Crate auths_keri

Expand description

KERI protocol types, SAID computation, and CESR translation for Auths.

The default feature set provides pure KERI types and SAID utilities with no heavy dependencies — suitable for WASM and FFI embedding.

Enable the cesr feature for bidirectional conversion between Auths’ internal JSON event representation and spec-compliant CESR streams (Trust over IP KERI v0.9).

Usage (default, no CESR):

use auths_keri::{Prefix, Said, compute_said};

let said = compute_said(&event_json)?;

Usage (with CESR feature):

use auths_keri::{CesrV1Codec, export_kel_as_cesr};

let codec = CesrV1Codec::new();
let cesr_stream = export_kel_as_cesr(&codec, &events)?;

Re-exports§

pub use acdc::ACDC_KERIPY_REVISION;
pub use acdc::ACDC_VERSION_PREFIX;
pub use acdc::Acdc;
pub use acdc::AcdcError;
pub use acdc::Attributes;
pub use acdc::CAPABILITY_SCHEMA;
pub use acdc::compute_capability_schema_said;
pub use acdc::compute_schema_said;
pub use capability::Capability;
pub use capability::CapabilityError;
pub use capability::MANAGE_MEMBERS;
pub use capability::ROTATE_KEYS;
pub use capability::SIGN_COMMIT;
pub use capability::SIGN_RELEASE;
pub use capability::UsageCap;
pub use did_webs::DidWebsDocument;
pub use did_webs::PublicKeyJwk;
pub use did_webs::VerificationMethod;
pub use ipex::IpexAdmit;
pub use ipex::IpexError;
pub use ipex::IpexGrant;
pub use ksn::KERI_KEY_STATE_VERSION;
pub use ksn::KSN_TYPE;
pub use ksn::KSN_VERSION;
pub use ksn::KeyStateNotice;
pub use ksn::KeyStateRecord;
pub use ksn::KsnError;
pub use ksn::LatestEstablishmentEvent;
pub use ksn::SignedKsn;
pub use oobi::EndRoleReply;
pub use oobi::LocSchemeReply;
pub use oobi::Oobi;
pub use oobi::OobiEndpoint;
pub use oobi::OobiError;
pub use oobi::OobiResolution;
pub use oobi::Role;
pub use oobi::ingest_oobi_stream;
pub use tel::Iss;
pub use tel::Rev;
pub use tel::TEL_KERIPY_REVISION;
pub use tel::TRAIT_NO_BACKERS;
pub use tel::TelAnchorSeal;
pub use tel::TelEvent;
pub use tel::TelState;
pub use tel::Vcp;
pub use tel::encode_nonce as encode_tel_nonce;
pub use tel::to_wire_bytes as tel_to_wire_bytes;
pub use tel::validate_tel;
pub use tls_cert::AUTHS_KERI_BINDING_OID;
pub use tls_cert::AuthsKeriBinding;
pub use tls_cert::DID_KERI_SCHEME;
pub use tls_cert::TlsCertError;
pub use tls_cert::TlsKeyAuthorization;
pub use tls_cert::TlsKeyAuthorizer;

