Struct Store 

pub struct Store { /* private fields */ }

Transactional metadata paired with an immutable content-addressed blob repository.

Implementations

impl Store

pub fn open( root: impl AsRef<Path>, blobs: Arc<dyn BlobStore>, ) -> Result<Self, StoreError>

Opens or creates a local store directory and acquires its writer lock.

pub fn open_with_cache_size( root: impl AsRef<Path>, blobs: Arc<dyn BlobStore>, cache_size: usize, ) -> Result<Self, StoreError>

Opens a local store with an explicit redb userspace page-cache bound.

pub async fn persist_commit( &self, envelope: &CommitEnvelope, ) -> Result<ApplyOutcome, StoreError>

Makes immutable bytes durable before atomically publishing their metadata.

pub async fn persist_commit_with_records( &self, envelope: &CommitEnvelope, records: &[MaterializedRecord], ) -> Result<ApplyOutcome, StoreError>

Makes a commit blob durable, then atomically publishes metadata and derived records.

pub async fn persist_commit_with_reconciliation( &self, envelope: &CommitEnvelope, records: &[MaterializedRecord], context: &VersionVector, record_heads: &[RecordHeadSet], ) -> Result<ApplyOutcome, StoreError>

Persists a record commit and atomically advances its incremental causal index.

pub async fn persist_schema_stages( &self, envelope: &CommitEnvelope, stages: &[SchemaStage], ) -> Result<ApplyOutcome, StoreError>

Persists an invisible bounded set of migration stages with its immutable commit.

pub async fn persist_schema_activation( &self, envelope: &CommitEnvelope, activation: &SchemaActivation, ) -> Result<ApplyOutcome, StoreError>

Atomically publishes a completely staged schema transition with its commit.

pub async fn persist_schema_stages_with_context( &self, envelope: &CommitEnvelope, stages: &[SchemaStage], context: &VersionVector, ) -> Result<ApplyOutcome, StoreError>

Persists schema stages while atomically advancing the causal commit index.

pub async fn persist_schema_activation_with_context( &self, envelope: &CommitEnvelope, activation: &SchemaActivation, context: &VersionVector, ) -> Result<ApplyOutcome, StoreError>

Persists schema activation while atomically advancing the causal commit index.

pub fn active_schema_activation( &self, domain_id: DomainId, collection_id: CollectionId, ) -> Result<Option<SchemaActivation>, StoreError>

Returns the active schema activation for a collection, if it has migrated.

pub fn active_schema_activations( &self, domain_id: DomainId, ) -> Result<Vec<SchemaActivation>, StoreError>

Lists active schema cuts for a domain in collection order.

pub fn migration_frozen( &self, domain_id: DomainId, collection_id: CollectionId, ) -> Result<bool, StoreError>

Returns whether incompatible activation siblings froze a collection.

pub fn migration_counts( &self, domain_id: DomainId, ) -> Result<(usize, usize, usize), StoreError>

Returns low-cardinality active, staged-record, and frozen migration counts.

pub fn record_snapshot_observed_at( &self, domain_id: DomainId, unix_seconds: u64, ) -> Result<(), StoreError>

Records when this device last created or installed a verified snapshot.

pub fn snapshot_observed_at( &self, domain_id: DomainId, ) -> Result<Option<u64>, StoreError>

Returns the durable local observation time of the newest verified snapshot.

pub fn schema_stages( &self, domain_id: DomainId, migration_id: MigrationId, ) -> Result<Vec<SchemaStage>, StoreError>

Loads every durable stage for one migration in source-key order.

pub fn contains_commit( &self, domain_id: DomainId, commit_id: CommitId, ) -> Result<bool, StoreError>

Returns whether commit metadata is accepted locally.

pub fn is_commit_quarantined( &self, commit_id: CommitId, ) -> Result<bool, StoreError>

Returns whether a commit ID is retained only as equivocation evidence.

pub fn author_quarantine( &self, domain_id: DomainId, author: AuthorId, ) -> Result<Option<u64>, StoreError>

Returns the first rejected sequence for an equivocated author, if any.

