Struct LoadOptions 

pub struct LoadOptions {
    pub isolation: Isolation,
    pub init_deadline_ms: u64,
    pub request_deadline_ms: u64,
    pub max_memory_bytes: u64,
    pub trusted_pool_size: usize,
    pub checkout_timeout_ms: u64,
    pub max_requests_per_instance: u64,
    pub ratelimit_bucket: Option<Bucket>,
    pub config: BTreeMap<String, String>,
}

Options for Host::load. A struct (not a bare arg) because deny-by-default grows more load-time knobs onto it. Defaults to the safe side: Untrusted (fail-closed) with metering on (ADR 000006). A future declarative manifest (ADR 000007) injects these.

Not Copy: the outbound policy (ADR 000036) carries an allowlist Vec, so this moves/clones.

Fields

isolation: Isolation

init_deadline_ms: u64

Epoch deadline (ms) for the once-per-instance init export.

request_deadline_ms: u64

Epoch deadline (ms) for each per-request hook (on-request / on-response).

max_memory_bytes: u64

Per-instance linear-memory cap (bytes), enforced by a StoreLimits.

trusted_pool_size: usize

Trusted pool: maximum concurrent reusable instances (lazily filled, ADR 000012). Clamped to [1, TRUSTED_POOL_MAX] at load. Ignored for Untrusted (fresh-per-request).

checkout_timeout_ms: u64

Trusted pool: bounded wait (ms) for a free instance under saturation before failing closed (RunError::Unavailable). Ignored for Untrusted.

max_requests_per_instance: u64

Trusted pool: recycle an instance (discard + rebuild) after this many requests, bounding linear-memory state accumulation (§6.6). Ignored for Untrusted.

ratelimit_bucket: Option<Bucket>

This filter’s host-side token-bucket spec for host-ratelimit (manifest [filter.ratelimit], ADR 000026). None = the filter has no limiter (its try-acquire fails closed). Host-configured so an untrusted filter cannot override its own limit.

config: BTreeMap<String, String>

This filter’s business config (manifest [filter.config], ADR 000066): an arbitrary string→string map read back via host-config::get. The host never interprets keys or values. Empty (the default) when the manifest declares no [filter.config] section — every get then reads None, same as an undeclared key in a non-empty map.

Implementations

impl LoadOptions

pub fn trusted() -> Self

pub fn untrusted() -> Self

pub fn with_request_deadline_ms(self, ms: u64) -> Self

Override the per-request hook deadline (ms).

pub fn with_init_deadline_ms(self, ms: u64) -> Self

Override the init deadline (ms).

pub fn with_max_memory_bytes(self, bytes: u64) -> Self

Override the per-instance linear-memory cap (bytes).

pub fn with_trusted_pool_size(self, n: usize) -> Self

Override the trusted pool capacity (max concurrent reusable instances).

pub fn with_checkout_timeout_ms(self, ms: u64) -> Self

Override the bounded checkout wait (ms) before a saturated trusted pool fails closed.

pub fn with_max_requests_per_instance(self, n: u64) -> Self

Override how many requests a trusted instance serves before it is recycled.

pub fn with_ratelimit_bucket( self, capacity: u64, refill_tokens: u64, refill_interval_ms: u64, ) -> Self

Configure this filter’s host-side host-ratelimit token bucket (ADR 000026). Without it, the filter’s try-acquire fails closed. The filter cannot supply or override these.

pub fn with_config(self, config: BTreeMap<String, String>) -> Self

Lend this filter’s manifest-declared business config ([filter.config], ADR 000066) — a read-only string map the filter reads back via host-config::get.

Trait Implementations

impl Clone for LoadOptions

fn clone(&self) -> LoadOptions

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for LoadOptions

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for LoadOptions

fn default() -> Self

Returns the “default value” for a type.