routing

Module: routing

Contents

Structs

• AutostartFlags - Inputs to [prepare_network_runtime] that gate autostart behaviour.
• EnvOverrides
• NetworkRuntime - Runtime-side network artifacts that must live while the wrapped process runs.
• ResolvedAuthority - Resolved Authority for the current run.

Functions

• prepare_network_runtime - Prepare network runtime artifacts for a sandbox launch.
• resolve_authority - Step 0: resolve the Authority before any sidecar work.

---

firma_run::routing::AutostartFlags

Struct

Inputs to [prepare_network_runtime] that gate autostart behaviour.

Fields:

• sidecar_autostart: bool - true when the selection resolved to local autostart.
• no_autostart: bool
• template_path: Option<std::path::PathBuf>
• startup_timeout: std::time::Duration
• authority_url: Option<String> - Effective Authority URL — set by resolve_authority and threaded
• authority_ca_cert: Option<std::path::PathBuf> - Path to the CA cert that signed the authority’s TLS cert — injected
• authority_pub_key: Option<std::path::PathBuf> - Path to the authority’s Ed25519 public key — injected into
• authority_credentials: Option<firma_sidecar::authority_credentials::SidecarCredentialsConfig> - Sidecar credential config injected into [sidecar.authority.credentials]
• capability_seed_path: Option<std::path::PathBuf> - Path of the per-session capability seed minted by firma run.
• use_http_proxy_sidecar: bool - When true, the autostarted sidecar is started in HTTP proxy
• monitor_mode: bool - When true, inject mode = "monitor" into the synthesized sidecar

Trait Implementations:

• Clone
  • fn clone(self: &Self) -> AutostartFlags
• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• Default
  • fn default() -> Self

firma_run::routing::EnvOverrides

Struct

Tuple Struct: ()

Trait Implementations:

• Default
  • fn default() -> EnvOverrides
• Deref
  • fn deref(self: &Self) -> &<Self as >::Target
• From
  • fn from(value: BTreeMap<String, String>) -> Self

firma_run::routing::NetworkRuntime

Struct

Runtime-side network artifacts that must live while the wrapped process runs.

Methods:

• fn env_overrides(self: &Self) -> &EnvOverrides - Returns environment values to merge into wrapped process launch env.
• fn sidecar_endpoint(self: &Self) -> &SidecarEndpoint - Endpoint the wrapped process should reach the sidecar through.

firma_run::routing::ResolvedAuthority

Struct

Resolved Authority for the current run.

Fields:

• url: String
• ca_cert_path: Option<std::path::PathBuf> - CA cert path from [sidecar.authority], if present.
• pub_key_path: Option<std::path::PathBuf> - Authority public key path from [sidecar.authority], if present.
• credentials: Option<firma_sidecar::authority_credentials::ResolvedSidecarCredentials> - Resolved credentials used by firma run when issuing a capability.
• credentials_config: Option<firma_sidecar::authority_credentials::SidecarCredentialsConfig> - Unresolved credentials config passed to an autostarted Sidecar.
• supervisor: Option<crate::authority::AuthoritySupervisor>

firma_run::routing::prepare_network_runtime

Function

Prepare network runtime artifacts for a sandbox launch.

When flags.sidecar_autostart == true (local selection), autostarts a per-run sidecar via [SidecarSupervisor] and substitutes its endpoint into the returned [NetworkRuntime]. The supervisor is held inside the returned struct so [Drop] tears the sidecar down when the wrapped process exits.

Errors

• [RunError::SidecarUnreachable] when the endpoint is unreachable and autostart is disabled.
• [RunError::SidecarReadyTimeout] / [RunError::SidecarStartupFailed] when the autostarted sidecar fails to come up.
• [RunError::UnsupportedPlatform] when autostart is required on a platform that does not support it.
• [RunError::Backend] for adapter socket failures.

fn prepare_network_runtime(handle: &crate::backend::SandboxHandle, proof: &crate::backend::EnforcementProof, sidecar_endpoint: &crate::config::SidecarEndpoint, identity: &crate::identity::RunIdentity, flags: &AutostartFlags, authority: ResolvedAuthority, skip_mint: bool) -> Result<NetworkRuntime, crate::error::RunError>

firma_run::routing::resolve_authority

Function

Step 0: resolve the Authority before any sidecar work.

CLI > persisted > prompt (only when both empty and TTY). On Local selection, probe [authority].listen_addr (default [::1]:50051); on miss, spawn an AuthoritySupervisor. Local mode is a dev convenience path and intentionally uses plaintext loopback (http://), not TLS/mTLS. EADDRINUSE recovery: on any spawn error, re-probe once; if the port is now reachable, drop the (failed) supervisor handle and proceed without one.

Errors

Propagates any RunError raised by selection or spawn paths.

fn resolve_authority(identity: &crate::identity::RunIdentity, runtime_dir: &std::path::Path, flags: &AutostartFlags, cli: &crate::authority::AuthorityCli, profile_name: &str, user_config_path: Option<&std::path::Path>, user_config_dir: Option<&std::path::Path>, firma_exe: &std::path::Path, prompt: & mut dyn crate::authority::AuthorityPromptIo) -> Result<ResolvedAuthority, crate::error::RunError>