Modules§

acdc: ACDC (Authentic Chained Data Container) credential type, SAID-ification, and the pinned v1 capability schema. ACDC (Authentic Chained Data Container) credential type for Auths.
capability: Validated capability identifiers — the atomic unit of authorization in Auths. Validated capability identifiers — the atomic unit of authorization in Auths.
did_webs: did:webs DID-document projection of a resolved KERI key-state. did:webs DID-document projection of a resolved KERI key-state.
ipex: IPEX — the Issuance & Presentation EXchange grant/admit exn handshake for handing over an ACDC credential between KERI controllers. IPEX — the Issuance & Presentation EXchange protocol.
kel_io: KEL storage port traits for reading and writing Key Event Logs.
ksn: Key-State Notice (KSN) — signed snapshot of current key-state for thin clients. Key-State Notice (KSN) — a signed snapshot of an identity’s current key-state.
messages: Routed KERI message types (qry, rpy, pro, bar, xip, exn). Routed KERI message types: Query, Reply, Prod, Bare, Exchange Inception, Exchange.
oobi: Out-Of-Band Introduction (OOBI) — KERI discovery: resolve/serve AID endpoints. Out-Of-Band Introduction (OOBI) — KERI discovery.
tel: Backerless TEL (Transaction Event Log) credential-status events: vcp/iss/rev. Backerless TEL (Transaction Event Log) events for Auths credential status.
tls_cert: KEL-rooted X.509 leaf certificates — composing a KERI identity with TLS (did:keri SAN + KEL key-state binding extension, verified by replay). KEL-rooted X.509 leaf certificates — composing a KERI identity with TLS.
witness: Witness protocol types: receipts, providers, and error reporting for split-view defense.

Structs§

AgentScope: Delegator-anchored scope/expiry for a delegated agent (Epic E.7).
CesrKey: A CESR-encoded public key (e.g., D + base64url Ed25519, 1AAI + base64url P-256).
DipEvent: Unified event enum for processing any KERI event type.
DipEventInit: Parameter struct for DipEvent::new.
DrtEvent: Delegated rotation event — rotates keys for a delegated identity.
DrtEventInit: Parameter struct for DrtEvent::new.
Fraction: Exact rational number for weighted threshold arithmetic.
IcpEvent: Inception event — creates a new KERI identity.
IcpEventInit: Parameter struct for IcpEvent::new. Mirrors the existing field set 1-for-1 so call-site migration is a mechanical prefix/ suffix wrap. Future wire-format additions land on IcpEvent via a with_* method, not by widening this Init struct — that’s what makes the pattern future-proof.
IndexedSignature: A single indexed controller signature.
IxnEvent: Interaction event — anchors data without key rotation.
KelPolicy: Configurable policy for time-aware KEL validation. Defaults match the plan text: 24h minimum rotation interval, 60s clock-skew tolerance, no emergency-override identifier.
KelSealIndex: A precomputed index of a delegator KEL’s anchoring seals.
KeriSequence: A KERI sequence number, stored internally as u64 and serialized as a hex string.
KeriTypeError: Error when constructing KERI newtypes with invalid values.
KeyState: Current key state derived from replaying a KEL.
Prefix: Strongly-typed KERI identifier prefix (e.g., "ETest123...", "DKey456...").
RotEvent: Rotation event — rotates to pre-committed key.
RotEventInit: Parameter struct for RotEvent::new. See IcpEventInit for the pattern rationale.
Said: KERI Self-Addressing Identifier (SAID).
SignedEvent: An event paired with its detached signature(s).
SourceSeal: A delegate-side source seal — the parsed form of a CESR -G SealSourceCouple.
TrustedKel: A KEL the caller asserts comes from a trusted source — the local identity registry / a self-owned store, or a chain already authenticated via validate_signed_kel.
VersionString: KERI v1.x version string: KERI10JSON{hhhhhh}_ (17 chars).
WireSignedDip: A device-signed delegated inception serialized for a single wire field.
WireSignedRot: Single-string wire form of a signed rotation: base64url-no-pad of the JSON {event, attachment_b64} pair.

Enums§

AnchorStatus: Three-state anchor verification result.
ConfigTrait: KERI configuration trait codes.
Event: Unified event enum for processing any KERI event type.
FractionError: Error when parsing a Fraction from a string.
KeriDecodeError: Errors from decoding a KERI-encoded public key.
KeriPublicKey: A validated KERI public key supporting Ed25519 and P-256.
KeriTranslationError: Errors during translation between Auths events and CESR streams.
Protocol: The 17-character protocol/version tag families used by SAID-ification.
Seal: KERI seal — anchors external data in an event’s a field.
TelError: Errors raised while constructing, SAID-ifying, or validating a backerless TEL.
Threshold: KERI signing/backer threshold.
ValidationError: Errors specific to KEL validation.
WitnessedReplay: The outcome of replaying a KEL through the witness-receipt gate.

