Source: arsenal/crates/arsenal-core/src/token.rs. SHA-256: 704152225e610b62f9b811548b7cd899d23bedee7514d8222e8073bd31044202.

This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.

token::TokenId

Token identifier - unique ID for each token instance

#[derive(Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]
#[serde(transparent)]
pub struct TokenId(Uuid);

Source line: 35.

token::TokenId::generate

Generate a new random token ID

#[must_use]
pub fn generate() -> Self;

Source line: 40.

token::TokenId::from_uuid

Create from an existing UUID

#[must_use]
pub const fn from_uuid(uuid: Uuid) -> Self;

Source line: 47.

token::TokenId::as_uuid

Get the inner UUID

#[must_use]
pub const fn as_uuid(&self) -> &Uuid;

Source line: 53.

token::AgentCapabilityToken

Agent Capability Token - the main credential type

This struct represents the claims within a token. The actual signed token is produced by the crypto layer.

#[derive(Clone, Serialize, Deserialize)]
pub struct AgentCapabilityToken {

}

Source line: 75.

token::AgentCapabilityToken::new

Create a new unsigned token with the given claims

#[must_use]
pub fn new(claims: TokenClaims) -> Self;

Source line: 86.

token::AgentCapabilityToken::claims

Get the token claims

#[must_use]
pub fn claims(&self) -> &TokenClaims;

Source line: 95.

token::AgentCapabilityToken::id

Get the token ID

#[must_use]
pub fn id(&self) -> &TokenId;

Source line: 101.

token::AgentCapabilityToken::subject

Get the subject (the agent's OAS DID)

#[must_use]
pub fn subject(&self) -> &OasDid;

Source line: 107.

token::AgentCapabilityToken::audience

Get the audience

#[must_use]
pub fn audience(&self) -> &str;

Source line: 113.

token::AgentCapabilityToken::scopes

Get the scopes

#[must_use]
pub fn scopes(&self) -> &ScopeSet;

Source line: 119.

token::AgentCapabilityToken::is_expired

Check if the token is expired

#[must_use]
pub fn is_expired(&self) -> bool;

Source line: 125.

token::AgentCapabilityToken::is_not_yet_valid

Check if the token is not yet valid

#[must_use]
pub fn is_not_yet_valid(&self) -> bool;

Source line: 131.

token::AgentCapabilityToken::is_time_valid

Check if the token is currently valid (time-wise)

#[must_use]
pub fn is_time_valid(&self) -> bool;

Source line: 137.

token::AgentCapabilityToken::remaining_ttl

Get remaining TTL

#[must_use]
pub fn remaining_ttl(&self) -> chrono::Duration;

Source line: 144.

token::AgentCapabilityToken::is_signed

Check if token has a valid signature

#[must_use]
pub fn is_signed(&self) -> bool;

Source line: 150.

token::AgentCapabilityToken::set_signature

Set the signature (called by the crypto layer after signing)

pub fn set_signature(&mut self, signature: TokenSignature);

Source line: 155.

token::AgentCapabilityToken::signature

Get the signature if present

#[must_use]
pub fn signature(&self) -> Option<&TokenSignature>;

Source line: 161.

token::AgentCapabilityToken::validate_structure

Validate token structure (not cryptographic verification)

Errors

Returns an error if the token structure is invalid

pub fn validate_structure(&self) -> ArsenalResult<()>;

Source line: 169.

token::AgentCapabilityToken::to_cbor

Serialize to the canonical ACT envelope

The bytes produced here are the interoperable form defined by agent-capability-token, not Arsenal's internal struct layout. A token leaving this process is a standard ACT, so a verifier that has never seen Arsenal can validate it.

Errors

Returns an error if the token is unsigned, if the claims cannot be represented canonically, or if the encoded token exceeds the size limit. An unsigned token has no envelope form: the envelope carries a signature by construction.

pub fn to_cbor(&self) -> ArsenalResult<Vec<u8>>;

Source line: 214.

token::AgentCapabilityToken::claims_to_cbor

Serialize just the claims to CBOR bytes (for signing/verification)

Produces the canonical claim encoding, so a signature computed here is a signature over the standard ACT payload. Signing and verification both route through this method, which is what keeps them in agreement.

