openagent_auth_protocol/
lib.rs

1// Copyright (c) 2026 L1fe Labs, Inc. — Apache-2.0 OR MIT
2//! `openagent-auth-protocol` — the transport-agnostic type layer for the
3//! **OpenAgent Core Protocol** identity flow.
4//!
5//! # This crate implements a specification; it does not define one
6//!
7//! The normative protocol document is the OpenAgent Core Protocol
8//! Specification (`openagents/openagent.id/OPENAGENT-CORE-SPEC.md`):
9//! abstract messages in Section 15, transport bindings in Section 16. If this
10//! crate disagrees with the specification, the specification is correct.
11//!
12//! # Identity flow (Section 15.1)
13//!
14//! 1. **IdentityChallenge** — the server issues a cryptographic challenge
15//!    (`openagent-challenge-v1`: nonce, timestamp, origin, optional realm)
16//! 2. **IdentityProof** — the agent signs the JCS-canonicalized (RFC 8785)
17//!    challenge bytes with its DID key
18//! 3. **IdentityVerified** — the server confirms identity and issues a
19//!    session token
20//!
21//! Concrete transports (HTTP, WebSocket, Weave) implement
22//! [`transport::AuthTransport`].
23//!
24//! # History
25//!
26//! This crate was previously "OAAP", a separate 4-step mutual-authentication
27//! protocol (PRESENT / CHALLENGE / PROVE / ESTABLISHED with an embedded
28//! lineage push and BLAKE3 tuple hashing) that diverged from the Core
29//! Protocol while claiming adjacency to it — and for a stretch did not
30//! compile at all (its two error enums disagreed). The Core Protocol is the
31//! one normative authentication protocol for the stack; the old vocabulary
32//! is retired.
33//!
34//! Lineage presentation is deliberately not part of this flow: the agent
35//! presents a proof of key possession, and the *server* resolves the DID
36//! document and evaluates lineage with its own trust policy (and, for
37//! privileged authority, the OAS lineage contracts). A protocol that lets
38//! the caller push its own proofs trades server-side verification for
39//! caller-side assertion.
40
41#![forbid(unsafe_code)]
42#![deny(missing_docs)]
43#![deny(rust_2018_idioms)]
44
45pub mod error;
46pub mod handshake;
47pub mod message;
48pub mod session;
49pub mod transport;
50pub mod types;
51
52pub use error::AuthProtocolError;
53pub use message::{
54    IdentityChallenge, IdentityProof, IdentityVerified, KeyType, TrustTier, CHALLENGE_TYPE,
55};
56pub use session::{InMemorySessionStore, Session, SessionId, SessionState, SessionStore};
57pub use transport::AuthTransport;
58pub use types::{ConformanceLevel, DidDocument, DiscoveryDocument, LineageLink, LineageProof};
59
60/// Crate version.
61pub const VERSION: &str = env!("CARGO_PKG_VERSION");
openagent_auth_protocol/lib.rs

openagent_auth_protocol/
lib.rs
