Struct NamespaceMinter 

pub struct NamespaceMinter { /* private fields */ }

Minted-on-use hook pairing the durable namespace registry with its AutoCreate policy.

Holds an Arc<dyn NamespaceStore> and the policy, so it is cheap to clone and share between the worker-registration and workflow-start mint seams. The hook is the only place the auto-create policy is implemented; both seams call NamespaceMinter::mint_or_gate, so the behaviour can never diverge across transports or call sites.

Implementations

impl NamespaceMinter

pub fn new(store: Arc<dyn NamespaceStore>, policy: AutoCreate) -> Self

Build a minter over a durable namespace store and an auto-create policy.

pub fn with_routing(self, routing: NamespaceRouting) -> Self

Attach the namespace-mint routing context a clustered boot builds, so a namespace whose registry shard this node does not own is minted by the node that does instead of being fenced forever.

Pure builder addition: without it the minter mints locally exactly as before, which is what every single-node boot and every unit test does.

pub fn without_routing(self) -> Self

Drop the routing context, pinning every mint to THIS node.

Used by the owner-side MintNamespace handler: a mint that already travelled must not travel again, so an arrival whose shard has moved on is answered with the local fence’s typed refusal rather than a re-forward chain. The refusal returns to the initiator, which surfaces it; nothing retries internally.

pub fn with_caller_credentials(self, credentials: MintCredentials) -> Self

Carry the inbound request’s caller credentials onto any forwarded mint, so the owning node authorizes the caller exactly as this node did.

A no-op with no routing context attached (nothing can be forwarded).

pub fn with_cluster_publisher(self, publisher: ClusterEventPublisher) -> Self

Attach the WS3 cluster-event publisher so a first mint pushes a live namespace created delta to the ops console (Control-Plane Phase 1, S8).

Pure builder addition: without it the minter behaves exactly as before (durable record + the tracing audit event only). The publisher is the deployment-global cluster channel — the same one the worker registry and supervisor emit on — so the delta reuses the existing browser push path rather than inventing a parallel channel.

pub fn policy(&self) -> AutoCreate

The auto-create policy this minter applies.

pub async fn mint_or_gate( &self, namespaces: &[String], origin: NamespaceOrigin, ) -> Result<(), ServerError>

Apply the minted-on-use policy to an already-authorized namespace set.

The caller MUST have authorized every namespace in namespaces before calling this — the mint is auth-scoped by construction, never a path to create a namespace the caller cannot use.

• AutoCreate::Open: each namespace is durably upserted via NamespaceStore::register_namespace with the given origin; a MintOutcome::Created (first mint) emits a loud structured tracing event — the Phase-1 “namespace created” signal (the socket-delta surfacing lands in a later slice). A MintOutcome::AlreadyExisted is silent (idempotent re-reference), so no duplicate row and no second “created” event ever appear.
• AutoCreate::Closed: a namespace with no registry row is rejected with a namespace-denied error; nothing is created.

A aion_store::StoreError::NotOwner from a quorum mint (this node is not the namespace shard’s owner) propagates unchanged through ? as ServerError::StoreBackend, which surfaces as the typed, retryable NotOwner wire code — never a silent success.

Closed-policy existence check (Phase 1). Existence is probed by registry-row presence (NamespaceStore::get_namespace). In a fresh Phase-1 deployment every used namespace already has a row minted on first register/start, so a missing row correctly means “never referenced”.

Errors

Returns ServerError::StoreBackend if a durable upsert/lookup fails (including a retryable NotOwner fence), or ServerError::Namespace when closed rejects an unknown namespace.

pub async fn create_explicit( &self, name: &str, ) -> Result<MintOutcome, ServerError>

Explicit operator create (POST /namespaces, S7) routed through the SAME MintOutcome::Created choke-point so the live “namespace created” delta fires once for an operator-minted namespace exactly as it does for a worker- or start-minted one.

Unlike NamespaceMinter::mint_or_gate this never gates on the AutoCreate::Closed policy: an explicit operator create is the documented escape hatch that brings a namespace into being in a locked-down deployment. The caller MUST have authorized name first (the HTTP handler runs the grant check), so the create is auth-scoped by construction.

Returns the MintOutcome so the handler can report created-vs-existing to the operator. Idempotent: a re-create observes AlreadyExisted and emits no second delta.

Errors

Returns ServerError::StoreBackend if the durable upsert/lookup fails (including a retryable NotOwner fence).

pub async fn set_placement( &self, name: &str, placement: NamespacePlacement, ) -> Result<bool, ServerError>

Set an existing namespace’s durable placement directive and emit the placement-changed socket delta (Control-Plane Phase 2, P2-P2).

The caller MUST have authorized name first (the HTTP handler runs the SAME grant check POST /namespaces does), so the placement change is auth-scoped by construction — a caller can never place a namespace it cannot access. The durable write is the idempotent quorum value-CAS update of the record’s placement field (NamespaceStore::set_namespace_placement): re-applying the same placement is a successful no-op.

Returns true when the placement was durably set, or false when no registry row exists for name (placement targets an already-minted namespace, so the handler surfaces a not-found rather than minting here). The placement-changed delta fires only on a real set (never on the not-found path), mirroring the Created-edge discipline of Self::announce_created.

Errors

Returns ServerError::StoreBackend if the durable update fails (including a retryable NotOwner fence).

pub async fn placement_of( &self, name: &str, ) -> Result<NamespacePlacement, ServerError>

Read a namespace’s durable placement directive, for the worker-admission gate (Control-Plane Phase 2, P2-I1). Reads the SAME registry record Self::set_placement writes — the single source of truth — so admission and dispatch can never disagree on a namespace’s placement.

An absent registry row means no placement applies: NamespacePlacement::Unplaced (any worker), so a namespace that has not yet been minted never gates a registration.

Errors

Returns ServerError::StoreBackend if the durable lookup fails (including a retryable NotOwner fence).

Trait Implementations

impl Clone for NamespaceMinter

fn clone(&self) -> NamespaceMinter

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for NamespaceMinter

fn fmt(&self, formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.