npub end: String,\n/// IANA timezone for this window (e.g., `\"America/New_York\"`).\n\npub timezone: String\n}", "docs": "A recurring time window (e.g., office hours on a specific day).\n\n# Examples\n\n```\nuse oas_document::calendar::ScheduleWindow;\n\nlet window = ScheduleWindow {\n day: \"monday\".to_string(),\n start: \"09:00\".to_string(),\n end: \"17:00\".to_string(),\n timezone: \"America/New_York\".to_string(),\n};\n```", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 29 }, { "name": "calendar::BookingEndpoint", "kind": "struct_item", "signature": "pub struct BookingEndpoint {\n/// Fragment identifier (e.g., \"booking-public\", \"booking-internal\").\n\npub id: String,\n/// The booking URL (e.g., Calendly, Cal.com, custom API).\n\npub url: String,\n/// Human-readable label (e.g., \"30-min consultation\", \"Priority support\").\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub label: Option,\n/// Type of booking: `\"consultation\"`, `\"support\"`, `\"meeting\"`, `\"task\"`, `\"custom\"`.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub booking_type: Option,\n/// Who can access this booking endpoint.\n\n#[serde(default)]\npub visibility: Visibility\n}", "docs": "A booking or scheduling endpoint.\n\nEach booking entry can have its own visibility \u2014 an agent might\nexpose a public booking link for external clients but restrict\nan internal scheduling API to organization members only.\n\n# Examples\n\n```\nuse oas_document::calendar::BookingEndpoint;\nuse oas_document::visibility::Visibility;\n\nlet booking = BookingEndpoint {\n id: \"booking-public\".to_string(),\n url: \"https://cal.com/agent42/30min\".to_string(),\n label: Some(\"30-min consultation\".to_string()),\n booking_type: Some(\"consultation\".to_string()),\n visibility: Visibility::Public,\n};\n```", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 65 }, { "name": "calendar::CalendarSection", "kind": "struct_item", "signature": "pub struct CalendarSection {\n/// Booking endpoints, each with independent visibility.\n\n#[serde(default, skip_serializing_if = \"Vec::is_empty\")]\npub booking_endpoints: Vec,\n/// iCal/CalDAV URL for real-time availability (free/busy).\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub availability_feed: Option,\n/// Preferred scheduling protocol:\n\n/// `\"ical-invite\"`, `\"api\"`, `\"agent-negotiation\"`, `\"manual\"`.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub scheduling_protocol: Option,\n/// Recurring office hours / availability windows.\n\n#[serde(default, skip_serializing_if = \"Vec::is_empty\")]\npub office_hours: Vec,\n/// Default IANA timezone for this entity's schedule.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub timezone: Option\n}", "docs": "Calendar and scheduling section of an OAS Identity Document.\n\n# Examples\n\n```\nuse oas_document::calendar::{CalendarSection, BookingEndpoint, ScheduleWindow};\nuse oas_document::visibility::Visibility;\n\nlet calendar = CalendarSection {\n booking_endpoints: vec![\n BookingEndpoint {\n id: \"booking-external\".to_string(),\n url: \"https://cal.com/agent42/intro\".to_string(),\n label: Some(\"Intro call\".to_string()),\n booking_type: Some(\"consultation\".to_string()),\n visibility: Visibility::Public,\n },\n BookingEndpoint {\n id: \"booking-internal\".to_string(),\n url: \"https://internal.acme.com/schedule/agent42\".to_string(),\n label: Some(\"Internal sync\".to_string()),\n booking_type: Some(\"meeting\".to_string()),\n visibility: Visibility::Organization,\n },\n ],\n availability_feed: Some(\"https://cal.com/agent42/availability.ics\".to_string()),\n scheduling_protocol: Some(\"ical-invite\".to_string()),\n office_hours: vec![\n ScheduleWindow {\n day: \"monday\".to_string(),\n start: \"09:00\".to_string(),\n end: \"17:00\".to_string(),\n timezone: \"America/New_York\".to_string(),\n },\n ],\n timezone: Some(\"America/New_York\".to_string()),\n};\nassert_eq!(calendar.booking_endpoints.len(), 2);\n```", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 126 }, { "name": "calendar::booking_types", "kind": "module", "signature": "pub mod booking_types;", "docs": "Standard booking types.", "attributes": "", "line": 150 }, { "name": "calendar::booking_types::CONSULTATION", "kind": "const_item", "signature": "pub const CONSULTATION: &str;", "docs": "", "attributes": "", "line": 151 }, { "name": "calendar::booking_types::SUPPORT", "kind": "const_item", "signature": "pub const SUPPORT: &str;", "docs": "", "attributes": "", "line": 152 }, { "name": "calendar::booking_types::MEETING", "kind": "const_item", "signature": "pub const MEETING: &str;", "docs": "", "attributes": "", "line": 153 }, { "name": "calendar::booking_types::TASK", "kind": "const_item", "signature": "pub const TASK: &str;", "docs": "", "attributes": "", "line": 154 }, { "name": "calendar::booking_types::CUSTOM", "kind": "const_item", "signature": "pub const CUSTOM: &str;", "docs": "", "attributes": "", "line": 155 }, { "name": "calendar::scheduling_protocols", "kind": "module", "signature": "pub mod scheduling_protocols;", "docs": "Standard scheduling protocols.", "attributes": "", "line": 159 }, { "name": "calendar::scheduling_protocols::ICAL_INVITE", "kind": "const_item", "signature": "pub const ICAL_INVITE: &str;", "docs": "iCalendar invite via email.", "attributes": "", "line": 161 }, { "name": "calendar::scheduling_protocols::API", "kind": "const_item", "signature": "pub const API: &str;", "docs": "Direct API call to booking endpoint.", "attributes": "", "line": 163 }, { "name": "calendar::scheduling_protocols::AGENT_NEGOTIATION", "kind": "const_item", "signature": "pub const AGENT_NEGOTIATION: &str;", "docs": "Agent-to-agent negotiation via MAP protocols.", "attributes": "", "line": 165 }, { "name": "calendar::scheduling_protocols::MANUAL", "kind": "const_item", "signature": "pub const MANUAL: &str;", "docs": "Manual / human-in-the-loop scheduling.", "attributes": "", "line": 167 } ], "parseErrors": false }, { "module": "compliance", "source": "oas/oas/oas-document/src/compliance.rs", "sha256": "d8e7bef91c2192744c6174ed6ca1caeff461d721db91f8f4f9a7e9149cdecbb0", "attributes": "", "items": [ { "name": "compliance::Certification", "kind": "struct_item", "signature": "pub struct Certification {\n/// Standard name: `\"SOC2 Type II\"`, `\"GDPR\"`, `\"HIPAA\"`, `\"ISO 27001\"`.\n\npub standard: String,\n/// Issuing body or audit firm.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub issuer: Option,\n/// Expiry date (ISO 8601 date or datetime).\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub valid_until: Option,\n/// URL to certification evidence or public report.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub url: Option\n}", "docs": "A compliance certification held by the entity.\n\n# Examples\n\n```\nuse oas_document::compliance::Certification;\n\nlet cert = Certification {\n standard: \"SOC2 Type II\".to_string(),\n issuer: Some(\"Vanta\".to_string()),\n valid_until: Some(\"2027-06-30\".to_string()),\n url: Some(\"https://acme.com/compliance/soc2\".to_string()),\n};\n```", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 25 }, { "name": "compliance::ComplianceSection", "kind": "struct_item", "signature": "pub struct ComplianceSection {\n/// Operating jurisdictions (ISO 3166-1 alpha-2 country codes).\n\n#[serde(default, skip_serializing_if = \"Vec::is_empty\")]\npub jurisdictions: Vec,\n/// Compliance certifications.\n\n#[serde(default, skip_serializing_if = \"Vec::is_empty\")]\npub certifications: Vec,\n/// Terms of service URL.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub terms_of_service_url: Option,\n/// Privacy policy URL.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub privacy_policy_url: Option,\n/// Data handling / data processing policy URL.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub data_handling_policy_url: Option,\n/// Data residency region (ISO 3166-1 alpha-2 or region name).\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub data_residency: Option\n}", "docs": "Compliance and jurisdiction section of an OAS Identity Document.\n\n# Examples\n\n```\nuse oas_document::compliance::{ComplianceSection, Certification};\n\nlet compliance = ComplianceSection {\n jurisdictions: vec![\"US\".to_string(), \"EU\".to_string()],\n certifications: vec![Certification {\n standard: \"GDPR\".to_string(),\n issuer: None,\n valid_until: None,\n url: None,\n }],\n terms_of_service_url: Some(\"https://acme.com/tos\".to_string()),\n privacy_policy_url: Some(\"https://acme.com/privacy\".to_string()),\n data_handling_policy_url: Some(\"https://acme.com/data-policy\".to_string()),\n data_residency: Some(\"EU\".to_string()),\n};\nassert_eq!(compliance.jurisdictions.len(), 2);\n```", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 66 } ], "parseErrors": false }, { "module": "conformance", "source": "oas/oas/oas-document/src/conformance.rs", "sha256": "4af11df070193dee1ef0d8e327a75debbdee373a6fc557a144f7e229e892cf65", "attributes": "", "items": [ { "name": "conformance::ConformanceLevel", "kind": "enum_item", "signature": "pub enum ConformanceLevel {\n /// Level 0 \u2014 Basic Identity (OAS Spec \u00a710.1).\n L0,\n /// Level 1 \u2014 Accountable Identity (OAS Spec \u00a710.2).\n L1,\n /// Level 2 \u2014 Full Identity (OAS Spec \u00a710.3).\n L2,\n}", "docs": "OAS conformance levels as defined in OAS Specification \u00a710.\n\n- **L0**: Basic Identity \u2014 valid document, signature, and kind\n- **L1**: Accountable Identity \u2014 L0 + valid lineage to human root\n- **L2**: Full Identity \u2014 L1 + immutable ledger anchoring + third-party attestation\n\n# Examples\n\n```\nuse oas_document::conformance::ConformanceLevel;\nuse std::str::FromStr;\n\nlet level = ConformanceLevel::from_str(\"L1\").unwrap();\nassert!(level >= ConformanceLevel::L0);\n```", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]", "line": 25 }, { "name": "conformance::ConformanceLevel::as_str", "kind": "function_item", "signature": "pub fn as_str(&self) -> &'static str;", "docs": "Returns the string representation.", "attributes": "", "line": 36 } ], "parseErrors": false }, { "module": "contact", "source": "oas/oas/oas-document/src/contact.rs", "sha256": "b9714c05319246fe83cf72c2d2e9e01665b90f703afe1b3dc4cf1030db576d86", "attributes": "", "items": [ { "name": "contact::ContactEntry", "kind": "struct_item", "signature": "pub struct ContactEntry {\n/// Fragment identifier (e.g., \"phone-1\", \"email-2\", \"social-x\").\n\npub id: String,\n/// Entry type: `\"phone\"`, `\"email\"`, `\"social\"`, `\"website\"`, `\"messaging\"`.\n\npub entry_type: String,\n/// The contact value. Format depends on type:\n\n/// - phone: `tel:+15551234567`\n\n/// - email: `mailto:agent@example.com`\n\n/// - social: `https://x.com/agent`\n\n/// - website: `https://example.com/agent`\n\n/// - messaging: `https://t.me/agent_bot`\n\npub value: String,\n/// Human-readable label (e.g., \"Primary\", \"Support\", \"Sales\", \"Personal\").\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub label: Option,\n/// Platform name for social/messaging entries (e.g., \"x\", \"linkedin\",\n\n/// \"discord\", \"telegram\", \"github\", \"slack\", \"whatsapp\", \"signal\").\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub platform: Option,\n/// Handle/username for social/messaging entries (e.g., \"@agent42\").\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub handle: Option,\n/// Who can see this entry's actual value.\n\n/// Non-public entries show only the capability flag on the DHT.\n\n#[serde(default)]\npub visibility: Visibility,\n/// Whether this contact channel has been verified by the entity.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub verified: Option\n}", "docs": "A single contact entry in an entity's contact directory.\n\nEach entry represents one reachable channel (phone, email, social profile, etc.)\nwith its own visibility level for access control.\n\n# DHT Behavior\n\nFor entries where `visibility` is not `public`, the DHT-stored copy contains:\n```json\n{\n \"id\": \"phone-1\",\n \"entryType\": \"phone\",\n \"label\": \"Support\",\n \"visibility\": \"organization\",\n \"available\": true,\n \"value\": null\n}\n```\nThe actual `value` is only served via the authenticated\n`OASPrivateEndpointService`.\n\n# Examples\n\n```\nuse oas_document::contact::ContactEntry;\nuse oas_document::visibility::Visibility;\n\nlet phone = ContactEntry {\n id: \"phone-1\".to_string(),\n entry_type: \"phone\".to_string(),\n value: \"tel:+15551234567\".to_string(),\n label: Some(\"Primary\".to_string()),\n platform: None,\n handle: None,\n visibility: Visibility::Public,\n verified: Some(true),\n};\nassert_eq!(phone.entry_type, \"phone\");\n```", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 53 }, { "name": "contact::ContactSection", "kind": "struct_item", "signature": "pub struct ContactSection {\n/// All contact entries for this entity.\n\npub entries: Vec\n}", "docs": "Contact directory section of an OAS Identity Document.\n\nContains all reachable channels for an entity, each with\nindependent visibility controls.\n\n# Standard Entry Types\n\n| Type | Value Format | Example |\n|-------------|-----------------------------------|---------------------------------|\n| `phone` | `tel:` URI (E.164) | `tel:+15551234567` |\n| `email` | `mailto:` URI | `mailto:agent@acme.com` |\n| `social` | HTTPS URL to profile | `https://x.com/agent42` |\n| `website` | HTTPS URL | `https://acme.com/agent` |\n| `messaging` | HTTPS URL or protocol-specific URI| `https://t.me/agent_bot` |\n\n# Examples\n\n```\nuse oas_document::contact::{ContactSection, ContactEntry};\nuse oas_document::visibility::Visibility;\n\nlet contact = ContactSection {\n entries: vec![\n ContactEntry {\n id: \"email-1\".to_string(),\n entry_type: \"email\".to_string(),\n value: \"mailto:hello@agent.ai\".to_string(),\n label: Some(\"Primary\".to_string()),\n platform: None,\n handle: None,\n visibility: Visibility::Public,\n verified: Some(true),\n },\n ContactEntry {\n id: \"social-x\".to_string(),\n entry_type: \"social\".to_string(),\n value: \"https://x.com/agent42\".to_string(),\n label: None,\n platform: Some(\"x\".to_string()),\n handle: Some(\"@agent42\".to_string()),\n visibility: Visibility::Public,\n verified: None,\n },\n ],\n};\nassert_eq!(contact.entries.len(), 2);\n```", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 140 }, { "name": "contact::entry_types", "kind": "module", "signature": "pub mod entry_types;", "docs": "Standard contact entry types.", "attributes": "", "line": 146 }, { "name": "contact::entry_types::PHONE", "kind": "const_item", "signature": "pub const PHONE: &str;", "docs": "Telephone number (value format: `tel:` URI).", "attributes": "", "line": 148 }, { "name": "contact::entry_types::EMAIL", "kind": "const_item", "signature": "pub const EMAIL: &str;", "docs": "Email address (value format: `mailto:` URI).", "attributes": "", "line": 150 }, { "name": "contact::entry_types::SOCIAL", "kind": "const_item", "signature": "pub const SOCIAL: &str;", "docs": "Social media profile (value: HTTPS URL).", "attributes": "", "line": 152 }, { "name": "contact::entry_types::WEBSITE", "kind": "const_item", "signature": "pub const WEBSITE: &str;", "docs": "Website (value: HTTPS URL).", "attributes": "", "line": 154 }, { "name": "contact::entry_types::MESSAGING", "kind": "const_item", "signature": "pub const MESSAGING: &str;", "docs": "Messaging endpoint (value: HTTPS URL or protocol-specific URI).", "attributes": "", "line": 156 }, { "name": "contact::platforms", "kind": "module", "signature": "pub mod platforms;", "docs": "Standard social platform identifiers.", "attributes": "", "line": 160 }, { "name": "contact::platforms::X", "kind": "const_item", "signature": "pub const X: &str;", "docs": "", "attributes": "", "line": 161 }, { "name": "contact::platforms::LINKEDIN", "kind": "const_item", "signature": "pub const LINKEDIN: &str;", "docs": "", "attributes": "", "line": 162 }, { "name": "contact::platforms::GITHUB", "kind": "const_item", "signature": "pub const GITHUB: &str;", "docs": "", "attributes": "", "line": 163 }, { "name": "contact::platforms::DISCORD", "kind": "const_item", "signature": "pub const DISCORD: &str;", "docs": "", "attributes": "", "line": 164 }, { "name": "contact::platforms::TELEGRAM", "kind": "const_item", "signature": "pub const TELEGRAM: &str;", "docs": "", "attributes": "", "line": 165 }, { "name": "contact::platforms::SLACK", "kind": "const_item", "signature": "pub const SLACK: &str;", "docs": "", "attributes": "", "line": 166 }, { "name": "contact::platforms::WHATSAPP", "kind": "const_item", "signature": "pub const WHATSAPP: &str;", "docs": "", "attributes": "", "line": 167 }, { "name": "contact::platforms::SIGNAL", "kind": "const_item", "signature": "pub const SIGNAL: &str;", "docs": "", "attributes": "", "line": 168 }, { "name": "contact::platforms::MASTODON", "kind": "const_item", "signature": "pub const MASTODON: &str;", "docs": "", "attributes": "", "line": 169 }, { "name": "contact::platforms::BLUESKY", "kind": "const_item", "signature": "pub const BLUESKY: &str;", "docs": "", "attributes": "", "line": 170 }, { "name": "contact::platforms::YOUTUBE", "kind": "const_item", "signature": "pub const YOUTUBE: &str;", "docs": "", "attributes": "", "line": 171 }, { "name": "contact::platforms::INSTAGRAM", "kind": "const_item", "signature": "pub const INSTAGRAM: &str;", "docs": "", "attributes": "", "line": 172 }, { "name": "contact::platforms::TIKTOK", "kind": "const_item", "signature": "pub const TIKTOK: &str;", "docs": "", "attributes": "", "line": 173 }, { "name": "contact::platforms::REDDIT", "kind": "const_item", "signature": "pub const REDDIT: &str;", "docs": "", "attributes": "", "line": 174 } ], "parseErrors": false }, { "module": "document", "source": "oas/oas/oas-document/src/document.rs", "sha256": "586da29287fbfd0b63c9f78262aa79e5be3ad43b9af1cf6e7d3736bd92c0d468", "attributes": "", "items": [ { "name": "document::OAS_CONTEXT", "kind": "const_item", "signature": "pub const OAS_CONTEXT: &str;", "docs": "The OAS JSON-LD context URI.", "attributes": "", "line": 28 }, { "name": "document::DID_CONTEXT", "kind": "const_item", "signature": "pub const DID_CONTEXT: &str;", "docs": "The W3C DID context URI.", "attributes": "", "line": 31 }, { "name": "document::ED25519_CONTEXT", "kind": "const_item", "signature": "pub const ED25519_CONTEXT: &str;", "docs": "The Ed25519 2020 suite context URI.", "attributes": "", "line": 34 }, { "name": "document::OAS_VERSION", "kind": "const_item", "signature": "pub const OAS_VERSION: &str;", "docs": "The current OAS specification version.", "attributes": "", "line": 37 }, { "name": "document::DocumentMetadata", "kind": "struct_item", "signature": "pub struct DocumentMetadata {\n/// ISO 8601 creation timestamp (required).\n\npub created: String,\n/// ISO 8601 last update timestamp (optional).\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub updated: Option,\n/// Semantic version of this entity's definition (optional).\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub version: Option\n}", "docs": "Metadata section of an OAS Identity Document.\n\n# Examples\n\n```\nuse oas_document::document::DocumentMetadata;\n\nlet meta = DocumentMetadata {\n created: \"2026-01-15T00:00:00Z\".to_string(),\n updated: None,\n version: None,\n};\n```", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]", "line": 53 }, { "name": "document::OasDocument", "kind": "struct_item", "signature": "pub struct OasDocument {\n/// JSON-LD contexts. MUST include the OAS context.\n\n#[serde(rename = \"@context\")]\npub context: Vec,\n/// The `did:oas` identifier.\n\npub id: String,\n/// DID of the controlling entity.\n\npub controller: String,\n/// At least one Ed25519VerificationKey2020.\n\npub verification_method: Vec,\n/// References to keys authorized for authentication.\n\npub authentication: Vec,\n/// References to keys authorized for assertions.\n\n#[serde(default, skip_serializing_if = \"Vec::is_empty\")]\npub assertion_method: Vec,\n/// References to keys authorized for capability invocation.\n\n#[serde(default, skip_serializing_if = \"Vec::is_empty\")]\npub capability_invocation: Vec,\n/// References to keys authorized for capability delegation.\n\n#[serde(default, skip_serializing_if = \"Vec::is_empty\")]\npub capability_delegation: Vec,\n/// Service endpoints.\n\n#[serde(default, skip_serializing_if = \"Vec::is_empty\")]\npub service: Vec,\n/// OAS specification version (currently `\"1.0.0\"`).\n\npub oas_version: String,\n/// Entity kind from the taxonomy.\n\npub kind: String,\n/// Human-readable name (max 256 chars).\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub name: Option,\n/// Human-readable description (max 4096 chars).\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub description: Option,\n/// Lineage information (required for L1+ non-root entities).\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub lineage: Option,\n/// Governance section (ENR entities only).\n\n/// Tracks which MHR governs this enterprise identity, epoch, and transition history.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub governance: Option,\n/// Conformance level: L0, L1, or L2.\n\npub conformance_level: ConformanceLevel,\n/// Lifecycle status.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub lifecycle_status: Option,\n/// Monotonically increasing version counter (starting at 1).\n\npub sequence: u64,\n/// Document metadata.\n\npub metadata: DocumentMetadata,\n/// Document proof (Ed25519Signature2020).\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub proof: Option,\n/// Whether this identity has been revoked.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub revoked: Option,\n/// Timestamp of revocation.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub revoked_at: Option,\n// \u2500\u2500 Extended Identity Sections (OAS \u00a75.8\u2013\u00a75.16) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n/// Profile / presentation data (\u00a75.8): avatar, tagline, categories.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub profile: Option,\n/// Contact directory (\u00a75.9): phones, emails, socials, websites.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub contact: Option,\n/// Calendar & scheduling (\u00a75.10): booking links, office hours.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub calendar: Option,\n/// Operational specification (\u00a75.11): SLA, rate limits, formats.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub operational: Option,\n/// Pricing & economics (\u00a75.12): cost model, billing, free tier.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub pricing: Option,\n/// Interoperability (\u00a75.13): protocols, API schemas, auth methods.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub interoperability: Option,\n/// Reputation summary (\u00a75.14): interactions, endorsements, uptime.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub reputation: Option,\n/// Compliance & jurisdiction (\u00a75.15): certifications, policy URLs.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub compliance: Option,\n/// Relationships & affiliations (\u00a75.16): org structure, partnerships.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub relationships: Option\n}", "docs": "An OAS Identity Document as defined in OAS Specification \u00a75.\n\nThis is the canonical representation of an autonomous entity's identity,\nextending the W3C DID Document with OAS-specific properties.\n\n# Examples\n\n```\nuse oas_document::OasDocument;\n\nlet json = r#\"{\n \"@context\": [\"https://www.w3.org/ns/did/v1\", \"https://w3id.org/security/suites/ed25519-2020/v1\", \"https://openagent.id/ns/oas/v1\"],\n \"id\": \"did:oas:test:hmr:alice\",\n \"controller\": \"did:oas:test:hmr:alice\",\n \"verificationMethod\": [{\"id\": \"did:oas:test:hmr:alice#key-1\", \"type\": \"Ed25519VerificationKey2020\", \"controller\": \"did:oas:test:hmr:alice\", \"publicKeyMultibase\": \"zTest\"}],\n \"authentication\": [\"did:oas:test:hmr:alice#key-1\"],\n \"oasVersion\": \"1.0.0\",\n \"kind\": \"hmr\",\n \"conformanceLevel\": \"L1\",\n \"sequence\": 1,\n \"metadata\": {\"created\": \"2026-01-15T00:00:00Z\"}\n}\"#;\nlet doc: OasDocument = serde_json::from_str(json).unwrap();\nassert_eq!(doc.id, \"did:oas:test:hmr:alice\");\n```", "attributes": "#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 93 }, { "name": "document::OasDocument::default_context", "kind": "function_item", "signature": "pub fn default_context() -> Vec;", "docs": "Returns the default JSON-LD context array for OAS documents.", "attributes": "", "line": 214 }, { "name": "document::OasDocument::is_root", "kind": "function_item", "signature": "pub fn is_root(&self) -> bool;", "docs": "Returns true if this document represents a root entity (HMR, MHR, or ENR).", "attributes": "", "line": 223 }, { "name": "document::OasDocument::is_revoked", "kind": "function_item", "signature": "pub fn is_revoked(&self) -> bool;", "docs": "Returns true if this document has been revoked.", "attributes": "", "line": 228 }, { "name": "document::OasDocument::canonical_digest", "kind": "function_item", "signature": "pub fn canonical_digest(&self) -> Result;", "docs": "Computes the canonical BLAKE3 commitment for this complete document.\n\nThe digest covers the RFC 8785 canonical JSON representation, including\nthe document proof and all status, relationship, key, and lineage fields.\nLineage proofs bind this value to the authenticated parent state used at\nissuance time.\n\n# Returns\n\nA lowercase `blake3:`-prefixed digest.\n\n# Errors\n\nReturns [`DocumentError::Crypto`] if canonicalization fails.", "attributes": "", "line": 246 }, { "name": "document::OasDocument::primary_public_key_multibase", "kind": "function_item", "signature": "pub fn primary_public_key_multibase(&self) -> Option<&str>;", "docs": "Returns the primary public key multibase string, if available.\n\nLooks for the first verification method's public key.", "attributes": "", "line": 258 }, { "name": "document::OasDocument::find_verification_method", "kind": "function_item", "signature": "pub fn find_verification_method(&self, id_or_fragment: &str) -> Option<&VerificationMethod>;", "docs": "Finds a verification method by its full ID or fragment.", "attributes": "", "line": 265 } ], "parseErrors": false }, { "module": "error", "source": "oas/oas/oas-document/src/error.rs", "sha256": "c054eaf593cb626500298c19fc5307892f8adb3b04aabc86f7665bfb6afe7a4b", "attributes": "", "items": [ { "name": "error::DocumentError", "kind": "enum_item", "signature": "pub enum DocumentError {\n /// The document is missing a required field.\n #[error(\"missing required field '{field}' in OAS Identity Document\")]\n MissingField {\n /// The name of the missing field.\n field: String,\n },\n\n /// A field value is invalid.\n #[error(\"invalid value for field '{field}': {reason}\")]\n InvalidField {\n /// The field name.\n field: String,\n /// Why the value is invalid.\n reason: String,\n },\n\n /// Document proof verification failed.\n #[error(\"document proof verification failed: {reason}\")]\n ProofVerificationFailed {\n /// Why verification failed.\n reason: String,\n },\n\n /// Document proof generation failed.\n #[error(\"document proof generation failed: {reason}\")]\n ProofGenerationFailed {\n /// Why generation failed.\n reason: String,\n },\n\n /// Conformance level requirements not met.\n #[error(\"conformance level {level} requirements not met: {reason}\")]\n ConformanceNotMet {\n /// The conformance level that was not met.\n level: String,\n /// What requirement was not satisfied.\n reason: String,\n },\n\n /// JSON serialization/deserialization failed.\n #[error(\"JSON error: {0}\")]\n Json(#[from] serde_json::Error),\n\n /// DID parsing failed.\n #[error(\"DID error: {0}\")]\n Did(#[from] oas_did::DidError),\n\n /// Cryptographic operation failed.\n #[error(\"crypto error: {0}\")]\n Crypto(#[from] oas_crypto::CryptoError),\n\n /// The lifecycle status transition is not allowed.\n #[error(\"invalid lifecycle transition from '{from}' to '{to}'\")]\n InvalidLifecycleTransition {\n /// Current status.\n from: String,\n /// Attempted new status.\n to: String,\n },\n\n /// Sequence number is not valid.\n #[error(\"invalid sequence number {sequence}: {reason}\")]\n InvalidSequence {\n /// The invalid sequence number.\n sequence: u64,\n /// Why it's invalid.\n reason: String,\n },\n}", "docs": "Errors arising from OAS Identity Document operations.", "attributes": "#[derive(Debug, Error)]", "line": 8 } ], "parseErrors": false }, { "module": "governance", "source": "oas/oas/oas-document/src/governance.rs", "sha256": "a3080f49ab3529bad6cdbd7b4f6522a78abf72e1e43017e197a9c998ed7e7e6a", "attributes": "", "items": [ { "name": "governance::GovernanceSection", "kind": "struct_item", "signature": "pub struct GovernanceSection {\n/// DID of the MHR currently governing this ENR.\n\npub current_mhr: String,\n/// Monotonically increasing epoch counter.\n\n/// Incremented on every governance transition.\n\npub epoch: u64,\n/// Complete history of governance transitions.\n\n#[serde(default)]\npub transitions: Vec,\n/// Governance policy constraints.\n\npub policy: GovernancePolicy\n}", "docs": "Governance section attached to ENR identity documents.\n\nTracks the governing MHR, monotonic epoch counter, transition history,\nand governance policy constraints.\n\n# Invariants\n\n- `epoch` MUST strictly increase (no gaps, no rewinds).\n- `current_mhr` MUST reference a valid, non-revoked MHR DID.\n- Each transition's `from` MUST match the previous transition's `to`.\n\n# Examples\n\n```\nuse oas_document::governance::GovernanceSection;\n\nlet json = r#\"{\n \"currentMhr\": \"did:oas:prod:mhr:council-alpha\",\n \"epoch\": 1,\n \"transitions\": [],\n \"policy\": {\n \"transitionRequires\": \"mhr_threshold\",\n \"signingKeyRotationRequires\": \"mhr_threshold\",\n \"maxTransitionsPerDay\": 1,\n \"timelockHours\": 24\n }\n}\"#;\nlet gov: GovernanceSection = serde_json::from_str(json).unwrap();\nassert_eq!(gov.epoch, 1);\n```", "attributes": "#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 42 }, { "name": "governance::GovernanceTransition", "kind": "struct_item", "signature": "pub struct GovernanceTransition {\n/// DID of the outgoing MHR (None for the initial governance assignment).\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub from: Option,\n/// DID of the incoming MHR.\n\npub to: String,\n/// Epoch at which this transition occurred.\n\npub epoch: u64,\n/// Cryptographic proof of the transition.\n\npub proof: GovernanceTransitionProof\n}", "docs": "A single governance transition record.\n\nRecords the handoff from one MHR to another, including the\ncryptographic proof (FROST threshold signature from the outgoing MHR).", "attributes": "#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 64 }, { "name": "governance::GovernanceTransitionProof", "kind": "struct_item", "signature": "pub struct GovernanceTransitionProof {\n/// Proof type identifier.\n\n#[serde(rename = \"type\")]\npub proof_type: String,\n/// FROST threshold signature from the outgoing MHR (base64url-encoded).\n\npub mhr_threshold_signature: String,\n/// ISO 8601 timestamp of when the proof was created.\n\npub timestamp: String\n}", "docs": "Proof that a governance transition was authorized.\n\nContains a FROST threshold signature from the outgoing MHR members,\nproving that a quorum approved the handoff.", "attributes": "#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 85 }, { "name": "governance::ENR_GOVERNANCE_PROOF_TYPE", "kind": "const_item", "signature": "pub const ENR_GOVERNANCE_PROOF_TYPE: &str;", "docs": "The canonical proof type string for ENR governance transitions.", "attributes": "", "line": 98 }, { "name": "governance::GovernancePolicy", "kind": "struct_item", "signature": "pub struct GovernancePolicy {\n/// What is required to transition governance (e.g., `\"mhr_threshold\"`).\n\npub transition_requires: String,\n/// What is required to rotate the ENR signing key (e.g., `\"mhr_threshold\"`).\n\npub signing_key_rotation_requires: String,\n/// Maximum number of governance transitions allowed per 24-hour period.\n\n#[serde(default = \"default_max_transitions\")]\npub max_transitions_per_day: u32,\n/// Mandatory delay (in hours) between initiating and confirming a transition.\n\n#[serde(default = \"default_timelock\")]\npub timelock_hours: u32\n}", "docs": "Policy constraints governing how ENR transitions may occur.", "attributes": "#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 103 }, { "name": "governance::GovernancePolicy::default_policy", "kind": "function_item", "signature": "pub fn default_policy() -> Self;", "docs": "Creates a default governance policy with standard constraints.", "attributes": "", "line": 129 } ], "parseErrors": false }, { "module": "interop", "source": "oas/oas/oas-document/src/interop.rs", "sha256": "c63c95edc05cade79ac2ae2d901517dc8a3083e24ab61422ae6e877d27fddb43", "attributes": "", "items": [ { "name": "interop::ProtocolSupport", "kind": "struct_item", "signature": "pub struct ProtocolSupport {\n/// Protocol identifier: `\"mcp\"`, `\"a2a\"`, `\"rest\"`, `\"graphql\"`,\n\n/// `\"grpc\"`, `\"websocket\"`, `\"oas-map\"`.\n\npub protocol: String,\n/// Protocol version if applicable.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub version: Option,\n/// Endpoint URL for this protocol.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub endpoint: Option\n}", "docs": "A supported protocol with optional version and endpoint.\n\n# Examples\n\n```\nuse oas_document::interop::ProtocolSupport;\n\nlet proto = ProtocolSupport {\n protocol: \"mcp\".to_string(),\n version: Some(\"2025-01\".to_string()),\n endpoint: Some(\"https://agent.acme.com/mcp\".to_string()),\n};\n```", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 24 }, { "name": "interop::ApiSchema", "kind": "struct_item", "signature": "pub struct ApiSchema {\n/// Schema format: `\"openapi\"`, `\"asyncapi\"`, `\"json-schema\"`,\n\n/// `\"protobuf\"`, `\"graphql-sdl\"`.\n\npub schema_type: String,\n/// URL to the schema document.\n\npub url: String,\n/// Schema version.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub version: Option\n}", "docs": "An API schema reference.\n\n# Examples\n\n```\nuse oas_document::interop::ApiSchema;\n\nlet schema = ApiSchema {\n schema_type: \"openapi\".to_string(),\n url: \"https://agent.acme.com/openapi.json\".to_string(),\n version: Some(\"3.1.0\".to_string()),\n};\n```", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 53 }, { "name": "interop::InteroperabilitySection", "kind": "struct_item", "signature": "pub struct InteroperabilitySection {\n/// Protocols this entity supports.\n\n#[serde(default, skip_serializing_if = \"Vec::is_empty\")]\npub protocols: Vec,\n/// API schema references.\n\n#[serde(default, skip_serializing_if = \"Vec::is_empty\")]\npub api_schemas: Vec,\n/// Authentication methods accepted: `\"did-auth\"`, `\"api-key\"`,\n\n/// `\"oauth2\"`, `\"mtls\"`, `\"bearer-token\"`.\n\n#[serde(default, skip_serializing_if = \"Vec::is_empty\")]\npub auth_methods: Vec\n}", "docs": "Interoperability section of an OAS Identity Document.\n\n# Examples\n\n```\nuse oas_document::interop::{InteroperabilitySection, ProtocolSupport, ApiSchema};\n\nlet interop = InteroperabilitySection {\n protocols: vec![\n ProtocolSupport {\n protocol: \"mcp\".to_string(),\n version: Some(\"2025-01\".to_string()),\n endpoint: Some(\"https://agent.acme.com/mcp\".to_string()),\n },\n ProtocolSupport {\n protocol: \"rest\".to_string(),\n version: None,\n endpoint: Some(\"https://api.acme.com/v1\".to_string()),\n },\n ],\n api_schemas: vec![ApiSchema {\n schema_type: \"openapi\".to_string(),\n url: \"https://api.acme.com/v1/openapi.json\".to_string(),\n version: Some(\"3.1.0\".to_string()),\n }],\n auth_methods: vec![\"did-auth\".to_string(), \"api-key\".to_string()],\n};\nassert_eq!(interop.protocols.len(), 2);\n```", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 97 }, { "name": "interop::protocols", "kind": "module", "signature": "pub mod protocols;", "docs": "Standard protocol identifiers.", "attributes": "", "line": 113 }, { "name": "interop::protocols::MCP", "kind": "const_item", "signature": "pub const MCP: &str;", "docs": "Model Context Protocol.", "attributes": "", "line": 115 }, { "name": "interop::protocols::A2A", "kind": "const_item", "signature": "pub const A2A: &str;", "docs": "Google Agent-to-Agent protocol.", "attributes": "", "line": 117 }, { "name": "interop::protocols::REST", "kind": "const_item", "signature": "pub const REST: &str;", "docs": "REST / HTTP API.", "attributes": "", "line": 119 }, { "name": "interop::protocols::GRAPHQL", "kind": "const_item", "signature": "pub const GRAPHQL: &str;", "docs": "GraphQL API.", "attributes": "", "line": 121 }, { "name": "interop::protocols::GRPC", "kind": "const_item", "signature": "pub const GRPC: &str;", "docs": "gRPC.", "attributes": "", "line": 123 }, { "name": "interop::protocols::WEBSOCKET", "kind": "const_item", "signature": "pub const WEBSOCKET: &str;", "docs": "WebSocket.", "attributes": "", "line": 125 }, { "name": "interop::protocols::OAS_MAP", "kind": "const_item", "signature": "pub const OAS_MAP: &str;", "docs": "OAS MAP protocol suite.", "attributes": "", "line": 127 }, { "name": "interop::auth_methods", "kind": "module", "signature": "pub mod auth_methods;", "docs": "Standard authentication methods.", "attributes": "", "line": 131 }, { "name": "interop::auth_methods::DID_AUTH", "kind": "const_item", "signature": "pub const DID_AUTH: &str;", "docs": "", "attributes": "", "line": 132 }, { "name": "interop::auth_methods::API_KEY", "kind": "const_item", "signature": "pub const API_KEY: &str;", "docs": "", "attributes": "", "line": 133 }, { "name": "interop::auth_methods::OAUTH2", "kind": "const_item", "signature": "pub const OAUTH2: &str;", "docs": "", "attributes": "", "line": 134 }, { "name": "interop::auth_methods::MTLS", "kind": "const_item", "signature": "pub const MTLS: &str;", "docs": "", "attributes": "", "line": 135 }, { "name": "interop::auth_methods::BEARER_TOKEN", "kind": "const_item", "signature": "pub const BEARER_TOKEN: &str;", "docs": "", "attributes": "", "line": 136 } ], "parseErrors": false }, { "module": "lifecycle", "source": "oas/oas/oas-document/src/lifecycle.rs", "sha256": "156e12d04f059e681b4f389c5f15b84ffc412beb105c5b495434a29c9263a0df", "attributes": "", "items": [ { "name": "lifecycle::LifecycleStatus", "kind": "enum_item", "signature": "pub enum LifecycleStatus {\n /// Entity is created but not yet operational.\n Nascent,\n /// Entity is operational and accepting interactions.\n Active,\n /// Entity is temporarily inactive but may be reactivated.\n Dormant,\n /// Entity has been suspended (e.g., for policy violation).\n Suspended,\n /// Entity has been permanently shut down.\n Terminated,\n /// Entity is preserved for historical/audit purposes.\n Archived,\n}", "docs": "The lifecycle statuses an OAS entity can be in.\n\nPer OAS Specification \u00a75.3, the valid lifecycle statuses are:\n`nascent`, `active`, `dormant`, `suspended`, `terminated`, `archived`.\n\n# Examples\n\n```\nuse oas_document::lifecycle::LifecycleStatus;\nuse std::str::FromStr;\n\nlet status = LifecycleStatus::from_str(\"active\").unwrap();\nassert_eq!(status, LifecycleStatus::Active);\n```", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(rename_all = \"lowercase\")]", "line": 25 }, { "name": "lifecycle::LifecycleStatus::as_str", "kind": "function_item", "signature": "pub fn as_str(&self) -> &'static str;", "docs": "Returns the string representation.", "attributes": "", "line": 42 } ], "parseErrors": false }, { "module": "lineage_section", "source": "oas/oas/oas-document/src/lineage_section.rs", "sha256": "73319761726f6da22a5b6e35caf1353a6f1e0b6b947d04c8f01ffab28d892956", "attributes": "", "items": [ { "name": "lineage_section::LineageSection", "kind": "struct_item", "signature": "pub struct LineageSection {\n/// DID of the ultimate human root (HMR, MHR, or ENR).\n\npub human_root_did: String,\n/// DID of the entity that directly created this entity.\n\npub creator_did: String,\n/// Number of derivation steps from human root.\n\n/// 0 = created directly by human root.\n\npub generation: u32,\n/// AgentLineageProof2025 linking this entity to its creator.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub derivation_proof: Option,\n/// Ordered array of DIDs from this entity to human root.\n\npub human_root_chain: Vec,\n/// Optional Merkle inclusion proof binding this entity to the\n\n/// `OrgLineageRoot` of its creator (an MHR / ENR org). REQUIRED at\n\n/// resolution time when the GAL has an `OrgLineageRoot` for the\n\n/// creator DID. Verification uses BLAKE3; see\n\n/// [`OrgInclusionProof`].\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub org_inclusion_proof: Option,\n/// References to on-chain or transparency-log anchors attesting to\n\n/// this lineage section's registration.\n\n///\n\n/// Lineage authority is backend-agnostic (see [`AnchorRef`]). An\n\n/// entity MAY be anchored on multiple backends at once - Sigil and an\n\n/// EAS attestation and a transparency log - and verifiers consult the\n\n/// refs for the schemes they trust. A verifier MUST ignore refs whose\n\n/// `scheme` it does not support rather than rejecting the document:\n\n/// unknown schemes are additive, never breaking.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub anchor_refs: Option>\n}", "docs": "The lineage section of an OAS Identity Document.\n\nContains the cryptographic chain linking an entity to its human root.\nRequired for L1+ conformance on non-root entities.\n\nSee OAS Specification \u00a78 for the complete structure.\n\n# Examples\n\n```\nuse oas_document::lineage_section::LineageSection;\n\nlet lineage = LineageSection {\n human_root_did: \"did:oas:acme:hmr:alice\".to_string(),\n creator_did: \"did:oas:acme:hmr:alice\".to_string(),\n generation: 0,\n derivation_proof: None,\n human_root_chain: vec![\n \"did:oas:acme:ao:research\".to_string(),\n \"did:oas:acme:hmr:alice\".to_string(),\n ],\n org_inclusion_proof: None,\n anchor_refs: None,\n};\nassert_eq!(lineage.generation, 0);\n```", "attributes": "#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 35 }, { "name": "lineage_section::AnchorRef", "kind": "struct_item", "signature": "pub struct AnchorRef {\n/// The anchor scheme: `sigil`, `eas`, `ctlog`, or a future registered\n\n/// name. Verifiers ignore schemes they do not support.\n\npub scheme: String,\n/// Scheme-specific locator: a transaction hash (`sigil`), an\n\n/// attestation UID (`eas`), a log identifier and leaf index (`ctlog`).\n\n/// Opaque to verifiers that do not implement the scheme.\n\npub locator: String,\n/// Optional inclusion proof binding the locator to the anchor\n\n/// backend's canonical root. Presence semantics are scheme-specific;\n\n/// some schemes (EAS) are self-proving and carry none, others (batch\n\n/// Merkle anchoring) require one.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub inclusion_proof: Option\n}", "docs": "A reference to an on-chain (or transparency-log) anchor attesting to a\nlineage registration.\n\nLineage *proofs* verify offline; lineage *authority* - proof that the\nclaimed root exists, that this delegation was recorded, and that\nnothing in the chain is revoked or superseded - is what an anchor\nbackend supplies. The scheme names the backend; the locator addresses\nthe record within it.", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 84 }, { "name": "lineage_section::AnchorRef::to_uri", "kind": "function_item", "signature": "pub fn to_uri(&self) -> String;", "docs": "The display form: `anchor::`.", "attributes": "", "line": 104 }, { "name": "lineage_section::AnchorRef::parse_uri", "kind": "function_item", "signature": "pub fn parse_uri(uri: &str) -> Option;", "docs": "Parse the display form back into a ref (without a proof).\n\nThe locator may itself contain colons (e.g. `ctlog` log-id:index\nforms), so parsing splits at the first two colons only.", "attributes": "", "line": 112 }, { "name": "lineage_section::AnchorInclusionProof", "kind": "struct_item", "signature": "pub struct AnchorInclusionProof {\n/// The proof family: `merkle-blake3`, `eas-attestation`, or a future\n\n/// registered name. Verifiers ignore types they do not support.\n\npub proof_type: String,\n/// The root this proof binds to (hex digest or backend-native form).\n\npub root: String,\n/// The leaf the anchored registration hashes to.\n\npub leaf_hash: String,\n/// Ordered sibling path from leaf to root (Merkle-family proofs).\n\n/// Empty for self-proving schemes.\n\n#[serde(default)]\npub path: Vec\n}", "docs": "An inclusion proof binding an [`AnchorRef`] locator to its backend's\ncanonical root.\n\nThe shape is the Merkle family generalization used by\n[`OrgInclusionProof`], named by `proof_type` so a backend can register\nothers: `merkle-blake3` (Sigil, transparency logs), `eas-attestation`\n(EAS, where the attestation itself is the proof and `root` is the\nschema UID), or future registered types.", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 136 }, { "name": "lineage_section::MerkleDirection", "kind": "enum_item", "signature": "pub enum MerkleDirection {\n /// Sibling is on the left; reconstructed hash combines as\n /// `H(sibling || current)`.\n Left,\n /// Sibling is on the right; reconstructed hash combines as\n /// `H(current || sibling)`.\n Right,\n}", "docs": "Direction of a sibling node in a Merkle proof path.", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 156 }, { "name": "lineage_section::MerkleProofNode", "kind": "struct_item", "signature": "pub struct MerkleProofNode {\n/// `blake3:`-prefixed hex of the sibling hash at this level.\n\npub sibling_hash: String,\n/// Direction of the sibling relative to the current node.\n\npub direction: MerkleDirection\n}", "docs": "One step in a Merkle inclusion proof path.", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 168 }, { "name": "lineage_section::OrgInclusionProof", "kind": "struct_item", "signature": "pub struct OrgInclusionProof {\n/// `blake3:`-prefixed hex of the org's Merkle root. MUST equal the\n\n/// on-chain `OrgLineageRoot.merkle_root`.\n\npub merkle_root: String,\n/// `blake3:`-prefixed hex of the leaf \u2014 `BLAKE3(child_did)`.\n\npub leaf_hash: String,\n/// Ordered path of sibling hashes from leaf to root.\n\npub path: Vec\n}", "docs": "Merkle inclusion proof binding a child entity to an\n`OrgLineageRoot`.\n\nCanonicalization rules (verified by `oas-resolve::sigil_guard` with\nthe BLAKE3-32 hash function):\n\n1. **Leaf hash:** `blake3:` + hex(BLAKE3(child_did_utf8_bytes)).\n The org commits to a tree of child DIDs.\n2. **Internal nodes:** at each level, combine the running hash and\n the sibling per `direction`. `Left` \u2192 `H(sibling || current)`;\n `Right` \u2192 `H(current || sibling)`. Both halves are taken as raw\n 32-byte BLAKE3 outputs (after stripping the `blake3:` prefix).\n3. **Root match:** the final reconstructed root MUST equal both\n `proof.merkle_root` and the `merkle_root` of the\n `OrgLineageRoot` returned by the GAL for the creator DID.", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 192 } ], "parseErrors": false }, { "module": "operational", "source": "oas/oas/oas-document/src/operational.rs", "sha256": "a0a03270339a7b9f4dbbeac3a800654edb63b530e9aafa6f9b92e160ea913360", "attributes": "", "items": [ { "name": "operational::SlaCommitment", "kind": "struct_item", "signature": "pub struct SlaCommitment {\n/// Metric name: `\"response_time_p95\"`, `\"uptime\"`, `\"throughput\"`.\n\npub metric: String,\n/// Target value: `\"<500ms\"`, `\"99.9%\"`, `\"1000 req/min\"`.\n\npub target: String\n}", "docs": "An SLA commitment for a specific metric.\n\n# Examples\n\n```\nuse oas_document::operational::SlaCommitment;\n\nlet sla = SlaCommitment {\n metric: \"response_time_p95\".to_string(),\n target: \"<500ms\".to_string(),\n};\n```", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 25 }, { "name": "operational::RateLimit", "kind": "struct_item", "signature": "pub struct RateLimit {\n/// What is being limited: `\"requests\"`, `\"tokens\"`, `\"bytes\"`.\n\npub resource: String,\n/// Numeric limit value.\n\npub limit: u64,\n/// Time window: `\"second\"`, `\"minute\"`, `\"hour\"`, `\"day\"`.\n\npub window: String\n}", "docs": "A rate limit specification.\n\n# Examples\n\n```\nuse oas_document::operational::RateLimit;\n\nlet limit = RateLimit {\n resource: \"requests\".to_string(),\n limit: 1000,\n window: \"minute\".to_string(),\n};\n```", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 48 }, { "name": "operational::OperationalSection", "kind": "struct_item", "signature": "pub struct OperationalSection {\n/// Availability mode: `\"24/7\"`, `\"business_hours\"`, `\"on_demand\"`, `\"scheduled\"`.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub availability: Option,\n/// SLA commitments.\n\n#[serde(default, skip_serializing_if = \"Vec::is_empty\")]\npub sla: Vec,\n/// Rate limits.\n\n#[serde(default, skip_serializing_if = \"Vec::is_empty\")]\npub rate_limits: Vec,\n/// Accepted input MIME types (e.g., `\"application/json\"`, `\"text/plain\"`).\n\n#[serde(default, skip_serializing_if = \"Vec::is_empty\")]\npub supported_input_formats: Vec,\n/// Produced output MIME types.\n\n#[serde(default, skip_serializing_if = \"Vec::is_empty\")]\npub supported_output_formats: Vec,\n/// Maximum request payload size in bytes.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub max_payload_bytes: Option,\n/// Maximum context window in tokens (for LLM-backed agents).\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub max_context_tokens: Option,\n/// Scheduled maintenance windows when the entity is unavailable.\n\n#[serde(default, skip_serializing_if = \"Vec::is_empty\")]\npub maintenance_windows: Vec\n}", "docs": "Operational specification section of an OAS Identity Document.\n\n# Examples\n\n```\nuse oas_document::operational::{OperationalSection, SlaCommitment, RateLimit};\n\nlet ops = OperationalSection {\n availability: Some(\"24/7\".to_string()),\n sla: vec![SlaCommitment {\n metric: \"uptime\".to_string(),\n target: \"99.9%\".to_string(),\n }],\n rate_limits: vec![RateLimit {\n resource: \"requests\".to_string(),\n limit: 1000,\n window: \"minute\".to_string(),\n }],\n supported_input_formats: vec![\"application/json\".to_string()],\n supported_output_formats: vec![\"application/json\".to_string()],\n max_payload_bytes: Some(10_485_760),\n max_context_tokens: None,\n maintenance_windows: vec![],\n};\nassert_eq!(ops.sla.len(), 1);\n```", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 87 } ], "parseErrors": false }, { "module": "pricing", "source": "oas/oas/oas-document/src/pricing.rs", "sha256": "68ede0b953a50b00885b05e0bd4340215873db18de5ed95786652bca372aba9f", "attributes": "", "items": [ { "name": "pricing::CostEntry", "kind": "struct_item", "signature": "pub struct CostEntry {\n/// What is being priced: `\"request\"`, `\"token\"`, `\"minute\"`,\n\n/// `\"task\"`, `\"subscription_monthly\"`.\n\npub unit: String,\n/// Amount as a decimal string (to avoid floating-point issues).\n\npub amount: String,\n/// ISO 4217 currency code (e.g., `\"USD\"`, `\"EUR\"`, `\"BTC\"`, `\"ETH\"`).\n\npub currency: String\n}", "docs": "A cost entry describing pricing for a specific unit of work.\n\n# Examples\n\n```\nuse oas_document::pricing::CostEntry;\n\nlet cost = CostEntry {\n unit: \"request\".to_string(),\n amount: \"0.001\".to_string(),\n currency: \"USD\".to_string(),\n};\n```", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 26 }, { "name": "pricing::PricingSection", "kind": "struct_item", "signature": "pub struct PricingSection {\n/// Pricing model: `\"free\"`, `\"per_request\"`, `\"per_token\"`,\n\n/// `\"subscription\"`, `\"negotiated\"`, `\"custom\"`.\n\npub model: String,\n/// Individual cost entries.\n\n#[serde(default, skip_serializing_if = \"Vec::is_empty\")]\npub costs: Vec,\n/// Currencies accepted (ISO 4217 or crypto ticker).\n\n#[serde(default, skip_serializing_if = \"Vec::is_empty\")]\npub currencies_accepted: Vec,\n/// Billing/payment endpoint URL.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub billing_endpoint: Option,\n/// Free tier description (e.g., \"100 requests/day\", \"1000 tokens/month\").\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub free_tier_limits: Option,\n/// Visibility of billing details.\n\n#[serde(default)]\npub billing_visibility: Visibility\n}", "docs": "Pricing and economics section of an OAS Identity Document.\n\n# Examples\n\n```\nuse oas_document::pricing::{PricingSection, CostEntry};\nuse oas_document::visibility::Visibility;\n\nlet pricing = PricingSection {\n model: \"per_request\".to_string(),\n costs: vec![CostEntry {\n unit: \"request\".to_string(),\n amount: \"0.001\".to_string(),\n currency: \"USD\".to_string(),\n }],\n currencies_accepted: vec![\"USD\".to_string(), \"ETH\".to_string()],\n billing_endpoint: Some(\"https://api.acme.com/billing\".to_string()),\n free_tier_limits: Some(\"100 requests/day\".to_string()),\n billing_visibility: Visibility::Authenticated,\n};\nassert_eq!(pricing.model, \"per_request\");\n```", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 62 }, { "name": "pricing::models", "kind": "module", "signature": "pub mod models;", "docs": "Standard pricing models.", "attributes": "", "line": 89 }, { "name": "pricing::models::FREE", "kind": "const_item", "signature": "pub const FREE: &str;", "docs": "", "attributes": "", "line": 90 }, { "name": "pricing::models::PER_REQUEST", "kind": "const_item", "signature": "pub const PER_REQUEST: &str;", "docs": "", "attributes": "", "line": 91 }, { "name": "pricing::models::PER_TOKEN", "kind": "const_item", "signature": "pub const PER_TOKEN: &str;", "docs": "", "attributes": "", "line": 92 }, { "name": "pricing::models::SUBSCRIPTION", "kind": "const_item", "signature": "pub const SUBSCRIPTION: &str;", "docs": "", "attributes": "", "line": 93 }, { "name": "pricing::models::NEGOTIATED", "kind": "const_item", "signature": "pub const NEGOTIATED: &str;", "docs": "", "attributes": "", "line": 94 }, { "name": "pricing::models::CUSTOM", "kind": "const_item", "signature": "pub const CUSTOM: &str;", "docs": "", "attributes": "", "line": 95 } ], "parseErrors": false }, { "module": "profile", "source": "oas/oas/oas-document/src/profile.rs", "sha256": "13d72c9dd8b98eb3ac9d1e010d03e26d64eea745cdc4dad9bf1e11334fbfaf6d", "attributes": "", "items": [ { "name": "profile::ProfileSection", "kind": "struct_item", "signature": "pub struct ProfileSection {\n/// URL to the entity's avatar image.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub avatar_url: Option,\n/// URL to the entity's banner/header image.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub banner_url: Option,\n/// Short tagline or bio (max 280 chars, like a tweet).\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub tagline: Option,\n/// Category tags for discovery (e.g., \"finance\", \"customer-support\", \"research\").\n\n#[serde(default, skip_serializing_if = \"Vec::is_empty\")]\npub categories: Vec,\n/// Supported languages as ISO 639-1 codes (e.g., \"en\", \"es\", \"zh\").\n\n#[serde(default, skip_serializing_if = \"Vec::is_empty\")]\npub languages: Vec,\n/// IANA timezone identifier (e.g., \"America/New_York\", \"UTC\").\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub timezone: Option,\n/// Accent/brand color as hex (e.g., \"#3B82F6\").\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub accent_color: Option\n}", "docs": "Profile section of an OAS Identity Document.\n\nProvides human-readable presentation data for the entity.\nAll fields are optional \u2014 entities expose only what they choose to.\n\n# Examples\n\n```\nuse oas_document::profile::ProfileSection;\n\nlet profile = ProfileSection {\n avatar_url: Some(\"https://cdn.example.com/agent-42/avatar.png\".to_string()),\n banner_url: None,\n tagline: Some(\"AI-powered financial analysis agent\".to_string()),\n categories: vec![\"finance\".to_string(), \"analytics\".to_string()],\n languages: vec![\"en\".to_string(), \"es\".to_string()],\n timezone: Some(\"America/New_York\".to_string()),\n accent_color: Some(\"#3B82F6\".to_string()),\n};\nassert_eq!(profile.languages.len(), 2);\n```", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 32 } ], "parseErrors": false }, { "module": "proof_format", "source": "oas/oas/oas-document/src/proof_format.rs", "sha256": "ef0aa12184d48759fd268ee0af6899f0b746a90969c8a0d9867cbd3f69777835", "attributes": "", "items": [ { "name": "proof_format::DOCUMENT_PROOF_TYPE", "kind": "const_item", "signature": "pub const DOCUMENT_PROOF_TYPE: &str;", "docs": "The fixed proof type for OAS document proofs.", "attributes": "", "line": 16 }, { "name": "proof_format::DocumentProof", "kind": "struct_item", "signature": "pub struct DocumentProof {\n/// Fixed: `\"Ed25519Signature2020\"`\n\n#[serde(rename = \"type\")]\npub proof_type: String,\n/// ISO 8601 timestamp of when the proof was created.\n\npub created: String,\n/// Reference to the verification method used (e.g., `did:oas:ns:hmr:a#key-1`).\n\npub verification_method: String,\n/// The purpose of this proof (e.g., `\"assertionMethod\"`).\n\npub proof_purpose: String,\n/// The multibase-encoded Ed25519 signature (base58btc with `z` prefix).\n\npub proof_value: String\n}", "docs": "An Ed25519Signature2020 document proof.\n\nSee OAS Specification \u00a75.5 for the complete format.", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 23 }, { "name": "proof_format::DocumentProof::generate", "kind": "function_item", "signature": "pub fn generate(\n document_json: &serde_json::Value,\n keypair: &OasKeyPair,\n verification_method_id: &str,\n created: &str,\n ) -> Result;", "docs": "Generates a document proof by signing the canonical document bytes.\n\nImplements OAS Specification \u00a75.5:\n1. Canonicalize the document (without proof) via JCS\n2. Sign the canonical bytes with the signing key\n3. Encode as multibase base58btc\n\n# Arguments\n\n* `document_json` - The document as a JSON value (proof field MUST be absent/null).\n* `keypair` - The signing keypair.\n* `verification_method_id` - Full ID of the verification method (e.g., `did:oas:ns:hmr:a#key-1`).\n* `created` - ISO 8601 timestamp for the proof.\n\n# Returns\n\nA [`DocumentProof`] containing the signature.\n\n# Errors\n\nReturns [`DocumentError::ProofGenerationFailed`] if canonicalization or signing fails.", "attributes": "", "line": 63 }, { "name": "proof_format::DocumentProof::verify", "kind": "function_item", "signature": "pub fn verify(\n &self,\n document_json: &serde_json::Value,\n public_key_bytes: &[u8],\n ) -> Result<(), DocumentError>;", "docs": "Verifies this document proof against the canonical document bytes.\n\nImplements OAS Specification \u00a75.5 verification:\n1. Canonicalize the document (without proof) via JCS\n2. Decode the proof value from multibase\n3. Verify the Ed25519 signature\n\n# Arguments\n\n* `document_json` - The document as a JSON value (proof field MUST be absent/null).\n* `public_key_bytes` - The 32-byte Ed25519 public key.\n\n# Returns\n\n`Ok(())` if the proof is valid.\n\n# Errors\n\nReturns [`DocumentError::ProofVerificationFailed`] if verification fails.", "attributes": "", "line": 106 } ], "parseErrors": false }, { "module": "relationships", "source": "oas/oas/oas-document/src/relationships.rs", "sha256": "1f1695557c49d5b9ef6d901b860b2b3d27a4d6036ba1b039a349ccdebd4e9b80", "attributes": "", "items": [ { "name": "relationships::Affiliation", "kind": "struct_item", "signature": "pub struct Affiliation {\n/// DID of the related entity.\n\npub did: String,\n/// Relationship type: `\"member\"`, `\"partner\"`, `\"subsidiary\"`,\n\n/// `\"affiliate\"`, `\"delegate\"`, `\"advisor\"`.\n\npub relationship: String,\n/// Human-readable label for this affiliation.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub label: Option\n}", "docs": "A relationship to another OAS entity.\n\n# Examples\n\n```\nuse oas_document::relationships::Affiliation;\n\nlet aff = Affiliation {\n did: \"did:oas:prod:ao:research-team\".to_string(),\n relationship: \"member\".to_string(),\n label: Some(\"Research Team\".to_string()),\n};\n```", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 26 }, { "name": "relationships::RelationshipsSection", "kind": "struct_item", "signature": "pub struct RelationshipsSection {\n/// DID of the parent organization (ENR or AO).\n\n/// Distinct from lineage `creator_did` \u2014 this is an organizational\n\n/// relationship, not a derivation chain link.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub parent_organization: Option,\n/// Voluntary affiliations (teams, partnerships, memberships).\n\n#[serde(default, skip_serializing_if = \"Vec::is_empty\")]\npub affiliations: Vec,\n/// DIDs that this entity refuses to interact with.\n\n/// Stored as public assertions to enable pre-flight checks.\n\n#[serde(default, skip_serializing_if = \"Vec::is_empty\")]\npub blocked_dids: Vec\n}", "docs": "Relationships and affiliations section of an OAS Identity Document.\n\n# Examples\n\n```\nuse oas_document::relationships::{RelationshipsSection, Affiliation};\n\nlet rels = RelationshipsSection {\n parent_organization: Some(\"did:oas:prod:enr:acme-corp\".to_string()),\n affiliations: vec![\n Affiliation {\n did: \"did:oas:prod:ao:ai-lab\".to_string(),\n relationship: \"member\".to_string(),\n label: Some(\"AI Research Lab\".to_string()),\n },\n ],\n blocked_dids: vec![],\n};\nassert!