Struct Database 

pub struct Database { /* private fields */ }

Implementations

impl Database

pub async fn export_data(&self, exported_at: String) -> Result<AvenExport>

pub async fn validate_import_data(&self, export: &AvenExport) -> Result<()>

pub async fn import_data(&self, export: &AvenExport) -> Result<IntegrityReport>

pub async fn database_integrity_report(&self) -> Result<IntegrityReport>

pub async fn attachment_integrity_checks( &self, blob_dir: &Path, deep: bool, ) -> Result<Vec<IntegrityCheck>>

pub async fn create_backup_archive( &self, blob_dir: &Path, output: &Path, ) -> Result<()>

impl Database

pub fn latest_schema_version() -> Option<i64>

pub async fn inspect(path: &Path) -> InspectedDatabase

Copies an existing SQLite file and its sidecars into isolated temporary storage, then opens the isolated snapshot for diagnostic queries.

This path does not create parent directories, databases, sidecars, metadata, workspaces, journal settings, or migrations in user state.

impl Database

pub async fn open(path: &Path) -> Result<Self>

pub fn path(&self) -> &Path

pub async fn close(&self)

Closes every connection, including those held by clones, and waits until SQLite has released the files. Dropping a database closes its connections in the background instead, so delete or replace the files only after this returns.

pub async fn meta(&self, key: &str) -> Result<Option<String>>

pub async fn conflict_exists( &self, workspace_id: &WorkspaceId, task_id: &TaskId, field: &str, ) -> Result<bool>

impl Database

pub async fn label_usage( &self, workspace_id: &WorkspaceId, ) -> Result<Vec<LabelUsage>>

pub async fn list_labels( &self, workspace_id: &WorkspaceId, search: Option<&str>, ) -> Result<Vec<String>>

pub async fn resolve_labels( &self, workspace_id: &WorkspaceId, labels: &[String], ) -> Result<Vec<String>>

impl Database

pub async fn sync_access_refusal(&self) -> Result<Option<SyncAccessRefusal>>

Returns the last time this installation’s sync credentials were refused.

pub async fn record_sync_access_refusal(&self) -> Result<SyncAccessRefusal>

Remembers an authentication refusal until a later sync succeeds.

pub async fn clear_sync_access_refusal(&self) -> Result<()>

Clears a previous authentication refusal after a successful sync.

pub async fn restore_queue_workspace(&self) -> Result<Workspace>

pub async fn select_queue_workspace( &self, workspace_id: &WorkspaceId, ) -> Result<Workspace>

pub async fn onboarding_status(&self) -> Result<OnboardingStatus>

pub async fn complete_onboarding(&self) -> Result<()>

impl Database

pub async fn collapsed_sidebar_sections( &self, ) -> Result<BTreeSet<SidebarSection>>

pub async fn set_sidebar_section_collapsed( &self, section: SidebarSection, collapsed: bool, ) -> Result<()>

impl Database

pub async fn list_metadata_fields( &self, workspace_id: &WorkspaceId, ) -> Result<Vec<MetadataFieldUsage>>

pub async fn find_metadata_field( &self, workspace_id: &WorkspaceId, key: &str, ) -> Result<Option<MetadataField>>

pub async fn rename_metadata_field( &self, workspace: &Workspace, key: &str, new_key: &str, ) -> Result<MetadataField>

impl Database

pub async fn task_metadata( &self, workspace_id: &WorkspaceId, task_id: &TaskId, ) -> Result<Vec<TaskMetadataValue>>

impl Database

pub async fn set_task_status( &self, workspace: &Workspace, task: &Task, status: &str, ) -> Result<Task>

pub async fn set_task_priority( &self, workspace: &Workspace, task: &Task, priority: &str, ) -> Result<Task>

pub async fn cycle_task_priority( &self, workspace: &Workspace, task: &Task, reverse: bool, ) -> Result<Task>

pub async fn set_task_deleted_state( &self, workspace: &Workspace, task: &Task, deleted: bool, ) -> Result<Task>

pub async fn set_task_field( &self, workspace: &Workspace, task_id: &TaskId, field: &str, value: &str, ) -> Result<bool>

pub async fn set_task_project( &self, workspace: &Workspace, task_id: &TaskId, project: &Project, ) -> Result<bool>

pub async fn set_task_fields( &self, workspace: &Workspace, updates: &[(TaskId, String, String)], ) -> Result<Vec<bool>>

pub async fn cycle_task_priorities( &self, workspace: &Workspace, tasks: &[Task], reverse: bool, ) -> Result<Vec<Task>>

impl Database

pub async fn add_task_attachment( &self, workspace: &Workspace, blob_dir: &Path, policy: LifecyclePolicy, task_id: &TaskId, input: AttachmentAddInput, ) -> Result<AttachmentAddOutcome>

pub async fn add_ordered_task_attachment( &self, workspace: &Workspace, blob_dir: &Path, policy: LifecyclePolicy, task_id: &TaskId, created_at: String, input: TaskAttachmentAddInput, ) -> Result<AttachmentAddOutcome>

pub async fn attachment_by_id( &self, workspace: &Workspace, attachment_id: &str, ) -> Result<AttachmentOutcome>

pub async fn delete_task_attachment( &self, workspace: &Workspace, attachment_id: &str, ) -> Result<AttachmentOutcome>

pub async fn attachment_read_items_by_task( &self, blob_dir: &Path, workspace_id: &WorkspaceId, task_id: &TaskId, include_deleted: bool, ) -> Result<Vec<AttachmentReadItem>>

