pub mod authority;
pub mod canonical;
pub mod cgroup_id;
pub mod cross_host_chain;
pub mod crypto;
pub mod error;
pub mod events;
pub mod host_baseline;
pub mod hostname_allowlist;
pub mod noop_broker;
pub mod observability;
pub mod policy;
pub mod ports;
pub mod principal;
pub mod redaction;
#[cfg(feature = "pkcs11")]
pub mod signer_pkcs11;
pub mod spec_validation;
pub mod state_projection;
pub mod trust_keys;
pub mod types;
pub use canonical::{canonical_json_bytes, canonical_payload, CANONICAL_PAYLOAD_VERSION};
pub use cgroup_id::sanitize_cgroup_leaf_segment;
pub use cross_host_chain::{
build_chain_entry, entry_digest, verify_cross_host_chains, VerifiedCrossHostChains,
CROSS_HOST_ENTRY_TYPE, GENESIS_PREV_DIGEST,
};
pub use crypto::{
provider, provider_identity, CryptoError, CryptoProvider, ProviderIdentity,
TrustAnchorPublicKey,
};
pub use error::CellosError;
pub use events::{
admission_decision_data_v1, audit_reconciled_data_v1, authz_rejected_data_v1, cell_subject_urn,
cloud_event_v1_cortex_dispatched, cloud_event_v1_dns_authority_dnssec_failed,
cloud_event_v1_dns_authority_drift, cloud_event_v1_dns_authority_rebind_rejected,
cloud_event_v1_dns_authority_rebind_threshold, cloud_event_v1_dns_query,
cloud_event_v1_dns_query_permitted, cloud_event_v1_dns_query_refused,
cloud_event_v1_firecracker_pool_checkout, cloud_event_v1_keyset_verification_failed,
cloud_event_v1_keyset_verified, cloud_event_v1_network_flow_decision,
command_completed_data_v1, compliance_summary_data_v1, cortex_dispatched_data_v1,
dns_authority_dnssec_failed_data_v1, dns_authority_drift_data_v1,
dns_authority_rebind_rejected_data_v1, dns_authority_rebind_threshold_data_v1,
dns_query_data_v1, dns_query_permitted_data_v1, dns_query_refused_data_v1,
evidence_bundle_emitted_data_v1, export_completed_data_v1, export_completed_data_v2,
export_failed_data_v2, firecracker_pool_event_data_v1, homeostasis_signal_data_v1,
homeostasis_violation_data_v1, identity_failed_data_v1, identity_materialized_data_v1,
identity_materialized_data_v1_provisioned, identity_revoked_data_v1,
keyset_verification_failed_data_v1, keyset_verified_data_v1, lifecycle_destroyed_data_v1,
lifecycle_destroyed_data_v1_typed, lifecycle_started_data_v1, manifest_failed_data_v1,
network_flow_decision_data_v1, observability_container_security_data_v1,
observability_dns_resolution_data_v1, observability_dns_target_set_data_v1,
observability_fs_touch_export_data_v1, observability_l7_egress_decision_data_v1,
observability_network_enforcement_data_v1, observability_network_policy_data_v1,
observability_network_scope_data_v1, observability_process_spawned_data_v1,
policy_rejected_data_v1, AdmissionDecisionReason, EnforcementBinding, EvidenceBundleRefs,
IdentityFailureOperation, LifecycleDestroyOutcome, LifecycleReason, LifecycleResidueClass,
LifecycleTerminalState, Provenance, ProvisioningWitness, ResidueClass, SubjectUrn,
SubjectUrnError, ADMISSION_ALLOWED_TYPE, ADMISSION_REJECTED_TYPE, AUDIT_RECONCILED_TYPE,
LIFECYCLE_MANIFEST_FAILED_TYPE, TRUST_PLANE_AGGREGATE_EGRESS_FQDN,
TRUST_PLANE_BUILTIN_KEYSET_ID, TRUST_PLANE_BUILTIN_L7_KID, TRUST_PLANE_BUILTIN_RESOLVER_KID,
