Skip to content
OpenFirma OpenFirma
Blog

v1

Module: v1

Section titled “Module: v1”

Contents

Section titled “Contents”

Modules

Structs

  • ActionMappingRule - ActionMappingRule is a normalized effective matcher, not a TOML set rule.
  • ActionMappingSnapshot - ActionMappingSnapshot contains all effective rules selected by the Authority.
  • CapabilityToken - CapabilityToken represents a signed, scoped, time-bounded permission
  • ConnectorResponse - ConnectorResponse wraps the response from an external system after
  • DbQueryParams - DbQueryParams carries parameters for a database query action.
  • DeniedApproval - DeniedApproval: an operator denied the request. Terminal; no token exists.
  • ExecutionEnvelope - ExecutionEnvelope is the core protocol unit of the Firma system.
  • ExecutionEvent - ExecutionEvent is the immutable audit record for a single enforcement
  • ExecutionIntent - ExecutionIntent describes the action the agent wants to perform.
  • ExecutionMetadata - ExecutionMetadata carries session and runtime context for an execution.
  • ExpiredApproval - ExpiredApproval: the request expired before a decision. Terminal; no token
  • GetApprovalOutcomeRequest - GetApprovalOutcomeRequest polls the outcome of one pending approval.
  • GetApprovalOutcomeResponse - GetApprovalOutcomeResponse carries exactly one pending or terminal outcome.
  • GrantedApproval - GrantedApproval: an operator approved the request and the Authority issued
  • HttpParams - HttpParams carries parameters for an HTTP action.
  • IssueCapabilityRequest - IssueCapabilityRequest carries the agent’s identity and requested scope
  • IssueCapabilityResponse - IssueCapabilityResponse returns the outcome of an issuance evaluation: a
  • PendingApproval - PendingApproval: no decision yet; poll again.
  • PolicyBundle - PolicyBundle is one complete, immutable enforcement snapshot distributed from
  • PolicyBundleUpdate - PolicyBundleUpdate is everything the Authority pushes to one agent’s Sidecar:
  • PolicySetDescriptor - PolicySetDescriptor identifies the policy set a bundle was composed from.
  • RevocationEvent - RevocationEvent is one member of a RevocationSet: the invalidation of a
  • RevocationSet - RevocationSet is the complete set of revocations the Authority holds for a
  • SidecarCredentials - SidecarCredentials are the credentials a Sidecar presents on every Authority
  • StreamEventsResponse - Delivery receipt: returned after SubmitEvent, or after the legacy stream
  • ToolUseParams - ToolUseParams carries parameters for an agent tool invocation.
  • WatchPolicyBundleRequest - WatchPolicyBundleRequest initiates a policy bundle subscription.
  • WatchRevocationsRequest - WatchRevocationsRequest initiates a revocation set subscription.

Enums

  • EnforcementDecision - EnforcementDecision is the outcome of Sidecar evaluation. Conforms to
  • IssueDecision - IssueDecision is the tri-state outcome of an IssueCapability evaluation.
  • PolicyBundleCapability - PolicyBundleCapability describes behavior supported by a bundle consumer.
  • TokenFormat - TokenFormat identifies the encoding format of a capability token.

firma_protobuf::v1::ActionMappingRule

Section titled “firma_protobuf::v1::ActionMappingRule”

Struct

ActionMappingRule is a normalized effective matcher, not a TOML set rule. Hosts include composed subdomains and use OpenFirma normalization and '' wildcard semantics, including ports, IPv4, and bracketed IPv6. The canonical mapping domain and ActionClass catalog own validation, not protobuf decoding. Explicit digit/'' port patterns contain at most five characters and retain their scope; normalization must not turn authored patterns into catch-alls.

Fields:

  • method: ::core::option::Option<::prost::alloc::string::String> - Absence means any method. Present values must be a supported uppercase
  • host: ::prost::alloc::string::String - Full normalized host pattern, never a relative subdomain. Empty is invalid.
  • path: ::core::option::Option<::prost::alloc::string::String> - Absence means any path. A present ’*’ remains distinct from absence for
  • action_class: ::prost::alloc::string::String - Canonical firma_core::ActionClass identifier; unknown/empty values fail closed.

Methods:

  • fn method(self: &Self) -> &str - Returns the value of method, or the default value if method is unset.
  • fn path(self: &Self) -> &str - Returns the value of path, or the default value if path is unset.

Traits: Eq

Trait Implementations:

  • Clone
    • fn clone(self: &Self) -> Self
  • Default
    • fn default() -> Self
  • PartialEq
    • fn eq(self: &Self, other: &Self) -> bool
  • Hash
    • fn hash<__H>(self: &Self, state: & mut __H)
  • Debug
    • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
  • Message
    • fn encoded_len(self: &Self) -> usize
    • fn clear(self: & mut Self)

firma_protobuf::v1::ActionMappingSnapshot

Section titled “firma_protobuf::v1::ActionMappingSnapshot”

Struct

ActionMappingSnapshot contains all effective rules selected by the Authority. Mini-authority uses configured file order, then rule position; Team uses rules from enabled workspace mapping sets, ordered by normalized owner host and authored rule position. Disabled sets contribute no rules; set IDs, names, and authored metadata are not runtime inputs. Receivers apply OpenFirma specificity ordering stably, preserving this order for ties. This payload has no independent version or TTL: PolicyBundle owns freshness and atomic consistency for every component.