(rels.parent_organization.is_some());\n```", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 61 }, { "name": "relationships::relationship_types", "kind": "module", "signature": "pub mod relationship_types;", "docs": "Standard relationship types.", "attributes": "", "line": 79 }, { "name": "relationships::relationship_types::MEMBER", "kind": "const_item", "signature": "pub const MEMBER: &str;", "docs": "", "attributes": "", "line": 80 }, { "name": "relationships::relationship_types::PARTNER", "kind": "const_item", "signature": "pub const PARTNER: &str;", "docs": "", "attributes": "", "line": 81 }, { "name": "relationships::relationship_types::SUBSIDIARY", "kind": "const_item", "signature": "pub const SUBSIDIARY: &str;", "docs": "", "attributes": "", "line": 82 }, { "name": "relationships::relationship_types::AFFILIATE", "kind": "const_item", "signature": "pub const AFFILIATE: &str;", "docs": "", "attributes": "", "line": 83 }, { "name": "relationships::relationship_types::DELEGATE", "kind": "const_item", "signature": "pub const DELEGATE: &str;", "docs": "", "attributes": "", "line": 84 }, { "name": "relationships::relationship_types::ADVISOR", "kind": "const_item", "signature": "pub const ADVISOR: &str;", "docs": "", "attributes": "", "line": 85 } ], "parseErrors": false }, { "module": "reputation", "source": "oas/oas/oas-document/src/reputation.rs", "sha256": "a4eb12f6b2a4ff47180ef92822356d9383db9b2b419c08e85b89af9bdfac8902", "attributes": "", "items": [ { "name": "reputation::ReputationSection", "kind": "struct_item", "signature": "pub struct ReputationSection {\n/// Total number of interactions/requests served.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub total_interactions: Option,\n/// Number of endorsements received from other DIDs.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub endorsement_count: Option,\n/// Aggregated trust score as a decimal string (0.0\u20131.0).\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub trust_score: Option,\n/// Uptime percentage over the last 30 days.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub uptime_30d: Option,\n/// Uptime percentage over the last 90 days.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub uptime_90d: Option,\n/// ISO 8601 timestamp of when this entity first became active.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub first_active: Option,\n/// DIDs of entities that have endorsed this entity.\n\n#[serde(default, skip_serializing_if = \"Vec::is_empty\")]\npub endorser_dids: Vec\n}", "docs": "Reputation summary section of an OAS Identity Document.\n\n# Trust Model\n\n- L0/L1: Self-reported \u2014 treat as claims, not facts.\n- L2: Backed by third-party attestation service, verifiable\n via `OASAttestationService` endpoint.\n\n# Examples\n\n```\nuse oas_document::reputation::ReputationSection;\n\nlet rep = ReputationSection {\n total_interactions: Some(15_420),\n endorsement_count: Some(87),\n trust_score: Some(\"0.94\".to_string()),\n uptime_30d: Some(\"99.7%\".to_string()),\n uptime_90d: Some(\"99.5%\".to_string()),\n first_active: Some(\"2026-01-15T00:00:00Z\".to_string()),\n endorser_dids: vec![\n \"did:oas:prod:hmr:alice\".to_string(),\n \"did:oas:prod:enr:acme\".to_string(),\n ],\n};\nassert_eq!(rep.endorsement_count, Some(87));\n```", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 40 } ], "parseErrors": false }, { "module": "service", "source": "oas/oas/oas-document/src/service.rs", "sha256": "f130b2274ff01d645d8f04f7f31b2b0f4a775c72e9a7c195077c8286c7c616da", "attributes": "", "items": [ { "name": "service::ServiceEndpoint", "kind": "struct_item", "signature": "pub struct ServiceEndpoint {\n/// The service ID (e.g., `did:oas:ns:agent:bot#service-1`).\n\npub id: String,\n/// The service type.\n\n#[serde(rename = \"type\")]\npub service_type: String,\n/// The service endpoint URI.\n\npub service_endpoint: String,\n/// Human-readable label for this service.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub label: Option,\n/// Human-readable description of what this service does.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub description: Option,\n/// Arbitrary key-value properties for this service.\n\n/// Useful for protocol-specific metadata (e.g., API version, auth scheme).\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub properties: Option>\n}", "docs": "A service endpoint in an OAS Identity Document.\n\nSee OAS Specification \u00a75.6 for standard service types.\n\n# Examples\n\n```\nuse oas_document::service::ServiceEndpoint;\n\nlet svc = ServiceEndpoint {\n id: \"did:oas:ns:agent:bot#api\".to_string(),\n service_type: \"OASEntity\".to_string(),\n service_endpoint: \"https://example.com/bot\".to_string(),\n label: Some(\"Primary API\".to_string()),\n description: Some(\"Main agent interaction endpoint\".to_string()),\n properties: None,\n};\n```", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 28 }, { "name": "service::service_types", "kind": "module", "signature": "pub mod service_types;", "docs": "Standard service types defined by OAS Specification \u00a75.6.", "attributes": "", "line": 54 }, { "name": "service::service_types::OAS_ENTITY", "kind": "const_item", "signature": "pub const OAS_ENTITY: &str;", "docs": "Primary entity interaction endpoint.", "attributes": "", "line": 56 }, { "name": "service::service_types::OAS_COMMUNICATION", "kind": "const_item", "signature": "pub const OAS_COMMUNICATION: &str;", "docs": "Communication / messaging endpoint.", "attributes": "", "line": 58 }, { "name": "service::service_types::OAS_LINEAGE_QUERY", "kind": "const_item", "signature": "pub const OAS_LINEAGE_QUERY: &str;", "docs": "Lineage chain query service.", "attributes": "", "line": 60 }, { "name": "service::service_types::OAS_ATTESTATION", "kind": "const_item", "signature": "pub const OAS_ATTESTATION: &str;", "docs": "Third-party attestation service.", "attributes": "", "line": 62 }, { "name": "service::service_types::OAS_REVOCATION_STATUS", "kind": "const_item", "signature": "pub const OAS_REVOCATION_STATUS: &str;", "docs": "Revocation status check endpoint.", "attributes": "", "line": 64 }, { "name": "service::service_types::OAS_CAPABILITY_INVOCATION", "kind": "const_item", "signature": "pub const OAS_CAPABILITY_INVOCATION: &str;", "docs": "Capability invocation endpoint.", "attributes": "", "line": 66 }, { "name": "service::service_types::OAS_GOVERNANCE", "kind": "const_item", "signature": "pub const OAS_GOVERNANCE: &str;", "docs": "Governance operations endpoint.", "attributes": "", "line": 68 }, { "name": "service::service_types::OAS_PRIVATE_ENDPOINT", "kind": "const_item", "signature": "pub const OAS_PRIVATE_ENDPOINT: &str;", "docs": "Authenticated endpoint for resolving visibility-restricted fields.\nAgents query this service with DID-Auth to retrieve fields that are\nredacted in the public DHT document.", "attributes": "", "line": 72 } ], "parseErrors": false }, { "module": "verification_method", "source": "oas/oas/oas-document/src/verification_method.rs", "sha256": "453af7775498ea48130015c72defb829d538d8060ed6ccf301b5f4c5f60a4b2d", "attributes": "", "items": [ { "name": "verification_method::VERIFICATION_METHOD_TYPE", "kind": "const_item", "signature": "pub const VERIFICATION_METHOD_TYPE: &str;", "docs": "The fixed verification method type per OAS Specification \u00a75.1.", "attributes": "", "line": 7 }, { "name": "verification_method::VerificationMethod", "kind": "struct_item", "signature": "pub struct VerificationMethod {\n/// The full key ID (e.g., `did:oas:acme:hmr:alice#key-1`).\n\npub id: String,\n/// The verification method type. MUST be `Ed25519VerificationKey2020`.\n\n#[serde(rename = \"type\")]\npub method_type: String,\n/// The DID that controls this key.\n\npub controller: String,\n/// The public key encoded as multibase base58btc (with `z` prefix).\n\npub public_key_multibase: String\n}", "docs": "An Ed25519 verification method as defined in OAS Identity Documents.\n\nSee OAS Specification \u00a75.1 for the complete structure.\n\n# Examples\n\n```\nuse oas_document::verification_method::VerificationMethod;\n\nlet vm = VerificationMethod {\n id: \"did:oas:acme:hmr:alice#key-1\".to_string(),\n method_type: \"Ed25519VerificationKey2020\".to_string(),\n controller: \"did:oas:acme:hmr:alice\".to_string(),\n public_key_multibase: \"z6Mktest123\".to_string(),\n};\nassert_eq!(vm.key_id(), \"key-1\");\n```", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 28 }, { "name": "verification_method::VerificationMethod::key_id", "kind": "function_item", "signature": "pub fn key_id(&self) -> &str;", "docs": "Extracts the key fragment (the part after `#`) from the ID.\n\n# Returns\n\nThe key fragment, or the full ID if no `#` is present.\n\n# Examples\n\n```\nuse oas_document::verification_method::VerificationMethod;\n\nlet vm = VerificationMethod {\n id: \"did:oas:ns:hmr:a#key-1\".to_string(),\n method_type: \"Ed25519VerificationKey2020\".to_string(),\n controller: \"did:oas:ns:hmr:a\".to_string(),\n public_key_multibase: \"zTest\".to_string(),\n};\nassert_eq!(vm.key_id(), \"key-1\");\n```", "attributes": "", "line": 63 }, { "name": "verification_method::VerificationMethod::new", "kind": "function_item", "signature": "pub fn new(did: &str, key_num: u32, public_key_multibase: &str) -> Self;", "docs": "Creates a new verification method for an OAS entity.\n\n# Arguments\n\n* `did` - The entity's DID string.\n* `key_num` - The key number (used to form the fragment, e.g., `key-1`).\n* `public_key_multibase` - The multibase-encoded public key.", "attributes": "", "line": 77 } ], "parseErrors": false }, { "module": "visibility", "source": "oas/oas/oas-document/src/visibility.rs", "sha256": "d9380fe685f75a2d877377b171f261d8860a59f297a08483543107168c13c059", "attributes": "", "items": [ { "name": "visibility::Visibility", "kind": "enum_item", "signature": "pub enum Visibility {\n /// Visible to anyone resolving the DID. Full value stored on DHT.\n #[default]\n Public,\n\n /// Visible to any agent that can prove identity via DID-Auth.\n /// DHT stores only a capability flag; actual value served via\n /// authenticated endpoint.\n Authenticated,\n\n /// Visible only to members of the same Autonomous Organization or\n /// Entity Name Record (verified via lineage chain).\n /// DHT stores only a capability flag.\n Organization,\n\n /// Visible only to the entity itself. Never stored on the DHT.\n Private,\n}", "docs": "Visibility level for access-controlled fields.\n\nControls who can read a field's actual value versus seeing only a\ncapability advertisement (e.g., \"this agent has a calendar\" without\nrevealing the booking URL).\n\n# Examples\n\n```\nuse oas_document::visibility::Visibility;\n\nlet vis = Visibility::Organization;\nassert_eq!(vis.as_str(), \"organization\");\nassert!(!vis.is_public());\n```", "attributes": "#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(rename_all = \"lowercase\")]", "line": 40 }, { "name": "visibility::Visibility::as_str", "kind": "function_item", "signature": "pub fn as_str(&self) -> &'static str;", "docs": "Returns the string representation.", "attributes": "", "line": 61 }, { "name": "visibility::Visibility::is_public", "kind": "function_item", "signature": "pub fn is_public(&self) -> bool;", "docs": "Returns `true` if this field should be fully visible on the public DHT.", "attributes": "", "line": 71 }, { "name": "visibility::Visibility::is_redacted_on_dht", "kind": "function_item", "signature": "pub fn is_redacted_on_dht(&self) -> bool;", "docs": "Returns `true` if this field should be redacted (capability flag only)\nor hidden entirely in the DHT-stored copy.", "attributes": "", "line": 77 } ], "parseErrors": false } ] }, { "name": "oas-lineage", "url": "/reference/rust/oas-lineage", "modules": [ { "module": "crate", "source": "oas/oas/oas-lineage/src/lib.rs", "sha256": "b334f1b452eb9c64f265f349c4a530fa82ee13b20bb2827ca7476fc7e3e07177", "attributes": "", "items": [ { "name": "config", "kind": "module", "signature": "pub mod config;", "docs": "# oas-lineage\n\nAgent lineage verification for the Open Agent Specification (OAS).\n\nThis crate implements the lineage verification algorithm from\nOAS Specification \u00a78 and Appendix C, including full cryptographic\nchain walking, structural validation, and child entity derivation.\n\n## Key Types\n\n- [`verify_lineage`](verify::verify_lineage) \u2014 Full cryptographic chain verification\n- [`derive_child_entity`](derive::derive_child_entity) \u2014 Create child entities with lineage\n- [`DocumentProvider`](provider::DocumentProvider) \u2014 Trait for document resolution\n- [`InMemoryProvider`](provider::InMemoryProvider) \u2014 In-memory provider for testing\n- [`VerifyConfig`](config::VerifyConfig) \u2014 Verification configuration\n- [`VerifyResult`](verify::VerifyResult) \u2014 Verification result with warnings\n\n## Example: Verify a lineage chain\n\n```\nuse oas_lineage::verify::verify_lineage;\nuse oas_lineage::config::{TrustAnchor, VerifyConfig};\nuse oas_lineage::provider::InMemoryProvider;\nuse oas_document::builder::DocumentBuilder;\nuse oas_document::conformance::ConformanceLevel;\nuse oas_crypto::keypair::OasKeyPair;\n\n// Root entities require an explicit verifier-controlled trust anchor.\nlet keypair = OasKeyPair::generate();\nlet root = DocumentBuilder::new(\"did:oas:test:hmr:alice\", \"hmr\")\n .conformance_level(ConformanceLevel::L1)\n .add_verification_method(&keypair)\n .build_and_sign(&keypair, \"2026-01-15T00:00:00Z\")\n .unwrap();\n\nlet provider = InMemoryProvider::new();\nlet anchor = TrustAnchor::new(\n &root.id,\n format!(\"{}#key-1\", root.id),\n keypair.public_key_multibase(),\n).with_document_digest(root.canonical_digest().unwrap());\nlet config = VerifyConfig::new().with_trust_anchor(anchor);\nlet result = verify_lineage(&root, &provider, &config).unwrap();\nassert_eq!(result.chain_length, 1);\n```\n\n## Example: Derive a child entity\n\n```\nuse oas_lineage::derive::derive_child_entity;\nuse oas_document::builder::DocumentBuilder;\nuse oas_document::conformance::ConformanceLevel;\nuse oas_crypto::keypair::OasKeyPair;\n\nlet root_keypair = OasKeyPair::generate();\nlet root_doc = DocumentBuilder::new(\"did:oas:test:hmr:alice\", \"hmr\")\n .conformance_level(ConformanceLevel::L1)\n .add_verification_method(&root_keypair)\n .build_and_sign(&root_keypair, \"2026-01-15T00:00:00Z\")\n .unwrap();\n\nlet child = derive_child_entity(\n &root_keypair,\n &root_doc,\n \"did:oas:test:agent:bot\",\n \"/agent-bot\",\n).unwrap();\n\nassert_eq!(child.lineage.generation, 1);\nassert_eq!(child.lineage.human_root_did, \"did:oas:test:hmr:alice\");\n```", "attributes": "", "line": 73 }, { "name": "derive", "kind": "module", "signature": "pub mod derive;", "docs": "", "attributes": "", "line": 74 }, { "name": "error", "kind": "module", "signature": "pub mod error;", "docs": "", "attributes": "", "line": 75 }, { "name": "provider", "kind": "module", "signature": "pub mod provider;", "docs": "", "attributes": "", "line": 76 }, { "name": "verify", "kind": "module", "signature": "pub mod verify;", "docs": "", "attributes": "", "line": 77 }, { "name": "pub use error::LineageError;", "kind": "use_declaration", "signature": "pub use error::LineageError;", "docs": "", "attributes": "", "line": 79 } ], "parseErrors": false }, { "module": "config", "source": "oas/oas/oas-lineage/src/config.rs", "sha256": "0e27fd221acf46d7e641769308ca22fc9b2863914e9bfc81b9f6010168eb6044", "attributes": "", "items": [ { "name": "config::TrustAnchor", "kind": "struct_item", "signature": "pub struct TrustAnchor {\n/// Root DID authorized by this anchor.\n\npub did: String,\n/// Authorized verification method on the root document.\n\npub verification_method: String,\n/// Authorized Ed25519 public key in multibase format.\n\npub public_key_multibase: String,\n/// Optional commitment to the exact trusted root document state.\n\npub document_digest: Option\n}", "docs": "A verifier-controlled trust anchor for an OAS root document.\n\nTrust anchors are local policy inputs. They are never inferred from the\ndocument or proof being verified.", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\", deny_unknown_fields)]", "line": 17 }, { "name": "config::TrustAnchor::new", "kind": "function_item", "signature": "pub fn new(\n did: impl Into,\n verification_method: impl Into,\n public_key_multibase: impl Into,\n ) -> Self;", "docs": "Creates a key-pinned trust anchor.", "attributes": "", "line": 30 }, { "name": "config::TrustAnchor::with_document_digest", "kind": "function_item", "signature": "pub fn with_document_digest(mut self, digest: impl Into) -> Self;", "docs": "Pins this anchor to an exact canonical root document digest.", "attributes": "#[must_use]", "line": 45 }, { "name": "config::VerifyConfig", "kind": "struct_item", "signature": "pub struct VerifyConfig {\n/// Maximum generation depth allowed.\n\n///\n\n/// Per OAS Spec \u00a78.3 rule 6: RECOMMENDED default is 16.\n\n/// Entities exceeding this depth MAY be rejected.\n\npub max_generation: u32,\n/// Per-hop resolution timeout.\n\n///\n\n/// Per OAS Spec \u00a78.3 rule 7: RECOMMENDED 5 seconds.\n\n/// Applied to each parent document resolution individually.\n\npub per_hop_timeout: Duration,\n/// Total timeout for the entire chain verification.\n\n///\n\n/// Per OAS Spec \u00a78.3 rule 7: RECOMMENDED 30 seconds.\n\n/// If the total elapsed time exceeds this, verification\n\n/// reports `unverifiable` (not `invalid`).\n\npub total_timeout: Duration,\n/// Whether to verify document signatures for each parent.\n\n///\n\n/// Defaults to `true`. Set to `false` only when parent documents\n\n/// have already been verified by the resolver.\n\npub verify_document_signatures: bool,\n/// Verifier-controlled root trust anchors.\n\npub trust_anchors: Vec\n}", "docs": "Configuration for the lineage verification algorithm.\n\nAll values have sensible defaults from the OAS Specification \u00a78.3.\n\n# Examples\n\n```\nuse oas_lineage::config::VerifyConfig;\n\n// Use defaults from the specification\nlet config = VerifyConfig::default();\nassert_eq!(config.max_generation, 16);\n\n// Or customize\nlet config = VerifyConfig::new()\n .with_max_generation(8)\n .with_total_timeout(std::time::Duration::from_secs(15));\nassert_eq!(config.max_generation, 8);\n```", "attributes": "#[derive(Debug, Clone)]", "line": 71 }, { "name": "config::VerifyConfig::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Creates a new `VerifyConfig` with default values.\n\nEquivalent to [`VerifyConfig::default()`].", "attributes": "", "line": 123 }, { "name": "config::VerifyConfig::with_max_generation", "kind": "function_item", "signature": "pub fn with_max_generation(mut self, depth: u32) -> Self;", "docs": "Sets the maximum generation depth.\n\n# Arguments\n\n* `depth` - Maximum number of derivation steps from human root.", "attributes": "", "line": 132 }, { "name": "config::VerifyConfig::with_per_hop_timeout", "kind": "function_item", "signature": "pub fn with_per_hop_timeout(mut self, timeout: Duration) -> Self;", "docs": "Sets the per-hop resolution timeout.\n\n# Arguments\n\n* `timeout` - Duration to wait for each parent resolution.", "attributes": "", "line": 142 }, { "name": "config::VerifyConfig::with_total_timeout", "kind": "function_item", "signature": "pub fn with_total_timeout(mut self, timeout: Duration) -> Self;", "docs": "Sets the total verification timeout.\n\n# Arguments\n\n* `timeout` - Maximum duration for the entire chain verification.", "attributes": "", "line": 152 }, { "name": "config::VerifyConfig::with_verify_signatures", "kind": "function_item", "signature": "pub fn with_verify_signatures(mut self, verify: bool) -> Self;", "docs": "Sets whether to verify document signatures at each hop.\n\n# Arguments\n\n* `verify` - `true` to verify signatures (default), `false` to skip.", "attributes": "", "line": 162 }, { "name": "config::VerifyConfig::with_trust_anchor", "kind": "function_item", "signature": "pub fn with_trust_anchor(mut self, anchor: TrustAnchor) -> Self;", "docs": "Adds a verifier-controlled root trust anchor.", "attributes": "#[must_use]", "line": 169 } ], "parseErrors": false }, { "module": "derive", "source": "oas/oas/oas-lineage/src/derive.rs", "sha256": "e61d3a231537dc09a8c22676cfd438afe2420195531b1246f80e567becd443db", "attributes": "", "items": [ { "name": "derive::DerivedChild", "kind": "struct_item", "signature": "pub struct DerivedChild {\n/// The derived Ed25519 keypair for the child entity.\n\npub keypair: OasKeyPair,\n/// The lineage section to include in the child's identity document.\n\npub lineage: LineageSection\n}", "docs": "The result of deriving a child entity.\n\nContains the child's Ed25519 keypair and a complete [`LineageSection`]\nready to be included in the child's identity document.\n\n# Examples\n\n```\nuse oas_lineage::derive::DerivedChild;\n\n// DerivedChild is returned by derive_child_entity()\n// It contains the child keypair and lineage section.\n```", "attributes": "#[derive(Debug)]", "line": 31 }, { "name": "derive::derive_child_entity", "kind": "function_item", "signature": "pub fn derive_child_entity(\n parent_keypair: &OasKeyPair,\n parent_doc: &OasDocument,\n child_did: &str,\n derivation_path: &str,\n) -> Result;", "docs": "Derives a new child entity from a parent, producing a keypair and lineage.\n\nPerforms the complete child entity derivation workflow per OAS Spec \u00a79:\n\n1. Derives a child Ed25519 keypair using HKDF-SHA256 (\u00a79.3).\n2. Generates an AgentLineageProof2025 (\u00a79.4).\n3. Constructs a complete [`LineageSection`] with the correct\n `humanRootDid`, `creatorDid`, `generation`, and `humanRootChain`.\n\n# Arguments\n\n* `parent_keypair` - The parent entity's keypair (used for signing the proof\n and as HKDF input for key derivation).\n* `parent_doc` - The parent entity's identity document (used to extract\n the parent's DID and lineage information).\n* `child_did` - The DID for the new child entity.\n* `derivation_path` - The HKDF derivation path (e.g., `\"/agent-bot-42\"`).\n\n# Returns\n\nA [`DerivedChild`] containing the derived keypair and lineage section.\n\n# Errors\n\nReturns [`LineageError`] if:\n- The parent is a non-root entity without lineage\n ([`LineageError::MissingLineage`]).\n- Key derivation fails ([`LineageError::Crypto`]).\n- Proof generation fails ([`LineageError::Crypto`]).\n\n# Examples\n\n```\nuse oas_lineage::derive::derive_child_entity;\nuse oas_document::builder::DocumentBuilder;\nuse oas_document::conformance::ConformanceLevel;\nuse oas_crypto::keypair::OasKeyPair;\n\nlet root_keypair = OasKeyPair::generate();\nlet root_doc = DocumentBuilder::new(\"did:oas:test:hmr:alice\", \"hmr\")\n .conformance_level(ConformanceLevel::L1)\n .add_verification_method(&root_keypair)\n .build_and_sign(&root_keypair, \"2026-01-15T00:00:00Z\")\n .unwrap();\n\nlet child = derive_child_entity(\n &root_keypair,\n &root_doc,\n \"did:oas:test:agent:bot\",\n \"/agent-bot\",\n).unwrap();\n\nassert_eq!(child.lineage.human_root_did, \"did:oas:test:hmr:alice\");\nassert_eq!(child.lineage.generation, 1);\n```", "attributes": "", "line": 94 } ], "parseErrors": false }, { "module": "error", "source": "oas/oas/oas-lineage/src/error.rs", "sha256": "8a965b2b82baa8cd43ce1599aafeb2dcb9bf6367f4698d2fa3c6d018ba0c8025", "attributes": "", "items": [ { "name": "error::LineageError", "kind": "enum_item", "signature": "pub enum LineageError {\n /// A non-root entity is missing its required lineage section.\n ///\n /// Per OAS Spec \u00a78.3 rule 1, every non-root entity MUST have lineage.\n #[error(\"non-root entity missing required lineage section (DID: {did})\")]\n MissingLineage {\n /// The DID of the entity missing lineage.\n did: String,\n },\n\n /// The `humanRootChain` array is empty.\n #[error(\"human root chain is empty for entity {did}\")]\n EmptyChain {\n /// The DID of the entity with an empty chain.\n did: String,\n },\n\n /// The lineage chain does not terminate at an HMR, MHR, or ENR entity.\n ///\n /// Per OAS Spec \u00a78.3 rule 2.\n #[error(\"chain does not terminate at human root: last DID is '{last_did}'; expected kind 'hmr', 'mhr', or 'enr'\")]\n ChainNotTerminatingAtRoot {\n /// The last DID in the chain (which should be an HMR, MHR, or ENR).\n last_did: String,\n },\n\n /// The generation field does not match `humanRootChain.len() - 1`.\n ///\n /// Per OAS Spec \u00a78.3 rule 3.\n #[error(\"generation {generation} does not match chain length minus one ({expected})\")]\n GenerationMismatch {\n /// The declared generation value.\n generation: u32,\n /// The expected value (`humanRootChain.len() - 1`).\n expected: usize,\n },\n\n /// The lineage chain exceeds the configured maximum generation depth.\n ///\n /// Per OAS Spec \u00a78.3 rule 6.\n #[error(\"generation depth {depth} exceeds maximum allowed depth {max_depth}\")]\n ChainTooDeep {\n /// The actual generation depth.\n depth: u32,\n /// The configured maximum.\n max_depth: u32,\n },\n\n /// A parent document could not be resolved during chain verification.\n ///\n /// Per OAS Spec Appendix C, step 6.\n #[error(\"cannot resolve parent document '{parent_did}': {reason}\")]\n ResolutionFailed {\n /// The parent DID that failed to resolve.\n parent_did: String,\n /// The reason resolution failed.\n reason: String,\n },\n\n /// A parent entity in the chain has been revoked.\n ///\n /// Per OAS Spec \u00a78.3 rule 5 (revocation cascades).\n #[error(\"parent entity is revoked: {parent_did}\")]\n ParentRevoked {\n /// The revoked parent DID.\n parent_did: String,\n },\n\n /// A parent document's signature is invalid.\n #[error(\"parent document signature invalid for '{parent_did}': {reason}\")]\n ParentSignatureInvalid {\n /// The parent DID with the invalid signature.\n parent_did: String,\n /// Details of the signature failure.\n reason: String,\n },\n\n /// The terminal root is not authorized by verifier-controlled policy.\n #[error(\"root '{root_did}' is not trusted by verifier policy: {reason}\")]\n UntrustedRoot {\n /// The untrusted root DID.\n root_did: String,\n /// Details of the trust-anchor failure.\n reason: String,\n },\n\n /// A document is revoked.\n #[error(\"document is revoked: {did}\")]\n DocumentRevoked {\n /// DID of the revoked document.\n did: String,\n },\n\n /// A document is outside its configured validity window.\n #[error(\"document is not currently valid: {did}\")]\n DocumentInactive {\n /// DID of the inactive document.\n did: String,\n },\n\n /// The derivation proof type is not `AgentLineageProof2025`.\n #[error(\"unknown proof type '{found}'; expected 'AgentLineageProof2025'\")]\n UnknownProofType {\n /// The unexpected proof type.\n found: String,\n },\n\n /// The proof's `parentDid` does not match the expected parent in the chain.\n #[error(\"proof parent DID mismatch: proof contains '{proof_parent}' but chain expects '{chain_parent}'\")]\n ProofParentMismatch {\n /// The parentDid from the proof.\n proof_parent: String,\n /// The expected parent from the chain.\n chain_parent: String,\n },\n\n /// The proof's `childDid` does not match the expected child in the chain.\n #[error(\"proof child DID mismatch: proof contains '{proof_child}' but chain expects '{chain_child}'\")]\n ProofChildMismatch {\n /// The childDid from the proof.\n proof_child: String,\n /// The expected child from the chain.\n chain_child: String,\n },\n\n /// The Ed25519 signature on a lineage proof is invalid.\n #[error(\"lineage proof signature invalid at generation {generation}: {reason}\")]\n ProofSignatureInvalid {\n /// The generation index where verification failed.\n generation: usize,\n /// Details of the signature failure.\n reason: String,\n },\n\n /// A legacy proof omits mandatory signed security bindings.\n #[error(\"legacy lineage proof is non-authorizing: {reason}\")]\n LegacyInsecureProof {\n /// The missing or insecure legacy binding.\n reason: String,\n },\n\n /// The proof algorithm is not supported by the strict verifier.\n #[error(\"unsupported lineage proof algorithm '{found}'\")]\n UnsupportedProofAlgorithm {\n /// The unsupported algorithm.\n found: String,\n },\n\n /// The canonicalization profile is not supported by the strict verifier.\n #[error(\"unsupported lineage canonicalization profile '{found}'\")]\n UnsupportedCanonicalization {\n /// The unsupported canonicalization profile.\n found: String,\n },\n\n /// The proof purpose is not supported by the strict verifier.\n #[error(\"unsupported lineage proof purpose '{found}'\")]\n UnsupportedProofPurpose {\n /// The unsupported proof purpose.\n found: String,\n },\n\n /// A lineage proof key is not the referenced authorized parent key.\n #[error(\n \"lineage proof key does not match parent document '{parent_did}' method '{verification_method}'\"\n )]\n ParentKeyMismatch {\n /// The parent DID.\n parent_did: String,\n /// Verification method referenced by the proof.\n verification_method: String,\n },\n\n /// A lineage proof does not bind the child's verification key.\n #[error(\n \"lineage proof child key does not match child document '{child_did}' method '{verification_method}'\"\n )]\n ChildKeyMismatch {\n /// The child DID.\n child_did: String,\n /// Verification method referenced by the proof.\n verification_method: String,\n },\n\n /// A lineage proof does not bind the resolved parent document state.\n #[error(\"lineage proof parent document binding mismatch for '{parent_did}': {reason}\")]\n ParentDocumentMismatch {\n /// The parent DID.\n parent_did: String,\n /// Details of the mismatch.\n reason: String,\n },\n\n /// A verification method is not authorized for lineage delegation.\n #[error(\n \"verification method '{verification_method}' is not authorized for lineage delegation by '{parent_did}'\"\n )]\n InvalidKeyPurpose {\n /// The parent DID.\n parent_did: String,\n /// Verification method lacking the required relationship.\n verification_method: String,\n },\n\n /// The declared lineage contains a repeated DID.\n #[error(\"lineage chain contains a cycle at '{did}'\")]\n ChainCycle {\n /// The repeated DID.\n did: String,\n },\n\n /// Resolved lineage metadata does not continue the declared chain.\n #[error(\"lineage chain continuity failed at '{did}': {reason}\")]\n ChainContinuity {\n /// DID at which continuity failed.\n did: String,\n /// Details of the discontinuity.\n reason: String,\n },\n\n /// The total timeout for lineage verification was exceeded.\n ///\n /// Per OAS Spec \u00a78.3 rule 7.\n #[error(\"lineage verification total timeout exceeded after {elapsed_secs:.1}s (limit: {limit_secs}s)\")]\n TotalTimeout {\n /// Elapsed time in seconds.\n elapsed_secs: f64,\n /// Configured limit in seconds.\n limit_secs: f64,\n },\n\n /// A non-root entity's lineage section is missing its derivation proof.\n #[error(\"derivation proof is missing for entity '{did}'\")]\n MissingDerivationProof {\n /// The DID of the entity without a proof.\n did: String,\n },\n\n /// The parent's public key referenced by the proof was not found in\n /// the parent's verification methods.\n #[error(\"parent public key not found in parent document '{parent_did}'\")]\n ParentKeyNotFound {\n /// The parent DID.\n parent_did: String,\n },\n\n /// An underlying cryptographic error occurred.\n #[error(\"cryptographic error: {0}\")]\n Crypto(#[from] oas_crypto::CryptoError),\n}", "docs": "Errors that can occur during lineage verification and chain operations.\n\nEach variant contains enough context to diagnose the problem,\nincluding DIDs, generation depths, and specific reasons for failure.\n\nSee OAS Specification \u00a78 and Appendix C for the verification algorithm.", "attributes": "#[derive(Debug, Error)]", "line": 16 } ], "parseErrors": false }, { "module": "provider", "source": "oas/oas/oas-lineage/src/provider.rs", "sha256": "c2b7bc7746cab041982221c20a525f6718b4728f1dfd142041c8fc51d0c81678", "attributes": "", "items": [ { "name": "provider::DocumentProvider", "kind": "trait_item", "signature": "pub trait DocumentProvider {\n /// Resolves a `did:oas` identifier to its identity document.\n ///\n /// # Arguments\n ///\n /// * `did` - The `did:oas` identifier to resolve.\n ///\n /// # Returns\n ///\n /// The resolved [`OasDocument`], or a [`LineageError::ResolutionFailed`]\n /// if the document cannot be found or resolution fails.\n ///\n /// # Errors\n ///\n /// Returns [`LineageError::ResolutionFailed`] if the DID cannot be resolved.\n fn resolve(&self, did: &str) -> Result;\n}", "docs": "A provider that resolves `did:oas` identifiers to [`OasDocument`]s.\n\nThis trait is the bridge between lineage verification and document\nresolution. The verification algorithm calls `resolve()` for each\nparent in the lineage chain.\n\n# Implementation Notes\n\n- Implementations SHOULD enforce per-hop timeouts internally.\n- Implementations SHOULD cache resolved documents to avoid redundant lookups.\n- Implementations MUST return the most recent valid document for a DID.\n\n# Examples\n\n```\nuse oas_lineage::provider::{DocumentProvider, InMemoryProvider};\nuse oas_document::OasDocument;\n\nlet provider = InMemoryProvider::new();\n// Empty provider returns an error for any DID\nassert!(provider.resolve(\"did:oas:test:hmr:alice\").is_err());\n```", "attributes": "", "line": 38 }, { "name": "provider::InMemoryProvider", "kind": "struct_item", "signature": "pub struct InMemoryProvider {\n\n}", "docs": "An in-memory document provider for testing and development.\n\nStores documents in a [`HashMap`] keyed by DID string.\nUseful for unit tests that need to verify lineage chains\nwithout network access.\n\n# Examples\n\n```\nuse oas_lineage::provider::InMemoryProvider;\nuse oas_lineage::provider::DocumentProvider;\n\nlet mut provider = InMemoryProvider::new();\n// Register documents, then use for lineage verification\nassert_eq!(provider.len(), 0);\n```", "attributes": "#[derive(Debug, Clone, Default)]", "line": 73 }, { "name": "provider::InMemoryProvider::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Creates an empty in-memory provider.", "attributes": "", "line": 79 }, { "name": "provider::InMemoryProvider::register", "kind": "function_item", "signature": "pub fn register(&mut self, doc: OasDocument);", "docs": "Registers a document in the provider.\n\nThe document is stored under its `id` field.\n\n# Arguments\n\n* `doc` - The document to register.", "attributes": "", "line": 92 }, { "name": "provider::InMemoryProvider::len", "kind": "function_item", "signature": "pub fn len(&self) -> usize;", "docs": "Returns the number of registered documents.", "attributes": "", "line": 97 }, { "name": "provider::InMemoryProvider::is_empty", "kind": "function_item", "signature": "pub fn is_empty(&self) -> bool;", "docs": "Returns true if no documents are registered.", "attributes": "", "line": 102 } ], "parseErrors": false }, { "module": "verify", "source": "oas/oas/oas-lineage/src/verify.rs", "sha256": "fbe78af078f918131bde6fc1b752e4e451afd41b832f518fb5ac9c8d2b819b26", "attributes": "", "items": [ { "name": "verify::VerifyResult", "kind": "struct_item", "signature": "pub struct VerifyResult {\n/// The total length of the verified chain (including the entity itself).\n\npub chain_length: usize,\n/// The DID of the human root at the end of the chain.\n\npub human_root_did: String,\n/// Non-fatal warnings encountered during verification.\n\n///\n\n/// Examples: expired liveness attestations.\n\npub warnings: Vec\n}", "docs": "The result of a successful lineage verification.\n\nContains metadata about the verification process and any warnings\nthat were encountered (e.g., expired liveness attestations).\n\n# Examples\n\n```\nuse oas_lineage::verify::VerifyResult;\n\nlet result = VerifyResult {\n chain_length: 3,\n human_root_did: \"did:oas:test:hmr:alice\".to_string(),\n warnings: vec![],\n};\nassert!(result.is_clean());\n```", "attributes": "#[derive(Debug, Clone)]", "line": 49 }, { "name": "verify::VerifyResult::is_clean", "kind": "function_item", "signature": "pub fn is_clean(&self) -> bool;", "docs": "Returns `true` if no warnings were raised.", "attributes": "", "line": 64 }, { "name": "verify::verify_lineage", "kind": "function_item", "signature": "pub fn verify_lineage(\n document: &OasDocument,\n provider: &dyn DocumentProvider,\n config: &VerifyConfig,\n) -> Result;", "docs": "Verifies the complete lineage chain of an OAS Identity Document.\n\nImplements the normative verification algorithm from OAS Spec Appendix C:\n\n1. Root entities (HMR, MHR, or ENR) must match verifier trust anchors.\n2. Verifies the lineage section exists for non-root entities.\n3. Verifies the chain terminates at an HMR, MHR, or ENR.\n4. Verifies generation matches chain length minus one.\n5. Enforces maximum generation depth.\n6. Walks the chain, verifying each AgentLineageProof2025 signature\n against the resolved parent document's public key.\n7. Optionally checks human root liveness.\n\n# Arguments\n\n* `document` - The document whose lineage to verify.\n* `provider` - A [`DocumentProvider`] for resolving parent documents.\n* `config` - Configuration (timeouts, max depth).\n\n# Returns\n\nA [`VerifyResult`] on success, containing chain metadata and any warnings.\n\n# Errors\n\nReturns [`LineageError`] if any step of the verification fails.\nSee the individual error variants for specific failure modes.\n\n# Examples\n\n```\nuse oas_lineage::verify::verify_lineage;\nuse oas_lineage::config::{TrustAnchor, VerifyConfig};\nuse oas_lineage::provider::InMemoryProvider;\nuse oas_document::builder::DocumentBuilder;\nuse oas_document::conformance::ConformanceLevel;\nuse oas_crypto::keypair::OasKeyPair;\n\nlet keypair = OasKeyPair::generate();\nlet root = DocumentBuilder::new(\"did:oas:test:hmr:alice\", \"hmr\")\n .conformance_level(ConformanceLevel::L1)\n .add_verification_method(&keypair)\n .build_and_sign(&keypair, \"2026-01-15T00:00:00Z\")\n .unwrap();\n\nlet provider = InMemoryProvider::new();\nlet anchor = TrustAnchor::new(\n &root.id,\n format!(\"{}#key-1\", root.id),\n keypair.public_key_multibase(),\n).with_document_digest(root.canonical_digest().unwrap());\nlet config = VerifyConfig::new().with_trust_anchor(anchor);\nlet result = verify_lineage(&root, &provider, &config);\nassert!(result.is_ok());\n```", "attributes": "", "line": 124 } ], "parseErrors": false } ] }, { "name": "oas-resolve", "url": "/reference/rust/oas-resolve", "modules": [ { "module": "crate", "source": "oas/oas/oas-resolve/src/lib.rs", "sha256": "cbec0de8bef5896f07fe96d25b680e99d01f120a9c7e9463ecb1a6655996d0d2", "attributes": "", "items": [ { "name": "anchored", "kind": "module", "signature": "pub mod anchored;", "docs": "# oas-resolve\n\nDID resolution for the Open Agent Specification (OAS).\n\nThis crate provides the [`Resolver`](resolver::Resolver) trait and several\nimplementations for resolving `did:oas` identifiers to OAS Identity Documents.\n\n## Key Types\n\n- [`Resolver`](resolver::Resolver) \u2014 The core async resolution trait\n- [`InMemoryResolver`](memory::InMemoryResolver) \u2014 In-memory resolver for testing\n- [`CachingResolver`](cache::CachingResolver) \u2014 TTL-based caching wrapper\n- [`FallbackResolver`](fallback::FallbackResolver) \u2014 Priority-ordered fallback chain\n- [`ResolveError`] \u2014 Resolution errors with OAS \u00a712.5 error codes\n- [`ResolutionMetadata`](metadata::ResolutionMetadata) \u2014 Resolution process metadata\n\n## Design\n\nPer OAS Specification \u00a712, resolution is defined as an abstract protocol.\nThis crate provides the trait and utility implementations. Concrete backends\n(DHT, HTTP, blockchain) implement the [`Resolver`](resolver::Resolver) trait.\n\n## Example\n\n```\nuse oas_resolve::resolver::Resolver;\nuse oas_resolve::memory::InMemoryResolver;\nuse oas_document::builder::DocumentBuilder;\nuse oas_document::conformance::ConformanceLevel;\nuse oas_crypto::keypair::OasKeyPair;\n\n# tokio_test::block_on(async {\nlet keypair = OasKeyPair::generate();\nlet doc = DocumentBuilder::new(\"did:oas:test:hmr:alice\", \"hmr\")\n .conformance_level(ConformanceLevel::L1)\n .add_verification_method(&keypair)\n .build_and_sign(&keypair, \"2026-01-15T00:00:00Z\")\n .unwrap();\n\nlet resolver = InMemoryResolver::new();\nresolver.register(doc);\n\nlet resolved = resolver.resolve(\"did:oas:test:hmr:alice\").await.unwrap();\nassert_eq!(resolved.id, \"did:oas:test:hmr:alice\");\n# });\n```", "attributes": "", "line": 48 }, { "name": "cache", "kind": "module", "signature": "pub mod cache;", "docs": "", "attributes": "", "line": 49 }, { "name": "error", "kind": "module", "signature": "pub mod error;", "docs": "", "attributes": "", "line": 50 }, { "name": "fallback", "kind": "module", "signature": "pub mod fallback;", "docs": "", "attributes": "", "line": 51 }, { "name": "memory", "kind": "module", "signature": "pub mod memory;", "docs": "", "attributes": "", "line": 52 }, { "name": "metadata", "kind": "module", "signature": "pub mod metadata;", "docs": "", "attributes": "", "line": 53 }, { "name": "resolver", "kind": "module", "signature": "pub mod resolver;", "docs": "", "attributes": "", "line": 54 }, { "name": "pub use anchored::{\n document_metadata_commitment, org_leaf_hash, AnchorError, AnchorRecord, AnchorStatus,\n AnchoredResolver, LineageAnchor, MemoryAnchor, OrgLineageRoot,\n};", "kind": "use_declaration", "signature": "pub use anchored::{\n document_metadata_commitment, org_leaf_hash, AnchorError, AnchorRecord, AnchorStatus,\n AnchoredResolver, LineageAnchor, MemoryAnchor, OrgLineageRoot,\n};", "docs": "", "attributes": "", "line": 56 }, { "name": "pub use error::ResolveError;", "kind": "use_declaration", "signature": "pub use error::ResolveError;", "docs": "", "attributes": "", "line": 60 }, { "name": "pub use anchored::{\n AnchorError as GalSourceError, AnchorRecord as GalRootAnchor,\n AnchorStatus as GalRevocationStatus, AnchoredResolver as SigilGuardedResolver,\n LineageAnchor as SigilGalSource, MemoryAnchor as MemoryGalSource,\n OrgLineageRoot as GalOrgLineageRoot,\n};", "kind": "use_declaration", "signature": "pub use anchored::{\n AnchorError as GalSourceError, AnchorRecord as GalRootAnchor,\n AnchorStatus as GalRevocationStatus, AnchoredResolver as SigilGuardedResolver,\n LineageAnchor as SigilGalSource, MemoryAnchor as MemoryGalSource,\n OrgLineageRoot as GalOrgLineageRoot,\n};", "docs": "", "attributes": "", "line": 65 } ], "parseErrors": false }, { "module": "anchored", "source": "oas/oas/oas-resolve/src/anchored.rs", "sha256": "fa71502f19c501a71ac700d39ae94217811409ce35453a6b070dc94041069170", "attributes": "", "items": [ { "name": "anchored::AnchorRecord", "kind": "struct_item", "signature": "pub struct AnchorRecord {\n/// Subject DID this anchor is bound to.\n\npub did: String,\n/// Lifecycle status reported by the GAL: `\"active\"`, `\"rotating\"`,\n\n/// `\"revoked\"`. Anything other than `\"active\"` is rejected.\n\npub status: String,\n/// Block height at which this anchor version was published. Must be\n\n/// less than or equal to the GAL's current finalized block.\n\npub anchored_at_block: u64,\n/// BLAKE3 commitment to the canonical off-chain DID document.\n\npub metadata_commitment: String\n}", "docs": "Minimal canonical view of a GAL root anchor (HMR / MHR / ENR).", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"snake_case\")]", "line": 87 }, { "name": "anchored::AnchorStatus", "kind": "struct_item", "signature": "pub struct AnchorStatus {\npub revoked: bool,\n/// Optional human-readable reason commitment.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub reason_commitment: Option\n}", "docs": "Result of a `check_revocation` call. Resolvers MUST call this first.", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]", "line": 102 }, { "name": "anchored::OrgLineageRoot", "kind": "struct_item", "signature": "pub struct OrgLineageRoot {\n/// Org DID (typically MHR or ENR).\n\npub org_did: String,\n/// `blake3:`-prefixed hex of the on-chain Merkle root.\n\npub merkle_root: String,\n/// On-chain status: `\"active\"` / `\"rotating\"` / `\"revoked\"`.\n\npub status: String,\n/// Block height at which this version of the root was published.\n\npub anchored_at_block: u64\n}", "docs": "Minimal canonical view of a GAL `OrgLineageRoot`. Only the fields the\nguard needs for inclusion verification are surfaced.", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"snake_case\")]", "line": 113 }, { "name": "anchored::AnchorError", "kind": "enum_item", "signature": "pub enum AnchorError {\n /// Underlying transport / RPC failure.\n #[error(\"anchor transport error: {0}\")]\n Transport(String),\n /// Backend returned a structurally invalid record.\n #[error(\"invalid anchor record: {0}\")]\n InvalidRecord(String),\n}", "docs": "Errors returned by a `LineageAnchor`. Mapped into `ResolveError`\nvariants by [`AnchoredResolver`].", "attributes": "#[derive(Debug, thiserror::Error)]", "line": 127 }, { "name": "anchored::LineageAnchor", "kind": "trait_item", "signature": "pub trait LineageAnchor: Send + Sync {\n /// Revocation-first check. Returns `revoked: true` for subjects with\n /// any cascade kind (single, cascade-root, cascade-org).\n async fn check_revocation(&self, did: &str) -> Result;\n\n /// Fetch the typed HMR anchor for a DID, or `None` if absent.\n async fn get_hmr(&self, did: &str) -> Result, AnchorError>;\n\n /// Fetch the typed MHR anchor for a DID, or `None` if absent.\n async fn get_mhr(&self, did: &str) -> Result, AnchorError>;\n\n /// Fetch the typed ENR anchor for a DID, or `None` if absent.\n async fn get_enr(&self, did: &str) -> Result, AnchorError>;\n\n /// Fetch the typed `OrgLineageRoot` for an org DID, or `None` if\n /// the GAL has no Merkle commitment for that DID.\n ///\n /// Default impl returns `None` \u2014 implementations that want to\n /// participate in Rule 7 (org Merkle inclusion) override this.\n async fn get_org_root(&self, _org_did: &str) -> Result, AnchorError> ;\n\n /// Current finalized block height. The guard uses this to reject\n /// anchors whose `anchored_at_block` lies in the future.\n async fn current_finalized_block(&self) -> Result;\n}", "docs": "Read-only view of the Sigil GAL needed by the verification guard.\n\nThis is intentionally a **subset** of `mars-protocol::SigilAnchorClient` \u2014\nresolvers do not need to submit anchors. A production adapter that\nwraps `mars-protocol::SigilAnchorClient` lives in `sigil-sdk`.", "attributes": "#[async_trait]", "line": 142 }, { "name": "anchored::MemoryAnchor", "kind": "struct_item", "signature": "pub struct MemoryAnchor {\n\n}", "docs": "In-memory `LineageAnchor` for tests. Deterministic, no I/O.", "attributes": "", "line": 171 }, { "name": "anchored::MemoryAnchor::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Empty source with `current_finalized_block = 0`.", "attributes": "", "line": 193 }, { "name": "anchored::MemoryAnchor::set_block", "kind": "function_item", "signature": "pub fn set_block(&self, block: u64);", "docs": "Set the current finalized block height.", "attributes": "", "line": 200 }, { "name": "anchored::MemoryAnchor::insert_hmr", "kind": "function_item", "signature": "pub fn insert_hmr(&self, anchor: AnchorRecord);", "docs": "Pre-populate an HMR anchor.", "attributes": "", "line": 207 }, { "name": "anchored::MemoryAnchor::insert_mhr", "kind": "function_item", "signature": "pub fn insert_mhr(&self, anchor: AnchorRecord);", "docs": "Pre-populate an MHR anchor.", "attributes": "", "line": 214 }, { "name": "anchored::MemoryAnchor::insert_enr", "kind": "function_item", "signature": "pub fn insert_enr(&self, anchor: AnchorRecord);", "docs": "Pre-populate an ENR anchor.", "attributes": "", "line": 221 }, { "name": "anchored::MemoryAnchor::insert_revocation", "kind": "function_item", "signature": "pub fn insert_revocation(&self, did: &str, reason: Option<&str>);", "docs": "Mark a DID as revoked.", "attributes": "", "line": 228 }, { "name": "anchored::MemoryAnchor::insert_org_root", "kind": "function_item", "signature": "pub fn insert_org_root(&self, root: OrgLineageRoot);", "docs": "Pre-populate an `OrgLineageRoot` (Rule 7 inclusion verification).", "attributes": "", "line": 241 }, { "name": "anchored::AnchoredResolver", "kind": "struct_item", "signature": "pub struct AnchoredResolver\nwhere\n R: Resolver,\n G: LineageAnchor, {\n\n}", "docs": "Wraps any inner [`Resolver`] with a [`LineageAnchor`] backend and\nenforces the GAL verification rules on every resolution.", "attributes": "", "line": 308 }, { "name": "anchored::AnchoredResolver::new", "kind": "function_item", "signature": "pub fn new(inner: R, anchor: G) -> Self;", "docs": "Build a guard around an inner resolver and GAL backend.", "attributes": "", "line": 323 }, { "name": "anchored::document_metadata_commitment", "kind": "function_item", "signature": "pub fn document_metadata_commitment(doc: &OasDocument) -> Result;", "docs": "Compute the BLAKE3 hex digest of a DID document's canonical JSON\n(RFC 8785 / JCS). This is the value committed to by GAL anchors.", "attributes": "", "line": 330 }, { "name": "anchored::org_leaf_hash", "kind": "function_item", "signature": "pub fn org_leaf_hash(child_did: &str) -> String;", "docs": "BLAKE3 of the canonical org leaf \u2014 `BLAKE3(child_did_utf8_bytes)`.\nExposed so test fixtures and indexers can compute the same value.", "attributes": "", "line": 729 } ], "parseErrors": false }, { "module": "cache", "source": "oas/oas/oas-resolve/src/cache.rs", "sha256": "58ff23aa2ef2f94c0540dfb51cb76895d205c58b67009f25fbce5a14356d75d1", "attributes": "", "items": [ { "name": "cache::CachingResolver", "kind": "struct_item", "signature": "pub struct CachingResolver {\n\n}", "docs": "A caching wrapper around any [`Resolver`].\n\nStores resolved documents in memory with a configurable TTL.\nExpired entries are lazily evicted on the next access.\n\n# Examples\n\n```\nuse oas_resolve::cache::CachingResolver;\nuse oas_resolve::memory::InMemoryResolver;\nuse std::time::Duration;\n\nlet inner = InMemoryResolver::new();\nlet caching = CachingResolver::new(inner, Duration::from_secs(300));\n```", "attributes": "", "line": 39 }, { "name": "cache::CachingResolver::new", "kind": "function_item", "signature": "pub fn new(inner: R, ttl: Duration) -> Self;", "docs": "Creates a new caching resolver.\n\n# Arguments\n\n* `inner` - The underlying resolver to wrap.\n* `ttl` - How long to cache resolved documents.", "attributes": "", "line": 52 }, { "name": "cache::CachingResolver::invalidate", "kind": "function_item", "signature": "pub fn invalidate(&self, did: &str);", "docs": "Invalidates a specific cached entry.\n\n# Arguments\n\n* `did` - The DID to invalidate.", "attributes": "", "line": 65 }, { "name": "cache::CachingResolver::clear", "kind": "function_item", "signature": "pub fn clear(&self);", "docs": "Clears all cached entries.", "attributes": "", "line": 72 }, { "name": "cache::CachingResolver::len", "kind": "function_item", "signature": "pub fn len(&self) -> usize;", "docs": "Returns the number of entries currently in the cache (including expired).", "attributes": "", "line": 79 }, { "name": "cache::CachingResolver::is_empty", "kind": "function_item", "signature": "pub fn is_empty(&self) -> bool;", "docs": "Returns true if the cache is empty.", "attributes": "", "line": 84 } ], "parseErrors": false }, { "module": "error", "source": "oas/oas/oas-resolve/src/error.rs", "sha256": "178fa1d8a81c986f7ff475bcbd5bce7e750260bb1bd2a0c8ccdcd8a366491e40", "attributes": "", "items": [ { "name": "error::ResolveError", "kind": "enum_item", "signature": "pub enum ResolveError {\n /// DID not found in any consulted registry.\n ///\n /// Error code: `notFound`\n #[error(\"DID not found: '{did}'\")]\n NotFound {\n /// The DID that was not found.\n did: String,\n },\n\n /// Document signature does not verify.\n ///\n /// Error code: `invalidSignature`\n #[error(\"document signature invalid for '{did}': {reason}\")]\n InvalidSignature {\n /// The DID of the document with the invalid signature.\n did: String,\n /// Details about the signature failure.\n reason: String,\n },\n\n /// The DID has been revoked.\n ///\n /// Error code: `revoked`\n #[error(\"DID has been revoked: '{did}'\")]\n Revoked {\n /// The revoked DID.\n did: String,\n },\n\n /// Lineage chain verification failed.\n ///\n /// Error code: `lineageInvalid`\n #[error(\"lineage verification failed for '{did}': {reason}\")]\n LineageInvalid {\n /// The DID whose lineage is invalid.\n did: String,\n /// Details about the lineage failure.\n reason: String,\n },\n\n /// Lineage chain could not be fully verified (timeout, missing ancestor).\n ///\n /// Error code: `lineageUnverifiable`\n #[error(\"lineage unverifiable for '{did}': {reason}\")]\n LineageUnverifiable {\n /// The DID whose lineage could not be verified.\n did: String,\n /// Details about why verification failed.\n reason: String,\n },\n\n /// The human root in the lineage chain is revoked.\n ///\n /// Error code: `humanRootRevoked`\n #[error(\"human root revoked for lineage of '{did}': root DID '{root_did}'\")]\n HumanRootRevoked {\n /// The DID of the entity whose root is revoked.\n did: String,\n /// The revoked human root DID.\n root_did: String,\n },\n\n /// Human root's liveness attestation has expired.\n ///\n /// Error code: `humanRootLivenessExpired`\n #[error(\"human root liveness expired for '{did}': root DID '{root_did}'\")]\n HumanRootLivenessExpired {\n /// The DID of the entity whose root liveness expired.\n did: String,\n /// The human root DID with expired liveness.\n root_did: String,\n },\n\n /// Conflicting documents found across registries.\n ///\n /// Error code: `conflictDetected`\n #[error(\"conflicting documents detected for '{did}': {reason}\")]\n ConflictDetected {\n /// The DID with conflicting documents.\n did: String,\n /// Details about the conflict.\n reason: String,\n },\n\n /// Entity's generation exceeds resolver's MAX_GENERATION.\n ///\n /// Error code: `maxGenerationExceeded`\n #[error(\"max generation exceeded for '{did}': generation {generation} exceeds limit {max_generation}\")]\n MaxGenerationExceeded {\n /// The DID of the entity exceeding the limit.\n did: String,\n /// The entity's generation.\n generation: u32,\n /// The resolver's maximum generation.\n max_generation: u32,\n },\n\n /// A network or I/O error occurred during resolution.\n #[error(\"resolution I/O error for '{did}': {reason}\")]\n IoError {\n /// The DID being resolved.\n did: String,\n /// Details of the I/O failure.\n reason: String,\n },\n\n /// An internal resolver error.\n #[error(\"internal resolver error: {reason}\")]\n Internal {\n /// Details of the internal error.\n reason: String,\n },\n\n /// The terminal root (HMR / MHR / ENR) is not anchored on the\n /// Global Anchor Layer (Sigil), or the anchor record is in a\n /// non-active state, or its anchor block lies in the future.\n ///\n /// Error code: `notAnchored`\n #[error(\"root not anchored on Sigil for '{did}': {reason}\")]\n NotAnchored {\n /// The DID whose root could not be verified against the GAL.\n did: String,\n /// Details about why the GAL anchor was rejected.\n reason: String,\n },\n\n /// The BLAKE3 commitment recorded by the on-chain anchor does not\n /// match the canonical hash of the resolved DID document. The\n /// document is considered tampered and is rejected.\n ///\n /// Error code: `metadataMismatch`\n #[error(\"metadata commitment mismatch for '{did}': {reason}\")]\n MetadataMismatch {\n /// The DID whose document failed the commitment check.\n did: String,\n /// Details about the mismatch (expected vs actual).\n reason: String,\n },\n\n /// A non-root entity (kind not in {`hmr`, `mhr`, `enr`}) presented\n /// no lineage section. Required for L1+ documents.\n ///\n /// Error code: `missingLineage`\n #[error(\"missing lineage section for non-root '{did}'\")]\n MissingLineage {\n /// The DID whose lineage section was missing.\n did: String,\n },\n\n /// The lineage anchor backend was unreachable while resolving. The\n /// resolver fails closed: an unreachable anchor means revocation\n /// state cannot be confirmed and the resolution MUST be rejected.\n ///\n /// Error code: `galUnreachable` - retained for wire compatibility\n /// with consumers that already match on it (the backend this variant\n /// first described was Sigil's GAL). An `anchorUnreachable` alias may\n /// replace it at the next major version.\n #[error(\"lineage anchor unreachable for '{did}': {reason}\")]\n AnchorUnreachable {\n /// The DID being resolved.\n did: String,\n /// Details of the anchor transport / RPC failure.\n reason: String,\n },\n\n /// An expected on-chain org lineage Merkle inclusion proof was\n /// missing or did not verify.\n ///\n /// Error code: `orgInclusionMissing`\n #[error(\"org Merkle inclusion missing or invalid for '{did}': {reason}\")]\n OrgInclusionMissing {\n /// The DID whose org inclusion check failed.\n did: String,\n /// Details about the failure.\n reason: String,\n },\n\n /// A non-root entity has a `lineage` section but no\n /// `derivation_proof`. Required for L1+ resolution.\n ///\n /// Error code: `missingLineageProof`\n #[error(\"missing AgentLineageProof2025 derivation proof for '{did}'\")]\n MissingLineageProof {\n /// The DID whose proof is missing.\n did: String,\n },\n\n /// A legacy lineage proof omits mandatory signed security bindings.\n ///\n /// Error code: `legacyInsecureProof`\n #[error(\"legacy lineage proof is non-authorizing for '{did}': {reason}\")]\n LegacyInsecureProof {\n /// The child DID whose proof is non-authorizing.\n did: String,\n /// The missing or insecure binding.\n reason: String,\n },\n\n /// The parent's `AgentLineageProof2025` signature does not verify\n /// against the parent DID document's declared key. The child\n /// document is considered untrustworthy and is rejected.\n ///\n /// Error code: `parentSignatureInvalid`\n #[error(\"parent signature invalid for '{did}': {reason}\")]\n ParentSignatureInvalid {\n /// The child DID whose lineage proof failed verification.\n did: String,\n /// Details about the signature failure.\n reason: String,\n },\n\n /// The parent public key referenced by the lineage proof is not\n /// present in the parent DID document's `verificationMethod` list.\n /// The proof would otherwise sign correctly, but the key is\n /// orphaned \u2014 not bound to the parent's declared identity.\n ///\n /// Error code: `parentKeyNotInDocument`\n #[error(\"proof key not declared by parent '{parent_did}' for child '{did}'\")]\n ParentKeyNotInDocument {\n /// The child DID.\n did: String,\n /// The parent DID whose document was inspected.\n parent_did: String,\n },\n}", "docs": "Errors that can occur during DID resolution.\n\nEach variant corresponds to a structured error code from\nOAS Specification \u00a712.5.\n\n# Examples\n\n```\nuse oas_resolve::error::ResolveError;\n\nlet err = ResolveError::NotFound {\n did: \"did:oas:test:agent:missing\".to_string(),\n};\nassert_eq!(err.error_code(), \"notFound\");\n```", "attributes": "#[derive(Debug, Error)]", "line": 25 }, { "name": "error::ResolveError::error_code", "kind": "function_item", "signature": "pub fn error_code(&self) -> &'static str;", "docs": "Returns the OAS Spec \u00a712.5 error code string for this error.\n\n# Examples\n\n```\nuse oas_resolve::error::ResolveError;\n\nlet err = ResolveError::Revoked { did: \"did:oas:test:hmr:alice\".to_string() };\nassert_eq!(err.error_code(), \"revoked\");\n```", "attributes": "", "line": 263 } ], "parseErrors": false }, { "module": "fallback", "source": "oas/oas/oas-resolve/src/fallback.rs", "sha256": "d896098c170df028892ba94542076fc2b89085ee858d4d8fa239ee2461cb9832", "attributes": "", "items": [ { "name": "fallback::FallbackResolver", "kind": "struct_item", "signature": "pub struct FallbackResolver {\n\n}", "docs": "A resolver that tries multiple backend resolvers in priority order.\n\nPer OAS Spec \u00a712.4 (Registry priority): resolvers MAY be configured\nwith a priority-ordered list of registries.\n\n# Examples\n\n```\nuse oas_resolve::fallback::FallbackResolver;\nuse oas_resolve::memory::InMemoryResolver;\n\nlet primary = InMemoryResolver::new();\nlet secondary = InMemoryResolver::new();\nlet fallback = FallbackResolver::new(vec![\n Box::new(primary),\n Box::new(secondary),\n]);\n```", "attributes": "", "line": 31 }, { "name": "fallback::FallbackResolver::new", "kind": "function_item", "signature": "pub fn new(resolvers: Vec>) -> Self;", "docs": "Creates a new fallback resolver with the given backends.\n\nResolvers are tried in order \u2014 the first one to return\na successful result wins.\n\n# Arguments\n\n* `resolvers` - Priority-ordered list of resolvers.", "attributes": "", "line": 44 }, { "name": "fallback::FallbackResolver::resolver_count", "kind": "function_item", "signature": "pub fn resolver_count(&self) -> usize;", "docs": "Returns the number of configured backend resolvers.", "attributes": "", "line": 49 } ], "parseErrors": false }, { "module": "memory", "source": "oas/oas/oas-resolve/src/memory.rs", "sha256": "f949fec8753d0e034fc1bd52e2b9f986d0a5b941fc1d5aed7278088416db697d", "attributes": "", "items": [ { "name": "memory::InMemoryResolver", "kind": "struct_item", "signature": "pub struct InMemoryResolver {\n\n}", "docs": "An in-memory DID resolver for testing and development.\n\nStores documents in a thread-safe `HashMap`. Documents are\nregistered via [`register`](InMemoryResolver::register) and\nresolved via the [`Resolver`] trait.\n\n# Thread Safety\n\nUses `RwLock` for interior mutability, allowing concurrent reads\nwith exclusive writes.\n\n# Examples\n\n```\nuse oas_resolve::memory::InMemoryResolver;\nuse oas_resolve::resolver::Resolver;\nuse oas_document::builder::DocumentBuilder;\nuse oas_document::conformance::ConformanceLevel;\nuse oas_crypto::keypair::OasKeyPair;\n\n# tokio_test::block_on(async {\nlet keypair = OasKeyPair::generate();\nlet doc = DocumentBuilder::new(\"did:oas:test:hmr:alice\", \"hmr\")\n .conformance_level(ConformanceLevel::L1)\n .add_verification_method(&keypair)\n .build_and_sign(&keypair, \"2026-01-15T00:00:00Z\")\n .unwrap();\n\nlet resolver = InMemoryResolver::new();\nresolver.register(doc);\n\nlet resolved = resolver.resolve(\"did:oas:test:hmr:alice\").await;\nassert!(resolved.is_ok());\n# });\n```", "attributes": "", "line": 52 }, { "name": "memory::InMemoryResolver::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Creates an empty in-memory resolver.", "attributes": "", "line": 58 }, { "name": "memory::InMemoryResolver::register", "kind": "function_item", "signature": "pub fn register(&self, doc: OasDocument);", "docs": "Registers a document in the resolver.