pub struct Package { /* private fields */ }Expand description
A validated, integrity-checked .aion package loaded fully into memory.
The engine performs actual VM registration. This crate only supplies the validated manifest, canonical beam bytes, optional source, and deployed module names the engine can register.
Implementations§
Source§impl Package
impl Package
Sourcepub fn load_from_path(
path: impl AsRef<Path>,
limits: ExtractionLimits,
) -> Result<Self, PackageError>
pub fn load_from_path( path: impl AsRef<Path>, limits: ExtractionLimits, ) -> Result<Self, PackageError>
Loads a .aion package from a filesystem path.
The caller chooses an explicit ExtractionLimits inflate budget;
untrusted input must be bounded.
§Errors
Returns a typed PackageError for unreadable archives, malformed
manifests or entries, unsupported format versions, integrity mismatches,
missing entry modules, or contents inflating past limits.
Sourcepub fn load_from_bytes(
bytes: impl AsRef<[u8]>,
limits: ExtractionLimits,
) -> Result<Self, PackageError>
pub fn load_from_bytes( bytes: impl AsRef<[u8]>, limits: ExtractionLimits, ) -> Result<Self, PackageError>
Loads a .aion package from an in-memory byte buffer.
The caller chooses an explicit ExtractionLimits inflate budget;
untrusted input must be bounded.
§Errors
Returns a typed PackageError for unreadable archives, malformed
manifests or entries, unsupported format versions, integrity mismatches,
missing entry modules, or contents inflating past limits.
Sourcepub const fn manifest(&self) -> &Manifest
pub const fn manifest(&self) -> &Manifest
Returns the validated manifest loaded from manifest.json.
Sourcepub const fn beams(&self) -> &BeamSet
pub const fn beams(&self) -> &BeamSet
Returns the canonical compiled beam set extracted from beam/ entries.
Sourcepub const fn source(&self) -> &BTreeMap<String, Vec<u8>>
pub const fn source(&self) -> &BTreeMap<String, Vec<u8>>
Returns optional Gleam source files extracted verbatim from src/ entries.
Sourcepub const fn content_hash(&self) -> &ContentHash
pub const fn content_hash(&self) -> &ContentHash
Returns the recomputed content hash that proved package integrity.
Sourcepub fn has_declared_timeout(&self) -> bool
pub fn has_declared_timeout(&self) -> bool
Whether this package’s version identity commits to an explicitly authored workflow timeout.
This is the single, tamper-evident authority for “did the author declare
a workflow timeout”: it is true only when the content hash is the
domain-separated timeout-bearing identity over exactly manifest.timeout.
A legacy (beams-only) archive — even one whose manifest still carries a
defaulted timeout value — reads as false, so it can never arm a
deadline. Callers pair this with Self::manifest to read the declared
timeout: the value is trustworthy precisely because it is bound into the
version hash.
Sourcepub fn declared_timeout(&self) -> Option<Duration>
pub fn declared_timeout(&self) -> Option<Duration>
The explicitly authored workflow timeout of the primary entry, or None.
Returns Some only when the package identity commits to a declared
timeout (see Self::has_declared_timeout); otherwise None, so a
legacy or defaulted manifest yields no deadline.
Sourcepub fn declared_entry_timeout(
&self,
entry_timeout: Option<Duration>,
) -> Option<Duration>
pub fn declared_entry_timeout( &self, entry_timeout: Option<Duration>, ) -> Option<Duration>
The authenticated authored timeout for an entry carrying entry_timeout.
This is the per-entry declaredness authority: the timeout-bearing
identity binds EVERY entry’s timeout (primary and additional), so when
Self::has_declared_timeout is true each entry’s manifest timeout is
authenticated and returned verbatim. When the identity is legacy
(beams-only) — or does not verify against the full per-entry timeout
vector — every entry reads as undeclared and arms nothing, regardless of
what timeout value a manifest entry happens to carry. Callers pass the
primary entry’s manifest.timeout or an additional
crate::WorkflowEntry::timeout; the gate is identical for both.
Sourcepub fn version_record(&self) -> WorkflowVersion
pub fn version_record(&self) -> WorkflowVersion
Produces the canonical cross-system version record for this loaded package.
Sourcepub fn deployed_modules(&self) -> Vec<(String, &[u8])>
pub fn deployed_modules(&self) -> Vec<(String, &[u8])>
Returns engine-ready deployed module names paired with their beam bytes.
The engine performs the actual VM registration; this crate only supplies the validated namespaced names and exact module bytes.
Sourcepub fn deployed_entry_module(&self) -> String
pub fn deployed_entry_module(&self) -> String
Returns the deployed namespaced module name for the manifest entry module.
Sourcepub fn to_archive_bytes(&self) -> Result<Vec<u8>, PackageError>
pub fn to_archive_bytes(&self) -> Result<Vec<u8>, PackageError>
Re-serialises this validated package into canonical .aion archive
bytes.
The deterministic crate::PackageBuilder write path is used, so the
output round-trips through Self::load_from_bytes to a package with
the same legacy or explicit-timeout content hash, canonical manifest
digest, and source set. This is the persistence form for runtime-deployed
packages: the engine stores these bytes so a deploy survives restart.
§Errors
Returns PackageError variants for manifest serialisation or ZIP
writer failures; the entry module is already proven present by load
validation.