Struct Session 

pub struct Session { /* private fields */ }

One resolved execution context: a named profile and the gateway client built from its POST-OVERLAY state. Construct through the three constructors — never by struct literal (the fields are the resolved choreography’s output, not inputs).

Manual Debug (no derive): the client isn’t Debug and must never be rendered credential-side — the profile NAME is the only safe field (the redaction discipline, CORE-02).

Implementations

impl Session

pub fn resolve(profile_flag: Option<&str>) -> Result<Self, CoreError>

Resolve through config: REQUIRED credential mode. Loads config (IGNITION_CLI_CONFIG first, platform path second), applies the env overlay scoped to the would-be selection, resolves the selection, then walks the LOCKED secret chain with NO degradation — a missing secret is CoreError::SecretUnavailable (exit 3), correct for authed reads. Replaces main.rs’s resolve_gateway_api (and named_profile_client: per-side resolution is just resolve(Some(name))).

pub fn resolve_loaded( config: &mut Config, profile_flag: Option<&str>, ) -> Result<(Self, Profile), CoreError>

Resolve through a config the CALLER already loaded — the caller owns the load policy, the seam keeps everything downstream (overlay scoped to the selection → selection → LOCKED secret chain → REQUIRED-credential construction). This is the cockpit’s entry point: the TUI loads with config::load_for_tui, whose NEW-surface degradation contract (a schema typo warns and defaults instead of killing startup) must apply BEFORE the seam runs, while selection/auth failures stay fatal. Returns the session AND the selected POST-OVERLAY profile — the url string and cadence fields consumers like the cockpit display, which a Session deliberately doesn’t re-expose.

pub fn resolve_side(config: &mut Config, name: &str) -> Result<Self, CoreError>

Resolve ONE NAMED side of a multi-profile command through a config the CALLER already loaded — the project diff/sync shape. Verbatim port of main.rs’s named_profile_client: the selection runs against the caller’s config with NO env overlay applied (side B carries its own URL even while IGNITION_URL overlays the envelope’s active profile — the contract the diff/sync goldens pin), then the LOCKED chain (required) and the client construction. The caller’s name rides the secret resolution verbatim, and the impossible empty-selection arm stays CoreError::Internal exactly as the original wrote it.

pub fn resolve_degraded(profile_flag: Option<&str>) -> Result<Self, CoreError>

Resolve through config with the credential DEGRADED to None when the secret chain exhausts: version must not demand a secret (gateway-info answers), the wait commands must keep polling while auth is broken, the doctor diagnoses absent auth for a living. Every OTHER credential error propagates (the resolve_secret_opt behavior behind main.rs:431/760 and resolve_headerless_api). Selection errors are NOT degraded: no target is NoActiveProfile, as today.

pub fn for_url( url: Url, credential: Option<Credential>, ssl_verify: bool, ) -> Result<Self, CoreError>

Headerless-BY-CONSTRUCTION client for the rig family: a caller- derived gateway URL (never a profile’s), an explicit optional credential, and the caller’s ssl_verify (rig probes use false — localhost probes against self-signed rig https are the norm). No config is read and no secret is resolved. Replaces main.rs’s rig_gateway_client + the TUI’s rig_client_with (the URL DERIVATION stays at the call sites; only the ReqwestGatewayApi construction moves behind this constructor — no second client construction anywhere).

Rig sessions carry NO profile: Self::profile_name returns the empty string (callers translate to None where the output model wants a profile echo).

pub fn profile_name(&self) -> &str

The resolved profile’s name — empty for Self::for_url rig sessions (no profile exists).

pub fn profile_url(&self) -> &Url

The resolved profile’s configured gateway URL — the POST-OVERLAY value (flag > IGNITION_URL env > profile), i.e. exactly what the session’s client targets. Doctor’s url check re-parses this raw value: the honest diagnosis must describe the URL the client ACTUALLY connects to, overlay included. For Self::for_url rig sessions this is the caller-derived rig URL.

pub fn credential_present(&self) -> bool

Whether a credential resolved into this session’s client — the doctor’s credential_present flag (a MISSING credential is a different diagnosis than an UNRECOGNIZED one; the degraded chain decides, this accessor reports, and the secret itself never crosses the seam). Always true for Self::resolve; the caller’s Some-ness for Self::for_url.

pub fn api(&self) -> &ReqwestGatewayApi

The gateway client, borrowed.

pub fn api_handle(&self) -> Arc<ReqwestGatewayApi>

The gateway client as an owned Arc handle — the TUI’s workers/ClientHandle shape, without a second construction.

Methods from Deref<Target = ReqwestGatewayApi>

pub async fn send_and_classify_for_api( &self, request: RequestBuilder, url: &Url, ) -> Result<Response, CoreError>

The api-call-scoped pipeline entry (09-01): identical transport-error → Network mapping, then [classify] with api_call = true so an unclassified gateway 4xx maps to GatewayClientError (exit 2, verbatim capped body) instead of Internal. Public because ign api call’s action layer (09-03) is the production consumer and the contract tests (tests/api_classify_contract.rs) pin the full exit partition through it — nothing in the curated pipeline switches to it.

Trait Implementations

impl Debug for Session

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Deref for Session

Feeds every existing free-fn action over &GatewayApi unchanged: version(&*session, …) and friends work exactly as they did against a bare ReqwestGatewayApi.

type Target = ReqwestGatewayApi

The resulting type after dereferencing.

fn deref(&self) -> &Self::Target

Dereferences the value.