Struct TokenDelegateHook 

pub struct TokenDelegateHook;

Token-delegation hook.

Payload (DelegationPayload) — unified input + accumulator. The outbound caller (typically a forwarding-proxy plugin) populates the input fields (bearer_token, target_name, target_audience, required_permissions, …) and invokes the hook; handlers populate the output fields (delegated_token, delegation_update, metadata) on clones of the running payload. Input fields are private and read through accessors — handlers cannot mutate them even on a clone, so the delegation context is canonical across the chain.

Result (PluginResult<DelegationPayload>) — the executor’s standard envelope. modified_payload carries the updated payload. continue_processing = false halts the pipeline (handler decided no credential can be minted — e.g. the inbound token’s scopes don’t cover the target’s required permissions).

Threading. Sequential-phase semantics already thread handler N’s modified_payload into handler N+1’s input, so the chain’s natural behavior is “each handler sees the prior handler’s contributions in the running payload.” Most deployments will register exactly one TokenDelegate handler (RFC 8693 exchanger, UCAN minter, …), but chaining works for hybrid setups — e.g. a passthrough fallback that fires only when the primary exchanger declined.

Handler signature:

impl HookHandler<TokenDelegateHook> for RfcExchanger {
    async fn handle(
        &self,
        payload: &DelegationPayload,
        _ext: &Extensions,
        _ctx: &mut PluginContext,
    ) -> PluginResult<DelegationPayload> {
        let minted = self
            .exchange(payload.bearer_token(), payload.target_audience())
            .await?;
        let mut updated = payload.clone();
        updated.delegated_token = Some(minted);
        PluginResult::modify_payload(updated)
    }
}

Registration: manager.register_handler_for_names::<TokenDelegateHook, _>(plugin, config, &["token.delegate"]). register_handler::<TokenDelegateHook, _> alone registers under the marker’s NAME (“token”) which is the hook family, not the specific hook name — register_handler_for_names (or the unified-name path) is the right call.

Trait Implementations

impl HookTypeDef for TokenDelegateHook

const NAME: &'static str = "token.delegate"

Hook name — used as the registry key and in config YAML.

type Payload = DelegationPayload

The typed payload that handlers receive. Must implement PluginPayload (Clone + Send + Sync + ’static).

type Result = PluginResult<DelegationPayload>

The typed result that handlers return.