Struct HttpEnvironmentStore 

pub struct HttpEnvironmentStore { /* private fields */ }

Remote HTTP-backed implementation of EnvironmentMutations.

See the module-level doc for the route table and design rationale.

Implementations

impl HttpEnvironmentStore

pub fn new(base_url: Url, auth: AuthMethod) -> Result<Self, ConstructionError>

Build with the default reqwest::blocking::Client.

Returns ConstructionError::InsecureTransport if auth is AuthMethod::Bearer and base_url is http:// to a non-loopback host.

pub fn with_client( client: Client, base_url: Url, auth: AuthMethod, ) -> Result<Self, ConstructionError>

Build with a caller-supplied client (custom timeouts, TLS config, etc.).

Returns ConstructionError::InsecureTransport if auth is AuthMethod::Bearer and base_url is http:// to a non-loopback host.

pub fn create_backup( &self, env_id: &EnvId, idempotency_key: &IdempotencyKey, ) -> Result<BackupManifest, StoreError>

POST /environments/{env_id}/backups — snapshot the environment’s stored state server-side; returns the contract’s manifest.

pub fn list_backups( &self, env_id: &EnvId, ) -> Result<Vec<BackupManifest>, StoreError>

GET /environments/{env_id}/backups — list backup manifests, oldest first.

pub fn delete_backup( &self, env_id: &EnvId, backup_id: &str, idempotency_key: &IdempotencyKey, ) -> Result<(), StoreError>

DELETE /environments/{env_id}/backups/{backup_id} — drop one backup (the server’s per-env backup store is bounded; at the cap, create_backup refuses until old ones are deleted).

pub fn restore( &self, env_id: &EnvId, request: &RestoreRequest, idempotency_key: &IdempotencyKey, ) -> Result<RestoreOutcome, StoreError>

POST /environments/{env_id}/restore — restore the environment from a named backup. request.precondition MUST pin prior state (the server answers 428 otherwise; a stale pin is a 412). The returned outcome’s integrity equals the backup’s recorded digest, and RestoreOutcome::etag is the restored state’s strong validator for the next CAS write.

pub fn reconcile_environment( &self, env_id: &EnvId, idempotency_key: &IdempotencyKey, ) -> Result<Environment, StoreError>

POST /environments/{env_id}/reconcile — server-mediated reconcile authorization. Asks the control-plane store to AUTHORIZE + AUDIT + CAS-pin a reconcile and return the authorized Environment snapshot; the operator still executes the k8s apply against the live cluster (the store has no cluster access). The cached strong ETag — captured by a prior load_environment read in this invocation — is replayed as the MANDATORY If-Match, so the snapshot returned is provably the revision the operator reviewed; a concurrent advance is refused server-side with a 412 (surfaced here as StoreError::Conflict). The reconcile writes no desired state, so the returned generation/ETag echo the loaded revision unchanged.

Callers MUST load_environment first: without a cached ETag the request carries no If-Match and the server answers 428.

pub fn rotate_messaging_webhook_secret_to_ref( &self, env_id: &EnvId, endpoint_id: MessagingEndpointId, updated_by: String, webhook_secret_ref: Option<String>, idempotency_key: IdempotencyKey, ) -> Result<MessagingEndpoint, StoreError>

POST /environments/{env_id}/messaging/{eid}/rotate-secret carrying an optional caller-supplied NEW webhook_secret_ref (raw secret:// URI). The control-plane store never mints secret material, so:

• Some(ref) — the operator has already provisioned the value in its own secrets plane; the server records the asserted ref and bumps the endpoint generation.
• None — the server cannot prove a rotation and answers 501.

The EnvironmentMutations::rotate_messaging_webhook_secret trait method delegates here with None (that generic surface carries no ref; the new-ref path is remote-store-specific and reached through the --store-url dispatch).

pub fn load_trust_root_keys( &self, env_id: &EnvId, ) -> Result<Vec<TrustedKey>, StoreError>

GET /environments/{env_id}/trust-root — the env’s trusted-key set (empty for an absent row, which the server treats as closed-by-default; a missing ENV is still a 404 → StoreError::NotFound). Inherent rather than on EnvironmentReads because trust roots are a separate document with their own error type and have no LocalFsStore equivalent on that trait.

Trait Implementations

impl Clone for HttpEnvironmentStore

fn clone(&self) -> HttpEnvironmentStore

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for HttpEnvironmentStore

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl EnvironmentMutations for HttpEnvironmentStore

fn create_environment( &self, env_id: &EnvId, name: String, host_config: EnvironmentHostConfig, ) -> Result<Environment, StoreError>

Create a fresh environment with empty bundles/revisions/packs. Rejects if the env already exists.

fn update_environment( &self, env_id: &EnvId, patch: UpdateEnvironmentPayload, ) -> Result<Environment, StoreError>

Patch the named scalar fields on an existing environment. FieldUpdate::Keep fields are skipped, FieldUpdate::Set writes the new value, FieldUpdate::Clear resets optional fields to None. The full updated Environment is returned. Covers what was previously split across update_environment (no listen_addr), set_public_url (single field), and set_config (host-level fields including listen_addr). One verb, one HTTP endpoint, one impl body per backend.

