openagent-crypto-wasm · wasm_api

Source: openagent-sdk/crates/openagent-crypto-wasm/src/wasm_api.rs. SHA-256: c567a5871c7879f19bf7b1be000244cb4f8d41f9f677a3d02d617dd4db9bfd6f.

This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.

Module condition:

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]

wasm_api::WasmKeypair

JS-friendly Ed25519 keypair: { signing_key, verifying_key } as Uint8Array byte arrays. Returned by [ed25519_generate_keypair].

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
#[derive(Clone)]
pub struct WasmKeypair {

}

Source line: 50.

wasm_api::WasmKeypair::signing_key

32-byte signing (private) key.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen(getter)]
pub fn signing_key(&self) -> Vec<u8>;

Source line: 59.

wasm_api::WasmKeypair::verifying_key

32-byte verifying (public) key.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen(getter)]
pub fn verifying_key(&self) -> Vec<u8>;

Source line: 65.

wasm_api::WasmX25519Keypair

JS-friendly X25519 keypair: { secret_key, public_key }.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
#[derive(Clone)]
pub struct WasmX25519Keypair {

}

Source line: 73.

wasm_api::WasmX25519Keypair::secret_key

32-byte secret (private) key.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen(getter)]
pub fn secret_key(&self) -> Vec<u8>;

Source line: 82.

wasm_api::WasmX25519Keypair::public_key

32-byte public key.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen(getter)]
pub fn public_key(&self) -> Vec<u8>;

Source line: 88.

wasm_api::ed25519_generate_keypair

Generates a fresh Ed25519 keypair using the host CSPRNG.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
pub fn ed25519_generate_keypair() -> WasmKeypair;

Source line: 99.

wasm_api::ed25519_sign

Signs message with the supplied 32-byte Ed25519 signing key.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
pub fn ed25519_sign(signing_key: &[u8], message: &[u8]) -> Result<Vec<u8>, JsError>;

Source line: 109.

wasm_api::ed25519_verify

Verifies an Ed25519 signature. Throws if verification fails.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
pub fn ed25519_verify(
    verifying_key: &[u8],
    message: &[u8],
    signature: &[u8],
) -> Result<(), JsError>;

Source line: 117.

wasm_api::ed25519_public_from_private

Derives the Ed25519 verifying key from a signing key.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
pub fn ed25519_public_from_private(signing_key: &[u8]) -> Result<Vec<u8>, JsError>;

Source line: 127.

wasm_api::x25519_generate_keypair

Generates a fresh X25519 keypair using the host CSPRNG.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
pub fn x25519_generate_keypair() -> WasmX25519Keypair;

Source line: 139.

wasm_api::x25519_diffie_hellman

Computes the X25519 raw shared secret. Callers MUST run this through HKDF before using it as keying material.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
pub fn x25519_diffie_hellman(
    secret_key: &[u8],
    peer_public_key: &[u8],
) -> Result<Vec<u8>, JsError>;

Source line: 150.

wasm_api::hkdf_sha256_extract

HKDF-Extract(salt, IKM) — returns the 32-byte PRK.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
pub fn hkdf_sha256_extract(salt: &[u8], ikm: &[u8]) -> Vec<u8>;

Source line: 165.

wasm_api::hkdf_sha256_expand

HKDF-Expand(PRK, info, length).

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
pub fn hkdf_sha256_expand(prk: &[u8], info: &[u8], length: usize) -> Result<Vec<u8>, JsError>;

Source line: 171.

wasm_api::hkdf_sha256_derive

Combined extract + expand HKDF-SHA256 derivation.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
pub fn hkdf_sha256_derive(
    salt: &[u8],
    ikm: &[u8],
    info: &[u8],
    length: usize,
) -> Result<Vec<u8>, JsError>;

Source line: 177.

wasm_api::blake3_hash_bytes

BLAKE3 hash of data.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
pub fn blake3_hash_bytes(data: &[u8]) -> Vec<u8>;

Source line: 192.

wasm_api::blake3_keyed_hash

BLAKE3 keyed hash.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
pub fn blake3_keyed_hash(key: &[u8], data: &[u8]) -> Result<Vec<u8>, JsError>;

Source line: 198.

wasm_api::blake3_derive_key

BLAKE3 KDF mode: derive_key(context, key_material).

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
pub fn blake3_derive_key(context: &str, key_material: &[u8]) -> Vec<u8>;

Source line: 206.

wasm_api::sha256

SHA-256 hash of data.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
pub fn sha256(data: &[u8]) -> Vec<u8>;

Source line: 212.

wasm_api::sha512

SHA-512 hash of data.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
pub fn sha512(data: &[u8]) -> Vec<u8>;

Source line: 218.

wasm_api::aes256gcm_encrypt

AES-256-GCM encryption. Returns ciphertext || tag.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
pub fn aes256gcm_encrypt(
    key: &[u8],
    nonce: &[u8],
    plaintext: &[u8],
    aad: &[u8],
) -> Result<Vec<u8>, JsError>;

Source line: 228.

wasm_api::aes256gcm_decrypt

AES-256-GCM decryption.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
pub fn aes256gcm_decrypt(
    key: &[u8],
    nonce: &[u8],
    ciphertext: &[u8],
    aad: &[u8],
) -> Result<Vec<u8>, JsError>;

Source line: 239.

wasm_api::xchacha20poly1305_encrypt

XChaCha20-Poly1305 encryption.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
pub fn xchacha20poly1305_encrypt(
    key: &[u8],
    nonce: &[u8],
    plaintext: &[u8],
    aad: &[u8],
) -> Result<Vec<u8>, JsError>;

