64 std::vector<std::uint8_t>
bytes;
Bounded, deterministic capsule archive access.
A reader over an admitted archive.
Definition archive.hpp:37
Definition profile_registry.hpp:68
Definition signature.hpp:43
A private directory that is removed when it goes out of scope unless it was published.
Definition staging.hpp:29
Result<T, E> — either holds a T or an E, never both.
Definition result.hpp:76
Archive and path budgets.
The capsule envelope: the only authority for what a capsule is.
Definition archive.hpp:24
constexpr CapsuleLimits kCapsuleLimitsV1
The frozen v1 budgets.
Definition limits.hpp:35
runtime::Result< CapsulePreview, CapsuleError > preview_capsule(const CapsuleArchive &archive, const ProfileRegistry ®istry, const AdmissionOptions &options)
Steps 1-4 of the import state machine: bounded manifest read, structural and closure validation,...
runtime::Result< std::uint64_t, CapsuleError > export_capsule(ExportRequest request, const std::filesystem::path &destination, const CapsuleLimits &limits=kCapsuleLimitsV1)
Fill in the closure — sorted files, digests, sizes, and revision_id — and write one deterministic arc...
@ preview
Definition component.hpp:21
std::function< bool(std::size_t member_index, std::size_t member_count)> ExtractionProgress
Progress and cancellation.
Definition staging.hpp:54
runtime::Result< void, CapsuleError > admit_to_staging(const CapsuleArchive &archive, const CapsulePreview &preview, const ProfileRegistry ®istry, const StagingArea &staging, const ExtractionProgress &progress={})
Steps 6-7: extract only declared members into staging, verifying digests, then run the profile's sema...
The result of inspecting a capsule without running any of it.
Consumers register what a payload means.
Result<T, E> — success / failure union for fallible operations.
Trust is an adapter, not a dependency.
Extract privately, publish atomically, never replace.
Admission failure vocabulary for authoring capsules.
Definition capsule.hpp:27
CapsuleLimits limits
Definition capsule.hpp:28
const SignatureVerifier * verifier
Optional; when absent, a signed capsule is admitted as unsigned rather than trusted.
Definition capsule.hpp:31
std::string product
Product identifier of the caller, used to distinguish "not for thisproduct" from "not supported anywh...
Definition capsule.hpp:34
Definition preview.hpp:65
One member of an export inventory.
Definition capsule.hpp:62
FileEntry entry
Definition capsule.hpp:63
std::vector< std::uint8_t > bytes
Definition capsule.hpp:64
Definition capsule.hpp:67
std::vector< ExportItem > items
Definition capsule.hpp:69
Manifest manifest
Definition capsule.hpp:68
One row of the archive closure.
Definition component.hpp:110
Definition manifest.hpp:47