statedb

package

Go to main page

Versions in this module

v0

v0.0.7

Oct 27, 2026

Changes in this version

+ const DenialTimeFormat

+ const DenialUnitemised

+ const HubCAActive

+ const HubCANext

+ const HubCAPrevious

+ const HubCARotationAbandoned

+ const HubCARotationActive

+ const HubCARotationRetired

+ const HubCARotationStaged

+ const MaxDenialRowsPerRun

+ const ProxySessionModel

+ var ErrHubCARotationConflict = errors.New("statedb: the hub CA rotation moved under this step")

+ func AuditFirewallDenied(d *DB, in FirewallDeniedInput)

+ func DenialDestination(dst string, port int, proto string) string

type CapResumeInput

+ ActedFor string

+ ActedForBasis string

type DB

+ func (d *DB) AbandonHubCANext(serial, rotationID string, at time.Time, by, detail string) error

+ func (d *DB) ActivateHubCA(fromSerial, toSerial, rotationID string, at time.Time, by string, ...) error

+ func (d *DB) CurrentHubCARotation() (HubCARotationRow, bool, error)

+ func (d *DB) DeleteHubCAMember(instanceID string) error

+ func (d *DB) DeleteHubTLS(id, serial string) (bool, error)

+ func (d *DB) EgressRefusals(runIDs []string, limit int) ([]EgressRefusal, error)

+ func (d *DB) ForgetIsolationEvidence(executorID string) error

+ func (d *DB) GetHubCARotation(id string) (HubCARotationRow, error)

+ func (d *DB) HubMetas(keys ...string) (map[string]string, error)

+ func (d *DB) IsolationEvidence(executorID, runtime string) (IsolationEvidenceRow, bool, error)

+ func (d *DB) ListEventsOfType(t EventType, limit int) ([]EventRow, error)

+ func (d *DB) ListHubCAMembers() ([]HubCAMemberRow, error)

+ func (d *DB) ListHubCARotations(limit int) ([]HubCARotationRow, error)

+ func (d *DB) ListIsolationEvidence() ([]IsolationEvidenceRow, error)

+ func (d *DB) PruneHubCAMembers(cutoff time.Time) (int64, error)

+ func (d *DB) PutHubCAMember(row HubCAMemberRow) error

+ func (d *DB) RecentDenials(since time.Time, limit int) ([]DenialSummary, error)

+ func (d *DB) RecordDenials(w DenialWrite) (DenialWriteResult, error)

+ func (d *DB) RecordIsolationProbe(row IsolationEvidenceRow) error

+ func (d *DB) RecordIsolationProbeFailure(row IsolationEvidenceRow) error

+ func (d *DB) RescopeProxySession(kind, id, holder, scope string) (bool, error)

+ func (d *DB) RetireHubCAPrevious(serial, rotationID string, at time.Time, by string, cutRuns []string) error

+ func (d *DB) RewrapKEK(id string, expect []byte, next KEKRow) (bool, error)

+ func (d *DB) RunDenialTotals(runID string) ([]DenialRuleTotal, error)

+ func (d *DB) RunDenials(runID string) ([]DenialRow, error)

+ func (d *DB) ScrubRetiredKEKs() (int, error)

+ func (d *DB) SetAgentCredentialLabels(agentID string, labels map[string]string) error

+ func (d *DB) SetHubCARotationEmergency(rotationID string) error

+ func (d *DB) SetHubMetas(values map[string]string) error

+ func (d *DB) StageHubCA(next HubTLSRow, rot HubCARotationRow) (bool, error)

+ func (d *DB) TaskDenials(taskID int, runIDs []string, from, to time.Time) ([]DenialRow, error)

