Struct CapabilityAmendment 

pub struct CapabilityAmendment { /* private fields */ }

A pending amendment to an existing capability.

Two kinds of change accumulate here:

• constraints (require-side): Self::designation, Self::designation_trusting, Self::valid_for. They tighten the capability and are valid under either terminal.
• attestations (provide-side): Self::activate, Self::with_designation. They supply facts that only carry weight when the amendment is signed, so they require the Self::attest terminal.

Implementations

impl CapabilityAmendment

pub fn designation( self, label: impl Into<String>, value: impl Into<String>, ) -> Self

Require a designation: adds check if designation(label, value).

pub fn designation_trusting( self, pk: PublicKey, label: impl Into<String>, value: impl Into<String>, ) -> Self

Require a designation that must be attested by pk: adds check if designation(label, value) trusting {pk}.

pub fn valid_for(self, duration: Duration) -> Self

Tighten the capability’s lifetime to duration from now. Checks only accumulate, so this can shorten the window, never extend it.

pub fn activate(self) -> Self

Attest that this (latent) capability is active as of now: supplies an activation fact, satisfying a latent capability’s activation check. Only meaningful under Self::attest (the signer vouches for it).

pub fn with_designation( self, label: impl Into<String>, value: impl Into<String>, ) -> Self

Attest a designation fact: supplies designation(label, value), satisfying a matching designation_trusting constraint. Mirrors crate::CapabilityVerifier::with_designation. Only meaningful under Self::attest.

pub fn with_time(self, time_config: TokenTimeConfig) -> Self

Supply a TokenTimeConfig to control time. Only start_time is used here: when set it overrides “now” for the activation fact and the tightened-window deadline (the seam for deterministic tests). duration is ignored – amend’s time check is opt-in via Self::valid_for.

pub fn attenuate(self) -> Result<String, TokenError>

Finalize as a keyless attenuation: appends a first-party block carrying only the require-side constraints. Errors if any attestation (a provide-side fact) was added – those require a signature via Self::attest.

pub fn attest(self, keypair: &KeyPair) -> Result<String, TokenError>

Finalize as an attestation: a third-party block signed by keypair carrying the attested facts plus any constraints. The signer vouches for the facts; constraints (trusting {keypair.public()}) reference this signer so the matching facts are honored only from blocks it signed.