Trait BundleRestorer 

pub trait BundleRestorer {
    // Required methods
    fn restore_sidecar(
        &mut self,
        spec: &MemberSpec,
        temp: &Path,
    ) -> Result<(), BundleError>;
    fn begin_chunked(&mut self, spec: &MemberSpec) -> Result<(), BundleError>;
    fn write_chunk(
        &mut self,
        spec: &MemberSpec,
        buf: &[u8],
    ) -> Result<(), BundleError>;
    fn finish_chunked(
        &mut self,
        spec: &MemberSpec,
        verified: bool,
    ) -> Result<(), BundleError>;
}

The restore policy the v3-capable single-pass reader read_bundle_streaming_atomic drives, one method per member shape. The format layer owns the PARSE + the per-member integrity VERIFY; the implementor (the import driver) owns the APPLY (where a member is re-keyed to the target, scope-enforced, and committed) — so a chunked member and a sidecar member of the same kind route through the SAME driver re-key/enforce, framing being a transport detail, never a tenancy bypass.

A Sidecar member arrives fully staged + size/SHA-VERIFIED at a bounded temp (restore_sidecar) — verify-THEN-apply, exactly as the v2 staged reader. A ChunkedTrailer member streams: begin_chunked opens the sink (a shadow DB / a staging temp / a blob put), write_chunk feeds each chunk as it arrives (the reader hashes + counts), and finish_chunked is told whether the TRAILING trailer matched — COMMIT the sink only on verified, else DROP it, so a corrupt/truncated/tampered chunked member applies NOTHING to live (the inc2 atomic shadow).

Required Methods

fn restore_sidecar( &mut self, spec: &MemberSpec, temp: &Path, ) -> Result<(), BundleError>

Apply a Sidecar member already staged + verified at temp (freed by the reader after this returns).

fn begin_chunked(&mut self, spec: &MemberSpec) -> Result<(), BundleError>

Open the sink for a ChunkedTrailer member, before its first chunk (e.g. create the shadow DB / the staging temp). A failure here aborts the import before any byte is applied.

fn write_chunk( &mut self, spec: &MemberSpec, buf: &[u8], ) -> Result<(), BundleError>

Feed the next slice of a chunked member’s bytes to the open sink (called repeatedly, in order, for each chunk the reader streams).

fn finish_chunked( &mut self, spec: &MemberSpec, verified: bool, ) -> Result<(), BundleError>

Finish a chunked member: verified is whether the streamed bytes matched the trailer’s size + SHA-256. COMMIT-swap the sink on true; DROP it (nothing applied to live) on false.

Dyn Compatibility

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors