Module signing 

Contract-owned request-signing bytes and header vocabulary.

Structs

GrantEnvelopeV2Payload

The fields covered by a GrantEnvelope v2 server signature.

GrantEnvelopeV2Right

One ordered right in a GrantEnvelope v2 canonical payload.

Enums

GrantEnvelopeV2CodecError

A fail-closed GrantEnvelope v2 canonical-payload codec error.

Constants

BISCUIT_AUTHORITY_PUBLIC_KEY_ROLE

Exact signed/wire role label for the ephemeral Biscuit authority key.

DEVICE_PROOF_PUBLIC_KEY_ROLE

Exact signed/wire role label for the non-extractable device proof key.

GRANT_ENVELOPE_V2_DOMAIN

Domain prepended to every server-signed GrantEnvelope v2 canonical payload.

GRANT_ENVELOPE_V2_FORMAT_VERSION

Signed format discriminator immediately following the GrantEnvelope domain.

HEADER_ACTION_URL

HEADER_ALGORITHM

HEADER_IDENTITY

HEADER_NONCE_BIN

HEADER_REQUIRED

HEADER_SIGNATURE_BIN

HEADER_TIMESTAMP

HEADER_WEBAUTHN_AUTH_DATA_BIN

HEADER_WEBAUTHN_CLIENT_DATA_BIN

HEADER_WEBAUTHN_USER_HANDLE_BIN

IDENTITY_BINDING_CHALLENGE_V2_DOMAIN

Domain for the WebAuthn assertion that binds both client-minted session signing roles. Includes its terminal NUL byte.

ONE_KEY_DEVICE_BINDING_CHALLENGE_DOMAIN

Domain separator for the one-key passkey↔device-key binding challenge introduced by weft#2047 (possession-first identity, two-key model retired). Promoted here from weft-local weft-authz::webauthn so weft, heddle, and tapestry share ONE definition. Unlike the -v2 NUL-terminated domains, this value is the bare string with NO terminal NUL: the challenge framing inserts an explicit 0x00 separator between the domain and the key. This matches weft’s ONE_KEY_DEVICE_BINDING_CHALLENGE_DOMAIN byte-for-byte.

POP_DELEGATION_V1_DOMAIN

Domain owned authoritatively by Weft’s strict pop_delegation verifier. Mirrored here so Rust and TypeScript producers cannot drift.

PROVIDER_PLAN_DOMAIN

RECOVERY_NEW_DEVICE_POP_V1_DOMAIN

Domain separator for the recovery new-device-key proof-of-possession (weft#2047 leg 2). Distinct from the credential-rotation (heddle-credential- rotation-v1) and SA-issuance (heddle-sa-credential-issue-v1) PoP domains so a signature captured against one RPC cannot be replayed against another. Bare string with explicit 0x00 field separators, matching that PoP family.

TIER_1_REQUEST_SIGNING_V1_DOMAIN

Deployed domain for Tier-1 request signatures. This legacy v1 value predates the terminal-NUL convention and MUST remain byte-for-byte stable.

TRANSPORT_BOOTSTRAP_SIGNING_V1_DOMAIN

Deployed domain used by endpoint-descriptor and relay-admission bootstrap signatures. It currently has the same bytes as request signing, but remains a separate constant so the two protocol purposes cannot drift implicitly.

Functions

endpoint_descriptor_bytes

Returns the domain-separated bytes signed for an HTTPS endpoint descriptor.

grant_envelope_v2_canonical_payload

Encodes the exact bytes that a GrantEnvelope v2 issuer signs.

identity_binding_challenge_v2_bytes

Returns the exact WebAuthn challenge bytes that bind both client-minted session roles. The array types pin both keys to raw 32-byte Ed25519 public keys; callers base64url-encode the returned bytes without padding for clientDataJSON.challenge.

one_key_device_binding_challenge

Computes the one-key passkey binding challenge string (weft#2047).

parse_grant_envelope_v2_canonical_payload

Parses one complete GrantEnvelope v2 canonical payload without fallback.

provider_plan_bytes

Returns the canonical bytes signed to consent to one exact provider batch.

recovery_new_device_pop_digest

Returns the 32-byte digest the NEW device key signs to prove possession during recovery completion (weft#2047 leg 2).

relay_admission_bytes

Returns the domain-separated bytes signed for a relay admission token.

retry_key_hash

Hashes the retry identity without conflating it with the request payload.

stream_open_bytes

Returns the canonical bytes signed by the opening frame of a stream.

unary_bytes

Returns the canonical bytes signed for a unary request.