Errors

Returns an error if the claims cannot be represented canonically.

pub fn claims_to_cbor(&self) -> ArsenalResult<Vec<u8>>;

Source line: 242.

token::AgentCapabilityToken::from_cbor

Deserialize from the canonical ACT envelope

Decoding does not verify the signature; that is the verifier's job. The signature is carried through so a verifier can check it.

Errors

Returns an error if the envelope is malformed, exceeds the size limit, or carries claims Arsenal cannot represent - a multi-audience token, for instance.

pub fn from_cbor(bytes: &[u8]) -> ArsenalResult<Self>;

Source line: 258.

token::TokenClaims

Token claims - the payload of an ACT

#[derive(Clone, Serialize, Deserialize)]
pub struct TokenClaims {
/// Token ID (unique identifier)

pub jti: TokenId,
/// Subject - the OAS DID of the agent this token is for

///

/// A DID rather than a local key, so that a verifier outside Arsenal can

/// resolve the identity a capability was granted to. ANVIL section 5.2

/// requires this binding.

pub sub: OasDid,
/// Issuer - who issued this token

pub iss: String,
/// Audience - intended recipient/service

pub aud: String,
/// Issued at timestamp

pub iat: chrono::DateTime<chrono::Utc>,
/// Not before timestamp

pub nbf: chrono::DateTime<chrono::Utc>,
/// Expiration timestamp

pub exp: chrono::DateTime<chrono::Utc>,
/// Tenant ID

pub tenant_id: TenantId,
/// Granted scopes

pub scope: ScopeSet,
/// Binding constraints

#[serde(default, skip_serializing_if = "Option::is_none")]
pub constraints: Option<Constraints>,
/// Rate limits

#[serde(default, skip_serializing_if = "Option::is_none")]
pub limits: Option<RateLimits>,
/// Usage budget

#[serde(default, skip_serializing_if = "Option::is_none")]
pub budget: Option<UsageBudget>,
/// Delegation constraints (if this token can be delegated)

#[serde(default, skip_serializing_if = "Option::is_none")]
pub delegation: Option<DelegationConstraints>,
/// Trace information

#[serde(default, skip_serializing_if = "Option::is_none")]
pub trace: Option<TokenTrace>,
/// Proof-of-possession key fingerprint

#[serde(default, skip_serializing_if = "Option::is_none")]
pub cnf: Option<ProofOfPossession>,
/// Delegated credential variables accessible via proxy (DCT extension)

#[serde(default, skip_serializing_if = "Option::is_none")]
pub delegated_variables: Option<Vec<String>>,
/// Maximum delegation depth for credential tokens (DCT extension)

#[serde(default, skip_serializing_if = "Option::is_none")]
pub max_delegation_depth: Option<u8>
}

Source line: 319.

token::TokenClaims::builder

Create a new token claims builder

#[must_use]
pub fn builder() -> TokenClaimsBuilder;

Source line: 371.

token::TokenClaimsBuilder

Builder for token claims

#[derive(Debug)]
pub struct TokenClaimsBuilder {

}

Source line: 390.

token::TokenClaimsBuilder::new

Create a new builder

#[must_use]
pub fn new() -> Self;

Source line: 410.

token::TokenClaimsBuilder::subject

Set the subject - the agent's OAS DID

#[must_use]
pub fn subject(mut self, sub: OasDid) -> Self;

Source line: 431.

token::TokenClaimsBuilder::issuer

Set the issuer

#[must_use]
pub fn issuer(mut self, iss: impl Into<String>) -> Self;

Source line: 438.

token::TokenClaimsBuilder::audience

Set the audience

#[must_use]
pub fn audience(mut self, aud: impl Into<String>) -> Self;

Source line: 445.

token::TokenClaimsBuilder::tenant

Set the tenant ID

#[must_use]
pub fn tenant(mut self, tenant_id: TenantId) -> Self;

Source line: 452.

token::TokenClaimsBuilder::scopes

Set the scopes

#[must_use]
pub fn scopes(mut self, scope: ScopeSet) -> Self;

Source line: 459.

token::TokenClaimsBuilder::ttl_seconds

Set the TTL in seconds

#[must_use]
pub fn ttl_seconds(mut self, ttl: i64) -> Self;

