chio_http_core/
lib.rs

1//! Protocol-agnostic HTTP security types for the Chio kernel.
2//!
3//! This crate defines the shared types that every HTTP substrate adapter uses:
4//! request model, caller identity, session context, HTTP receipts, and verdicts.
5//! It is the foundation for `chio-openapi`, `chio-config`, `chio api protect`,
6//! and all language-specific middleware crates.
7
8#![forbid(unsafe_code)]
9
10pub mod approvals;
11mod authority;
12mod authority_projection;
13pub mod compliance;
14mod egress;
15pub mod emergency;
16mod evaluation;
17mod identity;
18mod method;
19pub mod metrics;
20pub mod plan;
21mod receipt;
22pub mod regulatory_api;
23mod request;
24pub mod routes;
25mod session;
26mod verdict;
27
28pub use metrics::{
29    decision_latency_count, guard_evaluations_total, observe_decision_latency_nanos,
30    record_guard_evaluation, render_http_core_metrics_prometheus, CHIO_GUARD_EVALUATIONS_TOTAL,
31    CHIO_KERNEL_DECISION_LATENCY_SECONDS, GUARD_LABEL_HTTP_AUTHORITY, GUARD_OUTCOME_ALLOW,
32    GUARD_OUTCOME_DENY, GUARD_OUTCOME_ERROR,
33};
34
35pub use approvals::{
36    handle_batch_respond, handle_create_threshold_proposal, handle_deliver_threshold_approval,
37    handle_get_approval, handle_get_threshold_proposal, handle_list_pending, handle_respond,
38    handle_submit_threshold_approval, ApprovalAdmin, ApprovalHandlerError, BatchDecisionEntry,
39    BatchRespondRequest, BatchRespondResponse, BatchRespondResult, BatchRespondSummary,
40    CreateThresholdProposalRequest, GetApprovalResponse, PendingListResponse, PendingQuery,
41    RespondRequest, RespondResponse, SubmitThresholdApprovalRequest,
42};
43pub use authority::{
44    http_authority_tool_grant, HttpAuthority, HttpAuthorityBuilder, HttpAuthorityError,
45    HttpAuthorityEvaluation, HttpAuthorityInput, HttpAuthorityPolicy, PreparedHttpEvaluation,
46    TransportDenyInput, HTTP_AUTHORITY_SERVER_ID, HTTP_AUTHORITY_TOOL_NAME,
47};
48pub use compliance::{
49    handle_compliance_score, ComplianceScoreError, ComplianceScoreRequest, ComplianceScoreResponse,
50    ComplianceScoreWindow, ComplianceSource, ComplianceSourceResult,
51};
52#[cfg(feature = "reqwest-egress")]
53pub use egress::{client_builder_with_contract, send_with_contract};
54pub use egress::{HttpEgressContract, HttpEgressError, ValidatedHttpEgressTarget};
55pub use emergency::{
56    handle_emergency_resume, handle_emergency_status, handle_emergency_stop, EmergencyAdmin,
57    EmergencyHandlerError, EmergencyResumeResponse, EmergencyStatusResponse, EmergencyStopRequest,
58    EmergencyStopResponse,
59};
60pub use evaluation::{EvaluateResponse, HealthResponse, SidecarStatus, VerifyReceiptResponse};
61pub use identity::{AuthMethod, CallerIdentity};
62pub use method::HttpMethod;
63pub use plan::{handle_evaluate_plan, PlanHandlerError};
64pub use receipt::{
65    http_status_metadata_decision, http_status_metadata_final, http_status_scope, HttpReceipt,
66    HttpReceiptBody, CHIO_DECISION_RECEIPT_ID_KEY, CHIO_HTTP_STATUS_SCOPE_DECISION,
67    CHIO_HTTP_STATUS_SCOPE_FINAL, CHIO_HTTP_STATUS_SCOPE_KEY, CHIO_KERNEL_RECEIPT_ID_KEY,
68};
69pub use regulatory_api::{
70    handle_regulatory_receipts_signed, sign_regulatory_export, verify_regulatory_export,
71    RegulatorIdentity, RegulatoryApiError, RegulatoryReceiptExport, RegulatoryReceiptQueryResult,
72    RegulatoryReceiptSource, RegulatoryReceiptsQuery, SignedRegulatoryReceiptExport,
73    MAX_REGULATORY_EXPORT_LIMIT, REGULATORY_RECEIPT_EXPORT_SCHEMA,
74};
75pub use request::ChioHttpRequest;
76pub use routes::{
77    approval_route_registrations, emergency_route_registrations, regulatory_route_registrations,
78    EmergencyRouteRegistration, APPROVALS_BATCH_RESPOND_PATH, APPROVALS_GET_PATH,
79    APPROVALS_PENDING_PATH, APPROVALS_RESPOND_PATH, COMPLIANCE_SCORE_PATH,
80    EMERGENCY_ADMIN_TOKEN_HEADER, EMERGENCY_RESUME_PATH, EMERGENCY_STATUS_PATH,
81    EMERGENCY_STOP_PATH, EVALUATE_PLAN_PATH, REGULATORY_RECEIPTS_PATH, REGULATORY_TOKEN_HEADER,
82};
83pub use session::SessionContext;
84pub use verdict::{DenyDetails, Verdict};
85
86// Re-export execution-nonce types so HTTP SDKs don't need to depend on
87// chio-kernel directly just to read the nonce off the response.
88pub use chio_kernel::{
89    ExecutionNonce, ExecutionNonceConfig, ExecutionNonceError, ExecutionNonceStore,
90    InMemoryExecutionNonceStore, NonceBinding, SignedExecutionNonce, EXECUTION_NONCE_SCHEMA,
91};
92
93// Re-export types from chio-core-types that HTTP adapters commonly need.
94pub use chio_core_types::canonical::{canonical_json_bytes, canonical_json_string};
95pub use chio_core_types::crypto::{Keypair, PublicKey, Signature};
96pub use chio_core_types::plan::{
97    PlanEvaluationRequest, PlanEvaluationResponse, PlanVerdict, PlannedToolCall, PlannedToolCallId,
98    StepVerdict, StepVerdictKind,
99};
100pub use chio_core_types::receipt::metadata::GuardEvidence;
101pub use chio_core_types::{sha256_hex, Error, Result};
chio_http_core/lib.rs

chio_http_core/
lib.rs
