Struct Message

Source

pub struct Message<'b> { /* private fields */ }

Implementations§

Source §

pub fn root_offset(&self) -> u32

Absolute offset of the root struct block. Exposed for generated code (the codegen identity fast path reads at constant offsets from here).

Source

pub fn has_inline_schema(&self) -> bool

Source

pub fn writer_schema(&self) -> Result<Option<Schema>>

Decode the inline writer schema, if the message carries one. The decoded schema’s content hash must match the header’s schema id.

Source

pub fn root<'r>(&self, resolver: &'r Resolver) -> Result<StructReader<'b, 'r>>

Open the root struct through a resolver whose writer schema matches this message’s schema id. Unbounded: reads are memory-safe but do not cap total traversal work — use this for trusted data or after an upstream size cap. For untrusted input, prefer Self::root_bounded.

Source

pub fn root_bounded<'r>( &self, resolver: &'r Resolver, budget: &'r Budget, ) -> Result<StructReader<'b, 'r>>

Open the root struct with a Budget that caps total traversal work, guarding against amplification-DoS on untrusted input (the wire spec §5.2). The budget outlives the returned readers, which charge every byte they touch against it.

Source

pub fn verify(&self, resolver: &Resolver, budget: &Budget) -> Result<()>

Walk the whole message once under a Budget, touching every reachable field and element, and return Ok(()) iff the traversal stays within budget (and depth). This is the guard for the fast/codegen path: verify untrusted bytes once, and if it passes, a single subsequent zero-copy scan — via the generated readers or Self::root — cannot amplify beyond the budget, because a full scan touches no more than this walk did. Trusted data skips it and pays nothing. (Analogous to FlatBuffers’ verified root, but Veritate needs no separate encoding — the same bytes are then read directly.)

Source

pub fn suggested_budget(&self) -> u64

A sensible default traversal-budget limit for this message: max(64 KiB, 64 × message length). Scales with legitimate message size (a well-formed message touches ~its own size once), leaving generous headroom while capping amplification at ~64× the bytes on the wire.