\n\nThe document is stored under its `id` field. If a document\nwith the same ID already exists, it is replaced.\n\n# Arguments\n\n* `doc` - The document to register.", "attributes": "", "line": 72 }, { "name": "memory::InMemoryResolver::len", "kind": "function_item", "signature": "pub fn len(&self) -> usize;", "docs": "Returns the number of registered documents.", "attributes": "", "line": 79 }, { "name": "memory::InMemoryResolver::is_empty", "kind": "function_item", "signature": "pub fn is_empty(&self) -> bool;", "docs": "Returns true if no documents are registered.", "attributes": "", "line": 84 }, { "name": "memory::InMemoryResolver::remove", "kind": "function_item", "signature": "pub fn remove(&self, did: &str) -> Option;", "docs": "Removes a document from the resolver.\n\n# Arguments\n\n* `did` - The DID of the document to remove.\n\n# Returns\n\nThe removed document, if it existed.", "attributes": "", "line": 97 } ], "parseErrors": false }, { "module": "metadata", "source": "oas/oas/oas-resolve/src/metadata.rs", "sha256": "a1a4521862aef723f58382875693766297e92801f5431959f97740539dbe70a5", "attributes": "", "items": [ { "name": "metadata::ResolutionMetadata", "kind": "struct_item", "signature": "pub struct ResolutionMetadata {\n/// The content type of the resolved document.\n\npub content_type: String,\n/// ISO 8601 timestamp of when the resolution occurred.\n\npub retrieved: String,\n/// DID of the resolver that performed the resolution (optional).\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub resolver_identity: Option\n}", "docs": "Metadata about the resolution process itself.\n\nCorresponds to the `didResolutionMetadata` field in OAS Spec \u00a712.3.\n\n# Examples\n\n```\nuse oas_resolve::metadata::ResolutionMetadata;\n\nlet meta = ResolutionMetadata {\n content_type: \"application/did+ld+json\".to_string(),\n retrieved: \"2026-01-15T12:00:00Z\".to_string(),\n resolver_identity: None,\n};\nassert_eq!(meta.content_type, \"application/did+ld+json\");\n```", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 28 }, { "name": "metadata::DocumentResolutionMetadata", "kind": "struct_item", "signature": "pub struct DocumentResolutionMetadata {\n/// ISO 8601 creation timestamp of the document.\n\npub created: String,\n/// ISO 8601 last update timestamp (if any).\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub updated: Option,\n/// Version identifier (typically the sequence number as a string).\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub version_id: Option,\n/// Whether the lineage chain was verified during resolution.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub lineage_verified: Option,\n/// Whether the human root entity is active (not revoked).\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub human_root_active: Option,\n/// The conformance level of the resolved document.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub conformance_level: Option,\n/// Number of attestations associated with this entity.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub attestation_count: Option\n}", "docs": "Metadata about the resolved document.\n\nCorresponds to the `didDocumentMetadata` field in OAS Spec \u00a712.3.\n\n# Examples\n\n```\nuse oas_resolve::metadata::DocumentResolutionMetadata;\n\nlet meta = DocumentResolutionMetadata {\n created: \"2026-01-15T00:00:00Z\".to_string(),\n updated: None,\n version_id: Some(\"3\".to_string()),\n lineage_verified: Some(true),\n human_root_active: Some(true),\n conformance_level: Some(\"L2\".to_string()),\n attestation_count: Some(5),\n};\nassert!(meta.lineage_verified.unwrap_or(false));\n```", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 72 }, { "name": "metadata::ResolutionResult", "kind": "struct_item", "signature": "pub struct ResolutionResult {\n/// The resolved identity document.\n\npub document: oas_document::OasDocument,\n/// Metadata about the resolution process.\n\npub resolution_metadata: ResolutionMetadata,\n/// Metadata about the resolved document.\n\npub document_metadata: DocumentResolutionMetadata\n}", "docs": "A complete resolution result combining document, resolution metadata,\nand document metadata.\n\nImplements the full resolution response structure from OAS Spec \u00a712.3.\n\n# Examples\n\n```\nuse oas_resolve::metadata::{ResolutionResult, ResolutionMetadata, DocumentResolutionMetadata};\nuse oas_document::OasDocument;\n\n// ResolutionResult is returned by resolver implementations\n```", "attributes": "#[derive(Debug, Clone)]", "line": 115 } ], "parseErrors": false }, { "module": "resolver", "source": "oas/oas/oas-resolve/src/resolver.rs", "sha256": "35b732ff5e27f260a8e97c59ed22c82404abd5508da9ec278b0992dab4524509", "attributes": "", "items": [ { "name": "resolver::Resolver", "kind": "trait_item", "signature": "pub trait Resolver: Send + Sync {\n /// Resolves a `did:oas` identifier to its identity document.\n ///\n /// # Arguments\n ///\n /// * `did` - The `did:oas` identifier to resolve.\n ///\n /// # Returns\n ///\n /// The resolved [`OasDocument`].\n ///\n /// # Errors\n ///\n /// Returns a [`ResolveError`] if:\n /// - The DID is not found ([`ResolveError::NotFound`])\n /// - The document signature is invalid ([`ResolveError::InvalidSignature`])\n /// - The document is revoked ([`ResolveError::Revoked`])\n /// - Any other resolution error occurs\n async fn resolve(&self, did: &str) -> Result;\n}", "docs": "An async resolver that maps `did:oas` identifiers to identity documents.\n\nThis is the critical abstraction per OAS Specification \u00a712.\nOAS defines the trait; consumers implement it.\n\n# Implementation Requirements\n\nPer OAS Spec \u00a712.2:\n1. MUST return the most recent valid document for the given DID.\n2. MUST verify the document's signature before returning it.\n3. MUST check revocation status and indicate if revoked.\n4. SHOULD verify lineage for L1+ documents.\n5. MUST return a structured error on failure.\n\n# Examples\n\n```\nuse oas_resolve::resolver::Resolver;\nuse oas_resolve::memory::InMemoryResolver;\n\nlet resolver = InMemoryResolver::new();\n// The resolver is ready but empty \u2014 all lookups will return NotFound.\n```", "attributes": "#[async_trait]", "line": 37 } ], "parseErrors": false } ] }, { "name": "oas-sdk", "url": "/reference/rust/oas-sdk", "modules": [ { "module": "crate", "source": "oas/oas/oas-sdk/src/lib.rs", "sha256": "b03c0548ed311d0008bcdee9297c8dc60b2520f5090b17dc5abd3e87053e7608", "attributes": "", "items": [ { "name": "anchor_policy", "kind": "module", "signature": "pub mod anchor_policy;", "docs": "# oas-sdk\n\nUnified SDK for the Open Agent Specification (OAS).\n\nThis crate provides a single entry point for all OAS operations:\nidentity creation, lineage derivation, attestation, and resolution.\nIt re-exports the lower-level crates and adds high-level workflow functions.\n\n## Quick Start\n\n```\nuse oas_sdk::identity::create_hmr;\nuse oas_sdk::lineage::derive_child;\n\n// 1. Create a Human Root identity\nlet root = create_hmr(\"test\", \"alice\", \"2026-01-15T00:00:00Z\").unwrap();\nassert_eq!(root.document.id, \"did:oas:test:hmr:alice\");\n\n// 2. Derive a child agent\nlet agent = derive_child(\n &root.keypair,\n &root.document,\n \"test\", \"agent\", \"analyzer\",\n \"agent/analyzer\",\n \"2026-01-15T00:00:00Z\",\n).unwrap();\nassert_eq!(agent.document.id, \"did:oas:test:agent:analyzer\");\nassert!(agent.document.lineage.is_some());\n```\n\n## Crate Organization\n\n| Module | Purpose |\n|--------|---------|\n| [`identity`] | Root identity creation (HMR, MHR) |\n| [`lineage`] | Child derivation, local chain verification, privileged authority contract |\n| [`attestation`] | Create, sign, and verify W3C VCs |\n| [`config`] | SDK-wide configuration |\n| [`error`] | Unified error type |\n\n## Sub-Crate Re-exports\n\nFor advanced usage, the individual crates are re-exported:\n\n- `oas_sdk::crypto` \u2192 [`oas_crypto`]\n- `oas_sdk::did` \u2192 [`oas_did`]\n- `oas_sdk::document` \u2192 [`oas_document`]\n- `oas_sdk::lineage_crate` \u2192 [`oas_lineage`]\n- `oas_sdk::resolve` \u2192 [`oas_resolve`] (requires `resolve` feature)\n- `oas_sdk::attestation_crate` \u2192 [`oas_attestation`]", "attributes": "#[cfg(feature = \"resolve\")]", "line": 53 }, { "name": "attestation", "kind": "module", "signature": "pub mod attestation;", "docs": "", "attributes": "", "line": 54 }, { "name": "config", "kind": "module", "signature": "pub mod config;", "docs": "", "attributes": "", "line": 55 }, { "name": "error", "kind": "module", "signature": "pub mod error;", "docs": "", "attributes": "", "line": 56 }, { "name": "identity", "kind": "module", "signature": "pub mod identity;", "docs": "", "attributes": "", "line": 57 }, { "name": "lineage", "kind": "module", "signature": "pub mod lineage;", "docs": "", "attributes": "", "line": 58 }, { "name": "pub use oas_attestation as attestation_crate;", "kind": "use_declaration", "signature": "pub use oas_attestation as attestation_crate;", "docs": "", "attributes": "", "line": 61 }, { "name": "pub use oas_crypto as crypto;", "kind": "use_declaration", "signature": "pub use oas_crypto as crypto;", "docs": "", "attributes": "", "line": 62 }, { "name": "pub use oas_did as did;", "kind": "use_declaration", "signature": "pub use oas_did as did;", "docs": "", "attributes": "", "line": 63 }, { "name": "pub use oas_document as document;", "kind": "use_declaration", "signature": "pub use oas_document as document;", "docs": "", "attributes": "", "line": 64 }, { "name": "pub use oas_lineage as lineage_crate;", "kind": "use_declaration", "signature": "pub use oas_lineage as lineage_crate;", "docs": "", "attributes": "", "line": 65 }, { "name": "pub use oas_resolve as resolve;", "kind": "use_declaration", "signature": "pub use oas_resolve as resolve;", "docs": "", "attributes": "#[cfg(feature = \"resolve\")]", "line": 67 }, { "name": "pub use error::OasError;", "kind": "use_declaration", "signature": "pub use error::OasError;", "docs": "", "attributes": "", "line": 69 } ], "parseErrors": false }, { "module": "anchor_policy", "source": "oas/oas/oas-sdk/src/anchor_policy.rs", "sha256": "a7973d1474d6a9e82c69cdb9054b4e24f957fd1cb22400f09b3d3056bbf04710", "attributes": "#[cfg(feature = \"resolve\")]", "items": [ { "name": "anchor_policy::AnchorPolicy", "kind": "struct_item", "signature": "pub struct AnchorPolicy {\n/// Ordered anchor schemes, most preferred first.\n\npub trusted_schemes: Vec\n}", "docs": "The verifier's anchor policy.\n\n`trusted_schemes` is ordered most-preferred-first. The default policy\ntrusts Sigil only \u2014 the ecosystem's reference anchor and the home of the\nlineage economics (generation decay, publisher bonds), which only Sigil\ncomputes.", "attributes": "#[cfg(feature = \"resolve\")]\n#[derive(Debug, Clone, PartialEq, Eq)]", "line": 38 }, { "name": "anchor_policy::AnchorPolicy::trusting", "kind": "function_item", "signature": "pub fn trusting(schemes: impl IntoIterator>) -> Self;", "docs": "A policy trusting the given schemes in order.", "attributes": "#[cfg(feature = \"resolve\")]", "line": 53 }, { "name": "anchor_policy::AnchorPolicy::sigil_then_eas", "kind": "function_item", "signature": "pub fn sigil_then_eas() -> Self;", "docs": "Sigil preferred, EAS as fallback.", "attributes": "#[cfg(feature = \"resolve\")]", "line": 63 }, { "name": "anchor_policy::AnchorBackends", "kind": "type_item", "signature": "pub type AnchorBackends<'a> = HashMap;", "docs": "A registry of anchor backends by scheme name.", "attributes": "#[cfg(feature = \"resolve\")]", "line": 69 }, { "name": "anchor_policy::VerifyWithAnchorRequest", "kind": "struct_item", "signature": "pub struct VerifyWithAnchorRequest<'a> {\n/// Ordered verifier trust policy for anchor backends.\n\npub policy: &'a AnchorPolicy,\n/// Available anchor backends keyed by scheme.\n\npub backends: AnchorBackends<'a>,\n/// Expected authority path from the trusted root to the subject.\n\npub path_kind: crate::lineage::AuthorityPathKind,\n/// Scopes the confirmed authority must grant.\n\npub required_scopes: &'a [String],\n/// Optional lower bound for backend finality.\n\npub min_finalized_block: Option\n}", "docs": "Typed policy inputs for [`verify_with_anchor_policy`].\n\nGrouping these verifier-controlled values prevents positional argument\nmistakes and keeps the authority policy explicit at call sites.", "attributes": "#[cfg(feature = \"resolve\")]", "line": 75 }, { "name": "anchor_policy::AnchoredAuthoritySource", "kind": "struct_item", "signature": "pub struct AnchoredAuthoritySource<'a> {\n\n}", "docs": "A [`LineageAuthoritySource`] that dispatches to anchor backends per the\nverifier's [`AnchorPolicy`].", "attributes": "#[cfg(feature = \"resolve\")]", "line": 90 }, { "name": "anchor_policy::AnchoredAuthoritySource<'a>::new", "kind": "function_item", "signature": "pub fn new(policy: AnchorPolicy, backends: AnchorBackends<'a>) -> Self;", "docs": "Build the dispatcher.\n\nA trusted scheme with no registered backend cannot confirm authority,\nso it contributes nothing to the decision: the dispatcher proceeds\nwith the backends that exist and, if none confirms, fails closed with\nthe policy named in the error. An unregistered trusted scheme is a\nlegal state (a verifier may not run every backend it would trust);\nsilently treating it as a pass is the failure this shape prevents.", "attributes": "#[cfg(feature = \"resolve\")]", "line": 104 }, { "name": "anchor_policy::verify_with_anchor_policy", "kind": "function_item", "signature": "pub fn verify_with_anchor_policy(\n document: &OasDocument,\n provider: &dyn oas_lineage::provider::DocumentProvider,\n config: &oas_lineage::config::VerifyConfig,\n request: VerifyWithAnchorRequest<'_>,\n) -> Result;", "docs": "Verify lineage with an explicit anchor policy, in one call.\n\nThe facade-level entry for the common case: offline lineage verification\n(portable) followed by authority confirmation against the trusted anchor\nschemes the document's lineage section points at. If you do not have a\ndocument-shaped anchor reference set, this composes identically to\ncalling `verify_privileged_authority` with an [`AnchoredAuthoritySource`].\n\n# Errors\n\nFails closed: any backend error, absent anchor, non-active status, or\nunconfirmed finality means the privileged action is not authorized.", "attributes": "#[cfg(feature = \"resolve\")]\n#[cfg(feature = \"resolve\")]", "line": 275 } ], "parseErrors": false }, { "module": "attestation", "source": "oas/oas/oas-sdk/src/attestation.rs", "sha256": "ced1e63868a56de8ae5158a1d9cbce1540346b506bbd9d0c347fa152b578300a", "attributes": "", "items": [ { "name": "attestation::create_attestation", "kind": "function_item", "signature": "pub fn create_attestation(\n issuer_did: &str,\n subject_did: &str,\n attestation_type: AttestationType,\n claims: &[(&str, serde_json::Value)],\n issuer_keypair: &OasKeyPair,\n verification_method_id: &str,\n issuance_date: &str,\n expiration_date: Option<&str>,\n) -> Result;", "docs": "Creates and signs an attestation credential in a single call.\n\nCombines credential building and signing for the common case where\nyou have all the information upfront.\n\n# Arguments\n\n* `issuer_did` - The issuer's `did:oas` identifier.\n* `subject_did` - The subject entity's `did:oas` identifier.\n* `attestation_type` - The OAS \u00a713.2 attestation type.\n* `claims` - Additional credential subject claims as key-value pairs.\n* `issuer_keypair` - The issuer's Ed25519 keypair.\n* `verification_method_id` - Full verification method ID (e.g., `\"did:oas:test:hmr:a#key-1\"`).\n* `issuance_date` - ISO 8601 timestamp.\n* `expiration_date` - Optional ISO 8601 expiration timestamp.\n\n# Returns\n\nA signed [`OasCredential`].\n\n# Errors\n\nReturns [`OasError::Attestation`] if building, validation, or signing fails.\n\n# Examples\n\n```\nuse oas_sdk::attestation::create_attestation;\nuse oas_attestation::types::AttestationType;\nuse oas_crypto::keypair::OasKeyPair;\n\nlet keypair = OasKeyPair::generate();\nlet cred = create_attestation(\n \"did:oas:test:hmr:auditor\",\n \"did:oas:test:agent:target\",\n AttestationType::SecurityAudit,\n &[\n (\"auditType\", serde_json::json!(\"codeAudit\")),\n (\"result\", serde_json::json!(\"pass\")),\n (\"severityFindings\", serde_json::json!({\"critical\": 0})),\n (\"toolOrMethodology\", serde_json::json!(\"OWASP\")),\n (\"auditDate\", serde_json::json!(\"2026-01-15T00:00:00Z\")),\n ],\n &keypair,\n \"did:oas:test:hmr:auditor#key-1\",\n \"2026-01-15T00:00:00Z\",\n None,\n);\nassert!(cred.is_ok());\n```", "attributes": "#[allow(clippy::too_many_arguments)]", "line": 65 }, { "name": "attestation::verify_attestation", "kind": "function_item", "signature": "pub fn verify_attestation(\n credential: &OasCredential,\n issuer_public_key: &[u8],\n) -> Result<(), OasError>;", "docs": "Verifies an attestation credential's proof.\n\nValidates structure and cryptographic proof against the issuer's public key.\n\n# Arguments\n\n* `credential` - The signed credential to verify.\n* `issuer_public_key` - The 32-byte Ed25519 public key of the issuer.\n\n# Returns\n\n`Ok(())` if valid.\n\n# Errors\n\nReturns [`OasError::Attestation`] if verification fails.\n\n# Examples\n\n```\nuse oas_sdk::attestation::{create_attestation, verify_attestation};\nuse oas_attestation::types::AttestationType;\nuse oas_crypto::keypair::OasKeyPair;\n\nlet keypair = OasKeyPair::generate();\nlet cred = create_attestation(\n \"did:oas:test:hmr:auditor\",\n \"did:oas:test:agent:target\",\n AttestationType::ExpertEndorsement,\n &[\n (\"expertDid\", serde_json::json!(\"did:oas:test:hmr:auditor\")),\n (\"domain\", serde_json::json!(\"security\")),\n (\"endorsementType\", serde_json::json!(\"capability\")),\n (\"confidence\", serde_json::json!(0.9)),\n ],\n &keypair,\n \"did:oas:test:hmr:auditor#key-1\",\n \"2026-01-15T00:00:00Z\",\n None,\n).unwrap();\n\nlet result = verify_attestation(&cred, &keypair.verifying_key_bytes());\nassert!(result.is_ok());\n```", "attributes": "", "line": 144 }, { "name": "attestation::verify_attestation_with_time", "kind": "function_item", "signature": "pub fn verify_attestation_with_time(\n credential: &OasCredential,\n issuer_public_key: &[u8],\n now: &str,\n) -> Result<(), OasError>;", "docs": "Verifies an attestation credential with temporal checks.\n\nIn addition to proof verification, checks that the credential\nis within its valid time window.\n\n# Arguments\n\n* `credential` - The signed credential to verify.\n* `issuer_public_key` - The 32-byte Ed25519 public key of the issuer.\n* `now` - Current time as ISO 8601 string.\n\n# Returns\n\n`Ok(())` if valid and within time window.\n\n# Errors\n\nReturns [`OasError::Attestation`] if verification fails or the credential is expired/not yet valid.", "attributes": "", "line": 169 } ], "parseErrors": false }, { "module": "config", "source": "oas/oas/oas-sdk/src/config.rs", "sha256": "4038079d8f84273a076b937fa015546f3ad4f002cd8fd55e41afdbaa50f8a6c4", "attributes": "", "items": [ { "name": "config::SdkConfig", "kind": "struct_item", "signature": "pub struct SdkConfig {\n\n}", "docs": "Configuration for the OAS SDK.\n\nControls resolution, lineage verification settings, and other\nSDK-wide parameters.\n\n# Examples\n\n```\nuse oas_sdk::config::SdkConfig;\nuse std::time::Duration;\n\nlet config = SdkConfig::builder()\n .max_generation(8)\n .per_hop_timeout(Duration::from_secs(3))\n .build();\n\nassert_eq!(config.max_generation(), 8);\n```", "attributes": "#[derive(Debug, Clone)]", "line": 28 }, { "name": "config::SdkConfig::builder", "kind": "function_item", "signature": "pub fn builder() -> SdkConfigBuilder;", "docs": "Creates a new [`SdkConfigBuilder`].", "attributes": "", "line": 38 }, { "name": "config::SdkConfig::max_generation", "kind": "function_item", "signature": "pub fn max_generation(&self) -> u32;", "docs": "Returns the maximum allowed lineage generation depth.", "attributes": "", "line": 43 }, { "name": "config::SdkConfig::per_hop_timeout", "kind": "function_item", "signature": "pub fn per_hop_timeout(&self) -> Duration;", "docs": "Returns the per-hop resolution timeout.", "attributes": "", "line": 48 }, { "name": "config::SdkConfig::total_timeout", "kind": "function_item", "signature": "pub fn total_timeout(&self) -> Duration;", "docs": "Returns the total lineage verification timeout.", "attributes": "", "line": 53 }, { "name": "config::SdkConfig::verify_document_signatures", "kind": "function_item", "signature": "pub fn verify_document_signatures(&self) -> bool;", "docs": "Returns whether document signature verification is enabled.", "attributes": "", "line": 58 }, { "name": "config::SdkConfig::trust_anchors", "kind": "function_item", "signature": "pub fn trust_anchors(&self) -> &[oas_lineage::config::TrustAnchor];", "docs": "Returns verifier-controlled lineage root trust anchors.", "attributes": "", "line": 63 }, { "name": "config::SdkConfig::to_lineage_config", "kind": "function_item", "signature": "pub fn to_lineage_config(&self) -> oas_lineage::config::VerifyConfig;", "docs": "Converts this configuration into a lineage [`VerifyConfig`](oas_lineage::config::VerifyConfig).", "attributes": "", "line": 68 }, { "name": "config::SdkConfigBuilder", "kind": "struct_item", "signature": "pub struct SdkConfigBuilder {\n\n}", "docs": "Builder for [`SdkConfig`].\n\n# Examples\n\n```\nuse oas_sdk::config::SdkConfig;\n\nlet config = SdkConfig::builder()\n .max_generation(8)\n .verify_document_signatures(false)\n .build();\n```", "attributes": "#[derive(Debug, Default)]", "line": 106 }, { "name": "config::SdkConfigBuilder::max_generation", "kind": "function_item", "signature": "pub fn max_generation(mut self, max: u32) -> Self;", "docs": "Sets the maximum allowed lineage generation depth.\n\nDefault: 16 (per OAS Specification \u00a78).", "attributes": "", "line": 114 }, { "name": "config::SdkConfigBuilder::per_hop_timeout", "kind": "function_item", "signature": "pub fn per_hop_timeout(mut self, timeout: Duration) -> Self;", "docs": "Sets the per-hop resolution timeout.\n\nDefault: 5 seconds.", "attributes": "", "line": 122 }, { "name": "config::SdkConfigBuilder::total_timeout", "kind": "function_item", "signature": "pub fn total_timeout(mut self, timeout: Duration) -> Self;", "docs": "Sets the total lineage verification timeout.\n\nDefault: 30 seconds.", "attributes": "", "line": 130 }, { "name": "config::SdkConfigBuilder::verify_document_signatures", "kind": "function_item", "signature": "pub fn verify_document_signatures(mut self, verify: bool) -> Self;", "docs": "Sets whether to verify document proof signatures during lineage verification.\n\nDefault: true.", "attributes": "", "line": 138 }, { "name": "config::SdkConfigBuilder::trust_anchor", "kind": "function_item", "signature": "pub fn trust_anchor(mut self, anchor: oas_lineage::config::TrustAnchor) -> Self;", "docs": "Adds a verifier-controlled lineage root trust anchor.", "attributes": "", "line": 144 }, { "name": "config::SdkConfigBuilder::build", "kind": "function_item", "signature": "pub fn build(self) -> SdkConfig;", "docs": "Builds the configuration.", "attributes": "", "line": 150 } ], "parseErrors": false }, { "module": "error", "source": "oas/oas/oas-sdk/src/error.rs", "sha256": "0457ecc9696116283584ed709d0dac7459d1d5353fe97385a37f8f6e8b1d5cd8", "attributes": "", "items": [ { "name": "error::OasError", "kind": "enum_item", "signature": "pub enum OasError {\n /// A DID parsing error.\n #[error(\"DID error: {0}\")]\n Did(#[from] oas_did::DidError),\n\n /// A cryptographic operation error.\n #[error(\"crypto error: {0}\")]\n Crypto(#[from] oas_crypto::CryptoError),\n\n /// A document operation error.\n #[error(\"document error: {0}\")]\n Document(#[from] oas_document::DocumentError),\n\n /// A lineage verification error.\n #[error(\"lineage error: {0}\")]\n Lineage(#[from] oas_lineage::LineageError),\n\n /// A privileged lineage authority verification error.\n #[error(\"lineage authority error: {reason}\")]\n LineageAuthority {\n /// Description of why privileged authority was not accepted.\n reason: String,\n },\n\n /// A DID resolution error.\n #[cfg(feature = \"resolve\")]\n #[error(\"resolve error: {0}\")]\n Resolve(#[from] oas_resolve::ResolveError),\n\n /// An attestation operation error.\n #[error(\"attestation error: {0}\")]\n Attestation(#[from] oas_attestation::AttestationError),\n\n /// A JSON serialization error.\n #[error(\"JSON error: {0}\")]\n Json(#[from] serde_json::Error),\n\n /// An SDK configuration or usage error.\n #[error(\"SDK error: {reason}\")]\n Sdk {\n /// Description of what went wrong.\n reason: String,\n },\n}", "docs": "Unified error type for OAS SDK operations.\n\nAggregates errors from all underlying crates so callers need only\nhandle one error type.\n\n# Examples\n\n```\nuse oas_sdk::error::OasError;\n\nfn example() -> Result<(), OasError> {\n // Any sub-crate error can be converted via `?`\n Ok(())\n}\n```", "attributes": "#[derive(Debug, Error)]", "line": 25 } ], "parseErrors": false }, { "module": "identity", "source": "oas/oas/oas-sdk/src/identity.rs", "sha256": "654abc5c2246dab8bdf0c0effdd8037ea2551b53ed23f3a535226d5db67183db", "attributes": "", "items": [ { "name": "identity::CreatedIdentity", "kind": "struct_item", "signature": "pub struct CreatedIdentity {\n/// The signed OAS Identity Document.\n\npub document: OasDocument,\n/// The Ed25519 keypair for this identity.\n\npub keypair: OasKeyPair\n}", "docs": "The result of creating a new root identity.\n\nContains the signed identity document and the keypair used to sign it.\nThe caller is responsible for securely storing the keypair.", "attributes": "#[derive(Debug)]", "line": 19 }, { "name": "identity::create_hmr", "kind": "function_item", "signature": "pub fn create_hmr(\n namespace: &str,\n identifier: &str,\n created: &str,\n) -> Result;", "docs": "Creates a new Human Root (HMR) identity.\n\nGenerates a fresh Ed25519 keypair, constructs an OAS Identity Document\nfor a `did:oas::hmr:` DID, and signs it.\n\n# Arguments\n\n* `namespace` - The OAS namespace (e.g., `\"l1fe\"`, `\"test\"`).\n* `identifier` - The unique identifier within the namespace.\n* `created` - ISO 8601 timestamp for the document metadata.\n\n# Returns\n\nA [`CreatedIdentity`] containing the signed document and keypair.\n\n# Errors\n\nReturns [`OasError`] if DID construction or document building fails.\n\n# Examples\n\n```\nuse oas_sdk::identity::create_hmr;\n\nlet identity = create_hmr(\"test\", \"alice\", \"2026-01-15T00:00:00Z\");\nassert!(identity.is_ok());\nlet identity = identity.unwrap();\nassert_eq!(identity.document.id, \"did:oas:test:hmr:alice\");\n```", "attributes": "", "line": 55 }, { "name": "identity::create_mhr", "kind": "function_item", "signature": "pub fn create_mhr(\n namespace: &str,\n identifier: &str,\n created: &str,\n) -> Result;", "docs": "Creates a new Multi-Human Root (MHR) identity.\n\nSimilar to [`create_hmr`] but for multi-human threshold root entities.\nMHR identities use `did:oas::mhr:`.\n\n# Arguments\n\n* `namespace` - The OAS namespace (e.g., `\"l1fe\"`, `\"test\"`).\n* `identifier` - The unique identifier within the namespace.\n* `created` - ISO 8601 timestamp for the document metadata.\n\n# Returns\n\nA [`CreatedIdentity`] containing the signed document and keypair.\n\n# Errors\n\nReturns [`OasError`] if DID construction or document building fails.\n\n# Examples\n\n```\nuse oas_sdk::identity::create_mhr;\n\nlet identity = create_mhr(\"test\", \"system1\", \"2026-01-15T00:00:00Z\");\nassert!(identity.is_ok());\nlet identity = identity.unwrap();\nassert_eq!(identity.document.id, \"did:oas:test:mhr:system1\");\n```", "attributes": "", "line": 101 }, { "name": "identity::create_root_with_keypair", "kind": "function_item", "signature": "pub fn create_root_with_keypair(\n namespace: &str,\n kind: &str,\n identifier: &str,\n keypair: &OasKeyPair,\n created: &str,\n) -> Result;", "docs": "Creates a new root identity with a pre-existing keypair.\n\nUse this when you need to control the keypair (e.g., loading from storage).\n\n# Arguments\n\n* `namespace` - The OAS namespace.\n* `kind` - The entity kind (`\"hmr\"` or `\"mhr\"`).\n* `identifier` - The unique identifier.\n* `keypair` - The Ed25519 keypair to use.\n* `created` - ISO 8601 timestamp.\n\n# Returns\n\nA signed [`OasDocument`].\n\n# Errors\n\nReturns [`OasError`] if document building fails.\n\n# Examples\n\n```\nuse oas_sdk::identity::create_root_with_keypair;\nuse oas_crypto::keypair::OasKeyPair;\n\nlet keypair = OasKeyPair::generate();\nlet doc = create_root_with_keypair(\"test\", \"hmr\", \"alice\", &keypair, \"2026-01-15T00:00:00Z\");\nassert!(doc.is_ok());\n```", "attributes": "", "line": 148 } ], "parseErrors": false }, { "module": "lineage", "source": "oas/oas/oas-sdk/src/lineage.rs", "sha256": "dfb1c98b450d92cbca537fbbb0b1c744efda2674b3b83ba27dafa2ae5557a988", "attributes": "", "items": [ { "name": "lineage::DerivedIdentity", "kind": "struct_item", "signature": "pub struct DerivedIdentity {\n/// The signed child OAS Identity Document (with lineage section).\n\npub document: OasDocument,\n/// The derived Ed25519 keypair for this child entity.\n\npub keypair: OasKeyPair\n}", "docs": "The result of deriving a child entity.\n\nContains the signed child identity document and the derived keypair.", "attributes": "#[derive(Debug)]", "line": 22 }, { "name": "lineage::AuthorityPathKind", "kind": "enum_item", "signature": "pub enum AuthorityPathKind {\n /// Human root delegates authority to an agent.\n HumanToAgent,\n /// Agent acts on behalf of an organization.\n AgentToOrg,\n /// Organization delegates authority to an agent.\n OrgToAgent,\n /// Agent acts toward a human subject.\n AgentToHuman,\n /// Deployment-specific path kind.\n Custom(String),\n}", "docs": "A required privileged authority path shape.\n\nOAS keeps this intentionally small and stringly-extensible so downstream\nsystems can add product-specific paths without forking lineage semantics.", "attributes": "#[derive(Debug, Clone, PartialEq, Eq)]", "line": 34 }, { "name": "lineage::AuthorityPathKind::as_str", "kind": "function_item", "signature": "pub fn as_str(&self) -> &str;", "docs": "Stable wire label for this path kind.", "attributes": "", "line": 49 }, { "name": "lineage::LineageAuthorityRequest", "kind": "struct_item", "signature": "pub struct LineageAuthorityRequest {\n/// DID whose authority is being checked.\n\npub subject_did: String,\n/// Root DID proven by portable/local lineage verification.\n\npub local_root_did: String,\n/// Local chain as declared by the document, ordered root to subject when known.\n\npub local_chain: Vec,\n/// Required privileged path kind.\n\npub path_kind: AuthorityPathKind,\n/// Scopes the caller wants this lineage path to authorize.\n\npub required_scopes: Vec,\n/// Optional lower bound for acceptable Sigil finality.\n\npub min_finalized_block: Option\n}", "docs": "Request passed from OAS into a Sigil-backed lineage authority source.", "attributes": "#[derive(Debug, Clone, PartialEq, Eq)]", "line": 62 }, { "name": "lineage::LineageAuthorityRecord", "kind": "struct_item", "signature": "pub struct LineageAuthorityRecord {\n/// DID whose authority was verified.\n\npub subject_did: String,\n/// Finalized root DID for the verified authority path.\n\npub root_did: String,\n/// Reconstructed finalized path, ordered root to subject.\n\npub finalized_path: Vec,\n/// Sigil block height at which the authority proof is finalized.\n\npub finalized_block: u64,\n/// Backend/source identifier, e.g. \"sigil_gal\".\n\npub source: String,\n/// Scopes proven for this path.\n\npub scopes: Vec,\n/// Optional authority expiry timestamp.\n\npub expires_at: Option\n}", "docs": "Sigil-backed authority record returned by a lineage finality source.", "attributes": "#[derive(Debug, Clone, PartialEq, Eq)]", "line": 79 }, { "name": "lineage::LineageAuthorityVerification", "kind": "struct_item", "signature": "pub struct LineageAuthorityVerification {\n/// Portable local lineage verification result.\n\npub portable: VerifyResult,\n/// Sigil-backed finality record.\n\npub authority: LineageAuthorityRecord\n}", "docs": "Result of privileged lineage authority verification.", "attributes": "#[derive(Debug, Clone)]", "line": 98 }, { "name": "lineage::LineageAuthoritySource", "kind": "trait_item", "signature": "pub trait LineageAuthoritySource {\n /// Verify the requested path against finalized lineage state.\n fn verify_authority(\n &self,\n request: &LineageAuthorityRequest,\n ) -> Result;\n}", "docs": "Backend that proves privileged lineage authority.\n\nProduction implementations are expected to query Sigil GAL or verify a fresh\nproof/cache of Sigil GAL state. Implementations must fail closed: returning\nan error means the privileged action is not authorized.", "attributes": "", "line": 110 }, { "name": "lineage::derive_child", "kind": "function_item", "signature": "pub fn derive_child(\n parent_keypair: &OasKeyPair,\n parent_doc: &OasDocument,\n child_namespace: &str,\n child_kind: &str,\n child_identifier: &str,\n derivation_path: &str,\n created: &str,\n) -> Result;", "docs": "Derives a child entity from a parent identity.\n\nPerforms HKDF-SHA256 key derivation, constructs a lineage proof,\nbuilds the child document with the lineage section, and signs it.\n\n# Arguments\n\n* `parent_keypair` - The parent's Ed25519 keypair.\n* `parent_doc` - The parent's signed OAS Identity Document.\n* `child_namespace` - The child's namespace (often same as parent).\n* `child_kind` - The child's entity kind (e.g., `\"agent\"`, `\"tool\"`).\n* `child_identifier` - The child's unique identifier.\n* `derivation_path` - The HKDF derivation path string.\n* `created` - ISO 8601 timestamp.\n\n# Returns\n\nA [`DerivedIdentity`] containing the signed child document and derived keypair.\n\n# Errors\n\nReturns [`OasError`] if key derivation, document building, or signing fails.\n\n# Examples\n\n```\nuse oas_sdk::identity::create_hmr;\nuse oas_sdk::lineage::derive_child;\n\nlet parent = create_hmr(\"test\", \"alice\", \"2026-01-15T00:00:00Z\").unwrap();\nlet child = derive_child(\n &parent.keypair,\n &parent.document,\n \"test\",\n \"agent\",\n \"analyzer\",\n \"agent/analyzer\",\n \"2026-01-15T00:00:00Z\",\n);\nassert!(child.is_ok());\nlet child = child.unwrap();\nassert_eq!(child.document.id, \"did:oas:test:agent:analyzer\");\nassert!(child.document.lineage.is_some());\n```", "attributes": "", "line": 162 }, { "name": "lineage::verify_chain", "kind": "function_item", "signature": "pub fn verify_chain(\n document: &OasDocument,\n provider: &dyn DocumentProvider,\n config: &VerifyConfig,\n) -> Result;", "docs": "Verifies a lineage chain for a given document.\n\nWalks the chain from the child to the root, verifying each hop's\nAgentLineageProof2025 signature.\n\n# Arguments\n\n* `document` - The document whose lineage to verify.\n* `provider` - A provider that can resolve parent DIDs to documents.\n* `config` - Verification configuration (timeouts, max depth).\n\n# Returns\n\nA [`VerifyResult`] on success.\n\n# Errors\n\nReturns [`OasError::Lineage`] if verification fails.\n\n# Examples\n\n```\nuse oas_sdk::identity::create_hmr;\nuse oas_sdk::lineage::{derive_child, verify_chain};\nuse oas_lineage::provider::InMemoryProvider;\nuse oas_lineage::config::{TrustAnchor, VerifyConfig};\n\nlet parent = create_hmr(\"test\", \"alice\", \"2026-01-15T00:00:00Z\").unwrap();\nlet child = derive_child(\n &parent.keypair,\n &parent.document,\n \"test\", \"agent\", \"bot\",\n \"agent/bot\",\n \"2026-01-15T00:00:00Z\",\n).unwrap();\n\nlet mut provider = InMemoryProvider::new();\nprovider.register(parent.document.clone());\nlet anchor = TrustAnchor::new(\n &parent.document.id,\n format!(\"{}#key-1\", parent.document.id),\n parent.keypair.public_key_multibase(),\n).with_document_digest(parent.document.canonical_digest().unwrap());\nlet config = VerifyConfig::new().with_trust_anchor(anchor);\n\nlet result = verify_chain(&child.document, &provider, &config);\nassert!(result.is_ok());\n```", "attributes": "", "line": 241 }, { "name": "lineage::verify_privileged_authority", "kind": "function_item", "signature": "pub fn verify_privileged_authority(\n document: &OasDocument,\n provider: &dyn DocumentProvider,\n config: &VerifyConfig,\n authority_source: &dyn LineageAuthoritySource,\n path_kind: AuthorityPathKind,\n required_scopes: &[String],\n min_finalized_block: Option,\n) -> Result;", "docs": "Verifies local lineage and then requires Sigil-backed privileged authority.\n\nThis is the SDK-level contract downstream systems should call before issuing\nACTs, credentials, sessions, org membership, wallet authority, or other\nprivileged access. If the authority source is unavailable or rejects the\nrequest, this function fails closed.", "attributes": "", "line": 255 } ], "parseErrors": false } ] }, { "name": "oas-wasm", "url": "/reference/rust/oas-wasm", "modules": [ { "module": "crate", "source": "oas/oas/oas-wasm/src/lib.rs", "sha256": "8d2572603058d7249a6f0778adecaea168d1d4ce07764b7a36ce40c7e6b70f56", "attributes": "", "items": [ { "name": "parse_did", "kind": "module", "signature": "pub mod parse_did;", "docs": "", "attributes": "", "line": 34 }, { "name": "validate_document", "kind": "module", "signature": "pub mod validate_document;", "docs": "", "attributes": "", "line": 35 }, { "name": "verify_lineage", "kind": "module", "signature": "pub mod verify_lineage;", "docs": "", "attributes": "", "line": 36 }, { "name": "pub use identity_bridge::{create_hmr, create_mhr, derive_child, sign_message, verify_signature};", "kind": "use_declaration", "signature": "pub use identity_bridge::{create_hmr, create_mhr, derive_child, sign_message, verify_signature};", "docs": "", "attributes": "", "line": 38 } ], "parseErrors": false }, { "module": "identity_bridge", "source": "oas/oas/oas-wasm/src/identity_bridge.rs", "sha256": "2ca92579395ffd417fd1a0559317fca6bc82204f67e332da73d4b2a4a5bd4843", "attributes": "", "items": [ { "name": "identity_bridge::create_hmr", "kind": "function_item", "signature": "pub fn create_hmr(input_json: &str) -> String;", "docs": "Create a Human Root identity and export the result as JSON.", "attributes": "", "line": 171 }, { "name": "identity_bridge::create_mhr", "kind": "function_item", "signature": "pub fn create_mhr(input_json: &str) -> String;", "docs": "Create a Multi-Human Root identity and export the result as JSON.", "attributes": "", "line": 176 }, { "name": "identity_bridge::derive_child", "kind": "function_item", "signature": "pub fn derive_child(input_json: &str) -> String;", "docs": "Derive a child identity and export the result as JSON.", "attributes": "", "line": 181 }, { "name": "identity_bridge::sign_message", "kind": "function_item", "signature": "pub fn sign_message(input_json: &str) -> String;", "docs": "Sign a UTF-8 message with a base64url-encoded Ed25519 private key.", "attributes": "", "line": 270 }, { "name": "identity_bridge::verify_signature", "kind": "function_item", "signature": "pub fn verify_signature(input_json: &str) -> String;", "docs": "Verify a UTF-8 message signature against a multibase-encoded public key.", "attributes": "", "line": 302 } ], "parseErrors": false }, { "module": "parse_did", "source": "oas/oas/oas-wasm/src/parse_did.rs", "sha256": "87786ad2c36cd290819ae24aeb347cb4201dfc2fa7d12acf33d8fd25dbc7c21f", "attributes": "", "items": [ { "name": "parse_did::ParsedDid", "kind": "struct_item", "signature": "pub struct ParsedDid {\n/// The full DID string.\n\npub did: String,\n/// The namespace component.\n\npub namespace: String,\n/// The entity kind.\n\npub kind: String,\n/// The identifier component.\n\npub identifier: String\n}", "docs": "Parsed DID components returned from WASM.", "attributes": "#[derive(Debug, Serialize)]", "line": 11 }, { "name": "parse_did::ParseDidResult", "kind": "struct_item", "signature": "pub struct ParseDidResult {\n/// Whether the parse succeeded.\n\npub ok: bool,\n/// The parsed DID (present if `ok` is true).\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub parsed: Option,\n/// Error message (present if `ok` is false).\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub error: Option\n}", "docs": "Result of a DID parse operation, serialized as JSON.", "attributes": "#[derive(Debug, Serialize)]", "line": 24 }, { "name": "parse_did::parse_did", "kind": "function_item", "signature": "pub fn parse_did(did: &str) -> String;", "docs": "Parses a `did:oas` string and returns the result as JSON.\n\nThis is a synchronous, allocation-friendly function suitable for WASM.\n\n# Arguments\n\n* `did` - The DID string to parse.\n\n# Returns\n\nA JSON string containing a [`ParseDidResult`].\n\n# Examples\n\n```\nuse oas_wasm::parse_did::parse_did;\n\nlet result = parse_did(\"did:oas:test:agent:bot\");\nassert!(result.contains(\"\\\"ok\\\":true\"));\nassert!(result.contains(\"\\\"kind\\\":\\\"agent\\\"\"));\n\nlet result = parse_did(\"not-a-did\");\nassert!(result.contains(\"\\\"ok\\\":false\"));\n```", "attributes": "#[cfg_attr(target_arch = \"wasm32\", wasm_bindgen::prelude::wasm_bindgen)]", "line": 60 } ], "parseErrors": false }, { "module": "validate_document", "source": "oas/oas/oas-wasm/src/validate_document.rs", "sha256": "5f4d7cf8a957d95937b2e8327aaed826dfde71262a09247ee57a376096b2f785", "attributes": "", "items": [ { "name": "validate_document::ValidateDocumentResult", "kind": "struct_item", "signature": "pub struct ValidateDocumentResult {\n/// Whether validation passed.\n\npub ok: bool,\n/// The document's DID (if parsing succeeded).\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub did: Option,\n/// The document's entity kind (if parsing succeeded).\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub kind: Option,\n/// The document's conformance level (if parsing succeeded).\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub conformance_level: Option,\n/// Whether the document has a proof.\n\npub has_proof: bool,\n/// Validation errors (empty if valid).\n\npub errors: Vec\n}", "docs": "Result of a document validation, serialized as JSON.", "attributes": "#[derive(Debug, Serialize)]", "line": 13 }, { "name": "validate_document::validate_document", "kind": "function_item", "signature": "pub fn validate_document(document_json: &str) -> String;", "docs": "Validates an OAS Identity Document from JSON.\n\nChecks:\n- JSON deserialization\n- Required fields present\n- DID format valid\n- Conformance level field present\n\n# Arguments\n\n* `document_json` - The document as a JSON string.\n\n# Returns\n\nA JSON string containing a [`ValidateDocumentResult`].\n\n# Examples\n\n```\nuse oas_wasm::validate_document::validate_document;\nuse oas_crypto::keypair::OasKeyPair;\nuse oas_document::builder::DocumentBuilder;\nuse oas_document::conformance::ConformanceLevel;\n\nlet keypair = OasKeyPair::generate();\nlet doc = DocumentBuilder::new(\"did:oas:test:hmr:alice\", \"hmr\")\n .conformance_level(ConformanceLevel::L0)\n .add_verification_method(&keypair)\n .build_and_sign(&keypair, \"2026-01-15T00:00:00Z\")\n .unwrap();\n\nlet json = serde_json::to_string(&doc).unwrap();\nlet result = validate_document(&json);\nassert!(result.contains(\"\\\"ok\\\":true\"));\n```", "attributes": "#[cfg_attr(target_arch = \"wasm32\", wasm_bindgen::prelude::wasm_bindgen)]", "line": 67 } ], "parseErrors": false }, { "module": "verify_lineage", "source": "oas/oas/oas-wasm/src/verify_lineage.rs", "sha256": "0c9cc23d0054f81e4c6beb897009376acde39711afa4a2c544a1bfb2edeac5ec", "attributes": "", "items": [ { "name": "verify_lineage::VerifyLineageInput", "kind": "struct_item", "signature": "pub struct VerifyLineageInput {\n/// The document whose lineage to verify (as JSON).\n\npub document: serde_json::Value,\n/// Pre-fetched parent documents keyed by DID.\n\npub parents: HashMap,\n/// Optional maximum generation depth (defaults to 16).\n\n#[serde(alias = \"maxGeneration\")]\npub max_generation: Option,\n/// Verifier-controlled root trust anchors.\n\n#[serde(default, alias = \"trustAnchors\")]\npub trust_anchors: Vec\n}", "docs": "Input for lineage verification.", "attributes": "#[derive(Debug, Deserialize)]\n#[serde(deny_unknown_fields)]", "line": 19 }, { "name": "verify_lineage::VerifyLineageResult", "kind": "struct_item", "signature": "pub struct VerifyLineageResult {\n/// Whether the lineage is valid.\n\npub ok: bool,\n/// The root DID (if chain terminates at a root).\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub root_did: Option,\n/// The generation depth.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub generation: Option,\n/// Stable typed error code (if verification failed).\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub error_code: Option,\n/// Error message (if verification failed).\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub error: Option\n}", "docs": "Result of lineage verification.", "attributes": "#[derive(Debug, Serialize)]", "line": 34 }, { "name": "verify_lineage::verify_lineage", "kind": "function_item", "signature": "pub fn verify_lineage(input_json: &str) -> String;", "docs": "Verifies a lineage chain using pre-fetched documents.\n\nThis is a synchronous function suitable for WASM environments.\nAll parent documents must be provided upfront \u2014 no network requests are made.\n\n# Arguments\n\n* `input_json` - JSON string containing a [`VerifyLineageInput`].\n\n# Returns\n\nA JSON string containing a [`VerifyLineageResult`].\n\n# Examples\n\n```\nuse oas_wasm::verify_lineage::verify_lineage;\nuse oas_crypto::keypair::OasKeyPair;\nuse oas_document::builder::DocumentBuilder;\nuse oas_document::conformance::ConformanceLevel;\nuse oas_lineage::config::TrustAnchor;\n\nlet keypair = OasKeyPair::generate();\nlet doc = DocumentBuilder::new(\"did:oas:test:hmr:alice\", \"hmr\")\n .conformance_level(ConformanceLevel::L0)\n .add_verification_method(&keypair)\n .build_and_sign(&keypair, \"2026-01-15T00:00:00Z\")\n .unwrap();\n\nlet anchor = TrustAnchor::new(\n &doc.id,\n format!(\"{}#key-1\", doc.id),\n keypair.public_key_multibase(),\n).with_document_digest(doc.canonical_digest().unwrap());\nlet input = serde_json::json!({\n \"document\": doc,\n \"parents\": {},\n \"trustAnchors\": [anchor]\n});\n\nlet result = verify_lineage(&serde_json::to_string(&input).unwrap());\nassert!(result.contains(\"\\\"ok\\\":true\"));\n```", "attributes": "#[cfg_attr(target_arch = \"wasm32\", wasm_bindgen::prelude::wasm_bindgen)]", "line": 112 } ], "parseErrors": false } ] }, { "name": "openagent-http", "url": "/reference/rust/openagent-http", "modules": [ { "module": "crate", "source": "openagent-sdk/adapters/http/rust/src/lib.rs", "sha256": "e8edfdccf52752530c137986e9048db7421eab6c4e467f7eb2573eeddc5eef63", "attributes": "", "items": [ { "name": "client", "kind": "module", "signature": "pub mod client;", "docs": "", "attributes": "", "line": 29 }, { "name": "discovery", "kind": "module", "signature": "pub mod discovery;", "docs": "", "attributes": "", "line": 30 }, { "name": "headers", "kind": "module", "signature": "pub mod headers;", "docs": "", "attributes": "", "line": 31 }, { "name": "server", "kind": "module", "signature": "pub mod server;", "docs": "", "attributes": "", "line": 32 }, { "name": "session", "kind": "module", "signature": "pub mod session;", "docs": "", "attributes": "", "line": 33 }, { "name": "transport", "kind": "module", "signature": "pub mod transport;", "docs": "", "attributes": "", "line": 34 }, { "name": "axum", "kind": "module", "signature": "pub mod axum;", "docs": "", "attributes": "#[cfg(feature = \"axum-integration\")]", "line": 37 }, { "name": "pub use headers::{HEADER_OPENAGENT_DID, HEADER_OPENAGENT_SESSION, OPENAGENT_AUTH_SCHEME};", "kind": "use_declaration", "signature": "pub use headers::{HEADER_OPENAGENT_DID, HEADER_OPENAGENT_SESSION, OPENAGENT_AUTH_SCHEME};", "docs": "", "attributes": "", "line": 39 }, { "name": "pub use transport::HttpTransport;", "kind": "use_declaration", "signature": "pub use transport::HttpTransport;", "docs": "", "attributes": "", "line": 40 }, { "name": "::VERSION", "kind": "const_item", "signature": "pub const VERSION: &str;", "docs": "Crate version.", "attributes": "", "line": 43 } ], "parseErrors": false }, { "module": "client", "source": "openagent-sdk/adapters/http/rust/src/client.rs", "sha256": "49ea43248efb494f9d157791b6f6359a1970209f8005fc34e38ea48925ef950a", "attributes": "", "items": [ { "name": "client::ClientConfig", "kind": "struct_item", "signature": "pub struct ClientConfig {\n/// The agent's DID. Reported to the server for audit and, where the\n\n/// deployment resolves DIDs, for trust-tier assignment. The agent proves\n\n/// possession of the key - lineage evaluation is the server's job.\n\npub did: String\n}", "docs": "Configuration for the HTTP auth client.", "attributes": "#[derive(Debug, Clone)]", "line": 24 }, { "name": "client::HttpAuthClient", "kind": "struct_item", "signature": "pub struct HttpAuthClient {\n\n}", "docs": "HTTP client that performs the Core Protocol identity flow over REST.", "attributes": "", "line": 32 }, { "name": "client::HttpAuthClient::new", "kind": "function_item", "signature": "pub fn new(\n config: ClientConfig,\n signing_key_bytes: &[u8; 32],\n ) -> Result;", "docs": "Creates a new HTTP auth client.\n\n# Arguments\n- `config`: Agent identity configuration\n- `signing_key_bytes`: 32-byte Ed25519 signing key", "attributes": "", "line": 44 }, { "name": "client::HttpAuthClient::with_client", "kind": "function_item", "signature": "pub fn with_client(\n config: ClientConfig,\n signing_key_bytes: &[u8; 32],\n client: reqwest::Client,\n ) -> Self;", "docs": "Creates a client with a custom `reqwest::Client`.", "attributes": "", "line": 58 }, { "name": "client::HttpAuthClient::authenticate", "kind": "function_item", "signature": "pub async fn authenticate(\n &self,\n base_url: &str,\n ) -> Result;", "docs": "Performs the full identity flow against the given base URL.\n\n1. Discovers the auth endpoint via `GET /.well-known/openagent`\n (tolerating discovery failure and falling back to the default path)\n2. Fetches an `openagent-challenge-v1` challenge\n3. Signs the JCS-canonical challenge bytes and proves\n4. Returns an [`AuthenticatedSession`] carrying the session token", "attributes": "", "line": 79 } ], "parseErrors": false }, { "module": "discovery", "source": "openagent-sdk/adapters/http/rust/src/discovery.rs", "sha256": "76dfb34252ff2196b5f6cb0c381771dba74eb929cf75c150dcad78d85744fb9c", "attributes": "", "items": [ { "name": "discovery::fetch_discovery", "kind": "function_item", "signature": "pub async fn fetch_discovery(\n http_client: &reqwest::Client,\n base_url: &str,\n) -> Result;", "docs": "Fetch the discovery document from a server.\n\nSends `GET /.well-known/openagent` and parses the response.", "attributes": "", "line": 14 }, { "name": "discovery::resolve_auth_endpoint", "kind": "function_item", "signature": "pub fn resolve_auth_endpoint(base_url: &str, doc: &DiscoveryDocument) -> String;", "docs": "Resolve the full auth endpoint URL from a base URL and discovery document.", "attributes": "", "line": 47 }, { "name": "discovery::resolve_prove_endpoint", "kind": "function_item", "signature": "pub fn resolve_prove_endpoint(base_url: &str, doc: &DiscoveryDocument) -> String;", "docs": "Resolve the prove endpoint URL (auth endpoint + `/prove`).", "attributes": "", "line": 54 } ], "parseErrors": false }, { "module": "headers", "source": "openagent-sdk/adapters/http/rust/src/headers.rs", "sha256": "8c24d4281714b6d4a9eae19e89a1e696427759aa9516860fa5542623e23935d4", "attributes": "", "items": [ { "name": "headers::OPENAGENT_AUTH_SCHEME", "kind": "const_item", "signature": "pub const OPENAGENT_AUTH_SCHEME: &str;", "docs": "The canonical authorization scheme for OpenAgent-authenticated requests,\nper the Core Protocol HTTP binding.", "attributes": "", "line": 11 }, { "name": "headers::HEADER_OPENAGENT_DID", "kind": "const_item", "signature": "pub const HEADER_OPENAGENT_DID: &str;", "docs": "Header carrying the authenticated agent's DID.", "attributes": "", "line": 14 }, { "name": "headers::HEADER_OPENAGENT_SESSION", "kind": "const_item", "signature": "pub const HEADER_OPENAGENT_SESSION: &str;", "docs": "Header carrying the session token (alternative to the Authorization\nheader for clients that cannot set it).", "attributes": "", "line": 18 }, { "name": "headers::CONTENT_TYPE_JSON", "kind": "const_item", "signature": "pub const CONTENT_TYPE_JSON: &str;", "docs": "Content-Type for all Core Protocol JSON payloads.", "attributes": "", "line": 21 }, { "name": "headers::extract_openagent_token", "kind": "function_item", "signature": "pub fn extract_openagent_token(authorization: &str) -> Option<&str>;", "docs": "Extract the session token from an `Authorization: OpenAgent `\nheader. Returns `None` if the header is missing, malformed, or uses a\ndifferent scheme.", "attributes": "", "line": 26 }, { "name": "headers::build_openagent_header", "kind": "function_item", "signature": "pub fn build_openagent_header(token: &str) -> String;", "docs": "Build an `Authorization: OpenAgent ` header value.", "attributes": "", "line": 42 }, { "name": "headers::build_challenge_header", "kind": "function_item", "signature": "pub fn build_challenge_header(challenge: &IdentityChallenge) -> String;", "docs": "Build a `WWW-Authenticate: OpenAgent challenge=\"\"` header value\nfor the reactive flow: the challenge object serialized and base64url\nencoded (per the HTTP binding, Section 4.3 of the specification).", "attributes": "", "line": 49 }, { "name": "headers::parse_challenge_header", "kind": "function_item", "signature": "pub fn parse_challenge_header(header_value: &str) -> Option;", "docs": "Decode a challenge from a `WWW-Authenticate` header value (client side of\nthe reactive flow).", "attributes": "", "line": 57 } ], "parseErrors": false }, { "module": "server", "source": "openagent-sdk/adapters/http/rust/src/server.rs", "sha256": "f5e13912bf968d446ee97104dfd709bc4dfae668cd06db2029c64eee261f1f5e", "attributes": "", "items": [ { "name": "server::ServerConfig", "kind": "struct_item", "signature": "pub struct ServerConfig {\n/// The server's origin per RFC 6454 (`scheme://host[:port]`). Bound into\n\n/// every challenge the server issues.\n\npub origin: String,\n/// Optional protection-space identifier.\n\npub realm: Option,\n/// The trust tier assigned to verified agents. Deployments with DID\n\n/// resolution and registry context assign higher tiers in their own\n\n/// policy layer; this adapter's default is key-possession-only.\n\npub trust_tier: TrustTier,\n/// Session TTL in seconds.\n\npub session_ttl_secs: u32,\n/// Challenge TTL in seconds.\n\npub challenge_ttl_secs: u32\n}", "docs": "Server configuration for the HTTP adapter.", "attributes": "#[derive(Debug, Clone)]", "line": 29 }, { "name": "server::ServerConfig::new", "kind": "function_item", "signature": "pub fn new(origin: impl Into) -> Self;", "docs": "Creates a new server configuration with sensible defaults.", "attributes": "", "line": 47 }, { "name": "server::ServerConfig::with_realm", "kind": "function_item", "signature": "pub fn with_realm(mut self, realm: impl Into) -> Self;", "docs": "Sets the protection-space identifier.", "attributes": "", "line": 58 }, { "name": "server::ServerConfig::with_trust_tier", "kind": "function_item", "signature": "pub fn with_trust_tier(mut self, tier: TrustTier) -> Self;", "docs": "Sets the trust tier assigned to verified agents.", "attributes": "", "line": 64 }, { "name": "server::ServerConfig::with_session_ttl", "kind": "function_item", "signature": "pub fn with_session_ttl(mut self, secs: u32) -> Self;", "docs": "Sets the session TTL.", "attributes": "", "line": 70 }, { "name": "server::ServerConfig::with_challenge_ttl", "kind": "function_item", "signature": "pub fn with_challenge_ttl(mut self, secs: u32) -> Self;", "docs": "Sets the challenge TTL.", "attributes": "", "line": 76 }, { "name": "server::handle_discovery", "kind": "function_item", "signature": "pub fn handle_discovery(config: &ServerConfig) -> DiscoveryDocument;", "docs": "Handle `GET /.well-known/openagent` \u2014 returns the discovery document.", "attributes": "", "line": 83 }, { "name": "server::handle_challenge", "kind": "function_item", "signature": "pub async fn handle_challenge(\n config: &ServerConfig,\n store: &S,\n) -> Result;", "docs": "Handle the challenge step \u2014 issue an [`IdentityChallenge`].\n\nCreates a fresh challenge per Section 4 and records a pending session\nkeyed by the nonce, so the proof step can find exactly one challenge to\nanswer and a nonce can never be answered twice.", "attributes": "", "line": 97 }, { "name": "server::handle_prove", "kind": "function_item", "signature": "pub async fn handle_prove(\n config: &ServerConfig,\n store: &S,\n proof: &IdentityProof,\n) -> Result;", "docs": "Handle the prove step \u2014 verify an [`IdentityProof`] and issue a session.\n\nVerification is normative-ordered: shape checks first (nonce echo, key\nlength per scheme), then the pending challenge (present, unexpired), then\nthe signature over the JCS-canonical challenge bytes. The nonce is\nconsumed on success *and* on signature failure - a failed answer must not\nbe retryable, or a verifier becomes an oracle.", "attributes": "", "line": 137 }, { "name": "server::validate_authenticated_request", "kind": "function_item", "signature": "pub async fn validate_authenticated_request(\n store: &S,\n session_token: &str,\n) -> Result;", "docs": "Validate an authenticated request by checking the session store.\n\nLooks up the session by its token, verifies it is established and not\nexpired, and returns it.", "attributes": "", "line": 256 } ], "parseErrors": false }, { "module": "session", "source": "openagent-sdk/adapters/http/rust/src/session.rs", "sha256": "ba53a721c939d4b67d6e8d1a17c097716926a28910a8ec424fba9bf88d35586b", "attributes": "", "items": [ { "name": "session::AuthenticatedSession", "kind": "struct_item", "signature": "pub struct AuthenticatedSession {\n\n}", "docs": "An authenticated HTTP session obtained after a successful OAAP handshake.\n\nWraps a `reqwest::Client` and attaches the `Authorization: OAS `,\n`X-OpenAgent-DID`, and `X-OpenAgent-Session` headers to every request.", "attributes": "#[derive(Debug, Clone)]", "line": 17 }, { "name": "session::AuthenticatedSession::new", "kind": "function_item", "signature": "pub fn new(\n client: reqwest::Client,\n base_url: String,\n session_id: String,\n peer_did: String,\n session_token: String,\n expires_at: i64,\n ) -> Self;", "docs": "Creates a new authenticated session.", "attributes": "", "line": 30 }, { "name": "session::AuthenticatedSession::is_expired", "kind": "function_item", "signature": "pub fn is_expired(&self) -> bool;", "docs": "Returns true if the session has expired.", "attributes": "", "line": 49 }, { "name": "session::AuthenticatedSession::session_id", "kind": "function_item", "signature": "pub fn session_id(&self) -> &str;", "docs": "Returns the session ID.", "attributes": "", "line": 54 }, { "name": "session::AuthenticatedSession::peer_did", "kind": "function_item", "signature": "pub fn peer_did(&self) -> &str;", "docs": "Returns the peer DID.", "attributes": "", "line": 59 }, { "name": "session::AuthenticatedSession::base_url", "kind": "function_item", "signature": "pub fn base_url(&self) -> &str;", "docs": "Returns the base URL of the authenticated server.", "attributes": "", "line": 64 }, { "name": "session::AuthenticatedSession::get", "kind": "function_item", "signature": "pub async fn get(&self, path: &str) -> Result;", "docs": "Sends an authenticated GET request.", "attributes": "", "line": 69 }, { "name": "session::AuthenticatedSession::post", "kind": "function_item", "signature": "pub async fn post(\n &self,\n path: &str,\n body: &impl serde::Serialize,\n ) -> Result;", "docs": "Sends an authenticated POST request with a JSON body.", "attributes": "", "line": 84 }, { "name": "session::AuthenticatedSession::put", "kind": "function_item", "signature": "pub async fn put(\n &self,\n path: &str,\n body: &impl serde::Serialize,\n ) -> Result;", "docs": "Sends an authenticated PUT request with a JSON body.", "attributes": "", "line": 104 }, { "name": "session::AuthenticatedSession::delete", "kind": "function_item", "signature": "pub async fn delete(&self, path: &str) -> Result;", "docs": "Sends an authenticated DELETE request.", "attributes": "", "line": 124 } ], "parseErrors": false }, { "module": "transport", "source": "openagent-sdk/adapters/http/rust/src/transport.rs", "sha256": "3c74f3a12577b95f58fdecb1da9c390d554f6bf1df536c197a4c1a322e16dc1c", "attributes": "", "items": [ { "name": "transport::HttpTransport", "kind": "struct_item", "signature": "pub struct HttpTransport {\n\n}", "docs": "HTTP transport carrying the identity flow over REST.\n\nThe challenge is fetched with `POST ` and the proof with\n`POST /prove`, per the HTTP binding's proactive form. The\nreactive form (`401` + `WWW-Authenticate`) is handled by the client, which\nalso understands challenge headers.", "attributes": "", "line": 16 }, { "name": "transport::HttpTransport::new", "kind": "function_item", "signature": "pub fn new(client: reqwest::Client) -> Self;", "docs": "Creates a new HTTP transport with the given `reqwest` client.", "attributes": "", "line": 22 }, { "name": "transport::HttpTransport::with_defaults", "kind": "function_item", "signature": "pub fn with_defaults() -> Result;", "docs": "Creates a new HTTP transport with a default client.", "attributes": "", "line": 27 }, { "name": "transport::HttpTransport::inner", "kind": "function_item", "signature": "pub fn inner(&self) -> &reqwest::Client;", "docs": "Returns a reference to the inner reqwest client.", "attributes": "", "line": 38 } ], "parseErrors": false }, { "module": "axum", "source": "openagent-sdk/adapters/http/rust/src/axum.rs", "sha256": "cfdd6182f5b3b456e5e000560b61735b50ac4bd786b8dae6dddb65a1157766e8", "attributes": "#[cfg(feature = \"axum-integration\")]", "items": [ { "name": "axum::OpenAgentState", "kind": "struct_item", "signature": "pub struct OpenAgentState {\n/// The server configuration (origin, realm, TTLs, trust tier).