Struct Capability 

pub struct Capability { /* private fields */ }

A specific permission granted to an agent.

Implementations

impl Capability

pub fn builder() -> CapabilityBuilder

Create a new capability builder.

pub fn id(&self) -> CapabilityId

Get the capability ID.

pub fn kind(&self) -> &CapabilityKind

Get the capability kind.

pub fn scope(&self) -> &ResourceScope

Get the resource scope.

pub fn constraints(&self) -> &CapabilityConstraints

Get the constraints.

pub fn constraints_mut(&mut self) -> &mut CapabilityConstraints

Get mutable constraints (for usage tracking).

pub fn grantor(&self) -> &PrincipalId

Get the grantor.

pub fn granted_at(&self) -> i64

Get when this was granted.

pub fn expires_at(&self) -> Option<i64>

Get when this expires.

pub fn is_delegatable(&self) -> bool

Check if this capability is delegatable.

pub fn max_delegation_depth(&self) -> u32

Get maximum delegation depth.

pub fn signature(&self) -> &Sig

Get the signature.

pub fn delegation_depth(&self) -> u32

Get the current delegation depth (0 for root capabilities).

pub fn parent_capability_id(&self) -> Option<CapabilityId>

Get the parent capability ID (for delegated capabilities).

pub fn revoke(&mut self, reason: impl Into<String>)

Revoke this capability with a reason.

pub fn is_revoked(&self) -> bool

Check if this capability has been revoked.

pub fn revoked_at(&self) -> Option<i64>

Get the revocation timestamp if revoked.

pub fn revocation_reason(&self) -> Option<&str>

Get the revocation reason if revoked.

pub fn lifecycle_state(&self, now_ms: i64) -> CapabilityState

Get the lifecycle state at a given time per Section 5.4.

pub fn is_valid_at(&self, timestamp: i64) -> bool

Check if this capability is valid at a given time.

A capability is valid if it is not revoked and not expired.

pub fn matches( &self, action_kind: &CapabilityKind, resource: &ResourceId, ) -> bool

Check if this capability matches an action.

pub fn canonical_bytes(&self) -> Vec<u8>

Compute the canonical bytes for signing/verification.

pub fn hash(&self) -> Hash

Compute the hash of this capability.

pub fn delegate( &self, delegator_key: &SecretKey, scope: Option<ResourceScope>, expiry: Option<Duration>, ) -> Result<Capability>

Delegate this capability to another agent, creating a child capability.

Enforces:

• INV-CAP-3: child scope must be a subset of parent scope, child expiry must not exceed parent
• INV-CAP-4: delegation depth must not exceed max_delegation_depth
• Rule 5.3.3: delegated capabilities must be a subset of the delegator’s

Trait Implementations

impl Clone for Capability

fn clone(&self) -> Capability

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Capability

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Capability

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for Capability

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.