Struct LfsAdapter 

pub struct LfsAdapter { /* private fields */ }

The batch/transfer adapter — the storage-side surface the alkhttp lfs door consumes (ADR-022 §1–3, lfs.md §1–2 — the adapter/door split is the module doc). Construct over the object pool, the rows surface, the wired ownership provider (required — see the module doc), and the config knobs.

Implementations

impl LfsAdapter

pub fn new( store: Arc<BlobStore>, rows: Arc<dyn LfsRows>, ownership: Arc<dyn OwnershipProvider>, config: LfsAdapterConfig, ) -> Result<Self, OpenError>

Construct the adapter. The registry assembled here is the ops control plane the batch answers over (the POC-L DirectOps binding shape): blobs/stat through the OpsContext, the namespace ACL riding the wired provider — the one op this surface registers, so the ops fetch op’s own knobs (fetch_max_total_bytes and friends) stay at their defaults and are not this surface’s budget: downloads ride read_range directly under the resolved-span ceiling (LfsAdapterConfig::max_object_bytes, enforced adapter-side). Fallible on the config’s shape (the fallible-constructor posture).

pub fn config(&self) -> &LfsAdapterConfig

The adapter’s config (the door reads the budget knobs).

pub async fn check( &self, identity: Option<&Identity>, repo_id: &str, request: LfsBatchRequest, ) -> Result<LfsBatchResponse, LfsAdapterError>

The batch/checking answer (lfs.md §1): the formable-key existence over the ops control plane (blobs/stat through the context), the response objects’ shapes, and the row assertion at check time — every validated object’s (repo_id, oid, size) pair is asserted before the probes (the moment the server learns the pair; a malformed oid cannot form a row and its answer is the per-object 422). The batch’s own gates run first: no identity, or the wired provider not granting the operation’s action (write for upload batches, read for download batches), is the forbidden refusal; a declared hash_algo other than sha256 is the pinned 409.

pub async fn upload<R>( &self, identity: Option<&Identity>, repo_id: &str, oid: &str, size: Option<u64>, body: R, ) -> Result<(), LfsAdapterError>

where R: AsyncRead + Unpin + Send,

The upload — the pre-keyed put (ADR-022 §2). The identity and the write grant are required (the wired provider; the door carries the Basic tolerance). The size is the put’s mandatory claim: None is the size-less refusal. The row is asserted first (the moment the upload learns the pair), then the put rides the put handler’s contract minus the channel: the one-read tee over a bounded pipe, the claim cross-check pre-EOF (a mislabeled body kills the put — zero residue), then the custody hand-over through the OpsContext verbs — mint and confirm (the fleet form mints and drops the guard; the non-fleet form mints custodial and confirms, the POC-L attach-reference pattern).

pub async fn download( &self, identity: Option<&Identity>, repo_id: &str, oid: &str, range: Option<LfsRange>, ) -> Result<LfsDownload, LfsAdapterError>

The download — the ranged fetch (ADR-022 §2): the read grant is required (the wired provider), the entry’s existence rides stat, and the served stream verifies per-window slice digests mid-flight (the module doc’s byte-path section). The resolved span is budget-gated by LfsAdapterConfig::max_object_bytes — every form (the range-less whole serve, the open-ended resume, any resolved span) the adapter will actually produce counts against the ceiling; a past-EOF offset is the not-satisfiable refusal (the door’s 416). A whole-span download additionally verifies the served bytes’ sha256 against the oid end-to-end at EOF (the large tier’s reads carry no canonical re-derivation — the oid check is this path’s job); a partial span’s windows carry the length + store-interior slice checks only (the module doc’s verification statement).