\n\npub config: Arc\n}", "docs": "Shared state for the Axum integration.", "attributes": "#[cfg(feature = \"axum-integration\")]\n#[derive(Clone)]", "line": 35 }, { "name": "axum::OpenAgentState::new", "kind": "function_item", "signature": "pub fn new(config: ServerConfig, store: S) -> Self;", "docs": "Creates a new integration state.", "attributes": "#[cfg(feature = \"axum-integration\")]", "line": 43 }, { "name": "axum::OpenAgentState::store", "kind": "function_item", "signature": "pub fn store(&self) -> &S;", "docs": "The session store.", "attributes": "#[cfg(feature = \"axum-integration\")]", "line": 51 }, { "name": "axum::OpenAgentExtractor", "kind": "struct_item", "signature": "pub struct OpenAgentExtractor {\n\n}", "docs": "Axum extractor providing the authenticated agent context.\n\nRoutes can take this as an argument to get the verified session.", "attributes": "#[cfg(feature = \"axum-integration\")]\n#[derive(Debug, Clone)]", "line": 60 }, { "name": "axum::OpenAgentExtractor::peer_did", "kind": "function_item", "signature": "pub fn peer_did(&self) -> &str;", "docs": "Returns the authenticated agent's DID (or presented-key placeholder\nuntil a resolver names it).", "attributes": "#[cfg(feature = \"axum-integration\")]", "line": 67 }, { "name": "axum::OpenAgentExtractor::session_token", "kind": "function_item", "signature": "pub fn session_token(&self) -> &str;", "docs": "Returns the session token.", "attributes": "#[cfg(feature = \"axum-integration\")]", "line": 72 }, { "name": "axum::OpenAgentExtractor::session", "kind": "function_item", "signature": "pub fn session(&self) -> &Session;", "docs": "Returns the underlying session.", "attributes": "#[cfg(feature = \"axum-integration\")]", "line": 77 }, { "name": "axum::core_routes", "kind": "function_item", "signature": "pub fn core_routes(state: OpenAgentState) -> Router\nwhere\n S: SessionStore + Clone + Send + Sync + 'static,;", "docs": "Build an Axum router with the well-known endpoints:\n\n- `GET /.well-known/openagent` \u2014 discovery\n- `POST /.well-known/openagent/auth` \u2014 issue an [`openagent_auth_protocol::message::IdentityChallenge`]\n- `POST /.well-known/openagent/auth/prove` \u2014 verify an [`IdentityProof`], return [`IdentityVerified`]", "attributes": "#[cfg(feature = \"axum-integration\")]", "line": 154 }, { "name": "axum::protected_router", "kind": "function_item", "signature": "pub fn protected_router(\n state: OpenAgentState,\n app_routes: Router>,\n) -> Router\nwhere\n S: SessionStore + Clone + Send + Sync + 'static,;", "docs": "Convenience: merge the well-known endpoints with application routes.", "attributes": "#[cfg(feature = \"axum-integration\")]", "line": 207 } ], "parseErrors": false } ] }, { "name": "openagent-weave", "url": "/reference/rust/openagent-weave", "modules": [ { "module": "crate", "source": "openagent-sdk/adapters/weave/src/lib.rs", "sha256": "f6ff34beea33ace1e6cf696d32d2ae99a199db8044efea61e6dad53ed3b486a9", "attributes": "", "items": [ { "name": "codec", "kind": "module", "signature": "pub mod codec;", "docs": "", "attributes": "", "line": 44 }, { "name": "config", "kind": "module", "signature": "pub mod config;", "docs": "", "attributes": "", "line": 45 }, { "name": "error", "kind": "module", "signature": "pub mod error;", "docs": "", "attributes": "", "line": 46 }, { "name": "handler", "kind": "module", "signature": "pub mod handler;", "docs": "", "attributes": "", "line": 47 }, { "name": "peer_auth", "kind": "module", "signature": "pub mod peer_auth;", "docs": "", "attributes": "", "line": 48 }, { "name": "protocol", "kind": "module", "signature": "pub mod protocol;", "docs": "", "attributes": "", "line": 49 }, { "name": "transport", "kind": "module", "signature": "pub mod transport;", "docs": "", "attributes": "", "line": 50 }, { "name": "pub use config::WeaveAuthConfig;", "kind": "use_declaration", "signature": "pub use config::WeaveAuthConfig;", "docs": "", "attributes": "", "line": 52 }, { "name": "pub use error::WeaveAuthError;", "kind": "use_declaration", "signature": "pub use error::WeaveAuthError;", "docs": "", "attributes": "", "line": 53 }, { "name": "pub use handler::HandshakeHandler;", "kind": "use_declaration", "signature": "pub use handler::HandshakeHandler;", "docs": "", "attributes": "", "line": 54 }, { "name": "pub use peer_auth::{PeerAuthState, PeerAuthStore};", "kind": "use_declaration", "signature": "pub use peer_auth::{PeerAuthState, PeerAuthStore};", "docs": "", "attributes": "", "line": 55 }, { "name": "pub use protocol::{\n HandshakeRequest, HandshakeResponse, WeaveAuthBehaviour, WeaveAuthEvent,\n OPENAGENT_AUTH_PROTOCOL,\n};", "kind": "use_declaration", "signature": "pub use protocol::{\n HandshakeRequest, HandshakeResponse, WeaveAuthBehaviour, WeaveAuthEvent,\n OPENAGENT_AUTH_PROTOCOL,\n};", "docs": "", "attributes": "", "line": 56 }, { "name": "pub use transport::WeaveTransport;", "kind": "use_declaration", "signature": "pub use transport::WeaveTransport;", "docs": "", "attributes": "", "line": 60 } ], "parseErrors": false }, { "module": "codec", "source": "openagent-sdk/adapters/weave/src/codec.rs", "sha256": "c1222db288f0ca8462a02dae8e4f495fba541a82674aeb6ad504e0ecb43d27e8", "attributes": "", "items": [ { "name": "codec::CborCodec", "kind": "struct_item", "signature": "pub struct CborCodec {\n\n}", "docs": "CBOR codec for OpenAgent auth handshake messages.", "attributes": "#[derive(Debug, Clone)]", "line": 28 }, { "name": "codec::CborCodec::new", "kind": "function_item", "signature": "pub fn new(config: &WeaveAuthConfig) -> Self;", "docs": "Creates a new codec with the given maximum message size.", "attributes": "", "line": 34 }, { "name": "codec::encode_frame", "kind": "function_item", "signature": "pub fn encode_frame(value: &T, max_size: usize) -> Result, WeaveAuthError>;", "docs": "Encode a CBOR message with a 4-byte big-endian length prefix.", "attributes": "", "line": 50 }, { "name": "codec::decode_frame", "kind": "function_item", "signature": "pub fn decode_frame(\n data: &[u8],\n max_size: usize,\n) -> Result;", "docs": "Decode a length-prefixed CBOR message from a byte buffer.", "attributes": "", "line": 69 } ], "parseErrors": false }, { "module": "config", "source": "openagent-sdk/adapters/weave/src/config.rs", "sha256": "fe5a6919e4eb79da3f988e096b7a6fb5544d2f0a8812ba26cf610afd9b7fbca5", "attributes": "", "items": [ { "name": "config::WeaveAuthConfig", "kind": "struct_item", "signature": "pub struct WeaveAuthConfig {\n/// Maximum size of a single CBOR-encoded message frame, in bytes.\n\n/// Prevents memory exhaustion from malicious peers.\n\n/// Default: 64 KiB.\n\npub max_message_size: usize,\n/// How long to wait for each handshake round trip before timing out.\n\n/// Default: 30 seconds.\n\npub handshake_timeout: Duration,\n/// How long an established session remains valid.\n\n/// Default: 1 hour.\n\npub session_ttl: Duration,\n/// Maximum number of concurrent pending handshakes.\n\n/// Default: 128.\n\npub max_pending_handshakes: usize,\n/// How long a challenge remains valid before the initiator must send PROVE.\n\n/// Default: 60 seconds.\n\npub challenge_ttl: Duration\n}", "docs": "Configuration for the Weave OAAP protocol adapter.", "attributes": "#[derive(Debug, Clone)]", "line": 8 }, { "name": "config::WeaveAuthConfig::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Creates a new config with default values.", "attributes": "", "line": 45 }, { "name": "config::WeaveAuthConfig::with_max_message_size", "kind": "function_item", "signature": "pub fn with_max_message_size(mut self, size: usize) -> Self;", "docs": "Sets the maximum message size.", "attributes": "", "line": 50 }, { "name": "config::WeaveAuthConfig::with_handshake_timeout", "kind": "function_item", "signature": "pub fn with_handshake_timeout(mut self, timeout: Duration) -> Self;", "docs": "Sets the handshake timeout.", "attributes": "", "line": 56 }, { "name": "config::WeaveAuthConfig::with_session_ttl", "kind": "function_item", "signature": "pub fn with_session_ttl(mut self, ttl: Duration) -> Self;", "docs": "Sets the session TTL.", "attributes": "", "line": 62 }, { "name": "config::WeaveAuthConfig::with_max_pending_handshakes", "kind": "function_item", "signature": "pub fn with_max_pending_handshakes(mut self, max: usize) -> Self;", "docs": "Sets the maximum number of concurrent pending handshakes.", "attributes": "", "line": 68 }, { "name": "config::WeaveAuthConfig::with_challenge_ttl", "kind": "function_item", "signature": "pub fn with_challenge_ttl(mut self, ttl: Duration) -> Self;", "docs": "Sets the challenge TTL.", "attributes": "", "line": 74 } ], "parseErrors": false }, { "module": "error", "source": "openagent-sdk/adapters/weave/src/error.rs", "sha256": "93dc23119a78ed4187935042cb3b6cce37c59b653a44c0b1390b9dfc3aa5f250", "attributes": "", "items": [ { "name": "error::WeaveAuthError", "kind": "enum_item", "signature": "pub enum WeaveAuthError {\n /// CBOR encoding or decoding failed.\n #[error(\"cbor codec error: {0}\")]\n Codec(String),\n\n /// Message exceeds the configured maximum frame size.\n #[error(\"message too large: {size} bytes exceeds limit of {limit} bytes\")]\n MessageTooLarge {\n /// Actual message size in bytes.\n size: usize,\n /// Configured maximum.\n limit: usize,\n },\n\n /// No established auth session for the given peer.\n #[error(\"peer not authenticated: {peer_id}\")]\n PeerNotAuthenticated {\n /// The libp2p peer ID.\n peer_id: String,\n },\n\n /// A handshake is already in progress for this peer.\n #[error(\"handshake already in progress for peer: {peer_id}\")]\n HandshakeInProgress {\n /// The libp2p peer ID.\n peer_id: String,\n },\n\n /// The handshake timed out waiting for a response.\n #[error(\"handshake timeout after {elapsed_ms}ms\")]\n Timeout {\n /// Milliseconds elapsed before timeout.\n elapsed_ms: u64,\n },\n\n /// Received an unexpected message type for the current handshake state.\n #[error(\"unexpected message: expected {expected}, got {actual}\")]\n UnexpectedMessage {\n /// What was expected.\n expected: String,\n /// What was received.\n actual: String,\n },\n\n /// Error from the underlying OAAP protocol layer.\n #[error(\"auth protocol error: {0}\")]\n Protocol(#[from] openagent_auth_protocol::AuthProtocolError),\n\n /// libp2p dial or connection error.\n #[error(\"connection error: {0}\")]\n Connection(String),\n\n /// Internal error.\n #[error(\"internal error: {0}\")]\n Internal(String),\n}", "docs": "Errors specific to the Weave/libp2p OAAP adapter.", "attributes": "#[derive(Debug, Error)]", "line": 8 } ], "parseErrors": false }, { "module": "handler", "source": "openagent-sdk/adapters/weave/src/handler.rs", "sha256": "2ad6b50295c742b7653914b2efde11a8675a44d569a7e2038e03a82f33dd3ea7", "attributes": "", "items": [ { "name": "handler::HandshakeHandler", "kind": "struct_item", "signature": "pub struct HandshakeHandler {\n\n}", "docs": "Orchestrates OAAP handshakes for both initiator and responder roles.\n\nThe handler holds references to the peer auth store and session store,\nand coordinates the multi-step handshake against the swarm's\n`WeaveAuthBehaviour`.", "attributes": "", "line": 31 }, { "name": "handler::HandshakeHandler::new", "kind": "function_item", "signature": "pub fn new(config: WeaveAuthConfig, local_did: String) -> Self;", "docs": "Creates a new handler.", "attributes": "", "line": 41 }, { "name": "handler::HandshakeHandler::with_session_store", "kind": "function_item", "signature": "pub fn with_session_store(\n config: WeaveAuthConfig,\n local_did: String,\n session_store: Arc,\n ) -> Self;", "docs": "Creates a handler with an external session store.", "attributes": "", "line": 51 }, { "name": "handler::HandshakeHandler::peer_store", "kind": "function_item", "signature": "pub fn peer_store(&self) -> &PeerAuthStore;", "docs": "Returns a reference to the peer auth store.", "attributes": "", "line": 65 }, { "name": "handler::HandshakeHandler::local_did", "kind": "function_item", "signature": "pub fn local_did(&self) -> &str;", "docs": "Returns the local DID.", "attributes": "", "line": 70 }, { "name": "handler::HandshakeHandler::initiate", "kind": "function_item", "signature": "pub fn initiate(\n &self,\n behaviour: &mut WeaveAuthBehaviour,\n peer: &PeerId,\n present: PresentMessage,\n ) -> Result;", "docs": "Initiate a handshake with a remote peer (Step 1: send PRESENT).\n\nReturns the `OutboundRequestId` for tracking the challenge response.", "attributes": "", "line": 81 }, { "name": "handler::HandshakeHandler::handle_challenge", "kind": "function_item", "signature": "pub fn handle_challenge(\n &self,\n peer: &PeerId,\n challenge: &ChallengeMessage,\n ) -> Result<(), WeaveAuthError>;", "docs": "Process a CHALLENGE response from the responder (received after PRESENT).\n\nReturns the challenge message for the caller to sign and build a PROVE.", "attributes": "", "line": 105 }, { "name": "handler::HandshakeHandler::send_prove", "kind": "function_item", "signature": "pub fn send_prove(\n &self,\n behaviour: &mut WeaveAuthBehaviour,\n peer: &PeerId,\n prove: ProveMessage,\n ) -> Result;", "docs": "Send Step 3 (PROVE) to the responder.", "attributes": "", "line": 132 }, { "name": "handler::HandshakeHandler::handle_established", "kind": "function_item", "signature": "pub fn handle_established(\n &self,\n peer: &PeerId,\n established: &EstablishedMessage,\n ) -> Result<(), WeaveAuthError>;", "docs": "Process an ESTABLISHED response (received after PROVE).", "attributes": "", "line": 144 }, { "name": "handler::HandshakeHandler::handle_present", "kind": "function_item", "signature": "pub async fn handle_present(\n &self,\n peer: &PeerId,\n present: &PresentMessage,\n ) -> Result;", "docs": "Handle an inbound PRESENT request (Step 1 from a remote initiator).\n\nReturns a `ChallengeMessage` to send back.", "attributes": "", "line": 186 }, { "name": "handler::HandshakeHandler::handle_prove", "kind": "function_item", "signature": "pub async fn handle_prove(\n &self,\n peer: &PeerId,\n prove: &ProveMessage,\n ) -> Result;", "docs": "Handle an inbound PROVE request (Step 3 from a remote initiator).\n\nReturns an `EstablishedMessage` on success.", "attributes": "", "line": 246 }, { "name": "handler::HandshakeHandler::respond", "kind": "function_item", "signature": "pub fn respond(\n &self,\n behaviour: &mut WeaveAuthBehaviour,\n channel: ResponseChannel,\n response: HandshakeResponse,\n ) -> Result<(), WeaveAuthError>;", "docs": "Respond to an inbound request on its response channel.", "attributes": "", "line": 322 } ], "parseErrors": false }, { "module": "peer_auth", "source": "openagent-sdk/adapters/weave/src/peer_auth.rs", "sha256": "1d288e2675cff08c6905e3ec68b20bf61d08dc8501d838e8954cb839871c0fe0", "attributes": "", "items": [ { "name": "peer_auth::PeerAuthState", "kind": "struct_item", "signature": "pub struct PeerAuthState {\n/// The authenticated DID of the peer.\n\npub did: String,\n/// The session ID from the ESTABLISHED step.\n\npub session_id: String,\n/// When the session was established.\n\npub established_at: Instant,\n/// When the session expires.\n\npub expires_at: Instant,\n/// Current state of the handshake.\n\npub phase: HandshakePhase\n}", "docs": "Authentication state for a single peer.", "attributes": "#[derive(Debug, Clone)]", "line": 17 }, { "name": "peer_auth::HandshakePhase", "kind": "enum_item", "signature": "pub enum HandshakePhase {\n /// PRESENT sent, awaiting CHALLENGE.\n PresentSent,\n /// CHALLENGE issued by us, awaiting PROVE.\n ChallengeIssued,\n /// PROVE sent, awaiting ESTABLISHED.\n ProveSent,\n /// Handshake complete.\n Established,\n}", "docs": "Which phase of the handshake this peer is in.", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq)]", "line": 32 }, { "name": "peer_auth::PeerAuthState::is_valid", "kind": "function_item", "signature": "pub fn is_valid(&self) -> bool;", "docs": "Returns `true` if the session is established and not expired.", "attributes": "", "line": 45 }, { "name": "peer_auth::PeerAuthState::is_expired", "kind": "function_item", "signature": "pub fn is_expired(&self) -> bool;", "docs": "Returns `true` if the session has expired.", "attributes": "", "line": 50 }, { "name": "peer_auth::PeerAuthStore", "kind": "struct_item", "signature": "pub struct PeerAuthStore {\n\n}", "docs": "Thread-safe store for per-peer authentication state.\n\nKeyed by libp2p `PeerId`. Handles concurrent access from the swarm event\nloop and application code.", "attributes": "#[derive(Debug, Clone, Default)]", "line": 60 }, { "name": "peer_auth::PeerAuthStore::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Creates a new empty peer auth store.", "attributes": "", "line": 66 }, { "name": "peer_auth::PeerAuthStore::put", "kind": "function_item", "signature": "pub fn put(&self, peer: PeerId, state: PeerAuthState) -> Result<(), WeaveAuthError>;", "docs": "Record or update a peer's auth state.", "attributes": "", "line": 71 }, { "name": "peer_auth::PeerAuthStore::get", "kind": "function_item", "signature": "pub fn get(&self, peer: &PeerId) -> Result, WeaveAuthError>;", "docs": "Retrieve a peer's auth state.", "attributes": "", "line": 81 }, { "name": "peer_auth::PeerAuthStore::remove", "kind": "function_item", "signature": "pub fn remove(&self, peer: &PeerId) -> Result<(), WeaveAuthError>;", "docs": "Remove a peer's auth state (on disconnect or session revocation).", "attributes": "", "line": 90 }, { "name": "peer_auth::PeerAuthStore::is_authenticated", "kind": "function_item", "signature": "pub fn is_authenticated(&self, peer: &PeerId) -> bool;", "docs": "Returns `true` if the peer has a valid, non-expired established session.", "attributes": "", "line": 100 }, { "name": "peer_auth::PeerAuthStore::gc_expired", "kind": "function_item", "signature": "pub fn gc_expired(&self) -> Result;", "docs": "Remove all expired sessions. Returns the number removed.", "attributes": "", "line": 108 }, { "name": "peer_auth::PeerAuthStore::len", "kind": "function_item", "signature": "pub fn len(&self) -> usize;", "docs": "Returns the number of peers in the store.", "attributes": "", "line": 119 }, { "name": "peer_auth::PeerAuthStore::is_empty", "kind": "function_item", "signature": "pub fn is_empty(&self) -> bool;", "docs": "Returns `true` if the store has no entries.", "attributes": "", "line": 124 } ], "parseErrors": false }, { "module": "protocol", "source": "openagent-sdk/adapters/weave/src/protocol.rs", "sha256": "bd8735b2415d92f289459b6292df66aa1501a366a3ea8309a654f9093b07a8bd", "attributes": "", "items": [ { "name": "protocol::OPENAGENT_AUTH_PROTOCOL", "kind": "const_item", "signature": "pub const OPENAGENT_AUTH_PROTOCOL: &str;", "docs": "The protocol identifier for OpenAgent auth on libp2p.", "attributes": "", "line": 21 }, { "name": "protocol::HandshakeRequest", "kind": "enum_item", "signature": "pub enum HandshakeRequest {\n /// Step 1: Initiator presents identity.\n Present(PresentMessage),\n /// Step 3: Initiator proves ownership of the DID private key.\n Prove(ProveMessage),\n}", "docs": "A handshake request (sent by the initiator).\n\nMaps to Steps 1 (PRESENT) and 3 (PROVE) of the OAAP handshake.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 31 }, { "name": "protocol::HandshakeResponse", "kind": "enum_item", "signature": "pub enum HandshakeResponse {\n /// Step 2: Responder issues a challenge.\n Challenge(ChallengeMessage),\n /// Step 4: Authentication established.\n Established(EstablishedMessage),\n /// Error during handshake \u2014 the responder rejected the request.\n Error {\n /// Machine-readable error code.\n code: String,\n /// Human-readable reason.\n reason: String,\n },\n}", "docs": "A handshake response (sent by the responder).\n\nMaps to Steps 2 (CHALLENGE) and 4 (ESTABLISHED) of the OAAP handshake.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 42 }, { "name": "protocol::WeaveAuthEvent", "kind": "type_item", "signature": "pub type WeaveAuthEvent = request_response::Event;", "docs": "Events emitted by [`WeaveAuthBehaviour`].", "attributes": "", "line": 61 }, { "name": "protocol::WeaveAuthBehaviour", "kind": "type_item", "signature": "pub type WeaveAuthBehaviour = request_response::Behaviour;", "docs": "libp2p `NetworkBehaviour` for the OpenAgent auth protocol.\n\nThis is a thin wrapper around `request_response::Behaviour` configured with\nthe CBOR codec and the `/openagent/auth/1.0.0` protocol. Compose it into\nyour swarm alongside other behaviours (Kademlia, Identify, etc.).\n\n# Example\n\n```ignore\nuse openagent_weave::{WeaveAuthBehaviour, WeaveAuthConfig};\n\nlet config = WeaveAuthConfig::default();\nlet auth_behaviour = WeaveAuthBehaviour::new(config);\n// Include `auth_behaviour` in your composed NetworkBehaviour struct.\n```", "attributes": "", "line": 78 }, { "name": "protocol::new_behaviour", "kind": "function_item", "signature": "pub fn new_behaviour(config: &WeaveAuthConfig) -> WeaveAuthBehaviour;", "docs": "Create a new [`WeaveAuthBehaviour`] with the given configuration.\n\nBoth inbound and outbound support is enabled so the node can both\ninitiate and accept handshakes.", "attributes": "", "line": 84 }, { "name": "protocol::send_request", "kind": "function_item", "signature": "pub fn send_request(\n behaviour: &mut WeaveAuthBehaviour,\n peer: &PeerId,\n request: HandshakeRequest,\n) -> request_response::OutboundRequestId;", "docs": "Send a handshake request to a specific peer.\n\nReturns the `OutboundRequestId` for correlating the response.", "attributes": "", "line": 100 }, { "name": "protocol::send_response", "kind": "function_item", "signature": "pub fn send_response(\n behaviour: &mut WeaveAuthBehaviour,\n channel: request_response::ResponseChannel,\n response: HandshakeResponse,\n) -> Result<(), HandshakeResponse>;", "docs": "Send a handshake response for an inbound request.\n\n`channel` comes from the `request_response::Event::Message::Request` variant.", "attributes": "", "line": 111 } ], "parseErrors": false }, { "module": "transport", "source": "openagent-sdk/adapters/weave/src/transport.rs", "sha256": "411d7607bb9534c7e74a73f86b1e2cb1e5bd20371a1fa3bf9743c5143e259ee6", "attributes": "", "items": [ { "name": "transport::TransportCommand", "kind": "enum_item", "signature": "pub enum TransportCommand {\n /// Send a request to a peer and receive the response asynchronously.\n SendRequest {\n /// Target peer.\n peer: PeerId,\n /// The handshake request to send.\n request: HandshakeRequest,\n /// Channel to receive the response.\n reply: oneshot::Sender>,\n },\n}", "docs": "A command sent from [`WeaveTransport`] to the swarm event loop.", "attributes": "#[derive(Debug)]", "line": 30 }, { "name": "transport::WeaveTransport", "kind": "struct_item", "signature": "pub struct WeaveTransport {\n\n}", "docs": "`AuthTransport` implementation for Weave/libp2p.\n\nThe transport sends commands through a channel that the swarm event loop\nconsumes. This decouples the async transport API from the swarm poll loop.\n\n# Usage\n\n```ignore\nuse openagent_weave::{WeaveTransport, WeaveAuthConfig};\n\nlet (tx, rx) = tokio::sync::mpsc::channel(64);\nlet transport = WeaveTransport::new(config, tx, peer_store);\n\n// In the swarm loop, consume `rx` and call the behaviour.\n```", "attributes": "", "line": 57 }, { "name": "transport::WeaveTransport::new", "kind": "function_item", "signature": "pub fn new(\n config: WeaveAuthConfig,\n command_tx: mpsc::Sender,\n peer_store: PeerAuthStore,\n ) -> Self;", "docs": "Creates a new Weave transport.", "attributes": "", "line": 68 }, { "name": "transport::WeaveTransport::register_peer", "kind": "function_item", "signature": "pub async fn register_peer(&self, endpoint: &str, peer: PeerId);", "docs": "Register a mapping from an endpoint/DID string to a libp2p `PeerId`.\n\nThe `present` and `prove` methods accept an `endpoint` parameter. For\nWeave, this should be the peer's base58 PeerId or DID string. Register\nthe mapping here so the transport knows where to route.", "attributes": "", "line": 86 }, { "name": "transport::WeaveTransport::peer_store", "kind": "function_item", "signature": "pub fn peer_store(&self) -> &PeerAuthStore;", "docs": "Returns the peer auth store.", "attributes": "", "line": 92 } ], "parseErrors": false } ] }, { "name": "openagent-ws", "url": "/reference/rust/openagent-ws", "modules": [ { "module": "crate", "source": "openagent-sdk/adapters/websocket/rust/src/lib.rs", "sha256": "d6f1fc27284f118a123a7d0274dbc44542c94225a3b7b5c1dd2635d6276c4348", "attributes": "", "items": [ { "name": "client", "kind": "module", "signature": "pub mod client;", "docs": "", "attributes": "", "line": 56 }, { "name": "error", "kind": "module", "signature": "pub mod error;", "docs": "", "attributes": "", "line": 57 }, { "name": "frame", "kind": "module", "signature": "pub mod frame;", "docs": "", "attributes": "", "line": 58 }, { "name": "server", "kind": "module", "signature": "pub mod server;", "docs": "", "attributes": "", "line": 59 }, { "name": "session", "kind": "module", "signature": "pub mod session;", "docs": "", "attributes": "", "line": 60 }, { "name": "transport", "kind": "module", "signature": "pub mod transport;", "docs": "", "attributes": "", "line": 61 }, { "name": "pub use client::OpenAgentWsClient;", "kind": "use_declaration", "signature": "pub use client::OpenAgentWsClient;", "docs": "", "attributes": "", "line": 65 }, { "name": "pub use error::{Result, WsError};", "kind": "use_declaration", "signature": "pub use error::{Result, WsError};", "docs": "", "attributes": "", "line": 66 }, { "name": "pub use server::OpenAgentWsHandler;", "kind": "use_declaration", "signature": "pub use server::OpenAgentWsHandler;", "docs": "", "attributes": "", "line": 67 }, { "name": "pub use session::AuthenticatedSession;", "kind": "use_declaration", "signature": "pub use session::AuthenticatedSession;", "docs": "", "attributes": "", "line": 68 }, { "name": "::VERSION", "kind": "const_item", "signature": "pub const VERSION: &str;", "docs": "Crate version sourced from `Cargo.toml`.", "attributes": "", "line": 71 } ], "parseErrors": false }, { "module": "client", "source": "openagent-sdk/adapters/websocket/rust/src/client.rs", "sha256": "5b7d51d6bb8196d5dd39e33066f06351acf39ffd8fc5c6515ab90244d02e4405", "attributes": "", "items": [ { "name": "client::OpenAgentWsClient", "kind": "struct_item", "signature": "pub struct OpenAgentWsClient {\n\n}", "docs": "Client-side OAAP WebSocket connector.\n\nHolds the client's identity material. Call [`connect`](Self::connect) to\nopen a WebSocket, run the 4-step OAAP handshake, and receive an\nauthenticated session.", "attributes": "", "line": 31 }, { "name": "client::OpenAgentWsClient::new", "kind": "function_item", "signature": "pub fn new(did: impl Into, signing_key: [u8; 32], verifying_key: [u8; 32]) -> Self;", "docs": "Creates a new client with the given identity.", "attributes": "", "line": 40 }, { "name": "client::OpenAgentWsClient::with_timeout", "kind": "function_item", "signature": "pub fn with_timeout(mut self, duration: Duration) -> Self;", "docs": "Overrides the per-step handshake timeout (default: 5s).", "attributes": "", "line": 50 }, { "name": "client::OpenAgentWsClient::connect", "kind": "function_item", "signature": "pub async fn connect(&self, url: &str) -> Result>;", "docs": "Opens a WebSocket connection to `url` and runs the 4-step OAAP handshake.\n\nReturns an [`AuthenticatedSession`] on success.", "attributes": "", "line": 58 } ], "parseErrors": false }, { "module": "error", "source": "openagent-sdk/adapters/websocket/rust/src/error.rs", "sha256": "3c5f2de60af23894205f0c60779c9c69b974b370ae0703181c36e6641099b82c", "attributes": "", "items": [ { "name": "error::WsError", "kind": "enum_item", "signature": "pub enum WsError {\n /// The WebSocket connection was closed before the handshake completed.\n #[error(\"WebSocket closed during OAAP handshake at step {step}\")]\n HandshakeClosed {\n /// Which step (1-4) was in progress when the close occurred.\n step: u8,\n },\n\n /// An unexpected frame type was received during the handshake.\n #[error(\"unexpected OAAP frame type: expected {expected}, got {actual}\")]\n UnexpectedFrameType {\n /// Expected `oaap:*` type.\n expected: &'static str,\n /// Received type string.\n actual: String,\n },\n\n /// A timeout expired waiting for a handshake response.\n #[error(\"OAAP handshake timed out at step {step} after {timeout_ms}ms\")]\n HandshakeTimeout {\n /// Which step timed out.\n step: u8,\n /// Timeout duration in milliseconds.\n timeout_ms: u64,\n },\n\n /// JSON serialization or deserialization failed.\n #[error(\"JSON error: {0}\")]\n Json(#[from] serde_json::Error),\n\n /// The underlying WebSocket transport returned an error.\n #[error(\"WebSocket transport error: {0}\")]\n Transport(String),\n\n /// A cryptographic operation failed during handshake or message processing.\n #[error(\"crypto error: {0}\")]\n Crypto(#[from] openagent_crypto_wasm::CryptoError),\n\n /// Ed25519 signature verification failed on a handshake frame.\n #[error(\"OAAP authentication failed: {reason}\")]\n AuthFailed {\n /// Why authentication was rejected.\n reason: String,\n },\n\n /// The session has been invalidated or was never established.\n #[error(\"no active OAAP session\")]\n NoSession,\n\n /// The session ID on an incoming message did not match the established session.\n #[error(\"session ID mismatch: expected {expected}, got {actual}\")]\n SessionMismatch {\n /// Expected session ID (hex).\n expected: String,\n /// Received session ID (hex).\n actual: String,\n },\n\n /// AEAD decryption of a message payload failed.\n #[error(\"message decryption failed: {0}\")]\n DecryptionFailed(String),\n}", "docs": "Errors from the OpenAgent WebSocket adapter.", "attributes": "#[derive(Debug, Error)]", "line": 9 }, { "name": "error::Result", "kind": "type_item", "signature": "pub type Result = std::result::Result;", "docs": "Convenience alias.", "attributes": "", "line": 79 } ], "parseErrors": false }, { "module": "frame", "source": "openagent-sdk/adapters/websocket/rust/src/frame.rs", "sha256": "1dd6eb684a375c0c9733fc171a312b0703495370fa7ed8cfc0a5ee9a886c250f", "attributes": "", "items": [ { "name": "frame::PresentFrame", "kind": "struct_item", "signature": "pub struct PresentFrame {\n/// Always `\"oaap:present\"`.\n\n#[serde(rename = \"type\")]\npub frame_type: String,\n/// The client's `did:oas:*` identifier.\n\npub did: String,\n/// Client's ephemeral X25519 public key (hex-encoded, 64 chars).\n\npub ephemeral_pub: String,\n/// Client's Ed25519 verifying key (hex-encoded, 64 chars).\n\npub verifying_key: String,\n/// ISO-8601 timestamp of when the frame was created.\n\npub timestamp: String\n}", "docs": "Step 1: Client presents its DID and ephemeral X25519 public key.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 16 }, { "name": "frame::ChallengeFrame", "kind": "struct_item", "signature": "pub struct ChallengeFrame {\n/// Always `\"oaap:challenge\"`.\n\n#[serde(rename = \"type\")]\npub frame_type: String,\n/// The server's `did:oas:*` identifier.\n\npub did: String,\n/// Server's ephemeral X25519 public key (hex-encoded).\n\npub ephemeral_pub: String,\n/// Server's Ed25519 verifying key (hex-encoded).\n\npub verifying_key: String,\n/// Random challenge nonce (hex-encoded, 64 chars = 32 bytes).\n\npub challenge: String,\n/// ISO-8601 timestamp.\n\npub timestamp: String\n}", "docs": "Step 2: Server responds with its own DID, ephemeral key, and a challenge nonce.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 32 }, { "name": "frame::ProveFrame", "kind": "struct_item", "signature": "pub struct ProveFrame {\n/// Always `\"oaap:prove\"`.\n\n#[serde(rename = \"type\")]\npub frame_type: String,\n/// Ed25519 signature over the challenge bytes (hex-encoded, 128 chars).\n\npub signature: String,\n/// The challenge that was signed (echoed back for binding).\n\npub challenge: String\n}", "docs": "Step 3: Client proves identity by signing the challenge with its Ed25519 key.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 50 }, { "name": "frame::EstablishedFrame", "kind": "struct_item", "signature": "pub struct EstablishedFrame {\n/// Always `\"oaap:established\"`.\n\n#[serde(rename = \"type\")]\npub frame_type: String,\n/// The unique session identifier (hex-encoded, 32 bytes).\n\npub session: String,\n/// Whether the session uses encrypted payloads.\n\npub encrypted: bool,\n/// Ed25519 signature from the server over `session || client_ephemeral_pub`\n\n/// to prove the server is authentic (hex-encoded).\n\npub signature: String\n}", "docs": "Step 4: Server confirms authentication and establishes the session.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 62 }, { "name": "frame::MessageFrame", "kind": "struct_item", "signature": "pub struct MessageFrame {\n/// Always `\"oaap:message\"`.\n\n#[serde(rename = \"type\")]\npub frame_type: String,\n/// Session identifier (hex-encoded).\n\npub session: String,\n/// The payload \u2014 either plaintext (UTF-8) or base64-encoded ciphertext\n\n/// depending on whether the session is encrypted.\n\npub payload: String,\n/// AES-256-GCM nonce (hex-encoded) \u2014 present only when encrypted.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub nonce: Option,\n/// Monotonically increasing sequence number for replay protection.\n\npub seq: u64\n}", "docs": "Data frame sent after authentication is established.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 79 }, { "name": "frame::TYPE_PRESENT", "kind": "const_item", "signature": "pub const TYPE_PRESENT: &str;", "docs": "Wire value of the `type` field for [`PresentFrame`] (handshake step 1).", "attributes": "", "line": 107 }, { "name": "frame::TYPE_CHALLENGE", "kind": "const_item", "signature": "pub const TYPE_CHALLENGE: &str;", "docs": "Wire value of the `type` field for [`ChallengeFrame`] (handshake step 2).", "attributes": "", "line": 109 }, { "name": "frame::TYPE_PROVE", "kind": "const_item", "signature": "pub const TYPE_PROVE: &str;", "docs": "Wire value of the `type` field for [`ProveFrame`] (handshake step 3).", "attributes": "", "line": 111 }, { "name": "frame::TYPE_ESTABLISHED", "kind": "const_item", "signature": "pub const TYPE_ESTABLISHED: &str;", "docs": "Wire value of the `type` field for [`EstablishedFrame`] (handshake step 4).", "attributes": "", "line": 113 }, { "name": "frame::TYPE_MESSAGE", "kind": "const_item", "signature": "pub const TYPE_MESSAGE: &str;", "docs": "Wire value of the `type` field for [`MessageFrame`] (post-handshake data).", "attributes": "", "line": 115 } ], "parseErrors": false }, { "module": "server", "source": "openagent-sdk/adapters/websocket/rust/src/server.rs", "sha256": "3c53322097a362242fd8fbdab4d5b681606bb2c9f50a79a9d415da5013dbaf04", "attributes": "", "items": [ { "name": "server::OpenAgentWsHandler", "kind": "struct_item", "signature": "pub struct OpenAgentWsHandler {\n\n}", "docs": "Server-side OAAP WebSocket handler.\n\nHolds the server's identity material. Call [`accept`](Self::accept) on each\nincoming WebSocket connection to run the 4-step authentication handshake.", "attributes": "", "line": 32 }, { "name": "server::OpenAgentWsHandler::new", "kind": "function_item", "signature": "pub fn new(did: impl Into, signing_key: [u8; 32], verifying_key: [u8; 32]) -> Self;", "docs": "Creates a new handler with the server's identity.\n\n# Arguments\n\n* `did` \u2014 Server's `did:oas:*` identifier.\n* `signing_key` \u2014 32-byte Ed25519 signing key.\n* `verifying_key` \u2014 32-byte Ed25519 verifying key.", "attributes": "", "line": 48 }, { "name": "server::OpenAgentWsHandler::with_encryption", "kind": "function_item", "signature": "pub fn with_encryption(mut self, encrypted: bool) -> Self;", "docs": "Sets whether sessions use encryption (default: `true`).", "attributes": "", "line": 59 }, { "name": "server::OpenAgentWsHandler::with_timeout", "kind": "function_item", "signature": "pub fn with_timeout(mut self, duration: Duration) -> Self;", "docs": "Overrides the per-step handshake timeout (default: 5s).", "attributes": "", "line": 65 }, { "name": "server::OpenAgentWsHandler::accept", "kind": "function_item", "signature": "pub async fn accept(\n &self,\n mut ws: WsServerStream,\n ) -> Result>;", "docs": "Runs the 4-step OAAP handshake on an accepted WebSocket connection.\n\nReturns an [`AuthenticatedSession`] on success. The caller should then\nuse `session.send()` / `session.receive()` for all subsequent\ncommunication.\n\n# Errors\n\nReturns [`WsError`] if the handshake fails for any reason: timeout,\nunexpected frame, bad signature, transport error.", "attributes": "", "line": 80 } ], "parseErrors": false }, { "module": "session", "source": "openagent-sdk/adapters/websocket/rust/src/session.rs", "sha256": "6a62576fb7175db89350d6f835a0a351a791eeaa23ac997d206d7bb3c5108b3f", "attributes": "", "items": [ { "name": "session::AuthenticatedSession", "kind": "struct_item", "signature": "pub struct AuthenticatedSession {\n\n}", "docs": "An authenticated WebSocket session with an optional encryption layer.\n\nCreated by [`crate::server::OpenAgentWsHandler::accept`] or\n[`crate::client::OpenAgentWsClient::connect`] after a successful OAAP\nhandshake.", "attributes": "", "line": 34 }, { "name": "session::AuthenticatedSession::session_id_hex", "kind": "function_item", "signature": "pub fn session_id_hex(&self) -> String;", "docs": "Returns the hex-encoded session ID.", "attributes": "", "line": 108 }, { "name": "session::AuthenticatedSession::peer_did", "kind": "function_item", "signature": "pub fn peer_did(&self) -> &str;", "docs": "Returns the peer's DID.", "attributes": "", "line": 113 }, { "name": "session::AuthenticatedSession::is_encrypted", "kind": "function_item", "signature": "pub fn is_encrypted(&self) -> bool;", "docs": "Returns whether this session uses encryption.", "attributes": "", "line": 118 }, { "name": "session::AuthenticatedSession::send", "kind": "function_item", "signature": "pub async fn send(&mut self, payload: &[u8]) -> Result<()>;", "docs": "Sends a payload over the authenticated session.\n\nIf the session was established with encryption, the payload is\nAES-256-GCM encrypted with a fresh random nonce. Otherwise, it is\nsent as plaintext.", "attributes": "", "line": 133 }, { "name": "session::AuthenticatedSession::receive", "kind": "function_item", "signature": "pub async fn receive(&mut self) -> Result>;", "docs": "Receives the next message payload from the authenticated session.\n\nValidates session ID, verifies sequence ordering, and decrypts if\nthe session is encrypted.", "attributes": "", "line": 173 } ], "parseErrors": false }, { "module": "transport", "source": "openagent-sdk/adapters/websocket/rust/src/transport.rs", "sha256": "5d57dbb937bafb15a6c437c9b23cb383321f954c96469cb5d92ab2d3b49fb201", "attributes": "", "items": [ { "name": "transport::WsStream", "kind": "type_item", "signature": "pub type WsStream = WebSocketStream>;", "docs": "The raw WebSocket stream type (over TCP, possibly TLS).", "attributes": "", "line": 21 }, { "name": "transport::WsServerStream", "kind": "type_item", "signature": "pub type WsServerStream = WebSocketStream;", "docs": "The raw WebSocket stream type for a server-side accepted connection (plain TCP).", "attributes": "", "line": 24 }, { "name": "transport::OaapFrame", "kind": "enum_item", "signature": "pub enum OaapFrame {\n /// Step 1: `oaap:present`.\n Present(PresentFrame),\n /// Step 2: `oaap:challenge`.\n Challenge(ChallengeFrame),\n /// Step 3: `oaap:prove`.\n Prove(ProveFrame),\n /// Step 4: `oaap:established`.\n Established(EstablishedFrame),\n /// Post-handshake data.\n Message(MessageFrame),\n}", "docs": "Typed OAAP frames dispatched from the WebSocket.", "attributes": "#[derive(Debug)]", "line": 28 }, { "name": "transport::send_frame", "kind": "function_item", "signature": "pub async fn send_frame(ws: &mut S, frame: &F) -> Result<()>\nwhere\n S: SinkExt + Unpin,\n S::Error: std::fmt::Display,\n F: serde::Serialize,;", "docs": "Sends a serializable frame as a JSON text message.", "attributes": "", "line": 42 }, { "name": "transport::recv_frame", "kind": "function_item", "signature": "pub async fn recv_frame(ws: &mut S) -> Result\nwhere\n S: StreamExt>\n + Unpin,;", "docs": "Reads the next text frame from the WebSocket, deserializes and dispatches it.\n\nBinary frames are silently skipped. Ping/Pong are handled by tungstenite\nautomatically. Close frames cause [`WsError::HandshakeClosed`] with step = 0.", "attributes": "", "line": 59 } ], "parseErrors": false } ] }, { "name": "openagent-oidc", "url": "/reference/rust/openagent-oidc", "modules": [ { "module": "crate", "source": "openagent-sdk/bridges/oidc/rust/src/lib.rs", "sha256": "e1b78269f34977b6ddbd8eb3685e0ace43ad061c633423ab5684a6c3f88bc039", "attributes": "", "items": [ { "name": "bridge", "kind": "module", "signature": "pub mod bridge;", "docs": "", "attributes": "", "line": 70 }, { "name": "config", "kind": "module", "signature": "pub mod config;", "docs": "", "attributes": "", "line": 71 }, { "name": "discovery", "kind": "module", "signature": "pub mod discovery;", "docs": "", "attributes": "", "line": 72 }, { "name": "error", "kind": "module", "signature": "pub mod error;", "docs": "", "attributes": "", "line": 73 }, { "name": "exchange", "kind": "module", "signature": "pub mod exchange;", "docs": "", "attributes": "", "line": 74 }, { "name": "jwks", "kind": "module", "signature": "pub mod jwks;", "docs": "", "attributes": "", "line": 75 }, { "name": "jwt", "kind": "module", "signature": "pub mod jwt;", "docs": "", "attributes": "", "line": 76 }, { "name": "mapping", "kind": "module", "signature": "pub mod mapping;", "docs": "", "attributes": "", "line": 77 }, { "name": "pub use bridge::OidcBridge;", "kind": "use_declaration", "signature": "pub use bridge::OidcBridge;", "docs": "", "attributes": "", "line": 80 }, { "name": "pub use config::{OidcConfig, ProviderConfig};", "kind": "use_declaration", "signature": "pub use config::{OidcConfig, ProviderConfig};", "docs": "", "attributes": "", "line": 81 }, { "name": "pub use error::{OidcBridgeError, Result};", "kind": "use_declaration", "signature": "pub use error::{OidcBridgeError, Result};", "docs": "", "attributes": "", "line": 82 }, { "name": "pub use exchange::{TokenExchangeRequest, TokenExchangeResponse};", "kind": "use_declaration", "signature": "pub use exchange::{TokenExchangeRequest, TokenExchangeResponse};", "docs": "", "attributes": "", "line": 83 }, { "name": "pub use jwt::{ActJwtClaims, ValidatedClaims};", "kind": "use_declaration", "signature": "pub use jwt::{ActJwtClaims, ValidatedClaims};", "docs": "", "attributes": "", "line": 84 }, { "name": "pub use mapping::DerivedAgent;", "kind": "use_declaration", "signature": "pub use mapping::DerivedAgent;", "docs": "", "attributes": "", "line": 85 }, { "name": "::VERSION", "kind": "const_item", "signature": "pub const VERSION: &str;", "docs": "Crate version, sourced from `Cargo.toml` at compile time.", "attributes": "", "line": 88 } ], "parseErrors": false }, { "module": "bridge", "source": "openagent-sdk/bridges/oidc/rust/src/bridge.rs", "sha256": "db0ca0778211c56f2305ad437135aa8f90f539d82d69641a68f053e2fd1b3e6d", "attributes": "", "items": [ { "name": "bridge::OidcBridge", "kind": "struct_item", "signature": "pub struct OidcBridge {\n\n}", "docs": "The OIDC bridge \u2014 maps between human OIDC tokens and OAS agent identities.\n\nThread-safe and cheaply cloneable (all internal state is behind `Arc`).\n\n# Example\n\n```ignore\nlet bridge = OidcBridge::new(OidcConfig::single(\n ProviderConfig::new(\"okta\", \"https://dev-123.okta.com/oauth2/default\")\n .with_audience(\"my-app\"),\n))?;\n\n// Flow 1: Human JWT -> Agent DID\nlet agent = bridge.derive_agent_from_jwt(&jwt_string, \"my-bot\").await?;\n\n// Flow 2: Agent ACT -> JWT\nlet jwt = bridge.act_to_jwt(&act_claims, &signing_key, Algorithm::EdDSA, None).await?;\n```", "attributes": "#[derive(Debug, Clone)]", "line": 45 }, { "name": "bridge::OidcBridge::new", "kind": "function_item", "signature": "pub fn new(config: OidcConfig) -> Result;", "docs": "Create a new OIDC bridge with the given configuration.\n\n# Errors\n\nReturns [`OidcBridgeError::Config`] if the configuration is invalid.", "attributes": "", "line": 57 }, { "name": "bridge::OidcBridge::config", "kind": "function_item", "signature": "pub fn config(&self) -> &OidcConfig;", "docs": "Access the bridge configuration.", "attributes": "", "line": 71 }, { "name": "bridge::OidcBridge::derive_agent_from_jwt", "kind": "function_item", "signature": "pub async fn derive_agent_from_jwt(\n &self,\n token: &str,\n agent_name: &str,\n ) -> Result;", "docs": "Derive an agent DID from a human's OIDC JWT.\n\n1. Decodes the JWT header to find the algorithm and key ID.\n2. Identifies the OIDC provider from the `iss` claim.\n3. Fetches the provider's JWKS (cached, with rotation-aware refresh).\n4. Validates the JWT (signature, issuer, audience, expiry).\n5. Maps the JWT subject to an HMR DID.\n6. Derives a child agent DID under that HMR.\n\n# Errors\n\nReturns errors from any step in the chain (discovery, JWKS, validation,\nidentity derivation).", "attributes": "", "line": 90 }, { "name": "bridge::OidcBridge::act_to_jwt", "kind": "function_item", "signature": "pub fn act_to_jwt(\n &self,\n claims: &ActJwtClaims,\n signing_key: &EncodingKey,\n algorithm: Algorithm,\n kid: Option<&str>,\n ) -> Result;", "docs": "Wrap an Arsenal ACT into a standard JWT for services that speak OAuth2.\n\nThe resulting JWT includes custom claims (`lineage_depth`, `parent_hmr`,\n`act`) alongside standard OAuth2 claims (`sub`, `iss`, `aud`, `scope`,\n`exp`).\n\n# Arguments\n\n* `claims` - Pre-built ACT JWT claims (use [`build_act_claims`]).\n* `signing_key` - The key to sign the JWT with.\n* `algorithm` - Signing algorithm (e.g., `EdDSA`, `RS256`).\n* `kid` - Optional key ID for the JWT header.\n\n# Errors\n\nReturns [`OidcBridgeError::Signing`] if JWT encoding fails.", "attributes": "", "line": 145 }, { "name": "bridge::OidcBridge::wrap_act_as_jwt", "kind": "function_item", "signature": "pub fn wrap_act_as_jwt(\n &self,\n agent_did: &str,\n bridge_issuer: &str,\n audience: Option<&str>,\n scopes: &[String],\n lineage_depth: u32,\n parent_hmr: &str,\n act_b64: &str,\n signing_key: &EncodingKey,\n algorithm: Algorithm,\n kid: Option<&str>,\n ) -> Result;", "docs": "Convenience: build ACT claims and sign in one step.", "attributes": "", "line": 156 }, { "name": "bridge::OidcBridge::exchange_token", "kind": "function_item", "signature": "pub async fn exchange_token(\n &self,\n request: &TokenExchangeRequest,\n signing_key: &EncodingKey,\n algorithm: Algorithm,\n bridge_issuer: &str,\n ) -> Result;", "docs": "Execute an RFC 8693 token exchange.\n\nValidates the subject token (human JWT), derives an agent, and returns\nan ACT-wrapped JWT as the exchanged token.\n\n# Arguments\n\n* `request` - The token exchange request.\n* `signing_key` - Key for signing the response JWT.\n* `algorithm` - Signing algorithm.\n* `bridge_issuer` - Issuer claim for the response JWT.\n\n# Errors\n\nReturns errors from request validation, JWT validation, or signing.", "attributes": "", "line": 199 }, { "name": "bridge::OidcBridge::exchange_token_simple", "kind": "function_item", "signature": "pub async fn exchange_token_simple(\n &self,\n human_jwt: &str,\n requested_scopes: &[&str],\n signing_key: &EncodingKey,\n algorithm: Algorithm,\n bridge_issuer: &str,\n ) -> Result;", "docs": "Convenience: exchange a human JWT for agent scopes in one call.\n\nCombines Flow 1 and scope mapping without requiring the caller to\nconstruct a full [`TokenExchangeRequest`].", "attributes": "", "line": 259 }, { "name": "bridge::OidcBridge::validate_jwt", "kind": "function_item", "signature": "pub async fn validate_jwt(&self, token: &str) -> Result;", "docs": "Validate a JWT and return its claims without deriving an agent.\n\nUseful when you only need to verify the human's identity, not spawn\nan agent.", "attributes": "", "line": 278 }, { "name": "bridge::OidcBridge::refresh_all_jwks", "kind": "function_item", "signature": "pub async fn refresh_all_jwks(&self);", "docs": "Force-refresh the JWKS cache for all configured providers.", "attributes": "", "line": 300 } ], "parseErrors": false }, { "module": "config", "source": "openagent-sdk/bridges/oidc/rust/src/config.rs", "sha256": "2965e6823b8dd3c0503f4826dcedefa6b7d85304ad090dc45f2e6e8be5a5268e", "attributes": "", "items": [ { "name": "config::ProviderConfig", "kind": "struct_item", "signature": "pub struct ProviderConfig {\n/// Human-readable provider name (e.g. `\"okta\"`, `\"azure\"`).\n\npub name: String,\n/// OIDC issuer URL (must match the `iss` claim in JWTs from this provider).\n\npub issuer: String,\n/// Expected `aud` claim. Omit to skip audience validation (not recommended).\n\npub audience: Option,\n/// Override for the JWKS URI. If `None`, auto-discovered from\n\n/// `{issuer}/.well-known/openid-configuration`.\n\npub jwks_url: Option,\n/// Which JWT claim maps to the human identity (default: `\"sub\"`).\n\n#[serde(default = \"default_hmr_claim\")]\npub hmr_claim: String,\n/// Mapping from OIDC scopes / roles to Arsenal-style scopes.\n\n///\n\n/// Example: `{ \"admin\": [\"*:*:*\"], \"agent-user\": [\"openai:chat:*\"] }`.\n\n#[serde(default)]\npub scope_mapping: HashMap>\n}", "docs": "Configuration for a single OIDC provider (Okta, Auth0, Azure AD, etc.).", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 16 }, { "name": "config::ProviderConfig::new", "kind": "function_item", "signature": "pub fn new(name: impl Into, issuer: impl Into) -> Self;", "docs": "Create a minimal provider config with just issuer and audience.", "attributes": "", "line": 42 }, { "name": "config::ProviderConfig::with_audience", "kind": "function_item", "signature": "pub fn with_audience(mut self, audience: impl Into) -> Self;", "docs": "Set the expected audience.", "attributes": "", "line": 54 }, { "name": "config::ProviderConfig::with_jwks_url", "kind": "function_item", "signature": "pub fn with_jwks_url(mut self, url: impl Into) -> Self;", "docs": "Set a custom JWKS URL (skip discovery).", "attributes": "", "line": 60 }, { "name": "config::ProviderConfig::with_hmr_claim", "kind": "function_item", "signature": "pub fn with_hmr_claim(mut self, claim: impl Into) -> Self;", "docs": "Set the JWT claim that identifies the human root.", "attributes": "", "line": 66 }, { "name": "config::ProviderConfig::with_scope_mapping", "kind": "function_item", "signature": "pub fn with_scope_mapping(mut self, role: impl Into, scopes: Vec) -> Self;", "docs": "Add a scope mapping entry.", "attributes": "", "line": 72 }, { "name": "config::ProviderConfig::validate", "kind": "function_item", "signature": "pub fn validate(&self) -> Result<()>;", "docs": "Validate that the configuration is usable.", "attributes": "", "line": 78 }, { "name": "config::OidcConfig", "kind": "struct_item", "signature": "pub struct OidcConfig {\n/// List of OIDC providers. At least one is required.\n\npub providers: Vec,\n/// OAS namespace for minted DIDs (default: `\"openagent\"`).\n\n#[serde(default = \"default_namespace\")]\npub namespace: String,\n/// Default TTL in seconds for emitted JWTs (Flow 2). Default: 3600.\n\n#[serde(default = \"default_jwt_ttl\")]\npub jwt_ttl_seconds: i64,\n/// HTTP client timeout in milliseconds for discovery / JWKS fetches.\n\n#[serde(default = \"default_http_timeout_ms\")]\npub http_timeout_ms: u64\n}", "docs": "Top-level OIDC bridge configuration.\n\nSupports either a single provider (for simple setups) or multiple providers\n(for enterprises with several IdPs). The bridge routes JWTs to the correct\nprovider based on the `iss` claim.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 99 }, { "name": "config::OidcConfig::single", "kind": "function_item", "signature": "pub fn single(provider: ProviderConfig) -> Self;", "docs": "Create a config with a single OIDC provider.", "attributes": "", "line": 127 }, { "name": "config::OidcConfig::multi", "kind": "function_item", "signature": "pub fn multi(providers: Vec) -> Self;", "docs": "Create a config with multiple providers.", "attributes": "", "line": 137 }, { "name": "config::OidcConfig::with_namespace", "kind": "function_item", "signature": "pub fn with_namespace(mut self, ns: impl Into) -> Self;", "docs": "Override the OAS namespace.", "attributes": "", "line": 147 }, { "name": "config::OidcConfig::with_jwt_ttl", "kind": "function_item", "signature": "pub fn with_jwt_ttl(mut self, seconds: i64) -> Self;", "docs": "Override the JWT TTL for Flow 2 (ACT -> JWT).", "attributes": "", "line": 153 }, { "name": "config::OidcConfig::validate", "kind": "function_item", "signature": "pub fn validate(&self) -> Result<()>;", "docs": "Validate the entire configuration.", "attributes": "", "line": 159 }, { "name": "config::OidcConfig::find_provider", "kind": "function_item", "signature": "pub fn find_provider(&self, issuer: &str) -> Option<&ProviderConfig>;", "docs": "Find the provider whose issuer matches the given string.", "attributes": "", "line": 188 } ], "parseErrors": false }, { "module": "discovery", "source": "openagent-sdk/bridges/oidc/rust/src/discovery.rs", "sha256": "ce5af3534455570d352ac8a1051bc8612a3debed502a0b3a8a2c46f47967a70e", "attributes": "", "items": [ { "name": "discovery::DiscoveryDocument", "kind": "struct_item", "signature": "pub struct DiscoveryDocument {\n/// The OIDC issuer identifier (MUST match the `issuer` in our config).\n\npub issuer: String,\n/// URL of the authorization endpoint.\n\n#[serde(default)]\npub authorization_endpoint: String,\n/// URL of the token endpoint.\n\n#[serde(default)]\npub token_endpoint: String,\n/// URL of the JWKS endpoint.\n\npub jwks_uri: String,\n/// Supported response types.\n\n#[serde(default)]\npub response_types_supported: Vec,\n/// Supported subject identifier types.\n\n#[serde(default)]\npub subject_types_supported: Vec,\n/// Supported ID token signing algorithms.\n\n#[serde(default)]\npub id_token_signing_alg_values_supported: Vec,\n/// Supported scopes.\n\n#[serde(default)]\npub scopes_supported: Vec,\n/// Token exchange endpoint (may differ from token_endpoint for some providers).\n\n#[serde(default)]\npub token_exchange_endpoint: Option\n}", "docs": "Subset of the OpenID Connect Discovery document that we need.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 18 }, { "name": "discovery::DiscoveryClient", "kind": "struct_item", "signature": "pub struct DiscoveryClient {\n\n}", "docs": "OIDC discovery client with per-issuer caching.\n\nCache entries expire after the configured TTL (default: 1 hour).", "attributes": "#[derive(Debug, Clone)]", "line": 57 }, { "name": "discovery::DiscoveryClient::new", "kind": "function_item", "signature": "pub fn new(timeout: Duration, cache_ttl: Duration) -> Self;", "docs": "Create a new discovery client.", "attributes": "", "line": 65 }, { "name": "discovery::DiscoveryClient::with_defaults", "kind": "function_item", "signature": "pub fn with_defaults() -> Self;", "docs": "Create a discovery client with default settings (10s timeout, 1h cache TTL).", "attributes": "", "line": 80 }, { "name": "discovery::DiscoveryClient::discover", "kind": "function_item", "signature": "pub async fn discover(&self, issuer: &str) -> Result;", "docs": "Fetch (or return cached) the discovery document for the given issuer.\n\n# Errors\n\nReturns [`OidcBridgeError::Discovery`] if the fetch or parse fails.", "attributes": "", "line": 89 }, { "name": "discovery::DiscoveryClient::invalidate", "kind": "function_item", "signature": "pub async fn invalidate(&self, issuer: &str);", "docs": "Invalidate the cache for a specific issuer.", "attributes": "", "line": 149 }, { "name": "discovery::DiscoveryClient::invalidate_all", "kind": "function_item", "signature": "pub async fn invalidate_all(&self);", "docs": "Invalidate the entire cache.", "attributes": "", "line": 155 } ], "parseErrors": false }, { "module": "error", "source": "openagent-sdk/bridges/oidc/rust/src/error.rs", "sha256": "337e5071fb79b843df2ddf7f81ac0d51e6114063ef68b75b13d3dfb4609dee56", "attributes": "", "items": [ { "name": "error::Result", "kind": "type_item", "signature": "pub type Result = std::result::Result;", "docs": "Result alias for OIDC bridge operations.", "attributes": "", "line": 8 }, { "name": "error::OidcBridgeError", "kind": "enum_item", "signature": "pub enum OidcBridgeError {\n /// OIDC discovery failed (network, parse, missing fields).\n #[error(\"oidc discovery error: {0}\")]\n Discovery(String),\n\n /// JWKS fetch or parse error.\n #[error(\"jwks error: {0}\")]\n Jwks(String),\n\n /// JWT validation failed (signature, claims, expiry).\n #[error(\"jwt validation error: {0}\")]\n JwtValidation(String),\n\n /// No provider matched the JWT issuer claim.\n #[error(\"unknown issuer: {0}\")]\n UnknownIssuer(String),\n\n /// DID mapping or derivation failed.\n #[error(\"identity mapping error: {0}\")]\n Mapping(String),\n\n /// Token exchange error (RFC 8693).\n #[error(\"token exchange error: {0}\")]\n Exchange(String),\n\n /// ACT-to-JWT signing error.\n #[error(\"signing error: {0}\")]\n Signing(String),\n\n /// Configuration error (missing required fields, invalid values).\n #[error(\"configuration error: {0}\")]\n Config(String),\n\n /// HTTP transport error.\n #[error(\"transport error: {0}\")]\n Transport(String),\n\n /// Underlying OAS identity error.\n #[error(\"identity error: {0}\")]\n Identity(String),\n\n /// JSON serialization/deserialization error.\n #[error(\"json error: {0}\")]\n Json(#[from] serde_json::Error),\n}", "docs": "Unified error type for OIDC bridge operations.", "attributes": "#[derive(Debug, Error)]", "line": 12 }, { "name": "error::OidcBridgeError::config", "kind": "function_item", "signature": "pub fn config(msg: impl Into) -> Self;", "docs": "Construct a configuration error.", "attributes": "", "line": 60 }, { "name": "error::OidcBridgeError::discovery", "kind": "function_item", "signature": "pub fn discovery(msg: impl Into) -> Self;", "docs": "Construct a discovery error.", "attributes": "", "line": 65 }, { "name": "error::OidcBridgeError::jwks", "kind": "function_item", "signature": "pub fn jwks(msg: impl Into) -> Self;", "docs": "Construct a JWKS error.", "attributes": "", "line": 70 }, { "name": "error::OidcBridgeError::jwt_validation", "kind": "function_item", "signature": "pub fn jwt_validation(msg: impl Into) -> Self;", "docs": "Construct a JWT validation error.", "attributes": "", "line": 75 }, { "name": "error::OidcBridgeError::mapping", "kind": "function_item", "signature": "pub fn mapping(msg: impl Into) -> Self;", "docs": "Construct a mapping error.", "attributes": "", "line": 80 }, { "name": "error::OidcBridgeError::transport", "kind": "function_item", "signature": "pub fn transport(msg: impl Into) -> Self;", "docs": "Construct a transport error.", "attributes": "", "line": 85 } ], "parseErrors": false }, { "module": "exchange", "source": "openagent-sdk/bridges/oidc/rust/src/exchange.rs", "sha256": "eee1c1b9b3e003f6e61c96d3bca3af1e70494695d5060ca17447f4928ea16831", "attributes": "", "items": [ { "name": "exchange::GRANT_TYPE_TOKEN_EXCHANGE", "kind": "const_item", "signature": "pub const GRANT_TYPE_TOKEN_EXCHANGE: &str;", "docs": "Standard grant type for RFC 8693 Token Exchange.", "attributes": "", "line": 13 }, { "name": "exchange::TOKEN_TYPE_JWT", "kind": "const_item", "signature": "pub const TOKEN_TYPE_JWT: &str;", "docs": "Standard token type for JWT subject tokens.", "attributes": "", "line": 17 }, { "name": "exchange::TOKEN_TYPE_ACT", "kind": "const_item", "signature": "pub const TOKEN_TYPE_ACT: &str;", "docs": "Custom token type for OpenAgent ACTs.", "attributes": "", "line": 20 }, { "name": "exchange::TOKEN_TYPE_ACCESS", "kind": "const_item", "signature": "pub const TOKEN_TYPE_ACCESS: &str;", "docs": "Standard token type for access tokens.", "attributes": "", "line": 23 }, { "name": "exchange::TokenExchangeRequest", "kind": "struct_item", "signature": "pub struct TokenExchangeRequest {\n/// Must be `urn:ietf:params:oauth:grant-type:token-exchange`.\n\npub grant_type: String,\n/// The subject token (typically a human JWT).\n\npub subject_token: String,\n/// Type of the subject token.\n\npub subject_token_type: String,\n/// Desired type of the issued token.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub requested_token_type: Option,\n/// Requested scopes for the exchanged token.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub scope: Option,\n/// Target audience for the exchanged token.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub audience: Option,\n/// Logical name of the target service.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub resource: Option,\n/// Actor token (for delegation / impersonation scenarios).\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub actor_token: Option,\n/// Type of the actor token.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub actor_token_type: Option\n}", "docs": "Token exchange request (RFC 8693 Section 2.1).", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 27 }, { "name": "exchange::TokenExchangeResponse", "kind": "struct_item", "signature": "pub struct TokenExchangeResponse {\n/// The issued token.\n\npub access_token: String,\n/// Type of the issued token.\n\npub issued_token_type: String,\n/// Token type (always `\"Bearer\"` for our use case).\n\npub token_type: String,\n/// Lifetime of the token in seconds.\n\npub expires_in: i64,\n/// Scope of the issued token.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub scope: Option\n}", "docs": "Token exchange response (RFC 8693 Section 2.2).", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 56 }, { "name": "exchange::TokenExchangeRequest::new_jwt_to_act", "kind": "function_item", "signature": "pub fn new_jwt_to_act(subject_token: impl Into, scopes: &[&str]) -> Self;", "docs": "Create a new token exchange request for exchanging a human JWT for an ACT.", "attributes": "", "line": 72 }, { "name": "exchange::TokenExchangeRequest::validate", "kind": "function_item", "signature": "pub fn validate(&self) -> Result<()>;", "docs": "Validate the request structure.", "attributes": "", "line": 91 }, { "name": "exchange::TokenExchangeRequest::requested_scopes", "kind": "function_item", "signature": "pub fn requested_scopes(&self) -> Vec;", "docs": "Parse requested scopes into a vector.", "attributes": "", "line": 133 }, { "name": "exchange::TokenExchangeResponse::success", "kind": "function_item", "signature": "pub fn success(\n access_token: impl Into,\n issued_token_type: impl Into,\n expires_in: i64,\n scope: Option,\n ) -> Self;", "docs": "Build a successful token exchange response.", "attributes": "", "line": 143 }, { "name": "exchange::TokenExchangeError", "kind": "struct_item", "signature": "pub struct TokenExchangeError {\n/// Error code (per RFC 6749 Section 5.2).\n\npub error: String,\n/// Human-readable error description.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub error_description: Option\n}", "docs": "RFC 8693 error response.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 161 }, { "name": "exchange::TokenExchangeError::invalid_request", "kind": "function_item", "signature": "pub fn invalid_request(description: impl Into) -> Self;", "docs": "Create an `invalid_request` error.", "attributes": "", "line": 171 }, { "name": "exchange::TokenExchangeError::invalid_grant", "kind": "function_item", "signature": "pub fn invalid_grant(description: impl Into) -> Self;", "docs": "Create an `invalid_grant` error (e.g., JWT validation failed).", "attributes": "", "line": 179 }, { "name": "exchange::TokenExchangeError::unsupported_token_type", "kind": "function_item", "signature": "pub fn unsupported_token_type(description: impl Into) -> Self;", "docs": "Create an `unsupported_token_type` error.", "attributes": "", "line": 187 }, { "name": "exchange::TokenExchangeError::invalid_target", "kind": "function_item", "signature": "pub fn invalid_target(description: impl Into) -> Self;", "docs": "Create an `invalid_target` error.", "attributes": "", "line": 195 } ], "parseErrors": false }, { "module": "jwks", "source": "openagent-sdk/bridges/oidc/rust/src/jwks.rs", "sha256": "583b82e1c77b4208cb57a512763eaf62cbc3717254074494ff48e308a2abba22", "attributes": "", "items": [ { "name": "jwks::JwksClient", "kind": "struct_item", "signature": "pub struct JwksClient {\n\n}", "docs": "JWKS client with per-URI caching and rotation-aware refresh.", "attributes": "#[derive(Debug, Clone)]", "line": 28 }, { "name": "jwks::JwksClient::new", "kind": "function_item", "signature": "pub fn new(timeout: Duration, cache_ttl: Duration) -> Self;", "docs": "Create a new JWKS client.", "attributes": "", "line": 36 }, { "name": "jwks::JwksClient::with_defaults", "kind": "function_item", "signature": "pub fn with_defaults() -> Self;", "docs": "Create a client with default settings (10s timeout, 1h cache TTL).", "attributes": "", "line": 51 }, { "name": "jwks::JwksClient::fetch_jwks", "kind": "function_item", "signature": "pub async fn fetch_jwks(&self, jwks_uri: &str) -> Result;", "docs": "Fetch (or return cached) the JWKS for the given URI.\n\n# Errors\n\nReturns [`OidcBridgeError::Jwks`] on network or parse failure.", "attributes": "", "line": 60 }, { "name": "jwks::JwksClient::refresh", "kind": "function_item", "signature": "pub async fn refresh(&self, jwks_uri: &str) -> Result;", "docs": "Force-refresh the JWKS for the given URI (key rotation scenario).\n\nCall this when JWT signature verification fails \u2014 the IdP may have\nrotated keys since we last fetched the JWKS.", "attributes": "", "line": 78 }, { "name": "jwks::JwksClient::select_key", "kind": "function_item", "signature": "pub fn select_key(jwks: &JwkSet, header: &Header) -> Result;", "docs": "Select a [`DecodingKey`] from the JWKS that matches the JWT header.\n\nMatches on `kid` (key ID) first, then falls back to `alg` matching\nif there is exactly one key for that algorithm.\n\n# Errors\n\nReturns [`OidcBridgeError::Jwks`] if no matching key is found.", "attributes": "", "line": 91 }, { "name": "jwks::JwksClient::invalidate", "kind": "function_item", "signature": "pub async fn invalidate(&self, jwks_uri: &str);", "docs": "Invalidate a specific JWKS cache entry.", "attributes": "", "line": 178 } ], "parseErrors": false }, { "module": "jwt", "source": "openagent-sdk/bridges/oidc/rust/src/jwt.rs", "sha256": "3a1b313c20181eae9860c5525d156a1748a6859d586b20e6b1b6769905f36aab", "attributes": "", "items": [ { "name": "jwt::ValidatedClaims", "kind": "struct_item", "signature": "pub struct ValidatedClaims {\n/// Issuer (`iss` claim).\n\npub issuer: String,\n/// Subject (`sub` claim) \u2014 typically the human user's unique ID.\n\npub subject: String,\n/// Audience (`aud` claim), if present.\n\n#[serde(default)]\npub audience: Vec,\n/// Expiration time (epoch seconds).\n\npub exp: i64,\n/// Issued-at time (epoch seconds).\n\n#[serde(default)]\npub iat: i64,\n/// The claim value that maps to the HMR (configurable, default `sub`).\n\npub hmr_value: String,\n/// OIDC scopes or roles extracted from the token.\n\n#[serde(default)]\npub scopes: Vec,\n/// All original claims (for custom mapping).\n\n#[serde(default)]\npub raw_claims: HashMap\n}", "docs": "Standard + custom claims extracted from a validated human JWT.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 23 }, { "name": "jwt::decode_jwt_header", "kind": "function_item", "signature": "pub fn decode_jwt_header(token: &str) -> Result
