aion_package/
manifest.rs

1//! Typed `manifest.json` model and `.aion` format-version checks.
2
3use std::{fmt, time::Duration};
4
5use serde::{Deserialize, Serialize};
6use sha2::{Digest, Sha256};
7
8use crate::PackageError;
9
10/// Canonical SHA-256 digest of one manifest's serialized JSON form.
11///
12/// Legacy package versions cover the canonical beam set only; packages that
13/// opt an explicit workflow timeout into identity additionally cover that
14/// timeout. Other `manifest.json` fields remain excluded, so this digest is the
15/// tripwire for divergent manifests that still carry one version: the engine
16/// catalog retains it and refuses a mismatched idempotent reload.
17#[derive(Clone, Debug, PartialEq, Eq, Hash)]
18pub struct ManifestDigest([u8; 32]);
19
20impl ManifestDigest {
21    /// Creates a manifest digest from raw SHA-256 digest bytes.
22    #[must_use]
23    pub const fn from_bytes(bytes: [u8; 32]) -> Self {
24        Self(bytes)
25    }
26
27    /// Returns the raw SHA-256 digest bytes.
28    #[must_use]
29    pub const fn as_bytes(&self) -> &[u8; 32] {
30        &self.0
31    }
32}
33
34impl fmt::Display for ManifestDigest {
35    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
36        for byte in &self.0 {
37            write!(formatter, "{byte:02x}")?;
38        }
39        Ok(())
40    }
41}
42
43/// Current `.aion` manifest and archive-layout schema version supported by this crate.
44pub const CURRENT_FORMAT_VERSION: u32 = 1;
45
46/// Textual content-hash version stored in `manifest.json`.
47///
48/// The content hash is computed and stamped by later package-building code; this
49/// type keeps the manifest field distinct from unrelated strings while this
50/// module remains side-effect free.
51#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
52pub struct ManifestVersion(pub String);
53
54impl ManifestVersion {
55    /// Creates a manifest version value from the hash's stable textual form.
56    #[must_use]
57    pub fn new(version: impl Into<String>) -> Self {
58        Self(version.into())
59    }
60
61    /// Returns the stored textual content-hash version.
62    #[must_use]
63    pub fn as_str(&self) -> &str {
64        &self.0
65    }
66}
67
68/// Activity declaration recorded in the package manifest.
69#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
70pub struct DeclaredActivity {
71    /// Stable `activity_type` key naming an activity type invoked by workflow code.
72    ///
73    /// This follows the current `aion-core` event convention, where scheduled
74    /// activity types are represented as strings.
75    #[serde(rename = "activity_type")]
76    pub activity_type: String,
77}
78
79/// An additional workflow entry exported by the same `.aion` archive.
80///
81/// Additional entries share the archive's content hash and BEAM closure with
82/// the primary manifest entry. `workflow_type` is the routing name, while
83/// `entry_module` and `entry_function` identify the callable in that closure.
84#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
85pub struct WorkflowEntry {
86    /// Stable workflow type used by start and child-spawn routing.
87    pub workflow_type: String,
88    /// Logical BEAM module exporting the entry function.
89    pub entry_module: String,
90    /// Exported engine entry function.
91    pub entry_function: String,
92    /// JSON Schema for the entry's input payload.
93    #[serde(serialize_with = "crate::canonical::serialize_value")]
94    pub input_schema: serde_json::Value,
95    /// JSON Schema for the entry's result payload.
96    #[serde(serialize_with = "crate::canonical::serialize_value")]
97    pub output_schema: serde_json::Value,
98    /// Explicitly authored workflow execution timeout, or `None` when the entry
99    /// declared none. Serialised only when present, so a manifest written for an
100    /// entry with no authored timeout carries no `timeout` key at all; a legacy
101    /// manifest that still carries a defaulted value decodes to `Some(_)` but is
102    /// held non-arming by the package's content-hash identity (see
103    /// [`crate::Package`]). Never a buried default.
104    #[serde(default, skip_serializing_if = "Option::is_none")]
105    pub timeout: Option<Duration>,
106    /// Whether this entry is package-internal rather than operator-authored.
107    #[serde(default)]
108    pub internal: bool,
109}
110
111/// Typed on-disk `manifest.json` descriptor for a `.aion` package.
112///
113/// The public field names are the stable JSON keys written into `manifest.json`:
114/// `entry_module`, `entry_function`, `input_schema`, `output_schema`, `timeout`,
115/// `activities`, `version`, and `format_version`.
116#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
117pub struct Manifest {
118    /// Stable `entry_module` key naming the logical workflow entry module.
119    #[serde(rename = "entry_module")]
120    pub entry_module: String,
121    /// Stable `entry_function` key naming the exported workflow entry function.
122    #[serde(rename = "entry_function")]
123    pub entry_function: String,
124    /// Stable `input_schema` key containing a JSON-Schema document for input payloads.
125    #[serde(
126        rename = "input_schema",
127        serialize_with = "crate::canonical::serialize_value"
128    )]
129    pub input_schema: serde_json::Value,
130    /// Stable `output_schema` key containing a JSON-Schema document for result payloads.