Reports inventory availability, downgraded to unavailable when the object file is absent from blob_dir.

pub async fn prune_attachments( &self, blob_dir: &Path, policy: LifecyclePolicy, apply: bool, ) -> Result<PruneSummary>

pub async fn acquire_attachment_lease( &self, sha256: &str, purpose: &str, ) -> Result<String>

pub async fn acquire_live_attachment_read_lease( &self, workspace: &Workspace, attachment_id: &str, ) -> Result<AttachmentReadLease>

pub async fn release_attachment_lease(&self, lease_id: &str) -> Result<()>

pub async fn attachment_lifecycle_report( &self, blob_dir: &Path, policy: LifecyclePolicy, ) -> Result<LifecycleReport>

impl Database

pub async fn list_conflicts( &self, workspace: &Workspace, project_key: Option<&str>, field: Option<&str>, ) -> Result<Vec<ConflictListItem>>

pub async fn task_conflicts( &self, workspace: &Workspace, task_id: &TaskId, field: Option<&str>, ) -> Result<Vec<ConflictDetail>>

pub async fn unresolved_task_conflict_fields( &self, workspace_id: &WorkspaceId, candidates: &[(TaskId, String)], ) -> Result<HashMap<TaskId, HashSet<String>>>

pub async fn conflict_variant_value( &self, workspace: &Workspace, task_id: &TaskId, field: &str, token: &str, ) -> Result<String>

pub async fn resolve_conflict_with_tui_undo( &self, workspace: &Workspace, task_id: &TaskId, field: &str, value: &str, ) -> Result<ConflictResolutionOutcome>

pub async fn resolve_conflict( &self, workspace: &Workspace, task_id: &TaskId, field: &str, value: &str, ) -> Result<ConflictOutcome>

pub async fn recurrence_series_conflicts( &self, workspace: &Workspace, series_id: &RecurrenceSeriesId, field: Option<&str>, ) -> Result<Vec<ConflictDetail>>

pub async fn recurrence_conflict_variant_value( &self, workspace: &Workspace, series_id: &RecurrenceSeriesId, field: &str, token: &str, ) -> Result<String>

pub async fn resolve_recurrence_conflict( &self, workspace: &Workspace, series_id: &RecurrenceSeriesId, field: &str, value: &str, ) -> Result<String>

impl Database

pub async fn add_task_dependency( &self, workspace: &Workspace, task_id: &TaskId, depends_on_id: &TaskId, ) -> Result<DependencyOutcome>

pub async fn add_task_dependency_with_undo( &self, workspace: &Workspace, task_id: &TaskId, depends_on_id: &TaskId, undo: UndoContext, ) -> Result<DependencyOutcome>

pub async fn remove_task_dependency( &self, workspace: &Workspace, task_id: &TaskId, depends_on_id: &TaskId, ) -> Result<DependencyOutcome>

pub async fn remove_task_dependency_with_undo( &self, workspace: &Workspace, task_id: &TaskId, depends_on_id: &TaskId, undo: UndoContext, ) -> Result<DependencyOutcome>

impl Database

pub async fn add_task_to_epic( &self, workspace: &Workspace, child_id: &TaskId, epic_id: &TaskId, ) -> Result<EpicLinkOutcome>

pub async fn add_task_to_epic_with_undo( &self, workspace: &Workspace, child_id: &TaskId, epic_id: &TaskId, undo: UndoContext, ) -> Result<EpicLinkOutcome>

pub async fn remove_task_from_epic( &self, workspace: &Workspace, child_id: &TaskId, epic_id: &TaskId, ) -> Result<EpicLinkOutcome>

pub async fn remove_task_from_epic_with_undo( &self, workspace: &Workspace, child_id: &TaskId, epic_id: &TaskId, undo: UndoContext, ) -> Result<EpicLinkOutcome>

impl Database

pub async fn create_label( &self, workspace: &Workspace, name: &str, ) -> Result<LabelOutcome>

pub async fn create_label_with_tui_undo( &self, workspace: &Workspace, name: &str, ) -> Result<LabelOutcome>

pub async fn delete_label( &self, workspace: &Workspace, name: &str, ) -> Result<LabelDeleteOutcome>

pub async fn delete_label_with_tui_undo( &self, workspace: &Workspace, name: &str, ) -> Result<LabelDeleteOutcome>

pub async fn rename_label_with_tui_undo( &self, workspace: &Workspace, name: &str, new_name: &str, ) -> Result<LabelRenameOutcome>

impl Database

pub async fn create_project( &self, workspace: &Workspace, name: &str, ) -> Result<ProjectOutcome>

pub async fn create_project_with_tui_undo( &self, workspace: &Workspace, name: &str, ) -> Result<ProjectOutcome>

pub async fn delete_project( &self, workspace: &Workspace, project: &str, ) -> Result<ProjectDeleteOutcome>

pub async fn rename_project( &self, workspace: &Workspace, project: &str, new_name: &str, prefix: Option<&str>, ) -> Result<ProjectRenameOutcome>

pub async fn rename_project_with_tui_undo( &self, workspace: &Workspace, project: &str, new_name: &str, prefix: Option<&str>, ) -> Result<ProjectRenameOutcome>

pub async fn rename_project_before_commit<T, F>( &self, workspace: &Workspace, project: &str, new_name: &str, prefix: Option<&str>, before_commit: F, ) -> Result<(ProjectRenameOutcome, T)>

