Struct LocalFsStore 

pub struct LocalFsStore { /* private fields */ }

Implementations

impl LocalFsStore

pub fn create_environment( &self, env_id: &EnvId, name: String, host_config: EnvironmentHostConfig, ) -> Result<Environment, StoreError>

Create a fresh environment with empty bundles/revisions/packs. Rejects (via StoreError::Conflict) if the env already exists — callers wanting upsert semantics should call Self::update_environment.

The caller’s EnvironmentHostConfig::env_id is overwritten with env_id so the on-disk row’s host-config envelope cannot disagree with the directory it lands in.

pub fn update_environment( &self, env_id: &EnvId, patch: UpdateEnvironmentPayload, ) -> Result<Environment, StoreError>

Patch the named scalar fields on an existing env. [FieldUpdate::Keep] fields are skipped, [FieldUpdate::Set] writes the new value, and [FieldUpdate::Clear] resets an optional field to None. Returns the fully-updated Environment. Collapses what was previously split across the op env update, op env set-public-url, and op config set verbs — see UpdateEnvironmentPayload for the rationale.

StoreError::NotFound passes through unchanged; the CLI mapper downcasts it to OpError::NotFound via [crate::cli::map_store_err_preserving_noun].

pub fn migrate_merge_bindings( &self, target_env_id: &EnvId, payload: MigrateMergePayload, ) -> Result<(Vec<String>, Vec<String>), StoreError>

Merge pack bindings and extension bindings into target_env_id, optionally seeding a fresh target env from a source when the target doesn’t exist yet. All work runs under the target’s flock so the existence check + optional seed + merge + save are atomic.

Skips slots already in the target’s packs and extension keys already in the target’s extensions (uniqueness on (kind.path(), instance_id)). Returns (merged_slot_names, merged_extension_key_strings).

Returns StoreError::NotFound if target is missing AND payload.seed_if_missing is None (the caller asserted target presence).

pub fn stage_revision( &self, env_id: &EnvId, payload: StageRevisionPayload, _idempotency_key: IdempotencyKey, ) -> Result<Revision, StoreError>

Stage a fresh revision under payload.deployment_id. The caller supplies the pre-resolved artifact pointers (bundle_digest, pack_list, pack_list_lock_ref, pack_config_refs) and a pre-minted RevisionId — bundle staging (extract + lock-pin + pack-config materialization) runs OUTSIDE the env flock because the rev_dir is named after the ULID and the extraction cost shouldn’t hold the lock.

Inside the flock: load → re-validate deployment exists → compute next_sequence = max(existing[deployment]) + 1 → build Revision (Staged) → push → save.

Returns StoreError::DependentNotFound when the deployment is missing under the env at lock-acquisition time (closes the TOCTOU window over any pre-call lookup the caller may have done for input validation).

payload.idempotency_key is accepted for trait conformance and ignored locally; the HTTP backend caches it for A8 §2 replay.

pub fn warm_revision( &self, env_id: &EnvId, payload: WarmRevisionPayload, _idempotency_key: IdempotencyKey, ) -> Result<RevisionTransitionOutcome, StoreError>

Drive a revision through the Staged → Warming → Ready chain and apply the client-evaluated warm/ready health-gate outcome. The chain advance, the warmed_at stamp, the gate-result application (Ready on Ok(()); Failed on Err(failure), persisted), and the runtime-config.json refresh all happen inside one super::store::LocalFsStore::transact flock so the on-disk env is durable when the call returns.

The lifecycle precondition (payload.expected_lifecycle, PR-3a.6b), the chain constants, and the gate semantics live in engine::warm_revision — shared verbatim with the operator-store-server.

_idempotency_key is accepted for trait conformance and ignored locally; the HTTP backend caches it for A8 §2 replay.

pub fn drain_revision( &self, env_id: &EnvId, revision_id: RevisionId, _idempotency_key: IdempotencyKey, ) -> Result<RevisionTransitionOutcome, StoreError>

Transition a Ready revision to Draining. Pure lifecycle stamp — the in-flight drain dance (sessions, WebSocket cleanup) is owned by greentic-start.

