Crate type_bridge_workspace 

Validated, programmatic TypeBridge workspace configuration.

This public orchestration boundary deliberately stops before schema loading, history, persistence, provider/network I/O, secret resolution, or compiled-runtime construction. Its bounded filesystem observations are the explicitly supplied workspace YAML and custom TLS trust material: callers inject local source services that canonicalize and prove those inputs before an inert, fully validated TypeBridgeConfig is returned.

Structs

BundleProjectionContext

Exact target policy plus handler and resource evidence for one compiled projection.

BundleVerificationContext

Explicit capability, extension, scope, profile, and projection trust context.

ConfigOrigin

An immutable source origin for one workspace manifest.

ExtensionRequirement

One exact local extension handler/version requirement.

LocatedConfigSpec

A strict config spec permanently bound to the manifest that owns its paths.

MigrationDirectoryAuthority

An open, workspace-bound migration-directory authority.

MigrationPlanEntry

One dependency-ordered entry of an offline apply plan.

MigrationV2Directory

A confined direct V2 migration-history directory.

OutputDirectory

A confined output directory for one shipped binding target.

SchemaAuthorityOutputPath

A confined portable file path for the generated server schema authority.

SchemaBundleError

A fail-closed bundle failure retaining nested contract or schema diagnostics.

SchemaSetPath

A confined path to one portable schema-set manifest.

SecretReference

A retained environment-variable reference, never a resolved secret value.

SecretSlot

A deterministic logical slot containing one symbolic secret reference.

TypeBridgeConfig

An inert validated workspace policy produced only by its builder.

TypeBridgeConfigBuilder

A consuming typed builder for TypeBridgeConfig.

TypeBridgeConfigServices

Explicit services used to validate a programmatic config hermetically.

TypeBridgeConfigSpec

A strict parsed workspace spec retaining exact source, comments, and spans.

TypeBridgeRuntime

Source-free runtime installed only from a verified compiled bundle.

TypeBridgeWorkspace

An opaque source-authority workspace with resolved schema and managed state.

TypeBridgeWorkspaceServices

Explicit local services and capabilities used to construct a source workspace.

VerifiedSchemaBundle

Opaque constructor-verified compiled schema bundle.

VerifiedWorkspaceLock

Canonical lock bytes verified against one supplied source workspace.

WorkspaceConfigError

A structured programmatic workspace validation failure.

WorkspaceDirectoryAuthority

A retained, no-follow capability for one canonical workspace root.

WorkspaceEnvironment

One named, inert deployment environment.

WorkspaceLock

Canonical current lock bytes produced explicitly from one source workspace.

WorkspaceOutputDirectory

A retained, confined directory used for generated workspace artifacts.

WorkspaceRoot

An explicit absolute workspace root whose canonical spelling is service-verified.

WorkspaceRootCa

A canonical, workspace-confined custom root CA file.

WorkspaceServiceError

A stable failure reported by an injected, local-only config service.

Enums

SchemaBundleErrorCode

Stable high-level failure classification for bundle construction and verification.

TypeBridgeWorkspaceError

A fail-closed source-workspace construction failure retaining nested evidence.

WorkspaceConfigErrorCode

Stable categories returned while validating programmatic workspace policy.

WorkspaceLockError

A fail-closed workspace lock failure.

WorkspaceLockErrorCode

Stable error categories for explicit workspace lock generation and verification.

WorkspaceTransportPolicy

Validated transport policy for one workspace environment.

Constants

MAX_BACKFILL_INTENT_BYTES

Maximum bytes accepted for one source backfill intent.

MAX_SCHEMA_BUNDLE_BYTES

Maximum canonical compiled bundle size: 16 MiB.

MAX_WORKSPACE_LOCK_BYTES

Maximum accepted canonical workspace lock bytes.

SCHEMA_BUNDLE_FINGERPRINT_CANONICALIZATION

Canonicalization identity for the first bundle content envelope.

SCHEMA_BUNDLE_FINGERPRINT_DOMAIN

Fingerprint domain for the exact bundle content envelope.

TYPEBRIDGE_BACKFILL_INTENT_V1

Exact format identifier for the first closed backfill-intent YAML wire.

TYPEBRIDGE_SCHEMA_BUNDLE_V1

The first closed compiled-schema bundle format.

TYPEBRIDGE_WORKSPACE_LOCK_V1

The exact first canonical workspace lock format.

TYPEBRIDGE_WORKSPACE_SEMANTIC_PROFILE_ID

The preferred server-semantic profile for newly authored V2 workspaces.

TYPEBRIDGE_WORKSPACE_SEMANTIC_PROFILE_IDS

Frozen server-semantic profiles accepted for workspace generation.

TYPEBRIDGE_WORKSPACE_V1_FORMAT

The only accepted language-neutral workspace manifest discriminator.

Traits

ExtensionRegistryService

A local registry for projection-only extension requirements.

SecretReferenceService

A validator for symbolic secret references.

WorkspaceSourceService

A narrow local source service for root and custom-CA path validation.

Functions

build_verified_schema_bundle

Build and immediately reverify one source-free bundle from a source workspace.

c_symbol_prefix_for_app_label

Derive the stable C global-symbol prefix owned by a migration application.

decode_verified_schema_bundle

Decode, reconstruct, and independently verify one canonical compiled bundle.

encode_verified_schema_bundle

Return exact canonical bytes retained by an already verified bundle.

generate_workspace_lock

Explicitly generate canonical current lock bytes without writing them.

parse_backfill_intent

Parse and validate one source-located closed copy-attribute intent.

verify_workspace_lock

Verify canonical lock bytes against a freshly constructed source workspace.