Fields:

  • format_version: u32 - Must be 1 for this contract. Zero and unknown versions are invalid.
  • rules: ::prost::alloc::vec::Vec<ActionMappingRule> - Complete rules, including an empty list when no sets are enabled.
  • default_protected: bool - Must be true in managed mode, including when rules is empty. False (the

Trait Implementations:

  • Default
    • fn default() -> Self
  • Clone
    • fn clone(self: &Self) -> Self
  • PartialEq
    • fn eq(self: &Self, other: &Self) -> bool
  • Debug
    • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
  • Message
    • fn encoded_len(self: &Self) -> usize
    • fn clear(self: & mut Self)

firma_protobuf::v1::CapabilityToken

Section titled “firma_protobuf::v1::CapabilityToken”

Struct

CapabilityToken represents a signed, scoped, time-bounded permission granted to an agent for a specific action class.

Issued by the Authority before execution begins. Defines the permission perimeter: the Sidecar enforces constraints within it but cannot extend or override it.

Fields:

  • token_id: ::prost::alloc::string::String - Unique identifier for tracking and revocation lookups.
  • agent_id: ::prost::alloc::string::String - Identity of the agent this token was issued to.
  • session_id: ::prost::alloc::string::String - Session within which this token is valid.
  • action_set: ::prost::alloc::vec::Vec<::prost::alloc::string::String> - Set of actions this token authorizes (e.g., [“http_get”, “db_read”]).
  • resource_scope: ::prost::alloc::string::String - Resource scope this token covers (e.g., “api.example.com/*”).
  • issued_at: ::core::option::Option<::prost_types::Timestamp> - When this token was issued.
  • expiry: ::core::option::Option<::prost_types::Timestamp> - When this token expires. After expiry, the agent must call
  • context_hash: ::prost::alloc::string::String - Integrity hash of the Cedar context used at issuance.
  • signature: ::prost::alloc::vec::Vec<u8> - The raw signed token bytes.
  • format: i32 - Token encoding format.
  • policy_bundle_version: ::core::option::Option<::prost::alloc::string::String> - Policy bundle version at issuance time. Used for audit reconstruction.
  • approver_id: ::core::option::Option<::prost::alloc::string::String> - operator_id of the human who approved this capability, set only when the
  • approval_id: ::core::option::Option<::prost::alloc::string::String> - Approval record id bound to this capability, set only when the HITL path

Methods:

  • fn format(self: &Self) -> TokenFormat - Returns the enum value of format, or the default if the field is set to an invalid enum value.
  • fn set_format(self: & mut Self, value: TokenFormat) - Sets format to the provided enum value.
  • fn policy_bundle_version(self: &Self) -> &str - Returns the value of policy_bundle_version, or the default value if policy_bundle_version is unset.
  • fn approver_id(self: &Self) -> &str - Returns the value of approver_id, or the default value if approver_id is unset.
  • fn approval_id(self: &Self) -> &str - Returns the value of approval_id, or the default value if approval_id is unset.

Traits: Eq

Trait Implementations:

  • Default
    • fn default() -> Self
  • PartialEq
    • fn eq(self: &Self, other: &Self) -> bool
  • Hash
    • fn hash<__H>(self: &Self, state: & mut __H)
  • Debug
    • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
  • Message
    • fn encoded_len(self: &Self) -> usize
    • fn clear(self: & mut Self)
  • Clone
    • fn clone(self: &Self) -> Self

firma_protobuf::v1::ConnectorResponse

Section titled “firma_protobuf::v1::ConnectorResponse”

Struct

ConnectorResponse wraps the response from an external system after the Connector translates and forwards the ExecutionEnvelope.

Connectors apply technical constraints only (rate limits, schema validation, protocol translation). Business logic and authorization must remain in Cedar / Authority / Sidecar. A connector that becomes a second policy engine breaks auditability and system guarantees.

Fields:

  • status_code: i32
  • body: ::prost::alloc::vec::Vec<u8>
  • headers: ::std::collections::HashMap<::prost::alloc::string::String, ::prost::alloc::string::String>
  • latency_micros: i64
  • response_size_bytes: i64

Trait Implementations:

  • Default
    • fn default() -> Self
  • Clone
    • fn clone(self: &Self) -> Self
  • PartialEq
    • fn eq(self: &Self, other: &Self) -> bool
  • Debug
    • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
  • Message
    • fn encoded_len(self: &Self) -> usize
    • fn clear(self: & mut Self)

firma_protobuf::v1::DbQueryParams

Section titled “firma_protobuf::v1::DbQueryParams”

Struct

DbQueryParams carries parameters for a database query action.

Fields:

  • query_name: ::prost::alloc::string::String - Named query identifier — no raw SQL allowed.
  • bindings: ::std::collections::HashMap<::prost::alloc::string::String, ::prost::alloc::string::String> - Bound parameters — scalar values only, keyed by placeholder name.
  • db_name: ::prost::alloc::string::String - Target database name.
  • read_only: bool - Hint for policy: is this a read-only query?

Trait Implementations:

  • Default
    • fn default() -> Self
  • Clone
    • fn clone(self: &Self) -> Self
  • PartialEq
    • fn eq(self: &Self, other: &Self) -> bool
  • Debug
    • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
  • Message
    • fn encoded_len(self: &Self) -> usize
    • fn clear(self: & mut Self)

firma_protobuf::v1::DeniedApproval

Section titled “firma_protobuf::v1::DeniedApproval”

Struct

DeniedApproval: an operator denied the request. Terminal; no token exists.

Traits: Eq, Copy

Trait Implementations:

  • PartialEq
    • fn eq(self: &Self, other: &Self) -> bool
  • Clone
    • fn clone(self: &Self) -> Self
  • Hash
    • fn hash<__H>(self: &Self, state: & mut __H)
  • Debug
    • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
  • Message
    • fn encoded_len(self: &Self) -> usize
    • fn clear(self: & mut Self)
  • Default
    • fn default() -> Self

firma_protobuf::v1::EnforcementDecision

Section titled “firma_protobuf::v1::EnforcementDecision”

Enum

EnforcementDecision is the outcome of Sidecar evaluation. Conforms to AARM R4 (https://aarm.dev/spec): ALLOW/DENY/ABORT/MODIFY/STEP_UP/DEFER. A 0 (UNSPECIFIED) value is reserved and must never be emitted by the Sidecar; receivers should treat it as a protocol error.