_idempotency_key is accepted for trait conformance and ignored locally; the HTTP backend caches it for A8 §2 replay.

pub fn archive_revision( &self, env_id: &EnvId, revision_id: RevisionId, _idempotency_key: IdempotencyKey, ) -> Result<RevisionTransitionOutcome, StoreError>

Archive a revision, walking any of Staged | Warming | Ready | Failed to Archived in one hop and the post-drain Draining → Inactive → Archived walk end-to-end. Refuses if the revision still routes live traffic — callers rebalance via gtc op traffic set first.

_idempotency_key is accepted for trait conformance and ignored locally; the HTTP backend caches it for A8 §2 replay.

pub fn add_bundle( &self, env_id: &EnvId, payload: AddBundlePayload, _idempotency_key: IdempotencyKey, ) -> Result<BundleDeployment, StoreError>

Add a BundleDeployment to the env. Rejects with StoreError::Conflict when (bundle_id, customer_id) is already deployed (verb semantics live in engine::add_bundle). Writes the v1 revenue-policy sidecar via super::write_revenue_policy_version and pins the resulting ref on the deployment.

_idempotency_key is accepted for trait conformance and ignored locally; the HTTP backend caches it for A8 §2 replay.

pub fn update_bundle( &self, env_id: &EnvId, payload: UpdateBundlePayload, _idempotency_key: IdempotencyKey, ) -> Result<BundleDeployment, StoreError>

Patch a BundleDeployment’s scalar fields. None fields are skipped (verb semantics live in engine::update_bundle). When revenue_share is Some, writes a new signed/versioned revenue-policy sidecar (chain-linked to the prior version) and pins the new ref on the deployment.

Returns StoreError::DependentNotFound when deployment_id is absent under the env at lock-acquisition time.

_idempotency_key is accepted for trait conformance and ignored locally; the HTTP backend caches it for A8 §2 replay.

pub fn remove_bundle( &self, env_id: &EnvId, deployment_id: DeploymentId, _idempotency_key: IdempotencyKey, ) -> Result<RemoveBundleOutcome, StoreError>

Remove a BundleDeployment from the env. Refuses with StoreError::Conflict if the deployment still carries live state (any greentic_deploy_spec::TrafficSplit pointing at it, or any non-Archived revision under it) — callers run op traffic clear and archive revisions first. Drops archived revisions for the same deployment_id so the env stays compact. Verb semantics live in engine::remove_bundle; this wrapper owns the flock + persistence.

Returns StoreError::DependentNotFound when the deployment is absent under the env at lock-acquisition time (matches the DependentNotFound precedent set by stage_revision).

_idempotency_key is accepted for trait conformance and ignored locally; the HTTP backend caches it for A8 §2 replay.

pub fn add_pack_binding( &self, env_id: &EnvId, binding: EnvPackBinding, _idempotency_key: IdempotencyKey, ) -> Result<EnvPackBinding, StoreError>

Bind a new env-pack slot. Rejects with StoreError::Conflict when the slot is already bound (callers should update instead). Verb semantics live in engine::add_pack_binding; this wrapper owns the flock + persistence.

_idempotency_key is accepted for trait conformance and ignored locally; the HTTP backend caches it for A8 §2 replay.

pub fn update_pack_binding( &self, env_id: &EnvId, slot: CapabilitySlot, binding: EnvPackBinding, _idempotency_key: IdempotencyKey, ) -> Result<(EnvPackBinding, u64), StoreError>

Replace the binding on an existing slot. The engine snapshots the prior binding inline (one-step-rollback stash) — see engine::update_pack_binding.

Returns (new_binding, new_generation).

_idempotency_key is accepted for trait conformance and ignored locally; the HTTP backend caches it for A8 §2 replay.

pub fn remove_pack_binding( &self, env_id: &EnvId, slot: CapabilitySlot, _idempotency_key: IdempotencyKey, ) -> Result<(EnvPackBinding, u64), StoreError>

Remove a pack-binding slot. Returns (removed_binding, removed_generation).

_idempotency_key is accepted for trait conformance and ignored locally; the HTTP backend caches it for A8 §2 replay.

pub fn rollback_pack_binding( &self, env_id: &EnvId, slot: CapabilitySlot, _idempotency_key: IdempotencyKey, ) -> Result<(EnvPackBinding, u64), StoreError>

Rollback a pack-binding slot to its one-step-previous snapshot. Returns (restored_binding, new_generation). Fails with StoreError::DependentNotFound when the slot doesn’t exist and StoreError::Conflict when there is no previous snapshot to restore.