where F: FnOnce(&ProjectRenameOutcome) -> Result<T>,

impl Database

pub async fn create_recurrence_series( &self, workspace: &Workspace, params: CreateRecurrenceSeriesParams, ) -> Result<RecurrenceCreateOutcome>

pub async fn update_recurrence_template( &self, workspace: &Workspace, series_id: &RecurrenceSeriesId, params: UpdateRecurrenceTemplateParams, ) -> Result<RecurrenceTemplateUpdateOutcome>

pub async fn reconcile_recurrence_series( &self, workspace: &Workspace, series_id: &RecurrenceSeriesId, at: DateTime<Utc>, ) -> Result<RecurrenceReconcileOutcome>

pub async fn resolve_recurrence_occurrence( &self, workspace: &Workspace, task_id: &TaskId, outcome: RecurrenceOutcome, ) -> Result<RecurrenceResolveOutcome>

pub async fn resolve_recurrence_occurrence_with_undo( &self, workspace: &Workspace, task_id: &TaskId, outcome: RecurrenceOutcome, undo: UndoContext, ) -> Result<RecurrenceResolveOutcome>

pub async fn pause_recurrence_series( &self, workspace: &Workspace, series_id: &RecurrenceSeriesId, ) -> Result<RecurrenceStateOutcome>

pub async fn resume_recurrence_series( &self, workspace: &Workspace, series_id: &RecurrenceSeriesId, at: DateTime<Utc>, ) -> Result<RecurrenceStateOutcome>

pub async fn stop_recurrence_series( &self, workspace: &Workspace, series_id: &RecurrenceSeriesId, skip_current: bool, ) -> Result<RecurrenceStateOutcome>

pub async fn resolve_recurrence_ref( &self, workspace: &Workspace, input: &str, ) -> Result<RecurrenceSeries>

pub async fn recurrence_series_ref( &self, workspace_id: &WorkspaceId, series_id: &RecurrenceSeriesId, ) -> Result<String>

impl Database

pub async fn add_task_related_link( &self, workspace: &Workspace, task_id: &TaskId, related_task_id: &TaskId, ) -> Result<RelatedOutcome>

pub async fn add_task_related_link_with_undo( &self, workspace: &Workspace, task_id: &TaskId, related_task_id: &TaskId, undo: UndoContext, ) -> Result<RelatedOutcome>

pub async fn remove_task_related_link( &self, workspace: &Workspace, task_id: &TaskId, related_task_id: &TaskId, ) -> Result<RelatedOutcome>

pub async fn remove_task_related_link_with_undo( &self, workspace: &Workspace, task_id: &TaskId, related_task_id: &TaskId, undo: UndoContext, ) -> Result<RelatedOutcome>

impl Database

pub async fn move_tasks( &self, source_workspace: &Workspace, input: MoveTasksInput, ) -> Result<MoveTasksOutcome>

impl Database

pub async fn create_task_with_attachments( &self, workspace: &Workspace, blob_dir: &Path, lifecycle_policy: LifecyclePolicy, draft: TaskDraft, attachments: Vec<TaskAttachmentAddInput>, ) -> Result<TaskOutcome>

pub async fn create_task_with_attachments_and_undo( &self, workspace: &Workspace, blob_dir: &Path, lifecycle_policy: LifecyclePolicy, draft: TaskDraft, attachments: Vec<TaskAttachmentAddInput>, undo: TaskCreationUndo, ) -> Result<TaskOutcome>

pub async fn create_task_with_attachments_and_options( &self, workspace: &Workspace, blob_dir: &Path, lifecycle_policy: LifecyclePolicy, draft: TaskDraft, attachments: Vec<TaskAttachmentAddInput>, options: TaskCreationOptions, ) -> Result<TaskOutcome>

pub async fn create_task_with_attachments_for_epic( &self, workspace: &Workspace, blob_dir: &Path, lifecycle_policy: LifecyclePolicy, draft: TaskDraft, attachments: Vec<TaskAttachmentAddInput>, epic_id: &TaskId, ) -> Result<TaskOutcome>

pub async fn create_task_with_attachments_for_epic_and_undo( &self, workspace: &Workspace, blob_dir: &Path, lifecycle_policy: LifecyclePolicy, draft: TaskDraft, attachments: Vec<TaskAttachmentAddInput>, options: TaskCreationOptions, ) -> Result<TaskOutcome>

impl Database

pub async fn create_task( &self, workspace: &Workspace, draft: TaskDraft, ) -> Result<TaskOutcome>

pub async fn create_task_with_undo( &self, workspace: &Workspace, draft: TaskDraft, undo: TaskCreationUndo, ) -> Result<TaskOutcome>

pub async fn create_task_with_options( &self, workspace: &Workspace, draft: TaskDraft, options: TaskCreationOptions, ) -> Result<TaskOutcome>

pub async fn create_task_for_epic( &self, workspace: &Workspace, draft: TaskDraft, epic_id: &TaskId, ) -> Result<TaskOutcome>

pub async fn create_task_for_epic_with_undo( &self, workspace: &Workspace, draft: TaskDraft, epic_id: &TaskId, undo: TaskCreationUndo, ) -> Result<TaskOutcome>

impl Database

pub async fn update_task( &self, workspace: &Workspace, task_id: &TaskId, update: TaskUpdate, ) -> Result<TaskUpdateOutcome>

pub async fn update_tasks( &self, workspace: &Workspace, updates: Vec<(TaskId, TaskUpdate)>, ) -> Result<Vec<TaskUpdateOutcome>>