Variants:

  • Unspecified
  • Allow - ALLOW — envelope forwarded to Connector.
  • Deny - DENY — call blocked, structured response returned to agent.
  • Abort - ABORT — mid-flight kill sent to agent and Connector.
  • Modify - MODIFY — envelope forwarded to Connector with a modification applied
  • StepUp - STEP_UP — call blocked pending stronger authentication. The agent must
  • Defer - DEFER — call blocked pending asynchronous approval (human-in-the-loop).

Methods:

  • fn as_str_name(self: &Self) -> &'static str - String value of the enum field names used in the ProtoBuf definition.
  • fn from_str_name(value: &str) -> ::core::option::Option<Self> - Creates an enum from field names used in the ProtoBuf definition.
  • fn is_valid(value: i32) -> bool - Returns true if value is a variant of EnforcementDecision.
  • fn from_i32(value: i32) -> ::core::option::Option<EnforcementDecision> - Converts an i32 to a EnforcementDecision, or None if value is not a valid variant.

Traits: Copy, Eq

Trait Implementations:

  • TryFrom
    • fn try_from(value: i32) -> ::core::result::Result<EnforcementDecision, ::prost::UnknownEnumValue>
  • Clone
    • fn clone(self: &Self) -> Self
  • Default
    • fn default() -> EnforcementDecision
  • PartialOrd
    • fn partial_cmp(self: &Self, other: &Self) -> $crate::option::Option<$crate::cmp::Ordering>
  • Debug
    • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
  • PartialEq
    • fn eq(self: &Self, other: &Self) -> bool
  • Ord
    • fn cmp(self: &Self, other: &Self) -> $crate::cmp::Ordering
  • Hash
    • fn hash<__H>(self: &Self, state: & mut __H)

firma_protobuf::v1::ExecutionEnvelope

Section titled “firma_protobuf::v1::ExecutionEnvelope”

Struct

ExecutionEnvelope is the core protocol unit of the Firma system.

Every outbound call from an agent is represented as a distinct ExecutionEnvelope, evaluated independently by the Sidecar. Each request is evaluated, enforced, and audited as an ExecutionEnvelope.

Treated as immutable once created — any enrichment (e.g., credential injection) produces a derived structure, not a mutation.

Fields:

  • intent: ::core::option::Option<ExecutionIntent> - The action the agent intends to perform.
  • capability: ::prost::alloc::string::String - Capability token string (PASETO v4 or JWT RS256) as issued by the Authority.
  • metadata: ::core::option::Option<ExecutionMetadata> - Session and runtime metadata.
  • provenance: ::core::option::Option<::prost::alloc::string::String> - Provenance: reserved, nullable field.

Methods:

  • fn provenance(self: &Self) -> &str - Returns the value of provenance, or the default value if provenance is unset.

Trait Implementations:

  • Default
    • fn default() -> Self
  • Clone
    • fn clone(self: &Self) -> Self
  • PartialEq
    • fn eq(self: &Self, other: &Self) -> bool
  • Debug
    • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
  • Message
    • fn encoded_len(self: &Self) -> usize
    • fn clear(self: & mut Self)

firma_protobuf::v1::ExecutionEvent

Section titled “firma_protobuf::v1::ExecutionEvent”

Struct

ExecutionEvent is the immutable audit record for a single enforcement decision. Every field before signature is covered by the ECDSA signature, making the event independently verifiable.

Fields:

  • event_id: ::prost::alloc::string::String - Unique event identifier (UUID v7 — time-ordered).
  • session_id: ::prost::alloc::string::String - Session that produced this event.
  • token_id: ::prost::alloc::string::String - Capability token ID evaluated during enforcement.
  • agent_id: ::prost::alloc::string::String - Agent that initiated the action.
  • action: ::prost::alloc::string::String - Canonical action class from the normalizer (e.g., “http_get”).
  • resource: ::prost::alloc::string::String - Target resource identifier (e.g., URL, table name).
  • decision: i32 - Enforcement outcome.
  • deny_reason: ::prost::alloc::string::String - Human-readable reason when decision is DENY or ABORT. Empty on ALLOW.
  • enforcement_latency_us: i64 - Wall-clock time spent in the enforcement pipeline, in microseconds.
  • context_hash: ::prost::alloc::string::String - Integrity hash of the Cedar context used during evaluation.
  • bundle_version: ::prost::alloc::string::String - Policy bundle version active at decision time.
  • timestamp: ::core::option::Option<::prost_types::Timestamp> - Event timestamp with nanosecond precision.
  • signature: ::prost::alloc::vec::Vec<u8> - ECDSA signature (DER-encoded) over all preceding fields.
  • dispatch_status: i32 - HTTP status code returned by the connector. Zero when the call
  • dispatch_latency_us: i64 - Wall-clock time spent in the connector dispatch, in microseconds.
  • response_size: i64 - Target response body size in bytes. Zero when the call never
  • sandbox_id: ::prost::alloc::string::String - Per-run identity that scopes this event to a single firma run
  • provenance: ::prost::alloc::string::String - Tamper-evident provenance chain anchor (AARM R2 G2) for admitted
  • thread_id: ::prost::alloc::string::String - Server-derived conversation thread identity (AARM R2 G2) for admitted
  • parent_action_id: ::prost::alloc::string::String - Server-derived parent action identity (AARM R2 G2): the provenance
  • run_evidence: ::core::option::Option<::prost::alloc::vec::Vec<u8>> - Opaque per-event run evidence. Absence is unknown attribution; present but

Methods:

  • fn decision(self: &Self) -> EnforcementDecision - Returns the enum value of decision, or the default if the field is set to an invalid enum value.
  • fn set_decision(self: & mut Self, value: EnforcementDecision) - Sets decision to the provided enum value.
  • fn run_evidence(self: &Self) -> &[u8] - Returns the value of run_evidence, or the default value if run_evidence is unset.

