Struct EdgeCredentials 

pub struct EdgeCredentials { /* private fields */ }

One edge’s transport bearer plus its ed25519 envelope-signing key.

Built from the edge’s own configuration (POLYCHROME_EDGE_ID, POLYCHROME_EDGE_BEARER_KEY, POLYCHROME_EDGE_SIGNING_KEY_HEX — see the edge-auth redesign doc) via EdgeCredentials::from_parts, then passed to crate::AgentDialer::with_credentials. Held by the dialer behind an Arc, so cloning a dialer never re-derives or duplicates the key.

Implementations

impl EdgeCredentials

pub fn from_parts( edge_id: String, bearer: String, signing_key_hex: &str, ) -> Result<Self, CredentialError>

Build credentials from an edge’s id, transport bearer token, and hex-encoded 32-byte ed25519 private key.

Errors

Returns CredentialError::InvalidHex if signing_key_hex isn’t valid hex, or CredentialError::InvalidSigningKey if the decoded bytes aren’t a valid ed25519 private key.

pub fn edge_id(&self) -> &str

This edge’s registry id — carried as AssertedAttribution::edge_id on every envelope this credential signs.

pub fn bearer(&self) -> &str

The transport bearer token, ridden as Authorization: Bearer <token> on every call a dialer built with these credentials makes.

pub fn sign_assertion(&self, a: &mut AssertedAttribution)

Sign a in place: fills its signature_hex over the envelope’s canonical bytes (mirrors polyc_crypto::edge_identity::sign_edge_assertion_into, which this delegates to).

pub fn attach_approval_assertion( &self, request: &mut ApprovalResponseRequest, responder: ExternalIdentity, )

Assert responder as the human who resolved request, and sign it in place (#1553).

Puts an AssertedApproval naming this edge and responder on request, then signs the whole request under the approval-assertion domain — the same ed25519 identity key Self::sign_assertion uses for turn dispatch, since an edge has exactly one identity to assert with.

request must already be FINAL. The signature covers every other field of it — the decision, an approve’s modified arguments, the resolve_token — so a field set after this call invalidates the signature it was meant to be covered by. See polyc_crypto::approval_assertion, which this delegates to.