pub async fn mutate_tasks( &self, workspace: &Workspace, updates: Vec<(TaskId, TaskUpdate)>, undo: UndoContext, ) -> Result<TaskMutationReport>

pub async fn set_task_deleted( &self, workspace: &Workspace, task_id: &TaskId, deleted: bool, ) -> Result<TaskOutcome>

impl Database

pub async fn add_note( &self, workspace: &Workspace, task_id: &TaskId, body: String, ) -> Result<NoteOutcome>

pub async fn add_note_with_tui_undo( &self, workspace: &Workspace, task_id: &TaskId, body: String, ) -> Result<NoteOutcome>

pub async fn edit_note( &self, workspace: &Workspace, task_id: &TaskId, note_id: &str, body: String, ) -> Result<NoteEditOutcome>

pub async fn edit_note_with_tui_undo( &self, workspace: &Workspace, task_id: &TaskId, note_id: &str, body: String, ) -> Result<NoteEditOutcome>

pub async fn delete_note( &self, workspace: &Workspace, task_id: &TaskId, note_id: &str, ) -> Result<NoteDeleteOutcome>

pub async fn delete_note_with_tui_undo( &self, workspace: &Workspace, task_id: &TaskId, note_id: &str, ) -> Result<NoteDeleteOutcome>

impl Database

pub async fn find_project( &self, workspace_id: &WorkspaceId, input: &str, ) -> Result<Option<Project>>

pub async fn find_project_by_id( &self, workspace_id: &WorkspaceId, project_id: &ProjectId, ) -> Result<Option<Project>>

pub async fn resolve_existing_project( &self, workspace_id: &WorkspaceId, project: &str, ) -> Result<Project>

pub async fn list_projects( &self, workspace_id: &WorkspaceId, search: Option<&str>, ) -> Result<Vec<Project>>

pub async fn inferred_project_key_for_add( &self, workspace_id: &WorkspaceId, config_candidate: Option<&str>, cwd: &Path, git_root: Option<&Path>, ) -> Result<Option<String>>

pub async fn inferred_existing_project_key( &self, workspace_id: &WorkspaceId, config_candidate: Option<&str>, cwd: &Path, git_root: Option<&Path>, ) -> Result<Option<String>>

pub async fn remove_project_path( &self, workspace_id: &WorkspaceId, project_id: &ProjectId, path: &Path, ) -> Result<()>

pub async fn resolve_or_create_project( &self, workspace_id: &WorkspaceId, project: &str, ) -> Result<Project>

pub async fn resolve_project_for_stored_value( &self, workspace_id: &WorkspaceId, value: &str, ) -> Result<Project>

impl Database

pub async fn reconcile_recurrence_reports_at( &self, workspace_id: &WorkspaceId, at: DateTime<Utc>, ) -> Result<RecurrenceReconciliation>

Reconciles recurrence projections before a report reads current state.

The candidate count is bounded. Each changed series writes one atomic projection transaction that can archive one superseded task and materialize one successor.

pub async fn reconcile_recurrence_reports( &self, workspace_id: &WorkspaceId, ) -> Result<RecurrenceReconciliation>

pub async fn list_recurrence_series_view_at( &self, workspace_id: &WorkspaceId, at: DateTime<Utc>, query: RecurrenceSeriesListQuery, ) -> Result<Vec<RecurrenceSeriesListItem>>

pub async fn list_recurrence_series_view( &self, workspace_id: &WorkspaceId, query: RecurrenceSeriesListQuery, ) -> Result<Vec<RecurrenceSeriesListItem>>

pub async fn list_recurrence_series_at( &self, workspace_id: &WorkspaceId, at: DateTime<Utc>, ) -> Result<Vec<RecurrenceSeriesSummary>>

pub async fn recurrence_series_detail_at( &self, workspace_id: &WorkspaceId, series_id: &RecurrenceSeriesId, at: DateTime<Utc>, ) -> Result<RecurrenceSeriesDetail>

pub async fn recurrence_history_at( &self, workspace_id: &WorkspaceId, series_id: &RecurrenceSeriesId, at: DateTime<Utc>, offset: usize, limit: usize, ) -> Result<RecurrenceHistoryPage>

pub async fn list_recurrence_series( &self, workspace_id: &WorkspaceId, ) -> Result<Vec<RecurrenceSeriesSummary>>

pub async fn recurrence_series_detail( &self, workspace_id: &WorkspaceId, series_id: &RecurrenceSeriesId, ) -> Result<RecurrenceSeriesDetail>

pub async fn recurrence_history( &self, workspace_id: &WorkspaceId, series_id: &RecurrenceSeriesId, offset: usize, limit: usize, ) -> Result<RecurrenceHistoryPage>

pub async fn list_project_items( &self, workspace_id: &WorkspaceId, ) -> Result<Vec<ProjectListItem>>

pub async fn list_task_items( &self, workspace_id: &WorkspaceId, filters: TaskFilters, mode: TaskQueryMode, sort: TaskSort, direction: SortDirection, ) -> Result<Vec<TaskListItem>>

pub async fn list_bulk_update_task_items( &self, workspace_id: &WorkspaceId, filters: TaskFilters, mode: TaskQueryMode, sort: TaskSort, direction: SortDirection, ) -> Result<Vec<TaskListItem>>

pub async fn list_task_items_without_activity_from_current_projection( &self, workspace_id: &WorkspaceId, filters: TaskFilters, mode: TaskQueryMode, sort: TaskSort, direction: SortDirection, ) -> Result<Vec<TaskListItem>>