pub fn last_sequence( &self, domain_id: DomainId, author: AuthorId, ) -> Result<Option<u64>, StoreError>

Returns the latest accepted author sequence in a domain.

pub fn author_head( &self, domain_id: DomainId, author: AuthorId, ) -> Result<Option<CommitId>, StoreError>

Returns the latest accepted immutable commit for an author in a domain.

pub fn conflicting_author_commit( &self, envelope: &CommitEnvelope, ) -> Result<Option<CommitId>, StoreError>

Returns an accepted conflicting commit for the envelope’s author sequence.

pub async fn quarantine_equivocation( &self, evidence: &CommitEnvelope, invalid_commits: &[CommitId], accepted_frontier: &[CommitId], author_sequences: &[(AuthorId, u64)], author_heads: &[(AuthorId, u64, CommitId)], records: &[MaterializedRecord], ) -> Result<(), StoreError>

Atomically quarantines an equivocated branch and publishes rebuilt accepted state.

pub fn frontier(&self, domain_id: DomainId) -> Result<Vec<CommitId>, StoreError>

Returns the canonical sorted commit frontier for a domain.

pub fn reconciliation_index_ready( &self, domain_id: DomainId, ) -> Result<bool, StoreError>

Returns whether the rebuildable causal and record-head indexes are complete.

pub fn commit_context( &self, domain_id: DomainId, commit_id: CommitId, ) -> Result<Option<VersionVector>, StoreError>

Loads the inclusive causal context cached for one accepted commit.

pub fn record_heads( &self, domain_id: DomainId, collection_id: CollectionId, record_id: &[u8], ) -> Result<Vec<RecordHead>, StoreError>

Loads only the current causal heads for one materialized record.

pub fn replace_reconciliation_index( &self, domain_id: DomainId, contexts: &[(CommitId, VersionVector)], heads: &[RecordHead], ) -> Result<(), StoreError>

Atomically replaces the complete rebuildable reconciliation index for a domain.

pub fn get_record( &self, domain_id: DomainId, collection_id: CollectionId, record_id: &[u8], ) -> Result<Option<Vec<u8>>, StoreError>

Loads one canonical materialized record state by primary key.

pub fn list_records( &self, domain_id: DomainId, collection_id: CollectionId, ) -> Result<Vec<StoredRecord>, StoreError>

Lists canonical record IDs and states in stable primary-key order.

pub fn lookup_equal( &self, domain_id: DomainId, collection_id: CollectionId, field_id: u32, value: &[u8], ) -> Result<Vec<Vec<u8>>, StoreError>

Resolves an equality index to stable record IDs.

pub fn registered_schema( &self, domain_id: DomainId, collection_id: CollectionId, version: u32, ) -> Result<Option<SchemaDescriptor>, StoreError>

Loads a registered schema version, if present.

pub fn latest_registered_schema( &self, domain_id: DomainId, collection_id: CollectionId, ) -> Result<Option<SchemaDescriptor>, StoreError>

Loads the highest registered schema version for one collection.

pub fn list_commit_ids( &self, domain_id: DomainId, ) -> Result<Vec<CommitId>, StoreError>

Lists accepted commit IDs, including snapshot-covered history, in deterministic order.

pub fn has_snapshot_coverage( &self, domain_id: DomainId, ) -> Result<bool, StoreError>

Returns whether this domain relies on snapshot-covered commit history.

pub fn snapshot_coverage( &self, domain_id: DomainId, ) -> Result<Vec<CommitId>, StoreError>

Lists the exact opaque commit IDs represented by the installed snapshot.

pub fn snapshot_baseline( &self, domain_id: DomainId, ) -> Result<Option<SnapshotBaseline>, StoreError>

Loads the immutable snapshot recovery baseline for a compacted domain.

pub fn claim_blob( &self, domain_id: DomainId, hash: BlobHash, ) -> Result<(), StoreError>

Idempotently records local ownership of an immutable blob by one security domain.

pub fn owns_blob( &self, domain_id: DomainId, hash: BlobHash, ) -> Result<bool, StoreError>