_idempotency_key is accepted for trait conformance and ignored locally; the HTTP backend caches it for A8 §2 replay.

pub fn bootstrap_trust_root( &self, env_id: &EnvId, ) -> Result<TrustRootSeed, StoreError>

Unconditional re-grant: load (or generate) the operator key and add it to the env trust root. Idempotent on case-insensitive key_id collision — the existing entry’s PEM is overwritten with whatever the operator-key file holds today.

Lock placement. operator_key::load_or_generate runs OUTSIDE the env flock so a slow OS RNG seed does not hold the lock; the trust-root mutation runs INSIDE the flock so concurrent add/remove cannot race the read-modify-write. Caller is responsible for any authz gate before invoking this method — ~/.greentic/operator/key.pem is generated on first call to load_or_generate, so an authz failure after this method runs would not roll back that side effect.

pub fn seed_trust_root_if_absent( &self, env_id: &EnvId, ) -> Result<Option<TrustRootSeed>, StoreError>

First-init-only variant: returns None when <env_dir>/trust-root.json already exists (operator has touched the trust root via bootstrap/add/remove). The existence check and load_or_generate both sit under the env flock so a concurrent trust-root remove cannot race the gate, and ~/.greentic/operator/key.pem is not auto-generated when the gate would skip.

pub fn add_trusted_key( &self, env_id: &EnvId, key_id: String, public_key_pem: String, _idempotency_key: IdempotencyKey, ) -> Result<TrustRootAddOutcome, StoreError>

Add a trusted (key_id, public_key_pem) entry to the env trust root. Validates key_id matches the canonical derivation from pem and rejects empty/whitespace key ids. Idempotent on case-insensitive key_id collision.

_idempotency_key is accepted for trait-conformance with super::mutations::EnvironmentMutations::add_trusted_key and ignored locally — the HTTP backend caches it for A8 §2 replay.

pub fn remove_trusted_key( &self, env_id: &EnvId, key_id: String, _idempotency_key: IdempotencyKey, ) -> Result<TrustRootRemoveOutcome, StoreError>

Remove a trusted key by case-insensitive key_id. Silent no-op when the id is absent. Captures the pre-state PEM under the flock for race-safe recovery reporting.

_idempotency_key is accepted for trait-conformance with super::mutations::EnvironmentMutations::remove_trusted_key and ignored locally. The HTTP backend MUST cache and replay the original outcome so retries don’t surface removed_public_key_pem: None (the failure mode that motivated requiring the key).

pub fn add_extension_binding( &self, env_id: &EnvId, binding: ExtensionBinding, _idempotency_key: IdempotencyKey, ) -> Result<ExtensionBinding, StoreError>

Add a new extension binding to the env. Rejects with StoreError::Conflict if a binding with the same (kind.path(), instance_id) key already exists — callers wanting to replace use Self::update_extension_binding. Verb semantics live in engine::add_extension_binding.

_idempotency_key is accepted for trait conformance and ignored locally; the HTTP backend caches it for A8 §2 replay.

pub fn update_extension_binding( &self, env_id: &EnvId, key: ExtensionKey, binding: ExtensionBinding, _idempotency_key: IdempotencyKey, ) -> Result<(ExtensionBinding, u64), StoreError>

Replace an existing extension binding identified by key. The engine bumps generation and stashes the prior binding inline so Self::rollback_extension_binding can restore it — see engine::update_extension_binding.

Returns (new_binding, new_generation).

_idempotency_key is accepted for trait conformance and ignored locally; the HTTP backend caches it for A8 §2 replay.

pub fn remove_extension_binding( &self, env_id: &EnvId, key: ExtensionKey, _idempotency_key: IdempotencyKey, ) -> Result<(ExtensionBinding, u64), StoreError>

Remove an extension binding identified by key. Returns the removed binding and its generation at the time of removal.

_idempotency_key is accepted for trait conformance and ignored locally; the HTTP backend caches it for A8 §2 replay.

pub fn rollback_extension_binding( &self, env_id: &EnvId, key: ExtensionKey, _idempotency_key: IdempotencyKey, ) -> Result<(ExtensionBinding, u64), StoreError>

Rollback an extension binding to its previous version. Requires the binding to have a stashed previous_binding_ref. Bumps generation and clears the stash so a second rollback fails (single-step only).