pub async fn list_task_summary_items( &self, workspace_id: &WorkspaceId, filters: TaskFilters, mode: TaskQueryMode, sort: TaskSort, direction: SortDirection, limit: Option<usize>, ) -> Result<Vec<TaskListItem>>

pub async fn sidebar_counts_for_scope( &self, workspace_id: &WorkspaceId, project_key: Option<&str>, ) -> Result<SidebarCounts>

pub async fn list_recent_actions( &self, workspace_id: &WorkspaceId, project_scope: Option<&str>, ) -> Result<Vec<RecentActionItem>>

pub async fn task_activity_for_task( &self, workspace_id: &WorkspaceId, task_id: &TaskId, ) -> Result<Vec<RecentActionItem>>

pub async fn search_task_items( &self, workspace_id: &WorkspaceId, query: TaskSearchQuery, ) -> Result<Vec<TaskSearchResult>>

pub async fn search_task_occurrence_items( &self, workspace_id: &WorkspaceId, query: TaskSearchQuery, ) -> Result<Vec<TaskSearchResult>>

pub async fn search_task_preview_set( &self, workspace_id: &WorkspaceId, query: TaskSearchQuery, ) -> Result<TaskSearchPreviewResultSet>

pub async fn task_detail(&self, task: &Task) -> Result<TaskDetail>

pub async fn task_detail_with_display_refs( &self, task: &Task, display_refs: &DisplayRefContext, ) -> Result<TaskDetail>

pub async fn conflict_display_value( &self, workspace_id: &WorkspaceId, field: &str, value: &str, ) -> Result<String>

pub async fn task_dependency_summary( &self, workspace_id: &WorkspaceId, task_id: &TaskId, ) -> Result<TaskDependencySummary>

pub async fn task_related_links( &self, workspace_id: &WorkspaceId, task_id: &TaskId, ) -> Result<Vec<TaskRelatedLink>>

pub async fn workspace_task_counts( &self, workspace_id: &WorkspaceId, ) -> Result<WorkspaceTaskCounts>

pub async fn unresolved_conflict_count(&self) -> Result<i64>

pub async fn unresolved_task_conflict_count_in_workspace( &self, workspace_id: &WorkspaceId, ) -> Result<i64>

pub async fn sync_history_stats(&self) -> Result<SyncHistoryStats>

pub async fn database_stats( &self, workspace: &Workspace, ) -> Result<DatabaseStats>

impl Database

pub async fn display_ref_context( &self, workspace_id: &WorkspaceId, ) -> Result<DisplayRefContext>

pub async fn display_refs_for_task_ids( &self, workspace_id: &WorkspaceId, task_ids: &[TaskId], ) -> Result<HashMap<TaskId, String>>

pub async fn resolve_task_ref( &self, workspace: &Workspace, input: &str, ) -> Result<Task>

impl Database

pub async fn missing_sync_attachment_counts(&self) -> Result<ByteCount>

Accepted attachments whose image bytes are missing on this device.

pub async fn missing_setup_attachment_counts( &self, blob_dir: &Path, ) -> Result<ByteCount>

Live setup images whose object file is absent, regardless of the inventory’s last-known availability bit.

impl Database

pub async fn publish_bootstrap( &self, auth: &Authentication<'_>, request: PublishBootstrap<'_>, policy: PublicationPolicy, ) -> Result<PublicationOutcome>

Atomically publishes one complete immutable candidate and signed successor. This does not adopt the seed, install a client, or enable encrypted tail sync.

impl Database

pub async fn declare_bootstrap_staging( &self, auth: &Authentication<'_>, descriptor: &[u8], budget: Budget, ) -> Result<StagingStatus>

Authenticated declaration also ensures the initial staging reservation. Descriptor and budgets are immutable. Expired retries resume retained bytes.

pub async fn bootstrap_staging_status( &self, auth: &Authentication<'_>, bootstrap_id: [u8; 32], ) -> Result<Status>

Read-only, including for missing/expired candidates. No reservation renewal. Callers compare the returned commitment with their frozen local descriptor. Missing is an observation, never a terminal cancellation fence.

pub async fn ensure_bootstrap_staging( &self, auth: &Authentication<'_>, bootstrap_id: [u8; 32], descriptor_commitment: [u8; 32], ) -> Result<StagingStatus>

pub async fn cancel_bootstrap_staging( &self, auth: &Authentication<'_>, bootstrap_id: [u8; 32], ) -> Result<Status>

Terminal even before declaration. Canceled IDs consume the finite lifetime candidate budget and are never silently forgotten or reopened. Publication wins return its immutable outcome instead, without deleting any data.

pub async fn put_bootstrap_chunk( &self, auth: &Authentication<'_>, request: PutChunk<'_>, ) -> Result<()>

Stores one slot only after checking it against the frozen descriptor. Rejected bytes leave storage unchanged; exact retries succeed, including requests delayed across expiry and resume.

pub async fn put_bootstrap_batch( &self, auth: &Authentication<'_>, request: PutBatch<'_>, ) -> Result<()>

Stores every record of the batch in one transaction, each checked against its slot in the frozen descriptor, or stores nothing. Records already held must match exactly, so an exact retry succeeds and any conflicting record rolls back the whole batch.

impl Database

pub async fn publish_device_label( &self, device: [u8; 32], label: &str, ) -> Result<()>

Publishes this installation’s automatic label once. Device labels are display metadata; the membership device ID remains the identity.

pub async fn device_labels(&self) -> Result<BTreeMap<[u8; 32], String>>

Reads effective labels from encrypted retained history. Callers pair these with verified membership, so removed devices are not displayed.