Traits: Eq

Trait Implementations:

  • Clone
    • fn clone(self: &Self) -> Self
  • Default
    • fn default() -> Self
  • PartialEq
    • fn eq(self: &Self, other: &Self) -> bool
  • Hash
    • fn hash<__H>(self: &Self, state: & mut __H)
  • Debug
    • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
  • Message
    • fn encoded_len(self: &Self) -> usize
    • fn clear(self: & mut Self)

firma_protobuf::v1::ExecutionIntent

Section titled “firma_protobuf::v1::ExecutionIntent”

Struct

ExecutionIntent describes the action the agent wants to perform. The oneof params field enforces that exactly one action kind is present, with schema validation at the proto level — no arbitrary key-value blobs.

Fields action_class, raw_transport, and raw_action_ref mirror the core ExecutionIntent struct and FEP §2.1: Stage 2 policy rules bind to action_class and resource (FEP [I-N1]); raw_transport and raw_action_ref are observational only and must not drive policy decisions.

Fields:

  • resource: ::std::collections::HashMap<::prost::alloc::string::String, ::prost::alloc::string::String> - Target resource attribute map. Conventional keys: “host”, “path”,
  • action_class: ::prost::alloc::string::String - Canonical action class from the v0.1 registry (e.g.,
  • raw_transport: ::prost::alloc::string::String - Original transport protocol (e.g., “http”, “https”, “grpc”, “exec”).
  • raw_action_ref: ::prost::alloc::string::String - Original request signature for traceability (e.g.,
  • params: ::core::option::Option<execution_intent::Params> - Typed action parameters — only one action kind is valid per intent.

Trait Implementations:

  • Default
    • fn default() -> Self
  • Clone
    • fn clone(self: &Self) -> Self
  • PartialEq
    • fn eq(self: &Self, other: &Self) -> bool
  • Debug
    • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
  • Message
    • fn encoded_len(self: &Self) -> usize
    • fn clear(self: & mut Self)

firma_protobuf::v1::ExecutionMetadata

Section titled “firma_protobuf::v1::ExecutionMetadata”

Struct

ExecutionMetadata carries session and runtime context for an execution.

Fields:

  • session_id: ::prost::alloc::string::String
  • agent_id: ::prost::alloc::string::String
  • timestamp: ::core::option::Option<::prost_types::Timestamp>
  • trace_id: ::core::option::Option<::prost::alloc::string::String>
  • risk_score: ::core::option::Option<f64> - Static or pre-computed risk attribute. V1 does not compute risk dynamically;
  • thread_id: ::core::option::Option<::prost::alloc::string::String> - Server-derived conversation thread identity (AARM R2 G2). Groups
  • parent_action_id: ::core::option::Option<::prost::alloc::string::String> - Server-derived parent action identity (AARM R2 G2). The provenance

Methods:

  • fn trace_id(self: &Self) -> &str - Returns the value of trace_id, or the default value if trace_id is unset.
  • fn risk_score(self: &Self) -> f64 - Returns the value of risk_score, or the default value if risk_score is unset.
  • fn thread_id(self: &Self) -> &str - Returns the value of thread_id, or the default value if thread_id is unset.
  • fn parent_action_id(self: &Self) -> &str - Returns the value of parent_action_id, or the default value if parent_action_id is unset.

Trait Implementations:

  • PartialEq
    • fn eq(self: &Self, other: &Self) -> bool
  • Debug
    • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
  • Message
    • fn encoded_len(self: &Self) -> usize
    • fn clear(self: & mut Self)
  • Default
    • fn default() -> Self
  • Clone
    • fn clone(self: &Self) -> Self

firma_protobuf::v1::ExpiredApproval

Section titled “firma_protobuf::v1::ExpiredApproval”

Struct

ExpiredApproval: the request expired before a decision. Terminal; no token exists.

Traits: Eq, Copy

Trait Implementations:

  • Hash
    • fn hash<__H>(self: &Self, state: & mut __H)
  • Debug
    • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
  • Message
    • fn encoded_len(self: &Self) -> usize
    • fn clear(self: & mut Self)
  • Default
    • fn default() -> Self
  • PartialEq
    • fn eq(self: &Self, other: &Self) -> bool
  • Clone
    • fn clone(self: &Self) -> Self

firma_protobuf::v1::GetApprovalOutcomeRequest

Section titled “firma_protobuf::v1::GetApprovalOutcomeRequest”

Struct

GetApprovalOutcomeRequest polls the outcome of one pending approval.

Fields:

  • credentials: ::core::option::Option<SidecarCredentials> - Credentials authenticating the connecting Sidecar. Workspace, sidecar,
  • approval_id: ::prost::alloc::string::String - Approval record id returned by IssueCapability.
  • session_id: ::prost::alloc::string::String - Session that opened the approval; must match the persisted request.

Traits: Eq

Trait Implementations:

  • Clone
    • fn clone(self: &Self) -> Self
  • Default
    • fn default() -> Self
  • PartialEq
    • fn eq(self: &Self, other: &Self) -> bool
  • Hash
    • fn hash<__H>(self: &Self, state: & mut __H)
  • Debug
    • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
  • Message
    • fn encoded_len(self: &Self) -> usize
    • fn clear(self: & mut Self)

firma_protobuf::v1::GetApprovalOutcomeResponse

Section titled “firma_protobuf::v1::GetApprovalOutcomeResponse”

Struct

GetApprovalOutcomeResponse carries exactly one pending or terminal outcome.