;", "docs": "Decode the JWT header without validation (to extract `kid` and `alg`).\n\n# Errors\n\nReturns [`OidcBridgeError::JwtValidation`] if the header is malformed.", "attributes": "", "line": 81 }, { "name": "jwt::validate_jwt", "kind": "function_item", "signature": "pub fn validate_jwt(\n token: &str,\n key: &DecodingKey,\n algorithm: Algorithm,\n provider: &ProviderConfig,\n) -> Result;", "docs": "Validate and decode a JWT using the given decoding key.\n\nPerforms standard OIDC validation: issuer match, audience match (if\nconfigured), expiry check, signature verification.\n\n# Errors\n\nReturns [`OidcBridgeError::JwtValidation`] on any validation failure.", "attributes": "", "line": 95 }, { "name": "jwt::ActJwtClaims", "kind": "struct_item", "signature": "pub struct ActJwtClaims {\n/// Subject: the agent's DID.\n\npub sub: String,\n/// Issuer: the bridge's own issuer identifier.\n\npub iss: String,\n/// Audience: the service that will consume this JWT.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub aud: Option,\n/// Expiration (epoch seconds).\n\npub exp: i64,\n/// Issued-at (epoch seconds).\n\npub iat: i64,\n/// JWT ID for replay prevention.\n\npub jti: String,\n/// Arsenal scope strings mapped from the ACT.\n\npub scope: String,\n/// The agent's lineage depth (hops from HMR root).\n\npub lineage_depth: u32,\n/// The parent HMR DID.\n\npub parent_hmr: String,\n/// The serialized ACT (base64url-encoded).\n\npub act: String\n}", "docs": "Claims for an outbound JWT that wraps an Arsenal ACT (Flow 2).", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 156 }, { "name": "jwt::sign_act_jwt", "kind": "function_item", "signature": "pub fn sign_act_jwt(\n claims: &ActJwtClaims,\n signing_key: &EncodingKey,\n algorithm: Algorithm,\n kid: Option<&str>,\n) -> Result;", "docs": "Sign a JWT wrapping an Arsenal ACT for services that speak OAuth2.\n\nThe resulting JWT can be introspected by standard OAuth2 resource servers.\nCustom claims (`lineage_depth`, `parent_hmr`, `act`) carry the agent\nidentity metadata.\n\n# Arguments\n\n* `claims` - Pre-built ACT JWT claims.\n* `signing_key` - Ed25519 or RSA private key in PEM or DER format.\n* `algorithm` - The signing algorithm (e.g., `EdDSA`, `RS256`).\n* `kid` - Optional key ID to include in the JWT header.\n\n# Errors\n\nReturns [`OidcBridgeError::Signing`] if encoding fails.", "attributes": "", "line": 196 }, { "name": "jwt::build_act_claims", "kind": "function_item", "signature": "pub fn build_act_claims(\n agent_did: &str,\n bridge_issuer: &str,\n audience: Option<&str>,\n scopes: &[String],\n lineage_depth: u32,\n parent_hmr: &str,\n act_b64: &str,\n ttl_seconds: i64,\n) -> ActJwtClaims;", "docs": "Build ACT JWT claims from the parts produced by the bridge.", "attributes": "", "line": 212 } ], "parseErrors": false }, { "module": "mapping", "source": "openagent-sdk/bridges/oidc/rust/src/mapping.rs", "sha256": "4fc3d6174d7e45f26946109f84ae2814a0a343d7123f69e1638b58e8d8adb8c8", "attributes": "", "items": [ { "name": "mapping::DerivedAgent", "kind": "struct_item", "signature": "pub struct DerivedAgent {\n/// The agent's DID (`did:oas::agent:`).\n\npub agent_did: String,\n/// The agent's Ed25519 keypair.\n\npub agent_keypair: OasKeyPair,\n/// The agent's signed OAS document.\n\npub agent_document: OasDocument,\n/// Cryptographic lineage proof (the agent's document contains this).\n\npub lineage_proof: Option,\n/// The parent HMR DID.\n\npub parent_hmr_did: String,\n/// The parent HMR's signed document.\n\npub parent_document: OasDocument,\n/// The parent HMR's keypair (needed for further derivations).\n\npub parent_keypair: OasKeyPair\n}", "docs": "Result of deriving an agent DID from a human JWT.", "attributes": "#[derive(Debug)]", "line": 22 }, { "name": "mapping::hmr_identifier_from_claims", "kind": "function_item", "signature": "pub fn hmr_identifier_from_claims(issuer: &str, hmr_value: &str) -> String;", "docs": "Deterministic identifier for an HMR derived from an OIDC subject.\n\nUses the issuer + subject to produce a stable, collision-resistant\nidentifier so the same human always maps to the same HMR DID.", "attributes": "", "line": 43 }, { "name": "mapping::derive_agent_from_claims", "kind": "function_item", "signature": "pub fn derive_agent_from_claims(\n namespace: &str,\n claims: &ValidatedClaims,\n agent_name: &str,\n) -> Result;", "docs": "Derive an agent DID under a human's HMR from validated OIDC claims.\n\nThis is the core of **Flow 1**: Human JWT -> Agent DID.\n\n1. Maps the JWT subject to an HMR DID (deterministic).\n2. Derives a child agent DID under that HMR using HKDF-SHA256.\n3. Returns the agent's identity (DID, keypair, lineage proof, parent HMR).\n\n# Arguments\n\n* `namespace` - OAS namespace (e.g. `\"openagent\"`).\n* `claims` - Validated claims from the human's JWT.\n* `agent_name` - Name for the derived agent (e.g. `\"my-bot\"`).\n\n# Errors\n\nReturns [`OidcBridgeError::Mapping`] if HMR minting or child derivation fails.", "attributes": "", "line": 110 }, { "name": "mapping::map_scopes", "kind": "function_item", "signature": "pub fn map_scopes(\n oidc_scopes: &[String],\n scope_mapping: &HashMap>,\n) -> Vec;", "docs": "Map OIDC scopes/roles to Arsenal capability scopes using the provider's\nscope mapping configuration.\n\nIf the JWT contains scopes that are in the provider's `scope_mapping`,\nthe corresponding Arsenal scopes are returned. Unmapped scopes are\npassed through as-is (useful when OIDC scopes already match Arsenal\nformat).", "attributes": "", "line": 165 }, { "name": "mapping::lineage_depth", "kind": "function_item", "signature": "pub fn lineage_depth(doc: &OasDocument) -> u32;", "docs": "Compute the lineage depth from an OAS document.\n\nDerived from the OAS `LineageSection::generation` (number of derivation\nsteps from the human root); documents without a lineage section report 0.", "attributes": "", "line": 194 } ], "parseErrors": false } ] }, { "name": "openagent-scim", "url": "/reference/rust/openagent-scim", "modules": [ { "module": "crate", "source": "openagent-sdk/bridges/scim/rust/src/lib.rs", "sha256": "67ea054f3b8534db37953673131ee30641cdcf2978c96438d9a814c5123bd6f5", "attributes": "", "items": [ { "name": "mapping", "kind": "module", "signature": "pub mod mapping;", "docs": "# openagent-scim\n\nSCIM 2.0 provisioning bridge for OpenAgent \u2014 enterprise agent lifecycle\nmanagement via RFC 7644.\n\nThis crate provides:\n- Trait definitions for the SCIM provisioner\n- SCIM resource types (User + Agent extension)\n- OAS Agent <-> SCIM User mapping functions\n\nThe TypeScript implementation (`@openagentid/scim`) is the primary SDK.\nThis Rust crate provides trait definitions and reference types for\nRust-native integrations.", "attributes": "", "line": 15 }, { "name": "types", "kind": "module", "signature": "pub mod types;", "docs": "", "attributes": "", "line": 16 }, { "name": "::ScimError", "kind": "enum_item", "signature": "pub enum ScimError {\n #[error(\"Agent not found: {did}\")]\n NotFound { did: String },\n\n #[error(\"Agent already exists: {did}\")]\n Conflict { did: String },\n\n #[error(\"Invalid input: {detail}\")]\n InvalidInput { detail: String },\n\n #[error(\"Store error: {0}\")]\n Store(String),\n\n #[error(\"Deprovisioning cascade error: {step} \u2014 {detail}\")]\n CascadeError { step: String, detail: String },\n}", "docs": "Errors from the SCIM provisioner.", "attributes": "#[derive(Debug, thiserror::Error)]", "line": 23 }, { "name": "::ScimResult", "kind": "type_item", "signature": "pub type ScimResult = Result;", "docs": "Result type for SCIM operations.", "attributes": "", "line": 41 }, { "name": "::AgentStore", "kind": "trait_item", "signature": "pub trait AgentStore: Send + Sync {\n async fn list(&self) -> ScimResult>;\n async fn find_by_did(&self, did: &str) -> ScimResult>;\n async fn find_by_user_name(&self, user_name: &str) -> ScimResult>;\n async fn find_by_external_id(&self, external_id: &str) -> ScimResult>;\n async fn create(&self, record: AgentRecord) -> ScimResult;\n async fn update(&self, did: &str, record: AgentRecord) -> ScimResult;\n async fn delete(&self, did: &str) -> ScimResult<()>;\n}", "docs": "Storage interface for agent records.\n\nImplementations must return cloned/owned data \u2014 never hand out mutable\nreferences to internal state.", "attributes": "#[async_trait]", "line": 48 }, { "name": "::DidRevoker", "kind": "trait_item", "signature": "pub trait DidRevoker: Send + Sync {\n async fn revoke(&self, did: &str) -> ScimResult<()>;\n}", "docs": "DID document revocation hook.", "attributes": "#[async_trait]", "line": 60 }, { "name": "::DelegationCascadeRevoker", "kind": "trait_item", "signature": "pub trait DelegationCascadeRevoker: Send + Sync {\n async fn cascade_revoke(&self, did: &str) -> ScimResult<()>;\n}", "docs": "Delegation tree cascade revocation hook.", "attributes": "#[async_trait]", "line": 66 }, { "name": "::ArsenalSessionInvalidator", "kind": "trait_item", "signature": "pub trait ArsenalSessionInvalidator: Send + Sync {\n async fn invalidate_sessions(&self, did: &str) -> ScimResult<()>;\n}", "docs": "Arsenal session invalidation hook.", "attributes": "#[async_trait]", "line": 72 }, { "name": "::AuditSink", "kind": "trait_item", "signature": "pub trait AuditSink: Send + Sync {\n async fn emit(&self, event: AuditEvent) -> ScimResult<()>;\n}", "docs": "Audit event sink.", "attributes": "#[async_trait]", "line": 78 }, { "name": "::ScimProvisioner", "kind": "trait_item", "signature": "pub trait ScimProvisioner: Send + Sync {\n /// Create a new agent identity via SCIM.\n async fn create_agent(&self, params: CreateAgentParams) -> ScimResult;\n\n /// Replace an agent record (SCIM PUT).\n async fn replace_agent(\n &self,\n did: &str,\n params: CreateAgentParams,\n ) -> ScimResult;\n\n /// Partial update (SCIM PATCH). Receives the already-patched record.\n async fn update_agent(&self, did: &str, record: AgentRecord) -> ScimResult;\n\n /// Deprovision an agent \u2014 the killer feature.\n ///\n /// Execution order:\n /// 1. Revoke the agent's DID document\n /// 2. Cascade-revoke all delegation proofs\n /// 3. Invalidate all active Arsenal sessions\n /// 4. Delete the agent record from the store\n /// 5. Emit audit event\n async fn deprovision_agent(&self, did: &str) -> ScimResult<()>;\n\n /// Find agent by DID.\n async fn find_by_did(&self, did: &str) -> ScimResult>;\n\n /// List all agents.\n async fn list_agents(&self) -> ScimResult>;\n}", "docs": "The SCIM provisioner trait \u2014 core lifecycle operations.\n\nImplementations wire together storage, DID management, delegation\ncascade, Arsenal session control, and audit emission.", "attributes": "#[async_trait]", "line": 87 } ], "parseErrors": false }, { "module": "mapping", "source": "openagent-sdk/bridges/scim/rust/src/mapping.rs", "sha256": "fb8f084d5f431f079aa7cf4b3fa6e4acf4721c80adec4890c714cf071aea56d3", "attributes": "", "items": [ { "name": "mapping::agent_to_scim_resource", "kind": "function_item", "signature": "pub fn agent_to_scim_resource(agent: &AgentRecord, base_url: &str) -> ScimAgentResource;", "docs": "Convert an internal `AgentRecord` into a SCIM `ScimAgentResource`.", "attributes": "", "line": 9 }, { "name": "mapping::scim_resource_to_agent", "kind": "function_item", "signature": "pub fn scim_resource_to_agent(\n resource: &ScimAgentResource,\n existing: &AgentRecord,\n) -> AgentRecord;", "docs": "Convert a SCIM resource back to an internal `AgentRecord`.\n\nThis is used when processing SCIM PUT requests that provide a full\nreplacement resource.", "attributes": "", "line": 48 }, { "name": "mapping::derive_did", "kind": "function_item", "signature": "pub fn derive_did(namespace: &str, user_name: &str) -> String;", "docs": "Derive a deterministic DID from namespace + userName.", "attributes": "", "line": 72 }, { "name": "mapping::derive_keypair_fingerprint", "kind": "function_item", "signature": "pub fn derive_keypair_fingerprint(did: &str) -> String;", "docs": "Derive a keypair fingerprint for a provisioned agent.", "attributes": "", "line": 83 }, { "name": "mapping::compute_lineage_depth", "kind": "function_item", "signature": "pub fn compute_lineage_depth(parent_did: &str, parent_depth: Option) -> u32;", "docs": "Compute lineage depth: 1 if parent is HMR/MHR, otherwise derived.", "attributes": "", "line": 92 }, { "name": "mapping::parse_conformance_level", "kind": "function_item", "signature": "pub fn parse_conformance_level(s: &str) -> Result;", "docs": "Validate a conformance level string.", "attributes": "", "line": 103 } ], "parseErrors": false }, { "module": "types", "source": "openagent-sdk/bridges/scim/rust/src/types.rs", "sha256": "90751b9c8de304eb38dc8898876cbbdc4295ea101863ee05818abf122a152306", "attributes": "", "items": [ { "name": "types::SCIM_USER_SCHEMA", "kind": "const_item", "signature": "pub const SCIM_USER_SCHEMA: &str;", "docs": "SCIM core User schema URN.", "attributes": "", "line": 6 }, { "name": "types::OPENAGENT_AGENT_SCHEMA", "kind": "const_item", "signature": "pub const OPENAGENT_AGENT_SCHEMA: &str;", "docs": "OpenAgent agent extension schema URN.", "attributes": "", "line": 9 }, { "name": "types::SCIM_LIST_RESPONSE_SCHEMA", "kind": "const_item", "signature": "pub const SCIM_LIST_RESPONSE_SCHEMA: &str;", "docs": "SCIM List Response schema URN.", "attributes": "", "line": 12 }, { "name": "types::SCIM_ERROR_SCHEMA", "kind": "const_item", "signature": "pub const SCIM_ERROR_SCHEMA: &str;", "docs": "SCIM Error schema URN.", "attributes": "", "line": 16 }, { "name": "types::SCIM_PATCH_OP_SCHEMA", "kind": "const_item", "signature": "pub const SCIM_PATCH_OP_SCHEMA: &str;", "docs": "SCIM PatchOp schema URN.", "attributes": "", "line": 19 }, { "name": "types::ConformanceLevel", "kind": "enum_item", "signature": "pub enum ConformanceLevel {\n L0,\n L1,\n L2,\n}", "docs": "Conformance levels for OpenAgent agents.", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]", "line": 23 }, { "name": "types::AgentExtension", "kind": "struct_item", "signature": "pub struct AgentExtension {\npub parent_did: String,\npub conformance_level: ConformanceLevel,\npub scopes: Vec,\npub lineage_depth: u32,\npub created_via: String,\npub keypair_fingerprint: String\n}", "docs": "The OpenAgent agent extension attribute group.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 38 }, { "name": "types::ScimMeta", "kind": "struct_item", "signature": "pub struct ScimMeta {\npub resource_type: String,\npub created: String,\npub last_modified: String,\npub location: String,\npub version: String\n}", "docs": "SCIM resource metadata.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 50 }, { "name": "types::ScimAgentResource", "kind": "struct_item", "signature": "pub struct ScimAgentResource {\npub schemas: Vec,\npub id: String,\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub external_id: Option,\npub user_name: String,\npub display_name: String,\npub active: bool,\npub meta: ScimMeta,\n#[serde(rename = \"urn:openagent:scim:1.0:Agent\")]\npub agent_extension: AgentExtension\n}", "docs": "Full SCIM User resource with agent extension.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 61 }, { "name": "types::ScimListResponse", "kind": "struct_item", "signature": "pub struct ScimListResponse {\npub schemas: Vec,\npub total_results: usize,\npub start_index: usize,\npub items_per_page: usize,\n#[serde(rename = \"Resources\")]\npub resources: Vec\n}", "docs": "SCIM List Response envelope.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 77 }, { "name": "types::ScimErrorResponse", "kind": "struct_item", "signature": "pub struct ScimErrorResponse {\npub schemas: Vec,\npub status: String,\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub scim_type: Option,\npub detail: String\n}", "docs": "SCIM Error response.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 89 }, { "name": "types::ScimErrorResponse::new", "kind": "function_item", "signature": "pub fn new(status: u16, scim_type: impl Into, detail: impl Into) -> Self;", "docs": "Create a new SCIM error response.", "attributes": "", "line": 99 }, { "name": "types::AgentRecord", "kind": "struct_item", "signature": "pub struct AgentRecord {\npub did: String,\npub user_name: String,\npub display_name: String,\npub active: bool,\npub parent_did: String,\npub conformance_level: ConformanceLevel,\npub scopes: Vec,\npub lineage_depth: u32,\npub created_via: String,\npub keypair_fingerprint: String,\npub created_at: String,\npub updated_at: String,\npub version: String,\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub external_id: Option\n}", "docs": "Internal agent record \u2014 the canonical representation of a provisioned agent.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 112 }, { "name": "types::CreateAgentParams", "kind": "struct_item", "signature": "pub struct CreateAgentParams {\npub user_name: String,\npub display_name: Option,\npub parent_did: String,\npub conformance_level: ConformanceLevel,\npub scopes: Vec,\npub external_id: Option\n}", "docs": "Parameters for creating a new agent via SCIM.", "attributes": "#[derive(Debug, Clone)]", "line": 132 }, { "name": "types::AuditEvent", "kind": "struct_item", "signature": "pub struct AuditEvent {\n#[serde(rename = \"type\")]\npub event_type: AuditEventType,\npub did: String,\npub timestamp: String,\npub details: serde_json::Value\n}", "docs": "Audit event emitted during agent lifecycle operations.", "attributes": "#[derive(Debug, Clone, Serialize)]\n#[serde(rename_all = \"camelCase\")]", "line": 144 }, { "name": "types::AuditEventType", "kind": "enum_item", "signature": "pub enum AuditEventType {\n #[serde(rename = \"agent.created\")]\n AgentCreated,\n #[serde(rename = \"agent.updated\")]\n AgentUpdated,\n #[serde(rename = \"agent.deprovisioned\")]\n AgentDeprovisioned,\n}", "docs": "Audit event types.", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]", "line": 154 }, { "name": "types::PatchOperation", "kind": "struct_item", "signature": "pub struct PatchOperation {\npub op: PatchOp,\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub path: Option,\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub value: Option\n}", "docs": "SCIM PATCH operation.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 165 }, { "name": "types::PatchOp", "kind": "enum_item", "signature": "pub enum PatchOp {\n Add,\n Replace,\n Remove,\n}", "docs": "SCIM PATCH operation type.", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"lowercase\")]", "line": 176 } ], "parseErrors": false } ] }, { "name": "conformance-runner", "url": "/reference/rust/conformance-runner", "modules": [ { "module": "handlers", "source": "openagent-sdk/conformance/runner-rust/src/handlers.rs", "sha256": "48534696f198c6051aa4beb4550a4a65c8f1c8c9a9e86fbdc8184b7fbf032b7c", "attributes": "", "items": [ { "name": "handlers::run_vector", "kind": "function_item", "signature": "pub fn run_vector(category: &str, vector: &Vector) -> VectorResult;", "docs": "", "attributes": "", "line": 8 }, { "name": "handlers::crypto::run", "kind": "function_item", "signature": "pub fn run(v: &Vector) -> Result<(), String>;", "docs": "", "attributes": "", "line": 66 }, { "name": "handlers::oas::run", "kind": "function_item", "signature": "pub fn run(v: &Vector) -> Result<(), String>;", "docs": "", "attributes": "", "line": 541 }, { "name": "handlers::arsenal::run", "kind": "function_item", "signature": "pub fn run(v: &Vector) -> Result<(), String>;", "docs": "", "attributes": "", "line": 1083 }, { "name": "handlers::aegis::run", "kind": "function_item", "signature": "pub fn run(v: &Vector) -> Result<(), String>;", "docs": "", "attributes": "", "line": 1497 }, { "name": "handlers::openagent::run", "kind": "function_item", "signature": "pub fn run(v: &Vector) -> Result<(), String>;", "docs": "", "attributes": "", "line": 2136 }, { "name": "handlers::helpers::op_str", "kind": "function_item", "signature": "pub fn op_str(v: &Vector) -> Result<&str, String>;", "docs": "", "attributes": "", "line": 2805 }, { "name": "handlers::helpers::input_hex", "kind": "function_item", "signature": "pub fn input_hex(v: &Vector, field: &str) -> Result, String>;", "docs": "", "attributes": "", "line": 2812 }, { "name": "handlers::helpers::expected_hex", "kind": "function_item", "signature": "pub fn expected_hex(v: &Vector, field: &str) -> Result, String>;", "docs": "", "attributes": "", "line": 2821 }, { "name": "handlers::helpers::expected_bool", "kind": "function_item", "signature": "pub fn expected_bool(v: &Vector, field: &str) -> Result;", "docs": "", "attributes": "", "line": 2830 }, { "name": "handlers::helpers::info_bytes", "kind": "function_item", "signature": "pub fn info_bytes(v: &Vector) -> Result, String>;", "docs": "", "attributes": "", "line": 2837 } ], "parseErrors": false }, { "module": "report", "source": "openagent-sdk/conformance/runner-rust/src/report.rs", "sha256": "1d57ff1ae3d961eec391b11f9627e2db13886125afafb326050114bad5b188e7", "attributes": "", "items": [ { "name": "report::Summary", "kind": "struct_item", "signature": "pub struct Summary {\npub total_pass: usize,\npub total_fail: usize,\npub per_category: BTreeMap\n}", "docs": "", "attributes": "#[derive(Debug, Default)]", "line": 8 }, { "name": "report::Summary::record_pass", "kind": "function_item", "signature": "pub fn record_pass(&mut self, category: &str);", "docs": "", "attributes": "", "line": 15 }, { "name": "report::Summary::record_fail", "kind": "function_item", "signature": "pub fn record_fail(&mut self, category: &str);", "docs": "", "attributes": "", "line": 23 }, { "name": "report::JunitReport", "kind": "struct_item", "signature": "pub struct JunitReport<'a> {\n\n}", "docs": "", "attributes": "", "line": 32 }, { "name": "report::JunitReport<'a>::from_results", "kind": "function_item", "signature": "pub fn from_results(suite_name: &'a str, results: &'a [VectorResult]) -> Self;", "docs": "", "attributes": "", "line": 38 }, { "name": "report::JunitReport<'a>::render", "kind": "function_item", "signature": "pub fn render(&self) -> String;", "docs": "", "attributes": "", "line": 45 } ], "parseErrors": false }, { "module": "types", "source": "openagent-sdk/conformance/runner-rust/src/types.rs", "sha256": "909d50c14862d81e62708e0297a49bf0f34dbf3d94f38edd3eddb1c8cc3adb0c", "attributes": "", "items": [ { "name": "types::Vector", "kind": "struct_item", "signature": "pub struct Vector {\npub name: String,\n#[serde(default)]\npub description: String,\n#[serde(default)]\npub tags: Vec,\npub input: serde_json::Value,\npub expected_output: serde_json::Value\n}", "docs": "", "attributes": "#[derive(Debug, Clone, Deserialize)]", "line": 7 }, { "name": "types::VectorFile", "kind": "struct_item", "signature": "pub struct VectorFile {\npub category: String,\npub name: String,\npub vectors: Vec,\npub source: PathBuf\n}", "docs": "", "attributes": "#[derive(Debug, Clone)]", "line": 18 }, { "name": "types::VectorResult", "kind": "struct_item", "signature": "pub struct VectorResult {\npub category: String,\npub file_name: String,\npub vector_name: String,\npub outcome: Result<(), String>,\npub duration_ms: u64\n}", "docs": "", "attributes": "#[derive(Debug)]", "line": 26 } ], "parseErrors": false } ] }, { "name": "openagent-auth-protocol", "url": "/reference/rust/openagent-auth-protocol", "modules": [ { "module": "crate", "source": "openagent-sdk/crates/openagent-auth-protocol/src/lib.rs", "sha256": "986125777224d8b43f4ca1fb0a3c2b107512be4c4fcd1b8eabd61e27f3c4d240", "attributes": "", "items": [ { "name": "error", "kind": "module", "signature": "pub mod error;", "docs": "", "attributes": "", "line": 45 }, { "name": "handshake", "kind": "module", "signature": "pub mod handshake;", "docs": "", "attributes": "", "line": 46 }, { "name": "message", "kind": "module", "signature": "pub mod message;", "docs": "", "attributes": "", "line": 47 }, { "name": "session", "kind": "module", "signature": "pub mod session;", "docs": "", "attributes": "", "line": 48 }, { "name": "transport", "kind": "module", "signature": "pub mod transport;", "docs": "", "attributes": "", "line": 49 }, { "name": "types", "kind": "module", "signature": "pub mod types;", "docs": "", "attributes": "", "line": 50 }, { "name": "pub use error::AuthProtocolError;", "kind": "use_declaration", "signature": "pub use error::AuthProtocolError;", "docs": "", "attributes": "", "line": 52 }, { "name": "pub use message::{\n IdentityChallenge, IdentityProof, IdentityVerified, KeyType, TrustTier, CHALLENGE_TYPE,\n};", "kind": "use_declaration", "signature": "pub use message::{\n IdentityChallenge, IdentityProof, IdentityVerified, KeyType, TrustTier, CHALLENGE_TYPE,\n};", "docs": "", "attributes": "", "line": 53 }, { "name": "pub use session::{InMemorySessionStore, Session, SessionId, SessionState, SessionStore};", "kind": "use_declaration", "signature": "pub use session::{InMemorySessionStore, Session, SessionId, SessionState, SessionStore};", "docs": "", "attributes": "", "line": 56 }, { "name": "pub use transport::AuthTransport;", "kind": "use_declaration", "signature": "pub use transport::AuthTransport;", "docs": "", "attributes": "", "line": 57 }, { "name": "pub use types::{ConformanceLevel, DidDocument, DiscoveryDocument, LineageLink, LineageProof};", "kind": "use_declaration", "signature": "pub use types::{ConformanceLevel, DidDocument, DiscoveryDocument, LineageLink, LineageProof};", "docs": "", "attributes": "", "line": 58 }, { "name": "::VERSION", "kind": "const_item", "signature": "pub const VERSION: &str;", "docs": "Crate version.", "attributes": "", "line": 61 } ], "parseErrors": false }, { "module": "error", "source": "openagent-sdk/crates/openagent-auth-protocol/src/error.rs", "sha256": "5d1c97c1abadd46bbf983286ab6542c824a0453eb896492461e6f860577a7f09", "attributes": "", "items": [ { "name": "error::AuthProtocolError", "kind": "enum_item", "signature": "pub enum AuthProtocolError {\n /// The protocol version in the received message is not supported.\n #[error(\n \"unsupported protocol version {received}; this implementation supports version {supported}\"\n )]\n UnsupportedVersion {\n /// The version received from the peer.\n received: u8,\n /// The version this implementation supports.\n supported: u8,\n },\n\n /// A challenge failed the Section 4 field constraints.\n #[error(\"invalid challenge: {reason}\")]\n InvalidChallenge {\n /// What constraint failed.\n reason: String,\n },\n\n /// A proof failed the Section 15.3 shape checks.\n #[error(\"invalid proof: {reason}\")]\n InvalidProof {\n /// What constraint failed.\n reason: String,\n },\n\n /// The nonce echoed in the proof does not match the challenge.\n #[error(\"nonce mismatch: challenge carried {expected}, proof echoed {received}\")]\n NonceMismatch {\n /// The nonce in the challenge.\n expected: String,\n /// The nonce echoed in the proof.\n received: String,\n },\n\n /// The challenge nonce has expired (anti-replay protection).\n #[error(\"challenge expired: issued at {issued}, expiry was {expiry}, current time is {now}\")]\n ChallengeExpired {\n /// When the challenge was issued.\n issued: String,\n /// When it expired.\n expiry: String,\n /// Current timestamp.\n now: String,\n },\n\n /// A nonce was reused (replay attack detected).\n #[error(\"replay detected: nonce {nonce_hex} has already been used in a prior handshake\")]\n ReplayDetected {\n /// Hex-encoded nonce that was replayed.\n nonce_hex: String,\n },\n\n /// Signature verification failed against the trusted key set.\n #[error(\"signature verification failed: {reason}\")]\n SignatureVerificationFailed {\n /// Why verification failed.\n reason: String,\n },\n\n /// The peer's DID document is structurally invalid or missing required fields.\n #[error(\"invalid DID document for {did}: {reason}\")]\n InvalidDidDocument {\n /// The DID whose document was invalid.\n did: String,\n /// What was wrong.\n reason: String,\n },\n\n /// The transport layer failed to send or receive a message.\n #[error(\"transport error: {reason}\")]\n TransportFailed {\n /// Underlying transport error.\n reason: String,\n },\n\n /// A timeout occurred waiting for a response from the peer.\n #[error(\"timeout waiting for {step} response after {timeout_secs}s\")]\n Timeout {\n /// Which protocol step timed out.\n step: String,\n /// How long we waited.\n timeout_secs: u64,\n },\n\n /// Serialization or deserialization of a protocol message failed.\n #[error(\"message serialization failed for {message_type}: {reason}\")]\n SerializationFailed {\n /// The message type being (de)serialized.\n message_type: String,\n /// Underlying failure reason.\n reason: String,\n },\n\n /// The challenge expiry duration exceeds the maximum allowed (300 seconds,\n /// per Section 7 of the Core Protocol Specification).\n #[error(\"challenge expiry {requested_secs}s exceeds maximum allowed {max_secs}s\")]\n ExpiryTooLong {\n /// The requested expiry in seconds.\n requested_secs: u64,\n /// The maximum allowed.\n max_secs: u64,\n },\n\n /// An internal failure that is not the peer's fault (e.g. a poisoned\n /// lock in a session store). Surfaced rather than panicked, per the\n /// workspace no-panic policy.\n #[error(\"internal error: {0}\")]\n Internal(String),\n\n /// A presented session token does not identify a live session.\n #[error(\"session not found: {session_id}\")]\n SessionNotFound {\n /// The token or identifier presented.\n session_id: String,\n },\n\n /// A session exists but has expired and was removed.\n #[error(\"session expired: {session_id}\")]\n SessionExpired {\n /// The token or identifier presented.\n session_id: String,\n },\n}", "docs": "Errors arising from Core Protocol handshake operations.", "attributes": "#[derive(Debug, Error)]", "line": 17 } ], "parseErrors": false }, { "module": "handshake", "source": "openagent-sdk/crates/openagent-auth-protocol/src/handshake.rs", "sha256": "45c722316200bf93f48609255516c92106a0cb15ca1741a777f02c4f7c7941a9", "attributes": "", "items": [ { "name": "handshake::DEFAULT_SESSION_TTL_SECS", "kind": "const_item", "signature": "pub const DEFAULT_SESSION_TTL_SECS: u32;", "docs": "Default session TTL in seconds (5 minutes).", "attributes": "", "line": 13 }, { "name": "handshake::DEFAULT_CHALLENGE_TTL_SECS", "kind": "const_item", "signature": "pub const DEFAULT_CHALLENGE_TTL_SECS: u32;", "docs": "Default challenge TTL in seconds (Section 7: default 30s, max 300s).", "attributes": "", "line": 16 }, { "name": "handshake::MAX_CHALLENGE_TTL_SECS", "kind": "const_item", "signature": "pub const MAX_CHALLENGE_TTL_SECS: u32;", "docs": "Maximum challenge TTL in seconds (Section 7).", "attributes": "", "line": 19 }, { "name": "handshake::WELL_KNOWN_PATH", "kind": "const_item", "signature": "pub const WELL_KNOWN_PATH: &str;", "docs": "Well-known path for discovery.", "attributes": "", "line": 22 }, { "name": "handshake::AUTH_ENDPOINT_PATH", "kind": "const_item", "signature": "pub const AUTH_ENDPOINT_PATH: &str;", "docs": "Well-known path for the auth endpoint.", "attributes": "", "line": 25 }, { "name": "handshake::PROVE_ENDPOINT_PATH", "kind": "const_item", "signature": "pub const PROVE_ENDPOINT_PATH: &str;", "docs": "Well-known path for the prove endpoint.", "attributes": "", "line": 28 }, { "name": "handshake::generate_nonce", "kind": "function_item", "signature": "pub fn generate_nonce() -> Result;", "docs": "Generate a nonce per Section 7: 32 CSPRNG bytes as 64 lowercase hex chars.", "attributes": "", "line": 31 }, { "name": "handshake::new_challenge", "kind": "function_item", "signature": "pub fn new_challenge(\n origin: &str,\n realm: Option,\n) -> Result;", "docs": "Construct a fresh [`IdentityChallenge`] for `origin`, stamping the current\nUTC time in the Section 4 format (`Z` suffix, seconds precision).", "attributes": "", "line": 39 }, { "name": "handshake::canonical_challenge_bytes", "kind": "function_item", "signature": "pub fn canonical_challenge_bytes(\n challenge: &IdentityChallenge,\n) -> Result, AuthProtocolError>;", "docs": "The signing payload for an [`IdentityProof`]: the JCS-canonicalized\n(RFC 8785) UTF-8 bytes of the challenge object, with no framing, prefix,\nor envelope (Section 5 / Section 15.2).", "attributes": "", "line": 56 }, { "name": "handshake::validate_challenge", "kind": "function_item", "signature": "pub fn validate_challenge(challenge: &IdentityChallenge) -> Result<(), AuthProtocolError>;", "docs": "Validate an [`IdentityChallenge`] against the Section 4 field constraints.\n\nA server MUST reject a challenge whose `type` differs, and an agent MUST\nreject a malformed challenge before signing it: signing binds the agent to\nthese exact bytes.", "attributes": "", "line": 77 }, { "name": "handshake::validate_nonce", "kind": "function_item", "signature": "pub fn validate_nonce(nonce: &str) -> Result<(), AuthProtocolError>;", "docs": "The nonce field: exactly 64 lowercase hex characters (Section 7).", "attributes": "", "line": 100 }, { "name": "handshake::validate_timestamp", "kind": "function_item", "signature": "pub fn validate_timestamp(timestamp: &str) -> Result<(), AuthProtocolError>;", "docs": "The timestamp field: ISO 8601 UTC with `Z` suffix and seconds precision\n(Section 4.2). Fractional seconds and numeric offsets are rejected.", "attributes": "", "line": 118 }, { "name": "handshake::validate_origin", "kind": "function_item", "signature": "pub fn validate_origin(origin: &str) -> Result<(), AuthProtocolError>;", "docs": "The origin field: `scheme://host[:port]` per RFC 6454 (Section 4.2).", "attributes": "", "line": 131 }, { "name": "handshake::validate_proof_shape", "kind": "function_item", "signature": "pub fn validate_proof_shape(\n proof: &IdentityProof,\n challenge: &IdentityChallenge,\n) -> Result<(), AuthProtocolError>;", "docs": "Validate an [`IdentityProof`] against a challenge (Section 15.3):\nthe echoed nonce must match, and the key shape must match the declared\nscheme. Signature verification itself belongs to the verifier, which knows\nthe trusted key set.", "attributes": "", "line": 150 } ], "parseErrors": false }, { "module": "message", "source": "openagent-sdk/crates/openagent-auth-protocol/src/message.rs", "sha256": "c5b5442b0fb5d236093b1e4a4c62ea4823f363fd1e063000fdf2639ec4693c88", "attributes": "", "items": [ { "name": "message::CHALLENGE_TYPE", "kind": "const_item", "signature": "pub const CHALLENGE_TYPE: &str;", "docs": "The literal `type` value of an [`IdentityChallenge`], per Section 15.2.", "attributes": "", "line": 19 }, { "name": "message::IdentityChallenge", "kind": "struct_item", "signature": "pub struct IdentityChallenge {\n/// MUST be the literal string `openagent-challenge-v1`.\n\n#[serde(rename = \"type\")]\npub message_type: String,\n/// 64-character lowercase hexadecimal string (32 CSPRNG bytes).\n\npub nonce: String,\n/// ISO 8601 UTC timestamp, `Z` suffix, seconds precision.\n\npub timestamp: String,\n/// Server origin per RFC 6454: `scheme://host[:port]`.\n\npub origin: String,\n/// Optional protection-space identifier. Omitted entirely when absent.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub realm: Option\n}", "docs": "Server \u2192 Agent: a cryptographic challenge (Section 15.2).\n\nThe signing payload for the proof is the JCS-canonicalized (RFC 8785)\nUTF-8 byte representation of this object \u2014 no framing, prefix, or\nenvelope. Use [`crate::handshake::canonical_challenge_bytes`].", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]", "line": 27 }, { "name": "message::IdentityChallenge::new", "kind": "function_item", "signature": "pub fn new(nonce: String, timestamp: String, origin: String, realm: Option) -> Self;", "docs": "Construct a challenge of the current format version.", "attributes": "", "line": 44 }, { "name": "message::KeyType", "kind": "enum_item", "signature": "pub enum KeyType {\n /// Ed25519 (32-byte public key).\n Ed25519,\n /// secp256k1 (33-byte compressed SEC1 public key).\n Secp256k1,\n}", "docs": "Signature scheme used for an [`IdentityProof`] (Section 15.3).", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"lowercase\")]", "line": 58 }, { "name": "message::IdentityProof", "kind": "struct_item", "signature": "pub struct IdentityProof {\n/// Base64url (no padding) signature over the JCS-canonicalized challenge\n\n/// bytes. 64 bytes for both schemes.\n\npub signature: String,\n/// Base64url (no padding) raw public key: 32 bytes (Ed25519) or 33 bytes\n\n/// (secp256k1 compressed).\n\npub public_key: String,\n/// The signature scheme.\n\npub key_type: KeyType,\n/// The nonce from the challenge, echoed to assist server-side lookup.\n\npub nonce: String\n}", "docs": "Agent \u2192 Server: the cryptographic proof of identity (Section 15.3).", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]", "line": 76 }, { "name": "message::TrustTier", "kind": "enum_item", "signature": "pub enum TrustTier {\n /// Identity verified against the presented key only.\n Anonymous,\n /// Identity resolved with additional registry context.\n Identified,\n /// Identity resolved with full lineage authority.\n Sovereign,\n}", "docs": "The resolution tier the server assigns after verification (Section 15.4).", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"lowercase\")]", "line": 92 }, { "name": "message::IdentityVerified", "kind": "struct_item", "signature": "pub struct IdentityVerified {\n/// Most specific resolved DID for the agent.\n\npub did: String,\n/// The resolution tier assigned by the server.\n\npub trust_tier: TrustTier,\n/// JWT session token for subsequent requests.\n\npub session_token: String,\n/// ISO 8601 UTC timestamp of session expiry.\n\npub session_expires: String,\n/// Granted capability identifiers, populated by Arsenal when present.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub capabilities: Option>\n}", "docs": "Server \u2192 Agent: identity confirmed; session issued (Section 15.4).\n\nThe `session_token` replaces further challenge-response cycles until\nexpiry; the agent presents it as a bearer credential (Section 12).", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]", "line": 116 } ], "parseErrors": false }, { "module": "session", "source": "openagent-sdk/crates/openagent-auth-protocol/src/session.rs", "sha256": "846a27ff5bfe6506161ceae4398609265381bae29a2a2cdf9816a125e4d270e8", "attributes": "", "items": [ { "name": "session::SessionId", "kind": "type_item", "signature": "pub type SessionId = String;", "docs": "Opaque session identifier (BLAKE3 of random bytes, hex-encoded).", "attributes": "", "line": 17 }, { "name": "session::SessionState", "kind": "enum_item", "signature": "pub enum SessionState {\n /// Challenge issued; waiting for PROVE.\n AwaitingProof,\n /// Handshake complete; session is usable.\n Established,\n /// Session revoked or expired.\n Closed,\n}", "docs": "States a session transitions through during the handshake.", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]", "line": 21 }, { "name": "session::Session", "kind": "struct_item", "signature": "pub struct Session {\n/// Unique session identifier.\n\npub id: SessionId,\n/// Current handshake state.\n\npub state: SessionState,\n/// DID of the initiator (client).\n\npub initiator_did: String,\n/// DID of the responder (server).\n\npub responder_did: String,\n/// Nonce issued in the CHALLENGE step.\n\npub nonce: String,\n/// When the session was created.\n\npub created_at: DateTime,\n/// When the session expires.\n\npub expires_at: DateTime,\n/// Capabilities granted upon establishment.\n\n#[serde(default)]\npub capabilities: Vec\n}", "docs": "An authenticated session between two agents.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 32 }, { "name": "session::Session::is_expired", "kind": "function_item", "signature": "pub fn is_expired(&self) -> bool;", "docs": "Returns `true` if the session has expired.", "attributes": "", "line": 54 }, { "name": "session::Session::is_valid", "kind": "function_item", "signature": "pub fn is_valid(&self) -> bool;", "docs": "Returns `true` if the session is established and not expired.", "attributes": "", "line": 59 }, { "name": "session::SessionStore", "kind": "trait_item", "signature": "pub trait SessionStore: Send + Sync {\n /// Persist a new or updated session.\n async fn put(&self, session: Session) -> Result<(), AuthProtocolError>;\n /// Retrieve a session by its ID. Returns `None` if not found.\n async fn get(&self, id: &str) -> Result, AuthProtocolError>;\n /// Remove a session by its ID.\n async fn remove(&self, id: &str) -> Result<(), AuthProtocolError>;\n}", "docs": "Trait for pluggable session storage backends.\n\nImplementations must be `Send + Sync` for use with async runtimes.", "attributes": "#[async_trait::async_trait]", "line": 68 }, { "name": "session::InMemorySessionStore", "kind": "struct_item", "signature": "pub struct InMemorySessionStore {\n\n}", "docs": "In-memory session store \u2014 suitable for tests and single-node deployments.", "attributes": "#[derive(Debug, Clone, Default)]", "line": 79 }, { "name": "session::InMemorySessionStore::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Creates a new empty session store.", "attributes": "", "line": 85 } ], "parseErrors": false }, { "module": "transport", "source": "openagent-sdk/crates/openagent-auth-protocol/src/transport.rs", "sha256": "476f11d26cb734a256dfa734f413bb7660732700cddc9b8f2c274aa386a7faa2", "attributes": "", "items": [ { "name": "transport::AuthTransport", "kind": "trait_item", "signature": "pub trait AuthTransport: Send + Sync {\n /// Request a challenge from the server (proactive flow).\n async fn fetch_challenge(&self, endpoint: &str)\n -> Result;\n\n /// Send an [`IdentityProof`] and receive the [`IdentityVerified`] session.\n async fn prove(\n &self,\n endpoint: &str,\n proof: &IdentityProof,\n ) -> Result;\n}", "docs": "Transport-agnostic interface for the agent side of the identity flow.\n\nThe agent either receives a challenge passively (a `401` with a\n`WWW-Authenticate` challenge on the HTTP binding) or fetches one\nproactively, then proves. Responders handle inbound proofs through their\nframework-specific integration (e.g. an Axum layer).", "attributes": "#[async_trait]", "line": 21 } ], "parseErrors": false }, { "module": "types", "source": "openagent-sdk/crates/openagent-auth-protocol/src/types.rs", "sha256": "399d81227f0317d5513cd77a42d84da7b8f6f4772057de68a851138b880dd485", "attributes": "", "items": [ { "name": "types::ConformanceLevel", "kind": "enum_item", "signature": "pub enum ConformanceLevel {\n /// L0: Passive signals only (UA, TLS fingerprint).\n #[serde(rename = \"L0\")]\n L0,\n /// L1: Behavioral analysis (18-dim feature extraction).\n #[serde(rename = \"L1\")]\n L1,\n /// L2: Full cryptographic proof (Ed25519 / FIDO2).\n #[serde(rename = \"L2\")]\n L2,\n}", "docs": "Conformance levels for entity classification (Bioagentic).", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]", "line": 11 }, { "name": "types::ConformanceLevel::level", "kind": "function_item", "signature": "pub fn level(&self) -> u8;", "docs": "Returns the numeric ordering (L0=0, L1=1, L2=2).", "attributes": "", "line": 25 }, { "name": "types::ConformanceLevel::satisfies", "kind": "function_item", "signature": "pub fn satisfies(&self, required: &Self) -> bool;", "docs": "Returns true if `self` satisfies the `required` level.", "attributes": "", "line": 34 }, { "name": "types::DidDocument", "kind": "struct_item", "signature": "pub struct DidDocument {\n/// Canonical DID (e.g. `did:oas:l1fe:agent:my-bot`).\n\npub id: String,\n/// Multibase-encoded Ed25519 verification key.\n\npub verification_key: String,\n/// Entity kind (`agent`, `tool`, `service`, etc.).\n\npub kind: String,\n/// Optional parent DID for lineage.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub parent: Option\n}", "docs": "Minimal DID document fragment for the handshake.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 51 }, { "name": "types::LineageProof", "kind": "struct_item", "signature": "pub struct LineageProof {\n/// Chain of DID-to-DID attestations from the agent back to HMR.\n\npub chain: Vec\n}", "docs": "Cryptographic lineage proof linking an agent to its human root.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 65 }, { "name": "types::LineageLink", "kind": "struct_item", "signature": "pub struct LineageLink {\n/// DID of the parent (delegator).\n\npub from: String,\n/// DID of the child (delegatee).\n\npub to: String,\n/// Ed25519 signature by `from` over the delegation assertion.\n\npub signature: String,\n/// ISO-8601 timestamp of the delegation.\n\npub issued_at: String\n}", "docs": "A single link in the lineage chain.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 72 }, { "name": "types::DiscoveryDocument", "kind": "struct_item", "signature": "pub struct DiscoveryDocument {\n/// Auth endpoint path (default: `/.well-known/openagent/auth`).\n\npub auth_endpoint: String,\n/// Supported protocol versions.\n\npub supported_versions: Vec,\n/// Server's DID.\n\npub server_did: String,\n/// Minimum conformance level required.\n\npub required_conformance_level: ConformanceLevel\n}", "docs": "Server discovery response at `GET /.well-known/openagent`.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 85 } ], "parseErrors": false } ] }, { "name": "openagent-crypto-wasm", "url": "/reference/rust/openagent-crypto-wasm", "modules": [ { "module": "crate", "source": "openagent-sdk/crates/openagent-crypto-wasm/src/lib.rs", "sha256": "ca7f8f0e1dcb8f5effbb78f617609f811f8d519ada03695de6199cebdbf2ce9d", "attributes": "", "items": [ { "name": "aead", "kind": "module", "signature": "pub mod aead;", "docs": "", "attributes": "", "line": 86 }, { "name": "blake3_hash", "kind": "module", "signature": "pub mod blake3_hash;", "docs": "", "attributes": "", "line": 87 }, { "name": "ct", "kind": "module", "signature": "pub mod ct;", "docs": "", "attributes": "", "line": 88 }, { "name": "ed25519", "kind": "module", "signature": "pub mod ed25519;", "docs": "", "attributes": "", "line": 89 }, { "name": "encoding", "kind": "module", "signature": "pub mod encoding;", "docs": "", "attributes": "", "line": 90 }, { "name": "error", "kind": "module", "signature": "pub mod error;", "docs": "", "attributes": "", "line": 91 }, { "name": "frost", "kind": "module", "signature": "pub mod frost;", "docs": "", "attributes": "", "line": 92 }, { "name": "hkdf_sha256", "kind": "module", "signature": "pub mod hkdf_sha256;", "docs": "", "attributes": "", "line": 93 }, { "name": "jcs", "kind": "module", "signature": "pub mod jcs;", "docs": "", "attributes": "", "line": 94 }, { "name": "kdf_password", "kind": "module", "signature": "pub mod kdf_password;", "docs": "", "attributes": "", "line": 95 }, { "name": "sha", "kind": "module", "signature": "pub mod sha;", "docs": "", "attributes": "", "line": 96 }, { "name": "x25519", "kind": "module", "signature": "pub mod x25519;", "docs": "", "attributes": "", "line": 97 }, { "name": "wasm_api", "kind": "module", "signature": "pub mod wasm_api;", "docs": "", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]", "line": 101 }, { "name": "pub use error::CryptoError;", "kind": "use_declaration", "signature": "pub use error::CryptoError;", "docs": "", "attributes": "", "line": 103 }, { "name": "::VERSION", "kind": "const_item", "signature": "pub const VERSION: &str;", "docs": "Crate version, sourced from `Cargo.toml` at compile time.", "attributes": "", "line": 106 } ], "parseErrors": false }, { "module": "aead", "source": "openagent-sdk/crates/openagent-crypto-wasm/src/aead.rs", "sha256": "b05c0a00dca8d771fd7d2443a5bd1f00e5d223dc3acfda28d9a8bf5a626d674c", "attributes": "", "items": [ { "name": "aead::AES256GCM_KEY_LEN", "kind": "const_item", "signature": "pub const AES256GCM_KEY_LEN: usize;", "docs": "Length of an AES-256-GCM key in bytes.", "attributes": "", "line": 22 }, { "name": "aead::AES256GCM_NONCE_LEN", "kind": "const_item", "signature": "pub const AES256GCM_NONCE_LEN: usize;", "docs": "Length of an AES-256-GCM nonce in bytes (96 bits, recommended).", "attributes": "", "line": 24 }, { "name": "aead::XCHACHA20POLY1305_KEY_LEN", "kind": "const_item", "signature": "pub const XCHACHA20POLY1305_KEY_LEN: usize;", "docs": "Length of an XChaCha20-Poly1305 key in bytes.", "attributes": "", "line": 27 }, { "name": "aead::XCHACHA20POLY1305_NONCE_LEN", "kind": "const_item", "signature": "pub const XCHACHA20POLY1305_NONCE_LEN: usize;", "docs": "Length of an XChaCha20-Poly1305 nonce in bytes (192 bits, extended).", "attributes": "", "line": 29 }, { "name": "aead::aes256gcm_encrypt", "kind": "function_item", "signature": "pub fn aes256gcm_encrypt(\n key: &[u8],\n nonce: &[u8],\n plaintext: &[u8],\n aad: &[u8],\n) -> Result, CryptoError>;", "docs": "Encrypts `plaintext` with AES-256-GCM.\n\nReturns `ciphertext || tag` (16-byte tag appended).\n\n# Errors\n\n- [`CryptoError::InvalidLength`] if `key` or `nonce` has the wrong length.\n- [`CryptoError::AeadFailed`] if the underlying cipher rejects the input.", "attributes": "", "line": 39 }, { "name": "aead::aes256gcm_decrypt", "kind": "function_item", "signature": "pub fn aes256gcm_decrypt(\n key: &[u8],\n nonce: &[u8],\n ciphertext: &[u8],\n aad: &[u8],\n) -> Result, CryptoError>;", "docs": "Decrypts `ciphertext` with AES-256-GCM, verifying the tag.\n\n`ciphertext` must be `actual_ciphertext || tag`. Returns the plaintext on\nsuccessful tag verification.\n\n# Errors\n\n- [`CryptoError::InvalidLength`] if `key` or `nonce` has the wrong length.\n- [`CryptoError::AeadFailed`] (operation = `\"decrypt\"`) on tag failure.", "attributes": "", "line": 89 }, { "name": "aead::xchacha20poly1305_encrypt", "kind": "function_item", "signature": "pub fn xchacha20poly1305_encrypt(\n key: &[u8],\n nonce: &[u8],\n plaintext: &[u8],\n aad: &[u8],\n) -> Result, CryptoError>;", "docs": "Encrypts `plaintext` with XChaCha20-Poly1305 (extended-nonce variant).\n\nReturns `ciphertext || tag` (16-byte tag appended).\n\n# Errors\n\n- [`CryptoError::InvalidLength`] if `key` or `nonce` has the wrong length.\n- [`CryptoError::AeadFailed`] if the cipher rejects the input.", "attributes": "", "line": 138 }, { "name": "aead::xchacha20poly1305_decrypt", "kind": "function_item", "signature": "pub fn xchacha20poly1305_decrypt(\n key: &[u8],\n nonce: &[u8],\n ciphertext: &[u8],\n aad: &[u8],\n) -> Result, CryptoError>;", "docs": "Decrypts `ciphertext` with XChaCha20-Poly1305, verifying the tag.\n\n# Errors\n\n- [`CryptoError::InvalidLength`] if `key` or `nonce` has the wrong length.\n- [`CryptoError::AeadFailed`] (operation = `\"decrypt\"`) on tag failure.", "attributes": "", "line": 185 } ], "parseErrors": false }, { "module": "blake3_hash", "source": "openagent-sdk/crates/openagent-crypto-wasm/src/blake3_hash.rs", "sha256": "8ecfbe5691e332d06ec01ba5e08495b7e630e3257697784491a49b54ff511b40", "attributes": "", "items": [ { "name": "blake3_hash::HASH_LEN", "kind": "const_item", "signature": "pub const HASH_LEN: usize;", "docs": "BLAKE3 output length in bytes.", "attributes": "", "line": 12 }, { "name": "blake3_hash::KEY_LEN", "kind": "const_item", "signature": "pub const KEY_LEN: usize;", "docs": "BLAKE3 keyed-hash key length in bytes.", "attributes": "", "line": 14 }, { "name": "blake3_hash::hash", "kind": "function_item", "signature": "pub fn hash(data: &[u8]) -> [u8; HASH_LEN];", "docs": "Computes the BLAKE3 hash of `data`.\n\n# Examples\n\n```\nlet h = openagent_crypto_wasm::blake3_hash::hash(b\"hello world\");\nassert_eq!(h.len(), 32);\n```", "attributes": "", "line": 24 }, { "name": "blake3_hash::keyed_hash", "kind": "function_item", "signature": "pub fn keyed_hash(key: &[u8], data: &[u8]) -> Result<[u8; HASH_LEN], CryptoError>;", "docs": "Computes the keyed BLAKE3 hash of `data` under the 32-byte `key`.\n\n# Errors\n\n[`CryptoError::InvalidLength`] if `key` is not exactly 32 bytes.", "attributes": "", "line": 33 }, { "name": "blake3_hash::derive_key", "kind": "function_item", "signature": "pub fn derive_key(context: &str, key_material: &[u8]) -> [u8; HASH_LEN];", "docs": "Derives a 32-byte key using BLAKE3's key-derivation mode.\n\n`context` should be a hard-coded ASCII string unique per application/protocol\n(BLAKE3 KDF best practice).", "attributes": "", "line": 44 } ], "parseErrors": false }, { "module": "ct", "source": "openagent-sdk/crates/openagent-crypto-wasm/src/ct.rs", "sha256": "f322224a71a82f8f9092f36c0e26fd7a73322f9083bec9f3aece14b0ba508d51", "attributes": "", "items": [ { "name": "ct::ct_eq", "kind": "function_item", "signature": "pub fn ct_eq(a: &[u8], b: &[u8]) -> bool;", "docs": "Returns `true` iff `a` and `b` have the same length and identical contents.\n\nComparison is **constant time** with respect to slice length: the entire\n`a` slice is consumed before returning. Use this for comparing secrets,\nMAC tags, and any byte sequence whose contents must not leak via timing.\n\n# Examples\n\n```\nuse openagent_crypto_wasm::ct::ct_eq;\nassert!(ct_eq(b\"abc\", b\"abc\"));\nassert!(!ct_eq(b\"abc\", b\"abd\"));\nassert!(!ct_eq(b\"abc\", b\"abcd\"));\n```", "attributes": "", "line": 28 }, { "name": "ct::fill_random", "kind": "function_item", "signature": "pub fn fill_random(out: &mut [u8]) -> Result<(), CryptoError>;", "docs": "Fills `out` with cryptographically secure random bytes.\n\nOn native targets this calls `getrandom::getrandom` which delegates to the\nOS CSPRNG (`/dev/urandom`, `getrandom(2)`, `BCryptGenRandom`, etc.). On\nWebAssembly with the `wasm` feature enabled, the same call routes through\nthe JS host's `crypto.getRandomValues`.\n\n# Errors\n\n[`CryptoError::RngFailed`] if the underlying CSPRNG returns an error\n(extremely rare; usually only on misconfigured WASI environments).", "attributes": "", "line": 46 }, { "name": "ct::random_bytes", "kind": "function_item", "signature": "pub fn random_bytes(n: usize) -> Result, CryptoError>;", "docs": "Returns `n` cryptographically secure random bytes.", "attributes": "", "line": 53 } ], "parseErrors": false }, { "module": "ed25519", "source": "openagent-sdk/crates/openagent-crypto-wasm/src/ed25519.rs", "sha256": "e179bc0994784a264936ee081d125197bc8c5a2396fd4195a5c539e3fd97c0f4", "attributes": "", "items": [ { "name": "ed25519::SIGNING_KEY_LEN", "kind": "const_item", "signature": "pub const SIGNING_KEY_LEN: usize;", "docs": "Length of an Ed25519 signing (private) key in bytes.", "attributes": "", "line": 21 }, { "name": "ed25519::VERIFYING_KEY_LEN", "kind": "const_item", "signature": "pub const VERIFYING_KEY_LEN: usize;", "docs": "Length of an Ed25519 verifying (public) key in bytes.", "attributes": "", "line": 23 }, { "name": "ed25519::SIGNATURE_LEN", "kind": "const_item", "signature": "pub const SIGNATURE_LEN: usize;", "docs": "Length of an Ed25519 signature in bytes.", "attributes": "", "line": 25 }, { "name": "ed25519::Keypair", "kind": "struct_item", "signature": "pub struct Keypair {\n\n}", "docs": "An Ed25519 keypair, suitable for both Rust and WASM contexts.\n\nHolds the 32-byte signing key and the derived 32-byte verifying key. The\nsigning key bytes are zeroized when this struct is dropped.\n\n# Security\n\n`Debug` deliberately redacts the signing key. Do not log a [`Keypair`] in\nany way that could expose `signing_key`.", "attributes": "", "line": 36 }, { "name": "ed25519::Keypair::signing_key_bytes", "kind": "function_item", "signature": "pub fn signing_key_bytes(&self) -> [u8; SIGNING_KEY_LEN];", "docs": "Returns a copy of the 32-byte signing (private) key bytes.\n\nThe returned array should be wiped after use.", "attributes": "#[inline]", "line": 61 }, { "name": "ed25519::Keypair::verifying_key_bytes", "kind": "function_item", "signature": "pub fn verifying_key_bytes(&self) -> [u8; VERIFYING_KEY_LEN];", "docs": "Returns a copy of the 32-byte verifying (public) key bytes.", "attributes": "#[inline]", "line": 67 }, { "name": "ed25519::generate_keypair", "kind": "function_item", "signature": "pub fn generate_keypair() -> Keypair;", "docs": "Generates a fresh Ed25519 keypair using the OS / WASM host CSPRNG.\n\n# Examples\n\n```\nlet kp = openagent_crypto_wasm::ed25519::generate_keypair();\nassert_eq!(kp.signing_key_bytes().len(), 32);\nassert_eq!(kp.verifying_key_bytes().len(), 32);\n```", "attributes": "", "line": 81 }, { "name": "ed25519::keypair_from_signing_key", "kind": "function_item", "signature": "pub fn keypair_from_signing_key(signing_key: &[u8]) -> Result;", "docs": "Constructs an Ed25519 keypair from raw signing-key bytes.\n\nThe verifying key is computed deterministically from the signing key.\n\n# Errors\n\n[`CryptoError::InvalidLength`] if `signing_key` is not exactly\n[`SIGNING_KEY_LEN`] bytes.", "attributes": "", "line": 102 }, { "name": "ed25519::public_from_private", "kind": "function_item", "signature": "pub fn public_from_private(signing_key: &[u8]) -> Result<[u8; VERIFYING_KEY_LEN], CryptoError>;", "docs": "Derives the Ed25519 verifying (public) key from a signing (private) key.