fn load_environment(&self, env_id: &EnvId) -> Result<Environment, StoreError>

Read the current environment state. This is the single READ verb on an otherwise mutation-only trait: the remote dispatch needs it to evaluate client-side preconditions — e.g. the warm health-gate’s expected_lifecycle, which the local closure-based path reads inline under its flock. Maps to GET /environments/{env_id} on the HTTP backend and delegates to EnvironmentStore::load on LocalFsStore.

fn trust_root_is_seeded(&self, env_id: &EnvId) -> Result<bool, StoreError>

True when the env’s trust root holds at least one operator key. Maps to GET /environments/{env_id}/trust-root on the HTTP backend and to a trust-root file read on LocalFsStore. A read-only probe (like Self::load_environment) — remote env apply --check uses it to diff a declared trust_root instead of assuming it is seeded (the env document does not carry trust-root state).

fn migrate_merge_bindings( &self, target_env_id: &EnvId, payload: MigrateMergePayload, ) -> Result<(Vec<String>, Vec<String>), StoreError>

Merge pack bindings and extension bindings into target_env_id. Skips slots / extension keys already bound in the target. Returns the list of newly-merged slots + extension key strings (in the form "<kind_path>::<instance_id>").

fn stage_revision( &self, env_id: &EnvId, payload: StageRevisionPayload, idempotency_key: IdempotencyKey, ) -> Result<Revision, StoreError>

Stage a fresh revision under deployment_id. The caller supplies the pinned artifact pointers; LocalFsStore’s CLI helper resolves them from a local .gtbundle upstream of this call so the trait stays storage-only.

fn warm_revision( &self, env_id: &EnvId, payload: WarmRevisionPayload, idempotency_key: IdempotencyKey, ) -> Result<RevisionTransitionOutcome, StoreError>

Transition a revision through its warm lifecycle chain, applying the client-evaluated health-gate outcome. The deployer CLI runs the runner-side health checks locally and ships the result in WarmRevisionPayload::health_gate: Ok(()) advances the revision to Ready; Err(failure) flips it to Failed atomically. This replaces the closure-based gate so the operation can cross the A8 HTTP wire contract.

fn drain_revision( &self, env_id: &EnvId, revision_id: RevisionId, idempotency_key: IdempotencyKey, ) -> Result<RevisionTransitionOutcome, StoreError>

Drain a Ready revision (graceful step-down → Drained). idempotency_key is required for A8 mutation consistency even though drain is logically idempotent — the key enables audit-event replay.

fn archive_revision( &self, env_id: &EnvId, revision_id: RevisionId, idempotency_key: IdempotencyKey, ) -> Result<RevisionTransitionOutcome, StoreError>

Archive a Drained / Failed revision (terminal). idempotency_key is required for A8 mutation consistency even though archive is logically idempotent — the key enables audit-event replay.

fn add_bundle( &self, env_id: &EnvId, payload: AddBundlePayload, idempotency_key: IdempotencyKey, ) -> Result<BundleDeployment, StoreError>

idempotency_key is required for A8 §2 mutation replay; the local impl accepts and ignores, the HTTP backend caches the original outcome.

fn update_bundle( &self, env_id: &EnvId, payload: UpdateBundlePayload, idempotency_key: IdempotencyKey, ) -> Result<BundleDeployment, StoreError>

idempotency_key is required for A8 §2 mutation replay; the local impl accepts and ignores, the HTTP backend caches the original outcome.

fn remove_bundle( &self, env_id: &EnvId, deployment_id: DeploymentId, idempotency_key: IdempotencyKey, ) -> Result<RemoveBundleOutcome, StoreError>

Remove a bundle deployment from the env. Refuses if the deployment still has live traffic splits or non-archived revisions — callers must op traffic clear and archive revisions first.

fn add_pack_binding( &self, env_id: &EnvId, binding: EnvPackBinding, idempotency_key: IdempotencyKey, ) -> Result<EnvPackBinding, StoreError>

fn update_pack_binding( &self, env_id: &EnvId, slot: CapabilitySlot, binding: EnvPackBinding, idempotency_key: IdempotencyKey, ) -> Result<(EnvPackBinding, u64), StoreError>

Returns (new_binding, new_generation) — the bumped audit generation is surfaced for downstream observability.