Fields:

  • outcome: ::core::option::Option<get_approval_outcome_response::Outcome>

Traits: Eq

Trait Implementations:

  • Clone
    • fn clone(self: &Self) -> Self
  • Default
    • fn default() -> Self
  • PartialEq
    • fn eq(self: &Self, other: &Self) -> bool
  • Hash
    • fn hash<__H>(self: &Self, state: & mut __H)
  • Debug
    • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
  • Message
    • fn encoded_len(self: &Self) -> usize
    • fn clear(self: & mut Self)

firma_protobuf::v1::GrantedApproval

Section titled “firma_protobuf::v1::GrantedApproval”

Struct

GrantedApproval: an operator approved the request and the Authority issued the capability. Retrieval is repeatable: a retry after a lost response returns the same capability.

Fields:

  • token: ::core::option::Option<CapabilityToken> - The signed capability token issued from the approved perimeter.

Traits: Eq

Trait Implementations:

  • Default
    • fn default() -> Self
  • PartialEq
    • fn eq(self: &Self, other: &Self) -> bool
  • Hash
    • fn hash<__H>(self: &Self, state: & mut __H)
  • Debug
    • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
  • Message
    • fn encoded_len(self: &Self) -> usize
    • fn clear(self: & mut Self)
  • Clone
    • fn clone(self: &Self) -> Self

firma_protobuf::v1::HttpParams

Section titled “firma_protobuf::v1::HttpParams”

Struct

HttpParams carries parameters for an HTTP action.

Fields:

  • method: ::prost::alloc::string::String - HTTP method (GET, POST, PUT, DELETE, PATCH).
  • headers: ::std::collections::HashMap<::prost::alloc::string::String, ::prost::alloc::string::String> - Request headers — allowlisted keys only.
  • body: ::prost::alloc::vec::Vec<u8> - Request body as raw bytes (empty for GET/DELETE).
  • query: ::std::collections::HashMap<::prost::alloc::string::String, ::prost::alloc::string::String> - Query parameters.

Trait Implementations:

  • Clone
    • fn clone(self: &Self) -> Self
  • Debug
    • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
  • PartialEq
    • fn eq(self: &Self, other: &Self) -> bool
  • Message
    • fn encoded_len(self: &Self) -> usize
    • fn clear(self: & mut Self)
  • Default
    • fn default() -> Self

firma_protobuf::v1::IssueCapabilityRequest

Section titled “firma_protobuf::v1::IssueCapabilityRequest”

Struct

IssueCapabilityRequest carries the agent’s identity and requested scope for capability issuance.

Fields:

  • agent_id: ::prost::alloc::string::String - Identity of the requesting agent.
  • requested_actions: ::prost::alloc::vec::Vec<::prost::alloc::string::String> - Actions the agent is requesting authorization for.
  • resource_scope: ::prost::alloc::string::String - Resource scope the agent needs access to.
  • session_id: ::prost::alloc::string::String - Session identifier for correlation.
  • requested_ttl_seconds: i32 - Requested TTL in seconds for the capability token.
  • credentials: ::core::option::Option<SidecarCredentials> - Credentials authenticating the connecting Sidecar.
  • issuance_attempt_id: ::core::option::Option<::prost::alloc::string::String> - Client-chosen idempotency key for this issuance attempt, unique per

Methods:

  • fn issuance_attempt_id(self: &Self) -> &str - Returns the value of issuance_attempt_id, or the default value if issuance_attempt_id is unset.

Traits: Eq

Trait Implementations:

  • Clone
    • fn clone(self: &Self) -> Self
  • Default
    • fn default() -> Self
  • PartialEq
    • fn eq(self: &Self, other: &Self) -> bool
  • Hash
    • fn hash<__H>(self: &Self, state: & mut __H)
  • Debug
    • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
  • Message
    • fn encoded_len(self: &Self) -> usize
    • fn clear(self: & mut Self)

firma_protobuf::v1::IssueCapabilityResponse

Section titled “firma_protobuf::v1::IssueCapabilityResponse”

Struct

IssueCapabilityResponse returns the outcome of an issuance evaluation: a signed capability token, a structured denial, or a pending-approval handle.

decision is the authoritative outcome. Every other field is populated per decision as shown below; consumers MUST switch on decision and ignore any field not listed for that decision. A well-formed response never populates a field outside its decision’s row (e.g. granted == true with DENY, or a token with PENDING_APPROVAL, are both invalid and must not be produced).

decisionpopulated fields
ALLOWtoken (granted == true)
DENYdeny_reason, deny_message (granted == false)
PENDING_APPROVALapproval_id, approval_url, approval_expiry
(granted == false)

granted is exactly (decision == ALLOW) and is retained only for 0.1.x clients that predate decision.

Fields:

  • granted: bool - True iff decision == ALLOW. Retained for backward compatibility with
  • token: ::core::option::Option<CapabilityToken> - The signed capability token. Set only when decision == ALLOW.
  • deny_reason: ::prost::alloc::string::String - Structured reason code (e.g., “POLICY_DENIED”, “SCOPE_EXCEEDED”). Set only
  • deny_message: ::prost::alloc::string::String - Human-readable denial message for debugging. Set only when decision == DENY.
  • decision: i32 - Authoritative tri-state outcome of the evaluation. Consumers switch on
  • approval_id: ::core::option::Option<::prost::alloc::string::String> - Approval record id. Set only when decision == PENDING_APPROVAL. optional so
  • approval_url: ::core::option::Option<::prost::alloc::string::String> - URL the operator follows to approve/deny. Set only when
  • approval_expiry: ::core::option::Option<::prost_types::Timestamp> - When the pending approval expires. Set only when

Methods:

  • fn decision(self: &Self) -> IssueDecision - Returns the enum value of decision, or the default if the field is set to an invalid enum value.
  • fn set_decision(self: & mut Self, value: IssueDecision) - Sets decision to the provided enum value.
  • fn approval_id(self: &Self) -> &str - Returns the value of approval_id, or the default value if approval_id is unset.
  • fn approval_url(self: &Self) -> &str - Returns the value of approval_url, or the default value if approval_url is unset.

