An app’s existing one-row-per-version table, read once to adopt its applied version (see
MigrateOptions::import_legacy_versions). Only the highest version_column value is used.
Options for a ReadPool. The default (ReadPoolOptions::new) matches
DbOptions::open_read_pool: read-write file handles, with query_only set and verified on
every reader. Build with the with_* methods; the fields are private.
The zeroizing wrapper that the SQLCipher key fields and key candidates use, re-exported so
callers build keys without declaring their own zeroize dependency.
Zeroizing is a wrapper for any Z: Zeroize type which implements a
Drop handler which zeroizes dropped values.
How the journal mode is chosen. WAL needs working shared-memory locking, which network
filesystems often lack and which SQLite will silently downgrade; the default therefore
verifies the mode that took effect and falls back to a rollback journal.
Where migration versions are stored. Table storage uses Blueprint-compatible
key TEXT PRIMARY KEY, value TEXT NOT NULL rows, leaving user_version untouched.
Environment kill-switch (wal | delete | truncate) for a misclassified mount in the
field. An app’s own variable (DbOptions::journal_env) is checked first.
Idempotent ALTER TABLE .. ADD COLUMN (SQLite has no IF NOT EXISTS for columns).
table, column and decl must be literals from the app, never user input.
PRAGMA wal_checkpoint(RESTART): copies the log into the main file like PASSIVE, waits (under
the busy timeout) for readers still using the log, then the next writer starts it again from
the beginning. The log file keeps its size. Use it when the database is quiet and the log is
large; WalCheckpointJob decides when.
Classify an open-time failure that is neither corruption nor an unrelated error. None means
“not in this family”: the caller returns the original error. path is the database file; it
is probed (opened for reading) only to tell a permission failure from other SQLITE_CANTOPEN
causes, because SQLite reports EACCES as SQLITE_CANTOPEN.
True if table has column, including STORED/VIRTUAL generated columns (table_xinfo;
table_info omits them, which made MailRight re-run an ALTER on every open).
Unix seconds when the pending <db>.migrating batch started, 0 for a marker written
before the start time was recorded, None without a readable marker. A separate reader keeps
PendingMarker constructible as before.
quarantine_database with an explicit suffix format and sidecar policy. Refuses to overwrite
an existing file at the destination. Sidecar failures are errors, not ignored: a -wal left
at the original path would be replayed into the replacement database.
recover_interrupted_restore_locked under the exclusive store lock. Call it before opening
the database at startup: a crash inside a restore can leave the live path empty with the
previous store sitting at its kept name.
Validate backup_path before copying it into an already-open destination.
Uses the SQLite backup API, including committed WAL contents. options supplies
the backup’s key and timeout; its path is ignored. Invalid backups never touch
destination. The destination must be writable and outside a transaction.
Revert to target by replaying each step’s down, highest first, one transaction per step.
Refuses before touching anything unless every step in the range has a down.
True when the version stored under storage is above the newest of migrations, which means
a newer build wrote this database. It only reads: nothing is migrated, created or written. It
does not consult MigrateOptions::import_legacy_versions.
Writes the <db>.migrating marker for a batch that moves the schema from version from to
to. The write is atomic and records the writing process id and the start time (unix
seconds). migrate writes this same marker; pending_marker reads it back. Use it to
simulate an interrupted migration in a crash test, instead of a private copy of the format.
write_txn for a caller that holds only &Connection, such as a closure-style helper.
It runs BEGIN IMMEDIATE through Transaction::new_unchecked, so the reserved writer slot is
the same. The borrow checker does not stop a nested transaction here: SQLite refuses the
BEGIN instead. The transaction rolls back when dropped unless it is committed.
A check run on the placed store; Err(reason) rolls the restore back. The DbOptions are the
ones given to the restore. Drop every connection the check opens before it returns.