Source line: 466.

token::TokenClaimsBuilder::constraints

Set constraints

#[must_use]
pub fn constraints(mut self, constraints: Constraints) -> Self;

Source line: 473.

token::TokenClaimsBuilder::limits

Set rate limits

#[must_use]
pub fn limits(mut self, limits: RateLimits) -> Self;

Source line: 480.

token::TokenClaimsBuilder::budget

Set usage budget

#[must_use]
pub fn budget(mut self, budget: UsageBudget) -> Self;

Source line: 487.

token::TokenClaimsBuilder::delegation

Set delegation constraints

#[must_use]
pub fn delegation(mut self, delegation: DelegationConstraints) -> Self;

Source line: 494.

token::TokenClaimsBuilder::parent_token

Set parent token ID (for delegation chain)

#[must_use]
pub fn parent_token(mut self, parent_id: TokenId) -> Self;

Source line: 501.

token::TokenClaimsBuilder::proof_of_possession

Set proof-of-possession key

#[must_use]
pub fn proof_of_possession(mut self, cnf: ProofOfPossession) -> Self;

Source line: 508.

token::TokenClaimsBuilder::delegated_variables

Set delegated credential variables accessible via proxy

#[must_use]
pub fn delegated_variables(mut self, vars: Vec<String>) -> Self;

Source line: 515.

token::TokenClaimsBuilder::max_delegation_depth

Set maximum delegation depth for credential tokens

#[must_use]
pub fn max_delegation_depth(mut self, depth: u8) -> Self;

Source line: 522.

token::TokenClaimsBuilder::build

Build the token claims

Errors

Returns an error if required fields are missing

pub fn build(self) -> ArsenalResult<TokenClaims>;

Source line: 531.

token::TokenTrace

Token trace information for audit trail

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct TokenTrace {
/// Unique issuance ID

pub issuance_id: Uuid,
/// Parent token ID (if delegated)

#[serde(skip_serializing_if = "Option::is_none")]
pub parent_token_id: Option<TokenId>,
/// Policy ID that authorized this token

#[serde(skip_serializing_if = "Option::is_none")]
pub policy_id: Option<String>,
/// Delegation depth (0 = original token)

pub delegation_depth: u8
}

Source line: 599.

token::ProofOfPossession

Proof-of-possession confirmation

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ProofOfPossession {
/// Key fingerprint for `PoP` verification

pub key_fingerprint: KeyFingerprint,
/// Algorithm used for `PoP` (e.g., "Ed25519")

pub alg: String
}

Source line: 614.

token::ProofOfPossession::ed25519

Create a new PoP confirmation with Ed25519

#[must_use]
pub fn ed25519(key_fingerprint: KeyFingerprint) -> Self;

Source line: 624.

token::TokenSignature

Token signature

#[derive(Clone, Serialize, Deserialize)]
pub struct TokenSignature {

}

Source line: 634.

token::TokenSignature::new

Create a new signature

#[must_use]
pub fn new(bytes: Vec<u8>, algorithm: SignatureAlgorithm) -> Self;

Source line: 646.

token::TokenSignature::with_key_id

Set the key ID

#[must_use]
pub fn with_key_id(mut self, key_id: impl Into<String>) -> Self;

Source line: 656.

token::TokenSignature::bytes

Get the signature bytes

#[must_use]
pub fn bytes(&self) -> &[u8];

Source line: 663.

token::TokenSignature::algorithm

Get the algorithm

#[must_use]
pub const fn algorithm(&self) -> &SignatureAlgorithm;

Source line: 669.

token::TokenSignature::key_id

Get the key ID

#[must_use]
pub fn key_id(&self) -> Option<&str>;

Source line: 675.

token::SignatureAlgorithm

Signature algorithms supported

#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "UPPERCASE")]
pub enum SignatureAlgorithm {
    /// Ed25519 signature
    Ed25519,
    /// ECDSA with P-256
    Es256,
    /// ECDSA with P-384
    Es384,
}

Source line: 693.

token::SignatureAlgorithm::signature_length

Get the expected signature length

#[must_use]
pub const fn signature_length(&self) -> usize;

Source line: 705.

arsenal-core · token

On this page