Module grants 

Client side of SPEC-WRITE-GRANTS: the user grant store, owner signing and the local statement checks behind mkit grant, mkit epoch and mkit visibility.

Nothing here is repository-scoped. The store lives beside the user config, the relying-party pins come from the user config, and every header is verified with the mkit-attest verifier before it is stored or sent (SPEC-CONFIG-SECURITY; WP-2.13).

Modules

cli

What mkit grant, mkit epoch and mkit visibility share: loading the layered config and relying-party pins, choosing an owner-signing plan, opening the remote, and printing.

owner

Owner signing for mkit grant create, mkit epoch bump and mkit visibility set (WP-2.13, R-155).

remote

Picking the remote a grant, epoch or visibility command talks to, the audience it signs for, and waiting for the server to finish (WP-2.14).

spec

Turning command-line spellings into the canonical statements of SPEC-WRITE-GRANTS §3, §5.1 and §9.1.

store

The user grant store (WP-2.13, R-155).

Structs

VerifiedGrantHeader

A grant header whose owner signature verified.

Enums

HeaderError

Why a header could not be verified locally.

Functions

now_ms

Milliseconds since the Unix epoch.

parse_relying_parties

Parse grant.webauthn_rp entries (<rp_id> <origin>..., several entries separated by |).

read_bounded

Read at most max bytes from reader.

scope_text

<namespace>/* or <namespace>/<name>: the repositories a grant covers.

verify_epoch_header

SPEC-WRITE-GRANTS §5.2 checks 1–5 against the statement’s first audience.

verify_grant_header

SPEC-WRITE-GRANTS §7 steps 1, 3 and 4 for a grant header.

verify_visibility_header

SPEC-WRITE-GRANTS §9.1 checks for a visibility statement sent for repository, against the statement’s first audience.