Struct BlockingClient 

pub struct BlockingClient { /* private fields */ }

A blocking wrapper around the async gRPC client.

Implementations

impl BlockingClient

pub fn connect(path: &str) -> Result<Self>

Connect to the agent listening at path.

pub fn connect_with_timeout(path: &str, default_timeout: u64) -> Result<Self>

Connect with an explicit default per-request timeout in seconds.

pub fn new_key(&mut self, key_id: &str, key_type: KeyType) -> Result<KeyHandle>

Create a key under catalog name key_id.

pub fn import( &mut self, key_id: &str, key_type: KeyType, material: KeyMaterial, ) -> Result<KeyHandle>

Import caller-provided key material.

pub fn import_set( &mut self, entries: Vec<ImportEntry>, ) -> Result<Vec<KeyHandle>>

Import several keys in one call (e.g. an nsc-init bundle). See Client::import_set.

pub fn sign(&mut self, key_id: &str, message: &[u8]) -> Result<Vec<u8>>

Sign message with key_id, returning the raw signature. message is the raw bytes to be signed, not a precomputed digest, and can be a NATS server nonce or JWT signing input (see Client::sign).

pub fn verify( &mut self, key_id: &str, message: &[u8], signature: &[u8], ) -> Result<bool>

Verify signature over message with key_id.

pub fn get_public_key( &mut self, key_id: &str, version: Option<u32>, ) -> Result<GetPublicKeyResponse>

Fetch a public key by catalog name and optional version.

pub fn encrypt( &mut self, key_id: &str, algorithm: AeadAlgorithm, plaintext: &[u8], aad: Option<&[u8]>, ) -> Result<CiphertextEnvelope>

Encrypt plaintext. Basil owns nonce generation.

pub fn decrypt( &mut self, key_id: &str, envelope: CiphertextEnvelope, aad: Option<&[u8]>, ) -> Result<Vec<u8>>

Decrypt a Basil ciphertext envelope.

pub fn wrap_envelope( &mut self, key_id: &str, kem_algorithm: KemAlgorithm, envelope_algorithm: EnvelopeAlgorithm, plaintext: &[u8], aad: Option<&[u8]>, ) -> Result<KemEnvelope>

Wrap plaintext with a KEM/envelope operation.

pub fn unwrap_envelope( &mut self, key_id: &str, envelope: KemEnvelope, aad: Option<&[u8]>, ) -> Result<Vec<u8>>

Unwrap a KEM/envelope ciphertext.

pub fn get_secret( &mut self, secret_id: &str, version: Option<u32>, ) -> Result<SecretValue>

Fetch a secret payload.

pub fn set_secret(&mut self, secret_id: &str, value: &[u8]) -> Result<u32>

Store a secret payload, returning the new version.

pub fn rotate_secret(&mut self, secret_id: &str) -> Result<u32>

Rotate a secret, returning the new version.

pub fn list_catalog( &mut self, prefix: Option<&str>, ) -> Result<Vec<CatalogEntry>>

List visible catalog entries, optionally filtered by prefix.

pub fn mint_jwt( &mut self, key_id: &str, sub: &str, ttl_secs: Option<u64>, claims: impl Serialize, ) -> Result<MintedJwt>

Mint a generic JWT credential.

pub fn mint_jwt_json( &mut self, key_id: &str, sub: &str, ttl_secs: Option<u64>, extra_claims_json: impl Into<Vec<u8>>, ) -> Result<MintedJwt>

Mint a generic JWT credential from pre-encoded additional claim JSON.

pub fn mint_nats_user( &mut self, key_id: &str, subject_user_nkey: &str, issuer_account: Option<&str>, name: &str, ttl_secs: Option<u64>, permissions: NatsUserPermissions, ) -> Result<String>

Mint a NATS user JWT signed by an account key held by Basil.

issuer_account is the owning account’s identity public NKey (A…), required when key_id is an account signing key (it sets nats.issuer_account); pass None when key_id is the account identity key itself.