Traits: Eq

Trait Implementations:

  • PartialEq
    • fn eq(self: &Self, other: &Self) -> bool
  • Hash
    • fn hash<__H>(self: &Self, state: & mut __H)
  • Debug
    • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
  • Message
    • fn encoded_len(self: &Self) -> usize
    • fn clear(self: & mut Self)
  • Clone
    • fn clone(self: &Self) -> Self
  • Default
    • fn default() -> Self

firma_protobuf::v1::IssueDecision

Section titled “firma_protobuf::v1::IssueDecision”

Enum

IssueDecision is the tri-state outcome of an IssueCapability evaluation.

Variants:

  • Unspecified
  • Allow - Capability granted: a signed token is returned.
  • Deny - Denied by policy: a structured reason is returned, no token.
  • PendingApproval - Issuance gated on human approval: an approval handle is returned, no token.

Methods:

  • fn is_valid(value: i32) -> bool - Returns true if value is a variant of IssueDecision.
  • fn from_i32(value: i32) -> ::core::option::Option<IssueDecision> - Converts an i32 to a IssueDecision, or None if value is not a valid variant.
  • fn as_str_name(self: &Self) -> &'static str - String value of the enum field names used in the ProtoBuf definition.
  • fn from_str_name(value: &str) -> ::core::option::Option<Self> - Creates an enum from field names used in the ProtoBuf definition.

Traits: Copy, Eq

Trait Implementations:

  • Ord
    • fn cmp(self: &Self, other: &Self) -> $crate::cmp::Ordering
  • Hash
    • fn hash<__H>(self: &Self, state: & mut __H)
  • TryFrom
    • fn try_from(value: i32) -> ::core::result::Result<IssueDecision, ::prost::UnknownEnumValue>
  • Clone
    • fn clone(self: &Self) -> Self
  • Default
    • fn default() -> IssueDecision
  • PartialOrd
    • fn partial_cmp(self: &Self, other: &Self) -> $crate::option::Option<$crate::cmp::Ordering>
  • Debug
    • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
  • PartialEq
    • fn eq(self: &Self, other: &Self) -> bool

firma_protobuf::v1::PendingApproval

Section titled “firma_protobuf::v1::PendingApproval”

Struct

PendingApproval: no decision yet; poll again.

Fields:

  • expires_at: ::core::option::Option<::prost_types::Timestamp> - When the pending approval expires; polling past this deadline is useless.
  • retry_after: ::core::option::Option<::prost_types::Duration> - Server-suggested minimum delay before the next poll. Advisory: clients

Traits: Eq, Copy

Trait Implementations:

  • Default
    • fn default() -> Self
  • PartialEq
    • fn eq(self: &Self, other: &Self) -> bool
  • Clone
    • fn clone(self: &Self) -> Self
  • Hash
    • fn hash<__H>(self: &Self, state: & mut __H)
  • Debug
    • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
  • Message
    • fn encoded_len(self: &Self) -> usize
    • fn clear(self: & mut Self)

firma_protobuf::v1::PolicyBundle

Section titled “firma_protobuf::v1::PolicyBundle”

Struct

PolicyBundle is one complete, immutable enforcement snapshot distributed from Authority to Sidecar. Cedar policies, entity schema, and managed mappings share one version and TTL; receivers compile all components before atomic activation. Updates replace the complete snapshot, never append rules or apply deltas.

Fields:

  • version: ::prost::alloc::string::String - Version of the complete snapshot, including mappings when present.
  • policies: ::prost::alloc::vec::Vec<u8> - Serialized Cedar policy files.
  • entity_schema: ::prost::alloc::vec::Vec<u8> - Serialized Cedar entity schema.
  • ttl_seconds: u32 - Time-to-live in seconds. If TTL expires without refresh,
  • mappings: ::core::option::Option<ActionMappingSnapshot> - Complete effective mappings. Absence is a legacy policy-only payload,

Trait Implementations:

  • Debug
    • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
  • Message
    • fn encoded_len(self: &Self) -> usize
    • fn clear(self: & mut Self)
  • Default
    • fn default() -> Self
  • Clone
    • fn clone(self: &Self) -> Self
  • PartialEq
    • fn eq(self: &Self, other: &Self) -> bool

firma_protobuf::v1::PolicyBundleCapability

Section titled “firma_protobuf::v1::PolicyBundleCapability”

Enum

PolicyBundleCapability describes behavior supported by a bundle consumer. Unknown numbers and UNSPECIFIED do not imply any recognized capability.

Variants:

  • Unspecified
  • ActionMappingSnapshotV1 - Supports format-1 complete mappings, validates/compiles every component

Methods:

  • fn as_str_name(self: &Self) -> &'static str - String value of the enum field names used in the ProtoBuf definition.
  • fn from_str_name(value: &str) -> ::core::option::Option<Self> - Creates an enum from field names used in the ProtoBuf definition.
  • fn is_valid(value: i32) -> bool - Returns true if value is a variant of PolicyBundleCapability.
  • fn from_i32(value: i32) -> ::core::option::Option<PolicyBundleCapability> - Converts an i32 to a PolicyBundleCapability, or None if value is not a valid variant.

