Crate git_zero_rustix 

Allocation-free rustix file storage and blocking HTTP/1.0 adapters.

Re-exports

pub use storage::FileObject;

pub use storage::FileRepository;

pub use storage::FilePublication;

pub use storage::FilePublishedResponse;

Modules

cache

Synchronous selected-pack cache in a caller-owned directory and byte buffer.

storage

Raw object bodies in immutable regular files, read by offset with rustix.

Structs

AcceptedSocketTimeouts

Per-blocking-call timeouts applied only to the accepted socket. These do not bound accept, a complete request, or a complete response. None disables the corresponding timeout; zero durations are invalid. The OS may round values.

ChunkedLimits

Extra work limits for opt-in chunked intake. All wire framing also consumes the ordinary wire-byte quota; decoded identity bytes consume the body quota.

HeaderLimits

Inclusive HTTP header quotas. Byte counts apply to wire bytes before UTF-8 decoding; values include whitespace after the colon. Unknown and repeated ordinary fields consume the same budgets as recognized Git/framing fields.

HttpTransport

Numeric IPv4 addresses only. TLS, redirects, and chunked transfer decoding belong in richer host transports. All exchanges use fixed caller storage.

RequestDeadlines

Optional total intake and idle deadlines. Disabled defaults preserve the blocking API. A positive read resets idle only; total remains absolute. Zero durations and monotonic-clock arithmetic overflow fail before any read.

RequestLimits

Inclusive host admission quotas, separate from caller storage capacity. None leaves that quota unset; storage still bounds all request bytes.

RequestPolicy

Independent whole-request/body and header policies. Unset defaults preserve the storage-bounded parser. These quotas do not impose a total time deadline.

SocketWriter

Functions

accept

accept_with_timeouts

Accept with host-selected child socket timeouts, preserving close-on-exec. Invalid zero durations are rejected before accepting; configuration failures close the child before returning Backend. The listener is unchanged.

listen

listen_on

Bind an explicit numeric IPv4 or IPv6 address. IPv6 listeners accept only IPv6 connections; bind a separate IPv4 listener when both are required. Port zero is assigned by the OS and can be read with local_address.

local_address

Read the actual bound IP address, including an OS-assigned port.

local_port

read_request

Read one bounded request. Gzip bodies use the storage remaining after the compressed wire bytes and a fixed 32 KiB stack history window. Compressed plus expanded bytes and headers must fit storage; chunked input is rejected.

read_request_chunked

Bounded chunked intake with independent monotonic request deadlines.

read_request_from

Host transport boundary for authenticated TLS or other blocking streams. The callback fills at most the supplied slice, returns zero on EOF, and owns its transport deadlines/cancellation. Any error invalidates storage. Rust owns HTTP/Git parsing; the host owns peer authentication and TLS buffering. This default entry rejects Transfer-Encoding, as does the socket reader.

read_request_from_chunked

Opt-in bounded chunked HTTP/1.1 intake over a host-supplied transport. Chunk extensions and nonempty trailers are explicitly unsupported. Duplicate transfer fields, Content-Length conflicts and invalid chunk syntax fail before returning a request. Responses still close the connection; retain no pipeline.

read_request_with_deadlines

Apply monotonic total-intake and idle-progress deadlines in addition to byte quotas and accepted-socket read timeouts. The deadline starts on this call, covers header/body intake and the final synchronous parse/inflation check, and never resets when a peer drips another byte. It excludes accept, Git preparation and response transmission. Close the socket on every error. Expired host deadlines return LimitExceeded; a shorter socket timeout retains Backend. Socket flags and timeout settings remain unchanged. With both deadlines unset this is identical to read_request_with_policy.

read_request_with_limits

Read one request with inclusive logical quotas. Known policy exhaustion returns LimitExceeded; insufficient physical storage returns BufferTooSmall. A tied policy/capacity boundary is a policy failure. Gzip retains the complete wire body and original physical expansion slack. All storage is provisional on failure; discard it and close the socket.

read_request_with_policy

Apply header admission during intake and the single metadata-validation pass. An incomplete header stops at its exact byte quota without reading a byte beyond it. Field quotas are checked after that field’s syntax, before body intake/inflation and repository preparation. Failure invalidates all storage.

respond

respond_file_published

Send a previously verified on-disk publication, with independent file reads and response-local cancellation on any provider or socket error.

respond_headers

Write framing for a body streamed separately by the host. The host must then write exactly body_length bytes and close the connection on failure.

respond_published

Stream a publication response with its known complete length. Each cursor pins its provider; failed writes cancel only that response. Close the socket on errors, including a provider that was changed/truncated after publication.

respond_published_with_deadlines

Known-length publication responses with the same total/idle write budget. Deadline configuration errors and late provider failures cancel this cursor.

respond_stream

Send a prepared pull response with HTTP/1.0 close-delimited framing and caller-owned staging. Each successful socket write precedes the next pull. On any failure cancel the cursor and close the socket; never retry headers.

respond_stream_with_deadlines

Bound an entire streamed response and gaps in successful socket writes. Clock checks bracket every synchronous provider pull and EOF; a blocking provider cannot be preempted. Any expiry cancels the response without a successful protocol terminator. Close the transport on every error.

Type Aliases

ResponseDeadlines

Optional total response and idle-write-progress deadlines. Each response call gets its own monotonic budget; intake and response budgets are independent.