Source line: 250.

wasm_api::xchacha20poly1305_decrypt

XChaCha20-Poly1305 decryption.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
pub fn xchacha20poly1305_decrypt(
    key: &[u8],
    nonce: &[u8],
    ciphertext: &[u8],
    aad: &[u8],
) -> Result<Vec<u8>, JsError>;

Source line: 261.

wasm_api::argon2id_hash_password

Hashes password with Argon2id, returning a PHC-format string.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
pub fn argon2id_hash_password(password: &[u8]) -> Result<String, JsError>;

Source line: 276.

wasm_api::argon2id_verify_password

Verifies a password against a PHC-format Argon2id hash.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
pub fn argon2id_verify_password(password: &[u8], encoded_hash: &str) -> Result<bool, JsError>;

Source line: 282.

wasm_api::jcs_canonicalize

JCS canonicalization (RFC 8785) of a JSON string.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
pub fn jcs_canonicalize(json: &str) -> Result<Vec<u8>, JsError>;

Source line: 292.

wasm_api::multibase_base58btc_encode

Multibase base58btc encode.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
pub fn multibase_base58btc_encode(bytes: &[u8]) -> String;

Source line: 298.

wasm_api::multibase_base58btc_decode

Multibase base58btc decode.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
pub fn multibase_base58btc_decode(input: &str) -> Result<Vec<u8>, JsError>;

Source line: 304.

wasm_api::ct_eq

Constant-time byte equality. Returns false for slices of differing length.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
pub fn ct_eq(a: &[u8], b: &[u8]) -> bool;

Source line: 310.

wasm_api::random_bytes

Returns n cryptographically random bytes.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
pub fn random_bytes(n: usize) -> Result<Vec<u8>, JsError>;

Source line: 316.

wasm_api::frost_trusted_keygen

Generates a t-of-n FROST key share bundle (trusted dealer).

Returns a JSON string of KeyShareBundle.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
pub fn frost_trusted_keygen(min_signers: u16, max_signers: u16) -> Result<String, JsError>;

Source line: 333.

wasm_api::frost_sign_round1

FROST round 1 for a single participant. Returns JSON of Round1Output.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
pub fn frost_sign_round1(serialized_key_package: &[u8]) -> Result<String, JsError>;

Source line: 340.

wasm_api::frost_sign_round2

FROST round 2 for a single participant.

commitments_json is a JSON array of ParticipantCommitments.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
pub fn frost_sign_round2(
    serialized_key_package: &[u8],
    serialized_nonces: &[u8],
    message: &[u8],
    commitments_json: &str,
) -> Result<Vec<u8>, JsError>;

Source line: 350.

wasm_api::frost_aggregate

FROST aggregation: combine signature shares into a 64-byte Ed25519 signature.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
pub fn frost_aggregate(
    message: &[u8],
    commitments_json: &str,
    shares_json: &str,
    serialized_public_key_package: &[u8],
) -> Result<Vec<u8>, JsError>;

Source line: 369.

wasm_api::frost_verify

Verifies a FROST signature. Throws on failure.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
pub fn frost_verify(
    message: &[u8],
    signature: &[u8],
    group_public_key: &[u8],
) -> Result<(), JsError>;

Source line: 389.

wasm_api::version

Returns the crate version string.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
pub fn version() -> String;

Source line: 399.

wasm_api::act_verify

Verifies an ACT envelope against the trusted key set and policy, and returns the claims as a JSON string.

This is the full normative procedure from agent-capability-token, not a re-implementation: envelope decode, version/algorithm checks, Ed25519 signature verification (checked before any claim, so an attacker cannot plant unauthenticated claim content), temporal checks with leeway, and issuer/audience/scope policy.

Arguments:

token_bytes: the ACT envelope bytes (CBOR).
trusted_keys: concatenated raw 32-byte Ed25519 public keys (exactly 32 bytes each, any count > 0). Keys are tried in order; kid is a hint for audit, never authoritative for selection.
expected_issuer / expected_audience: the policy bindings. Both are required, deliberately: a verifier that does not bind the token's intended audience accepts tokens meant for someone else.
required_scopes: each entry a service:resource:action scope string the token must grant; wildcards in the GRANT expand, in the REQUEST are literal.
leeway_seconds: symmetric clock-skew allowance on temporal checks.
now_unix_seconds: 0 for the system clock, or a pinned time for tests and for replaying a decision at a known instant.

Errors (thrown on the JS side) are the canonical ActError reasons, so a forged token reports distinctly from an expired one and an unimplemented format version distinctly from both.

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
pub fn act_verify(
    token_bytes: &[u8],
    trusted_keys: &[u8],
    expected_issuer: &str,
    expected_audience: &str,
    required_scopes: Vec<String>,
    leeway_seconds: i64,
    now_unix_seconds: i64,
) -> Result<String, JsError>;

Source line: 436.

wasm_api::act_decode_unverified

Decodes an ACT envelope's claims WITHOUT verifying the signature, for diagnostics and tooling. The returned string is prefixed so callers cannot accidentally treat the contents as verified.

Never use this for authorization: unverified claims are attacker controlled. Authorization decisions go through [act_verify].

#[cfg(feature = "wasm")]
#[cfg_attr(docsrs, doc(cfg(feature = "wasm")))]
#[wasm_bindgen]
pub fn act_decode_unverified(token_bytes: &[u8]) -> Result<String, JsError>;

Source line: 497.

openagent-crypto-wasm · wasm_api

On this page