Traits: Copy, Eq

Trait Implementations:

  • Ord
    • fn cmp(self: &Self, other: &Self) -> $crate::cmp::Ordering
  • Hash
    • fn hash<__H>(self: &Self, state: & mut __H)
  • TryFrom
    • fn try_from(value: i32) -> ::core::result::Result<PolicyBundleCapability, ::prost::UnknownEnumValue>
  • Clone
    • fn clone(self: &Self) -> Self
  • Default
    • fn default() -> PolicyBundleCapability
  • PartialOrd
    • fn partial_cmp(self: &Self, other: &Self) -> $crate::option::Option<$crate::cmp::Ordering>
  • Debug
    • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
  • PartialEq
    • fn eq(self: &Self, other: &Self) -> bool

firma_protobuf::v1::PolicyBundleUpdate

Section titled “firma_protobuf::v1::PolicyBundleUpdate”

Struct

PolicyBundleUpdate is everything the Authority pushes to one agent’s Sidecar: the enforcement snapshot plus descriptive parts about it. New data for the agent is added as new fields here (descriptive parts) or on PolicyBundle (enforcement parts); the rpc and this envelope are never renamed.

Fields:

  • bundle: ::core::option::Option<PolicyBundle> - The updated policy bundle.
  • updated_at: ::core::option::Option<::prost_types::Timestamp> - When the payload content became current; keepalive resends repeat it. An
  • policy_set: ::core::option::Option<PolicySetDescriptor> - Policy set the bundle was composed from. Absent when the serving Authority

Trait Implementations:

  • PartialEq
    • fn eq(self: &Self, other: &Self) -> bool
  • Debug
    • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
  • Message
    • fn encoded_len(self: &Self) -> usize
    • fn clear(self: & mut Self)
  • Default
    • fn default() -> Self
  • Clone
    • fn clone(self: &Self) -> Self

firma_protobuf::v1::PolicySetDescriptor

Section titled “firma_protobuf::v1::PolicySetDescriptor”

Struct

PolicySetDescriptor identifies the policy set a bundle was composed from.

Fields:

  • policy_set_id: ::prost::alloc::string::String - Policy set identity (pset_… TypeID).
  • policy_set_version: u64 - Version of the policy set the bundle was composed from. A separate

Traits: Eq

Trait Implementations:

  • Clone
    • fn clone(self: &Self) -> Self
  • Default
    • fn default() -> Self
  • PartialEq
    • fn eq(self: &Self, other: &Self) -> bool
  • Hash
    • fn hash<__H>(self: &Self, state: & mut __H)
  • Debug
    • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
  • Message
    • fn encoded_len(self: &Self) -> usize
    • fn clear(self: & mut Self)

firma_protobuf::v1::RevocationEvent

Section titled “firma_protobuf::v1::RevocationEvent”

Struct

RevocationEvent is one member of a RevocationSet: the invalidation of a previously issued capability token. Authorities send whole sets, never a bare event. Enforced locally in Stage 1 with no network calls at decision time.

Fields:

  • token_id: ::prost::alloc::string::String - The token_id being revoked.
  • reason: ::prost::alloc::string::String - Reason for revocation.
  • timestamp: ::core::option::Option<::prost_types::Timestamp> - When the revocation was issued.

Traits: Eq

Trait Implementations:

  • Clone
    • fn clone(self: &Self) -> Self
  • Default
    • fn default() -> Self
  • PartialEq
    • fn eq(self: &Self, other: &Self) -> bool
  • Hash
    • fn hash<__H>(self: &Self, state: & mut __H)
  • Debug
    • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
  • Message
    • fn encoded_len(self: &Self) -> usize
    • fn clear(self: & mut Self)

firma_protobuf::v1::RevocationSet

Section titled “firma_protobuf::v1::RevocationSet”

Struct

RevocationSet is the complete set of revocations the Authority holds for a workspace, not a delta. Receivers replace what they hold with it.

Membership is bounded by capability retention, not by all-time revocation history: a revocation leaves the set once the Authority purges the capability record it names, which happens only after the capability has expired, on a cutoff set behind the present to absorb clock skew. A token that drops out of the set is therefore already expired, and the Sidecar rejects it on expiry alone.

Fields:

  • revocations: ::prost::alloc::vec::Vec<RevocationEvent> - Every revocation currently held, in no significant order. An empty set is

Trait Implementations:

  • Default
    • fn default() -> Self
  • Clone
    • fn clone(self: &Self) -> Self
  • PartialEq
    • fn eq(self: &Self, other: &Self) -> bool
  • Debug
    • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
  • Message
    • fn encoded_len(self: &Self) -> usize
    • fn clear(self: & mut Self)

firma_protobuf::v1::SidecarCredentials

Section titled “firma_protobuf::v1::SidecarCredentials”

Struct

SidecarCredentials are the credentials a Sidecar presents on every Authority request. The Authority resolves (workspace_id, sidecar_id) and verifies pre_shared_key against the stored hash.

Fields:

  • workspace_id: ::prost::alloc::string::String - Workspace the Sidecar belongs to.
  • sidecar_id: ::prost::alloc::string::String - Authority-assigned Sidecar identity.
  • pre_shared_key: ::prost::alloc::string::String - The Sidecar’s pre-shared key, verified against the Authority’s stored hash.

Traits: Eq

Trait Implementations:

  • Debug
    • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
  • Message
    • fn encoded_len(self: &Self) -> usize
    • fn clear(self: & mut Self)
  • Clone
    • fn clone(self: &Self) -> Self
  • Default
    • fn default() -> Self
  • PartialEq
    • fn eq(self: &Self, other: &Self) -> bool
  • Hash
    • fn hash<__H>(self: &Self, state: & mut __H)

firma_protobuf::v1::StreamEventsResponse

Section titled “firma_protobuf::v1::StreamEventsResponse”

Struct

Delivery receipt: returned after SubmitEvent, or after the legacy stream half-closes. A successful transport alone does not establish persistence.

Fields:

  • last_event_id: ::prost::alloc::string::String - Event ID of the last event the server persisted.
  • events_received: i64 - Total number of events received in this stream session.
  • durably_persisted: bool - True only after storage commit. Queueing in memory is not persistence.