impl Database

pub async fn encrypted_image_downloads_remaining(&self) -> Result<u64>

Images whose bytes this device still has to download. Counting reads only local state and never consumes a selection turn.

pub async fn prepare_encrypted_image_download( &self, a: &Authority, ) -> Result<Option<Download>>

Selects and advances past one pending object before transfer. The local cursor orders attempts, not acceptance, validation or content progress.

pub async fn install_encrypted_image( &self, a: &Authority, blob_dir: &Path, download: &Download, records: &[Vec<u8>], policy: LifecyclePolicy, ) -> Result<()>

pub async fn complete_encrypted_image_from_local( &self, a: &Authority, blob_dir: &Path, download: &Download, policy: LifecyclePolicy, ) -> Result<bool>

impl Database

pub async fn encrypted_tail_frozen_record( &self, a: &Authority, ) -> Result<Option<(String, Vec<u8>)>>

impl Database

pub async fn repair_encrypted_image( &self, a: &Authority, blob_dir: &Path, workspace: &str, reference: &str, ) -> Result<Upload>

Exact targeted repair uses only an authenticated admitted mapping.

impl Database

pub async fn prune_encrypted_images( &self, grace: Duration, limit: usize, ) -> Result<usize>

Deletes the stored bytes of at most limit images that have been unreferenced and unticketed for at least grace, keeping their descriptors. Returns how many images were pruned.

pub async fn encrypted_image_exchange( &self, context: &Context, bearer: &Secret, op: Operation, policy: LifecyclePolicy, ) -> Result<Reply>

impl Database

pub async fn encrypted_round_state( &self, authority: &Authority, ) -> Result<RoundState>

One validated read of local round state. Observation never freezes work or advances the download selector.

pub async fn encrypted_tail_observed_rank(&self) -> Result<u64>

Highest tail rank this replica applied or accepted. An honest allocator mark is never below a rank it assigned.

pub async fn prepare_encrypted_push( &self, authority: &Authority, blob_dir: &Path, ) -> Result<Option<Push>>

Returns the frozen head, or freezes the next ordered pending change. Image heads also return exact staged ciphertext for upload.

pub async fn prepare_encrypted_batch_in_run( &self, authority: &Authority, blob_dir: &Path, preflight: Option<Preflight>, count: usize, ) -> Result<(Option<Push>, Option<Preflight>)>

Freezes the next ordered pending group in one serialized push run. Reuses only the checked window while the local mutation sequence is unchanged.

pub async fn reconcile_encrypted_tail_absence( &self, authority: &Authority, absence: &AbsentOperation, blob_dir: &Path, ) -> Result<bool>

Closed-generation absence and replacement commit under one outbox/history owner. A failed transaction retains old bytes and requires a new lookup on retry.

pub async fn reconcile_encrypted_tail_absences( &self, authority: &Authority, absences: &[AbsentOperation], blob_dir: &Path, ) -> Result<bool>

pub async fn observe_encrypted_tail( &self, authority: &Authority, mapping: &Mapping, ) -> Result<Vec<u8>>

Retain an observed immutable outcome before fetching a different representation.

pub async fn verify_encrypted_tail_outcome( &self, authority: &Authority, accepted: &Accepted, ) -> Result<()>

pub async fn encrypted_tail_has_batch_work( &self, authority: &Authority, ) -> Result<bool>

pub async fn encrypted_tail_frozen_records( &self, authority: &Authority, ) -> Result<Vec<(String, Vec<u8>)>>

Returns the immutable unresolved inventory in dispatch order.

pub async fn accept_encrypted_tail_batch( &self, authority: &Authority, mappings: &[Mapping], ) -> Result<()>

Accepts exact frozen ciphertext together with every local domain effect.

pub async fn apply_encrypted_tail_page( &self, authority: &Authority, page: &Page, ) -> Result<()>

impl Database

pub async fn encrypted_tail_exchange( &self, context: &Context, bearer: &Secret, op: Operation, ) -> Result<Reply>

pub async fn encrypted_tail_batch_exchange( &self, context: &Context, bearer: &Secret, op: BatchOperation, ) -> Result<BatchReply>

impl Database

pub async fn sync_persistence_status(&self) -> Result<SyncPersistenceStatus>

Local sync bookkeeping; reads no protected keys and contacts no server.

impl Database

pub async fn prepare_membership_management( &self, auth: &Authentication<'_>, ) -> Result<ManagementPreparation>

pub async fn apply_membership_management( &self, auth: &Authentication<'_>, record: &[u8], ) -> Result<Vec<u8>>

impl Database

pub async fn verify_membership_history(&self) -> Result<()>

Replays the complete stored membership history and fills the cache. Servers run this before accepting requests; storage without published membership has nothing to verify.

pub async fn membership_evidence( &self, auth: &Authentication<'_>, ) -> Result<Evidence>

This read alone accepts a verified ancestor head, after current credential authentication.

pub async fn register_membership_invitation_at( &self, auth: &Authentication<'_>, raw: &[u8], time: i64, ) -> Result<RegistrationStatus>

pub async fn post_membership_request_at( &self, vault: [u8; 32], handle: [u8; 32], request: &[u8], time: i64, ) -> Result<()>

pub async fn membership_mailbox( &self, vault: [u8; 32], handle: [u8; 32], ) -> Result<Mailbox>

pub async fn cancel_membership_invitation_at( &self, auth: &Authentication<'_>, handle: [u8; 32], time: i64, ) -> Result<CancelStatus>

