Crate auths_transparency 

Append-only transparency log for Auths.

Implements C2SP tlog-tiles Merkle tree types, proof verification, signed note format, and tile storage abstractions.

Feature Flags

• native (default) — enables TileStore trait and async tile I/O
• Without features — WASM-safe core: types, Merkle math, proofs, notes

Re-exports

pub use bundle::BundleVerificationReport;

pub use bundle::CheckpointStatus;

pub use bundle::DelegationChainLink;

pub use bundle::DelegationStatus;

pub use bundle::InclusionStatus;

pub use bundle::NamespaceStatus;

pub use bundle::OfflineBundle;

pub use bundle::SignatureStatus;

pub use bundle::WitnessStatus;

pub use entry::AccessTier;

pub use entry::Entry;

pub use entry::EntryBody;

pub use entry::EntryContent;

pub use entry::EntryType;

pub use note::C2spSignature;

pub use note::NoteSignature;

pub use note::build_signature_line;

pub use note::compute_ecdsa_key_id;

pub use note::compute_key_id;

pub use note::parse_signed_note;

pub use note::parse_signed_note_c2sp;

pub use note::serialize_signed_note;

pub use tile::TILE_HEIGHT;

pub use tile::TILE_WIDTH;

pub use tile::leaf_tile;

pub use tile::tile_count;

pub use tile::tile_path;

pub use store::TileStore;

pub use verify::verify_bundle;

pub use verify::verify_checkpoint_signature;

pub use verify::verify_witness_cosignatures;

pub use writer::AppendedLeaf;

pub use writer::LogSigningKey;

pub use writer::LogWriter;

pub use witness::ALG_COSIGNATURE_V1;

pub use witness::CosignRequest;

pub use witness::CosignResponse;

pub use witness::DEFAULT_WITNESS_TIMEOUT;

pub use witness::WitnessClient;

pub use witness::WitnessResult;

pub use witness::build_cosignature_line;

pub use witness::collect_witness_cosignatures;

pub use witness::compute_witness_key_id;

pub use witness::cosignature_signed_message;

pub use witness::extract_cosignatures;

pub use witness::parse_cosignature;

pub use witness::serialize_cosignature;

pub use witness_policy::WitnessPolicy;

pub use witness_policy::WitnessPolicyEntry;

pub use witness_policy::WitnessPolicyError;

pub use witness_policy::ceiling_for_policy_load;

Modules

bundle

Offline verification bundles.

checkpoint

Log checkpoint types. Log checkpoints (signed tree heads) and witness cosignatures.

entry

Transparency log entry types.

error

Error types for transparency operations. The transparency-log error contract.

merkle

RFC 6962 Merkle tree operations. RFC 6962 Merkle tree hashing and proof verification.

note

C2SP signed note format.

proof

Inclusion and consistency proof types. Merkle inclusion and consistency proofs.

store

Tile storage trait (behind native feature).

tile

C2SP tlog-tiles path encoding.

types

Core newtypes: MerkleHash, LogOrigin. Identifier and hash newtypes for the transparency-log wire contract.

verify

Offline bundle verification (requires native feature for Ed25519). Offline bundle verification logic.

witness

Witness protocol for split-view protection (requires native feature). Witness protocol for transparency log split-view protection.

witness_policy

Typed, fail-closed witness-diversity policy loader. Typed, fail-closed witness-diversity policy (data/witness_policy.json).

writer

The log write path: append leaves, sign checkpoints, mint inclusion proofs (requires native feature). The write half of the transparency log: append leaves, sign checkpoints, and mint inclusion proofs a verifier can replay offline.

Structs

Checkpoint

An unsigned transparency log checkpoint.

ConsistencyProof

Merkle consistency proof between two tree sizes.

FsTileStore

Filesystem-backed tile store.

HonestyCeiling

The honest current truth about a witness set, rendered identically by every surface — CLI witness status, verify output, and the cross-repo badge (via the serialized form). Computing it in ONE place means no surface can forget the ceiling or re-derive met/failing differently.

InclusionProof

Merkle inclusion proof for a single entry in the log.

IndependencePolicy

Minimum-diversity thresholds an independent quorum must clear.

LogOrigin

Validated log origin string (e.g., "auths.dev/log").

MerkleHash

SHA-256 Merkle hash (32 bytes).

OperatorAttributes

The independence-relevant attributes of one attester in a quorum.

SignedCheckpoint

A checkpoint signed by the log operator (and optionally witnesses).

TrustConfig

Multi-log trust configuration.

TrustRoot

Trust root for verifying transparency log checkpoints.

TrustRootWitness

A trusted witness in the TrustRoot.

WitnessCosignature

A witness cosignature on a checkpoint.

WitnessOperatorInfo

The independence attributes pinned alongside a witness key.

Enums

EquivocationDetection

Whether cross-operator equivocation detection is merely sampled or non-repudiable. Until the gossip layer (W.3) lands, detection is Sampled — a surface must say so rather than imply a guarantee it cannot make.

TransparencyError

Errors from transparency log operations.

Functions

compute_root

Compute the Merkle root of a list of leaf hashes per RFC 6962 Section 2.1.

hash_children

Hash two child nodes with RFC 6962 domain separation: SHA-256(0x01 || left || right).

hash_leaf

Hash a leaf value with RFC 6962 domain separation: SHA-256(0x00 || data).

prove_inclusion

Generate the RFC 6962 inclusion-proof path for the leaf at index.

verify_consistency

Verify a consistency proof between an old tree of old_size and a new tree of new_size.

verify_inclusion

Verify a Merkle inclusion proof for a leaf at a given index in a tree of size leaves.