Struct VerifiedSession 

pub struct VerifiedSession<'view, 'scope, 'inputs, W: Work> { /* private fields */ }

A verified request’s scoped continuation. No document, policy, resolver or budget is reconstructed when selecting a signature or replaying a reference.

Implementations

impl<W: Work> VerifiedSession<'_, '_, '_, W>

pub fn with_key_association_in<Q: Work, R, E>( &self, signature: NodeIdentity, expected: WorkingKey<'_>, work: &Q, visitor: impl FnOnce(KeyAssociation) -> Result<R, E>, ) -> Result<R, CatalogueError<E>>

Associate an original authenticated Signature’s successful key using only the supplied current query execution. Selection, receipt gates, provider comparison and callback admission all charge work, never the completed verification’s producer-local execution. Retained storage keeps its original account; no Reference catalogue, resolver or verifier is run.

The original document/generation, policy, provider and terminal capture cause remain binding. Same is key association, not certificate trust.

impl<W: Work> VerifiedSession<'_, '_, '_, W>

pub fn resolve_bare_name_in<Q: Work>( &self, uri: &str, work: &Q, ) -> Result<BareNameTarget, DsigError>

Resolve #id through this operation’s ID registrations, fragment unescaping and same-document ID semantics, charging work. XMLDSig 1.1 §4.4.3.3 defines the bare-name form; XPointer and non-fragment forms are reported, never interpreted. https://www.w3.org/TR/2013/REC-xmldsig-core1-20130411/#sec-Same-Document

pub fn resolve_digest_method_in<Q: Work>( &self, method: NodeIdentity, work: &Q, ) -> Result<DigestMethodResolution, DsigError>

Interpret an original DigestMethod element. A recognized algorithm that the operation policy forbids is a policy error, not Unsupported.

pub fn begin_digest( &self, algorithm: DigestAlgorithm, ) -> Result<SessionDigest<'_>, DsigError>

Start an incremental digest with the selected provider under the compiled digest policy.

pub fn execution(&self) -> &W

This verified request’s own execution. A continuation that funds its work from the request, rather than from a separately supplied query account, keeps the caller’s local and aggregate ceilings.

pub fn certificate_parser(&self) -> Parser

A DER certificate parser bounded by this operation’s X.509 resource policy (max_x509_work, max_x509_workspace_bytes, under the hard ceilings), on a fresh account of its own, as verification’s certificate processing is. Path validation and certificate storage that use its account obey the same limits.

pub fn certificate_path_bounds(&self) -> ValidationBounds

Shared path-processor bounds from this operation’s key-trust policy, the same bounds verification applied to its own paths.

pub fn certificate_path_verifier<'a, 'p>( &'p self, chain: &'p [&'a Certificate<'a>], anchor: &'a Certificate<'a>, ) -> CertificatePathVerifier<'a, 'p>

Certificate-path signature checks for chain and anchor through this operation’s provider and certificate trust policy.

impl<'view, 'scope, 'inputs, W: Work> VerifiedSession<'view, 'scope, 'inputs, W>

pub fn view(&self) -> DocumentView<'view>

Original immutable view; identities never cross a second parse/projection.

pub fn evidence(&self) -> &VerifyEvidence<OwnedVec<SignatureEvidence, W>>

Results of the original verification. Inspect errors and target status independently of selected instruction authentication.

pub fn into_evidence(self) -> VerifyEvidence<OwnedVec<SignatureEvidence, W>>

Transfer independently owned result facts with their retained account. This transfers no document or operation borrow and no replay capability.

pub fn select_signature( &self, identity: NodeIdentity, ) -> Result<SelectedSignature<'_, 'view, 'scope, 'inputs, W>, DsigError>

Select only a Signature whose original cryptographic decision succeeded. A failed child Manifest digest does not erase that decision.

pub fn with_query<Q: Work, R, E>( &self, identity: NodeIdentity, work: &Q, visitor: impl for<'query> FnOnce(SelectedSignature<'query, 'view, 'scope, 'inputs, W, Q>) -> Result<R, E>, ) -> Result<R, CatalogueError<E>>

Continue an original authenticated signature with a separate current execution. Query scratch cannot escape the callback; the document, provider, policy, authentication and retained storage remain original. Selection, inspection, resolution and transform replay spend work; the original compiled policy’s cumulative allowances are not reset. Use select_signature instead to retain producer-funded execution.