Returns whether an accepted commit or claimed immutable blob belongs to a domain.

pub fn list_stored_commit_ids( &self, domain_id: DomainId, ) -> Result<Vec<CommitId>, StoreError>

Lists commit IDs whose immutable envelope blobs are stored locally.

pub fn list_stored_commit_ids_through( &self, domain_id: DomainId, max_epoch: u64, ) -> Result<Vec<CommitId>, StoreError>

Lists locally stored accepted commits visible through an epoch.

pub fn author_sequences( &self, domain_id: DomainId, ) -> Result<Vec<(AuthorId, u64)>, StoreError>

Exports durable per-author sequence baselines for a snapshot.

pub fn export_materialized( &self, domain_id: DomainId, ) -> Result<Vec<MaterializedRecord>, StoreError>

Exports complete canonical derived state for snapshots and equivalence checks.

pub fn replace_materialized( &self, domain_id: DomainId, records: &[MaterializedRecord], ) -> Result<(), StoreError>

Atomically replaces all derived state for one domain.

pub fn install_snapshot( &self, domain_id: DomainId, records: &[MaterializedRecord], covered_commits: &[CommitId], frontier_commits: &[CommitId], author_sequences: &[(AuthorId, u64)], activations: &[SchemaActivation], observed_at_unix_seconds: u64, baseline: &SnapshotBaseline, ) -> Result<(), StoreError>

Atomically installs snapshot-derived state and its causal acceptance baseline.

pub async fn load_commit( &self, commit_id: CommitId, ) -> Result<CommitEnvelope, StoreError>

Loads and strictly decodes an accepted immutable commit blob.

pub async fn scan_commit_orphans(&self) -> Result<Vec<CommitId>, StoreError>

Finds canonical commit blobs left behind before their metadata transaction committed.

Arbitrary application blobs are ignored. The returned IDs are deterministic and can be offered to a repair workflow; scanning never mutates durable state.

pub fn bootstrap_domain( &self, descriptor: &DomainDescriptor, root: &CapabilityCertificate, ) -> Result<(), StoreError>

Atomically records a domain genesis descriptor and its owner capability.

pub fn import_domain_authority_atomic( &self, descriptor: &DomainDescriptor, chain: &[CapabilityCertificate], ) -> Result<CapabilityId, StoreError>

Atomically imports a descriptor, chain, active root/leaf, and trust set.

pub fn import_authority_checkpoint_atomic( &self, invitation: &Invitation, ) -> Result<CapabilityId, StoreError>

Atomically imports a signed current authority baseline from a targeted invitation.

pub fn install_capability( &self, capability: &CapabilityCertificate, ) -> Result<CapabilityId, StoreError>

Installs a delegated capability after validating its durable issuer link.

pub fn install_capability_chain_atomic( &self, chain: &[CapabilityCertificate], ) -> Result<CapabilityId, StoreError>

Atomically installs a validated root-to-leaf capability chain.

Only the leaf becomes active. Intermediate certificates are retained as immutable delegation evidence and cannot replace another subject’s active capability as a side effect of authenticating the leaf.

pub fn capability( &self, capability_id: CapabilityId, ) -> Result<Option<CapabilityCertificate>, StoreError>

Loads one verified capability certificate by content ID.

pub fn capability_chain( &self, leaf: CapabilityId, ) -> Result<Vec<CapabilityCertificate>, StoreError>

Resolves a bounded root-to-leaf capability chain.

pub fn domain_descriptor( &self, domain_id: DomainId, ) -> Result<Option<DomainDescriptor>, StoreError>

Loads the immutable descriptor when this is a capability-controlled domain.

pub fn active_capability( &self, domain_id: DomainId, subject: AuthorId, ) -> Result<Option<CapabilityId>, StoreError>

Returns the active capability selected for an endpoint in a domain.

pub fn active_capabilities( &self, domain_id: DomainId, ) -> Result<Vec<CapabilityId>, StoreError>

Lists exact active capability IDs for a domain in canonical order.