Traits: Eq

Trait Implementations:

  • Hash
    • fn hash<__H>(self: &Self, state: & mut __H)
  • Debug
    • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
  • Message
    • fn encoded_len(self: &Self) -> usize
    • fn clear(self: & mut Self)
  • Clone
    • fn clone(self: &Self) -> Self
  • Default
    • fn default() -> Self
  • PartialEq
    • fn eq(self: &Self, other: &Self) -> bool

firma_protobuf::v1::TokenFormat

Section titled “firma_protobuf::v1::TokenFormat”

Enum

TokenFormat identifies the encoding format of a capability token.

Variants:

  • Unspecified
  • PasetoV4 - PASETO v4 — preferred format (Ed25519 or XChaCha20-Poly1305).
  • JwtRs256 - JWT RS256 — fallback for environments with existing JWT infrastructure.

Methods:

  • fn is_valid(value: i32) -> bool - Returns true if value is a variant of TokenFormat.
  • fn from_i32(value: i32) -> ::core::option::Option<TokenFormat> - Converts an i32 to a TokenFormat, or None if value is not a valid variant.
  • fn as_str_name(self: &Self) -> &'static str - String value of the enum field names used in the ProtoBuf definition.
  • fn from_str_name(value: &str) -> ::core::option::Option<Self> - Creates an enum from field names used in the ProtoBuf definition.

Traits: Copy, Eq

Trait Implementations:

  • Hash
    • fn hash<__H>(self: &Self, state: & mut __H)
  • Default
    • fn default() -> TokenFormat
  • PartialOrd
    • fn partial_cmp(self: &Self, other: &Self) -> $crate::option::Option<$crate::cmp::Ordering>
  • Debug
    • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
  • Clone
    • fn clone(self: &Self) -> Self
  • TryFrom
    • fn try_from(value: i32) -> ::core::result::Result<TokenFormat, ::prost::UnknownEnumValue>
  • Ord
    • fn cmp(self: &Self, other: &Self) -> $crate::cmp::Ordering
  • PartialEq
    • fn eq(self: &Self, other: &Self) -> bool

firma_protobuf::v1::ToolUseParams

Section titled “firma_protobuf::v1::ToolUseParams”

Struct

ToolUseParams carries parameters for an agent tool invocation.

Fields:

  • tool_name: ::prost::alloc::string::String - Registered tool name.
  • input: ::std::collections::HashMap<::prost::alloc::string::String, ::prost::alloc::string::String> - Tool input — scalar values only, schema validated against tool registry.

Trait Implementations:

  • Default
    • fn default() -> Self
  • Clone
    • fn clone(self: &Self) -> Self
  • PartialEq
    • fn eq(self: &Self, other: &Self) -> bool
  • Debug
    • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
  • Message
    • fn encoded_len(self: &Self) -> usize
    • fn clear(self: & mut Self)

firma_protobuf::v1::WatchPolicyBundleRequest

Section titled “firma_protobuf::v1::WatchPolicyBundleRequest”

Struct

WatchPolicyBundleRequest initiates a policy bundle subscription.

Fields:

  • current_version: ::prost::alloc::string::String - The sidecar’s current bundle version (empty string on first connect),
  • credentials: ::core::option::Option<SidecarCredentials> - Credentials authenticating the connecting Sidecar.
  • supported_capabilities: ::prost::alloc::vec::Vec<i32> - Explicit consumer support. Empty (including legacy omission), unspecified,

Methods:

  • fn supported_capabilities(self: &Self) -> ::core::iter::FilterMap<::core::iter::Cloned<::core::slice::Iter<i32>>, fn(...)> - Returns an iterator which yields the valid enum values contained in supported_capabilities.
  • fn push_supported_capabilities(self: & mut Self, value: PolicyBundleCapability) - Appends the provided enum value to supported_capabilities.

Traits: Eq

Trait Implementations:

  • Clone
    • fn clone(self: &Self) -> Self
  • Default
    • fn default() -> Self
  • PartialEq
    • fn eq(self: &Self, other: &Self) -> bool
  • Hash
    • fn hash<__H>(self: &Self, state: & mut __H)
  • Debug
    • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
  • Message
    • fn encoded_len(self: &Self) -> usize
    • fn clear(self: & mut Self)

firma_protobuf::v1::WatchRevocationsRequest

Section titled “firma_protobuf::v1::WatchRevocationsRequest”

Struct

WatchRevocationsRequest initiates a revocation set subscription.

Fields:

  • credentials: ::core::option::Option<SidecarCredentials> - Credentials authenticating the connecting Sidecar.

Traits: Eq

Trait Implementations:

  • Clone
    • fn clone(self: &Self) -> Self
  • Default
    • fn default() -> Self
  • PartialEq
    • fn eq(self: &Self, other: &Self) -> bool
  • Hash
    • fn hash<__H>(self: &Self, state: & mut __H)
  • Debug
    • fn fmt(self: &Self, f: & mut ::core::fmt::Formatter) -> ::core::fmt::Result
  • Message
    • fn encoded_len(self: &Self) -> usize
    • fn clear(self: & mut Self)

Module: audit_service_client

Section titled “Module: audit_service_client”

Generated client implementations.

Module: audit_service_server

Section titled “Module: audit_service_server”

Generated server implementations.

Module: authority_service_client

Section titled “Module: authority_service_client”

Generated client implementations.

Module: authority_service_server

Section titled “Module: authority_service_server”

Generated server implementations.

Module: execution_intent

Section titled “Module: execution_intent”

Nested message and enum types in ExecutionIntent.

Module: get_approval_outcome_response

Section titled “Module: get_approval_outcome_response”

Nested message and enum types in GetApprovalOutcomeResponse.