_idempotency_key is accepted for trait conformance and ignored locally; the HTTP backend caches it for A8 §2 replay.

pub fn set_traffic_split( &self, env_id: &EnvId, payload: SetTrafficSplitPayload, idempotency_key: IdempotencyKey, ) -> Result<ApplyTrafficSplitOutcome, StoreError>

Replace the entire traffic-split entry list for one deployment. Pure semantics (10,000 bps sum invariant, §5.3 admission, the idempotency contract, the one-step rollback stash) live in engine::set_traffic_split; this wrapper owns persistence and the derived runtime-config.json.

Post-save, the materialized runtime-config.json is refreshed. A failure there wraps as StoreError::CommittedAfterSave so the CLI audit fires for the already-persisted mutation. The idempotent no-op replay skips the save but still reconciles runtime-config (repairs a prior publish failure) — a refresh failure there is NOT committed-after-save, because nothing new was committed.

TrafficSplitApplied telemetry is emitted by the CLI layer from the outcome’s env snapshot (identical local and remote), not here.

pub fn rollback_traffic_split( &self, env_id: &EnvId, deployment_id: DeploymentId, _idempotency_key: IdempotencyKey, ) -> Result<RollbackTrafficSplitOutcome, StoreError>

Rollback the traffic split for a deployment to its one-step-previous snapshot. Pure semantics live in engine::rollback_traffic_split; this wrapper owns persistence and the runtime-config.json refresh (wrapped as StoreError::CommittedAfterSave post-save).

Returns StoreError::DependentNotFound when no split exists for the deployment, and StoreError::Conflict when there is no previous snapshot to restore.

_idempotency_key is accepted for trait conformance and ignored locally; the HTTP backend caches it for A8 §2 replay.

pub fn add_messaging_endpoint( &self, env_id: &EnvId, payload: AddMessagingEndpointPayload, idempotency_key: IdempotencyKey, ) -> Result<MessagingEndpoint, StoreError>

Add a messaging endpoint. Rejects with StoreError::Conflict when the (provider_type, provider_id) pair is already present or when the idempotency key was already used for a different endpoint identity. Idempotent on same-key same-identity replay (repairs a stale projection from a prior failed call).

Telegram-class providers auto-generate a webhook secret at creation time via [crate::cli::messaging::provision_webhook_secret].

pub fn link_messaging_bundle( &self, env_id: &EnvId, endpoint_id: MessagingEndpointId, bundle_id: BundleId, updated_by: String, idempotency_key: IdempotencyKey, ) -> Result<MessagingEndpoint, StoreError>

Link a bundle to an existing messaging endpoint. Idempotent when the bundle is already linked (repairs a stale projection). Rejects with StoreError::DependentNotFound when the endpoint or bundle is missing.

pub fn unlink_messaging_bundle( &self, env_id: &EnvId, endpoint_id: MessagingEndpointId, bundle_id: BundleId, updated_by: String, idempotency_key: IdempotencyKey, ) -> Result<MessagingEndpoint, StoreError>

Unlink a bundle from an existing messaging endpoint. Idempotent when the bundle is not linked (repairs a stale projection). Rejects with StoreError::Conflict if the bundle owns the endpoint’s welcome_flow.

pub fn set_messaging_welcome_flow( &self, env_id: &EnvId, payload: SetMessagingWelcomeFlowPayload, idempotency_key: IdempotencyKey, ) -> Result<MessagingEndpoint, StoreError>

Set the welcome flow on a messaging endpoint. Rejects with StoreError::InvalidArgument when the bundle is not linked, or when pack_id does not appear in any current revision’s pack_list. Idempotent when the same welcome flow ref is already set (repairs a stale projection).

pub fn remove_messaging_endpoint( &self, env_id: &EnvId, endpoint_id: MessagingEndpointId, ) -> Result<MessagingEndpointId, StoreError>

Remove a messaging endpoint by id. Idempotent when the endpoint is already absent (repairs a stale projection). Returns the id of the removed endpoint.