};
pub use host_baseline::{
host_baseline_event, probe_host_baseline, probe_host_baseline_with_forced,
sign_host_baseline_attestation, verify_host_baseline_attestation, BaselineControl,
HostBaselineAttestationV1, HOST_BASELINE_ATTESTATION_TYPE,
};
pub use noop_broker::NoopSecretBroker;
pub use policy::{
check_policy_pack_version_compatibility, spec_matches_placement_scope,
validate_authorization_policy, validate_policy_pack_document, validate_spec_against_policy,
AuthorizationPolicy, AuthorizationPolicyDocument, PolicyPackDocument, PolicyPackSpec,
PolicyRules, PolicyViolation, MIN_SUPPORTED_POLICY_PACK_VERSION, POLICY_ALLOW_DOWNGRADE_ENV,
};
pub use ports::{NoopExportSink, NoopInferenceBroker, RuntimeSecretLeaseRequest};
pub use principal::{
AuthorityScope, AuthorityScopeViolation, Capability, DelegateId, ExternalId, OperatorId,
PlatformId, Principal, PrincipalParseError, TrustRoot,
};
pub use redaction::{redact_url_credentials_for_logs, redact_url_if_echoed_in_text};
#[cfg(feature = "pkcs11")]
pub use signer_pkcs11::Pkcs11Signer;
pub use spec_validation::{
enforce_derivation_scope_policy, validate_execution_cell_document,
validate_tenant_id_for_subject_token, verify_authority_derivation,
verify_signed_trust_keyset_chain, verify_signed_trust_keyset_envelope,
};
pub use state_projection::{
CellStateProjection, CellStateSnapshot, ExportProjectionRecord, ProjectionCurrentState,
ProjectionExportStage, ProjectionIdentityStage, ProjectionLifecycleStage,
};
pub use trust_keys::{
canonical_event_signing_payload, load_revocation_list_file, load_trust_verify_keys_file,
parse_trust_verify_keys, sign_event_ed25519, sign_event_hmac_sha256, sign_event_with,
verify_and_parse_revocation_envelope, verify_signed_event_envelope,
verify_signed_event_envelope_with_revocations, SignedEventEnvelopeV1, Signer, SoftwareSigner,
};
pub use types::{
canonical_spec_hash, qtype_to_dns_query_type, AuthorityBundle, AuthorityCapability,
AuthorityComponent, AuthorityDerivationToken, AuthorityNarrowing, AuthoritySignature,
CdnAuthority, CdnProvider, CexAttributes, CloudEventV1, Correlation, DnsAuthority,
DnsAuthorityDnssecFailed, DnsAuthorityDnssecFailureReason, DnsAuthorityDrift,
DnsAuthorityRebindRejected, DnsAuthorityRebindThreshold, DnsQueryDecision, DnsQueryEvent,
DnsQueryReasonCode, DnsQueryType, DnsRebindingPolicy, DnsRefreshPolicy, DnsRefreshStrategy,
DnsResolver, DnsResolverDnssecPolicy, DnsResolverProtocol, EgressRule, EnvironmentSpec,
ExecutionCellDocument, ExecutionCellSpec, ExportArtifact, ExportArtifactMetadata,
ExportChannels, ExportReceipt, ExportReceiptTargetKind, ExportTarget, GitIngress,
HomeostasisSignal, HttpExportTarget, InferenceMessage, InferenceRequest, InferenceResponse,
InferenceRole, Ingress, Lifetime, NetworkFlowDecision, NetworkFlowDecisionOutcome,
NetworkFlowDirection, OciImageIngress, PlacementSpec, PolicyRef, RoleId, RunCpuMax, RunLimits,
RunSpec, S3ExportTarget, SecretDeliveryMode, SecretView, SignedTrustKeysetEnvelope,
TelemetryChannel, TelemetrySpec, TrustKeysetSignature, WorkloadIdentity, WorkloadIdentityKind,
};