fn remove_pack_binding( &self, env_id: &EnvId, slot: CapabilitySlot, idempotency_key: IdempotencyKey, ) -> Result<(EnvPackBinding, u64), StoreError>

fn rollback_pack_binding( &self, env_id: &EnvId, slot: CapabilitySlot, idempotency_key: IdempotencyKey, ) -> Result<(EnvPackBinding, u64), StoreError>

fn add_extension_binding( &self, env_id: &EnvId, binding: ExtensionBinding, idempotency_key: IdempotencyKey, ) -> Result<ExtensionBinding, StoreError>

fn update_extension_binding( &self, env_id: &EnvId, key: ExtensionKey, binding: ExtensionBinding, idempotency_key: IdempotencyKey, ) -> Result<(ExtensionBinding, u64), StoreError>

fn remove_extension_binding( &self, env_id: &EnvId, key: ExtensionKey, idempotency_key: IdempotencyKey, ) -> Result<(ExtensionBinding, u64), StoreError>

fn rollback_extension_binding( &self, env_id: &EnvId, key: ExtensionKey, idempotency_key: IdempotencyKey, ) -> Result<(ExtensionBinding, u64), StoreError>

fn set_traffic_split( &self, env_id: &EnvId, payload: SetTrafficSplitPayload, idempotency_key: IdempotencyKey, ) -> Result<ApplyTrafficSplitOutcome, StoreError>

fn rollback_traffic_split( &self, env_id: &EnvId, deployment_id: DeploymentId, idempotency_key: IdempotencyKey, ) -> Result<RollbackTrafficSplitOutcome, StoreError>

fn add_messaging_endpoint( &self, env_id: &EnvId, payload: AddMessagingEndpointPayload, idempotency_key: IdempotencyKey, ) -> Result<MessagingEndpoint, StoreError>

idempotency_key is both A8 §2 transport metadata AND domain state in this group: the key is embedded in the endpoint’s updated_by stamp and drives same-key replay detection (see greentic_deploy_spec::engine::messaging).

fn link_messaging_bundle( &self, env_id: &EnvId, endpoint_id: MessagingEndpointId, bundle_id: BundleId, updated_by: String, idempotency_key: IdempotencyKey, ) -> Result<MessagingEndpoint, StoreError>

fn unlink_messaging_bundle( &self, env_id: &EnvId, endpoint_id: MessagingEndpointId, bundle_id: BundleId, updated_by: String, idempotency_key: IdempotencyKey, ) -> Result<MessagingEndpoint, StoreError>

fn set_messaging_welcome_flow( &self, env_id: &EnvId, payload: SetMessagingWelcomeFlowPayload, idempotency_key: IdempotencyKey, ) -> Result<MessagingEndpoint, StoreError>

idempotency_key semantics as on Self::add_messaging_endpoint — transport metadata that doubles as the replay-detection stamp.

fn remove_messaging_endpoint( &self, env_id: &EnvId, endpoint_id: MessagingEndpointId, ) -> Result<MessagingEndpointId, StoreError>

fn rotate_messaging_webhook_secret( &self, env_id: &EnvId, endpoint_id: MessagingEndpointId, updated_by: String, idempotency_key: IdempotencyKey, ) -> Result<MessagingEndpoint, StoreError>

fn bootstrap_trust_root( &self, env_id: &EnvId, ) -> Result<TrustRootSeed, StoreError>

Load (or generate) the backend’s operator signing key and add it to the env trust root. Idempotent re-grant: a second call with the same operator key is a no-op on the key set (case-insensitive key_id dedup), and it never rejects on an existing trust root.

fn seed_trust_root_if_absent( &self, env_id: &EnvId, ) -> Result<Option<TrustRootSeed>, StoreError>

Idempotent variant called from op env init: returns Some(seed) when a key was minted, None when a trust root already existed.

fn add_trusted_key( &self, env_id: &EnvId, key_id: String, public_key_pem: String, idempotency_key: IdempotencyKey, ) -> Result<TrustRootAddOutcome, StoreError>

idempotency_key is required for A8 mutation consistency even though add_trusted_key is intrinsically idempotent on key_id collision — the key enables HTTP-backend audit-event replay. Local-FS impls accept and ignore it; HTTP impls cache it for replay.

fn remove_trusted_key( &self, env_id: &EnvId, key_id: String, idempotency_key: IdempotencyKey, ) -> Result<TrustRootRemoveOutcome, StoreError>

idempotency_key is required for A8 mutation consistency. remove is logically idempotent on the trust-root state, but the wire-shape removed_public_key_pem field would be null on retry (the original PEM is gone) — so a retry without replay loses recovery material AND audit fidelity. The key enables HTTP-backend replay of the original response/audit; local-FS impls accept and ignore it.

impl EnvironmentReads for HttpEnvironmentStore

fn list_env_ids(&self) -> Result<Vec<EnvId>, StoreError>

GET /environments → the sorted env-id set (RBAC read-scope filtering is applied server-side).

fn env_exists(&self, env_id: &EnvId) -> Result<bool, StoreError>

A GET of the env mapped to a boolean: 200 → present, 404 → absent.

fn load_env(&self, env_id: &EnvId) -> Result<Environment, StoreError>

The environment document. Delegates to the mutation-side read EnvironmentMutations::load_environment (GET /environments/{env_id}) so the env GET shape lives in one place; the read verbs only project the returned document.

fn read_runtime( &self, env_id: &EnvId, ) -> Result<Option<EnvironmentRuntime>, StoreError>

GET /environments/{env_id}/runtime → the runtime host-config sidecar (null when none has been written) so remote env show reports the real runtime instead of conflating “absent” with “not exposed”.