\n\n# Errors\n\n[`CryptoError::InvalidLength`] if `signing_key` is not exactly 32 bytes.", "attributes": "", "line": 119 }, { "name": "ed25519::sign", "kind": "function_item", "signature": "pub fn sign(signing_key: &[u8], message: &[u8]) -> Result<[u8; SIGNATURE_LEN], CryptoError>;", "docs": "Signs `message` with the supplied 32-byte Ed25519 signing key.\n\nReturns the 64-byte detached signature.\n\n# Errors\n\n[`CryptoError::InvalidLength`] if `signing_key` is not exactly 32 bytes.", "attributes": "", "line": 131 }, { "name": "ed25519::verify", "kind": "function_item", "signature": "pub fn verify(verifying_key: &[u8], message: &[u8], signature: &[u8]) -> Result<(), CryptoError>;", "docs": "Verifies an Ed25519 signature against the given verifying key and message.\n\nReturns `Ok(())` on success.\n\n# Errors\n\n- [`CryptoError::InvalidLength`] if either `verifying_key` or `signature`\n has the wrong length.\n- [`CryptoError::InvalidPublicKey`] if `verifying_key` is not on the curve.\n- [`CryptoError::SignatureInvalid`] if verification fails.", "attributes": "", "line": 150 } ], "parseErrors": false }, { "module": "encoding", "source": "openagent-sdk/crates/openagent-crypto-wasm/src/encoding.rs", "sha256": "9f8b44e6dae5524119b6fdf05def6dc7db8eb9b7165257052594db7899c03449", "attributes": "", "items": [ { "name": "encoding::encode", "kind": "function_item", "signature": "pub fn encode(bytes: &[u8]) -> String;", "docs": "Encodes raw bytes as multibase base58btc with the `z` prefix.\n\n# Examples\n\n```\nlet s = openagent_crypto_wasm::encoding::encode(&[0xDE, 0xAD, 0xBE, 0xEF]);\nassert!(s.starts_with('z'));\n```", "attributes": "", "line": 19 }, { "name": "encoding::decode", "kind": "function_item", "signature": "pub fn decode(input: &str) -> Result, CryptoError>;", "docs": "Decodes a multibase base58btc string (must start with `z`) into raw bytes.\n\n# Errors\n\n[`CryptoError::MultibaseFailed`] if:\n- The input is empty or does not start with `'z'`\n- The base58btc payload is malformed", "attributes": "", "line": 33 } ], "parseErrors": false }, { "module": "error", "source": "openagent-sdk/crates/openagent-crypto-wasm/src/error.rs", "sha256": "45f418c13364d1919337da58b6082b122998ab707bc834816dca8bc90ea1d57f", "attributes": "", "items": [ { "name": "error::CryptoError", "kind": "enum_item", "signature": "pub enum CryptoError {\n /// A byte slice did not have the length required by the primitive.\n #[error(\"invalid byte length for {what}: expected {expected}, got {actual}\")]\n InvalidLength {\n /// What was being constructed (e.g. `\"Ed25519 signing key\"`).\n what: &'static str,\n /// Expected length in bytes.\n expected: usize,\n /// Actual length received.\n actual: usize,\n },\n\n /// An Ed25519 signature failed verification.\n #[error(\"Ed25519 signature verification failed: {reason}\")]\n SignatureInvalid {\n /// Why verification failed (algorithm-supplied reason).\n reason: String,\n },\n\n /// An Ed25519 public key could not be constructed from the supplied bytes.\n #[error(\"invalid Ed25519 public key: {reason}\")]\n InvalidPublicKey {\n /// Why the public key was rejected.\n reason: String,\n },\n\n /// HKDF expansion failed (typically: requested OKM exceeds 255*HashLen).\n #[error(\"HKDF-SHA256 {stage} failed: {reason}\")]\n HkdfFailed {\n /// `\"extract\"` or `\"expand\"`.\n stage: &'static str,\n /// Underlying failure reason.\n reason: String,\n },\n\n /// AEAD encryption or decryption failed (auth tag mismatch or bad input).\n #[error(\"AEAD {algorithm} {operation} failed: {reason}\")]\n AeadFailed {\n /// `\"AES-256-GCM\"` or `\"XChaCha20-Poly1305\"`.\n algorithm: &'static str,\n /// `\"encrypt\"` or `\"decrypt\"`.\n operation: &'static str,\n /// Underlying failure reason.\n reason: String,\n },\n\n /// Argon2id password hashing or verification failed.\n #[error(\"Argon2id {operation} failed: {reason}\")]\n PasswordHashFailed {\n /// `\"hash\"` or `\"verify\"`.\n operation: &'static str,\n /// Underlying failure reason.\n reason: String,\n },\n\n /// JCS (RFC 8785) canonicalization failed (typically: invalid JSON input).\n #[error(\"JCS canonicalization failed: {reason}\")]\n JcsFailed {\n /// Underlying failure reason.\n reason: String,\n },\n\n /// Multibase encoding or decoding failed.\n #[error(\"multibase {operation} failed: {reason}\")]\n MultibaseFailed {\n /// `\"encode\"` or `\"decode\"`.\n operation: &'static str,\n /// Underlying failure reason.\n reason: String,\n },\n\n /// FROST trusted-dealer key generation failed.\n #[error(\"FROST keygen failed for {min_signers}-of-{max_signers}: {reason}\")]\n FrostKeygenFailed {\n /// Threshold `t`.\n min_signers: u16,\n /// Total participants `n`.\n max_signers: u16,\n /// Underlying failure reason.\n reason: String,\n },\n\n /// FROST round-1 commitment, round-2 share, or aggregation step failed.\n #[error(\"FROST {stage} failed: {reason}\")]\n FrostStageFailed {\n /// One of `\"round1\"`, `\"round2\"`, `\"aggregate\"`, `\"verify\"`.\n stage: &'static str,\n /// Underlying failure reason.\n reason: String,\n },\n\n /// FROST participant selection was rejected (wrong count, OOB index, duplicate).\n #[error(\"FROST participant selection invalid: {reason}\")]\n FrostInvalidParticipants {\n /// Why the selection was rejected.\n reason: String,\n },\n\n /// A serialization/deserialization step failed.\n #[error(\"serialization failed for {what}: {reason}\")]\n SerializationFailed {\n /// What was being (de)serialized.\n what: &'static str,\n /// Underlying failure reason.\n reason: String,\n },\n\n /// The OS / WASM-host CSPRNG was unavailable or returned an error.\n #[error(\"system random number generator failed: {reason}\")]\n RngFailed {\n /// Underlying failure reason.\n reason: String,\n },\n}", "docs": "Errors arising from `openagent-crypto-wasm` primitives.\n\nConstruct via `?` from internal fallible operations. Match on the variant\nto discriminate failure modes; format with `Display` to surface the message.", "attributes": "#[derive(Debug, Error)]", "line": 18 } ], "parseErrors": false }, { "module": "frost", "source": "openagent-sdk/crates/openagent-crypto-wasm/src/frost.rs", "sha256": "9167fd0ac7d830b71fc393a2a12a7cd68ca017d28ed5c0be720f47ebb172e745", "attributes": "", "items": [ { "name": "frost::KeyShareBundle", "kind": "struct_item", "signature": "pub struct KeyShareBundle {\n/// Threshold `t` \u2014 minimum number of signers required.\n\npub min_signers: u16,\n/// Total participants `n`.\n\npub max_signers: u16,\n/// One serialized `KeyPackage` per participant, in identifier order.\n\npub key_packages: Vec>,\n/// Serialized `PublicKeyPackage` shared by every participant.\n\npub public_key_package: Vec,\n/// Group verifying (public) key, raw 32 bytes.\n\npub group_public_key: Vec\n}", "docs": "A complete bundle of FROST key shares produced by [`trusted_keygen`].\n\nContains every participant's serialized [`KeyPackage`](frost::keys::KeyPackage)\nand the shared [`PublicKeyPackage`](frost::keys::PublicKeyPackage). In\nproduction deployments, the dealer SHOULD distribute exactly one\n`key_packages[i]` entry to participant `i` and then destroy the bundle.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 47 }, { "name": "frost::Round1Output", "kind": "struct_item", "signature": "pub struct Round1Output {\n/// Serialized `SigningNonces` \u2014 KEEP SECRET on the participant's machine.\n\npub nonces: Vec,\n/// Serialized `SigningCommitments` \u2014 broadcast to all signers + coordinator.\n\npub commitments: Vec\n}", "docs": "Output of [`sign_round1`] for a single participant.\n\nContains the participant's `nonces` (kept secret, used in round 2) and\n`commitments` (sent to the coordinator and broadcast to other signers).", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 65 }, { "name": "frost::ParticipantCommitments", "kind": "struct_item", "signature": "pub struct ParticipantCommitments {\n/// 1-based participant identifier (matches the position in `key_packages`).\n\npub identifier: u16,\n/// Serialized `SigningCommitments` from `sign_round1`.\n\npub commitments: Vec\n}", "docs": "A pairing of (participant identifier, that participant's serialized commitments).", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 74 }, { "name": "frost::ParticipantShare", "kind": "struct_item", "signature": "pub struct ParticipantShare {\n/// 1-based participant identifier (matches the position in `key_packages`).\n\npub identifier: u16,\n/// Serialized `SignatureShare` from `sign_round2`.\n\npub share: Vec\n}", "docs": "A pairing of (participant identifier, that participant's signature share).", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 83 }, { "name": "frost::trusted_keygen", "kind": "function_item", "signature": "pub fn trusted_keygen(min_signers: u16, max_signers: u16) -> Result;", "docs": "Generates a t-of-n FROST key share bundle via the trusted-dealer protocol.\n\n# Arguments\n\n* `min_signers` \u2014 threshold `t`. Must be >= 2.\n* `max_signers` \u2014 total participants `n`. Must be >= `min_signers`.\n\n# Errors\n\n- [`CryptoError::FrostKeygenFailed`] if the parameters are invalid or the\n underlying FROST keygen fails.\n- [`CryptoError::SerializationFailed`] if any serialized output cannot be\n produced (should never happen with valid keygen output).", "attributes": "", "line": 103 }, { "name": "frost::sign_round1", "kind": "function_item", "signature": "pub fn sign_round1(serialized_key_package: &[u8]) -> Result;", "docs": "Round-1 of the FROST protocol for a single participant.\n\nGenerates that participant's signing nonces and commitments. The nonces\nMUST be kept secret and passed verbatim into [`sign_round2`]. The\ncommitments are broadcast to all other selected signers and to the\ncoordinator.\n\n# Errors\n\n- [`CryptoError::SerializationFailed`] if the input key package cannot be\n parsed or the outputs cannot be serialized.", "attributes": "", "line": 191 }, { "name": "frost::sign_round2", "kind": "function_item", "signature": "pub fn sign_round2(\n serialized_key_package: &[u8],\n serialized_nonces: &[u8],\n message: &[u8],\n commitments: &[ParticipantCommitments],\n) -> Result, CryptoError>;", "docs": "Round-2 of the FROST protocol for a single participant.\n\nGiven the participant's serialized key package, their secret nonces from\nround 1, the message to sign, and the aggregated commitments from all\nsigners, produces this participant's signature share.\n\n# Arguments\n\n* `serialized_key_package` \u2014 this participant's key package bytes.\n* `serialized_nonces` \u2014 the `nonces` field from this participant's\n [`Round1Output`].\n* `message` \u2014 the message bytes being signed.\n* `commitments` \u2014 every selected signer's commitments (including this one),\n tagged with their 1-based identifier.\n\n# Errors\n\n- [`CryptoError::SerializationFailed`] for any deserialization failure.\n- [`CryptoError::FrostStageFailed`] (stage = `\"round2\"`) if the round-2\n signing operation rejects the inputs.", "attributes": "", "line": 242 }, { "name": "frost::aggregate", "kind": "function_item", "signature": "pub fn aggregate(\n message: &[u8],\n commitments: &[ParticipantCommitments],\n shares: &[ParticipantShare],\n serialized_public_key_package: &[u8],\n) -> Result, CryptoError>;", "docs": "Aggregates per-participant signature shares into a single Ed25519 signature.\n\n# Arguments\n\n* `message` \u2014 the same message bytes that were signed in round 2.\n* `commitments` \u2014 every selected signer's commitments (must match the set\n used in round 2).\n* `shares` \u2014 every selected signer's `SignatureShare` from round 2.\n* `serialized_public_key_package` \u2014 the bundle's `public_key_package` field.\n\nReturns a 64-byte Ed25519 signature.\n\n# Errors\n\n- [`CryptoError::SerializationFailed`] for any deserialization failure.\n- [`CryptoError::FrostStageFailed`] (stage = `\"aggregate\"`) if FROST\n aggregation fails.", "attributes": "", "line": 292 }, { "name": "frost::verify", "kind": "function_item", "signature": "pub fn verify(\n message: &[u8],\n signature: &[u8],\n group_public_key: &[u8],\n) -> Result<(), CryptoError>;", "docs": "Verifies a FROST-Ed25519 threshold signature against the group public key.\n\nFROST produces standard Ed25519 signatures, so this is a straight delegate\nto [`crate::ed25519::verify`]. Provided here for API symmetry with the rest\nof the FROST module.\n\n# Errors\n\n- [`CryptoError::FrostStageFailed`] (stage = `\"verify\"`) on any verification\n failure (we wrap the underlying Ed25519 error so callers can branch on the\n FROST-specific stage if needed).", "attributes": "", "line": 351 } ], "parseErrors": false }, { "module": "hkdf_sha256", "source": "openagent-sdk/crates/openagent-crypto-wasm/src/hkdf_sha256.rs", "sha256": "150f18f8e76586b7619205c3804ac25284d3c64360f906764ee4bd462fdebc1a", "attributes": "", "items": [ { "name": "hkdf_sha256::PRK_LEN", "kind": "const_item", "signature": "pub const PRK_LEN: usize;", "docs": "Length of the HKDF-SHA256 PRK output (== HashLen).", "attributes": "", "line": 17 }, { "name": "hkdf_sha256::extract", "kind": "function_item", "signature": "pub fn extract(salt: &[u8], ikm: &[u8]) -> [u8; PRK_LEN];", "docs": "Performs `HKDF-Extract(salt, IKM)`.\n\nReturns the 32-byte pseudo-random key.\n\n# Arguments\n\n* `salt` \u2014 optional salt; pass an empty slice for the \"no salt\" case (the\n HKDF will internally use 32 zero bytes per RFC 5869).\n* `ikm` \u2014 input keying material.", "attributes": "", "line": 28 }, { "name": "hkdf_sha256::expand", "kind": "function_item", "signature": "pub fn expand(prk: &[u8], info: &[u8], length: usize) -> Result, CryptoError>;", "docs": "Performs `HKDF-Expand(PRK, info, length)`.\n\n# Errors\n\n- [`CryptoError::InvalidLength`] if `prk` is not exactly 32 bytes.\n- [`CryptoError::HkdfFailed`] if `length` exceeds `255 * HashLen` (8160 bytes\n for SHA-256), which is the maximum allowed by RFC 5869.", "attributes": "", "line": 43 }, { "name": "hkdf_sha256::derive", "kind": "function_item", "signature": "pub fn derive(salt: &[u8], ikm: &[u8], info: &[u8], length: usize) -> Result, CryptoError>;", "docs": "Convenience: combined `HKDF-Extract` + `HKDF-Expand` in one call.\n\nEquivalent to running [`extract`] then [`expand`] but avoids exposing the\nintermediate PRK to the caller.\n\n# Errors\n\n[`CryptoError::HkdfFailed`] if `length` exceeds `255 * HashLen`.", "attributes": "", "line": 68 } ], "parseErrors": false }, { "module": "jcs", "source": "openagent-sdk/crates/openagent-crypto-wasm/src/jcs.rs", "sha256": "06d4f1069cf4f1bd1e99da710961198c3c22f15031fbecadd0bf8ff84a3cfbe6", "attributes": "", "items": [ { "name": "jcs::canonicalize", "kind": "function_item", "signature": "pub fn canonicalize(input: &str) -> Result, CryptoError>;", "docs": "Canonicalizes a UTF-8 JSON string into its JCS bytes.\n\n`input` MUST be a valid JSON document. Invalid JSON returns\n[`CryptoError::JcsFailed`].\n\n# Examples\n\n```\nlet bytes = openagent_crypto_wasm::jcs::canonicalize(r#\"{\"b\":1,\"a\":2}\"#).unwrap();\nassert_eq!(bytes, br#\"{\"a\":2,\"b\":1}\"#);\n```", "attributes": "", "line": 26 }, { "name": "jcs::canonicalize_value", "kind": "function_item", "signature": "pub fn canonicalize_value(value: &serde_json::Value) -> Result, CryptoError>;", "docs": "Canonicalizes a [`serde_json::Value`] into its JCS bytes.\n\nUse this when you already have a parsed `serde_json::Value` (e.g. from a\ndownstream Rust crate) so you don't pay the cost of re-parsing.", "attributes": "", "line": 38 } ], "parseErrors": false }, { "module": "kdf_password", "source": "openagent-sdk/crates/openagent-crypto-wasm/src/kdf_password.rs", "sha256": "c021bffeadff900136368ce8482ab55ccdec97252df3d516ed985b9deabe67ad", "attributes": "", "items": [ { "name": "kdf_password::hash_password", "kind": "function_item", "signature": "pub fn hash_password(password: &[u8]) -> Result;", "docs": "Hashes `password` with Argon2id and a fresh random salt.\n\nReturns the PHC-format encoded hash string (`$argon2id$v=19$m=...`).\n\n# Errors\n\n[`CryptoError::PasswordHashFailed`] if the underlying hasher fails.", "attributes": "", "line": 24 }, { "name": "kdf_password::verify_password", "kind": "function_item", "signature": "pub fn verify_password(password: &[u8], encoded_hash: &str) -> Result;", "docs": "Verifies `password` against a PHC-format encoded Argon2id hash.\n\nReturns `Ok(true)` on a valid match, `Ok(false)` on a mismatch, and\n[`CryptoError::PasswordHashFailed`] only if the hash string is malformed.", "attributes": "", "line": 41 } ], "parseErrors": false }, { "module": "sha", "source": "openagent-sdk/crates/openagent-crypto-wasm/src/sha.rs", "sha256": "2336d7624b2af848b3f708a8182c87c46da2ec140dd6237e0fa1c1a4807bb622", "attributes": "", "items": [ { "name": "sha::SHA256_LEN", "kind": "const_item", "signature": "pub const SHA256_LEN: usize;", "docs": "Length of a SHA-256 hash in bytes.", "attributes": "", "line": 10 }, { "name": "sha::SHA512_LEN", "kind": "const_item", "signature": "pub const SHA512_LEN: usize;", "docs": "Length of a SHA-512 hash in bytes.", "attributes": "", "line": 12 }, { "name": "sha::sha256", "kind": "function_item", "signature": "pub fn sha256(data: &[u8]) -> [u8; SHA256_LEN];", "docs": "Computes the SHA-256 hash of `data`.", "attributes": "", "line": 15 }, { "name": "sha::sha512", "kind": "function_item", "signature": "pub fn sha512(data: &[u8]) -> [u8; SHA512_LEN];", "docs": "Computes the SHA-512 hash of `data`.", "attributes": "", "line": 25 } ], "parseErrors": false }, { "module": "x25519", "source": "openagent-sdk/crates/openagent-crypto-wasm/src/x25519.rs", "sha256": "c3377cf2c8c6a2f73d789a2ae207d9fdc9c28dd61499daee727076477af34af6", "attributes": "", "items": [ { "name": "x25519::SECRET_KEY_LEN", "kind": "const_item", "signature": "pub const SECRET_KEY_LEN: usize;", "docs": "Length of an X25519 secret (private) key in bytes.", "attributes": "", "line": 15 }, { "name": "x25519::PUBLIC_KEY_LEN", "kind": "const_item", "signature": "pub const PUBLIC_KEY_LEN: usize;", "docs": "Length of an X25519 public key in bytes.", "attributes": "", "line": 17 }, { "name": "x25519::SHARED_SECRET_LEN", "kind": "const_item", "signature": "pub const SHARED_SECRET_LEN: usize;", "docs": "Length of an X25519 raw shared secret in bytes.", "attributes": "", "line": 19 }, { "name": "x25519::X25519Keypair", "kind": "struct_item", "signature": "pub struct X25519Keypair {\n\n}", "docs": "An X25519 keypair (Curve25519, RFC 7748).\n\nThe secret key is zeroized on drop.", "attributes": "", "line": 24 }, { "name": "x25519::X25519Keypair::secret_key_bytes", "kind": "function_item", "signature": "pub fn secret_key_bytes(&self) -> [u8; SECRET_KEY_LEN];", "docs": "Returns a copy of the 32-byte secret key bytes.", "attributes": "#[inline]", "line": 47 }, { "name": "x25519::X25519Keypair::public_key_bytes", "kind": "function_item", "signature": "pub fn public_key_bytes(&self) -> [u8; PUBLIC_KEY_LEN];", "docs": "Returns a copy of the 32-byte public key bytes.", "attributes": "#[inline]", "line": 53 }, { "name": "x25519::generate_keypair", "kind": "function_item", "signature": "pub fn generate_keypair() -> X25519Keypair;", "docs": "Generates a fresh X25519 keypair using the OS / WASM host CSPRNG.", "attributes": "", "line": 59 }, { "name": "x25519::public_from_secret", "kind": "function_item", "signature": "pub fn public_from_secret(secret_key: &[u8]) -> Result<[u8; PUBLIC_KEY_LEN], CryptoError>;", "docs": "Derives an X25519 public key from a 32-byte secret key.\n\n# Errors\n\n[`CryptoError::InvalidLength`] if `secret_key` is not exactly 32 bytes.", "attributes": "", "line": 77 }, { "name": "x25519::diffie_hellman", "kind": "function_item", "signature": "pub fn diffie_hellman(\n secret_key: &[u8],\n peer_public_key: &[u8],\n) -> Result<[u8; SHARED_SECRET_LEN], CryptoError>;", "docs": "Performs an X25519 Diffie-Hellman key exchange.\n\nReturns the raw 32-byte shared secret. Callers MUST process this through\na KDF (e.g. [`crate::hkdf_sha256`]) before using it as keying material.\n\n# Errors\n\n[`CryptoError::InvalidLength`] if either input is not 32 bytes.", "attributes": "", "line": 94 } ], "parseErrors": false }, { "module": "wasm_api", "source": "openagent-sdk/crates/openagent-crypto-wasm/src/wasm_api.rs", "sha256": "c567a5871c7879f19bf7b1be000244cb4f8d41f9f677a3d02d617dd4db9bfd6f", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]", "items": [ { "name": "wasm_api::WasmKeypair", "kind": "struct_item", "signature": "pub struct WasmKeypair {\n\n}", "docs": "JS-friendly Ed25519 keypair: `{ signing_key, verifying_key }` as\n`Uint8Array` byte arrays. Returned by [`ed25519_generate_keypair`].", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]\n#[derive(Clone)]", "line": 50 }, { "name": "wasm_api::WasmKeypair::signing_key", "kind": "function_item", "signature": "pub fn signing_key(&self) -> Vec;", "docs": "32-byte signing (private) key.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen(getter)]", "line": 59 }, { "name": "wasm_api::WasmKeypair::verifying_key", "kind": "function_item", "signature": "pub fn verifying_key(&self) -> Vec;", "docs": "32-byte verifying (public) key.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen(getter)]", "line": 65 }, { "name": "wasm_api::WasmX25519Keypair", "kind": "struct_item", "signature": "pub struct WasmX25519Keypair {\n\n}", "docs": "JS-friendly X25519 keypair: `{ secret_key, public_key }`.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]\n#[derive(Clone)]", "line": 73 }, { "name": "wasm_api::WasmX25519Keypair::secret_key", "kind": "function_item", "signature": "pub fn secret_key(&self) -> Vec;", "docs": "32-byte secret (private) key.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen(getter)]", "line": 82 }, { "name": "wasm_api::WasmX25519Keypair::public_key", "kind": "function_item", "signature": "pub fn public_key(&self) -> Vec;", "docs": "32-byte public key.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen(getter)]", "line": 88 }, { "name": "wasm_api::ed25519_generate_keypair", "kind": "function_item", "signature": "pub fn ed25519_generate_keypair() -> WasmKeypair;", "docs": "Generates a fresh Ed25519 keypair using the host CSPRNG.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]", "line": 99 }, { "name": "wasm_api::ed25519_sign", "kind": "function_item", "signature": "pub fn ed25519_sign(signing_key: &[u8], message: &[u8]) -> Result, JsError>;", "docs": "Signs `message` with the supplied 32-byte Ed25519 signing key.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]", "line": 109 }, { "name": "wasm_api::ed25519_verify", "kind": "function_item", "signature": "pub fn ed25519_verify(\n verifying_key: &[u8],\n message: &[u8],\n signature: &[u8],\n) -> Result<(), JsError>;", "docs": "Verifies an Ed25519 signature. Throws if verification fails.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]", "line": 117 }, { "name": "wasm_api::ed25519_public_from_private", "kind": "function_item", "signature": "pub fn ed25519_public_from_private(signing_key: &[u8]) -> Result, JsError>;", "docs": "Derives the Ed25519 verifying key from a signing key.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]", "line": 127 }, { "name": "wasm_api::x25519_generate_keypair", "kind": "function_item", "signature": "pub fn x25519_generate_keypair() -> WasmX25519Keypair;", "docs": "Generates a fresh X25519 keypair using the host CSPRNG.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]", "line": 139 }, { "name": "wasm_api::x25519_diffie_hellman", "kind": "function_item", "signature": "pub fn x25519_diffie_hellman(\n secret_key: &[u8],\n peer_public_key: &[u8],\n) -> Result, JsError>;", "docs": "Computes the X25519 raw shared secret. Callers MUST run this through HKDF\nbefore using it as keying material.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]", "line": 150 }, { "name": "wasm_api::hkdf_sha256_extract", "kind": "function_item", "signature": "pub fn hkdf_sha256_extract(salt: &[u8], ikm: &[u8]) -> Vec;", "docs": "`HKDF-Extract(salt, IKM)` \u2014 returns the 32-byte PRK.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]", "line": 165 }, { "name": "wasm_api::hkdf_sha256_expand", "kind": "function_item", "signature": "pub fn hkdf_sha256_expand(prk: &[u8], info: &[u8], length: usize) -> Result, JsError>;", "docs": "`HKDF-Expand(PRK, info, length)`.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]", "line": 171 }, { "name": "wasm_api::hkdf_sha256_derive", "kind": "function_item", "signature": "pub fn hkdf_sha256_derive(\n salt: &[u8],\n ikm: &[u8],\n info: &[u8],\n length: usize,\n) -> Result, JsError>;", "docs": "Combined extract + expand HKDF-SHA256 derivation.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]", "line": 177 }, { "name": "wasm_api::blake3_hash_bytes", "kind": "function_item", "signature": "pub fn blake3_hash_bytes(data: &[u8]) -> Vec;", "docs": "BLAKE3 hash of `data`.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]", "line": 192 }, { "name": "wasm_api::blake3_keyed_hash", "kind": "function_item", "signature": "pub fn blake3_keyed_hash(key: &[u8], data: &[u8]) -> Result, JsError>;", "docs": "BLAKE3 keyed hash.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]", "line": 198 }, { "name": "wasm_api::blake3_derive_key", "kind": "function_item", "signature": "pub fn blake3_derive_key(context: &str, key_material: &[u8]) -> Vec;", "docs": "BLAKE3 KDF mode: `derive_key(context, key_material)`.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]", "line": 206 }, { "name": "wasm_api::sha256", "kind": "function_item", "signature": "pub fn sha256(data: &[u8]) -> Vec;", "docs": "SHA-256 hash of `data`.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]", "line": 212 }, { "name": "wasm_api::sha512", "kind": "function_item", "signature": "pub fn sha512(data: &[u8]) -> Vec;", "docs": "SHA-512 hash of `data`.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]", "line": 218 }, { "name": "wasm_api::aes256gcm_encrypt", "kind": "function_item", "signature": "pub fn aes256gcm_encrypt(\n key: &[u8],\n nonce: &[u8],\n plaintext: &[u8],\n aad: &[u8],\n) -> Result, JsError>;", "docs": "AES-256-GCM encryption. Returns `ciphertext || tag`.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]", "line": 228 }, { "name": "wasm_api::aes256gcm_decrypt", "kind": "function_item", "signature": "pub fn aes256gcm_decrypt(\n key: &[u8],\n nonce: &[u8],\n ciphertext: &[u8],\n aad: &[u8],\n) -> Result, JsError>;", "docs": "AES-256-GCM decryption.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]", "line": 239 }, { "name": "wasm_api::xchacha20poly1305_encrypt", "kind": "function_item", "signature": "pub fn xchacha20poly1305_encrypt(\n key: &[u8],\n nonce: &[u8],\n plaintext: &[u8],\n aad: &[u8],\n) -> Result, JsError>;", "docs": "XChaCha20-Poly1305 encryption.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]", "line": 250 }, { "name": "wasm_api::xchacha20poly1305_decrypt", "kind": "function_item", "signature": "pub fn xchacha20poly1305_decrypt(\n key: &[u8],\n nonce: &[u8],\n ciphertext: &[u8],\n aad: &[u8],\n) -> Result, JsError>;", "docs": "XChaCha20-Poly1305 decryption.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]", "line": 261 }, { "name": "wasm_api::argon2id_hash_password", "kind": "function_item", "signature": "pub fn argon2id_hash_password(password: &[u8]) -> Result;", "docs": "Hashes `password` with Argon2id, returning a PHC-format string.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]", "line": 276 }, { "name": "wasm_api::argon2id_verify_password", "kind": "function_item", "signature": "pub fn argon2id_verify_password(password: &[u8], encoded_hash: &str) -> Result;", "docs": "Verifies a password against a PHC-format Argon2id hash.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]", "line": 282 }, { "name": "wasm_api::jcs_canonicalize", "kind": "function_item", "signature": "pub fn jcs_canonicalize(json: &str) -> Result, JsError>;", "docs": "JCS canonicalization (RFC 8785) of a JSON string.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]", "line": 292 }, { "name": "wasm_api::multibase_base58btc_encode", "kind": "function_item", "signature": "pub fn multibase_base58btc_encode(bytes: &[u8]) -> String;", "docs": "Multibase base58btc encode.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]", "line": 298 }, { "name": "wasm_api::multibase_base58btc_decode", "kind": "function_item", "signature": "pub fn multibase_base58btc_decode(input: &str) -> Result, JsError>;", "docs": "Multibase base58btc decode.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]", "line": 304 }, { "name": "wasm_api::ct_eq", "kind": "function_item", "signature": "pub fn ct_eq(a: &[u8], b: &[u8]) -> bool;", "docs": "Constant-time byte equality. Returns `false` for slices of differing length.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]", "line": 310 }, { "name": "wasm_api::random_bytes", "kind": "function_item", "signature": "pub fn random_bytes(n: usize) -> Result, JsError>;", "docs": "Returns `n` cryptographically random bytes.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]", "line": 316 }, { "name": "wasm_api::frost_trusted_keygen", "kind": "function_item", "signature": "pub fn frost_trusted_keygen(min_signers: u16, max_signers: u16) -> Result;", "docs": "Generates a t-of-n FROST key share bundle (trusted dealer).\n\nReturns a JSON string of [`KeyShareBundle`](crate::frost::KeyShareBundle).", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]", "line": 333 }, { "name": "wasm_api::frost_sign_round1", "kind": "function_item", "signature": "pub fn frost_sign_round1(serialized_key_package: &[u8]) -> Result;", "docs": "FROST round 1 for a single participant. Returns JSON of [`Round1Output`](crate::frost::Round1Output).", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]", "line": 340 }, { "name": "wasm_api::frost_sign_round2", "kind": "function_item", "signature": "pub fn frost_sign_round2(\n serialized_key_package: &[u8],\n serialized_nonces: &[u8],\n message: &[u8],\n commitments_json: &str,\n) -> Result, JsError>;", "docs": "FROST round 2 for a single participant.\n\n`commitments_json` is a JSON array of\n[`ParticipantCommitments`](crate::frost::ParticipantCommitments).", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]", "line": 350 }, { "name": "wasm_api::frost_aggregate", "kind": "function_item", "signature": "pub fn frost_aggregate(\n message: &[u8],\n commitments_json: &str,\n shares_json: &str,\n serialized_public_key_package: &[u8],\n) -> Result, JsError>;", "docs": "FROST aggregation: combine signature shares into a 64-byte Ed25519 signature.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]", "line": 369 }, { "name": "wasm_api::frost_verify", "kind": "function_item", "signature": "pub fn frost_verify(\n message: &[u8],\n signature: &[u8],\n group_public_key: &[u8],\n) -> Result<(), JsError>;", "docs": "Verifies a FROST signature. Throws on failure.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]", "line": 389 }, { "name": "wasm_api::version", "kind": "function_item", "signature": "pub fn version() -> String;", "docs": "Returns the crate version string.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]", "line": 399 }, { "name": "wasm_api::act_verify", "kind": "function_item", "signature": "pub fn act_verify(\n token_bytes: &[u8],\n trusted_keys: &[u8],\n expected_issuer: &str,\n expected_audience: &str,\n required_scopes: Vec,\n leeway_seconds: i64,\n now_unix_seconds: i64,\n) -> Result;", "docs": "Verifies an ACT envelope against the trusted key set and policy, and\nreturns the claims as a JSON string.\n\nThis is the full normative procedure from `agent-capability-token`, not a\nre-implementation: envelope decode, version/algorithm checks, Ed25519\nsignature verification (checked **before** any claim, so an attacker\ncannot plant unauthenticated claim content), temporal checks with leeway,\nand issuer/audience/scope policy.\n\nArguments:\n- `token_bytes`: the ACT envelope bytes (CBOR).\n- `trusted_keys`: concatenated raw 32-byte Ed25519 public keys (exactly 32\n bytes each, any count > 0). Keys are tried in order; `kid` is a hint for\n audit, never authoritative for selection.\n- `expected_issuer` / `expected_audience`: the policy bindings. Both are\n required, deliberately: a verifier that does not bind the token's\n intended audience accepts tokens meant for someone else.\n- `required_scopes`: each entry a `service:resource:action` scope string\n the token must grant; wildcards in the GRANT expand, in the REQUEST are\n literal.\n- `leeway_seconds`: symmetric clock-skew allowance on temporal checks.\n- `now_unix_seconds`: 0 for the system clock, or a pinned time for tests\n and for replaying a decision at a known instant.\n\nErrors (thrown on the JS side) are the canonical `ActError` reasons, so a\nforged token reports distinctly from an expired one and an unimplemented\nformat version distinctly from both.", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]", "line": 436 }, { "name": "wasm_api::act_decode_unverified", "kind": "function_item", "signature": "pub fn act_decode_unverified(token_bytes: &[u8]) -> Result;", "docs": "Decodes an ACT envelope's claims WITHOUT verifying the signature, for\ndiagnostics and tooling. The returned string is prefixed so callers cannot\naccidentally treat the contents as verified.\n\nNever use this for authorization: unverified claims are attacker\ncontrolled. Authorization decisions go through [`act_verify`].", "attributes": "#[cfg(feature = \"wasm\")]\n#[cfg_attr(docsrs, doc(cfg(feature = \"wasm\")))]\n#[wasm_bindgen]", "line": 497 } ], "parseErrors": false } ] }, { "name": "openagent-skills-policy", "url": "/reference/rust/openagent-skills-policy", "modules": [ { "module": "crate", "source": "openagent-sdk/crates/openagent-skills-policy/rust/src/lib.rs", "sha256": "6523cde71371235b5d154fb57f0ef3abba4272d7bb7702c13ea1e3cdf6648685", "attributes": "", "items": [ { "name": "audit", "kind": "module", "signature": "pub mod audit;", "docs": "", "attributes": "", "line": 69 }, { "name": "did", "kind": "module", "signature": "pub mod did;", "docs": "", "attributes": "", "line": 70 }, { "name": "engine", "kind": "module", "signature": "pub mod engine;", "docs": "", "attributes": "", "line": 72 }, { "name": "error", "kind": "module", "signature": "pub mod error;", "docs": "", "attributes": "", "line": 73 }, { "name": "policy", "kind": "module", "signature": "pub mod policy;", "docs": "", "attributes": "", "line": 74 }, { "name": "rate", "kind": "module", "signature": "pub mod rate;", "docs": "", "attributes": "", "line": 75 }, { "name": "skills_md", "kind": "module", "signature": "pub mod skills_md;", "docs": "", "attributes": "", "line": 76 }, { "name": "pub use audit::{AuditChain, HashHex, Receipt};", "kind": "use_declaration", "signature": "pub use audit::{AuditChain, HashHex, Receipt};", "docs": "", "attributes": "", "line": 78 }, { "name": "pub use did::Did;", "kind": "use_declaration", "signature": "pub use did::Did;", "docs": "", "attributes": "", "line": 79 }, { "name": "pub use engine::{arsenal_error_from, InvocationContext, SkillsPolicy};", "kind": "use_declaration", "signature": "pub use engine::{arsenal_error_from, InvocationContext, SkillsPolicy};", "docs": "", "attributes": "", "line": 80 }, { "name": "pub use error::{Result, SkillsPolicyError};", "kind": "use_declaration", "signature": "pub use error::{Result, SkillsPolicyError};", "docs": "", "attributes": "", "line": 81 }, { "name": "pub use policy::{\n AuditLevel, DefaultRule, RateLimit, SkillRule, SkillsPolicyDoc, TimeWindow,\n CURRENT_VERSION, MAX_SKILL_RULES,\n};", "kind": "use_declaration", "signature": "pub use policy::{\n AuditLevel, DefaultRule, RateLimit, SkillRule, SkillsPolicyDoc, TimeWindow,\n CURRENT_VERSION, MAX_SKILL_RULES,\n};", "docs": "", "attributes": "", "line": 82 }, { "name": "pub use skills_md::{SkillEntry, SkillsManifest};", "kind": "use_declaration", "signature": "pub use skills_md::{SkillEntry, SkillsManifest};", "docs": "", "attributes": "", "line": 86 } ], "parseErrors": false }, { "module": "audit", "source": "openagent-sdk/crates/openagent-skills-policy/rust/src/audit.rs", "sha256": "bcd120729293228acf0d04e5b12283d672de19108329b1136e444f3e455b609b", "attributes": "", "items": [ { "name": "audit::HASH_LEN", "kind": "const_item", "signature": "pub const HASH_LEN: usize;", "docs": "Length of a BLAKE3 hash in bytes.", "attributes": "", "line": 20 }, { "name": "audit::HashHex", "kind": "struct_item", "signature": "pub struct HashHex(String);", "docs": "A hex-encoded hash (used for JSON-friendly serialization).", "attributes": "#[derive(Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(transparent)]", "line": 25 }, { "name": "audit::HashHex::from_bytes", "kind": "function_item", "signature": "pub fn from_bytes(bytes: &[u8; HASH_LEN]) -> Self;", "docs": "Build from raw bytes.", "attributes": "#[must_use]", "line": 30 }, { "name": "audit::HashHex::as_str", "kind": "function_item", "signature": "pub fn as_str(&self) -> &str;", "docs": "Return the hex string.", "attributes": "#[must_use]", "line": 36 }, { "name": "audit::Receipt", "kind": "struct_item", "signature": "pub struct Receipt {\n/// Monotonically increasing sequence number, starting at 0.\n\npub sequence: u64,\n/// Skill that was invoked.\n\npub skill: String,\n/// DID of the invoking agent.\n\npub agent: String,\n/// Session ID the invocation happened under.\n\npub session: String,\n/// When the invocation was recorded (UTC, RFC 3339).\n\npub invoked_at: String,\n/// Audit level applied when recording.\n\npub audit_level: AuditLevel,\n/// Hash of the arguments (always present; the argument payload itself is\n\n/// only included when `audit_level = Full`).\n\npub arguments_hash: HashHex,\n/// Full arguments JSON \u2014 only populated when `audit_level = Full`.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub arguments: Option,\n/// Hash of the previous receipt in the chain (or zero for the first).\n\npub previous_hash: HashHex,\n/// Hash of *this* receipt \u2014 computed over all fields above plus\n\n/// `previous_hash`.\n\npub receipt_hash: HashHex\n}", "docs": "A single invocation receipt.\n\nReceipts are immutable. New invocations produce new receipts rather than\nmutating existing ones.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 58 }, { "name": "audit::AuditChain", "kind": "struct_item", "signature": "pub struct AuditChain {\n\n}", "docs": "Append-only chain of invocation receipts.", "attributes": "#[derive(Debug, Default, Clone)]", "line": 86 }, { "name": "audit::AuditChain::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Create an empty chain.", "attributes": "#[must_use]", "line": 94 }, { "name": "audit::AuditChain::len", "kind": "function_item", "signature": "pub fn len(&self) -> usize;", "docs": "Number of receipts in the chain.", "attributes": "#[must_use]", "line": 100 }, { "name": "audit::AuditChain::is_empty", "kind": "function_item", "signature": "pub fn is_empty(&self) -> bool;", "docs": "Whether the chain is empty.", "attributes": "#[must_use]", "line": 106 }, { "name": "audit::AuditChain::head", "kind": "function_item", "signature": "pub fn head(&self) -> HashHex;", "docs": "The current head hash (all-zero if the chain is empty).", "attributes": "#[must_use]", "line": 112 }, { "name": "audit::AuditChain::get", "kind": "function_item", "signature": "pub fn get(&self, sequence: u64) -> Option<&Receipt>;", "docs": "Get a receipt by its sequence number.", "attributes": "#[must_use]", "line": 118 }, { "name": "audit::AuditChain::iter", "kind": "function_item", "signature": "pub fn iter(&self) -> impl Iterator;", "docs": "Iterate over all receipts in order.", "attributes": "", "line": 123 }, { "name": "audit::AuditChain::verify", "kind": "function_item", "signature": "pub fn verify(&self) -> bool;", "docs": "Verify that every receipt's `receipt_hash` and `previous_hash`\nmatches the recomputed chain. Returns `true` if intact.", "attributes": "#[must_use]", "line": 130 } ], "parseErrors": false }, { "module": "did", "source": "openagent-sdk/crates/openagent-skills-policy/rust/src/did.rs", "sha256": "c2b2af023a2d408322f60d815ccb05d1c39ed16728e03f7b612556db5fe37669", "attributes": "", "items": [ { "name": "did::Did", "kind": "struct_item", "signature": "pub struct Did(String);", "docs": "A Decentralized Identifier (DID) that identifies the agent a policy\napplies to.\n\nFormat: `did::`. For L1fe agents this is\ntypically `did:oas:l1fe:agent:`.", "attributes": "#[derive(Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]\n#[serde(transparent)]", "line": 28 }, { "name": "did::Did::new", "kind": "function_item", "signature": "pub fn new(input: impl Into) -> Result;", "docs": "Create a new DID with validation.\n\n# Errors\nReturns [`SkillsPolicyError::InvalidPolicy`] if the input does not\nlook like a DID.", "attributes": "", "line": 36 }, { "name": "did::Did::as_str", "kind": "function_item", "signature": "pub fn as_str(&self) -> &str;", "docs": "Return the raw DID string.", "attributes": "#[must_use]", "line": 44 } ], "parseErrors": false }, { "module": "engine", "source": "openagent-sdk/crates/openagent-skills-policy/rust/src/engine.rs", "sha256": "9e55ac1b6524d85519315932929f89032d22db8f361634fcd7adc6b13a394abe", "attributes": "", "items": [ { "name": "engine::InvocationContext", "kind": "struct_item", "signature": "pub struct InvocationContext {\n/// DID of the invoking agent.\n\npub agent_did: Did,\n/// Session ID (opaque string \u2014 matches `arsenal-core::SessionId` shape).\n\npub session_id: String,\n/// Arguments that will be passed to the skill.\n\npub arguments: serde_json::Value,\n/// Wall-clock time of the attempted invocation (UTC).\n\npub invoked_at: OffsetDateTime,\n/// Whether the caller has already collected human-in-the-loop consent.\n\npub consent_granted: bool\n}", "docs": "Context passed into `can_invoke` / `record_invocation` describing who is\nattempting to use a skill, when, and with what arguments.", "attributes": "#[derive(Debug, Clone)]", "line": 31 }, { "name": "engine::InvocationContext::new", "kind": "function_item", "signature": "pub fn new(\n agent_did: Did,\n session_id: impl Into,\n arguments: serde_json::Value,\n ) -> Self;", "docs": "Convenience constructor. `consent_granted` defaults to `false`.", "attributes": "", "line": 46 }, { "name": "engine::InvocationContext::with_consent", "kind": "function_item", "signature": "pub fn with_consent(mut self) -> Self;", "docs": "Mark consent as granted (e.g. after a HITL approval flow).", "attributes": "#[must_use]", "line": 62 }, { "name": "engine::InvocationContext::with_invoked_at", "kind": "function_item", "signature": "pub fn with_invoked_at(mut self, t: OffsetDateTime) -> Self;", "docs": "Override the invocation timestamp (primarily for testing).", "attributes": "#[must_use]", "line": 69 }, { "name": "engine::SkillsPolicy", "kind": "struct_item", "signature": "pub struct SkillsPolicy {\n\n}", "docs": "Governance engine for agent skill invocations.", "attributes": "", "line": 76 }, { "name": "engine::SkillsPolicy::from_yaml", "kind": "function_item", "signature": "pub fn from_yaml(yaml: &str) -> Result;", "docs": "Parse a policy YAML document.\n\n# Errors\nReturns [`SkillsPolicyError::InvalidPolicy`] if the YAML is malformed\nor fails structural validation.", "attributes": "", "line": 101 }, { "name": "engine::SkillsPolicy::from_file", "kind": "function_item", "signature": "pub fn from_file(path: &Path) -> Result;", "docs": "Load a policy YAML document from a file path.\n\n# Errors\nReturns [`SkillsPolicyError::Io`] on read failure, or any error from\n[`SkillsPolicy::from_yaml`] on parse/validation failure.", "attributes": "", "line": 119 }, { "name": "engine::SkillsPolicy::agent", "kind": "function_item", "signature": "pub fn agent(&self) -> &Did;", "docs": "The DID of the agent this policy applies to.", "attributes": "#[must_use]", "line": 129 }, { "name": "engine::SkillsPolicy::has_rule", "kind": "function_item", "signature": "pub fn has_rule(&self, skill: &str) -> bool;", "docs": "Whether the policy has a per-skill rule for `skill`.", "attributes": "#[must_use]", "line": 135 }, { "name": "engine::SkillsPolicy::can_invoke", "kind": "function_item", "signature": "pub fn can_invoke(&self, skill: &str, ctx: &InvocationContext) -> Result<()>;", "docs": "Read-only check: can `ctx` invoke `skill` right now?\n\nThis runs every policy dimension except the rate-limit *advance*. A\nsuccessful return does not consume any rate-limit tokens \u2014 use\n`record_invocation` for that.\n\n# Errors\nReturns a specific [`SkillsPolicyError`] variant per failed dimension.", "attributes": "", "line": 147 }, { "name": "engine::SkillsPolicy::record_invocation", "kind": "function_item", "signature": "pub fn record_invocation(\n &mut self,\n skill: &str,\n ctx: &InvocationContext,\n ) -> Result;", "docs": "Authorize and record an invocation.\n\nThis runs `can_invoke`, then checks and advances the rate limiter,\nthen appends a [`Receipt`] to the hash-chained audit log. On any\nfailure no state changes.\n\n# Errors\nReturns the first dimension that failed. On rate-limit failure the\ncaller gets `used` and `max` values to surface a friendly error.", "attributes": "", "line": 213 }, { "name": "engine::SkillsPolicy::audit_chain", "kind": "function_item", "signature": "pub fn audit_chain(&self) -> &AuditChain;", "docs": "Borrow the audit chain for inspection (verification, export).", "attributes": "#[must_use]", "line": 281 }, { "name": "engine::SkillsPolicy::reset_rate_limit", "kind": "function_item", "signature": "pub fn reset_rate_limit(&mut self, skill: &str);", "docs": "Reset the rate-limit state for a single skill.", "attributes": "", "line": 286 }, { "name": "engine::arsenal_error_from", "kind": "function_item", "signature": "pub fn arsenal_error_from(err: &SkillsPolicyError) -> arsenal_core::ArsenalError;", "docs": "Used by integration with Arsenal: convert a `SkillsPolicyError` into an\n`arsenal_core::ArsenalError`. Kept behind the engine module so that\ndownstream crates can depend on this without pulling the whole module\ngraph.", "attributes": "", "line": 370 } ], "parseErrors": false }, { "module": "error", "source": "openagent-sdk/crates/openagent-skills-policy/rust/src/error.rs", "sha256": "e81853a8af43c13d6d09e8d0dac265acba3f37b22f391ecb0e909ef05828fcad", "attributes": "", "items": [ { "name": "error::Result", "kind": "type_item", "signature": "pub type Result = std::result::Result;", "docs": "Result alias for the skills policy engine.", "attributes": "", "line": 12 }, { "name": "error::SkillsPolicyError", "kind": "enum_item", "signature": "pub enum SkillsPolicyError {\n /// The policy YAML failed to parse or validate.\n #[error(\"invalid policy document: {0}\")]\n InvalidPolicy(String),\n\n /// Failed to read a file from disk.\n #[error(\"failed to read {path}: {source}\")]\n Io {\n /// The path we tried to read.\n path: PathBuf,\n /// The underlying I/O error.\n #[source]\n source: std::io::Error,\n },\n\n /// The skill name is not allowed under the current policy.\n ///\n /// This covers both explicit `deny_list` hits and the implicit deny from\n /// `default.allow: false` when the skill is not in any allow list.\n #[error(\"skill `{skill}` is not allowed by policy: {reason}\")]\n NotAllowed {\n /// The skill name that was rejected.\n skill: String,\n /// Why it was rejected (e.g. \"in deny_list\", \"no matching rule\").\n reason: String,\n },\n\n /// The invocation exceeded the configured rate limit for this skill.\n #[error(\"rate limit exceeded for skill `{skill}`: {used}/{max} in {window_secs}s window\")]\n RateLimitExceeded {\n /// The skill name.\n skill: String,\n /// How many invocations were observed in the window.\n used: u64,\n /// The maximum allowed in the window.\n max: u64,\n /// The window length in seconds.\n window_secs: u64,\n },\n\n /// Arguments did not match the declared JSON Schema.\n #[error(\"argument constraints violated for skill `{skill}`: {details}\")]\n ArgumentConstraint {\n /// The skill name.\n skill: String,\n /// Human-readable detail about the violation.\n details: String,\n },\n\n /// The current time is outside any permitted time window.\n #[error(\"skill `{skill}` cannot be invoked at this time: outside allowed time windows\")]\n OutsideTimeWindow {\n /// The skill name.\n skill: String,\n },\n\n /// Human-in-the-loop consent is required and has not been granted.\n #[error(\"skill `{skill}` requires consent but none was provided\")]\n ConsentRequired {\n /// The skill name.\n skill: String,\n },\n\n /// The SKILLS.md file could not be parsed.\n #[error(\"failed to parse SKILLS.md: {0}\")]\n InvalidSkillsMarkdown(String),\n}", "docs": "All errors produced by the skills policy engine.", "attributes": "#[derive(Debug, Error)]", "line": 16 } ], "parseErrors": false }, { "module": "policy", "source": "openagent-sdk/crates/openagent-skills-policy/rust/src/policy.rs", "sha256": "68313deafe836186c7c6805a142260bdd81f9f350dc30c0b1c4d900e29eaab6f", "attributes": "", "items": [ { "name": "policy::MAX_SKILL_RULES", "kind": "const_item", "signature": "pub const MAX_SKILL_RULES: usize;", "docs": "Maximum number of skill rules in a single policy document.\n\nMirrors Arsenal's `MAX_RULES_PER_POLICY` to keep the two in lockstep.", "attributes": "", "line": 21 }, { "name": "policy::CURRENT_VERSION", "kind": "const_item", "signature": "pub const CURRENT_VERSION: u32;", "docs": "Current policy schema version.", "attributes": "", "line": 24 }, { "name": "policy::AuditLevel", "kind": "enum_item", "signature": "pub enum AuditLevel {\n /// No audit event produced.\n None,\n /// Record only the skill name, DID, and a hash of the arguments.\n #[default]\n Hash,\n /// Record the full arguments JSON in the receipt.\n Full,\n}", "docs": "How much detail to record for each invocation.", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, Default)]\n#[serde(rename_all = \"snake_case\")]", "line": 29 }, { "name": "policy::RateLimit", "kind": "struct_item", "signature": "pub struct RateLimit {\n/// Window length as a string (parsed to seconds at load time).\n\npub window: String,\n/// Maximum invocations allowed within a single window.\n\npub max: u64\n}", "docs": "A rate limit for a single skill.\n\nThe window is expressed as a human-friendly string (`1s`, `30m`, `1h`,\n`24h`) which the engine parses at load time.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 44 }, { "name": "policy::TimeWindow", "kind": "struct_item", "signature": "pub struct TimeWindow {\n/// Inclusive start hour in UTC (0..=23).\n\npub start_hour: u8,\n/// Exclusive end hour in UTC (0..=24). 24 means midnight.\n\npub end_hour: u8,\n/// Optional weekday filter (0=Sunday..6=Saturday). Empty = all days.\n\n#[serde(default)]\npub weekdays: Vec\n}", "docs": "A time window during which a skill may be invoked.\n\nHours are interpreted in UTC. `start_hour` may be greater than `end_hour`\nto express an overnight window (e.g. 22..6).", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 56 }, { "name": "policy::SkillRule", "kind": "struct_item", "signature": "pub struct SkillRule {\n/// Whether the agent may invoke this skill at all.\n\n///\n\n/// Defaults to `true` when the skill appears in the policy map. Use\n\n/// `allow: false` to explicitly deny while still documenting the rule.\n\n#[serde(default = \"default_allow\")]\npub allow: bool,\n/// Rate limit applied to this skill.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub rate_limit: Option,\n/// JSON Schema that invocation arguments must satisfy.\n\n///\n\n/// Stored as a raw `serde_json::Value` to avoid premature compilation;\n\n/// the engine compiles and caches it at load time.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub arg_constraints: Option,\n/// Time windows during which the skill may be invoked. Empty = always.\n\n#[serde(default, skip_serializing_if = \"Vec::is_empty\")]\npub time_windows: Vec,\n/// If `true`, the caller must supply a consent token alongside the\n\n/// invocation context.\n\n#[serde(default)]\npub require_consent: bool,\n/// How much invocation detail to record in the audit chain.\n\n#[serde(default)]\npub audit_level: AuditLevel\n}", "docs": "Per-skill policy rule.\n\nEvery field is optional; the engine applies only what is present.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 70 }, { "name": "policy::DefaultRule", "kind": "struct_item", "signature": "pub struct DefaultRule {\n/// Whether unknown skills are allowed by default.\n\n#[serde(default)]\npub allow: bool,\n/// Default audit level for unknown skills.\n\n#[serde(default)]\npub audit_level: AuditLevel\n}", "docs": "Default rule applied when a skill has no per-skill entry.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 122 }, { "name": "policy::SkillsPolicyDoc", "kind": "struct_item", "signature": "pub struct SkillsPolicyDoc {\n/// Schema version. Must equal [`CURRENT_VERSION`].\n\npub version: u32,\n/// DID of the agent this policy applies to.\n\npub agent: Did,\n/// Per-skill rules keyed by skill name.\n\n#[serde(default)]\npub skills: BTreeMap,\n/// Default rule applied when a skill has no entry in `skills`.\n\n#[serde(default)]\npub default: DefaultRule,\n/// Optional human-friendly description.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub description: Option\n}", "docs": "A skills policy document, as loaded from YAML.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 142 } ], "parseErrors": false }, { "module": "rate", "source": "openagent-sdk/crates/openagent-skills-policy/rust/src/rate.rs", "sha256": "97137171669e3ce11ad4761853f56ec30c9fcc38fcf99bee9d72ca15ed80b8a3", "attributes": "", "items": [ { "name": "rate::RateLimiter", "kind": "struct_item", "signature": "pub struct RateLimiter {\n\n}", "docs": "In-memory GCRA rate limiter keyed by skill name.", "attributes": "#[derive(Debug, Default)]", "line": 23 }, { "name": "rate::RateLimitDecision", "kind": "enum_item", "signature": "pub enum RateLimitDecision {\n /// The invocation is allowed; TAT has been advanced.\n Allowed,\n /// The invocation is denied. Contains the number of *conceptual*\n /// invocations already consumed in the window.\n Denied {\n /// How many are currently considered used in the window.\n used: u64,\n },\n}", "docs": "Result of consulting the rate limiter.", "attributes": "#[derive(Debug, Clone, Copy, PartialEq)]", "line": 30 }, { "name": "rate::RateLimiter::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Create a fresh limiter with no state.", "attributes": "#[must_use]", "line": 44 }, { "name": "rate::RateLimiter::used", "kind": "function_item", "signature": "pub fn used(&self, skill: &str, limit: &RateLimit, now: OffsetDateTime) -> u64;", "docs": "Peek at the number of theoretical invocations currently in use for\n`skill`, for observability/debugging.", "attributes": "#[must_use]", "line": 72 }, { "name": "rate::RateLimiter::reset", "kind": "function_item", "signature": "pub fn reset(&mut self, skill: &str);", "docs": "Remove any stored state for the given skill.", "attributes": "", "line": 92 }, { "name": "rate::RateLimiter::snapshot", "kind": "function_item", "signature": "pub fn snapshot(&self) -> Vec<(String, f64)>;", "docs": "Snapshot the current TATs \u2014 useful for persisting state.", "attributes": "#[must_use]", "line": 98 } ], "parseErrors": false }, { "module": "skills_md", "source": "openagent-sdk/crates/openagent-skills-policy/rust/src/skills_md.rs", "sha256": "65c4afba7eec3d10fb719b995d734e908301f151a660d58fe59b62f4a13e830e", "attributes": "", "items": [ { "name": "skills_md::SkillEntry", "kind": "struct_item", "signature": "pub struct SkillEntry {\n/// Canonical skill name (the text of the `##` heading, trimmed).\n\npub name: String,\n/// Human-readable description \u2014 all paragraphs beneath the heading,\n\n/// joined with blank lines.\n\npub description: String\n}", "docs": "A single skill entry discovered in a `SKILLS.md` file.", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]", "line": 33 }, { "name": "skills_md::SkillsManifest", "kind": "struct_item", "signature": "pub struct SkillsManifest {\n/// All skills discovered, in document order.\n\npub skills: Vec\n}", "docs": "A parsed `SKILLS.md` file.", "attributes": "#[derive(Debug, Clone, Default, Serialize, Deserialize)]", "line": 43 }, { "name": "skills_md::SkillsManifest::from_markdown", "kind": "function_item", "signature": "pub fn from_markdown(input: &str) -> Result;", "docs": "Parse a `SKILLS.md` document from an in-memory string.\n\n# Errors\nReturns [`SkillsPolicyError::InvalidSkillsMarkdown`] if the document\ncontains zero `##` skill headings or if a heading line is malformed.", "attributes": "", "line": 54 }, { "name": "skills_md::SkillsManifest::from_file", "kind": "function_item", "signature": "pub fn from_file(path: &Path) -> Result;", "docs": "Load and parse a `SKILLS.md` file from disk.\n\n# Errors\nReturns [`SkillsPolicyError::Io`] on read failure or\n[`SkillsPolicyError::InvalidSkillsMarkdown`] on parse failure.", "attributes": "", "line": 120 }, { "name": "skills_md::SkillsManifest::len", "kind": "function_item", "signature": "pub fn len(&self) -> usize;", "docs": "Number of skills discovered.", "attributes": "#[must_use]", "line": 130 }, { "name": "skills_md::SkillsManifest::is_empty", "kind": "function_item", "signature": "pub fn is_empty(&self) -> bool;", "docs": "Whether the manifest contains zero skills.", "attributes": "#[must_use]", "line": 136 }, { "name": "skills_md::SkillsManifest::get", "kind": "function_item", "signature": "pub fn get(&self, name: &str) -> Option<&SkillEntry>;", "docs": "Return the skill entry with the given name, if any.", "attributes": "#[must_use]", "line": 142 }, { "name": "skills_md::SkillsManifest::names", "kind": "function_item", "signature": "pub fn names(&self) -> impl Iterator;", "docs": "Iterate all skill names.", "attributes": "", "line": 147 } ], "parseErrors": false } ] }, { "name": "openagent-claude-agent", "url": "/reference/rust/openagent-claude-agent", "modules": [ { "module": "crate", "source": "openagent-sdk/integrations/claude-agent-sdk/rust/src/lib.rs", "sha256": "e8f91183afd16d5b68e4263a8ac0e6b53399b2e83daea317c8758d1f22ac7e51", "attributes": "", "items": [ { "name": "audit", "kind": "module", "signature": "pub mod audit;", "docs": "", "attributes": "", "line": 62 }, { "name": "error", "kind": "module", "signature": "pub mod error;", "docs": "", "attributes": "", "line": 63 }, { "name": "hash", "kind": "module", "signature": "pub mod hash;", "docs": "", "attributes": "", "line": 64 }, { "name": "hooks", "kind": "module", "signature": "pub mod hooks;", "docs": "", "attributes": "", "line": 65 }, { "name": "identity", "kind": "module", "signature": "pub mod identity;", "docs": "", "attributes": "", "line": 66 }, { "name": "plugin", "kind": "module", "signature": "pub mod plugin;", "docs": "", "attributes": "", "line": 67 }, { "name": "policy", "kind": "module", "signature": "pub mod policy;", "docs": "", "attributes": "", "line": 68 }, { "name": "pub use error::Error;", "kind": "use_declaration", "signature": "pub use error::Error;", "docs": "", "attributes": "", "line": 70 }, { "name": "pub use hooks::{HookContext, OpenAgentHooks};", "kind": "use_declaration", "signature": "pub use hooks::{HookContext, OpenAgentHooks};", "docs": "", "attributes": "", "line": 71 }, { "name": "pub use plugin::{OpenAgentPlugin, PluginConfig};", "kind": "use_declaration", "signature": "pub use plugin::{OpenAgentPlugin, PluginConfig};", "docs": "", "attributes": "", "line": 72 } ], "parseErrors": false }, { "module": "audit", "source": "openagent-sdk/integrations/claude-agent-sdk/rust/src/audit.rs", "sha256": "132364e5627d22ac9cdf310625d67c4fd39583c23ca482194e5fada810de2bcb", "attributes": "", "items": [ { "name": "audit::GENESIS_PREV_HASH", "kind": "const_item", "signature": "pub const GENESIS_PREV_HASH: &str;", "docs": "Sentinel for the head of the chain (64 zero hex chars).", "attributes": "", "line": 13 }, { "name": "audit::AuditKind", "kind": "enum_item", "signature": "pub enum AuditKind {\n /// Session lifecycle: opened.\n SessionStart,\n /// Session lifecycle: closed.\n SessionStop,\n /// Tool call preflight (pre-execution scope check).\n ToolPreflight,\n /// Tool call completed.\n ToolComplete,\n /// Skill invocation preflight (policy check before body runs).\n SkillPreflight,\n /// Skill invocation completed.\n SkillComplete,\n /// Outbound / inbound message audit.\n MessageSigned,\n /// Generic policy denial.\n PolicyDeny,\n}", "docs": "Categories of audit events.", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"kebab-case\")]", "line": 19 }, { "name": "audit::Outcome", "kind": "enum_item", "signature": "pub enum Outcome {\n /// Operation was allowed (gating check).\n Allow,\n /// Operation was denied (gating check).\n Deny,\n /// Operation completed successfully.\n Ok,\n /// Operation failed.\n Error,\n}", "docs": "Outcome of an audited operation.", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"lowercase\")]", "line": 41 }, { "name": "audit::AuditRecord", "kind": "struct_item", "signature": "pub struct AuditRecord {\n/// Monotonic sequence within the session.\n\npub seq: u64,\n/// ISO-8601 timestamp.\n\npub timestamp: String,\n/// Session id.\n\npub session_id: String,\n/// Agent DID.\n\npub agent_did: String,\n/// Event category.\n\npub kind: AuditKind,\n/// Tool / skill name when applicable.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub name: Option,\n/// Outcome of the operation.\n\npub outcome: Outcome,\n/// Hash of the request payload.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub input_hash: Option,\n/// Hash of the response payload.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub output_hash: Option,\n/// Pointer to the previous record's `hash` field.\n\npub prev_hash: String,\n/// This record's hash (computed from every field except `hash` itself).\n\npub hash: String,\n/// Free-form context.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub context: Option\n}", "docs": "One audit record. Hash chained via `prev_hash` -> `hash`.