Terminally fences a registered, unadmitted invitation of the caller so no new admission can commit. Serialized with admission; idempotent. Unknown handles allocate nothing.

pub async fn admit_membership_device_at( &self, auth: &Authentication<'_>, handle: [u8; 32], record: &[u8], time: i64, ) -> Result<Vec<u8>>

impl Database

pub async fn membership_checkpoint_mirror( &self, ) -> Result<Option<([u8; 32], u64, [u8; 32], [u8; 32])>>

pub async fn mirror_membership_checkpoint( &self, identity: [u8; 32], m: &Membership, evidence: [u8; 32], ) -> Result<()>

impl Database

pub async fn peer_target_preflight(&self) -> Result<String>

pub async fn peer_retry_preflight( &self, identity: [u8; 32], client: &str, guard: &InstallationGuard, ) -> Result<()>

Rechecks that this pinned peer join is unfinished: nothing installed, associated or set up, and the domain still empty. The enrollment pin and installation fence stay in place.

pub async fn enrollment_pin(&self) -> Result<Option<([u8; 32], String, String)>>

pub async fn pin_enrollment( &self, identity: [u8; 32], client: &str, role: &str, guard: &InstallationGuard, ) -> Result<()>

pub async fn adopted_enrollment_client(&self) -> Result<String>

pub async fn enrollment_artifact(&self, kind: &str) -> Result<Option<Vec<u8>>>

pub async fn enrollment_artifacts(&self) -> Result<HashMap<String, Vec<u8>>>

pub async fn enrollment_artifact_marker(&self) -> Result<i64>

Monotonic, nonsecret marker for write-once enrollment state changes.

pub async fn pin_enrollment_artifact( &self, identity: [u8; 32], kind: &str, digest: [u8; 32], ) -> Result<()>

impl Database

pub async fn admit_seed_claim( &self, request: &[u8], authentication: ClaimAuthentication<'_>, ) -> Result<ClaimResult>

Admits one immutable sequence-zero claim under operator setup authority. The storage’s unexpired issued verifier is read in this claim transaction, so a concurrent reissue either precedes the claim or finds the storage claimed. Exact authenticated retries return the original result without reissuance. This does not authorize uploads, READY, or ordinary plaintext sync.

pub async fn e2ee_server_is_claimed(&self) -> Result<bool>

Whether encrypted server storage already has its immutable seed claim.

pub async fn local_seed_genesis_commitment(&self) -> Result<Option<[u8; 32]>>

Nonsecret loss-detection pin. This is never a substitute for host authority.

pub async fn pin_local_seed_genesis(&self, genesis: &Genesis) -> Result<()>

Hosts call this only after protected storage has committed exact authority. An old or replaced database may acquire a pin but cannot change one.

pub async fn mark_local_seed_claim_refused(&self, reason: &str) -> Result<()>

Records that a server refused this unfenced provisional claim. Refusals are unauthenticated, so the seed authority stays for an exact retry; hosts present the database as not set up until the next claim attempt.

pub async fn clear_local_seed_claim_refused(&self) -> Result<()>

pub async fn local_seed_claim_refused(&self) -> Result<bool>

pub async fn rollback_local_seed_genesis( &self, expected: [u8; 32], ) -> Result<()>

Removes an abandoned provisional seed pin and its recorded refusal. Once source authority or publication state exists, the installation is fenced and this operation refuses to undo it.

pub async fn issue_e2ee_server_setup( &self, secret: &Secret, fresh_id: [u8; 32], expires_at: u64, ) -> Result<[u8; 32]>

Issues operator setup authority for secret on encrypted server storage and returns its setup ID. An existing ID is kept, even after expiry, so a device whose genesis already binds it can claim with the reissued secret; the replaced verifier refuses earlier secrets. Claimed storage and storage holding local domain data cannot take a new verifier.

pub async fn e2ee_server_setup( &self, now: u64, ) -> Result<Option<SetupAuthority>>

The configured setup verifier while it is unexpired at now (Unix seconds).

pub async fn is_e2ee_server_storage(&self) -> Result<bool>

True once storage was prepared for, or claimed by, an encrypted vault. Refuses marked server storage containing local domain data.

pub async fn has_change_history(&self) -> Result<bool>

True when storage holds change rows. Encrypted server storage never does, so server launch refuses such storage as unsupported.

impl Database

pub async fn seed_source_pin(&self) -> Result<Option<Vec<u8>>>

pub async fn bind_seed_source( &self, source: &SeedSourceAuthority, installation: &InstallationGuard, ) -> Result<()>

Called under the installation interlock after protected persistence.

pub async fn seed_publication_intent_bytes( &self, ) -> Result<Option<(Vec<u8>, String)>>

pub async fn prepare_seed_publication_intent( &self, source: &SeedSourceAuthority, seed: &SeedAuthority, key: &LocalSharedStatePackageKey, ) -> Result<SeedPublicationIntent>

Commits cancellation exclusion before any protected intent is exposed. Retrying returns exact persisted bytes, never a newly signed context.

pub async fn seal_seed_publication_intent( &self, source: &SeedSourceAuthority, intent: &SeedPublicationIntent, ) -> Result<()>

Hosts supply an intent reloaded from protected storage, never a boolean.

pub async fn cleanup_adopted_seed_capture( &self, source: &SeedSourceAuthority, intent: &SeedPublicationIntent, ) -> Result<()>

Separate post-commit cleanup. Durable authority/receipt never cascades away.

impl Database

pub async fn has_local_shared_state_package_never_dispatched( &self, ) -> Result<bool>

Reports frozen package ownership, including missing-byte corruption. A true result requires the host to load existing protected authority, never generate a replacement key.

pub async fn package_local_shared_state_never_dispatched( &self, blob_dir: &Path, context: LocalSharedStatePackageContext, key: &LocalSharedStatePackageKey, membership_predecessor: [u8; 32], ) -> Result<EncryptedLocalSharedStatePackage>

Encrypts the durable never-dispatched capture or returns its frozen package.

