Function verify_and_extract_source_bundle 

pub fn verify_and_extract_source_bundle(
    archive_path: &Utf8Path,
    expected_archive: &SourceArchive,
    expected_manifest: &SourceManifest,
    destination: &Utf8Path,
    limits: SourceArchiveLimits,
) -> Result<SourceArchive, SourceError>

Verify and extract an untrusted source ZIP below a fresh destination.

ZIP structure and metadata are fully preflighted before destination creation. Extracted bytes, hashes, sizes, paths, order, and executable bits must exactly match the separately transported manifest.

Errors

Returns an error for transport-integrity mismatch, unsafe ZIP metadata, exceeded bounds, extraction races, or any manifest mismatch. Only a destination created by this call is removed on failure.