pub fn rotate_messaging_webhook_secret( &self, env_id: &EnvId, endpoint_id: MessagingEndpointId, updated_by: String, idempotency_key: IdempotencyKey, ) -> Result<MessagingEndpoint, StoreError>

Rotate the webhook secret for a messaging endpoint. Generates a new CSPRNG secret value, writes it to the dev-store under the existing (or freshly-built) secret ref URI, and bumps generation. Idempotent on same-idem-key replay (returns the existing endpoint without re-generating).

pub fn ensure_local_environment( &self, env_id: &EnvId, payload: EnsureLocalEnvironmentPayload, ) -> Result<(Environment, LocalEnvOutcome), StoreError>

Get-or-create-with-heal: idempotent first-run bootstrap of the local Environment with default env-pack bindings. Returns the env + an outcome variant indicating whether it was Created, Healed (default bindings added), or AlreadyExists (no change needed).

The entire read-modify-write runs inside LocalFsStore::transact, so concurrent first-run invocations on the same host serialize on the per-env flock and produce a single env.

refresh_local_runtime_stub is NOT called here — the CLI layer runs it after the verb returns, outside the flock. The tiny race window (another writer could modify the env between verb-return and stub-refresh) is acceptable because the runtime stub is a derived projection that self-heals on every bootstrap call.

This verb is not part of the super::mutations::EnvironmentMutations trait — bootstrap is LocalFsStore-specific. Remote stores don’t run first-run local bootstrap.

impl LocalFsStore

pub fn new(root: impl Into<PathBuf>) -> Self

pub fn default_root() -> Option<PathBuf>

~/.greentic/environments per the Phase A acceptance criteria.

pub fn root(&self) -> &Path

pub fn load_update_channel( &self, env_id: &EnvId, ) -> Result<Option<UpdateChannelConfig>, StoreError>

Load the operator’s update-channel policy. Absent file → Ok(None) (callers resolve that to deny-by-default). Validates the env-id binding and schema discriminator, mirroring load_runtime. Inherent (not a trait method): the update channel is a local-runtime concern, so remote store backends need not carry it.

impl LocalFsStore

pub fn env_lock_path(&self, env_id: &EnvId) -> Result<PathBuf, StoreError>

Resolve the per-env lock path. Public so external callers that need raw EnvFlock semantics can grab the path without poking at private internals — but they must understand that each mutating call already re-acquires this lock blocking, so externally-held guards combined with save_* on the same instance will deadlock. Prefer LocalFsStore::transact for compound mutations.

pub fn transact<F, R, E>(&self, env_id: &EnvId, f: F) -> Result<R, E>

where F: FnOnce(&Locked<'_>) -> Result<R, E>, E: From<StoreError>,

Run f while holding the env’s exclusive lock. The closure receives a Locked view whose mutator methods skip lock acquisition, so a natural load → mutate → save flow inside the closure does not re-enter (and deadlock on) the per-FD flock.

Reads (load, load_runtime, load_pack_answers, exists, list) do not take the lock and are also available on the Locked handle for convenience.

Generic over the closure’s error type via E: From<StoreError> so callers that mix storage errors with their own domain errors (e.g. the cli::* operator surface using OpError) can run validation + load + mutate + save in a single critical section without an outer-layer error-mapping dance. Existing callers passing Result<_, StoreError> continue to work because From<StoreError> for StoreError is automatic.

Trait Implementations

impl Clone for LocalFsStore

fn clone(&self) -> LocalFsStore

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for LocalFsStore

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl EnvironmentMutations for LocalFsStore

fn create_environment( &self, env_id: &EnvId, name: String, host_config: EnvironmentHostConfig, ) -> Result<Environment, StoreError>

See LocalFsStore::create_environment.

fn update_environment( &self, env_id: &EnvId, patch: UpdateEnvironmentPayload, ) -> Result<Environment, StoreError>

See LocalFsStore::update_environment.

fn load_environment(&self, env_id: &EnvId) -> Result<Environment, StoreError>

Reads the persisted env via EnvironmentStore::load — the trait’s one read verb, surfaced here so &dyn EnvironmentMutations callers (the remote dispatch) can evaluate client-side preconditions.

fn trust_root_is_seeded(&self, env_id: &EnvId) -> Result<bool, StoreError>

A seeded env has the trust-root file present — the seed/add paths always write ≥1 key, mirroring the tr_path.exists() check in LocalFsStore::seed_trust_root_if_absent.

