Struct CredentialBundle 

pub struct CredentialBundle { /* private fields */ }

An encrypted local bundle, safe to persist outside the replicated DAG.

This is a local storage format, not a portable Account schema or a recovery export. All convenience logins use this same format, including empty passwords. Encrypted records may be served to filesystem-trusted socket clients; their passwords and decrypted keys need not be sent to a daemon.

Implementations

impl CredentialBundle

pub fn seal( account_id: &ID, keys: &[PrivateKey], password: &str, ) -> Result<Self>

Encrypt exactly these installation keys and this Account locator with one password. Keys must be nonempty and unique. No reference lookup, membership enrollment, or database write occurs. Every password string is accepted, including empty. Empty-string wrapping provides no meaningful confidentiality against anyone holding the bundle.

use eidetica::{ID, account::{CredentialBundle, AccountSigner}, auth::crypto::generate_keypair};
let account_id = ID::from_bytes("example-account-locator");
let (private, public) = generate_keypair();
let encrypted = CredentialBundle::seal(&account_id, &[private], "local password")?;
let bytes = serde_json::to_vec(&encrypted)?; // Persist only outside the Entry DAG.
let stored: CredentialBundle = serde_json::from_slice(&bytes)?;
let unlocked = stored.unlock_for(&account_id, "local password")?;
let acting = AccountSigner::new(account_id.clone(), unlocked.signer(&public)?);
assert_eq!(acting.account_id(), &account_id);
assert_eq!(acting.key_id(), public);
drop(unlocked); // The acting handle owns an independent signer clone.

pub fn unlock(&self, password: &str) -> Result<UnlockedCredentials>

Unlock on the client. The Account locator and every private key are authenticated by the same envelope. Unknown formats, tampering and wrong passwords fail closed without echoing decrypted bytes in diagnostics.

pub fn unlock_for( &self, account_id: &ID, password: &str, ) -> Result<UnlockedCredentials>

Unlock only if the encrypted locator matches the expected Account. A directory hint or copied encrypted blob cannot rebind its locator.

Trait Implementations

impl Clone for CredentialBundle

fn clone(&self) -> CredentialBundle

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CredentialBundle

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for CredentialBundle

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for CredentialBundle

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.