Struct HostedSession 

pub struct HostedSession { /* private fields */ }

A validated, connectable hosted-session configuration.

Building runs the fallible TLS/auth validation up front, so callers that must not leave partial on-disk artifacts (clone, push) — or that build the config on one thread and connect on another (lazy hydration) — can prevalidate before any irreversible work, then connect() afterwards. Callers with no such ordering constraint use HostedGrpcClient::open_session, which builds and connects in one call.

Implementations

impl HostedSession

pub fn build_stored_credential( user_config: &UserConfig, server_key: &str, ) -> Result<HostedSession, Error>

Build a session from the exact stored authority credential selected by an auth command. Unlike CredentialFallback, configured/env tokens cannot replace the selected bearer. The matching device proof key is required and validated before the command performs any mutation.

pub fn build( user_config: &UserConfig, server_key: Option<String>, ) -> Result<HostedSession, Error>

Resolve auth + build the validated client config for a hosted session. Runs the single resolve_hosted_credential precedence (HEDDLE_CREDENTIAL → keystore → unauthenticated), server-key attachment, and proof-key attachment from either the resolved credential or the matching shared same-host device identity — the assembly the command modules used to hand-roll.

pub fn with_allow_insecure(self, allow: bool) -> HostedSession

Explicitly allow cleartext to non-loopback hosts for this session (CLI --insecure or remote insecure = true). Does not disable an allow already set via user config / env.

pub async fn connect( &self, addr: SocketAddr, ) -> Result<HostedGrpcClient, ProtocolError>

Connect and evaluate renewal for an eligible stored authority token.

The eligibility check runs immediately after connect and requires the active bearer to remain byte-for-byte identical to the stored one-block authority credential selected during HostedSession::build. Explicit config/env and attenuated tokens are never rotated here.

pub async fn connect_channel( &self, channel: Channel, ) -> Result<HostedGrpcClient, ProtocolError>

Finish a validated session over a channel whose URI/TLS policy was already established by the auth command’s endpoint connector.