fn migrate_merge_bindings( &self, target_env_id: &EnvId, payload: MigrateMergePayload, ) -> Result<(Vec<String>, Vec<String>), StoreError>

See LocalFsStore::migrate_merge_bindings.

fn stage_revision( &self, env_id: &EnvId, payload: StageRevisionPayload, idempotency_key: IdempotencyKey, ) -> Result<Revision, StoreError>

See LocalFsStore::stage_revision.

fn warm_revision( &self, env_id: &EnvId, payload: WarmRevisionPayload, idempotency_key: IdempotencyKey, ) -> Result<RevisionTransitionOutcome, StoreError>

See LocalFsStore::warm_revision.

fn drain_revision( &self, env_id: &EnvId, revision_id: RevisionId, idempotency_key: IdempotencyKey, ) -> Result<RevisionTransitionOutcome, StoreError>

See LocalFsStore::drain_revision.

fn archive_revision( &self, env_id: &EnvId, revision_id: RevisionId, idempotency_key: IdempotencyKey, ) -> Result<RevisionTransitionOutcome, StoreError>

See LocalFsStore::archive_revision.

fn add_bundle( &self, env_id: &EnvId, payload: AddBundlePayload, idempotency_key: IdempotencyKey, ) -> Result<BundleDeployment, StoreError>

See LocalFsStore::add_bundle.

fn update_bundle( &self, env_id: &EnvId, payload: UpdateBundlePayload, idempotency_key: IdempotencyKey, ) -> Result<BundleDeployment, StoreError>

See LocalFsStore::update_bundle.

fn remove_bundle( &self, env_id: &EnvId, deployment_id: DeploymentId, idempotency_key: IdempotencyKey, ) -> Result<RemoveBundleOutcome, StoreError>

See LocalFsStore::remove_bundle.

fn add_pack_binding( &self, env_id: &EnvId, binding: EnvPackBinding, idempotency_key: IdempotencyKey, ) -> Result<EnvPackBinding, StoreError>

See LocalFsStore::add_pack_binding.

fn update_pack_binding( &self, env_id: &EnvId, slot: CapabilitySlot, binding: EnvPackBinding, idempotency_key: IdempotencyKey, ) -> Result<(EnvPackBinding, u64), StoreError>

See LocalFsStore::update_pack_binding.

fn remove_pack_binding( &self, env_id: &EnvId, slot: CapabilitySlot, idempotency_key: IdempotencyKey, ) -> Result<(EnvPackBinding, u64), StoreError>

See LocalFsStore::remove_pack_binding.

fn rollback_pack_binding( &self, env_id: &EnvId, slot: CapabilitySlot, idempotency_key: IdempotencyKey, ) -> Result<(EnvPackBinding, u64), StoreError>

See LocalFsStore::rollback_pack_binding.

fn add_extension_binding( &self, env_id: &EnvId, binding: ExtensionBinding, idempotency_key: IdempotencyKey, ) -> Result<ExtensionBinding, StoreError>

See LocalFsStore::add_extension_binding.

fn update_extension_binding( &self, env_id: &EnvId, key: ExtensionKey, binding: ExtensionBinding, idempotency_key: IdempotencyKey, ) -> Result<(ExtensionBinding, u64), StoreError>

See LocalFsStore::update_extension_binding.

fn remove_extension_binding( &self, env_id: &EnvId, key: ExtensionKey, idempotency_key: IdempotencyKey, ) -> Result<(ExtensionBinding, u64), StoreError>

See LocalFsStore::remove_extension_binding.

fn rollback_extension_binding( &self, env_id: &EnvId, key: ExtensionKey, idempotency_key: IdempotencyKey, ) -> Result<(ExtensionBinding, u64), StoreError>

See LocalFsStore::rollback_extension_binding.

fn set_traffic_split( &self, env_id: &EnvId, payload: SetTrafficSplitPayload, idempotency_key: IdempotencyKey, ) -> Result<ApplyTrafficSplitOutcome, StoreError>

See LocalFsStore::set_traffic_split.

fn rollback_traffic_split( &self, env_id: &EnvId, deployment_id: DeploymentId, idempotency_key: IdempotencyKey, ) -> Result<RollbackTrafficSplitOutcome, StoreError>

