Struct BlobHydrator 

pub struct BlobHydrator { /* private fields */ }

Runtime-owned bounded blob hydration with weighted raw-byte admission.

Implementations

impl BlobHydrator

pub fn for_mode( store: Arc<dyn BlobStore>, budget_bytes: u64, read_only: bool, ) -> RuntimeResult<Self>

Pair a raw store with a budget under an explicitly declared blob-runtime mode. read_only = true wraps the store so every physical mutator refuses while the bounded read surface stays available; false is Self::new. Boot paths that decide the blob mode from configuration (the blob pack’s backend mode, ADR-160 D3) construct through this so the decision travels with the hydrator — the install seam can then hold hydrator mode against runtime mode instead of trusting the caller’s pairing.

pub fn resolve_for_governing_backend( cfg: &KhiveConfig, resolve_backend: &StorageBackend, governing_backend: &StorageBackend, budget_bytes: u64, ) -> Result<Self, GovernedBlobError>

Resolve the configured store and pair it with the budget under the mode of the backend that GOVERNS blob mutability — the backend the blob pack maps to (ADR-160 D3), which on single-backend boots is the runtime’s own backend.

The mode is derived here from governing_backend’s own access mode, never accepted as a caller-declared flag, and the hydrator is stamped as governed. crate::KhiveRuntime::install_shared_blob_hydrator accepts only governed hydrators.

Trust model (explicit policy): which backend governs blob mutability is a deployment-topology assertion made by the host that wires boot (the blob pack’s backend, ADR-160 D3), and this seam takes the caller’s word for it. What the derivation defends against is the ACCIDENTAL mode mismatch — a hand-paired writable hydrator drifting onto a read-only handle through the shared seam. It does not defend against an in-process caller who deliberately misdeclares the governing backend, because no runtime seam can: any such caller can already open the configured blob root directly (the same config and store constructors are public) and mutate it without touching a runtime handle. Read-only runtime handles are a wrong-wiring guard, not an in-process sandbox.

pub fn new(store: Arc<dyn BlobStore>, budget_bytes: u64) -> RuntimeResult<Self>

Pair one store with one aggregate byte budget.

pub fn budget_bytes(&self) -> u64

Return the resolved aggregate admission budget.

pub async fn hydrate_verified( &self, content_ref: &ContentRef, max_bytes: u64, ) -> RuntimeResult<VerifiedBlob>

Hydrate one complete digest-verified object under weighted admission.

Trait Implementations

impl Debug for BlobHydrator

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.