Patterns

String -> PrivateKey

Parse and instantiate a cryptographic private key from its serialized string representation.

ConsentCredential, AccessRequest -> AuthorizationDecision

Authorize health data access requests by matching the request attributes against actor-signed consent credentials.

VerifiablePresentation -> VerifiedClaims

Verify the cryptographic signatures of a Verifiable Presentation and its constituent Verifiable Credentials using resolved public keys.

DID -> DIDDocument

Resolve a Decentralized Identifier (DID) to its corresponding W3C DID Document containing cryptographic keys and service endpoints.

UserContext + EntityRelationGraph -> AccessDecision

Determine user access permissions by walking a directed graph representing ownership and assignment relations between customers, assets, and devices.

SetupSession -> AuthConfig

Poll or block on an active OAuth setup session until the user completes authentication, returning the persisted configuration ID.

OAuthConfigRequest -> SetupSession

Generate a temporary user-interactive setup URL for external OAuth consent and expose a session identifier to track its completion.

ModelInput + ModelOutput + ZKProof + CircuitFingerprint -> VerificationResult

Verify that an AI inference output matches a specific model architecture and input using a cryptographic zero-knowledge proof.

RawAgentCommand -> ExecutionResult

Intercept agent keyboard inputs to execute only a validated, high-level CLI wrapper subset instead of open-ended bash commands.

HandshakeRequest -> CookieChallenge

Respond to unauthenticated connection requests with a cryptographic cookie containing IP/timestamp MACs, delaying memory allocation until the initiator echoes it back.

(StaticPublicKey, EphemeralPublicKey) -> (DoubleCiphertext, SharedSecret)

Encapsulate shared secrets against both static and ephemeral post-quantum public keys of a peer, combining outputs into a single authenticated shared secret.

SymmetricKey -> WireGuardConfig

Inject dynamically negotiated post-quantum symmetric keys into a running WireGuard peer's pre-shared key (PSK) slot via runtime configuration commands.

(Scalar, Base1, Base2, Target1, Target2) -> Proof

Generate a zero-knowledge proof that two base-generator pairs share the same secret scalar exponent.

(BlindedMessage, PrivateKey) -> BlindedSignature

Generate an RSA signature on a blinded message such that the signer does not learn the message content, and the resulting signature can be unblinded to a valid standard signature.

BlindedElement -> (BlindedEvaluation, ZKProof)

Evaluate a pseudorandom function on a blinded input, producing a blinded evaluation alongside a zero-knowledge proof of correct computation.

Bytes -> CurvePoint

Deterministically map an arbitrary byte string to a point on an elliptic curve in a cryptographically secure manner.

PublicKey, Plaintext -> EncryptedMessage

Encrypt a message using a combination of an asymmetric key encapsulation mechanism and symmetric authenticated encryption.

CodeBlock -> ExecutionResult

Parse executable code blocks from generated model responses, execute them inside a runtime sandbox, and feed output/errors back to the model for iterative correction.

McpProtocolMessage -> McpProtocolMessage

Expose an MCP-compliant endpoint over HTTPS that bridges local MCP clients to cloud-hosted agent tools using bearer tokens.

ResponsePayload, RolePermissions -> MaskedResponsePayload

Filter and mask sensitive schema columns in outgoing API response payloads based on the caller's role-based access rights.

APIRequest, Script -> APIRequest

Execute sandboxed scripts during pre- and post-processing phases of an API request lifecycle to mutate payloads or apply custom validation.

UserCredentials -> ImpersonatedSecurityContext

Proxy execution requests to cluster managers and storage using the end-user's identity rather than the gateway's system user.