openagent-auth-protocol · message

Source: openagent-sdk/crates/openagent-auth-protocol/src/message.rs. SHA-256: c5b5442b0fb5d236093b1e4a4c62ea4823f363fd1e063000fdf2639ec4693c88.

This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.

message::CHALLENGE_TYPE

The literal type value of an [IdentityChallenge], per Section 15.2.

pub const CHALLENGE_TYPE: &str;

Source line: 19.

message::IdentityChallenge

Server → Agent: a cryptographic challenge (Section 15.2).

The signing payload for the proof is the JCS-canonicalized (RFC 8785) UTF-8 byte representation of this object — no framing, prefix, or envelope. Use [crate::handshake::canonical_challenge_bytes].

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct IdentityChallenge {
/// MUST be the literal string `openagent-challenge-v1`.

#[serde(rename = "type")]
pub message_type: String,
/// 64-character lowercase hexadecimal string (32 CSPRNG bytes).

pub nonce: String,
/// ISO 8601 UTC timestamp, `Z` suffix, seconds precision.

pub timestamp: String,
/// Server origin per RFC 6454: `scheme://host[:port]`.

pub origin: String,
/// Optional protection-space identifier. Omitted entirely when absent.

#[serde(default, skip_serializing_if = "Option::is_none")]
pub realm: Option<String>
}

Source line: 27.

message::IdentityChallenge::new

Construct a challenge of the current format version.

pub fn new(nonce: String, timestamp: String, origin: String, realm: Option<String>) -> Self;

Source line: 44.

message::KeyType

Signature scheme used for an [IdentityProof] (Section 15.3).

#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "lowercase")]
pub enum KeyType {
    /// Ed25519 (32-byte public key).
    Ed25519,
    /// secp256k1 (33-byte compressed SEC1 public key).
    Secp256k1,
}

Source line: 58.

message::IdentityProof

Agent → Server: the cryptographic proof of identity (Section 15.3).

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct IdentityProof {
/// Base64url (no padding) signature over the JCS-canonicalized challenge

/// bytes. 64 bytes for both schemes.

pub signature: String,
/// Base64url (no padding) raw public key: 32 bytes (Ed25519) or 33 bytes

/// (secp256k1 compressed).

pub public_key: String,
/// The signature scheme.

pub key_type: KeyType,
/// The nonce from the challenge, echoed to assist server-side lookup.

pub nonce: String
}

Source line: 76.

message::TrustTier

The resolution tier the server assigns after verification (Section 15.4).

#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "lowercase")]
pub enum TrustTier {
    /// Identity verified against the presented key only.
    Anonymous,
    /// Identity resolved with additional registry context.
    Identified,
    /// Identity resolved with full lineage authority.
    Sovereign,
}

Source line: 92.

message::IdentityVerified

Server → Agent: identity confirmed; session issued (Section 15.4).

The session_token replaces further challenge-response cycles until expiry; the agent presents it as a bearer credential (Section 12).

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct IdentityVerified {
/// Most specific resolved DID for the agent.

pub did: String,
/// The resolution tier assigned by the server.

pub trust_tier: TrustTier,
/// JWT session token for subsequent requests.

pub session_token: String,
/// ISO 8601 UTC timestamp of session expiry.

pub session_expires: String,
/// Granted capability identifiers, populated by Arsenal when present.

#[serde(default, skip_serializing_if = "Option::is_none")]
pub capabilities: Option<Vec<String>>
}

Source line: 116.