Struct Store 

pub struct Store { /* private fields */ }

Implementations

impl Store

pub fn open(root: impl Into<PathBuf>) -> Result<Self, SnapshotError>

pub fn open_with( root: impl Into<PathBuf>, opts: StoreOptions, ) -> Result<Self, SnapshotError>

pub fn snapshot( &self, path: &Path, limits: Option<&Limits>, ) -> Result<Manifest, SnapshotError>

Capture the pre-action state of path (file, directory tree, symlink, or an absent-marker when the path does not exist).

pub fn snapshot_excluding( &self, path: &Path, limits: Option<&Limits>, exclude: &[PathBuf], ) -> Result<Manifest, SnapshotError>

pub fn snapshot_scoped( &self, path: &Path, limits: Option<&Limits>, exclude: &[PathBuf], skip: &SkipPolicy, ) -> Result<Manifest, SnapshotError>

The full snapshot entry point.

exclude prunes subtrees under an absolute path — the hook passes DOOVER_HOME so a defensive cwd snapshot of a project that CONTAINS doover’s own store never ingests doover’s internals (round 21).

skip prunes regenerable build/dependency directories found INSIDE the tree (target/, node_modules/, …) — see SkipPolicy for why a name alone is not enough. Dogfooding showed a Rust repo is 99.5% target/: without this the time budget is spent on build artifacts and the user’s actual source never gets captured. The snapshot ROOT is never skipped, so rm -rf target still snapshots target/ in full — skipping only applies to dirs we find while walking a tree the user did not point at directly.

pub fn restore( &self, manifest: &Manifest, ) -> Result<RestoreReport, SnapshotError>

Restore the exact captured state, replacing whatever is at the path now. Fails before touching anything if the store is corrupt. Callers wanting conflict detection diff current state against the manifest first (undo engine, step 6).

pub fn state_matches(&self, manifest: &Manifest) -> Result<bool, SnapshotError>

Does the CURRENT filesystem state at manifest.path match the manifest? Content-level comparison: file hashes (with a length fast-path), directory presence, symlink targets, fifo presence. Mode and mtime are deliberately ignored — metadata-only drift is not a conflict. Extra entries under the root or missing entries are mismatches, except under a truncated manifest, which compares only what it captured (weaker evidence — callers should warn).

pub fn supports_reflink(&self) -> bool

Probe whether the store’s filesystem supports copy-on-write clones.

pub fn prune( &self, live: &BTreeSet<String>, grace_ms: u64, dry_run: bool, ) -> Result<(u64, u64), SnapshotError>

Remove every object whose hash is NOT in live. Returns (objects_removed, bytes_freed); dry_run only counts. Objects are immutable and content-addressed, so removal is always safe for anything outside the live set — the live set is the whole contract. Remove content objects not in live. grace_ms protects objects younger than the window: a hook promotes an object into objects/ and only THEN journals the manifest that references it, so a gc racing that window would see a just-promoted object no journal row vouches for yet. Deleting it strands the about-to-be-written manifest — silent undo breakage. Young unreferenced objects are therefore treated as possibly-in-flight and kept (same guard clean_tmp gives tmp files); only aged orphans (crash leftovers) are reaped.

pub fn clean_tmp( &self, max_age_ms: u64, dry_run: bool, ) -> Result<u64, SnapshotError>

Remove tmp entries older than max_age_ms — crash leftovers from interrupted ingestions. Age-gated so a concurrently-running hook’s in-flight tmp file is never yanked out from under it.

pub fn object_count(&self) -> Result<u64, SnapshotError>

pub fn total_bytes(&self) -> Result<u64, SnapshotError>

Apparent store size: the sum of object lengths. On CoW filesystems the blocks may be shared with the originals (actual usage lower), which is exactly why this is the PREDICTABLE bound the size cap enforces — the free-space floor covers the physical-disk side.

pub fn object_paths(&self) -> Result<Vec<PathBuf>, SnapshotError>