131    #[serde(
132        rename = "output_schema",
133        serialize_with = "crate::canonical::serialize_value"
134    )]
135    pub output_schema: serde_json::Value,
136    /// Stable `timeout` key: the explicitly authored workflow timeout, or absent.
137    ///
138    /// `None` is serialised as an omitted key — a manifest written for a workflow
139    /// with no authored timeout carries no `timeout` at all, so nothing is armed.
140    /// A legacy manifest that carries a defaulted duration decodes to `Some(_)`,
141    /// but arming is authorised by the package's content-hash identity, not by
142    /// this field's presence: a legacy (beams-only) identity reads as not
143    /// declared regardless (see [`crate::Package::has_declared_timeout`]). This
144    /// key therefore never encodes a buried default.
145    #[serde(rename = "timeout", default, skip_serializing_if = "Option::is_none")]
146    pub timeout: Option<Duration>,
147    /// Stable `activities` key listing activity types declared by the workflow.
148    #[serde(rename = "activities")]
149    pub activities: Vec<DeclaredActivity>,
150    /// Stable `version` key containing the package content hash textual value.
151    #[serde(rename = "version")]
152    pub version: ManifestVersion,
153    /// Stable `format_version` key identifying the `.aion` format schema version.
154    ///
155    /// This lets future layout changes be detected rather than silently misread.
156    #[serde(rename = "format_version")]
157    pub format_version: u32,
158    /// Additional workflow entries exported by this same archive and pinned to
159    /// the same content hash. Absent in packages created before multi-entry
160    /// registration.
161    #[serde(default, skip_serializing_if = "Vec::is_empty")]
162    pub additional_workflows: Vec<WorkflowEntry>,
163}
164
165impl Manifest {
166    /// Checks whether this manifest declares a supported `.aion` format version.
167    ///
168    /// # Errors
169    ///
170    /// Returns [`PackageError::UnknownFormatVersion`] when `format_version` is
171    /// not [`CURRENT_FORMAT_VERSION`].
172    pub fn check_format_version(&self) -> Result<(), PackageError> {
173        if self.format_version == CURRENT_FORMAT_VERSION {
174            Ok(())
175        } else {
176            Err(PackageError::UnknownFormatVersion {
177                found: self.format_version,
178            })
179        }
180    }
181
182    /// Computes the canonical SHA-256 digest of this manifest.
183    ///
184    /// The digest covers the manifest's stable serialized JSON form (the same
185    /// field names and ordering written into `manifest.json`), so any
186    /// semantic difference — entry function, schemas, timeout, declared
187    /// activities — produces a different digest even when the beam set (and
188    /// therefore the content hash) is unchanged.
189    ///
190    /// The embedded schema documents serialize through
191    /// [`crate::canonical::serialize_value`], so the digest depends on the
192    /// schemas' content and not on the `serde_json` map representation the
193    /// build happened to resolve.
194    ///
195    /// # Errors
196    ///
197    /// Returns [`PackageError::ManifestSerialise`] when the manifest cannot be
198    /// serialized to JSON.
199    pub fn canonical_digest(&self) -> Result<ManifestDigest, PackageError> {
200        let bytes = serde_json::to_vec(self)
201            .map_err(|source| PackageError::ManifestSerialise { source })?;
202        let mut digest = Sha256::new();
203        digest.update(&bytes);
204        Ok(ManifestDigest(digest.finalize().into()))
205    }
206}
207
208#[cfg(test)]
209mod tests {
210    use std::time::Duration;
211
212    use serde_json::json;
213
214    use super::{
215        CURRENT_FORMAT_VERSION, DeclaredActivity, Manifest, ManifestVersion, WorkflowEntry,
216    };
217    use crate::PackageError;
218
219    fn sample_manifest() -> Manifest {
220        Manifest {
221            entry_module: "workflow/order".to_owned(),
222            entry_function: "run".to_owned(),
223            input_schema: json!({
224                "$schema": "https://json-schema.org/draft/2020-12/schema",
225                "type": "object",
226                "required": ["order_id"],
227                "properties": {
228                    "order_id": { "type": "string" },
229                    "retry": { "type": "boolean" }
230                }
231            }),
232            output_schema: json!({
233                "$schema": "https://json-schema.org/draft/2020-12/schema",
234                "type": "object",
235                "required": ["status"],
236                "properties": {
237                    "status": { "enum": ["accepted", "rejected"] },
238                    "total": { "type": "number" }
239                }
240            }),
241            timeout: Some(Duration::new(30, 250_000_000)),
242            activities: vec![
243                DeclaredActivity {
244                    activity_type: "charge_card".to_owned(),
245                },
246                DeclaredActivity {
247                    activity_type: "send_receipt".to_owned(),
248                },
249            ],
250            version: ManifestVersion::new(
251                "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
