Trait ConnectionServices 

pub trait ConnectionServices:
    Debug
    + Send
    + Sync {
    // Required methods
    fn publish(
        &self,
        connection: u64,
        channel: &str,
        envelope: &MessageEnvelope,
        idempotency_key: Option<&str>,
    ) -> Result<PublishOutcome, ServerError>;
    fn subscribe(
        &self,
        channel: &str,
        accepted_schemas: &[ProtocolSchemaId],
        install: Option<InboxInstall>,
    ) -> Result<ConnectionSubscription, ServerError>;
    fn unsubscribe(
        &self,
        subscription: ConnectionSubscription,
    ) -> Result<(), ServerError>;
    fn open_conversation(
        &self,
        conversation_id: u64,
        subject: &str,
    ) -> Result<ConnectionConversation, ServerError>;
    fn conversation_message(
        &self,
        conversation: &ConnectionConversation,
        envelope: &MessageEnvelope,
        op_id: Option<u64>,
    ) -> Result<(), ServerError>;
    fn close_conversation(
        &self,
        conversation: ConnectionConversation,
    ) -> Result<(), ServerError>;
    fn flush_durable_state(&self) -> Result<(), ServerError>;

    // Provided methods
    fn construction_request(
        &self,
        _: Option<&dyn LysSession>,
        subject: &str,
        _: &[u8],
        _: u64,
    ) -> Option<Result<Value, ServerError>> { ... }
    fn prepare_site_trial(
        &self,
        _: u64,
        _: Option<&dyn LysSession>,
        _: &WorkerRegistration,
        _: Option<&ProcessGrant>,
        _: u64,
    ) -> Result<Option<TrialPermit>, ServerError> { ... }
    fn admit_site_call(
        &self,
        _: Option<&dyn LysSession>,
        _: &str,
        _: u64,
    ) -> Result<bool, ServerError> { ... }
    fn site_registration_closed(&self, _: u64) -> Result<(), ServerError> { ... }
    fn publish_identified(
        &self,
        connection: u64,
        session: Option<&dyn LysSession>,
        channel: &str,
        envelope: &MessageEnvelope,
        key: Option<&str>,
    ) -> Result<PublishOutcome, ServerError> { ... }
    fn agents(&self) -> Option<&Arc<Agents>> { ... }
    fn subscribe_identified(
        &self,
        connection: u64,
        session: Option<&dyn LysSession>,
        channel: &str,
        schemas: &[ProtocolSchemaId],
        install: Option<InboxInstall>,
    ) -> Result<ConnectionSubscription, ServerError> { ... }
    fn participant_service(&self) -> Option<InstalledParticipantService> { ... }
    fn stop_participant_warm(&self) { ... }
    fn finish_background_store_work(&self) -> Result<(), ServerError> { ... }
    fn release_store_holders(&self) -> Result<(), ServerError> { ... }
    fn listening(self: Arc<Self>) -> Option<JoinHandle<()>> { ... }
    fn supports_channel_operations(&self) -> bool { ... }
    fn admit_channel(
        &self,
        _operation: ChannelOperation,
        _channel: &str,
    ) -> Result<(), ChannelAccessError> { ... }
}

Operations that adapt wire frames to liminal library calls.

Required Methods

fn publish( &self, connection: u64, channel: &str, envelope: &MessageEnvelope, idempotency_key: Option<&str>, ) -> Result<PublishOutcome, ServerError>

Delegates a publish request to the liminal library.

connection is the publishing connection’s id (its process pid, as apply_frame knows it), carried as the publish origin so the console tap attributes the message to it (SRV-012). idempotency_key, when Some, drives dedup-on-delivery: a re-publish with the same key is delivered to subscribers at most once. The returned PublishOutcome carries the genuine delivery ack.

Errors

Returns ServerError when the liminal publish operation fails.

fn subscribe( &self, channel: &str, accepted_schemas: &[ProtocolSchemaId], install: Option<InboxInstall>, ) -> Result<ConnectionSubscription, ServerError>

Delegates a subscribe request to the liminal library.

install, when Some, carries the connection’s §5 shared inbox byte budget, per-inbox fairness cap, and R3 wake notifier. The implementation MUST install it on the subscription’s inbox BEFORE the registration is published to the channel actor (i.e. before any envelope can be delivered), so no envelope is ever admitted uncharged, past the depth cap, or without a wake. Implementations with no real inbox (test stand-ins, capability-scoped profiles that refuse subscribe) may ignore it.

Errors

Returns ServerError when the liminal subscribe operation fails.

fn unsubscribe( &self, subscription: ConnectionSubscription, ) -> Result<(), ServerError>

Delegates unsubscribe to the liminal library.

Errors

Returns ServerError when the liminal unsubscribe operation fails.

fn open_conversation( &self, conversation_id: u64, subject: &str, ) -> Result<ConnectionConversation, ServerError>

Delegates conversation open to the liminal library.

Errors

Returns ServerError when the liminal conversation open operation fails.

fn conversation_message( &self, conversation: &ConnectionConversation, envelope: &MessageEnvelope, op_id: Option<u64>, ) -> Result<(), ServerError>

Delegates a conversation message to the liminal library.

