Struct BundleSlot 

pub struct BundleSlot {

    pub bucket: String,
    pub origin: Option<String>,
    pub account: Option<String>,
    pub name: Option<String>,
    pub machines: Vec<String>,
    pub runtime_version: Option<String>,
    pub serve_bins: BTreeMap<String, PathBuf>,
    pub serve_build: Option<BinBuild>,
    pub lifecycle: BundleLifecycle,
    pub port: Option<u16>,
    pub env: BTreeMap<String, String>,
    pub revalidate: Option<RevalidateSlot>,
    pub zone: Option<String>,
    pub verify_serving: bool,
}

Parsed [providers.bundle] slot — everything the sync arm needs that is declared rather than derived.

[providers.bundle]
use = "cloudflare"                  # R2 credentials resolve via this provider
bucket = "yah-dev-bundles"          # the append-only bundle store
origin = "https://cdn.yah.dev"      # public origin serving that bucket;
                                    # omit on a fleet whose nodes already
                                    # point at it (R870-B6)
machines = ["us-east-001"]          # explicit placement (or `required = {…}`)
name = "yah-marketing"              # stable workload handle; defaults to the service name
lifecycle = "keep-alive"            # or "on-demand"
idle_ttl_ms = 300000                # on-demand only
runtime_version = "0.8.20"          # vanilla bundles only (no serve binary)
serve_bins = { x86_64-unknown-linux-musl = "target/…/mesofact-serve" }
# …or, instead of naming pre-built paths, name the recipe that builds them:
# [providers.bundle.serve_build]
# pipeline = "mesofact-musl"
# binary   = "mesofact"
# triples  = ["x86_64-unknown-linux-musl"]
zone = "yah.dev"                    # front door to serving-verify; defaults
                                    # to the service's own domain
verify_serving = true               # default; see the field docs

# Environment for the serve process, as source URIs resolved at deploy
# (R556-T12). An SSR route reading a private source needs this or it gets
# a credential-less server on the node.
[providers.bundle.env]
ANALYTICS_R2_ACCESS_KEY = "vault:cloudflare-r2-access-key-id"
ANALYTICS_R2_BUCKET     = "yah-analytics"      # bare literal: not a secret

Fields

bucket: String

R2 bucket holding the bundle store. Append-only, blob-deduped.

origin: Option<String>

Public HTTPS origin serving bucket — the R2 custom domain bound to it, e.g. "https://cdn.noisetable.com" (R870-B6).

None → the node fetches from its own KAMAJI_BUNDLE_ORIGIN, which is correct exactly while the store the mirror publishes to is the store the fleet was configured for. A second tenant publishing to its own bucket must declare this or the node materializes from the wrong store and fails with missing blob manifests/<digest> after a clean admission.

Declared rather than derived from bucket or zone: the bucket→origin mapping is a Cloudflare R2 custom-domain binding that exists or doesn’t, and guessing https://cdn.<zone> would put an unreachable URL on the wire for every mirror that has not bound one. Same call providers.static.asset_origin makes, one tier over.

account: Option<String>

Cloudflare account id override. None → resolve from the workspace’s cloudflare provider config / CF_ACCOUNT_ID.

name: Option<String>

Stable operator-facing workload name. yubaba requires one for a bundle deploy: the digest is the content and changes on every rebuild, so it is not a usable handle for list / stop.

machines: Vec<String>

Explicitly named target machines, in deploy order. Empty → fall back to the slot’s required = {…} placement spec.

runtime_version: Option<String>

Stock runtime version recorded as runtime = "mesofact/<version>" for a vanilla bundle. Ignored when serve_bins is non-empty. None → the caller’s own version.

serve_bins: BTreeMap<String, PathBuf>

<triple> → <path to serve binary>. Any entry makes this a runtime = "self" bundle that carries its own serve binaries.

serve_build: Option<BinBuild>

Build the serve binaries on demand instead of naming pre-built paths (R746-F2). Mutually exclusive with serve_bins; either one makes this a runtime = "self" bundle.

lifecycle: BundleLifecycle

How kamaji supervises the served bundle.

port: Option<u16>

Port the served bundle listens on (R599-F12). None → kamaji’s node-wide default (8080), which is only correct while the node hosts a single bundle; declare one per workload to put several on a node.

env: BTreeMap<String, String>

[providers.bundle.env] — environment for the serve process, as NAME → source URI (R556-T12).

