Source: act/agent-capability-token/src/wire.rs. SHA-256: c72d2909a9791584b9c5611732b7cc6b43de3de6a3ac4002e4359870c358d24f.

This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.

wire::FORMAT_VERSION

Current ACT format version.

pub const FORMAT_VERSION: u64;

Source line: 34.

wire::ALGORITHM_ED25519

The only signature algorithm this version defines.

pub const ALGORITHM_ED25519: &str;

Source line: 37.

wire::MAX_ACT_BYTES

Maximum accepted size of an encoded ACT, in bytes.

Enforced before parsing so an oversized payload cannot drive allocation.

pub const MAX_ACT_BYTES: usize;

Source line: 42.

wire::PublicKeyBytes

A raw Ed25519 public key.

Kept as a plain array so this crate does not impose a key-handle type on callers, who typically hold a rotating set loaded from their issuer's key endpoint.

pub type PublicKeyBytes = [u8; 32];

Source line: 52.

wire::ActEnvelope

The outer envelope, as it appears on the wire.

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ActEnvelope {
/// Format version.

pub v: u64,
/// Signature algorithm identifier.

pub alg: String,
/// CBOR-encoded claims. These exact bytes are what the signature covers.

pub claims: serde_bytes::ByteBuf,
/// Raw signature over `claims`.

pub sig: serde_bytes::ByteBuf,
/// Optional key identifier, so a verifier can select a key during rotation

/// instead of trying every trusted key.

#[serde(default, skip_serializing_if = "Option::is_none")]
pub kid: Option<String>
}

Source line: 56.

wire::ActEnvelope::decode

Decodes an envelope without verifying its signature.

Useful for reading kid in order to select a verification key. The claims inside are unauthenticated until [verify] succeeds, and must not be used for any authorization decision.

Errors

Returns [ActError::TooLarge] above [MAX_ACT_BYTES], [ActError::EnvelopeDecode] for malformed CBOR, [ActError::UnsupportedVersion] or [ActError::UnsupportedAlgorithm] for a format this build does not implement.

pub fn decode(bytes: &[u8]) -> ActResult<Self>;

Source line: 84.

wire::ActEnvelope::encode

Serializes this envelope to CBOR.

Errors

Returns [ActError::Encode] if serialization fails.

pub fn encode(&self) -> ActResult<Vec<u8>>;

Source line: 113.

wire::Verifier

What a verifier requires of a token.

#[derive(Debug, Clone)]
pub struct Verifier {

}

Source line: 122.

wire::Verifier::new

Builds a verifier.

Errors

Returns [ActError::NoTrustedKeys] if trusted_keys is empty, since no token could then ever verify and the misconfiguration should surface at construction rather than as a stream of signature failures.

pub fn new(
        trusted_keys: Vec<PublicKeyBytes>,
        expected_issuer: impl Into<String>,
        expected_audience: impl Into<String>,
    ) -> ActResult<Self>;

Source line: 139.

wire::Verifier::requiring_scopes

Requires that the token grant every scope in scopes.

#[must_use]
pub fn requiring_scopes(mut self, scopes: impl IntoIterator<Item = Scope>) -> Self;

Source line: 159.

wire::Verifier::with_leeway_seconds

Allows seconds of clock skew on the nbf and exp checks.

Applied symmetrically. Callers running across hosts without tightly synchronized clocks need a small allowance here; leaving it at zero makes a token minted moments ago fail at a verifier whose clock trails the issuer's.

#[must_use]
pub fn with_leeway_seconds(mut self, seconds: i64) -> Self;

Source line: 171.

wire::Verifier::with_clock

Pins the time used for temporal checks, in seconds since the Unix epoch.

Intended for tests and for replaying a decision at a known instant.

#[must_use]
pub fn with_clock(mut self, now_unix_seconds: i64) -> Self;

Source line: 180.

wire::verify

Verifies an encoded ACT and returns its claims.

The order matters. Signature verification precedes every claim check, so a forged token is rejected before any of its unauthenticated content is used to make a decision or shape a log line.

1. Enforce the size ceiling and decode the envelope.
2. Verify the Ed25519 signature over the raw claims bytes.
3. Decode the claims and check they are structurally sound.
4. Check the temporal window, issuer, audience, and required scopes.

Errors

Returns the [ActError] variant describing the first failed step.

Examples

use agent_capability_token::{verify, ActError, Verifier};

let verifier = Verifier::new(vec![[0u8; 32]], "arsenal:broker:prod-1", "omerta")?;
// An empty payload is not a valid envelope.
assert!(matches!(verify(&[], &verifier), Err(ActError::EnvelopeDecode(_))));
# Ok::<(), ActError>(())

pub fn verify(token_bytes: &[u8], verifier: &Verifier) -> ActResult<ActClaims>;

Source line: 232.

wire::claims_to_signing_payload

Encodes claims into the exact byte string the signature must cover.

Exposed so an issuer holding its key in an HSM, or any other signer that cannot hand over private key material, can produce the payload here and sign it elsewhere.

Errors

Returns [ActError::Encode] if serialization fails.

pub fn claims_to_signing_payload(claims: &ActClaims) -> ActResult<Vec<u8>>;

Source line: 341.

wire::envelope_from_parts

Assembles an envelope from claims bytes and a detached signature.

Pairs with [claims_to_signing_payload] for signers that hold their key outside the process.

Errors

Returns [ActError::MalformedSignature] unless signature is 64 bytes, and [ActError::TooLarge] if the assembled token exceeds [MAX_ACT_BYTES].

pub fn envelope_from_parts(
    claims_bytes: Vec<u8>,
    signature: &[u8],
    kid: Option<String>,
) -> ActResult<Vec<u8>>;

Source line: 357.

wire::sign

Signs claims with an in-process key and returns an encoded ACT.

Behind the sign feature: a verifier has no reason to link signing code, and most deployments verify in far more places than they mint.

Errors

Returns [ActError::Encode] if serialization fails, or [ActError::TooLarge] if the assembled token exceeds [MAX_ACT_BYTES].

#[cfg(feature = "sign")]
pub fn sign(
    claims: &ActClaims,
    signing_key: &ed25519_dalek::SigningKey,
    kid: Option<String>,
) -> ActResult<Vec<u8>>;

Source line: 394.