Crate appcore_transfer 

Verified, bounded transfer. Trust in descriptors and source selection belongs to deployment. Download completion never installs an artifact or changes replication state.

Structs

ObjectDescriptor

Complete object plus exact ordered block hashes. A digest is not authenticity. Deployment must authenticate this descriptor before admitting a transfer.

SourceBinding

Deployment-approved source identity and provider; not discovery or authentication.

TransferControl

Shared cancellation/deadline for all bounded workers; never starts background tasks.

TransferLimits

Admission bounds, validated before network or persistent work.

TransferOptions

Per-invocation scheduling limits; each source has at most one active worker.

TransferReport

Final observable counters and a verified immutable object.

TransferSession

Exclusive mutable resumable state for one object.

TransferStore

One exclusive process-local store owner. The file lock is held until drop. Existing ancestors must be deployment-protected; Windows additionally requires a deployment-owned private ACL. Reparse points are rejected on all Windows paths.

VerifiedObject

An immutable, fully hash-verified object. This is not an authenticated release.

Enums

TransferError

Controlled transfer failure.

Traits

BlockSource

An explicitly selected provider. Implementations must honor cancellation and deadline and bound every blocking I/O operation; the executor never detaches a thread or pretends it can forcibly interrupt arbitrary provider code.

Functions

transfer

Completes one session from bounded explicitly approved providers. On failure, durable valid blocks remain resumable. Workers are joined before returning; timeouts are cooperative and depend on provider-owned I/O bounds.

Type Aliases

TransferResult

Result from bounded transfer operations.