Function build_apex_client

atomic-cli/src/commands/client.rs:82–110

Build a [`StorageClient`] targeting the server **apex** (no org subdomain). Apex-scoped endpoints — notably `GET /orgs` ("list my orgs") and `POST /orgs` ("create org") — span orgs, so they must be hit on the bare server host rather than an ` . ` subdomain. This helper resolves the active server profile, mints a self-signed EdDSA JWT against the apex URL, and constructs a `StorageClient`

(server_override: Option<&str>)

/// - Identity store cannot be opened or no default identity set.
/// - HTTP client construction failure.
pub async fn build_apex_client(server_override: Option<&str>) -> CliResult<StorageClient> {
    let config = GlobalConfig::load()
        .map_err(|e| CliError::Internal(anyhow::anyhow!("Failed to load global config: {}", e)))?;

    let server = config
        .resolve_server(server_override)
        .map_err(|e| CliError::Internal(anyhow::anyhow!("{}", e)))?
        .0;

    let apex_url = server
        .url
        .clone()
        .ok_or_else(|| server_url_missing(server_override))?;

    let identity = resolve_identity_for_server(server)?;

    // Self-signed EdDSA JWT keyed by the identity's own public key; minted
    // against the apex URL (the token is portable across the deployment).
    let bearer_token = crate::commands::token::get_token(&apex_url, &identity).await?;

    let delegation = delegation_for(&identity, &apex_url);
    let client =
        StorageClient::with_delegation(&apex_url, "", &bearer_token, delegation.as_deref())
            .map_err(|e| {
                CliError::Internal(anyhow::anyhow!("Failed to create storage client: {}", e))
            })?;

    Ok(client)
}

/// The encoded certificate this identity presents, if it is an agent.
///