pub fn mint_nats_account( &mut self, signing_key_id: &str, subject_account_nkey: &str, name: &str, signing_keys: &[String], expires_in_secs: Option<u64>, ) -> Result<String>

Mint a NATS account JWT signed by an operator key (or self-signed) held by Basil.

pub fn mint_nats_operator( &mut self, signing_key_id: &str, subject_operator_nkey: Option<&str>, name: &str, signing_keys: &[String], account_server_url: Option<&str>, system_account: Option<&str>, expires_in_secs: Option<u64>, ) -> Result<String>

Mint a NATS operator JWT. With subject_operator_nkey set to None the issuer self-signs.

pub fn mint_nats_signer( &mut self, signing_key_id: &str, subject_nkey: &str, name: &str, expires_in_secs: Option<u64>, ) -> Result<String>

Mint a NATS account-signing-key JWT (subject is an N-prefixed signer nkey).

pub fn mint_nats_server( &mut self, signing_key_id: &str, subject_server_nkey: &str, name: &str, expires_in_secs: Option<u64>, ) -> Result<String>

Mint a NATS server JWT (subject is an N-prefixed server nkey).

pub fn mint_nats_curve( &mut self, signing_key_id: &str, subject_curve_nkey: &str, name: &str, expires_in_secs: Option<u64>, ) -> Result<String>

Mint a NATS curve (x25519) JWT (subject is an X-prefixed curve nkey).

pub fn encrypt_nats_curve( &mut self, key_id: &str, recipient_public_xkey: &str, plaintext: &[u8], ) -> Result<Vec<u8>>

Encrypt with a custodied NATS curve xkey to a recipient public xkey.

pub fn decrypt_nats_curve( &mut self, key_id: &str, sender_public_xkey: &str, ciphertext: &[u8], ) -> Result<Vec<u8>>

Decrypt a NATS curve xkey box from a sender public xkey.

pub fn sign_nats_jwt( &mut self, key_id: &str, claims: impl Serialize, options: SignNatsJwtOptions, ) -> Result<MintedJwt>

Validate and sign a caller-supplied NATS JWT claim document.

pub fn sign_nats_jwt_json( &mut self, key_id: &str, claims_json: impl Into<Vec<u8>>, options: SignNatsJwtOptions, ) -> Result<MintedJwt>

Validate and sign a pre-encoded NATS JWT claim document.

pub fn validate_nats_jwt( &mut self, jwt: &str, allowed_signers: impl IntoIterator<Item = AllowedNatsSigner>, expected_type: Option<NatsJwtType>, ) -> Result<NatsJwtValidation>

Validate a presented NATS JWT against candidate catalog keys or public NKeys.

pub fn issue_certificate( &mut self, issuer_key_id: &str, common_name: &str, dns_sans: &[String], ip_sans: &[String], ttl_secs: u64, ) -> Result<IssuedCertificate>

Issue a DNS/IP-SAN X.509 leaf (TLS cert). See Client::issue_certificate.

pub fn status(&mut self) -> Result<AgentStatus>

The broker’s backend identifier, build version, and wire protocol version.

pub fn health(&mut self) -> Result<AgentHealth>

Broker liveness: is the daemon up and serving the socket? No backend I/O.

pub fn readiness(&mut self) -> Result<AgentReadiness>

Broker readiness: can the broker actually serve? Returns a non-secret summary (counts, coarse reason, active generation id).

pub fn reload(&mut self, check: bool) -> Result<AgentReload>

Trigger a permission-gated catalog/policy hot reload from disk (basil-atq). check = true is a dry-run (validate, do not swap). The config is read from the broker’s on-disk paths only, never the wire.

pub fn explain( &mut self, subject: &str, op: &str, key: &str, ) -> Result<AgentExplanation>

Explain a policy decision against the broker’s serving generation.

pub fn revoke( &mut self, trust_domain: &str, jti: &str, expires_at_unix: u64, ) -> Result<AgentRevocation>

Revoke a JWT-SVID by trust-domain/jti tuple.