Struct BundleTrust 

pub struct BundleTrust { /* private fields */ }

A parsed, authenticated trust anchor extracted from an identity bundle.

Constructing one (BundleTrust::parse) proves three things, so callers never re-check them:

1. Freshness — the bundle is within its own TTL.
2. Self-certification (RT-005) — the bundle’s identity_did names the inception event its KEL carries (SAID for E… prefixes, controller field otherwise), so a bundle cannot pair a victim’s DID with an attacker-authored KEL.
3. KEL authentication (RT-002) — every KEL event is signed by its controlling key-state, verified via validate_signed_kel; a stripped or forged attachment fails closed here.

The bundle is evidence for a pinned root, never the source of the pin: callers must still require BundleTrust::root_did to be in their independently pinned root set.

Implementations

impl BundleTrust

pub fn parse( bundle: &IdentityBundle, now: DateTime<Utc>, ) -> Result<Self, BundleTrustError>

Parse a bundle into a trust anchor: freshness + RT-005 + RT-002.

Args:

• bundle: The deserialized identity bundle (attacker-controlled input).
• now: Current time, injected at the boundary.

Usage:

let trust = BundleTrust::parse(&bundle, Utc::now())?;
assert!(pinned_roots.contains(&trust.root_did().to_string()));

pub fn root_did(&self) -> &str

The root did:keri: this bundle self-certifies to. Evidence for a pin, never the pin itself.

pub fn kel(&self) -> &[Event]

The authenticated KEL events, oldest first.

pub fn device_kels(&self) -> &[AuthenticatedDeviceKel]

The authenticated device KELs — (did, events) per delegated device the bundle carries, each seal-checked against the root KEL.

pub fn into_parts(self) -> (String, Vec<Event>, Vec<AuthenticatedDeviceKel>)

Consume the anchor into (root_did, kel, device_kels) for callers that thread the parts separately (the CLI’s stateless resolver).