Errors

Returns ServerError when the liminal conversation message operation fails.

fn close_conversation( &self, conversation: ConnectionConversation, ) -> Result<(), ServerError>

Delegates conversation close to the liminal library.

Errors

Returns ServerError when the liminal conversation close operation fails.

fn flush_durable_state(&self) -> Result<(), ServerError>

Flushes the shared durable store after channel publications have settled.

Errors

Returns ServerError when the shared store flush operation fails.

Provided Methods

fn construction_request( &self, _: Option<&dyn LysSession>, subject: &str, _: &[u8], _: u64, ) -> Option<Result<Value, ServerError>>

Construction built-ins are dispatched before ordinary worker routing.

fn prepare_site_trial( &self, _: u64, _: Option<&dyn LysSession>, _: &WorkerRegistration, _: Option<&ProcessGrant>, _: u64, ) -> Result<Option<TrialPermit>, ServerError>

Reserves the completion barrier before storing a trial registration.

Errors

The trial’s identity, contracts or serve decision refused.

fn admit_site_call( &self, _: Option<&dyn LysSession>, _: &str, _: u64, ) -> Result<bool, ServerError>

Checks a Building subject before routing and before releasing a reply.

Errors

A trial caller or its pass was refused.

fn site_registration_closed(&self, _: u64) -> Result<(), ServerError>

Removes trial barriers when the directory removes a connection.

Errors

The target store or console projection failed.

fn publish_identified( &self, connection: u64, session: Option<&dyn LysSession>, channel: &str, envelope: &MessageEnvelope, key: Option<&str>, ) -> Result<PublishOutcome, ServerError>

Publishes with the identity proved at Connect; it adds no authority.

Errors

Identity, rights, payload or publication admission refused.

fn agents(&self) -> Option<&Arc<Agents>>

Agent station state, when configured.

fn subscribe_identified( &self, connection: u64, session: Option<&dyn LysSession>, channel: &str, schemas: &[ProtocolSchemaId], install: Option<InboxInstall>, ) -> Result<ConnectionSubscription, ServerError>

Subscribes using the identity proved at Connect; it adds no authority.

Errors

Identity, rights or subscription admission refused.

fn participant_service(&self) -> Option<InstalledParticipantService>

Returns the complete participant service installed on this adapter.

None keeps participant capability disabled even when the adapter owns a durable store for unrelated channel traffic. The returned token is server-sealed and atomically carries declared semantics plus durability, making a handler-without-store activation impossible by construction.

fn stop_participant_warm(&self)

Stops the participant warm and records the clean stop’s capacity snapshot (DUR-020 R3, R5). Called once, by the shutdown sequence, before the final flush; an adapter with no participant does nothing.

fn finish_background_store_work(&self) -> Result<(), ServerError>

Joins background work that can still write to the store.

Errors

Returns a named shutdown failure when an owned worker cannot be joined.

fn release_store_holders(&self) -> Result<(), ServerError>

Stops store-owning service workers after the final flush.

Errors

Returns a named shutdown failure when a service worker cannot be joined.

fn listening(self: Arc<Self>) -> Option<JoinHandle<()>>

The listener is bound: whatever the start reads that no admission needs before it is judged runs from here, behind the listening door. An adapter with nothing to read does nothing. Answers the thread it started, which the listener leaves to run and a test may join.

fn supports_channel_operations(&self) -> bool

Whether this adapter backs ordinary channel and conversation operations.

The default is true — the full-service adapter serves publish, subscribe, and conversation frames, so full mode is byte-for-byte unchanged. The capability-scoped worker front door overrides this to false, letting [super::apply] reject the channel/conversation frames it short-circuits on empty connection state (Unsubscribe, ConversationMessage, ConversationClose) with a typed error frame instead of silently swallowing an operation for a resource that could never have been created in this profile. Frames that always reach a service method (Publish, Subscribe, ConversationOpen) are rejected by the front door’s own method bodies and do not consult this flag.

fn admit_channel( &self, _operation: ChannelOperation, _channel: &str, ) -> Result<(), ChannelAccessError>

Whether channel admits operation right now.

Consulted by the connection process BEFORE the operation is delegated, so a roster refusal is typed at the moment of the decision, by the component that made it, from the value it decided on. The alternative — classifying an opaque failure afterwards by re-reading the roster in the error arm — cannot tell “the roster refused this” from “something else failed while the roster happened to change”, and would put a confident wrong cause on the wire.

It does NOT replace the adapter’s own inner check. Admission here is the caller’s guard; a service method is public and callable without a frame, so it keeps its own.

The default ADMITS. An adapter with no roster has nothing to say here and its refusals travel as service errors exactly as they do today; only the roster-owning adapter overrides this. A default body is also what keeps this addition inside “minor”: a method added without one breaks every downstream implementor of a public trait.

Errors

Returns ChannelAccessError when the roster refuses the operation.

Dyn Compatibility

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors

impl ConnectionServices for AdmittedServices<'_>

impl ConnectionServices for LiminalConnectionServices

impl ConnectionServices for WorkerFrontDoorServices