Struct ReceiptQuery 

pub struct ReceiptQuery {
    pub capability_id: Option<String>,
    pub tool_server: Option<String>,
    pub tool_name: Option<String>,
    pub outcome: Option<String>,
    pub since: Option<u64>,
    pub until: Option<u64>,
    pub min_cost: Option<u64>,
    pub max_cost: Option<u64>,
    pub cursor: Option<u64>,
    pub limit: usize,
    pub agent_subject: Option<String>,
    pub tenant_filter: Option<String>,
}

Query parameters for filtering and paginating tool receipts.

Fields

capability_id: Option<String>

Filter by capability ID (exact match).

tool_server: Option<String>

Filter by tool server name (exact match).

tool_name: Option<String>

Filter by tool name (exact match).

outcome: Option<String>

Filter by decision outcome (maps to decision_kind column: “allow”, “deny”, “cancelled”, “incomplete”).

since: Option<u64>

Include only receipts with timestamp >= since (Unix seconds, inclusive).

until: Option<u64>

Include only receipts with timestamp <= until (Unix seconds, inclusive).

min_cost: Option<u64>

Include only receipts with financial cost_charged >= min_cost (minor units). Receipts without financial metadata are excluded when this filter is set.

max_cost: Option<u64>

Include only receipts with financial cost_charged <= max_cost (minor units). Receipts without financial metadata are excluded when this filter is set.

cursor: Option<u64>

Cursor for forward pagination: return only receipts with seq > cursor (exclusive).

limit: usize

Maximum number of receipts to return per page (capped at MAX_QUERY_LIMIT).

agent_subject: Option<String>

Filter by agent subject public key (hex-encoded Ed25519). Resolved through capability_lineage JOIN – does not replay issuance logs.

tenant_filter: Option<String>

Phase 1.5 multi-tenant receipt isolation: restrict results to a tenant. When Some(id), the store returns receipts whose tenant_id = id OR whose tenant_id IS NULL (the pre- multi-tenant “public” set) so legacy receipts remain visible during the transition. When None, no filter is applied – intended for admin / compat query paths only.

For strict isolation that excludes the NULL fallback set, the caller must also flip the store’s strict-tenant-isolation mode via SqliteReceiptStore::with_strict_tenant_isolation(true).

MUST be derived from the caller’s authentication context at the HTTP edge, not from a query parameter. See docs/protocols/STRUCTURAL-SECURITY-FIXES.md section 6.

Trait Implementations

impl Clone for ReceiptQuery

fn clone(&self) -> ReceiptQuery

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ReceiptQuery

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ReceiptQuery

fn default() -> ReceiptQuery

Returns the “default value” for a type.