Struct DeviceJoinTransport 

pub struct DeviceJoinTransport<'a> { /* private fields */ }

One attempt’s slot namespace, bound to the side of the exchange this device is on.

Implementations

impl<'a> DeviceJoinTransport<'a>

pub fn open( storage: &'a dyn CloudSyncObjectStorage, bundle: &'a DeviceJoinOfferBundle, role: DeviceJoinRole, ) -> Result<Self, DeviceJoinTransportError>

Open the transport described by bundle against storage, for the role this device plays. It may publish only the kinds that role produces; it may read every kind.

pub async fn publish( &self, action: &DeviceJoinAction, ) -> Result<(), DeviceJoinTransportError>

Seal an artifact and create it at its slot.

Republishing an artifact already at its slot succeeds — that is what a crash between the durable journal advance and the create resumes into. The seal draws a fresh nonce per call, so sameness is decided on the artifact, not on the stored ciphertext; the first write’s bytes stay. A different artifact at an occupied slot is refused: a counterpart may already have read what is there.

pub async fn read( &self, kind: DeviceJoinTransportKind, ) -> Result<Option<DeviceJoinAction>, DeviceJoinTransportError>

Read one kind’s artifact, or None while its slot is still empty.

pub async fn await_artifact<T: DeviceJoinArtifact>( &self, timing: DeviceJoinTransportTiming, ) -> Result<T, DeviceJoinTransportError>

Poll for the counterpart’s artifact of type T until the deadline. The timeout names the role that never published, so a host can tell the user which device it is waiting on.

pub async fn observe_artifact<T: DeviceJoinArtifact>( &self, timing: DeviceJoinTransportTiming, ) -> Result<T, DeviceJoinTransportError>

Observe one artifact without imposing a phase deadline. A concurrent operation owns the deadline; this observation exists to interrupt that operation when a terminal artifact appears.

This is the longest-running wait in a join and the one least likely to find anything: it watches for the owner cancelling, for the whole join, alongside the snapshot download and the install. At the asked-for cadence that is a provider read every hundred milliseconds for minutes to answer “not yet” — which is exactly what the poll backoff was introduced to stop for the phase waits, and this one was left behind because it takes a bare interval rather than a timing. It takes the timing now and backs off like the others: the first look is immediate, so a cancellation still interrupts promptly, and the cadence settles at the same ceiling instead of running flat out under a several-second download.

pub async fn await_step<T: DeviceJoinArtifact>( &self, timing: DeviceJoinTransportTiming, ) -> Result<DeviceJoinStep<T>, DeviceJoinTransportError>

Poll for the next artifact of type T, or for the owner’s abandonment of the whole attempt, whichever appears first.

The owner may give up on an attempt while the joining device is waiting for the next step, so every joiner wait watches both slots. A wait that watched only its own kind would sit until its deadline against an abandonment already published.

pub async fn delete_attempt_slots(&self) -> Result<(), DeviceJoinTransportError>

Remove everything under this attempt’s namespace.

Called once the exchange has reached an end the joining device has consumed — its completed join or its accepted abandonment. The joining device is the last reader on both, which is why the deletion is its to make: the admitting device has no artifact by which it could learn that the joiner read the last thing it published. There is no sweep behind this.

The namespace is listed rather than probed kind by kind. Probing asks for every name this build knows and so leaves behind anything written under a name it does not — an artifact from a different version, or from anyone else who can write to the provider. A listing names what is actually there, which is what “remove the namespace” has to mean.

Each object is still deleted by the exact reference its own stored bytes produce, so a delete cannot race a concurrent write: the reference carries the size and hash observed, and the delete refuses if what sits there no longer matches. Nothing is opened — this is removing a namespace, not reading it, and an object this device cannot decrypt is exactly as much garbage as one it can.