wasm_capability_contract/capability/vo/egress_identity.rs
1//! [`EgressIdentity`] — which identity mechanism an egress call presents.
2
3use serde::{Deserialize, Serialize};
4
5/// Which identity mechanism an `Http`/`Grpc` egress call presents to its
6/// target, decided statically when the [`crate::CapabilityGrant`] is
7/// authored — never resolved dynamically at call time. See ADR-002
8/// (agent-to-agent identity via edge-a2ac) and ADR-003 (control-plane and
9/// M2M identity via SST) for what each variant actually wires to; this
10/// port only carries the choice.
11#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
12#[serde(tag = "type", rename_all = "snake_case")]
13pub enum EgressIdentity {
14 /// Present an edge-a2ac `AgentIdentity`-bound certificate — the target
15 /// is another A2A agent.
16 A2ac {
17 /// HTTPS URL where the target agent's signed A2A Agent Card is served.
18 agent_card_url: String,
19 },
20 /// Present an SST machine-to-machine credential — the target is an
21 /// ordinary internal service, not an A2A agent.
22 SstM2m {
23 /// The M2M client id this grant authenticates as, registered in `swe_iam`.
24 client_id: String,
25 },
26}