pub struct Package { /* private fields */ }Expand description
A validated, integrity-checked .aion package loaded fully into memory.
The engine performs actual VM registration. This crate only supplies the validated manifest, canonical beam bytes, optional source, and deployed module names the engine can register.
Implementations§
Source§impl Package
impl Package
Sourcepub fn load_from_path(
path: impl AsRef<Path>,
limits: ExtractionLimits,
) -> Result<Self, PackageError>
pub fn load_from_path( path: impl AsRef<Path>, limits: ExtractionLimits, ) -> Result<Self, PackageError>
Loads a .aion package from a filesystem path.
The caller chooses an explicit ExtractionLimits inflate budget;
untrusted input must be bounded.
§Errors
Returns a typed PackageError for unreadable archives, malformed
manifests or entries, unsupported format versions, integrity mismatches,
missing entry modules, or contents inflating past limits.
Sourcepub fn load_from_bytes(
bytes: impl AsRef<[u8]>,
limits: ExtractionLimits,
) -> Result<Self, PackageError>
pub fn load_from_bytes( bytes: impl AsRef<[u8]>, limits: ExtractionLimits, ) -> Result<Self, PackageError>
Loads a .aion package from an in-memory byte buffer.
The caller chooses an explicit ExtractionLimits inflate budget;
untrusted input must be bounded.
§Errors
Returns a typed PackageError for unreadable archives, malformed
manifests or entries, unsupported format versions, integrity mismatches,
missing entry modules, or contents inflating past limits.
Sourcepub const fn manifest(&self) -> &Manifest
pub const fn manifest(&self) -> &Manifest
Returns the validated manifest loaded from manifest.json.
Sourcepub const fn beams(&self) -> &BeamSet
pub const fn beams(&self) -> &BeamSet
Returns the canonical compiled beam set extracted from beam/ entries.
Sourcepub const fn source(&self) -> &BTreeMap<String, Vec<u8>>
pub const fn source(&self) -> &BTreeMap<String, Vec<u8>>
Returns optional Gleam source files extracted verbatim from src/ entries.
Sourcepub const fn awl(&self) -> Option<&AwlSource>
pub const fn awl(&self) -> Option<&AwlSource>
Returns the authored AWL document and its imported schema files, when the archive carries them.
None for every archive built from a Gleam project and for every AWL
archive written before the awl/ entry families existed — the field is
provenance, never a load requirement.
This is PROVENANCE ONLY: it never participates in the package’s
ContentHash, so a consumer must not treat it as a version input.
Sourcepub const fn content_hash(&self) -> &ContentHash
pub const fn content_hash(&self) -> &ContentHash
Returns the recomputed content hash that proved package integrity.
Sourcepub fn contract(&self) -> Result<&PackageContract, ContractIdentityError>
pub fn contract(&self) -> Result<&PackageContract, ContractIdentityError>
Returns the durable contract only when the stored identity commits to it.
§Errors
Returns ContractIdentityError::RedeployRequired for every pre-.v4
identity, including integrity-valid legacy, .v1, and .v3 packages.
Sourcepub fn has_declared_timeout(&self) -> bool
pub fn has_declared_timeout(&self) -> bool
Whether this package’s version identity commits to an explicitly authored workflow timeout.
This is the single, tamper-evident authority for “did the author declare
a workflow timeout”: it is true only when the manifest carries an
authored timeout AND the content hash is the domain-separated
contract-bearing identity that binds it. The .v4 identity commits to
every package’s timeout vector, so identity alone does not mean a
timeout was authored — absence of the value is absence of the
declaration. A legacy (beams-only) archive — even one whose manifest
still carries a defaulted timeout value — reads as false, so it can
never arm a deadline. Callers pair this with Self::manifest to read
the declared timeout: the value is trustworthy precisely because it is
bound into the version hash.
Sourcepub fn declared_timeout(&self) -> Option<Duration>
pub fn declared_timeout(&self) -> Option<Duration>
The explicitly authored workflow timeout of the primary entry, or None.
Returns Some only when the package identity commits to a declared
timeout (see Self::has_declared_timeout); otherwise None, so a
legacy or defaulted manifest yields no deadline.
Sourcepub fn declared_entry_timeout(
&self,
entry_timeout: Option<Duration>,
) -> Option<Duration>
pub fn declared_entry_timeout( &self, entry_timeout: Option<Duration>, ) -> Option<Duration>
The authenticated authored timeout for an entry carrying entry_timeout.
This is the per-entry declaredness authority: the timeout-bearing
identity binds EVERY entry’s timeout (primary and additional), so when
Self::has_declared_timeout is true each entry’s manifest timeout is
authenticated and returned verbatim. When the identity is legacy
(beams-only) — or does not verify against the full per-entry timeout
vector — every entry reads as undeclared and arms nothing, regardless of
what timeout value a manifest entry happens to carry. Callers pass the
primary entry’s manifest.timeout or an additional
crate::WorkflowEntry::timeout; the gate is identical for both.
Sourcepub fn version_record(&self) -> WorkflowVersion
pub fn version_record(&self) -> WorkflowVersion
Produces the canonical cross-system version record for this loaded package.
Sourcepub fn deployed_modules(&self) -> Vec<(String, &[u8])>
pub fn deployed_modules(&self) -> Vec<(String, &[u8])>
Returns engine-ready deployed module names paired with their beam bytes.
The engine performs the actual VM registration; this crate only supplies the validated namespaced names and exact module bytes.
Sourcepub fn deployed_entry_module(&self) -> String
pub fn deployed_entry_module(&self) -> String
Returns the deployed namespaced module name for the manifest entry module.
Sourcepub fn to_archive_bytes(&self) -> Result<Vec<u8>, PackageError>
pub fn to_archive_bytes(&self) -> Result<Vec<u8>, PackageError>
Re-serialises this validated package into canonical .aion archive
bytes.
The deterministic crate::PackageBuilder write path is used, so the
output round-trips through Self::load_from_bytes to a package with
the same legacy or explicit-timeout content hash, canonical manifest
digest, source set, and AWL provenance. This is the persistence form for
runtime-deployed packages: the engine stores these bytes so a deploy
survives restart, and this path rebuilds the archive from FIELDS — so
anything the loaded package does not hold as a field is not persisted.
§Errors
Returns PackageError variants for manifest serialisation or ZIP
writer failures; the entry module is already proven present by load
validation.