Struct MachineToken 

pub struct MachineToken {
    pub version: u32,
    pub signing_secret: Vec<u8>,
    pub recipient_secret: Vec<u8>,
    pub content_key: Vec<u8>,
    pub source_commit: Vec<u8>,
    pub repo_name: Option<String>,
    pub expires_at: u64,
}

A machine token — packaged credentials for scoped repo access.

Fields

version: u32

Version tag for forward compatibility.

signing_secret: Vec<u8>

Ed25519 signing secret key (32 bytes) — for the machine’s own commits.

recipient_secret: Vec<u8>

X25519 recipient secret key (32 bytes) — for ECIES operations.

content_key: Vec<u8>

Content key (32 bytes) — scoped read access to source_commit.

source_commit: Vec<u8>

CID of the source commit this token grants access to.

repo_name: Option<String>

Repo name (for display/context).

expires_at: u64

Unix timestamp after which this token is invalid.

Implementations

impl MachineToken

pub const VERSION: u32 = 1

pub fn new( signing_secret: &SigningSecretKey, recipient_secret: &RecipientSecretKey, content_key: &[u8; 32], source_commit: Vec<u8>, repo_name: Option<String>, expires_at: u64, ) -> Self

Create a new machine token.

pub fn is_expired(&self, now: u64) -> bool

Check if the token has expired.

pub fn to_bytes(&self) -> CryptoResult<Vec<u8>>

Serialize to CBOR bytes.

pub fn from_bytes(data: &[u8]) -> CryptoResult<Self>

Deserialize from CBOR bytes.

pub fn seal(&self, key: &[u8; 32]) -> CryptoResult<Vec<u8>>

Encrypt the token with a passphrase-derived key.

The token is CBOR-serialized then AES-256-GCM encrypted. Use a key derived from a passphrase, PIN, or random secret.

pub fn unseal(ciphertext: &[u8], key: &[u8; 32]) -> CryptoResult<Self>

Decrypt a sealed token.

pub fn to_base64(&self) -> CryptoResult<String>

Encode as a base64 string (for env vars, CLI output).

pub fn to_vault(&self) -> CryptoResult<KeyVault>

Create a content-key KeyVault from this token’s content key.

The vault is read-only — it can decrypt the source commit’s objects but cannot seal new commits.

pub fn to_signing_key(&self) -> CryptoResult<SigningKey>

Extract the signing key from this token.

pub fn from_base64(s: &str) -> CryptoResult<Self>

Decode from a base64 string.

Trait Implementations

impl<'de> Deserialize<'de> for MachineToken

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for MachineToken

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.