Struct RulePackage 

pub struct RulePackage { /* private fields */ }

A rule package, parsed and checked once.

This is the artefact an embedder holds for the life of the process. It carries no host, no budget, and no backend: those belong to a run, and a package outlives every run made from it.

Implementations

impl RulePackage

pub fn load(root: &Path, schema: ModuleSchema) -> Result<RulePackage, String>

Loads, parses, and checks the rule package rooted at root, holding every call into reviews to schema.

root is examples/rules. Every directory under it holding .cove files becomes one module, named by its path — rules, rules.policy, rules.catalog and so on — which is the rule cove_sema::package::load follows on disk. It is done here rather than by that function for one reason: an embedder composes a package out of the rules its user wrote, and it is entitled to decide what is in it.

The schema goes to Compiler::with_host_schema, so a call into reviews is checked at its call site, against the same table the boundary will hold it to.

pub fn cost(&self) -> LoadCost

What loading this package cost.

pub fn notices(&self) -> Vec<String>

Whatever the checker accepted but doubted, rendered.

Empty for a package checked against a schema that describes every host module it names, which is what an embedder should expect to see.

pub fn lower(&self, module: &str, entry: &str) -> Result<Lowering, String>

Lowers one entry to cove-ir’s executable IR.

Per entry rather than per package, because that is what cove_ir::lower_entry does: it lowers what the entry can reach and nothing else. An embedder that invokes two entries lowers twice, once each, and holds both for the life of the process.

There is no separate validation step to time. The predecessor lowered to a form a second pass then checked; cove_ir::lower_entry verifies as it goes and answers a lowering that is already known good or a Vec<Diagnostic> naming what was wrong, so Lowering has one duration where it used to have two.

The schema handed to cove_ir::lower_entry is RulePackage::load’s own — the one Compiler::with_host_schema checked this package against — because a reviews.pull call has to lower against the same signature the checker confirmed it against, or the two could disagree about what the boundary looks like.

pub fn serve<T>( &self, hosts: Arc<HostRegistry>, lowering: Option<&Lowering>, body: impl FnOnce(&mut Session<'_>) -> T, ) -> T

Builds one backend over hosts and hands it to body.

The one Vm or interpreter body is given serves every invocation body makes, which is what compile-once/invoke-many means on this API. cove-rules-measure reports what building it costs separately from an invocation’s, though for Vm that cost is no longer a pass over the program: cove_ir::lower_entry computed every layout while RulePackage::lower ran, so cove_runtime::Vm::new allocates the heap region and a table sized to the program’s string count and reads nothing else back out of the lowered program. The predecessor backend read the program’s struct shapes, enum shapes and constants at this point and built a table of each, which is what made building it a cost worth reporting in the first place.

The borrow is why this takes a closure rather than answering with a session. An Vm borrows the Runtime and the lowered program, both of which live for exactly as long as this call, and nothing Cove-shaped may leave it in any case: a Value is Rc-based and is not Send.