Constants§

KERI_VERSION_PREFIX: KERI protocol version prefix string.
SAID_PLACEHOLDER: The 44-character # placeholder injected into the d field (and i field for inception events) before hashing. Matches the length of a CESR-qualified Blake3-256 digest (E + 43 chars base64url = 44 chars).

Traits§

DelegatorKelLookup: Validate a KEL and return the resulting KeyState.

Functions§

compute_event_said: Compute the SAID for an event.
compute_next_commitment: Compute the next-key commitment digest for pre-rotation.
compute_said: Computes a spec-compliant SAID for a KERI event (KERI10JSON protocol tag).
compute_said_with_protocol: Computes a spec-compliant SAID for a SAID’d JSON object under a chosen protocol.
compute_section_said: Computes the SAID of a nested SAID’d section that carries no version string.
decode_agent_scope: Decode an agent-scope seal value into (agent_prefix, AgentScope), or None if the value is not an agentscope: marker or any capability fails validation. Inverse of encode_agent_scope.
decode_signed_dip: Decode a single-string wire form back into the dip and its attachment bytes. Inverse of encode_signed_dip.
decode_signed_rot: Decode a single-string wire form back into the rot and its attachment bytes. Inverse of encode_signed_rot.
encode_agent_scope: Encode an agent-scope seal value: agentscope:{prefix}:{expires_or_0}:{caps_csv}.
encode_signed_dip: Encode a device-signed dip into its single-string wire form.
encode_signed_rot: Encode a signed rot into its single-string wire form.
finalize_dip_event: Create a delegated inception (dip) event with a properly computed SAID.
finalize_drt_event: Create a delegated rotation (drt) event with a properly computed SAID.
finalize_icp_event: Create an inception event with a properly computed SAID.
finalize_ixn_event: Create an interaction event with a properly computed SAID.
finalize_rot_event: Create a rotation event with a properly computed SAID.
find_seal_in_kel: Search for a seal with the given digest in any IXN event in the KEL.
pair_kel_attachments: Pair an ordered KEL with its per-event CESR signature attachments, producing the SignedEvents an authenticated replay (validate_signed_kel) consumes.
parse_attachment: Parse a CESR -A## indexed-signature group into the constituent IndexedSignatures.
parse_delegated_attachment: Parse a delegated event’s combined attachment — the controller signature group (-A) followed by an optional source-seal group (-G).
parse_kel_json: Parse a KEL from a JSON string.
parse_source_seal_couples: Parse a CESR -G## SealSourceCouples group into SourceSeals.
serialize_attachment: Serialize a list of externalized signatures to CESR text-domain -A##<siger1><siger2>… indexed-signature group bytes.
serialize_for_signing: Serialize a finalized event for signing.
serialize_source_seal_couples: Serialize source seals to a CESR text-domain -G##<Seqner><Saider>… SealSourceCouples group, byte-aligned with keripy 1.3.4.
state_after_event: Compute the key state after applying event on top of current_state.
validate_delegation: Validate a delegated event against the delegator’s KEL.
validate_for_append: Validate a single event for appending to a KEL with known state.
validate_signed_event: Validate a signed event’s crypto (signatures + commitments) against key state.
validate_signed_kel: Replay a KEL of signed events, verifying each event’s signature against the key-state that authorizes it — the authenticated counterpart to the structural-only [validate_kel] (RT-002).
verify_commitment: Verify that a public key satisfies a commitment.
verify_event_crypto: Validate the cryptographic integrity of a single event against the current key state.
verify_event_said: Verify an event’s SAID matches its content hash.
verify_said: Verifies that an event’s d field matches the spec-compliant SAID.

Crate auths_keri

Crate auths_keri Copy item path

Re-exports§

Modules§

Structs§

Enums§

Constants§

Traits§

Functions§

Crate auths_keri