The first successful call freezes the descriptor, catalogs and encrypted records in one SQLite transaction under the capture candidate ID. Tentative preparation before that commit can be retried. Later calls authenticate and return the exact saved bytes without reading image files. membership_predecessor is context only, not proof of authorization. Changed keys/context, incomplete data and incompatible local-only packages fail without replacement. Cancellation releases bytes and ownership together. SQLite commit/reopen is not a claim of platform power-loss durability.

pub async fn decrypt_and_install_local_shared_state_package( &self, package: &EncryptedLocalSharedStatePackage, key: &LocalSharedStatePackageKey, ) -> Result<SharedStateInstallReport>

Authenticates, decrypts, validates, and atomically installs a package.

All package bytes are checked before the target database transaction is opened. Installation still enforces the existing empty-target boundary.

impl Database

pub async fn published_snapshot_read( &self, auth: &Authentication<'_>, descriptor: [u8; 32], component: Option<Component>, index: u64, ) -> Result<Vec<u8>>

Copies one published record inside the current-membership transaction. Image bytes are read from lifecycle ownership, never staging or restored.

pub async fn peer_snapshot_receipt( &self, verified: &VerifiedEnrollment, enrollment: [u8; 32], client: &str, guard: &InstallationGuard, ) -> Result<Option<SharedStateInstallReport>>

Receipt lookup still requires independently verified protected authority. It never repairs a receipt or resets a later cursor or domain edit.

pub async fn install_peer_snapshot( &self, verified: &VerifiedEnrollment, enrollment: [u8; 32], client: &str, guard: &InstallationGuard, package: &Metadata, ) -> Result<SharedStateInstallReport>

Authenticated metadata and mappings commit independently of image bytes.

impl Database

pub async fn capture_local_shared_state_never_dispatched( &self, ) -> Result<NeverDispatchedLocalSharedCapture>

Creates or resumes the one durable, never-dispatched local capture.

The snapshot, exact history map, stable candidate and stream identities, image classification, ownership pins, counter floor, and sync fence commit in one immediate transaction. An existing capture is resumed without reading current domain rows or attachment bytes again.

pub async fn capture_local_shared_state_for_setup( &self, blob_dir: &Path, ) -> Result<NeverDispatchedLocalSharedCapture>

Captures setup state while checking that inventory marked available is still present on disk. Files missing at this boundary are published as unavailable; other filesystem failures remain explicit errors.

pub async fn resume_local_shared_state_never_dispatched( &self, ) -> Result<Option<NeverDispatchedLocalSharedCapture>>

Reopens the durable local capture without consulting newer domain rows.

pub async fn cancel_local_shared_state_never_dispatched( &self, candidate_id: &str, ) -> Result<bool>

Cancels only the given candidate’s never-dispatched capture and releases its pins.

Repeating cancellation after success is harmless. A different active candidate fails closed. Domain rows and later edits are never removed.

pub async fn install_shared_state( &self, capture: &SharedStateCapture, ) -> Result<SharedStateInstallReport>

Atomically installs captured shared state into a fresh database.

The target keeps its own client identity and local settings. Retained history receives dense effective prefix ranks, while source ordering provenance remains separate. Attachment metadata is installed without claiming that image bytes are locally available.

impl Database

pub async fn task_field_value( &self, workspace_id: &WorkspaceId, task_id: &TaskId, field: &str, ) -> Result<String>

pub async fn task_labels( &self, workspace_id: &WorkspaceId, task_id: &TaskId, ) -> Result<Vec<String>>

pub async fn task_undo_snapshot( &self, workspace_id: &WorkspaceId, task_id: &TaskId, ) -> Result<TaskUndoSnapshot>

pub async fn conflict_row_id( &self, workspace_id: &WorkspaceId, task_id: &TaskId, field: &str, ) -> Result<i64>

pub async fn clear_pending_tui_undo_entries(&self) -> Result<()>

pub async fn latest_tui_undo_presentation( &self, workspace_id: &WorkspaceId, ) -> Result<Option<PendingUndoPresentation>>

pub async fn apply_latest_tui_undo( &self, workspace_id: &WorkspaceId, ) -> Result<Option<UndoOutcome>>

impl Database

pub async fn list_workspaces(&self) -> Result<Vec<Workspace>>

pub async fn list_workspace_open_summaries( &self, ) -> Result<Vec<WorkspaceOpenSummary>>

pub async fn find_workspace( &self, name_or_key: &str, ) -> Result<Option<Workspace>>

pub async fn workspace_for_id( &self, workspace_id: &WorkspaceId, ) -> Result<Workspace>

pub async fn resolve_workspace(&self, name_or_key: &str) -> Result<Workspace>

pub async fn resolve_required_workspace( &self, name_or_key: &str, source: &str, ) -> Result<Workspace>

pub async fn create_workspace(&self, name: &str) -> Result<Workspace>

pub async fn rename_workspace( &self, workspace_ref: &str, new_name: &str, ) -> Result<Workspace>

Trait Implementations

impl Clone for Database

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.