252            ),
253            format_version: CURRENT_FORMAT_VERSION,
254            additional_workflows: Vec::new(),
255        }
256    }
257
258    #[test]
259    fn manifest_round_trips_losslessly_through_json() -> Result<(), serde_json::Error> {
260        let manifest = sample_manifest();
261
262        let json = serde_json::to_string(&manifest)?;
263        let decoded: Manifest = serde_json::from_str(&json)?;
264
265        assert_eq!(decoded, manifest);
266        Ok(())
267    }
268
269    #[test]
270    fn absent_additional_workflow_list_loads_as_legacy_empty() -> Result<(), serde_json::Error> {
271        let mut value = serde_json::to_value(sample_manifest())?;
272        let object = value
273            .as_object_mut()
274            .ok_or_else(|| serde_json::Error::io(std::io::Error::other("manifest not object")))?;
275        object.remove("additional_workflows");
276        let decoded: Manifest = serde_json::from_value(value)?;
277        assert!(decoded.additional_workflows.is_empty());
278        Ok(())
279    }
280
281    #[test]
282    fn additional_workflow_entry_round_trips_with_internal_flag() -> Result<(), serde_json::Error> {
283        let mut manifest = sample_manifest();
284        manifest.additional_workflows.push(WorkflowEntry {
285            workflow_type: "awl_distribute_items_0".to_owned(),
286            entry_module: manifest.entry_module.clone(),
287            entry_function: "awl_distribute_items_0_run".to_owned(),
288            input_schema: json!({ "type": "object" }),
289            output_schema: json!({ "type": "string" }),
290            timeout: Some(Duration::from_secs(30)),
291            internal: true,
292        });
293        let encoded = serde_json::to_string(&manifest)?;
294        let decoded: Manifest = serde_json::from_str(&encoded)?;
295        assert_eq!(decoded, manifest);
296        assert!(
297            decoded
298                .additional_workflows
299                .first()
300                .is_some_and(|entry| entry.internal)
301        );
302        Ok(())
303    }
304
305    #[test]
306    fn manifest_with_schemas_and_declared_activities_round_trips() -> Result<(), serde_json::Error>
307    {
308        let manifest = sample_manifest();
309
310        let json = serde_json::to_string(&manifest)?;
311        let decoded: Manifest = serde_json::from_str(&json)?;
312
313        assert_eq!(
314            decoded.input_schema["properties"]["order_id"]["type"],
315            "string"
316        );
317        assert_eq!(
318            decoded.output_schema["properties"]["status"]["enum"][0],
319            "accepted"
320        );
321        assert_eq!(decoded.activities.len(), 2);
322        assert_eq!(decoded, manifest);
323        Ok(())
324    }
325
326    #[test]
327    fn supported_format_version_passes() -> Result<(), PackageError> {
328        sample_manifest().check_format_version()
329    }
330
331    /// Identical manifests digest identically; any semantic change (entry
332    /// function here) changes the digest even though the beam set — and
333    /// therefore the content hash — is untouched.
334    #[test]
335    fn canonical_digest_detects_manifest_divergence() -> Result<(), PackageError> {
336        let manifest = sample_manifest();
337        let same = sample_manifest();
338        let mut diverged = sample_manifest();
339        diverged.entry_function = "start".to_owned();
340
341        assert_eq!(manifest.canonical_digest()?, same.canonical_digest()?);
342        assert_ne!(manifest.canonical_digest()?, diverged.canonical_digest()?);
343        Ok(())
344    }
345
346    #[test]
347    fn canonical_digest_renders_as_lowercase_hex() -> Result<(), PackageError> {
348        let digest = sample_manifest().canonical_digest()?;
349        let text = digest.to_string();
350
351        assert_eq!(text.len(), 64);
352        assert!(
353            text.bytes()
354                .all(|byte| matches!(byte, b'0'..=b'9' | b'a'..=b'f'))
355        );
356        Ok(())
357    }
358
359    #[test]
360    fn unsupported_format_version_returns_typed_error() {
361        let mut manifest = sample_manifest();
362        manifest.format_version = CURRENT_FORMAT_VERSION + 1;
363
364        let result = manifest.check_format_version();
365
366        assert!(matches!(
367            result,
368            Err(PackageError::UnknownFormatVersion { found }) if found == CURRENT_FORMAT_VERSION + 1
369        ));
370    }
371
372    #[test]
373    fn manifest_json_keys_are_stable() -> Result<(), serde_json::Error> {
374        let manifest = sample_manifest();
375
376        let json = serde_json::to_value(&manifest)?;
377
378        assert!(json.get("entry_module").is_some());
379        assert!(json.get("entry_function").is_some());
380        assert!(json.get("input_schema").is_some());
381        assert!(json.get("output_schema").is_some());
382        assert!(json.get("timeout").is_some());
383        assert!(json.get("activities").is_some());
384        assert!(json.get("version").is_some());
385        assert!(json.get("format_version").is_some());
386        assert_eq!(json["activities"][0]["activity_type"], "charge_card");
387        Ok(())
388    }
389}
aion_package/manifest.rs

aion_package/
manifest.rs
