atd_runtime/ucan/
mod.rs

1//! SP-capability-v2 UCAN-lite implementation.
2//!
3//! UCAN-lite is a profile of UCAN v1.0 narrowed for ATD's use case:
4//! - JWT compact form on the wire (not DAG-CBOR / CIDv1).
5//! - `alg = "EdDSA"`, `typ = "ucan/1.0+jwt"`, `ucv = "1.0"`.
6//! - `did:key` issuer / audience only (no `did:web`, no `did:plc`).
7//! - Capabilities tunneled as `cmd = "atd-cap"`, `args.caps: Vec<String>`,
8//!   `args.with: Vec<{patient: String}>` (or other binding kinds reserved).
9//!
10//! Phasing (per `docs/archive/superpowers/plans/2026-05-11-sp-capability-v2.md`):
11//! - Phase B.1 ([`parse`]): structural decoder; no signature, no chain walk.
12//! - Phase B.2 (`verify`, not yet landed): chain attenuation, signature
13//!   verification (Ed25519), audience pinning, depth limit, revocation
14//!   consultation. Lands in a follow-up commit on the same SP.
15//!
16//! Spec: `docs/archive/superpowers/specs/2026-05-11-sp-capability-v2-design.md` §4.1–§4.7
17
18pub mod error;
19pub mod parse;
20pub mod revocation;
21pub mod types;
22pub mod verify;
23
24pub use error::{UcanParseError, UcanVerifyError, wire_code};
25pub use parse::parse_jwt;
26pub use revocation::{InMemoryUcanRevocationStore, UcanRevocationStore};
27pub use types::{UcanCapability, UcanHeader, UcanPayload};
28pub use verify::{VerifyConfig, compute_cid, verify_jwt, verify_tokens};
atd_runtime/ucan/mod.rs

atd_runtime/ucan/
mod.rs