See LocalFsStore::rollback_traffic_split.

fn add_messaging_endpoint( &self, env_id: &EnvId, payload: AddMessagingEndpointPayload, idempotency_key: IdempotencyKey, ) -> Result<MessagingEndpoint, StoreError>

See LocalFsStore::add_messaging_endpoint.

fn link_messaging_bundle( &self, env_id: &EnvId, endpoint_id: MessagingEndpointId, bundle_id: BundleId, updated_by: String, idempotency_key: IdempotencyKey, ) -> Result<MessagingEndpoint, StoreError>

See LocalFsStore::link_messaging_bundle.

fn unlink_messaging_bundle( &self, env_id: &EnvId, endpoint_id: MessagingEndpointId, bundle_id: BundleId, updated_by: String, idempotency_key: IdempotencyKey, ) -> Result<MessagingEndpoint, StoreError>

See LocalFsStore::unlink_messaging_bundle.

fn set_messaging_welcome_flow( &self, env_id: &EnvId, payload: SetMessagingWelcomeFlowPayload, idempotency_key: IdempotencyKey, ) -> Result<MessagingEndpoint, StoreError>

See LocalFsStore::set_messaging_welcome_flow.

fn remove_messaging_endpoint( &self, env_id: &EnvId, endpoint_id: MessagingEndpointId, ) -> Result<MessagingEndpointId, StoreError>

See LocalFsStore::remove_messaging_endpoint.

fn rotate_messaging_webhook_secret( &self, env_id: &EnvId, endpoint_id: MessagingEndpointId, updated_by: String, idempotency_key: IdempotencyKey, ) -> Result<MessagingEndpoint, StoreError>

See LocalFsStore::rotate_messaging_webhook_secret.

fn bootstrap_trust_root( &self, env_id: &EnvId, ) -> Result<TrustRootSeed, StoreError>

See LocalFsStore::bootstrap_trust_root.

fn seed_trust_root_if_absent( &self, env_id: &EnvId, ) -> Result<Option<TrustRootSeed>, StoreError>

See LocalFsStore::seed_trust_root_if_absent.

fn add_trusted_key( &self, env_id: &EnvId, key_id: String, public_key_pem: String, idempotency_key: IdempotencyKey, ) -> Result<TrustRootAddOutcome, StoreError>

See LocalFsStore::add_trusted_key.

fn remove_trusted_key( &self, env_id: &EnvId, key_id: String, idempotency_key: IdempotencyKey, ) -> Result<TrustRootRemoveOutcome, StoreError>

See LocalFsStore::remove_trusted_key.

impl EnvironmentReads for LocalFsStore

fn list_env_ids(&self) -> Result<Vec<EnvId>, StoreError>

All environment ids known to the store, sorted.

fn env_exists(&self, env_id: &EnvId) -> Result<bool, StoreError>

Whether env_id exists.

fn load_env(&self, env_id: &EnvId) -> Result<Environment, StoreError>

Load the environment document.

fn read_runtime( &self, env_id: &EnvId, ) -> Result<Option<EnvironmentRuntime>, StoreError>

Load the runtime host-config sidecar, or None when none has been written. Both backends read it (the HTTP store via GET /environments/{env_id}/runtime), so None means genuinely absent.

impl EnvironmentStore for LocalFsStore

fn list(&self) -> Result<Vec<EnvId>, StoreError>

fn exists(&self, env_id: &EnvId) -> Result<bool, StoreError>

fn load(&self, env_id: &EnvId) -> Result<Environment, StoreError>

fn save(&self, env: &Environment) -> Result<(), StoreError>

fn load_runtime( &self, env_id: &EnvId, ) -> Result<Option<EnvironmentRuntime>, StoreError>

fn save_runtime(&self, runtime: &EnvironmentRuntime) -> Result<(), StoreError>

fn load_pack_answers( &self, env_id: &EnvId, slot: CapabilitySlot, ) -> Result<Option<Value>, StoreError>

fn save_pack_answers( &self, env_id: &EnvId, slot: CapabilitySlot, answers: &Value, ) -> Result<(), StoreError>

fn delete_pack_answers( &self, env_id: &EnvId, slot: CapabilitySlot, ) -> Result<(), StoreError>