Struct Credential 

pub struct Credential<T> { /* private fields */ }

A sealed credential value. The inner T is constructable only via a CredentialMinter — itself only obtainable as a function parameter injected by the framework into credential-issuing methods.

Activation code can:

• Construct via minter.mint(payload, metadata) (the framework witnesses the construction)
• Read metadata via Credential::metadata (immutable reference)
• Serialize via serde_json::to_value(&cred) — this produces ONLY the sentinel {"$credential": "<id>"}; the inner value never appears.

Activation code CANNOT:

• Construct from raw bytes (no public new / From<T>)
• Mutate the inner value (no &mut accessor)
• Read the inner value via serde_json::to_value (the custom Serialize impl writes the sentinel, not the value)
• Deserialize from raw JSON (Deserialize is intentionally absent)

Sealing

Credential<T>::new_sealed is pub(crate). Only CredentialMinter inside this crate calls it. The compile-fail tests in tests/compile_fail/credential_*.rs assert that external construction is rejected.

Implementations

impl<T> Credential<T>

pub fn metadata(&self) -> &CredentialMetadata

Immutable accessor for the metadata. There is no mutable counterpart — metadata is fixed at mint time.

pub fn id(&self) -> &CredentialId

The credential’s stable id (used in the wire sentinel).

impl<T> Credential<T>

pub fn audit_projection(&self) -> &CredentialMetadata

Project to the metadata for audit-record emission. Read-only; the returned reference is the metadata exactly as fixed at mint time.

Equivalent to Self::metadata, named separately to make the audit-side projection grep-discoverable. Per AUTHZ-CRED-S01-output §8, the audit pipeline records credentials_issued: Vec<CredentialMetadata> — this is the projection that produces it. The inner credential value is never included.

Trait Implementations

impl<T: Clone> Clone for Credential<T>

fn clone(&self) -> Credential<T>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<T: Debug> Debug for Credential<T>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<T> Serialize for Credential<T>

where T: Serialize,

fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>

where S: Serializer,

Emits the sentinel {"$credential": "<id>"} always.

If a dispatch-capture guard is active on the current thread, the inner value is ALSO captured into the sidecar (keyed by id) so the dispatch wrapper can emit it under the envelope’s _credentials key. Application code that calls serde_json::to_value(&credential) without a guard sees only the sentinel — the inner value never appears in the produced JSON.