pub fn authorize_capability( &self, domain_id: DomainId, subject: AuthorId, capability_id: CapabilityId, permission: Permission, epoch: u64, ) -> Result<bool, StoreError>

Checks active, non-revoked, endpoint-bound permission at an epoch.

pub fn control_head( &self, domain_id: DomainId, ) -> Result<Option<ControlTransition>, StoreError>

Loads and verifies the current single-successor control head.

pub fn accepted_control_chain( &self, domain_id: DomainId, ) -> Result<Vec<ControlTransition>, StoreError>

Returns the accepted control chain in ascending sequence order.

pub fn authority_checkpoint( &self, domain_id: DomainId, ) -> Result<Option<AuthorityCheckpoint>, StoreError>

Loads and verifies the optional history-compacting authority baseline.

pub fn authority_checkpoint_consistent( &self, domain_id: DomainId, ) -> Result<bool, StoreError>

Checks persisted checkpoint evidence against immutable authority objects.

pub fn control_transition( &self, domain_id: DomainId, control_id: [u8; 32], ) -> Result<Option<ControlTransition>, StoreError>

Loads one retained canonical control object by content ID.

pub fn accepted_control_at_sequence( &self, domain_id: DomainId, sequence: u64, ) -> Result<Option<ControlTransition>, StoreError>

Loads one retained accepted transition by its signed sequence.

pub fn current_epoch(&self, domain_id: DomainId) -> Result<u64, StoreError>

Returns the epoch authorized by the durable control chain.

pub fn current_control_sequence( &self, domain_id: DomainId, ) -> Result<u64, StoreError>

Returns the accepted domain-control sequence, or zero at genesis.

pub fn subject_revocations_consistent( &self, domain_id: DomainId, ) -> Result<bool, StoreError>

Checks the rebuildable subject-revocation index against signed control.

pub fn subject_revocations( &self, domain_id: DomainId, ) -> Result<Vec<(AuthorId, u64)>, StoreError>

Returns the canonical revocation accumulator derived from signed authority.

pub fn repair_subject_revocations( &self, domain_id: DomainId, ) -> Result<(), StoreError>

Atomically rebuilds subject revocations from the accepted signed chain.

pub fn current_controller( &self, domain_id: DomainId, ) -> Result<AuthorId, StoreError>

Returns the endpoint exclusively authorized to sign the next control transition.

pub fn current_writer( &self, domain_id: DomainId, ) -> Result<Option<AuthorId>, StoreError>

Returns the currently designated single writer.

pub fn observe_control( &self, control: &ControlTransition, ) -> Result<(), StoreError>

Verifies and retains a control object before separately delivered key material is activated.

pub fn apply_control( &self, control: &ControlTransition, ) -> Result<(), StoreError>

Atomically advances authority, records the causal cut, and revokes endpoint access.

pub fn apply_control_bundle( &self, control: &ControlTransition, successor_chain: &[CapabilityCertificate], ) -> Result<(), StoreError>

Atomically installs successor capability evidence and advances authority.

pub fn trust_author( &self, domain_id: DomainId, author: AuthorId, ) -> Result<(), StoreError>

Adds a device to the local domain authorization set.

pub fn is_author_trusted( &self, domain_id: DomainId, author: AuthorId, ) -> Result<bool, StoreError>

Returns whether a device is locally authorized for this domain.

pub fn trusted_authors( &self, domain_id: DomainId, ) -> Result<Vec<AuthorId>, StoreError>

Lists locally authorized devices in canonical identity order.

pub fn set_device_group( &self, domain_id: DomainId, label: &str, members: &[AuthorId], ) -> Result<(), StoreError>

Replaces bounded application-facing group metadata without changing protocol identity.

pub fn device_groups( &self, domain_id: DomainId, ) -> Result<Vec<(String, Vec<AuthorId>)>, StoreError>

Lists device groups for one domain in label order.

pub fn consume_invitation( &self, invitation_id: [u8; 32], ) -> Result<bool, StoreError>

Atomically marks an offline invitation ticket consumed, returning false on replay.

Trait Implementations

impl Clone for Store

fn clone(&self) -> Store

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.