Values are the source declaration, kept verbatim and resolved deploy-side by yah cloud apply — vault:<slot>, env:<VAR>, a pipe-joined fallback chain of either, or a bare literal for a known-non-secret value. Same grammar ~/.yah/qed/secrets.toml uses, so there is one source-URI vocabulary in the camp rather than two.

Parsing stays here and resolution does not: this crate is offline by construction (a misconfigured mirror must fail before a build runs), and only the syncing machine has the vault. The RevalidateSlot::mirror_key_env → RevalidateSlot::to_workload_payload split is the same shape one level down.

revalidate: Option<RevalidateSlot>

Optional revalidate receiver config (R330-F12). Some → the deploy also stands up a mesofact serve --revalidate process.

zone: Option<String>

Public zone whose front door is checked after a deploy (R703-T7). None → the service’s own domain, which is the shape every mirror in tree uses; declare one only when the bundle serves a zone that isn’t it.

Unlike [providers.static], this is optional: the static slot’s zone is load-bearing for the Worker route and cache purge, whereas here it only names what to probe.

verify_serving: bool

Whether a deploy is checked against the live front door (R703-T7).

Defaults to true, and the only reason to turn it off is a deliberately in-flight front-door migration — with a comment naming the ticket. It is declared in config rather than passed as a CLI flag for the same reason the static slot’s is: switching it off should be a reviewable diff, not an invocation habit that quietly becomes permanent.

Implementations

impl BundleSlot

pub fn parse(mirror: &MirrorConfig, service: &str, env: &str) -> Result<Self>

Parse the mirror’s [providers.bundle] slot.

Every failure names the offending field plus the service and env, so the operator gets a file to open rather than a type error. Validation is total and offline — nothing here touches the network, so a misconfigured mirror fails before a build runs (R330-B5 fail-fast discipline).

pub fn serving_zone<'a>(&'a self, service_domain: &'a str) -> &'a str

The zone whose front door a deploy of this bundle is checked against: the slot’s zone, else the service’s own domain.

pub fn workload_name<'a>(&'a self, service: &'a str) -> &'a str

Stable workload handle: the slot’s name, else the service name.

pub fn is_self_contained(&self) -> bool

True when the assembled bundle carries its own serve binaries (runtime = "self") rather than resolving a stock node runtime asset.

Keyed on the declaration, not on what is on disk: a serve_build slot is self-contained before its binary has ever been built, because the mirror said so. Deriving the shape from disk state instead is the bug this relay exists to remove — it makes a bundle’s shape depend on which machine ran the sync.

pub fn serve_bundle( &self, digest: &str, runtime: &str, env: BTreeMap<String, String>, ) -> MesofactServeBundle

Build the {digest, runtime, lifecycle} triple a mesofact-static workload carries once its bundle is published.

runtime wire-mirrors yah_mesofact_bundle::BundleRuntime, so it is taken from the manifest the assembler actually wrote rather than re-derived here — the manifest is what the node will verify against.

env is the resolved serve environment, passed in rather than read off self.env: this crate holds source URIs, and only the syncing machine can turn a vault:<slot> into a value. Same by-value handoff RevalidateSlot::to_workload_payload takes, for the same reason — the node must never see a keystore slot name (R556-T12).

Trait Implementations

impl Clone for BundleSlot

fn clone(&self) -> BundleSlot

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for BundleSlot

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for BundleSlot

impl PartialEq for BundleSlot

fn eq(&self, other: &BundleSlot) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for BundleSlot