Struct PeerPlane 

pub struct PeerPlane { /* private fields */ }

Everything a mint or a redeem needs, and nothing a running task leaves behind.

Always built, declared or not — the same shape crate::resource_plane::ResourcePlane has, and for the same reason: an undeclared capsule still has to record the redeem it refused, and a plane that does not exist has nowhere to write.

Implementations

impl PeerPlane

pub fn new( accessible_workdir: &Path, export: Option<(&PeerFilesExport, Arc<PeerMintKey>)>, session_id: String, containment_achieved: ContainmentClass, generation: Arc<AtomicU64>, trace: Option<Arc<ResourceTraceAppender>>, ) -> Self

Everything a plane needs, and the complete list of it: a host path, the declared export (None = undeclared = deny) paired with the instance key, the session id, the achieved class, the generation counter and somewhere to write the record.

pub fn is_declared(&self) -> bool

Whether this capsule declared exports.peer_files at all.

pub fn generation(&self) -> u64

pub fn mint_handle( &self, relpath: &str, audience: &str, ttl_secs: Option<u64>, ) -> Result<MintedHandle, PeerError>

Mints a handle for one file under exports.peer_files.root, for one audience.

relpath is relative to the export root and is resolved by the same code that resolves a read, so a path that escapes — .., absolute, percent-encoded, or a symlink leaving the root — fails the mint. It is refused, never normalised into something mintable.

ttl_secs may only narrow: a value above the declared max_ttl is clamped down, never up, and None means the declared max_ttl.