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 54 }, { "name": "audit::AuditSink", "kind": "trait_item", "signature": "pub trait AuditSink: Send + Sync {\n /// Append a single record. MUST be best-effort and non-throwing.\n async fn append(&self, record: AuditRecord);\n}", "docs": "Audit sink trait \u2014 implement to ship records to a durable backend.", "attributes": "#[async_trait]", "line": 87 }, { "name": "audit::AuditChain", "kind": "struct_item", "signature": "pub struct AuditChain {\n\n}", "docs": "Builds and signs (hash-chains) audit records for a single session.", "attributes": "", "line": 93 }, { "name": "audit::AuditChain::new", "kind": "function_item", "signature": "pub fn new(\n session_id: impl Into,\n agent_did: impl Into,\n sink: std::sync::Arc,\n ) -> Self;", "docs": "Construct a new chain rooted at the genesis prev hash.", "attributes": "", "line": 103 }, { "name": "audit::AuditChain::append", "kind": "function_item", "signature": "pub async fn append(\n &self,\n kind: AuditKind,\n name: Option<&str>,\n outcome: Outcome,\n input_hash: Option,\n output_hash: Option,\n context: Option,\n ) -> Result;", "docs": "Append a record. Sink errors are swallowed by design.", "attributes": "", "line": 118 }, { "name": "audit::AuditChain::head", "kind": "function_item", "signature": "pub fn head(&self) -> String;", "docs": "Current chain head.", "attributes": "", "line": 166 }, { "name": "audit::hash_record", "kind": "function_item", "signature": "pub fn hash_record(record: &AuditRecord) -> Result;", "docs": "Compute the hash of a record (excludes the `hash` field itself).", "attributes": "", "line": 175 }, { "name": "audit::verify_chain", "kind": "function_item", "signature": "pub fn verify_chain(records: &[AuditRecord]) -> Result<()>;", "docs": "Verify a previously emitted chain.", "attributes": "", "line": 185 }, { "name": "audit::InMemoryAuditSink", "kind": "struct_item", "signature": "pub struct InMemoryAuditSink {\n\n}", "docs": "In-memory audit sink (handy for tests + dev).", "attributes": "#[derive(Debug, Default)]", "line": 202 }, { "name": "audit::InMemoryAuditSink::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Construct a new in-memory sink.", "attributes": "", "line": 208 }, { "name": "audit::InMemoryAuditSink::snapshot", "kind": "function_item", "signature": "pub fn snapshot(&self) -> Vec;", "docs": "Snapshot the buffered records (test helper).", "attributes": "", "line": 213 }, { "name": "audit::FanOutAuditSink", "kind": "struct_item", "signature": "pub struct FanOutAuditSink {\n\n}", "docs": "Fan-out sink: dispatch each record to every inner sink.", "attributes": "", "line": 231 }, { "name": "audit::FanOutAuditSink::new", "kind": "function_item", "signature": "pub fn new(sinks: Vec>) -> Self;", "docs": "Construct a new fan-out sink.", "attributes": "", "line": 237 } ], "parseErrors": false }, { "module": "error", "source": "openagent-sdk/integrations/claude-agent-sdk/rust/src/error.rs", "sha256": "72d4525fbfa0afd56bb272039df2f356fc7e12968ae58d7049cd238fb25500ac", "attributes": "", "items": [ { "name": "error::Result", "kind": "type_item", "signature": "pub type Result = std::result::Result;", "docs": "Result alias used throughout the crate.", "attributes": "", "line": 6 }, { "name": "error::Error", "kind": "enum_item", "signature": "pub enum Error {\n /// Configuration was invalid at construction time.\n #[error(\"invalid configuration: {0}\")]\n Config(String),\n\n /// A hook was invoked before the session was started.\n #[error(\"hook called before session_start\")]\n NoActiveSession,\n\n /// A tool call was rejected because the agent lacks the required scope.\n #[error(\"tool denied: {tool} (required scope: {required_scope}; reason: {reason})\")]\n ToolDenied {\n /// Tool name.\n tool: String,\n /// Scope that was checked.\n required_scope: String,\n /// Human-readable reason.\n reason: String,\n },\n\n /// A skill invocation was rejected by the skills policy.\n #[error(\"skill denied: {skill} (reason: {reason})\")]\n SkillDenied {\n /// Skill name.\n skill: String,\n /// Reason for denial.\n reason: String,\n },\n\n /// Identity signing failed.\n #[error(\"signing failed: {0}\")]\n Sign(String),\n\n /// Audit chain verification failed.\n #[error(\"audit chain broken at index {index}\")]\n AuditBroken {\n /// Index in the chain where verification failed.\n index: usize,\n },\n\n /// JSON (de)serialisation failure.\n #[error(\"serialization error: {0}\")]\n Serde(#[from] serde_json::Error),\n\n /// I/O failure (sink, file, etc).\n #[error(\"io error: {0}\")]\n Io(#[from] std::io::Error),\n}", "docs": "All errors produced by `openagent-claude-agent`.", "attributes": "#[derive(Debug, Error)]", "line": 10 } ], "parseErrors": false }, { "module": "hash", "source": "openagent-sdk/integrations/claude-agent-sdk/rust/src/hash.rs", "sha256": "09cb9f60075ccb9fec692f4a351ddb5a0f34500627c339d5985d3ef95d2f2b0c", "attributes": "", "items": [ { "name": "hash::hash_hex", "kind": "function_item", "signature": "pub fn hash_hex(bytes: &[u8]) -> String;", "docs": "Hash a byte buffer with BLAKE3 and return lowercase hex.", "attributes": "", "line": 6 }, { "name": "hash::canonical_json", "kind": "function_item", "signature": "pub fn canonical_json(value: &T) -> Result;", "docs": "Stable JSON serialisation (object keys sorted) for canonical hashing.\n\n`serde_json` orders object keys lexicographically when using\n`serde_json::to_value` over a `BTreeMap`-like structure. We canonicalise\nby round-tripping through `serde_json::Value` and re-emitting via a\nhelper that sorts maps.", "attributes": "", "line": 17 }, { "name": "hash::hash_value", "kind": "function_item", "signature": "pub fn hash_value(value: &T) -> Result;", "docs": "Hash a serialisable value via canonical JSON.", "attributes": "", "line": 24 } ], "parseErrors": false }, { "module": "hooks", "source": "openagent-sdk/integrations/claude-agent-sdk/rust/src/hooks.rs", "sha256": "3bf764fae3216f04fddedb38b0a7577d86ac1c17c79e524af886d11402a0a892", "attributes": "", "items": [ { "name": "hooks::HookContext", "kind": "struct_item", "signature": "pub struct HookContext {\n/// The verified agent identity.\n\npub identity: Arc,\n/// Capability checker (Arsenal-backed in production).\n\npub capabilities: Arc,\n/// Skills policy (defaults to `DenyUnlessScopedSkillsPolicy`).\n\npub skills_policy: Arc,\n/// Audit chain for this session.\n\npub chain: Arc,\n/// Whether outbound messages are signed with the agent's key.\n\npub sign_messages: bool\n}", "docs": "Per-session hook context. Constructed on session start, threaded\nthrough subsequent hook invocations, dropped on session end.", "attributes": "", "line": 27 }, { "name": "hooks::OpenAgentHooks", "kind": "trait_item", "signature": "pub trait OpenAgentHooks: Send + Sync {\n /// Called once when a new session begins.\n async fn on_session_start(&self, session_id: &str) -> Result<()>;\n\n /// Called once when the session ends.\n async fn on_session_end(&self) -> Result<()>;\n\n /// Called before a tool runs. Returns Err(ToolDenied) on deny in\n /// `Throw` mode; otherwise returns Ok with the (allow=false) audit\n /// trail already recorded.\n async fn pre_tool_use(&self, tool_name: &str, args: &Value) -> Result<()>;\n\n /// Called after a tool runs.\n async fn post_tool_use(\n &self,\n tool_name: &str,\n result: &Value,\n ok: bool,\n error: Option<&str>,\n ) -> Result<()>;\n\n /// Called when an outbound or inbound message passes through the agent.\n async fn on_message(&self, body: &[u8], outbound: bool) -> Result>;\n\n /// Called when the agent attempts to invoke a SKILLS.md skill.\n async fn on_skill_invoke(&self, skill_name: &str, args: Option<&Value>) -> Result<()>;\n}", "docs": "Lifecycle hook trait. Implement this in any Rust agent harness to\nreceive OpenAgent enforcement and audit events.", "attributes": "#[async_trait]", "line": 43 } ], "parseErrors": false }, { "module": "identity", "source": "openagent-sdk/integrations/claude-agent-sdk/rust/src/identity.rs", "sha256": "735ea2a719fe37faba2ad65743fcb6490dd942db130f310b7ffa7208bff4ae8d", "attributes": "", "items": [ { "name": "identity::OpenAgentIdentity", "kind": "trait_item", "signature": "pub trait OpenAgentIdentity: Send + Sync {\n /// The fully-qualified DID, e.g. `did:oas:test:agent:foo`.\n fn did(&self) -> &str;\n\n /// Entity kind: `hmr`, `mhr`, `agent`, `tool`, `skill`, ...\n fn kind(&self) -> &str;\n\n /// 32-byte Ed25519 public key. Returned by value (32 bytes is cheap)\n /// so adapters that wrap an external SDK don't need to cache.\n fn public_key(&self) -> [u8; 32];\n\n /// Optional lineage chain (HMR -> ... -> this agent).\n fn lineage(&self) -> Vec ;\n\n /// Sign a payload. Implementations must never log or expose the key.\n async fn sign(&self, payload: &[u8]) -> Result>;\n}", "docs": "A signing key + DID, structurally compatible with the OAS identity\nsurface. Implementations must NOT expose the secret key directly \u2014\nsigning operations go through the [`OpenAgentIdentity::sign`] method.", "attributes": "#[async_trait]", "line": 15 }, { "name": "identity::Identity", "kind": "struct_item", "signature": "pub struct Identity {\n\n}", "docs": "Default in-process identity used by tests and dev harnesses.\n\nSigning is intentionally a deterministic stub \u2014 production deployments\nmust replace this with an OAS-backed implementation that holds a real\nEd25519 key.", "attributes": "#[derive(Debug, Clone)]", "line": 41 }, { "name": "identity::Identity::new", "kind": "function_item", "signature": "pub fn new(did: impl Into, kind: impl Into, public_key: [u8; 32]) -> Self;", "docs": "Construct a new identity.", "attributes": "", "line": 50 }, { "name": "identity::Identity::with_lineage", "kind": "function_item", "signature": "pub fn with_lineage(mut self, lineage: Vec) -> Self;", "docs": "Set the lineage chain (builder).", "attributes": "#[must_use]", "line": 61 }, { "name": "identity::OpenAgentSdkIdentity", "kind": "struct_item", "signature": "pub struct OpenAgentSdkIdentity {\n\n}", "docs": "Adapter that exposes an [`openagent_sdk::OpenAgent`] as an\n[`OpenAgentIdentity`].\n\nThis is the production wiring: hand the plugin an `OpenAgent` built\nvia `OpenAgentBuilder` and it will pull DID, public key, and Ed25519\nsigning through the wrapped SDK.", "attributes": "", "line": 105 }, { "name": "identity::OpenAgentSdkIdentity::new", "kind": "function_item", "signature": "pub fn new(inner: openagent_sdk::OpenAgent) -> Self;", "docs": "Wrap an existing `openagent_sdk::OpenAgent`.", "attributes": "", "line": 111 }, { "name": "identity::OpenAgentSdkIdentity::inner", "kind": "function_item", "signature": "pub fn inner(&self) -> &openagent_sdk::OpenAgent;", "docs": "Borrow the underlying SDK agent (escape hatch for advanced users).", "attributes": "", "line": 116 } ], "parseErrors": false }, { "module": "plugin", "source": "openagent-sdk/integrations/claude-agent-sdk/rust/src/plugin.rs", "sha256": "87304e5c59bf4e6a5b65c3631673ed87107bc9dc98e2c8eeaff4ddd5a89c3f22", "attributes": "", "items": [ { "name": "plugin::DenyMode", "kind": "enum_item", "signature": "pub enum DenyMode {\n /// Return `Err(Error::ToolDenied / SkillDenied)`.\n Throw,\n /// Record the deny in the audit log and return `Ok(())`.\n Block,\n}", "docs": "Behaviour on a denied tool / skill request.", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq)]", "line": 22 }, { "name": "plugin::PluginConfig", "kind": "struct_item", "signature": "pub struct PluginConfig {\n/// The verified OpenAgent identity to attach to the session. Any\n\n/// implementor of [`OpenAgentIdentity`] is accepted \u2014 typically an\n\n/// [`crate::identity::OpenAgentSdkIdentity`] in production or\n\n/// [`crate::identity::Identity`] in tests.\n\npub identity: Arc,\n/// Capability checker (Arsenal-backed in production).\n\npub capabilities: Arc,\n/// Skills policy.\n\npub skills_policy: Arc,\n/// Audit sink.\n\npub sink: Arc,\n/// Sign outbound messages with the agent key.\n\npub sign_messages: bool,\n/// Behaviour on deny.\n\npub deny_mode: DenyMode\n}", "docs": "Plugin configuration.", "attributes": "", "line": 30 }, { "name": "plugin::OpenAgentPlugin", "kind": "struct_item", "signature": "pub struct OpenAgentPlugin {\n\n}", "docs": "The composition root that drives the lifecycle hooks.", "attributes": "", "line": 49 }, { "name": "plugin::OpenAgentPlugin::new", "kind": "function_item", "signature": "pub fn new(config: PluginConfig) -> Self;", "docs": "Construct a new plugin from configuration.", "attributes": "", "line": 65 }, { "name": "plugin::OpenAgentPlugin::session_start", "kind": "function_item", "signature": "pub async fn session_start(&self, session_id: &str) -> Result<()>;", "docs": "Begin a new session \u2014 must be called before any other hook.", "attributes": "", "line": 80 }, { "name": "plugin::OpenAgentPlugin::session_end", "kind": "function_item", "signature": "pub async fn session_end(&self) -> Result<()>;", "docs": "End the current session.", "attributes": "", "line": 112 }, { "name": "plugin::OpenAgentPlugin::pre_tool_use", "kind": "function_item", "signature": "pub async fn pre_tool_use(&self, tool_name: &str, args: &Value) -> Result<()>;", "docs": "Verify a tool call against Arsenal scopes (preflight).", "attributes": "", "line": 131 }, { "name": "plugin::OpenAgentPlugin::post_tool_use", "kind": "function_item", "signature": "pub async fn post_tool_use(\n &self,\n tool_name: &str,\n result: &Value,\n ok: bool,\n error: Option<&str>,\n ) -> Result<()>;", "docs": "Emit a post-tool-use audit record.", "attributes": "", "line": 179 }, { "name": "plugin::OpenAgentPlugin::on_message", "kind": "function_item", "signature": "pub async fn on_message(&self, body: &[u8], outbound: bool) -> Result>;", "docs": "Sign an outbound message and emit an audit record.", "attributes": "", "line": 203 }, { "name": "plugin::OpenAgentPlugin::on_skill_invoke", "kind": "function_item", "signature": "pub async fn on_skill_invoke(\n &self,\n skill_name: &str,\n args: Option<&Value>,\n ) -> Result<()>;", "docs": "Consult the skills policy before a SKILLS.md skill runs.", "attributes": "", "line": 234 } ], "parseErrors": false }, { "module": "policy", "source": "openagent-sdk/integrations/claude-agent-sdk/rust/src/policy.rs", "sha256": "6cd87a54d42dfa671bac1443a09d0d1b7555f810e604c4866440a6131dde8097", "attributes": "", "items": [ { "name": "policy::TOOL_SCOPE_PREFIX", "kind": "const_item", "signature": "pub const TOOL_SCOPE_PREFIX: &str;", "docs": "Canonical scope prefix for tool invocations.", "attributes": "", "line": 12 }, { "name": "policy::SKILL_SCOPE_PREFIX", "kind": "const_item", "signature": "pub const SKILL_SCOPE_PREFIX: &str;", "docs": "Canonical scope prefix for skill invocations.", "attributes": "", "line": 15 }, { "name": "policy::tool_scope", "kind": "function_item", "signature": "pub fn tool_scope(name: &str) -> String;", "docs": "Build a canonical scope string for a tool name.", "attributes": "#[must_use]", "line": 19 }, { "name": "policy::skill_scope", "kind": "function_item", "signature": "pub fn skill_scope(name: &str) -> String;", "docs": "Build a canonical scope string for a skill name.", "attributes": "#[must_use]", "line": 25 }, { "name": "policy::ScopeDecision", "kind": "struct_item", "signature": "pub struct ScopeDecision {\n/// Whether the request is allowed.\n\npub allowed: bool,\n/// Matched scope string (if any).\n\npub matched_scope: Option,\n/// Human-readable reason for denial.\n\npub reason: Option\n}", "docs": "Result of a single scope check.", "attributes": "#[derive(Debug, Clone)]", "line": 31 }, { "name": "policy::ScopeDecision::allow", "kind": "function_item", "signature": "pub fn allow(matched: impl Into) -> Self;", "docs": "Build an allow decision.", "attributes": "", "line": 42 }, { "name": "policy::ScopeDecision::deny", "kind": "function_item", "signature": "pub fn deny(reason: impl Into) -> Self;", "docs": "Build a deny decision.", "attributes": "", "line": 51 }, { "name": "policy::CapabilityChecker", "kind": "trait_item", "signature": "pub trait CapabilityChecker: Send + Sync {\n /// Check whether the agent currently holds the requested scope.\n async fn check(&self, scope: &str) -> Result;\n}", "docs": "Trait implemented by anything that can authorise scope requests.", "attributes": "#[async_trait]", "line": 62 }, { "name": "policy::StaticCapabilityChecker", "kind": "struct_item", "signature": "pub struct StaticCapabilityChecker {\n\n}", "docs": "Static capability checker backed by a fixed allow-list.\n\nSupports literal scopes and one wildcard form: any entry ending in `*`\nmatches anything starting with the prefix preceding the `*`.", "attributes": "#[derive(Debug, Default)]", "line": 72 }, { "name": "policy::StaticCapabilityChecker::new", "kind": "function_item", "signature": "pub fn new(scopes: I) -> Self\n where\n I: IntoIterator,\n S: Into,;", "docs": "Construct a checker from an iterator of scope strings.", "attributes": "", "line": 79 }, { "name": "policy::SkillDecision", "kind": "struct_item", "signature": "pub struct SkillDecision {\n/// Allow / deny.\n\npub allowed: bool,\n/// Reason on deny.\n\npub reason: Option,\n/// Matched scope on allow.\n\npub matched_scope: Option\n}", "docs": "Decision returned by [`SkillsPolicy`].", "attributes": "#[derive(Debug, Clone)]", "line": 115 }, { "name": "policy::SkillsPolicy", "kind": "trait_item", "signature": "pub trait SkillsPolicy: Send + Sync {\n /// Evaluate whether the named skill may be invoked by the current agent.\n async fn evaluate(\n &self,\n skill_name: &str,\n identity: &dyn OpenAgentIdentity,\n capabilities: &dyn CapabilityChecker,\n ) -> Result;\n}", "docs": "Skills policy: gates SKILLS.md skill invocations.", "attributes": "#[async_trait]", "line": 126 }, { "name": "policy::DenyUnlessScopedSkillsPolicy", "kind": "struct_item", "signature": "pub struct DenyUnlessScopedSkillsPolicy;", "docs": "Default policy: deny unless the agent holds `skills:invoke:`.", "attributes": "#[derive(Debug, Default, Clone, Copy)]", "line": 138 }, { "name": "policy::AllowListSkillsPolicy", "kind": "struct_item", "signature": "pub struct AllowListSkillsPolicy {\n\n}", "docs": "Allow-list skills policy: only listed skills are permitted, and the\ninner policy (defaults to [`DenyUnlessScopedSkillsPolicy`]) must also\nallow the call.", "attributes": "", "line": 173 }, { "name": "policy::AllowListSkillsPolicy::new", "kind": "function_item", "signature": "pub fn new(allowed: I, inner: Option>) -> Self\n where\n I: IntoIterator,\n S: Into,;", "docs": "Construct a new allow-list policy.", "attributes": "", "line": 180 }, { "name": "policy::OpenAgentSdkSkillsPolicy", "kind": "struct_item", "signature": "pub struct OpenAgentSdkSkillsPolicy {\n\n}", "docs": "Adapter that bridges the OpenAgent SDK's `SkillsPolicy` (synchronous,\nowned by an `OpenAgent`) into this crate's async [`SkillsPolicy`].\n\nUse this when you've already configured a skills policy on an\n`openagent_sdk::OpenAgent` (e.g., via `with_skills_policy`) and want\nthe same policy to gate Claude Agent SDK skill invocations.", "attributes": "", "line": 217 }, { "name": "policy::OpenAgentSdkSkillsPolicy::new", "kind": "function_item", "signature": "pub fn new(inner: openagent_sdk::SkillsPolicyHandle) -> Self;", "docs": "Wrap an `openagent_sdk::SkillsPolicyHandle`.", "attributes": "", "line": 223 }, { "name": "policy::CompositeSkillsPolicy", "kind": "struct_item", "signature": "pub struct CompositeSkillsPolicy {\n\n}", "docs": "Composite policy: every inner policy must allow.", "attributes": "", "line": 252 }, { "name": "policy::CompositeSkillsPolicy::new", "kind": "function_item", "signature": "pub fn new(policies: Vec>) -> Self;", "docs": "Construct a composite policy from a Vec of inner policies.", "attributes": "", "line": 258 } ], "parseErrors": false } ] }, { "name": "openagent-mcp", "url": "/reference/rust/openagent-mcp", "modules": [ { "module": "crate", "source": "openagent-sdk/integrations/mcp/rust/src/lib.rs", "sha256": "11aff0aa5e83e1a0673b1faf7ed5fb90ca60cb9637f517d3e53e152186cbce35", "attributes": "", "items": [ { "name": "pub use rmcp_adapter::RmcpOpenAgent;", "kind": "use_declaration", "signature": "pub use rmcp_adapter::RmcpOpenAgent;", "docs": "", "attributes": "#[cfg(feature = \"rmcp\")]", "line": 58 }, { "name": "pub use errors::{McpAuthError, McpErrorCode};", "kind": "use_declaration", "signature": "pub use errors::{McpAuthError, McpErrorCode};", "docs": "", "attributes": "", "line": 60 }, { "name": "pub use handler::{\n InMemoryToolHandler, RegisteredTool, ToolCall, ToolHandler, ToolResult, WithOpenAgent,\n WrappedHandler,\n};", "kind": "use_declaration", "signature": "pub use handler::{\n InMemoryToolHandler, RegisteredTool, ToolCall, ToolHandler, ToolResult, WithOpenAgent,\n WrappedHandler,\n};", "docs": "", "attributes": "", "line": 61 }, { "name": "pub use middleware::{OpenAgentMiddleware, default_require_scopes, default_scope_format};", "kind": "use_declaration", "signature": "pub use middleware::{OpenAgentMiddleware, default_require_scopes, default_scope_format};", "docs": "", "attributes": "", "line": 65 }, { "name": "pub use skills::{\n InMemorySkillsStore, SkillsPolicy, SkillsPolicyDecision, SkillsRule, SkillsStore,\n DEFAULT_SKILL_TOOL_NAMES,\n};", "kind": "use_declaration", "signature": "pub use skills::{\n InMemorySkillsStore, SkillsPolicy, SkillsPolicyDecision, SkillsRule, SkillsStore,\n DEFAULT_SKILL_TOOL_NAMES,\n};", "docs": "", "attributes": "", "line": 66 }, { "name": "pub use types::{\n Agent, AuditMeta, Config, ErrorHook, Identity, IdentityVerifier, PostCallHook, PreCallHook,\n ScopeDeriver, VerifiedIdentity,\n};", "kind": "use_declaration", "signature": "pub use types::{\n Agent, AuditMeta, Config, ErrorHook, Identity, IdentityVerifier, PostCallHook, PreCallHook,\n ScopeDeriver, VerifiedIdentity,\n};", "docs": "", "attributes": "", "line": 70 } ], "parseErrors": false }, { "module": "errors", "source": "openagent-sdk/integrations/mcp/rust/src/errors.rs", "sha256": "e79319eebdefb1f95676a8579a2e34cf8aee982a73d7bb530b47dcc5942f07c8", "attributes": "", "items": [ { "name": "errors::McpErrorCode", "kind": "enum_item", "signature": "pub enum McpErrorCode {\n /// Generic server error.\n ServerError = -32000,\n /// Identity verification failed (no envelope, bad proof, etc.).\n AuthenticationFailed = -32001,\n /// Caller does not hold the required scopes.\n AuthorizationDenied = -32002,\n /// Skills policy hook returned `allow: false`.\n SkillsPolicyDenied = -32003,\n /// Method or tool not found.\n MethodNotFound = -32601,\n /// Invalid parameters.\n InvalidParams = -32602,\n /// Internal error.\n InternalError = -32603,\n}", "docs": "JSON-RPC + MCP error codes used by the middleware.\n\nAll entries lie inside the `-32000..=-32099` server-error range\nreserved by the JSON-RPC spec for application use.", "attributes": "#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]\n#[repr(i32)]", "line": 18 }, { "name": "errors::McpErrorCode::as_i32", "kind": "function_item", "signature": "pub fn as_i32(self) -> i32;", "docs": "Return the underlying integer code.", "attributes": "", "line": 37 }, { "name": "errors::McpAuthError", "kind": "enum_item", "signature": "pub enum McpAuthError {\n /// `_meta.openagent.identity` was absent on a tool call.\n #[error(\"Tool '{tool}' requires an OpenAgent identity in _meta.openagent.identity\")]\n MissingIdentity {\n /// The tool name the call targeted.\n tool: String,\n },\n\n /// The verifier rejected the supplied envelope.\n #[error(\"Identity verification failed for tool '{tool}': {reason}\")]\n VerificationFailed {\n /// The tool name.\n tool: String,\n /// Human-readable reason from the verifier.\n reason: String,\n },\n\n /// The verified identity does not hold the required scopes.\n #[error(\n \"Tool '{tool}' requires scopes [{required}], caller holds [{held}]\"\n )]\n AuthorizationDenied {\n /// The tool name.\n tool: String,\n /// Required scopes, comma-joined for display.\n required: String,\n /// Held scopes, comma-joined for display.\n held: String,\n },\n\n /// The skills policy denied the call.\n #[error(\"Skills policy denied tool '{tool}'{}\", reason.as_ref().map(|r| format!(\": {r}\")).unwrap_or_default())]\n SkillsPolicyDenied {\n /// The tool name.\n tool: String,\n /// Optional reason from the policy hook.\n reason: Option,\n },\n\n /// Tool body or downstream component returned an error.\n #[error(\"Tool '{tool}' failed: {source}\")]\n ToolFailed {\n /// The tool name.\n tool: String,\n /// Underlying error type-erased to a string.\n source: Box,\n },\n\n /// Generic internal error. Use sparingly \u2014 prefer one of the variants\n /// above when the failure category is known.\n #[error(\"Internal middleware error: {0}\")]\n Internal(String),\n}", "docs": "All errors produced by the middleware. Subclasses set a default\n[`McpErrorCode`] that maps to a JSON-RPC error code.", "attributes": "#[derive(Debug, Error)]", "line": 45 }, { "name": "errors::McpAuthError::code", "kind": "function_item", "signature": "pub fn code(&self) -> McpErrorCode;", "docs": "Map the error to a JSON-RPC error code.", "attributes": "", "line": 101 }, { "name": "errors::McpAuthError::to_json_rpc", "kind": "function_item", "signature": "pub fn to_json_rpc(&self) -> JsonRpcError;", "docs": "Render the error as a JSON-RPC error envelope.", "attributes": "", "line": 113 }, { "name": "errors::JsonRpcError", "kind": "struct_item", "signature": "pub struct JsonRpcError {\n/// JSON-RPC error code.\n\npub code: i32,\n/// Human-readable message.\n\npub message: String,\n/// Optional structured data payload.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub data: Option\n}", "docs": "Serializable JSON-RPC error envelope.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 147 } ], "parseErrors": false }, { "module": "handler", "source": "openagent-sdk/integrations/mcp/rust/src/handler.rs", "sha256": "90e5087e39d015e22b608bba0f1550506c76121634c4718f0b82463c42463243", "attributes": "", "items": [ { "name": "handler::ToolCall", "kind": "struct_item", "signature": "pub struct ToolCall {\n/// The tool name (e.g., `\"search_web\"`).\n\npub name: String,\n/// JSON arguments the caller supplied.\n\n#[serde(default)]\npub arguments: serde_json::Value,\n/// Request metadata. Identity envelope lives at\n\n/// `meta[\"openagent\"][\"identity\"]`.\n\n#[serde(default)]\npub meta: serde_json::Value\n}", "docs": "A single inbound `tools/call` request.\n\n`meta` carries the request metadata pulled from the MCP envelope \u2014\nin particular `meta[\"openagent\"][\"identity\"]` is where the auth\nenvelope lives. The middleware reads it and never modifies it in\nplace.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 32 }, { "name": "handler::ToolResult", "kind": "struct_item", "signature": "pub struct ToolResult {\n/// MCP content blocks (text, image, resource_link, etc).\n\n#[serde(default)]\npub content: serde_json::Value,\n/// Optional structured content (the new MCP 2025 field).\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub structured_content: Option,\n/// Optional `isError` flag for error responses returned via the\n\n/// happy-path channel.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub is_error: Option,\n/// Result metadata. Audit metadata is stamped here on success.\n\n#[serde(default)]\npub meta: serde_json::Value\n}", "docs": "A single outbound tool result. The middleware stamps audit metadata\nonto `meta` after the handler returns.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 47 }, { "name": "handler::ToolResult::text", "kind": "function_item", "signature": "pub fn text(message: impl Into) -> Self;", "docs": "Build a simple text result with no metadata.", "attributes": "", "line": 65 }, { "name": "handler::RegisteredTool", "kind": "struct_item", "signature": "pub struct RegisteredTool {\n/// Tool name.\n\npub name: String,\n/// Optional description for clients.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub description: Option\n}", "docs": "Description of a registered tool, returned by\n[`ToolHandler::list_tools`].", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 78 }, { "name": "handler::ToolHandler", "kind": "trait_item", "signature": "pub trait ToolHandler: Send + Sync {\n /// Return the tools this handler exposes.\n async fn list_tools(&self) -> Vec;\n\n /// Execute a single tool call. Implementations should NOT do any\n /// authentication or authorization \u2014 that runs in the middleware\n /// before this is invoked.\n async fn call_tool(&self, call: ToolCall) -> Result;\n}", "docs": "The trait every concrete server handler implements. Two methods \u2014\n`list_tools` and `call_tool` \u2014 keep the surface narrow and stable\nacross MCP SDK versions.", "attributes": "#[async_trait]", "line": 90 }, { "name": "handler::WithOpenAgent", "kind": "trait_item", "signature": "pub trait WithOpenAgent: ToolHandler + Sized {\n /// Wrap this handler with the OpenAgent middleware.\n ///\n /// ```no_run\n /// use openagent_mcp::{Config, InMemoryToolHandler, OpenAgentMiddleware, WithOpenAgent};\n /// # use std::sync::Arc;\n /// # async fn example(agent: std::sync::Arc) {\n /// let handler = InMemoryToolHandler::new();\n /// let middleware = OpenAgentMiddleware::new(Config::new(agent));\n /// let authed = handler.with_openagent(middleware);\n /// # let _ = authed;\n /// # }\n /// ```\n fn with_openagent(self, middleware: OpenAgentMiddleware) -> WrappedHandler ;\n}", "docs": "Marker trait \u2014 anything that implements [`ToolHandler`] can be\nwrapped via [`WithOpenAgent::with_openagent`].", "attributes": "", "line": 102 }, { "name": "handler::WrappedHandler", "kind": "struct_item", "signature": "pub struct WrappedHandler {\n\n}", "docs": "Result of wrapping a [`ToolHandler`] with [`OpenAgentMiddleware`].\n\n`WrappedHandler` itself implements [`ToolHandler`], so the wrapped\ninstance is a drop-in replacement for the original \u2014 the rest of\nyour server code keeps working unchanged.", "attributes": "", "line": 130 }, { "name": "handler::InMemoryToolHandler", "kind": "struct_item", "signature": "pub struct InMemoryToolHandler {\n\n}", "docs": "In-memory test handler. Useful for unit and integration tests of\nthe middleware (and as a tiny example of what a custom handler\nlooks like).", "attributes": "#[derive(Default)]", "line": 173 }, { "name": "handler::InMemoryToolHandler::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Create an empty handler.", "attributes": "", "line": 199 }, { "name": "handler::InMemoryToolHandler::register", "kind": "function_item", "signature": "pub async fn register(\n &self,\n name: impl Into,\n description: Option<&str>,\n handler: F,\n ) where\n F: Fn(serde_json::Value) -> Fut + Send + Sync + 'static,\n Fut: std::future::Future> + Send + 'static,;", "docs": "Register a tool. The handler closure receives the deserialized\narguments and returns a [`ToolResult`].", "attributes": "", "line": 205 } ], "parseErrors": false }, { "module": "middleware", "source": "openagent-sdk/integrations/mcp/rust/src/middleware.rs", "sha256": "4fc7a846d77047ae227b86d30edf99d9cc86666781c3bb2a00168c404965d9fe", "attributes": "", "items": [ { "name": "middleware::default_scope_format", "kind": "function_item", "signature": "pub fn default_scope_format(tool_name: &str) -> String;", "docs": "Default scope format used when [`Config::with_require_scopes`] is\nnot supplied. Returns `mcp::invoke`.", "attributes": "", "line": 32 }, { "name": "middleware::default_require_scopes", "kind": "function_item", "signature": "pub fn default_require_scopes(tool_name: &str, _args: &serde_json::Value) -> Vec;", "docs": "Default scope deriver used when [`Config::with_require_scopes`] is\nnot supplied.", "attributes": "", "line": 38 }, { "name": "middleware::OpenAgentMiddleware", "kind": "struct_item", "signature": "pub struct OpenAgentMiddleware {\n\n}", "docs": "The middleware engine.\n\nCheap to clone \u2014 internally just an `Arc` over the config and a\nderived scope deriver.", "attributes": "#[derive(Clone)]", "line": 47 }, { "name": "middleware::OpenAgentMiddleware::new", "kind": "function_item", "signature": "pub fn new(config: Config) -> Self;", "docs": "Create a new middleware engine.", "attributes": "", "line": 62 }, { "name": "middleware::OpenAgentMiddleware::run", "kind": "function_item", "signature": "pub async fn run(&self, call: ToolCall, inner: F) -> Result\n where\n F: FnOnce(\n ToolCall,\n )\n -> Pin> + Send>>\n + Send\n + 'static,;", "docs": "Run the middleware pipeline against a single call. The\n`inner` closure is invoked once the auth pipeline approves the\ncall. It receives the (unmodified) `ToolCall`.\n\nThis is the function adapters call from inside their concrete\n`call_tool` implementations. Most users do not call it\ndirectly \u2014 they wrap their handler with\n[`crate::WithOpenAgent::with_openagent`] instead.", "attributes": "", "line": 82 } ], "parseErrors": false }, { "module": "skills", "source": "openagent-sdk/integrations/mcp/rust/src/skills.rs", "sha256": "3f20542523a5bba4da4bbccb5f14e50431ae45505dc1251e2194c7344e44a684", "attributes": "", "items": [ { "name": "skills::DEFAULT_SKILL_TOOL_NAMES", "kind": "const_item", "signature": "pub const DEFAULT_SKILL_TOOL_NAMES: &[&str];", "docs": "Tool name prefixes the middleware treats as skill-like by default.", "attributes": "", "line": 21 }, { "name": "skills::SkillsRule", "kind": "struct_item", "signature": "pub struct SkillsRule {\n/// The skill name as it appears in SKILLS.md.\n\npub skill_name: String,\n/// DIDs allowed to invoke this skill, or `None` for any.\n\npub dids: Option>,\n/// Optional human-readable reason returned on denial.\n\npub reason: Option\n}", "docs": "A single rule mapping a skill name to the DIDs allowed to invoke it.\n`dids: None` means \"any verified caller\".", "attributes": "#[derive(Debug, Clone)]", "line": 32 }, { "name": "skills::SkillsPolicyDecision", "kind": "struct_item", "signature": "pub struct SkillsPolicyDecision {\n/// Whether to allow the call.\n\npub allow: bool,\n/// Optional reason \u2014 set on denial.\n\npub reason: Option\n}", "docs": "Decision returned by [`SkillsPolicy::decide`].", "attributes": "#[derive(Debug, Clone)]", "line": 43 }, { "name": "skills::SkillsPolicyDecision::allow", "kind": "function_item", "signature": "pub fn allow() -> Self;", "docs": "Build an allow decision.", "attributes": "", "line": 52 }, { "name": "skills::SkillsPolicyDecision::deny", "kind": "function_item", "signature": "pub fn deny(reason: impl Into) -> Self;", "docs": "Build a deny decision with a reason.", "attributes": "", "line": 60 }, { "name": "skills::SkillsStore", "kind": "trait_item", "signature": "pub trait SkillsStore: Send + Sync {\n /// Look up the rule for a given skill name. Return `None` if no\n /// rule is configured.\n async fn lookup(&self, skill_name: &str) -> Option;\n}", "docs": "Storage backend for skills rules. Implementations may be in-memory,\nfile-backed, or fetched from a remote service.", "attributes": "#[async_trait]", "line": 71 }, { "name": "skills::InMemorySkillsStore", "kind": "struct_item", "signature": "pub struct InMemorySkillsStore {\n\n}", "docs": "In-memory store. Construct from a list of rules and pass to\n[`SkillsPolicy::new`].", "attributes": "#[derive(Debug, Default)]", "line": 80 }, { "name": "skills::InMemorySkillsStore::new", "kind": "function_item", "signature": "pub fn new(rules: impl IntoIterator) -> Self;", "docs": "Build a store from a list of rules.", "attributes": "", "line": 86 }, { "name": "skills::InMemorySkillsStore::with_rule", "kind": "function_item", "signature": "pub fn with_rule(&self, rule: SkillsRule) -> Self;", "docs": "Return a NEW store with the given rule applied (immutable\nupdate \u2014 the original is left untouched).", "attributes": "", "line": 96 }, { "name": "skills::SkillNameExtractor", "kind": "type_item", "signature": "pub type SkillNameExtractor = Arc Option + Send + Sync>;", "docs": "Configurable matcher: returns the skill name if a tool call should\nbe checked against the skills policy, or `None` to skip the check.", "attributes": "", "line": 112 }, { "name": "skills::SkillsPolicy", "kind": "struct_item", "signature": "pub struct SkillsPolicy {\n\n}", "docs": "The skills policy hook.\n\nConstruct via [`SkillsPolicy::new`]. The policy decides per call\nwhether the tool is skill-like, looks up a rule from the configured\nstore, and matches the verified DID against the rule.", "attributes": "#[derive(Clone)]", "line": 120 }, { "name": "skills::SkillsPolicy::new", "kind": "function_item", "signature": "pub fn new(store: Arc) -> Self;", "docs": "Build a policy from a store, using the default skill-name\nextractor that:\n\n * Treats the tool as a skill if its name is in\n [`DEFAULT_SKILL_TOOL_NAMES`].\n * Reads `args[\"skill\"]` or `args[\"skillName\"]` for the skill\n name.", "attributes": "", "line": 139 }, { "name": "skills::SkillsPolicy::with_extractor", "kind": "function_item", "signature": "pub fn with_extractor(mut self, extractor: SkillNameExtractor) -> Self;", "docs": "Override the extractor with a custom matcher.", "attributes": "", "line": 147 }, { "name": "skills::SkillsPolicy::decide", "kind": "function_item", "signature": "pub async fn decide(\n &self,\n tool_name: &str,\n args: &serde_json::Value,\n identity: &VerifiedIdentity,\n ) -> SkillsPolicyDecision;", "docs": "Decide whether a call should be allowed.", "attributes": "", "line": 153 } ], "parseErrors": false }, { "module": "types", "source": "openagent-sdk/integrations/mcp/rust/src/types.rs", "sha256": "b7bab88be56f0adcd317993328ebffa29830ff8ac0d6091c5a7baa116c42b086", "attributes": "", "items": [ { "name": "types::Did", "kind": "type_item", "signature": "pub type Did = String;", "docs": "A decentralized identifier \u2014 typically `did:oas::...`, but\nany format the configured [`IdentityVerifier`] understands is allowed.", "attributes": "", "line": 18 }, { "name": "types::Identity", "kind": "struct_item", "signature": "pub struct Identity {\n/// Caller's DID.\n\npub did: Did,\n/// Verifiable proof \u2014 opaque to the middleware.\n\npub proof: String,\n/// Optional bearer-style nonce for replay protection.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub nonce: Option,\n/// Optional context fields the verifier may use (issuer DID,\n\n/// audience, claimed scopes). Always validated against the verifier\n\n/// policy \u2014 never trusted as input.\n\n#[serde(default, skip_serializing_if = \"Option::is_none\")]\npub context: Option\n}", "docs": "Identity envelope attached to an outbound MCP `tools/call` request.\n\nThe middleware extracts this from `_meta.openagent.identity` on the\ninbound request. `proof` is opaque to the middleware \u2014 it can be a\nsigned challenge response, an Arsenal Agent Capability Token, or any\nother format the verifier knows how to validate.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]", "line": 27 }, { "name": "types::VerifiedIdentity", "kind": "struct_item", "signature": "pub struct VerifiedIdentity {\n/// Verified DID.\n\npub did: Did,\n/// Scopes the caller actually holds (post-verification).\n\npub scopes: Vec,\n/// Audit identifier echoed back to the caller in the response.\n\npub audit_id: String,\n/// Verifier-issued claims about the caller.\n\npub claims: serde_json::Value\n}", "docs": "The result of a successful identity verification. Carries the audit\nid stamped onto the response, the held scopes, and any verifier\nclaims.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 46 }, { "name": "types::AuditMeta", "kind": "struct_item", "signature": "pub struct AuditMeta {\n/// Identifier for correlating logs end-to-end.\n\npub audit_id: String,\n/// DID of the caller that was successfully verified.\n\npub verified_did: Did,\n/// Scopes the caller exercised on this call.\n\npub scopes: Vec\n}", "docs": "Audit metadata stamped onto the response `_meta.openagent` block.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 59 }, { "name": "types::IdentityVerifier", "kind": "trait_item", "signature": "pub trait IdentityVerifier: Send + Sync {\n /// Verify the supplied identity envelope and return the resulting\n /// [`VerifiedIdentity`]. Implementations MUST be deterministic for a\n /// given `(identity, required_scopes)` pair and MUST NOT mutate\n /// either argument.\n async fn verify(\n &self,\n identity: &Identity,\n required_scopes: &[String],\n ) -> Result;\n}", "docs": "The trait every identity verifier implements. Production deployments\nwill use the verifier from `openagent-sdk`; tests use the\n[`crate::handler::InMemoryToolHandler`]-friendly fake found in the\n`tests/` directory.", "attributes": "#[async_trait]", "line": 73 }, { "name": "types::Agent", "kind": "trait_item", "signature": "pub trait Agent: Send + Sync {\n /// The agent's own DID.\n fn did(&self) -> &str;\n\n /// The verifier the agent's MCP server uses to authenticate\n /// inbound calls.\n fn verifier(&self) -> Arc;\n\n /// Sign an outbound call so the receiving server can authenticate\n /// the agent. Returns the identity envelope to attach to the\n /// request `_meta.openagent.identity` field.\n async fn sign_request(\n &self,\n tool_name: &str,\n audience: Option<&str>,\n ) -> Result;\n}", "docs": "Minimal Agent surface used by the middleware.", "attributes": "#[async_trait]", "line": 87 }, { "name": "types::ScopeDeriver", "kind": "type_item", "signature": "pub type ScopeDeriver =\n Arc Vec + Send + Sync>;", "docs": "Function type that derives the required scopes for a tool from the\ntool name and arguments.", "attributes": "", "line": 107 }, { "name": "types::PreCallHook", "kind": "type_item", "signature": "pub type PreCallHook = Arc<\n dyn Fn(&PreCallContext<'_>) -> futures_compat::BoxFuture<'static, ()> + Send + Sync,\n>;", "docs": "Hook fired before the tool body executes.", "attributes": "", "line": 111 }, { "name": "types::PostCallHook", "kind": "type_item", "signature": "pub type PostCallHook = Arc<\n dyn Fn(&PostCallContext<'_>) -> futures_compat::BoxFuture<'static, ()> + Send + Sync,\n>;", "docs": "Hook fired after the tool body executes successfully.", "attributes": "", "line": 116 }, { "name": "types::ErrorHook", "kind": "type_item", "signature": "pub type ErrorHook = Arc<\n dyn Fn(&ErrorContext<'_>) -> futures_compat::BoxFuture<'static, ()> + Send + Sync,\n>;", "docs": "Hook fired when the auth pipeline or tool body errors.", "attributes": "", "line": 121 }, { "name": "types::PreCallContext", "kind": "struct_item", "signature": "pub struct PreCallContext<'a> {\n/// The tool name.\n\npub tool_name: &'a str,\n/// Arguments the caller supplied.\n\npub args: &'a serde_json::Value,\n/// The verified identity.\n\npub identity: &'a VerifiedIdentity\n}", "docs": "Context passed to a [`PreCallHook`].", "attributes": "#[derive(Debug)]", "line": 127 }, { "name": "types::PostCallContext", "kind": "struct_item", "signature": "pub struct PostCallContext<'a> {\n/// The tool name.\n\npub tool_name: &'a str,\n/// Arguments the caller supplied.\n\npub args: &'a serde_json::Value,\n/// The verified identity.\n\npub identity: &'a VerifiedIdentity,\n/// Wall-clock duration of the call, in milliseconds.\n\npub duration_ms: u128,\n/// The successful tool result, after audit metadata stamping.\n\npub result: &'a serde_json::Value\n}", "docs": "Context passed to a [`PostCallHook`].", "attributes": "#[derive(Debug)]", "line": 138 }, { "name": "types::ErrorContext", "kind": "struct_item", "signature": "pub struct ErrorContext<'a> {\n/// The tool name.\n\npub tool_name: &'a str,\n/// Arguments the caller supplied.\n\npub args: &'a serde_json::Value,\n/// The verified identity, if the auth pipeline got far enough to\n\n/// produce one.\n\npub identity: Option<&'a VerifiedIdentity>,\n/// The error that aborted the call.\n\npub error: &'a McpAuthError\n}", "docs": "Context passed to an [`ErrorHook`].", "attributes": "#[derive(Debug)]", "line": 153 }, { "name": "types::Config", "kind": "struct_item", "signature": "pub struct Config {\n\n}", "docs": "Configuration for the [`crate::OpenAgentMiddleware`].", "attributes": "#[derive(Clone)]", "line": 167 }, { "name": "types::Config::new", "kind": "function_item", "signature": "pub fn new(agent: Arc) -> Self;", "docs": "Create a new config from the agent. All hooks default to none\nand identity is required.", "attributes": "", "line": 196 }, { "name": "types::Config::with_require_scopes", "kind": "function_item", "signature": "pub fn with_require_scopes(mut self, deriver: ScopeDeriver) -> Self;", "docs": "Override the per-tool scope deriver. Defaults to\n`[\"mcp::invoke\"]`.", "attributes": "", "line": 211 }, { "name": "types::Config::with_require_identity", "kind": "function_item", "signature": "pub fn with_require_identity(mut self, require: bool) -> Self;", "docs": "Set whether the middleware should reject calls without an\nidentity envelope. Defaults to `true`.", "attributes": "", "line": 218 }, { "name": "types::Config::with_skills_policy", "kind": "function_item", "signature": "pub fn with_skills_policy(mut self, policy: SkillsPolicy) -> Self;", "docs": "Install a skills policy hook. See [`crate::skills`].", "attributes": "", "line": 224 }, { "name": "types::Config::with_pre_call", "kind": "function_item", "signature": "pub fn with_pre_call(mut self, hook: PreCallHook) -> Self;", "docs": "Install a pre-call hook.", "attributes": "", "line": 230 }, { "name": "types::Config::with_post_call", "kind": "function_item", "signature": "pub fn with_post_call(mut self, hook: PostCallHook) -> Self;", "docs": "Install a post-call hook.", "attributes": "", "line": 236 }, { "name": "types::Config::with_on_error", "kind": "function_item", "signature": "pub fn with_on_error(mut self, hook: ErrorHook) -> Self;", "docs": "Install an error hook.", "attributes": "", "line": 242 }, { "name": "types::Config::with_extra", "kind": "function_item", "signature": "pub fn with_extra(mut self, key: impl Into, value: serde_json::Value) -> Self;", "docs": "Attach an arbitrary metadata field to the config (for\nobservability or custom adapters). Returns the new config.", "attributes": "", "line": 249 }, { "name": "types::Config::agent", "kind": "function_item", "signature": "pub fn agent(&self) -> &Arc;", "docs": "Borrow the underlying agent.", "attributes": "", "line": 255 }, { "name": "types::futures_compat", "kind": "module", "signature": "pub mod futures_compat;", "docs": "Tiny adapter module so the public API can use boxed futures without\npulling in the full `futures` crate. Keeping this in-tree avoids a\ndependency that has historically caused version conflicts inside the\nL1fe ecosystem.", "attributes": "", "line": 264 }, { "name": "types::futures_compat::BoxFuture", "kind": "type_item", "signature": "pub type BoxFuture<'a, T> = Pin + Send + 'a>>;", "docs": "A future that has been boxed onto the heap with a `'static`\nlifetime. Used by hook signatures.", "attributes": "", "line": 270 } ], "parseErrors": false }, { "module": "rmcp_adapter", "source": "openagent-sdk/integrations/mcp/rust/src/rmcp_adapter.rs", "sha256": "6259f4263bbaaf3272b3af31186470920d98d8db0723bae0985d573a7f477a63", "attributes": "#[cfg(feature = \"rmcp\")]", "items": [ { "name": "rmcp_adapter::RmcpOpenAgent", "kind": "struct_item", "signature": "pub struct RmcpOpenAgent\nwhere\n H: ToolHandler + 'static, {\n\n}", "docs": "Newtype wrapper around a [`WrappedHandler`] that exposes a method\nthe user's `rmcp::ServerHandler::call_tool` implementation can\ndelegate to.\n\n## Usage\n\n```ignore\n// 1. Build your handler and wrap it with the middleware.\nuse openagent_mcp::{Config, InMemoryToolHandler, OpenAgentMiddleware, RmcpOpenAgent, WithOpenAgent};\n# async fn example(agent: std::sync::Arc) {\nlet inner = InMemoryToolHandler::new();\nlet middleware = OpenAgentMiddleware::new(Config::new(agent));\nlet wrapped = inner.with_openagent(middleware);\nlet adapter = RmcpOpenAgent::new(wrapped);\n\n// 2. From your rmcp ServerHandler::call_tool, delegate:\n// async fn call_tool(&self, params: CallToolRequestParam, ctx: RequestContext)\n// -> Result\n// {\n// adapter.dispatch(params, &ctx).await\n// }\n# let _ = adapter;\n# }\n```\n\nThe dispatch helper handles the JSON conversion and error mapping\nso the rmcp glue stays a one-liner.", "attributes": "#[cfg(feature = \"rmcp\")]", "line": 63 }, { "name": "rmcp_adapter::RmcpOpenAgent::new", "kind": "function_item", "signature": "pub fn new(handler: WrappedHandler) -> Self;", "docs": "Wrap an [`WrappedHandler`] so it can be plugged into rmcp.", "attributes": "#[cfg(feature = \"rmcp\")]", "line": 86 }, { "name": "rmcp_adapter::RmcpOpenAgent::dispatch_value", "kind": "function_item", "signature": "pub async fn dispatch_value(\n &self,\n name: String,\n arguments: serde_json::Value,\n meta: serde_json::Value,\n ) -> Result;", "docs": "Translate an rmcp `CallToolRequestParam` into a [`ToolCall`],\nrun the middleware pipeline, and return a [`ToolResult`] ready\nto be converted back into rmcp's `CallToolResult` by the caller.\n\nWe deliberately do not import rmcp's types here \u2014 the conversion\nto and from those types lives in the user's `ServerHandler`\nimplementation. That way, when rmcp bumps its API again, only\nthe user's call site needs to be touched.", "attributes": "#[cfg(feature = \"rmcp\")]", "line": 100 }, { "name": "rmcp_adapter::RmcpOpenAgent::handler", "kind": "function_item", "signature": "pub fn handler(&self) -> &Arc>;", "docs": "Borrow the inner wrapped handler. Useful for tests and for\ncallers that want to invoke `list_tools` directly.", "attributes": "#[cfg(feature = \"rmcp\")]", "line": 116 } ], "parseErrors": false } ] }, { "name": "openagent-sdk", "url": "/reference/rust/openagent-sdk", "modules": [ { "module": "crate", "source": "openagent-sdk/sdks/rust/src/lib.rs", "sha256": "a08e99ea97d2d8baf98b88b5fc13588ae769ec424219aaba3b1cd1d7a78b22ae", "attributes": "", "items": [ { "name": "act", "kind": "module", "signature": "pub mod act;", "docs": "", "attributes": "", "line": 74 }, { "name": "agent", "kind": "module", "signature": "pub mod agent;", "docs": "", "attributes": "", "line": 75 }, { "name": "builder", "kind": "module", "signature": "pub mod builder;", "docs": "", "attributes": "", "line": 76 }, { "name": "config", "kind": "module", "signature": "pub mod config;", "docs": "", "attributes": "", "line": 77 }, { "name": "credentials", "kind": "module", "signature": "pub mod credentials;", "docs": "", "attributes": "#[cfg(feature = \"arsenal\")]", "line": 79 }, { "name": "errors", "kind": "module", "signature": "pub mod errors;", "docs": "", "attributes": "", "line": 80 }, { "name": "identity", "kind": "module", "signature": "pub mod identity;", "docs": "", "attributes": "", "line": 81 }, { "name": "skills", "kind": "module", "signature": "pub mod skills;", "docs": "", "attributes": "", "line": 82 }, { "name": "verification", "kind": "module", "signature": "pub mod verification;", "docs": "", "attributes": "#[cfg(feature = \"aegis\")]", "line": 84 }, { "name": "pub use agent::authenticate_with_verifier;", "kind": "use_declaration", "signature": "pub use agent::authenticate_with_verifier;", "docs": "", "attributes": "#[cfg(feature = \"aegis\")]", "line": 91 }, { "name": "pub use agent::{CreateAgentOptions, OpenAgent};", "kind": "use_declaration", "signature": "pub use agent::{CreateAgentOptions, OpenAgent};", "docs": "", "attributes": "", "line": 92 }, { "name": "pub use builder::OpenAgentBuilder;", "kind": "use_declaration", "signature": "pub use builder::OpenAgentBuilder;", "docs": "", "attributes": "", "line": 93 }, { "name": "pub use config::{BrokerMtlsConfig, OpenAgentConfig};", "kind": "use_declaration", "signature": "pub use config::{BrokerMtlsConfig, OpenAgentConfig};", "docs": "", "attributes": "", "line": 94 }, { "name": "pub use credentials::CredentialClient;", "kind": "use_declaration", "signature": "pub use credentials::CredentialClient;", "docs": "", "attributes": "#[cfg(feature = \"arsenal\")]", "line": 96 }, { "name": "pub use errors::{OpenAgentError, Result};", "kind": "use_declaration", "signature": "pub use errors::{OpenAgentError, Result};", "docs": "", "attributes": "", "line": 97 }, { "name": "pub use identity::{AgentIdentityRecord, ParsedDid};", "kind": "use_declaration", "signature": "pub use identity::{AgentIdentityRecord, ParsedDid};", "docs": "", "attributes": "", "line": 98 }, { "name": "pub use skills::{AllowListPolicy, SkillsPolicy, SkillsPolicyHandle};", "kind": "use_declaration", "signature": "pub use skills::{AllowListPolicy, SkillsPolicy, SkillsPolicyHandle};", "docs": "", "attributes": "", "line": 99 }, { "name": "pub use verification::{\n authority_context_from_oas, LineageAuthorityContext, VerifiedContext, Verifier,\n};", "kind": "use_declaration", "signature": "pub use verification::{\n authority_context_from_oas, LineageAuthorityContext, VerifiedContext, Verifier,\n};", "docs": "", "attributes": "#[cfg(feature = \"aegis\")]", "line": 101 }, { "name": "pub use arsenal_sdk;", "kind": "use_declaration", "signature": "pub use arsenal_sdk;", "docs": "The wrapped Arsenal SDK.", "attributes": "#[cfg(feature = \"arsenal\")]", "line": 111 }, { "name": "pub use oas_sdk;", "kind": "use_declaration", "signature": "pub use oas_sdk;", "docs": "The wrapped OAS SDK.", "attributes": "", "line": 113 }, { "name": "pub use openagent_aegis_sdk;", "kind": "use_declaration", "signature": "pub use openagent_aegis_sdk;", "docs": "The wrapped AEGIS SDK.", "attributes": "#[cfg(feature = \"aegis\")]", "line": 116 }, { "name": "sync", "kind": "module", "signature": "pub mod sync;", "docs": "Synchronous helpers for CLI tooling.\n\nThe OpenAgent SDK is async-first, but CLI tools and one-shot scripts\nusually want a blocking wrapper. The [`sync`] module provides exactly that.", "attributes": "", "line": 122 }, { "name": "sync::create_agent", "kind": "function_item", "signature": "pub fn create_agent(opts: CreateAgentOptions<'_>) -> Result;", "docs": "Blocking equivalent of [`crate::OpenAgent::create_agent`].\n\nBuilds a single-threaded tokio runtime, drives the async call to\ncompletion, and returns the result. Safe to call from any non-async\ncontext.\n\n# Errors\n\nPropagates any [`crate::OpenAgentError`] from the async path.", "attributes": "", "line": 135 } ], "parseErrors": false }, { "module": "act", "source": "openagent-sdk/sdks/rust/src/act.rs", "sha256": "68f5160930c131e508255fa8ae69bf8ca61b0d84f3c68cf5eb025e2a08b622be", "attributes": "", "items": [ { "name": "act::ActVerifierBuilder", "kind": "struct_item", "signature": "pub struct ActVerifierBuilder<'a> {\n\n}", "docs": "Fluent ACT verifier, built by [`verify`].", "attributes": "#[derive(Debug, Clone)]", "line": 26 }, { "name": "act::verify", "kind": "function_item", "signature": "pub fn verify(token: &[u8]) -> ActVerifierBuilder<'_>;", "docs": "Begin verifying an ACT envelope (CBOR bytes).", "attributes": "", "line": 37 }, { "name": "act::ActVerifierBuilder<'a>::issuer", "kind": "function_item", "signature": "pub fn issuer(mut self, iss: impl Into) -> Self;", "docs": "Bind the expected issuer. Required: a verifier that does not name the\nissuer accepts anyone's tokens.", "attributes": "", "line": 52 }, { "name": "act::ActVerifierBuilder<'a>::for_audience", "kind": "function_item", "signature": "pub fn for_audience(mut self, audience: impl Into) -> Self;", "docs": "Bind the audience this verifier answers for. Required: a token meant\nfor another service must not pass here.", "attributes": "", "line": 59 }, { "name": "act::ActVerifierBuilder<'a>::require_scope", "kind": "function_item", "signature": "pub fn require_scope(mut self, scope: Scope) -> Self;", "docs": "Require a scope the token must grant. Wildcards in the grant expand;\nin the request they are literal.", "attributes": "", "line": 66 }, { "name": "act::ActVerifierBuilder<'a>::trusted_keys", "kind": "function_item", "signature": "pub fn trusted_keys(mut self, keys: impl IntoIterator) -> Self;", "docs": "The trusted Ed25519 public keys (raw 32 bytes each). Required.", "attributes": "", "line": 72 }, { "name": "act::ActVerifierBuilder<'a>::with_leeway", "kind": "function_item", "signature": "pub fn with_leeway(mut self, seconds: i64) -> Self;", "docs": "Allow `seconds` of clock skew on temporal checks.", "attributes": "", "line": 78 }, { "name": "act::ActVerifierBuilder<'a>::at_time", "kind": "function_item", "signature": "pub fn at_time(mut self, unix_seconds: i64) -> Self;", "docs": "Pin the verification clock (tests, decision replay).", "attributes": "", "line": 84 }, { "name": "act::ActVerifierBuilder<'a>::run", "kind": "function_item", "signature": "pub fn run(self) -> Result;", "docs": "Run verification.\n\n# Errors\n\nReturns [`OpenAgentError::Config`] for a missing policy binding, and\n[`OpenAgentError::Verification`] carrying the canonical reason\n(signature, expiry, audience, scope, version - distinct on purpose)\nwhen the token itself fails.", "attributes": "", "line": 97 }, { "name": "act::axum_support", "kind": "module", "signature": "pub mod axum_support;", "docs": "", "attributes": "#[cfg(feature = \"axum\")]", "line": 127 }, { "name": "act::axum_support::ActPolicy", "kind": "struct_item", "signature": "pub struct ActPolicy {\n\n}", "docs": "The shared verifier policy. Cheap to clone (Arc inside).", "attributes": "#[cfg(feature = \"axum\")]\n#[derive(Clone)]", "line": 145 }, { "name": "act::axum_support::ActPolicy::new", "kind": "function_item", "signature": "pub fn new(\n issuer: impl Into,\n audience: impl Into,\n trusted_keys: Vec,\n ) -> Result;", "docs": "Build a policy. Same bindings as the builder: issuer, audience,\nand at least one trusted key are required.", "attributes": "#[cfg(feature = \"axum\")]", "line": 156 }, { "name": "act::axum_support::ActPolicy::with_scopes", "kind": "function_item", "signature": "pub fn with_scopes(mut self, scopes: Vec) -> Self;", "docs": "Require scopes on every request.", "attributes": "#[cfg(feature = \"axum\")]", "line": 176 }, { "name": "act::axum_support::ActPolicy::with_leeway", "kind": "function_item", "signature": "pub fn with_leeway(mut self, seconds: i64) -> Self;", "docs": "Allow clock skew.", "attributes": "#[cfg(feature = \"axum\")]", "line": 182 }, { "name": "act::axum_support::ActContext", "kind": "struct_item", "signature": "pub struct ActContext(pub ActClaims);", "docs": "Extractor: the verified claims of the request's ACT.", "attributes": "#[cfg(feature = \"axum\")]", "line": 189 } ], "parseErrors": false }, { "module": "agent", "source": "openagent-sdk/sdks/rust/src/agent.rs", "sha256": "1538f167ae4c05d66cb606308a74ffbb53fe3171efcb40787d53077a38312219", "attributes": "", "items": [ { "name": "agent::CreateAgentOptions", "kind": "struct_item", "signature": "pub struct CreateAgentOptions<'a> {\n/// Parent DID to derive this agent from. When `None`, a fresh Human Root\n\n/// (HMR) identity is minted under the configured namespace.\n\npub parent: Option,\n/// Required: a short, human-readable name (becomes the DID identifier).\n\npub name: &'a str,\n/// Default scopes the agent will request from the Arsenal broker. May be\n\n/// overridden per-credential-call.\n\npub scopes: &'a [&'a str],\n/// Optional kind override (defaults to `\"agent\"` when deriving from a\n\n/// parent, or `\"hmr\"` when no parent is supplied).\n\npub kind: Option<&'a str>,\n/// Optional derivation path. Defaults to `\"/\"`.\n\npub derivation_path: Option<&'a str>\n}", "docs": "Options for creating a new agent in one call.\n\nMirrors the JS / TS pattern of \"one big options bag\" so the call site stays\nflat. Most fields are optional and have sensible defaults.", "attributes": "#[derive(Debug, Default)]", "line": 43 }, { "name": "agent::OpenAgent", "kind": "struct_item", "signature": "pub struct OpenAgent {\n\n}", "docs": "A fully-constructed agent.\n\n`OpenAgent` is `Clone`-cheap (everything inside is `Arc`-shared) so the\nsame agent handle can flow through every layer of an application.", "attributes": "#[derive(Clone)]", "line": 68 }, { "name": "agent::OpenAgent::from_parts", "kind": "function_item", "signature": "pub fn from_parts(\n record: AgentIdentityRecord,\n config: OpenAgentConfig,\n #[cfg(feature = \"arsenal\")] credentials: Option,\n #[cfg(feature = \"aegis\")] verifier: Option,\n skills: SkillsPolicyHandle,\n default_scopes: Vec,\n ) -> Self;", "docs": "Construct an [`OpenAgent`] from already-built parts.\n\nMost callers should use [`crate::builder::OpenAgentBuilder`] or\n[`OpenAgent::create_agent`] instead. This constructor exists so test\nharnesses (and the builder itself) can wire pre-built components.\n\nThe signature varies with the enabled Cargo features: `credentials`\nexists only with `arsenal`, `verifier` only with `aegis`. A subsystem\nleft disabled is absent from the type, not silently stubbed.", "attributes": "", "line": 93 }, { "name": "agent::OpenAgent::create_agent", "kind": "function_item", "signature": "pub async fn create_agent(opts: CreateAgentOptions<'_>) -> Result;", "docs": "Create a new agent with default SDK configuration.\n\nThis is the boring, batteries-included path:\n\n1. If `parent` is supplied, derive a child identity under that parent.\n Otherwise mint a fresh HMR under the SDK's default namespace.\n2. Skip the credentials layer (no broker is configured by default \u2014\n use [`crate::builder::OpenAgentBuilder::with_arsenal_client`] for\n that).\n3. Skip the AEGIS verifier (same reason).\n4. Use a deny-all default skills policy.\n\n# Errors\n\nReturns [`OpenAgentError::Identity`] if document construction fails.", "attributes": "", "line": 130 }, { "name": "agent::OpenAgent::create_agent_with_config", "kind": "function_item", "signature": "pub async fn create_agent_with_config(\n opts: CreateAgentOptions<'_>,\n config: OpenAgentConfig,\n ) -> Result;", "docs": "Like [`Self::create_agent`] but with a custom [`OpenAgentConfig`].\n\n# Errors\n\nReturns [`OpenAgentError::Identity`] if document construction fails.", "attributes": "", "line": 139 }, { "name": "agent::OpenAgent::document", "kind": "function_item", "signature": "pub fn document(&self) -> &OasDocument;", "docs": "The agent's signed OAS Identity Document.", "attributes": "", "line": 187 }, { "name": "agent::OpenAgent::keypair", "kind": "function_item", "signature": "pub fn keypair(&self) -> &OasKeyPair;", "docs": "The agent's keypair (for advanced workflows \u2014 most users should not\ntouch this).", "attributes": "", "line": 193 }, { "name": "agent::OpenAgent::did", "kind": "function_item", "signature": "pub fn did(&self) -> &str;", "docs": "The agent's `did:oas` string.", "attributes": "", "line": 198 }, { "name": "agent::OpenAgent::default_scopes", "kind": "function_item", "signature": "pub fn default_scopes(&self) -> &[String];", "docs": "The default scopes the agent was created with.", "attributes": "", "line": 203 }, { "name": "agent::OpenAgent::config", "kind": "function_item", "signature": "pub fn config(&self) -> &OpenAgentConfig;", "docs": "The SDK config snapshot in effect for this agent.", "attributes": "", "line": 208 }, { "name": "agent::OpenAgent::skills_policy", "kind": "function_item", "signature": "pub fn skills_policy(&self) -> SkillsPolicyHandle;", "docs": "Skill policy handle for this agent.\n\nReturns a clone, so callers can move it into other layers without\nborrow-checking pain.", "attributes": "", "line": 216 }, { "name": "agent::OpenAgent::with_skills_policy", "kind": "function_item", "signature": "pub fn with_skills_policy(self, policy: P) -> Self;", "docs": "Set (or replace) the skill policy on this agent.\n\nThis rebuilds the inner `Arc` so the change is local to the returned\nclone \u2014 callers should reassign the returned value.", "attributes": "", "line": 224 }, { "name": "agent::OpenAgent::check_skill", "kind": "function_item", "signature": "pub fn check_skill(&self, skill: &str) -> Result<()>;", "docs": "Quick check whether the named skill may be invoked by this agent.\n\n# Errors\n\nReturns [`OpenAgentError::SkillDenied`] if the skill is not allowed.", "attributes": "", "line": 250 }, { "name": "agent::OpenAgent::credentials_for", "kind": "function_item", "signature": "pub async fn credentials_for(&self, provider: &str) -> Result;", "docs": "Get a credentials handle scoped to a specific provider.\n\n`provider` is a logical name (e.g., `\"openai\"`, `\"github\"`) used by the\nSDK only for diagnostic logs \u2014 the actual scopes routed to the broker\ncome from the agent's [`Self::default_scopes`].\n\n# Errors\n\nReturns [`OpenAgentError::Config`] if no credential client is wired in.", "attributes": "#[cfg(feature = \"arsenal\")]", "line": 264 }, { "name": "agent::OpenAgent::verifier", "kind": "function_item", "signature": "pub fn verifier(&self) -> Option<&Verifier>;", "docs": "Reference to the AEGIS verifier (if configured).", "attributes": "#[cfg(feature = \"aegis\")]", "line": 278 }, { "name": "agent::authenticate_with_verifier", "kind": "function_item", "signature": "pub async fn authenticate_with_verifier(\n verifier: &Verifier,\n did: &str,\n) -> Result;", "docs": "One-shot authentication helper at the crate level.\n\n`OpenAgent::authenticate` is the canonical entry point referenced in\nthe README pitch. We expose it as an inherent method on the [`OpenAgent`]\ntype itself by re-exporting from [`crate::lib`].\n\nVerifies the supplied DID through an injected [`Verifier`]. The DID\nis opaque \u2014 typically it comes from an `Authorization: Bearer` header\nor an `X-Openagent-DID` header on an inbound HTTP request.\n\n# Errors\n\nReturns [`OpenAgentError::Verification`] on pipeline failure or\n[`OpenAgentError::Config`] if no verifier was supplied.", "attributes": "#[cfg(feature = \"aegis\")]", "line": 311 } ], "parseErrors": false }, { "module": "builder", "source": "openagent-sdk/sdks/rust/src/builder.rs", "sha256": "e0ecff2f40b0c2c8b5021827630f5991d14020c8561aee684e80447db77856a7", "attributes": "", "items": [ { "name": "builder::OpenAgentBuilder", "kind": "struct_item", "signature": "pub struct OpenAgentBuilder {\n\n}", "docs": "Fluent builder for an [`OpenAgent`].\n\nAll setters consume `self` and return a new builder; the builder itself is\n`Default`-friendly so you can chain straight from a function call.\n\nSetters for a disabled Cargo feature are absent rather than ignored: a\n`with_arsenal_client` call cannot exist in a build that would discard the\nclient.", "attributes": "#[derive(Default)]", "line": 36 }, { "name": "builder::OpenAgentBuilder::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Start a new builder with default config.", "attributes": "", "line": 50 }, { "name": "builder::OpenAgentBuilder::config", "kind": "function_item", "signature": "pub fn config(mut self, config: OpenAgentConfig) -> Self;", "docs": "Replace the SDK config.", "attributes": "", "line": 55 }, { "name": "builder::OpenAgentBuilder::with_arsenal_client", "kind": "function_item", "signature": "pub fn with_arsenal_client(mut self, client: ArsenalClient) -> Self;", "docs": "Wire in an existing [`ArsenalClient`].\n\nWithout this call, agents built by this builder cannot fetch\ncredentials and [`OpenAgent::credentials_for`] will return a\n[`crate::errors::OpenAgentError::Config`].", "attributes": "#[cfg(feature = \"arsenal\")]", "line": 66 }, { "name": "builder::OpenAgentBuilder::with_aegis_client", "kind": "function_item", "signature": "pub fn with_aegis_client(mut self, client: AegisClient) -> Self;", "docs": "Wire in an existing [`AegisClient`].", "attributes": "#[cfg(feature = \"aegis\")]", "line": 73 }, { "name": "builder::OpenAgentBuilder::with_aegis_registry", "kind": "function_item", "signature": "pub fn with_aegis_registry(mut self, registry: Arc) -> Self;", "docs": "Wire in an AEGIS plugin registry. The builder will materialise an\n[`AegisClient`] from this when needed.", "attributes": "#[cfg(feature = \"aegis\")]", "line": 81 }, { "name": "builder::OpenAgentBuilder::with_skills_policy", "kind": "function_item", "signature": "pub fn with_skills_policy(mut self, policy: P) -> Self;", "docs": "Wire in a custom skills policy.", "attributes": "", "line": 87 }, { "name": "builder::OpenAgentBuilder::with_parent", "kind": "function_item", "signature": "pub fn with_parent(mut self, parent: AgentIdentityRecord) -> Self;", "docs": "Provide a real parent identity (with its own keypair) so the new agent\ncan be derived from it cryptographically.\n\nThis is the production path. The convenience\n[`crate::OpenAgent::create_agent`] mints a fresh transient root from\nthe parent DID instead, which is useful for tests but not for\nlong-lived deployments.", "attributes": "", "line": 99 }, { "name": "builder::OpenAgentBuilder::build", "kind": "function_item", "signature": "pub async fn build(self, opts: CreateAgentOptions<'_>) -> Result;", "docs": "Finish the build and produce an [`OpenAgent`].\n\n# Errors\n\nReturns [`OpenAgentError::Identity`] if document construction fails or\n[`OpenAgentError::Config`] if the supplied options are invalid.", "attributes": "", "line": 110 } ], "parseErrors": false }, { "module": "config", "source": "openagent-sdk/sdks/rust/src/config.rs", "sha256": "60a0684c92cb70612b9eda9b841a39dfed78ad80c39f2df3a6d8afbb7f1baa3c", "attributes": "", "items": [ { "name": "config::OpenAgentConfig", "kind": "struct_item", "signature": "pub struct OpenAgentConfig {\n/// The OAS namespace used when minting new identities. Default: `\"openagent\"`.\n\npub namespace: String,\n/// Optional Arsenal broker URL for credential proxying.\n\n/// When `None`, agents are created with identity only and credential\n\n/// fetching will return [`crate::errors::OpenAgentError::Config`].\n\npub broker_url: Option,\n/// Optional broker mTLS configuration. Required when `broker_url` is set\n\n/// in production.\n\npub broker_mtls: Option,\n/// Default audience advertised on broker capability requests.\n\npub default_audience: String,\n/// Default capability TTL in seconds. Default: 300 (5 minutes).\n\npub default_ttl_seconds: i64,\n/// Whether to auto-renew capability tokens before expiry. Default: `true`.\n\npub auto_renew: bool,\n/// Optional path to a key file for loading the SDK's master signing key.\n\n/// When `None`, a fresh ephemeral key is generated.\n\npub key_file: Option\n}", "docs": "Top-level configuration for the OpenAgent SDK.\n\nMost users can call [`OpenAgentConfig::default`] and never touch this type.\nAdvanced users construct it via [`crate::builder::OpenAgentBuilder`].", "attributes": "#[derive(Debug, Clone)]", "line": 14 }, { "name": "config::BrokerMtlsConfig", "kind": "struct_item", "signature": "pub struct BrokerMtlsConfig {\n/// PEM-encoded client certificate chain.\n\npub client_cert: PathBuf,\n/// PEM-encoded client private key.\n\npub client_key: PathBuf,\n/// Optional PEM-encoded CA certificate to trust for the broker server.\n\npub ca_cert: Option\n}", "docs": "mTLS bundle for the Arsenal broker connection.\n\nAll three fields are file paths to PEM-encoded material on disk. The SDK\npasses them through to [`arsenal_sdk::ArsenalClientBuilder::broker_mtls`].", "attributes": "#[derive(Debug, Clone)]", "line": 60 } ], "parseErrors": false }, { "module": "credentials", "source": "openagent-sdk/sdks/rust/src/credentials.rs", "sha256": "4031950119cf80c662cc8b3f1862a41b1ac6f38b25b9ef80e899de1c0645c042", "attributes": "#[cfg(feature = \"arsenal\")]", "items": [ { "name": "credentials::CredentialClient", "kind": "struct_item", "signature": "pub struct CredentialClient {\n\n}", "docs": "Builder-friendly handle to Arsenal-backed credentials for one agent.\n\n`CredentialClient` is `Clone` (via `Arc`) so multiple call sites in an\nagent can share one underlying broker connection. Internally it holds:\n\n- the [`ArsenalClient`] (broker connection + identity),\n- the agent's default scopes,\n- the most-recently issued capability token (cached in the client itself),\n- a default audience hint for the broker.", "attributes": "#[cfg(feature = \"arsenal\")]\n#[derive(Clone)]", "line": 39 }, { "name": "credentials::CredentialClient::new", "kind": "function_item", "signature": "pub fn new(\n client: ArsenalClient,\n default_scopes: Vec,\n default_ttl_seconds: i64,\n ) -> Self;", "docs": "Wrap an existing [`ArsenalClient`] into a [`CredentialClient`].\n\n`default_scopes` are advertised on every capability request unless the\ncaller passes more specific scopes via [`Self::request_token`].", "attributes": "#[cfg(feature = \"arsenal\")]", "line": 56 }, { "name": "credentials::CredentialClient::default_scopes", "kind": "function_item", "signature": "pub fn default_scopes(&self) -> &[String];", "docs": "Default scopes this credential client was constructed with.", "attributes": "#[cfg(feature = \"arsenal\")]", "line": 72 }, { "name": "credentials::CredentialClient::ensure_session", "kind": "function_item", "signature": "pub async fn ensure_session(&self) -> Result<()>;", "docs": "Ensure the underlying Arsenal session is open.\n\nIdempotent \u2014 safe to call from every entry point. The first call opens\nthe session; subsequent calls are no-ops.\n\n# Errors\n\nReturns [`OpenAgentError::Credential`] if the broker rejects the\nsession.", "attributes": "#[cfg(feature = \"arsenal\")]", "line": 85 }, { "name": "credentials::CredentialClient::request_token", "kind": "function_item", "signature": "pub async fn request_token(&self, scopes: &[&str]) -> Result;", "docs": "Request a capability token for the given scopes.\n\nIf `scopes` is empty the client falls back to the default scopes\nsupplied at construction.\n\n# Errors\n\nReturns [`OpenAgentError::Credential`] if the broker rejects the\nrequest or no scopes were configured.", "attributes": "#[cfg(feature = \"arsenal\")]", "line": 109 }, { "name": "credentials::CredentialClient::get", "kind": "function_item", "signature": "pub async fn get(\n &self,\n url: impl Into,\n headers: BTreeMap,\n ) -> Result;", "docs": "Send an HTTP `GET` through the credential proxy.\n\n`url` and `headers` may contain `{{VARIABLE}}` placeholders; the broker\nresolves them server-side and the agent never sees the raw credential.\n\n# Errors\n\nReturns [`OpenAgentError::Credential`] or [`OpenAgentError::Transport`]\non broker / network failures.", "attributes": "#[cfg(feature = \"arsenal\")]", "line": 144 }, { "name": "credentials::CredentialClient::post", "kind": "function_item", "signature": "pub async fn post(\n &self,\n url: impl Into,\n headers: BTreeMap,\n body: Vec,\n ) -> Result;", "docs": "Send an HTTP `POST` through the credential proxy.\n\n# Errors\n\nReturns [`OpenAgentError::Credential`] or [`OpenAgentError::Transport`]\non broker / network failures.", "attributes": "#[cfg(feature = \"arsenal\")]", "line": 158 }, { "name": "credentials::CredentialClient::inner", "kind": "function_item", "signature": "pub fn inner(&self) -> &ArsenalClient;", "docs": "Reference to the wrapped Arsenal client for advanced use cases.\n\nDrop down to this when the SDK doesn't expose what you need \u2014 but if\nyou find yourself doing it often, file a feature request.", "attributes": "#[cfg(feature = \"arsenal\")]", "line": 200 } ], "parseErrors": false }, { "module": "errors", "source": "openagent-sdk/sdks/rust/src/errors.rs", "sha256": "0d1f1eb2ffaa998919d2141ddf3cd565a7e235accc1a85ebfd2a844b66140155", "attributes": "", "items": [ { "name": "errors::Result", "kind": "type_item", "signature": "pub type Result = std::result::Result;", "docs": "Result alias for OpenAgent SDK operations.", "attributes": "", "line": 9 }, { "name": "errors::OpenAgentError", "kind": "enum_item", "signature": "pub enum OpenAgentError {\n /// An error from the OAS identity layer.\n #[error(\"identity error: {0}\")]\n Identity(#[from] oas_sdk::error::OasError),\n\n /// An error from the Arsenal capability/credential layer.\n #[cfg(feature = \"arsenal\")]\n #[error(\"credential error: {code:?}: {message}\")]\n Credential {\n /// Numeric Arsenal error code.\n code: arsenal_core::error::ErrorCode,\n /// Human-readable description of what went wrong.\n message: String,\n },\n\n /// An error from the AEGIS verification layer.\n #[error(\"verification error: {0}\")]\n Verification(String),\n\n /// An error from the AEGIS authentication layer.\n #[error(\"authentication error: {0}\")]\n Authentication(String),\n\n /// An error from the AEGIS policy / authorization layer.\n #[error(\"authorization error: {0}\")]\n Authorization(String),\n\n /// An error from the AEGIS delegation layer.\n #[error(\"delegation error: {0}\")]\n Delegation(String),\n\n /// A skill policy violation reported by the [`crate::skills`] layer.\n #[error(\"skill denied: {skill}: {reason}\")]\n SkillDenied {\n /// Name of the skill that was denied.\n skill: String,\n /// Reason the skill is denied.\n reason: String,\n },\n\n /// A configuration error in the SDK itself (missing parent, invalid scope, etc.).\n #[error(\"configuration error: {0}\")]\n Config(String),\n\n /// An error in the underlying HTTP transport when proxying credentials.\n #[error(\"transport error: {0}\")]\n Transport(String),\n\n /// A JSON serialization error from any of the layers.\n #[error(\"serialization error: {0}\")]\n Json(#[from] serde_json::Error),\n}", "docs": "Unified error type for the OpenAgent SDK.\n\nWraps every error returned by the underlying OAS, Arsenal, and AEGIS layers\nso consumers don't need to learn three different error taxonomies.\n\n# Examples\n\n```\nuse openagent_sdk::errors::{OpenAgentError, Result};\n\nfn example() -> Result<()> {\n // Errors from any wrapped SDK convert via `?`.\n Ok(())\n}\n```", "attributes": "#[derive(Debug, Error)]", "line": 27 }, { "name": "errors::OpenAgentError::config", "kind": "function_item", "signature": "pub fn config(msg: impl Into) -> Self;", "docs": "Construct a configuration error from any displayable value.", "attributes": "", "line": 82 }, { "name": "errors::OpenAgentError::transport", "kind": "function_item", "signature": "pub fn transport(msg: impl Into) -> Self;", "docs": "Construct a transport error from any displayable value.", "attributes": "", "line": 87 } ], "parseErrors": false }, { "module": "identity", "source": "openagent-sdk/sdks/rust/src/identity.rs", "sha256": "60b1590df92837c9a3fe12731f27f1d5dc40c693a5d1d6115c27ffb6eb3f0d01", "attributes": "", "items": [ { "name": "identity::ParsedDid", "kind": "struct_item", "signature": "pub struct ParsedDid {\n/// The namespace component (e.g., `\"l1fe\"`, `\"openagent\"`).\n\npub namespace: String,\n/// The entity kind (e.g., `\"hmr\"`, `\"agent\"`, `\"tool\"`).\n\npub kind: String,\n/// The entity identifier.\n\npub identifier: String\n}", "docs": "A parsed `did:oas:::` triple.\n\nThe OpenAgent SDK accepts DIDs as strings everywhere \u2014 this struct only\nexists internally so the wrapper code doesn't have to re-split the string.", "attributes": "#[derive(Debug, Clone, PartialEq, Eq)]", "line": 23 }, { "name": "identity::ParsedDid::parse", "kind": "function_item", "signature": "pub fn parse(did: &str) -> Result;", "docs": "Parse a `did:oas:...` string.\n\n# Errors\n\nReturns [`OpenAgentError::Config`] if the DID is malformed.", "attributes": "", "line": 38 }, { "name": "identity::ParsedDid::to_did", "kind": "function_item", "signature": "pub fn to_did(&self) -> String;", "docs": "Render this triple back into the canonical DID string.", "attributes": "", "line": 59 }, { "name": "identity::AgentIdentityRecord", "kind": "struct_item", "signature": "pub struct AgentIdentityRecord {\n/// The signed OAS Identity Document.\n\npub document: OasDocument,\n/// The Ed25519 keypair the document is signed with.\n\npub keypair: OasKeyPair\n}", "docs": "A signed identity document plus its keypair.\n\nThis is the OpenAgent SDK's analogue of [`oas_sdk::identity::CreatedIdentity`]\nand [`oas_sdk::lineage::DerivedIdentity`]. We collapse them into one type\nbecause consumers don't need to care which workflow produced the identity.", "attributes": "#[derive(Debug)]", "line": 87 }, { "name": "identity::mint_human_root", "kind": "function_item", "signature": "pub fn mint_human_root(namespace: &str, identifier: &str) -> Result;", "docs": "Mint a fresh Human Root (HMR) identity.\n\nMost apps don't call this directly \u2014 agents derive from a parent. This is\nexposed for tests and for the rare case of bootstrapping a new root.\n\n# Errors\n\nReturns [`OpenAgentError::Identity`] if document construction or signing\nfails inside OAS.", "attributes": "", "line": 121 }, { "name": "identity::derive_agent", "kind": "function_item", "signature": "pub fn derive_agent(\n parent_keypair: &OasKeyPair,\n parent_doc: &OasDocument,\n namespace: &str,\n kind: &str,\n identifier: &str,\n derivation_path: &str,\n) -> Result;", "docs": "Derive a child agent (or tool, skill, workflow) from a parent identity.\n\nPerforms HKDF-SHA256 key derivation, builds the child document with a\nlineage section, and signs the document. The returned record can be used\ndirectly or registered with an [`oas_lineage::provider::InMemoryProvider`]\nfor chain verification.\n\n# Errors\n\nReturns [`OpenAgentError::Identity`] if any step inside [`oas_sdk::lineage`]\nfails.", "attributes": "", "line": 138 }, { "name": "identity::verify_lineage_chain", "kind": "function_item", "signature": "pub fn verify_lineage_chain(document: &OasDocument, provider: &dyn DocumentProvider) -> Result<()>;", "docs": "Verify a document's lineage chain back to a human root.\n\nProvider must already contain every parent document on the chain (the\nOpenAgent SDK does not perform DID resolution; that lives in AEGIS).\n\n# Errors\n\nReturns [`OpenAgentError::Identity`] if any hop fails verification.", "attributes": "", "line": 167 } ], "parseErrors": false }, { "module": "skills", "source": "openagent-sdk/sdks/rust/src/skills.rs", "sha256": "917d41de8f0984c4dfa386f7d56e170f11d91aedd10a4d8e91e2d8e6208cbf51", "attributes": "", "items": [ { "name": "skills::SkillsPolicy", "kind": "trait_item", "signature": "pub trait SkillsPolicy: Send + Sync {\n /// Return `Ok(())` if the skill is allowed, `Err` otherwise.\n fn can_invoke(&self, skill: &str) -> Result<()>;\n\n /// Return the set of skills currently allowed by this policy.\n ///\n /// Used by tooling and tests; the policy may return an empty set if it\n /// does not enumerate skills (e.g., a remote service).\n fn allowed_skills(&self) -> BTreeSet;\n}", "docs": "Trait every skill policy must implement.\n\nA policy answers a single question: \"is this agent allowed to invoke the\nnamed skill, given the current verified context?\". Implementations may be\npure (an in-memory allow-list) or remote (an HTTP call to a policy\nservice); the SDK does not care.", "attributes": "", "line": 25 }, { "name": "skills::AllowListPolicy", "kind": "struct_item", "signature": "pub struct AllowListPolicy {\n\n}", "docs": "Default in-memory allow-list skill policy.\n\n`AllowListPolicy` lets callers register skill names up front and allow\nthem by exact match. Useful for tests, CLI tools, and bootstrap before\nthe real `openagent-skills-policy` crate is wired in.", "attributes": "#[derive(Debug, Clone, Default)]", "line": 42 }, { "name": "skills::AllowListPolicy::new", "kind": "function_item", "signature": "pub fn new() -> Self;", "docs": "Create an empty policy that denies every skill.", "attributes": "", "line": 48 }, { "name": "skills::AllowListPolicy::with_skills", "kind": "function_item", "signature": "pub fn with_skills(skills: I) -> Self\n where\n I: IntoIterator,\n S: Into,;", "docs": "Build a policy from an iterator of skill names.", "attributes": "", "line": 53 }, { "name": "skills::AllowListPolicy::allow", "kind": "function_item", "signature": "pub fn allow(&mut self, skill: impl Into);", "docs": "Mutably add a skill to the allow-list.", "attributes": "", "line": 64 }, { "name": "skills::SkillsPolicyHandle", "kind": "struct_item", "signature": "pub struct SkillsPolicyHandle {\n\n}", "docs": "Cheap-to-clone facade returned by [`crate::OpenAgent::skills_policy`].\n\nWraps an `Arc` so the same policy object can be shared\nacross multiple agent handles without lifetime headaches.", "attributes": "#[derive(Clone)]", "line": 91 }, { "name": "skills::SkillsPolicyHandle::new", "kind": "function_item", "signature": "pub fn new(policy: P) -> Self;", "docs": "Wrap any [`SkillsPolicy`] implementation.", "attributes": "", "line": 97 }, { "name": "skills::SkillsPolicyHandle::from_arc", "kind": "function_item", "signature": "pub fn from_arc(policy: Arc) -> Self;", "docs": "Wrap an already-`Arc`'d policy (useful when sharing one policy across\nmany `OpenAgent` instances).", "attributes": "", "line": 105 }, { "name": "skills::SkillsPolicyHandle::can_invoke", "kind": "function_item", "signature": "pub fn can_invoke(&self, skill: &str) -> Result<()>;", "docs": "Return `Ok(())` if the named skill may be invoked, otherwise an error.", "attributes": "", "line": 110 }, { "name": "skills::SkillsPolicyHandle::allowed_skills", "kind": "function_item", "signature": "pub fn allowed_skills(&self) -> BTreeSet;", "docs": "All skills currently allowed by the wrapped policy.", "attributes": "", "line": 115 } ], "parseErrors": false }, { "module": "verification", "source": "openagent-sdk/sdks/rust/src/verification.rs", "sha256": "9244631fd8211d5e12d74a0e176f213441496c235ec2f2aee5d8900f20b58f7b", "attributes": "#[cfg(feature = \"aegis\")]", "items": [ { "name": "verification::Verifier", "kind": "struct_item", "signature": "pub struct Verifier {\n\n}", "docs": "Wraps an AEGIS client.\n\nThe verifier owns its `AegisClient` (cheap-clone via `Arc` internally) and\nis meant to be shared across an entire process. Construction is async-free\nbecause AEGIS uses lazy in-memory stores by default.", "attributes": "#[cfg(feature = \"aegis\")]\n#[derive(Clone)]", "line": 29 }, { "name": "verification::Verifier::new", "kind": "function_item", "signature": "pub fn new(registry: Arc) -> Self;", "docs": "Build a verifier with the supplied plugin registry and AEGIS defaults.", "attributes": "#[cfg(feature = \"aegis\")]", "line": 35 }, { "name": "verification::Verifier::from_client", "kind": "function_item", "signature": "pub fn from_client(client: AegisClient) -> Self;", "docs": "Wrap an existing [`AegisClient`].\n\nUse this when you've configured AEGIS with custom storage backends\n(e.g., PostgreSQL) or a non-default policy engine.", "attributes": "#[cfg(feature = \"aegis\")]", "line": 45 }, { "name": "verification::Verifier::inner", "kind": "function_item", "signature": "pub fn inner(&self) -> &AegisClient;", "docs": "Reference to the wrapped AEGIS client for advanced use.", "attributes": "#[cfg(feature = \"aegis\")]", "line": 52 }, { "name": "verification::Verifier::verify", "kind": "function_item", "signature": "pub async fn verify(&self, did: &str) -> Result;", "docs": "Verify a DID end-to-end and return a [`VerifiedContext`].\n\nRuns the full AEGIS verification pipeline: DID resolution, signature\ncheck, lineage walk back to a human root, revocation check, and\nliveness probe (subject to the configured TTL cache).\n\n# Errors\n\nReturns [`OpenAgentError::Verification`] if any pipeline stage fails.", "attributes": "#[cfg(feature = \"aegis\")]", "line": 65 }, { "name": "verification::Verifier::authenticate", "kind": "function_item", "signature": "pub async fn authenticate(\n &self,\n credential: &AuthCredential,\n identity_type: IdentityType,\n ) -> Result;", "docs": "Authenticate a credential and return the resulting AEGIS session ID.\n\n`identity_type` is `Human` for OAuth/Passkey/etc. and `Agent` for\nmachine-to-machine flows. The two get different session lifetimes.\n\n# Errors\n\nReturns [`OpenAgentError::Authentication`] if no provider accepts the\ncredential.", "attributes": "#[cfg(feature = \"aegis\")]", "line": 83 }, { "name": "verification::Verifier::authorize", "kind": "function_item", "signature": "pub async fn authorize(&self, request: &PolicyRequest) -> Result;", "docs": "Evaluate an authorization request against the registered policy engine.\n\n# Errors\n\nReturns [`OpenAgentError::Authorization`] if the policy engine errors\n(a *deny* decision is **not** an error \u2014 inspect [`PolicyDecision`]).", "attributes": "#[cfg(feature = \"aegis\")]", "line": 98 }, { "name": "verification::LineageAuthorityContext", "kind": "struct_item", "signature": "pub struct LineageAuthorityContext {\n/// DID whose privileged authority was verified.\n\npub subject: String,\n/// Backend/source identifier, normally `sigil_gal`.\n\npub source: String,\n/// Finalized root DID for the verified path.\n\npub root: String,\n/// Reconstructed finalized path, ordered root to caller.\n\npub path: Vec,\n/// Sigil block height at which this authority was finalized.\n\npub finalized_block: u64,\n/// Authority path kind, e.g. `human_to_agent`.\n\npub path_kind: String,\n/// Scopes proven by this lineage path.\n\npub scopes: Vec,\n/// Generation/depth from root to subject.\n\npub generation: u32,\n/// Accepted root kind for this authority path.\n\npub root_kind: Option,\n/// Optional org lineage root commitment for org-scoped authority.\n\npub org_root_commitment: Option,\n/// Optional expiry timestamp for the authority edge/path.\n\npub expires_at: Option\n}", "docs": "Sigil-backed lineage authority attached by an OAS verifier.", "attributes": "#[cfg(feature = \"aegis\")]\n#[derive(Debug, Clone, PartialEq, Eq)]", "line": 105 }, { "name": "verification::authority_context_from_oas", "kind": "function_item", "signature": "pub fn authority_context_from_oas(\n document: &OasDocument,\n provider: &dyn DocumentProvider,\n config: &VerifyConfig,\n authority_source: &dyn LineageAuthoritySource,\n path_kind: AuthorityPathKind,\n required_scopes: &[String],\n min_finalized_block: Option,\n) -> Result;", "docs": "Convert an OAS privileged-authority verification into OpenAgent runtime\nauth context.\n\nThis is the OpenAgent-side bridge for sensitive operations: callers provide\nan OAS document resolver and an authority source adapter, and OpenAgent\nreceives a normalized context it can attach to ACT/request verification.", "attributes": "#[cfg(feature = \"aegis\")]", "line": 136 }, { "name": "verification::VerifiedContext", "kind": "struct_item", "signature": "pub struct VerifiedContext {\n/// The DID that was verified.\n\npub did: String,\n/// The raw AEGIS verification result (lineage chain, expiry, etc.).\n\npub result: VerificationResult,\n/// OAS + Sigil authority proof required for privileged access.\n\npub lineage_authority: Option\n}", "docs": "`VerifiedContext` is what callers get back from\n[`crate::OpenAgent::authenticate`]. It bundles the DID that was verified,\nthe raw AEGIS [`VerificationResult`] for advanced use, and optional\nSigil-backed lineage authority for privileged actions.", "attributes": "#[cfg(feature = \"aegis\")]\n#[derive(Debug, Clone)]", "line": 183 }, { "name": "verification::VerifiedContext::is_valid", "kind": "function_item", "signature": "pub fn is_valid(&self) -> bool;", "docs": "True if the verification considered the DID valid.\n\nCombines signature, lineage, revocation, and liveness into a single\nboolean. Use [`Self::result`] for the breakdown.", "attributes": "#[cfg(feature = \"aegis\")]", "line": 197 }, { "name": "verification::VerifiedContext::require_privileged_authority", "kind": "function_item", "signature": "pub fn require_privileged_authority(&self) -> Result<&LineageAuthorityContext>;", "docs": "Return the attached Sigil-backed authority or fail closed.", "attributes": "#[cfg(feature = \"aegis\")]", "line": 209 } ], "parseErrors": false } ] }, { "name": "openagent-capability", "url": "/reference/rust/openagent-capability", "modules": [ { "module": "crate", "source": "openagents/openagent.id/crates/openagent-capability/src/lib.rs", "sha256": "b24b099555e8f3131cecb5682e0bfe244cce4064305779bd6f0dadf79d2efebd", "attributes": "", "items": [ { "name": "pub use agent_capability_token::{\n claims_to_signing_payload, envelope_from_parts, verify, ActClaims, ActEnvelope, ActError,\n ActResult, Confirmation, Delegation, PublicKeyBytes, Scope, Verifier, ALGORITHM_ED25519,\n FORMAT_VERSION, MAX_ACT_BYTES, SCOPE_SEGMENTS, WILDCARD,\n};", "kind": "use_declaration", "signature": "pub use agent_capability_token::{\n claims_to_signing_payload, envelope_from_parts, verify, ActClaims, ActEnvelope, ActError,\n ActResult, Confirmation, Delegation, PublicKeyBytes, Scope, Verifier, ALGORITHM_ED25519,\n FORMAT_VERSION, MAX_ACT_BYTES, SCOPE_SEGMENTS, WILDCARD,\n};", "docs": "", "attributes": "", "line": 43 }, { "name": "pub use agent_capability_token::sign;", "kind": "use_declaration", "signature": "pub use agent_capability_token::sign;", "docs": "", "attributes": "#[cfg(feature = \"sign\")]", "line": 50 }, { "name": "::require_scopes", "kind": "function_item", "signature": "pub fn require_scopes(claims: &ActClaims, required: &[Scope]) -> ActResult<()>;", "docs": "Asserts that `claims` grants every scope in `required`.\n\nConvenience over [`Scope::covers`], kept because scope presence checks are\nthe most common thing a verifier does after [`verify`] and the spelling is\neasy to get wrong: wildcards expand in a grant and are literal in a request,\nso a holder must not be able to widen its own authority by requesting `*`.\n\n# Errors\n\nReturns [`ActError::MissingScope`] with the first required scope the token\ndoes not cover.", "attributes": "", "line": 63 } ], "parseErrors": false } ] }, { "name": "openagent-client", "url": "/reference/rust/openagent-client", "modules": [ { "module": "crate", "source": "openagents/openagent.id/crates/openagent-client/src/lib.rs", "sha256": "23b524b4bb88ff2889460df8f132972d7e3b707a7f3af5891a1f6d26c69240f4", "attributes": "", "items": [ { "name": "error", "kind": "module", "signature": "pub mod error;", "docs": "", "attributes": "", "line": 14 }, { "name": "::OpenAgentClient", "kind": "struct_item", "signature": "pub struct OpenAgentClient {\n\n}", "docs": "An OpenAgent client that handles the challenge-response flow transparently.\n\nWraps an Ed25519 signing key. On each `fetch`, if the server returns 401,\nthe client automatically signs the challenge and retries.\n\nSession tokens are cached and reused until they expire.", "attributes": "", "line": 30 }, { "name": "::AuthenticatedResponse", "kind": "struct_item", "signature": "pub struct AuthenticatedResponse {\npub status: u16,\npub did: Option,\npub trust_tier: Option,\npub session_token: Option,\n/// Legacy lineage response metadata retained only for migration and audit.\n\n///\n\n/// This value is never an authorization grant.\n\npub legacy_lineage_evidence: Option,\npub body: Vec,\npub headers: reqwest::header::HeaderMap\n}", "docs": "Response from a successful OpenAgent-authenticated request.", "attributes": "#[derive(Debug)]", "line": 43 }, { "name": "::OpenAgentClient::new", "kind": "function_item", "signature": "pub fn new(secret_key: &[u8; 32]) -> Self;", "docs": "Creates a new client from a 32-byte Ed25519 secret key.", "attributes": "", "line": 70 }, { "name": "::OpenAgentClient::public_key_bytes", "kind": "function_item", "signature": "pub fn public_key_bytes(&self) -> [u8; 32];", "docs": "Returns the Ed25519 public key as bytes.", "attributes": "", "line": 79 }, { "name": "::OpenAgentClient::fetch", "kind": "function_item", "signature": "pub async fn fetch(\n &self,\n url: &str,\n body: Option<&[u8]>,\n ) -> Result;", "docs": "Sends an authenticated request to the given URL.\n\nThe full flow:\n1. If a cached session token exists for this origin, try Bearer auth\n2. If no session or session is rejected (401), do challenge-response\n3. Cache the new session token\n4. Return the final response", "attributes": "", "line": 90 } ], "parseErrors": false }, { "module": "error", "source": "openagents/openagent.id/crates/openagent-client/src/error.rs", "sha256": "765b122c694fce1392af3c172bd77dfa289e9873ac48ecff105e0a2ab3f5a054", "attributes": "", "items": [ { "name": "error::ClientError", "kind": "enum_item", "signature": "pub enum ClientError {\n #[error(\"invalid URL: {0}\")]\n InvalidUrl(String),\n\n #[error(\"HTTP request failed: {0}\")]\n Http(reqwest::Error),\n\n #[error(\"server returned 401 but no WWW-Authenticate header with OpenAgent challenge\")]\n NoChallengeHeader,\n\n #[error(\"malformed challenge: {0}\")]\n MalformedChallenge(String),\n\n #[error(\"server rejected the signed challenge\")]\n AuthenticationRejected,\n}", "docs": "Errors from the OpenAgent client.", "attributes": "#[derive(Debug, thiserror::Error)]", "line": 5 } ], "parseErrors": false } ] }, { "name": "openagent-server", "url": "/reference/rust/openagent-server", "modules": [ { "module": "crate", "source": "openagents/openagent.id/crates/openagent-server/src/lib.rs", "sha256": "c43f987d28dca0c03c3934d60c2f9f82ce7cc8a39cd25885a4e8ecd524ebbadc", "attributes": "", "items": [ { "name": "authority", "kind": "module", "signature": "pub mod authority;", "docs": "", "attributes": "", "line": 25 }, { "name": "challenge", "kind": "module", "signature": "pub mod challenge;", "docs": "", "attributes": "", "line": 26 }, { "name": "config", "kind": "module", "signature": "pub mod config;", "docs": "", "attributes": "", "line": 27 }, { "name": "did_key", "kind": "module", "signature": "pub mod did_key;", "docs": "", "attributes": "", "line": 28 }, { "name": "error", "kind": "module", "signature": "pub mod error;", "docs": "", "attributes": "", "line": 29 }, { "name": "l1feid_client", "kind": "module", "signature": "pub mod l1feid_client;", "docs": "", "attributes": "", "line": 30 }, { "name": "layer", "kind": "module", "signature": "pub mod layer;", "docs": "", "attributes": "", "line": 31 }, { "name": "session", "kind": "module", "signature": "pub mod session;", "docs": "", "attributes": "", "line": 32 }, { "name": "verify", "kind": "module", "signature": "pub mod verify;", "docs": "", "attributes": "", "line": 33 }, { "name": "pub use authority::{\n require_authoritative_lineage, AuthorityError, LegacyLineageEvidence, MissingAuthorityVerifier,\n PrivilegedAuthorityRequest, PrivilegedAuthorityVerifier,\n};", "kind": "use_declaration", "signature": "pub use authority::{\n require_authoritative_lineage, AuthorityError, LegacyLineageEvidence, MissingAuthorityVerifier,\n PrivilegedAuthorityRequest, PrivilegedAuthorityVerifier,\n};", "docs": "", "attributes": "", "line": 35 }, { "name": "pub use config::OpenAgentConfig;", "kind": "use_declaration", "signature": "pub use config::OpenAgentConfig;", "docs": "", "attributes": "", "line": 39 }, { "name": "pub use l1feid_client::L1feIdClient;", "kind": "use_declaration", "signature": "pub use l1feid_client::L1feIdClient;", "docs": "", "attributes": "", "line": 40 }, { "name": "pub use layer::OpenAgentLayer;", "kind": "use_declaration", "signature": "pub use layer::OpenAgentLayer;", "docs": "", "attributes": "", "line": 41 } ], "parseErrors": false }, { "module": "authority", "source": "openagents/openagent.id/crates/openagent-server/src/authority.rs", "sha256": "3c9c321ec47adf7eb3bc86427418bc9f67fca6ebf5f141fc75e6df5232e4cec3", "attributes": "", "items": [ { "name": "authority::LegacyLineageEvidence", "kind": "struct_item", "signature": "pub struct LegacyLineageEvidence {\n/// DID named as the subject by the legacy evidence.\n\npub subject: String,\n/// Root DID reported by the legacy evidence.\n\npub root: String,\n/// Reported path kind, e.g. `human_to_agent`.\n\npub path_kind: String,\n/// Parser/source identifier.\n\npub source: String,\n/// Reconstructed informational path, ordered root to subject.\n\npub path: Vec,\n/// Finalized block reported by the source.\n\npub finalized_block: u64,\n/// Scopes reported by the legacy evidence; never authorization grants.\n\npub scopes: Vec,\n/// Reported generation/depth from root to subject.\n\npub generation: u32,\n/// Reported root kind.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub root_kind: Option,\n/// Optional org lineage root commitment.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub org_root_commitment: Option,\n/// Optional expiry timestamp for the authority edge/path.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub expires_at: Option\n}", "docs": "Parsed legacy lineage retained strictly as migration/audit evidence.\n\nThis type deliberately does not use an authority-oriented name. There is no\nauthoritative lineage result type in the containment release; adding one\nrequires a separately reviewed hardened verifier integration.", "attributes": "#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]", "line": 16 }, { "name": "authority::PrivilegedAuthorityRequest", "kind": "struct_item", "signature": "pub struct PrivilegedAuthorityRequest {\npub subject_did: String,\npub required_path_kind: Option,\npub required_scopes: Vec,\npub min_finalized_block: Option\n}", "docs": "Request passed to a deployment-provided privileged authority verifier.", "attributes": "#[derive(Debug, Clone, PartialEq, Eq)]", "line": 46 }, { "name": "authority::PrivilegedAuthorityVerifier", "kind": "trait_item", "signature": "pub trait PrivilegedAuthorityVerifier: Send + Sync {\n async fn verify(\n &self,\n request: PrivilegedAuthorityRequest,\n ) -> Result;\n}", "docs": "Adapter trait for parsing legacy OAS/Sigil lineage evidence.\n\nThe output is intentionally [`LegacyLineageEvidence`], so an adapter cannot\npresent the legacy profile as authoritative at compile time.", "attributes": "#[async_trait]", "line": 58 }, { "name": "authority::MissingAuthorityVerifier", "kind": "struct_item", "signature": "pub struct MissingAuthorityVerifier;", "docs": "Authority verifier used when no OAS/Sigil adapter is installed.", "attributes": "", "line": 66 }, { "name": "authority::AuthorityError", "kind": "enum_item", "signature": "pub enum AuthorityError {\n #[error(\"legacy lineage evidence is informational and cannot authorize\")]\n LegacyLineageNotAuthoritative,\n #[error(\"authoritative lineage verification is unavailable\")]\n LineageVerificationUnavailable,\n #[error(\"privileged lineage authority is malformed: {0}\")]\n Malformed(String),\n #[error(\"privileged lineage authority was rejected: {0}\")]\n Rejected(String),\n}", "docs": "", "attributes": "#[derive(Debug, thiserror::Error)]", "line": 79 }, { "name": "authority::require_authoritative_lineage", "kind": "function_item", "signature": "pub fn require_authoritative_lineage(\n _subject_did: &str,\n _evidence: &LegacyLineageEvidence,\n _required_path_kind: Option<&str>,\n _required_scopes: &[String],\n) -> Result;", "docs": "Rejects legacy lineage at a privileged authorization boundary.\n\nThe arguments that formerly shaped structural acceptance remain on the API\nduring migration so callers cannot accidentally remove an authorization\ngate. They are intentionally not consulted: no legacy field combination can\nsatisfy the privilege predicate.", "attributes": "", "line": 96 } ], "parseErrors": false }, { "module": "challenge", "source": "openagents/openagent.id/crates/openagent-server/src/challenge.rs", "sha256": "2920c158061f341875b5b18dc7b452400506dc614b4bfda7f3e03c88ab021dd0", "attributes": "", "items": [ { "name": "challenge::Challenge", "kind": "struct_item", "signature": "pub struct Challenge {\n#[serde(rename = \"type\")]\npub challenge_type: String,\npub nonce: String,\npub timestamp: String,\npub origin: String,\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub realm: Option\n}", "docs": "A challenge issued to an unauthenticated agent.\n\nPer OPENAGENT-CORE-SPEC.md \u00a74, the challenge is a JSON object with:\n- `type`: always \"openagent-challenge-v1\"\n- `nonce`: 32-byte hex string\n- `timestamp`: ISO 8601 UTC\n- `origin`: server origin\n- `realm`: optional realm string", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 22 }, { "name": "challenge::Challenge::new", "kind": "function_item", "signature": "pub fn new(origin: &str, realm: Option<&str>) -> Self;", "docs": "Creates a new challenge with a cryptographically random nonce.", "attributes": "", "line": 34 }, { "name": "challenge::Challenge::to_jcs_bytes", "kind": "function_item", "signature": "pub fn to_jcs_bytes(&self) -> Result, serde_json::Error>;", "docs": "Serializes this challenge using JCS (RFC 8785) for deterministic signing.", "attributes": "", "line": 50 }, { "name": "challenge::Challenge::to_base64url", "kind": "function_item", "signature": "pub fn to_base64url(&self) -> Result;", "docs": "Encodes the challenge as base64url for the WWW-Authenticate header.", "attributes": "", "line": 57 }, { "name": "challenge::hex::encode", "kind": "function_item", "signature": "pub fn encode(bytes: &[u8]) -> String;", "docs": "", "attributes": "", "line": 65 }, { "name": "challenge::NonceStore", "kind": "struct_item", "signature": "pub struct NonceStore {\n\n}", "docs": "Thread-safe nonce store with TTL-based expiration.\n\nPer OPENAGENT-CORE-SPEC.md \u00a77:\n- Nonces are single-use (consumed atomically on verification)\n- Nonces expire after a configurable TTL (default 30 seconds)\n- Expired nonces are lazily cleaned up", "attributes": "", "line": 86 }, { "name": "challenge::NonceStore::new", "kind": "function_item", "signature": "pub fn new(ttl: Duration) -> Self;", "docs": "", "attributes": "", "line": 92 }, { "name": "challenge::NonceStore::issue", "kind": "function_item", "signature": "pub fn issue(&self, origin: &str, realm: Option<&str>) -> Challenge;", "docs": "Issues a new challenge and stores its nonce.", "attributes": "", "line": 100 }, { "name": "challenge::NonceStore::consume", "kind": "function_item", "signature": "pub fn consume(&self, nonce: &str) -> Option;", "docs": "Consumes a nonce atomically, returning the original challenge if valid.\n\nReturns `None` if the nonce is unknown, already consumed, or expired.", "attributes": "", "line": 119 } ], "parseErrors": false }, { "module": "config", "source": "openagents/openagent.id/crates/openagent-server/src/config.rs", "sha256": "f3287273cd30315d8e25093d429ce61c9652b3de24c912e28e60537d18be424c", "attributes": "", "items": [ { "name": "config::OpenAgentConfig", "kind": "struct_item", "signature": "pub struct OpenAgentConfig {\n/// Server origin for challenge generation (e.g., \"https://api.example.com\").\n\npub origin: String,\n/// Optional realm for challenge generation.\n\npub realm: Option,\n/// Challenge nonce TTL. Default: 30 seconds.\n\npub nonce_ttl: Duration,\n/// Session token TTL in seconds. Default: 900 (15 minutes).\n\npub session_ttl_secs: i64,\n/// HMAC secret for signing session JWTs. Must be at least 32 bytes.\n\npub session_secret: Vec,\n/// Minimum trust tier required for this service. Default: 0 (Anonymous).\n\npub min_trust_tier: u8,\n/// Require privileged lineage authority for this service.\n\n///\n\n/// During containment this is a deny-only gate because no hardened lineage\n\n/// verifier result type is available.\n\npub require_privileged_authority: bool,\n/// Required authority path kind when privileged authority is required.\n\npub required_authority_path: Option,\n/// Scopes that must be present in the privileged authority context.\n\npub required_authority_scopes: Vec,\n/// Optional minimum finalized block for accepted authority context.\n\npub min_authority_finalized_block: Option\n}", "docs": "Configuration for the OpenAgent server middleware.", "attributes": "#[derive(Debug, Clone)]", "line": 9 }, { "name": "config::OpenAgentConfig::new", "kind": "function_item", "signature": "pub fn new(origin: impl Into, session_secret: impl Into>) -> Self;", "docs": "Creates a new config with the given origin and session secret.\n\nAll other fields use protocol defaults.", "attributes": "", "line": 48 }, { "name": "config::OpenAgentConfig::with_realm", "kind": "function_item", "signature": "pub fn with_realm(mut self, realm: impl Into) -> Self;", "docs": "Sets the optional realm.", "attributes": "", "line": 64 }, { "name": "config::OpenAgentConfig::with_min_trust_tier", "kind": "function_item", "signature": "pub fn with_min_trust_tier(mut self, tier: u8) -> Self;", "docs": "Sets the minimum trust tier.", "attributes": "", "line": 70 }, { "name": "config::OpenAgentConfig::with_nonce_ttl", "kind": "function_item", "signature": "pub fn with_nonce_ttl(mut self, ttl: Duration) -> Self;", "docs": "Sets the nonce TTL.", "attributes": "", "line": 76 }, { "name": "config::OpenAgentConfig::with_session_ttl_secs", "kind": "function_item", "signature": "pub fn with_session_ttl_secs(mut self, secs: i64) -> Self;", "docs": "Sets the session token TTL.", "attributes": "", "line": 82 }, { "name": "config::OpenAgentConfig::with_privileged_authority", "kind": "function_item", "signature": "pub fn with_privileged_authority(mut self, path_kind: impl Into) -> Self;", "docs": "Enables the deny-only privileged-lineage gate and pins the path kind.\n\nThis method cannot restore legacy authorization. Requests remain denied\nuntil a separately reviewed hardened verifier API is introduced.", "attributes": "", "line": 91 }, { "name": "config::OpenAgentConfig::with_required_authority_scopes", "kind": "function_item", "signature": "pub fn with_required_authority_scopes(mut self, scopes: Vec) -> Self;", "docs": "Adds scopes that the privileged authority context must prove.", "attributes": "", "line": 98 }, { "name": "config::OpenAgentConfig::with_min_authority_finalized_block", "kind": "function_item", "signature": "pub fn with_min_authority_finalized_block(mut self, block: u64) -> Self;", "docs": "Sets the minimum finalized authority block.", "attributes": "", "line": 104 } ], "parseErrors": false }, { "module": "did_key", "source": "openagents/openagent.id/crates/openagent-server/src/did_key.rs", "sha256": "af3d85cbe793c1528189111ecc157ee9f82bc378c3f446f9246a3baac5de7e62", "attributes": "", "items": [ { "name": "did_key::did_key_from_ed25519", "kind": "function_item", "signature": "pub fn did_key_from_ed25519(pubkey: &[u8; 32]) -> String;", "docs": "Derives a `did:key` string from a raw 32-byte Ed25519 public key.\n\nPer the did:key method specification:\n1. Prepend the Ed25519 multicodec prefix (0xed01)\n2. Encode with base58btc (multibase prefix 'z')\n3. Result: `did:key:z`\n\n# Arguments\n\n* `pubkey` - 32-byte Ed25519 public key\n\n# Returns\n\nThe `did:key:z...` string.", "attributes": "", "line": 28 }, { "name": "did_key::ed25519_from_did_key", "kind": "function_item", "signature": "pub fn ed25519_from_did_key(did: &str) -> Result<[u8; 32], DidKeyError>;", "docs": "Extracts the raw 32-byte Ed25519 public key from a `did:key` string.\n\n# Errors\n\nReturns an error if the DID is not a valid `did:key` with Ed25519 multicodec prefix.", "attributes": "", "line": 41 }, { "name": "did_key::parse_pubkey_base64url", "kind": "function_item", "signature": "pub fn parse_pubkey_base64url(encoded: &str) -> Result<[u8; 32], DidKeyError>;", "docs": "Parses a public key from the base64url-encoded segment of an Authorization header.", "attributes": "", "line": 69 }, { "name": "did_key::DidKeyError", "kind": "enum_item", "signature": "pub enum DidKeyError {\n #[error(\"did:key must start with 'did:key:z'\")]\n InvalidPrefix,\n\n #[error(\"invalid base58 encoding in did:key\")]\n InvalidBase58,\n\n #[error(\"invalid base64url encoding\")]\n InvalidBase64,\n\n #[error(\"decoded key length {actual} does not match expected {expected}\")]\n InvalidLength { expected: usize, actual: usize },\n\n #[error(\"unsupported multicodec prefix {found}; expected 0xed01 (Ed25519)\")]\n UnsupportedCodec { found: String },\n}", "docs": "Errors from did:key operations.", "attributes": "#[derive(Debug, thiserror::Error)]", "line": 88 } ], "parseErrors": false }, { "module": "error", "source": "openagents/openagent.id/crates/openagent-server/src/error.rs", "sha256": "b02b125967dab737185e3e4f93279af42dab8cd530ffccc054abefd129a798d5", "attributes": "", "items": [ { "name": "error::ErrorCode", "kind": "enum_item", "signature": "pub enum ErrorCode {\n /// No Authorization header and no valid session token.\n AuthenticationRequired,\n /// Challenge nonce has expired (older than TTL window).\n ChallengeExpired,\n /// Signature verification failed against the challenge bytes.\n InvalidSignature,\n /// The key type in X-OpenAgent-Key-Type is not supported.\n UnsupportedKeyType,\n /// The nonce was already consumed or is not recognized.\n NonceUnknown,\n /// The agent's trust tier is below the route's minimum.\n TrustInsufficient,\n /// Legacy lineage evidence reached a privileged authorization boundary.\n LegacyLineageNotAuthoritative,\n /// No authoritative lineage verifier result is available.\n LineageVerificationUnavailable,\n /// Rate limit exceeded for this agent's trust tier.\n RateLimited,\n /// The Authorization header is present but malformed.\n MalformedRequest,\n /// Session token is expired or invalid.\n SessionExpired,\n /// Internal server error during verification.\n InternalError,\n}", "docs": "Error codes defined by the OpenAgent protocol.", "attributes": "#[derive(Debug, Clone, Copy, Serialize)]\n#[serde(rename_all = \"snake_case\")]", "line": 12 }, { "name": "error::OpenAgentError", "kind": "struct_item", "signature": "pub struct OpenAgentError {\npub error: ErrorCode,\npub message: String,\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub details: Option,\npub request_id: String\n}", "docs": "Structured error response per OPENAGENT-CORE-SPEC.md \u00a713.", "attributes": "#[derive(Debug, Serialize)]", "line": 60 }, { "name": "error::OpenAgentError::new", "kind": "function_item", "signature": "pub fn new(code: ErrorCode, message: impl Into, request_id: impl Into) -> Self;", "docs": "", "attributes": "", "line": 69 } ], "parseErrors": false }, { "module": "l1feid_client", "source": "openagents/openagent.id/crates/openagent-server/src/l1feid_client.rs", "sha256": "d2a9626be9a57125eed115e7d03ffe2fa00f4b20d21d14ebf7b73f57f39b4578", "attributes": "", "items": [ { "name": "l1feid_client::L1feIdProvisionResponse", "kind": "struct_item", "signature": "pub struct L1feIdProvisionResponse {\n/// The stable platform UUID for this agent.\n\npub l1fe_id: String,\n/// Trust tier from the platform record (0-4).\n\npub trust_tier: u8,\n/// True when a new record was created (HTTP 201), false when an existing\n\n/// record was returned (HTTP 200).\n\npub is_new: bool\n}", "docs": "Response returned by `L1feIdClient::provision`.", "attributes": "#[derive(Debug, Clone, Serialize, Deserialize)]", "line": 16 }, { "name": "l1feid_client::L1feIdError", "kind": "enum_item", "signature": "pub enum L1feIdError {\n #[error(\"L1feID service request failed: {0}\")]\n Transport(String),\n\n #[error(\"L1feID service returned unexpected status {status}: {body}\")]\n UnexpectedStatus { status: u16, body: String },\n\n #[error(\"failed to deserialize L1feID response: {0}\")]\n Deserialize(String),\n}", "docs": "Errors that can occur when calling L1feID.", "attributes": "#[derive(Debug, thiserror::Error)]", "line": 28 }, { "name": "l1feid_client::L1feIdClient", "kind": "struct_item", "signature": "pub struct L1feIdClient {\n\n}", "docs": "HTTP client for the L1feID provisioning endpoint.\n\nThe base URL is resolved from the first set of these env vars (see\n[`L1feIdClient::from_env`]):\n- `LIFEID_SERVICE_URL` (canonical code-side name)\n- `L1FEID_API_URL` (deployment/ops contract used by k8s secrets)\n- `L1FEID_SERVICE_URL` (alternate spelling)\n\nIf none are set, the in-cluster default\n(`http://l1feid.l1feid.svc.cluster.local:8090`) is used.", "attributes": "#[derive(Debug, Clone)]", "line": 50 }, { "name": "l1feid_client::L1feIdClient::new", "kind": "function_item", "signature": "pub fn new(base_url: String) -> Self;", "docs": "Creates a new client targeting `base_url`.\n\nThe URL should NOT include a trailing slash.", "attributes": "", "line": 75 }, { "name": "l1feid_client::L1feIdClient::from_env", "kind": "function_item", "signature": "pub fn from_env() -> Self;", "docs": "Creates a client using the L1feID base URL from the environment.\n\nResolution order (first non-empty wins):\n1. `LIFEID_SERVICE_URL`\n2. `L1FEID_API_URL` \u2014 ops/k8s secret key (must match deploys)\n3. `L1FEID_SERVICE_URL`\n4. in-cluster default `http://l1feid.l1feid.svc.cluster.local:8090`\n\nAccepting both `LIFEID_SERVICE_URL` and `L1FEID_API_URL` closes the\nhistorical mismatch where manifests injected `L1FEID_API_URL` while\nthe binary only read `LIFEID_SERVICE_URL`.", "attributes": "", "line": 94 }, { "name": "l1feid_client::L1feIdClient::base_url", "kind": "function_item", "signature": "pub fn base_url(&self) -> &str;", "docs": "Returns the configured base URL (no trailing slash expected).", "attributes": "#[must_use]", "line": 102 }, { "name": "l1feid_client::L1feIdClient::provision", "kind": "function_item", "signature": "pub async fn provision(\n &self,\n did: &str,\n initial_trust_tier: u8,\n ) -> Result;", "docs": "Auto-provisions a platform identity record for `did`.\n\nThis is idempotent: calling provision for a DID that already has a record\nreturns the existing `l1fe_id` without modification.\n\n`initial_trust_tier` is only used during first-time creation.", "attributes": "", "line": 112 } ], "parseErrors": false }, { "module": "layer", "source": "openagents/openagent.id/crates/openagent-server/src/layer.rs", "sha256": "d3ed7de38e820ff9f645b974e5fb314d02837d9b4b7c79ffd1e6f1e9851dc0d3", "attributes": "", "items": [ { "name": "layer::OpenAgentState", "kind": "struct_item", "signature": "pub struct OpenAgentState {\npub config: OpenAgentConfig,\npub nonce_store: NonceStore,\npub l1feid_client: L1feIdClient,\npub authority_verifier: Arc\n}", "docs": "Shared state for the OpenAgent middleware.", "attributes": "", "line": 30 }, { "name": "layer::OpenAgentLayer", "kind": "struct_item", "signature": "pub struct OpenAgentLayer {\n\n}", "docs": "The Axum middleware layer.\n\nAttach to a router:\n```rust,ignore\nuse openagent_server::{OpenAgentConfig, OpenAgentLayer};\n\nlet config = OpenAgentConfig::new(\"https://api.example.com\", b\"my-secret-key-32-bytes-minimum!!\");\nlet app = Router::new()\n .route(\"/api/data\", get(handler))\n .layer(OpenAgentLayer::new(config));\n```", "attributes": "#[derive(Clone)]", "line": 49 }, { "name": "layer::OpenAgentLayer::new", "kind": "function_item", "signature": "pub fn new(config: OpenAgentConfig) -> Self;", "docs": "Creates a new layer with the L1feID client resolved via\n[`crate::l1feid_client::L1feIdClient::from_env`]\n(`LIFEID_SERVICE_URL` / `L1FEID_API_URL` contract).", "attributes": "", "line": 57 }, { "name": "layer::OpenAgentLayer::with_l1feid_client", "kind": "function_item", "signature": "pub fn with_l1feid_client(config: OpenAgentConfig, l1feid_client: L1feIdClient) -> Self;", "docs": "Creates a new layer with an explicit L1feID client (useful for testing).", "attributes": "", "line": 71 }, { "name": "layer::OpenAgentLayer::with_authority_verifier", "kind": "function_item", "signature": "pub fn with_authority_verifier(\n config: OpenAgentConfig,\n authority_verifier: Arc,\n ) -> Self;", "docs": "Creates a new layer with an explicit privileged authority verifier.", "attributes": "", "line": 84 }, { "name": "layer::OpenAgentLayer::with_l1feid_and_authority_verifier", "kind": "function_item", "signature": "pub fn with_l1feid_and_authority_verifier(\n config: OpenAgentConfig,\n l1feid_client: L1feIdClient,\n authority_verifier: Arc,\n ) -> Self;", "docs": "Creates a new layer with explicit L1feID and privileged authority clients.", "attributes": "", "line": 101 }, { "name": "layer::OpenAgentMiddleware", "kind": "struct_item", "signature": "pub struct OpenAgentMiddleware {\n\n}", "docs": "The middleware service that wraps the inner handler.", "attributes": "#[derive(Clone)]", "line": 131 } ], "parseErrors": false }, { "module": "session", "source": "openagents/openagent.id/crates/openagent-server/src/session.rs", "sha256": "9984fa2b50874326503665e883533b1999c40f51f154775fcd571f668069c348", "attributes": "", "items": [ { "name": "session::SessionClaims", "kind": "struct_item", "signature": "pub struct SessionClaims {\npub sub: String,\npub iss: String,\npub iat: i64,\npub exp: i64,\npub nonce: String,\npub trust_tier: u8,\n/// L1feID platform identifier. Absent when the L1feID service was\n\n/// unreachable during the initial provisioning call.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub l1fe_id: Option,\n/// Legacy lineage evidence. Informational only; never forwarded as authority.\n\n#[serde(skip_serializing_if = \"Option::is_none\")]\npub lineage_authority: Option\n}", "docs": "JWT claims for an OpenAgent session token.\n\nPer OPENAGENT-CORE-SPEC.md \u00a712:\n- `sub`: the agent's DID (did:key or did:oas)\n- `iss`: the server origin\n- `iat`: issued-at timestamp (Unix seconds)\n- `exp`: expiration timestamp (Unix seconds)\n- `nonce`: the challenge nonce that was consumed\n- `trust_tier`: the agent's trust tier (0-4)\n- `l1fe_id`: the agent's L1feID platform UUID (None if L1feID was unreachable)\n- `lineage_authority`: optional legacy lineage evidence retained for migration", "attributes": "#[derive(Debug, Serialize, Deserialize)]", "line": 25 }, { "name": "session::issue_session_token", "kind": "function_item", "signature": "pub fn issue_session_token(\n did: &str,\n origin: &str,\n nonce: &str,\n trust_tier: u8,\n l1fe_id: Option<&str>,\n lineage_authority: Option,\n ttl_secs: i64,\n secret: &[u8],\n) -> Result;", "docs": "Issues a JWT session token.\n\n# Arguments\n\n* `did` - The agent's DID\n* `origin` - The server origin (becomes `iss`)\n* `nonce` - The consumed challenge nonce\n* `trust_tier` - The agent's trust tier\n* `l1fe_id` - The agent's L1feID platform UUID (None if service unreachable)\n* `lineage_authority` - Optional informational legacy lineage evidence\n* `ttl_secs` - Token lifetime in seconds (default: 900 = 15 min)\n* `secret` - HMAC-SHA256 signing secret", "attributes": "", "line": 53 }, { "name": "session::validate_session_token", "kind": "function_item", "signature": "pub fn validate_session_token(token: &str, secret: &[u8]) -> Result;", "docs": "Validates a JWT session token and returns its claims.", "attributes": "", "line": 86 }, { "name": "session::SessionError", "kind": "enum_item", "signature": "pub enum SessionError {\n #[error(\"session token has expired\")]\n Expired,\n\n #[error(\"session token signature is invalid\")]\n InvalidSignature,\n\n #[error(\"failed to encode session token: {0}\")]\n EncodingFailed(String),\n\n #[error(\"session token validation failed: {0}\")]\n ValidationFailed(String),\n}", "docs": "", "attributes": "#[derive(Debug, thiserror::Error)]", "line": 102 } ], "parseErrors": false }, { "module": "verify", "source": "openagents/openagent.id/crates/openagent-server/src/verify.rs", "sha256": "701f627e8d8e41643d91a128e645b64af8cc52a955e2d62354d5bbe63714edcd", "attributes": "", "items": [ { "name": "verify::parse_authorization_header", "kind": "function_item", "signature": "pub fn parse_authorization_header(header_value: &str) -> Result<(Vec, [u8; 32]), VerifyError>;", "docs": "Parses the `Authorization: OpenAgent .` header.\n\nReturns (signature_bytes, public_key_bytes) on success.", "attributes": "", "line": 14 }, { "name": "verify::verify_ed25519", "kind": "function_item", "signature": "pub fn verify_ed25519(\n pubkey: &[u8; 32],\n signature_bytes: &[u8],\n challenge_jcs_bytes: &[u8],\n) -> Result<(), VerifyError>;", "docs": "Verifies an Ed25519 signature over JCS-canonicalized challenge bytes.\n\n# Arguments\n\n* `pubkey` - 32-byte Ed25519 public key\n* `signature_bytes` - 64-byte Ed25519 signature\n* `challenge_jcs_bytes` - The JCS-canonicalized challenge JSON", "attributes": "", "line": 57 }, { "name": "verify::VerifyError", "kind": "enum_item", "signature": "pub enum VerifyError {\n #[error(\"malformed Authorization header: {0}\")]\n MalformedHeader(String),\n\n #[error(\"invalid base64url encoding in {0}\")]\n InvalidBase64(&'static str),\n\n #[error(\"public key length {actual} does not match expected {expected}\")]\n InvalidKeyLength { expected: usize, actual: usize },\n\n #[error(\"signature length {actual} does not match expected {expected}\")]\n InvalidSignatureLength { expected: usize, actual: usize },\n\n #[error(\"invalid Ed25519 public key: {0}\")]\n InvalidPublicKey(String),\n\n #[error(\"Ed25519 signature verification failed\")]\n SignatureInvalid,\n}", "docs": "", "attributes": "#[derive(Debug, thiserror::Error)]", "line": 82 } ], "parseErrors": false } ] }, { "name": "openagent-standalone", "url": "/reference/rust/openagent-standalone", "modules": [] } ] }