wasm-capability-contract 0.3.0

//! [`EgressIdentity`] — which identity mechanism an egress call presents.

use serde::{Deserialize, Serialize};

/// Which identity mechanism an `Http`/`Grpc` egress call presents to its
/// target, decided statically when the [`crate::CapabilityGrant`] is
/// authored — never resolved dynamically at call time. See ADR-002
/// (agent-to-agent identity via edge-a2ac) and ADR-003 (control-plane and
/// M2M identity via SST) for what each variant actually wires to; this
/// port only carries the choice.
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(tag = "type", rename_all = "snake_case")]
pub enum EgressIdentity {
    /// Present an edge-a2ac `AgentIdentity`-bound certificate — the target
    /// is another A2A agent.
    A2ac {
        /// HTTPS URL where the target agent's signed A2A Agent Card is served.
        agent_card_url: String,
    },
    /// Present an SST machine-to-machine credential — the target is an
    /// ordinary internal service, not an A2A agent.
    SstM2m {
        /// The M2M client id this grant authenticates as, registered in `swe_iam`.
        client_id: String,
    },
}