Struct PackageContract 

pub struct PackageContract {
    pub input_schema: Value,
    pub output_schema: Value,
    pub workers: Vec<WorkerContract>,
    pub children: Vec<ChildContract>,
    pub signals: Vec<SignalContract>,
    pub additional_workflows: Vec<AdditionalWorkflowContract>,
    pub unscoped_activities: Vec<String>,
    pub workloop: Option<WorkloopContract>,
}

The complete contract surface committed into a package’s .v4 identity.

Fields

input_schema: Value

Primary workflow input schema.

output_schema: Value

Primary workflow output schema.

workers: Vec<WorkerContract>

Queue-scoped activity declarations.

children: Vec<ChildContract>

Declared child workflow callables.

signals: Vec<SignalContract>

Declared signal payloads.

additional_workflows: Vec<AdditionalWorkflowContract>

Additional workflow entry schemas in this package.

unscoped_activities: Vec<String>

Activity names retained by legacy project manifests that cannot declare a queue or typed activity surface. They remain identity-bound but do not create a queue declaration.

workloop: Option<WorkloopContract>

The workloop declaration surface, when the package’s entry document is a workloop. This is what the ENGINE reads at start time to arm the cadence, seed generation 1’s carries and evaluate tolerances, so it must travel with the deployed archive rather than only with the in-process compile output — a server restart must not forget what a deployed loop’s tolerances were.

IDENTITY-BOUND, and that is not a formality: a tolerance rewritten in storage changes WHEN a loop alarms, and a retention window rewritten in storage changes WHAT is destroyed. Both are executable authority, so two packages that differ in them must not be one version.

Implementations

impl PackageContract

pub fn unenforceable_schemas(&self) -> Vec<UnenforceableSchema>

Every declared schema in this contract that cannot be compiled into a validator, in declaration order.

This is the whole contract surface, not only the schemas today’s admission boundaries happen to read: a declaration is identity-bound, so a package that commits to a shape no validator can compile has promised something it can never be held to, whichever boundary reaches it first. An empty result means every declaration this package makes is one the engine can actually enforce.

A declaration that constrains nothing (declares_nothing) is not a failure — it says nothing on purpose, and admission skips it deliberately rather than by breaking.

pub fn declared_signal(&self, signal_name: &str) -> Option<&SignalContract>

The declared signal record for signal_name, when this contract declares one.

pub fn declared_signal_names(&self) -> Vec<&str>

Every declared signal name, in stable sorted order.

Used to tell a caller which names the package actually accepts when it named one the package does not declare.

pub fn entry_input_schema(&self, workflow_type: &str) -> &Value

The declared input schema for the entry workflow_type.

A package archive can carry several workflow entries under one identity: the primary entry’s schema is PackageContract::input_schema and every additional entry carries its own in PackageContract::additional_workflows. An additional entry is matched by name first, so a synthesized child entry is never validated against the primary entry’s shape; any other name is the primary entry, which is the only other type a catalog can hold for this identity.

impl PackageContract

pub fn canonical_bytes(&self) -> Vec<u8>

Returns the deterministic binary encoding committed by the current identity domain.

Declaration vectors and JSON object keys are sorted before encoding. JSON whitespace and source map insertion order therefore cannot affect package identity.

pub fn legacy_v5_canonical_bytes(&self) -> Vec<u8>

The superseded .v5 encoding, exactly as every released cut from v0.19 through v0.24 computed it: no per-action agent byte, no workloop block.

🔴 VERIFICATION-ONLY MIGRATION SURFACE. This exists so the verifier in crate::hash can re-attest archives those releases minted — a store restarted under the current build must not strand its own recorded deployments. Nothing ever MINTS a .v5 identity again; calling this anywhere except a verifier is a defect.

impl PackageContract

pub fn from_manifest(manifest: &Manifest) -> Self

Produces the most precise contract available from a legacy manifest.

This never invents a queue or schemas for bare activity names. Such names are committed as unscoped records and therefore cannot satisfy a structural queue-service check.

Trait Implementations

impl Clone for PackageContract

fn clone(&self) -> PackageContract

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PackageContract

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for PackageContract

fn default() -> PackageContract

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for PackageContract

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for PackageContract

impl PartialEq for PackageContract

fn eq(&self, other: &PackageContract) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for PackageContract

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for PackageContract