+ type DenialRow struct

+ Count int64

+ Dst string

+ ExecutorID string

+ Fingerprint string

+ FirstSeen time.Time

+ LastSeen time.Time

+ Port int

+ Proto string

+ Rule string

+ RunID string

+ TaskID int

+ Why string

+ type DenialRuleTotal struct

+ Count int64

+ Destinations int

+ FirstSeen time.Time

+ LastSeen time.Time

+ Rule string

+ Top []string

+ Why string

+ type DenialSummary struct

+ Count int64

+ Dst string

+ ExecutorID string

+ FirstSeen time.Time

+ LastRunID string

+ LastSeen time.Time

+ Port int

+ Proto string

+ Rule string

+ Runs int

+ Why string

+ type DenialWrite struct

+ At time.Time

+ Entries []DenialRow

+ ExecutorID string

+ Fingerprint string

+ RunID string

+ TaskID int

+ Unitemised int64

+ type DenialWriteResult struct

+ FirstUnitemised bool

+ New []DenialRow

+ Unitemised int64

+ type EgressRefusal struct

+ Action string

+ At time.Time

+ Host string

+ Port int

+ Reason string

+ RunID string

type EventType

+ const EventGitPushRefused

+ const EventIsolationEvidence

+ const EventModelRelay

+ const EventNetworkBlocked

+ type FirewallDeniedInput struct

+ ExecutorID string

+ Fingerprint string

+ ProjectPath string

+ RunID string

+ Total DenialRuleTotal

+ type HubCALeafAck struct

+ Issuer string

+ NotAfter time.Time

+ Serial string

+ type HubCAMemberRow struct

+ Active string

+ AdoptedAt time.Time

+ InstanceID string

+ Leaves map[string]HubCALeafAck

+ SeenAt time.Time

+ Trusts []string

+ type HubCARotationRow struct

+ ActivatedAt time.Time

+ ActivatedBy string

+ CutRuns []string

+ Detail string

+ Emergency bool

+ EndedAt time.Time

+ EndedBy string

+ Forced []string

+ FromSerial string

+ ID string

+ Names []string

+ StagedAt time.Time

+ StagedBy string

+ State string

+ ToSerial string

+ func (r HubCARotationRow) Current() bool

+ type IsolationEvidenceRow struct

+ Engine string

+ Evidence string

+ Image string

+ ProbedBy string

+ Reference string

type KEKRow

+ KMSAnnotations string

+ KMSCiphertext []byte

+ KMSKeyID string

+ Wrap string

v0.0.6

Oct 16, 2026

Changes in this version

+ const AttachmentOutboxDir

+ const AttachmentSourceCLI

+ const AttachmentSourceRun

+ const ForwarderRequestApproved

+ const ForwarderRequestDenied

+ const ForwarderRequestExpired

+ const ForwarderRequestPending

+ const ForwarderRequestWithdrawn

+ const MaxAttachmentNameBytes

+ var ErrApprovalNotifyCursorMoved = errors.New("statedb: the approval notification cursor moved")

+ var ErrAttachmentNotFound = errors.New("statedb: attachment not found")

+ var ErrAuditForwardCursorMissing = errors.New("statedb: the audit forward cursor does not exist")

+ var ErrAuditForwardCursorMoved = errors.New("statedb: the audit forward cursor moved")

+ var ErrForwarderBindingNotFound = errors.New("statedb: forwarder binding not found")

+ var ErrForwarderBindingRequestNotFound = errors.New("statedb: forwarder binding request not found")

+ var ErrForwarderEnrollmentNotFound = errors.New("statedb: forwarder enrollment token not found")

+ var ErrForwarderEnrollmentSpent = errors.New("statedb: forwarder enrollment token already redeemed")

+ var ErrForwarderNotFound = errors.New("statedb: forwarder not found")

+ func AttachmentStoreDir(dbPath string) string

+ func AuditForwarderLifecycle(d *DB, in ForwarderAuditInput)

+ func AuditTaskAttachmentDelete(d *DB, row AttachmentRow, actor string)

+ func OpenAttachmentStore(dbPath string, create bool) (*os.Root, error)

+ func ValidAttachmentID(id string) bool

type APITokenRow

+ ApprovedAt time.Time

+ ApprovedBy string

+ MintedUnder string

+ type ApprovalNotice struct

+ CreatedAt time.Time

+ Event string

+ ID int64

+ Key string

+ Payload string

+ type ApprovalNotifyAdvance struct

+ At time.Time

+ Delivered bool

+ Dropped bool

+ Error string

+ From int64

+ To int64

+ type ApprovalNotifyCursor struct

+ AckedID int64

+ CreatedAt time.Time

+ Delivered int64

+ Dropped int64

+ Failures int64

+ LastDeliveredAt time.Time

+ LastError string

+ LastErrorAt time.Time

+ NextAttemptAt time.Time

+ Sink string

+ UpdatedAt time.Time

+ type AttachmentRow struct

+ AddedBy string

+ CreatedAt time.Time

+ ID string

+ MediaType string

+ Name string

+ Note string

+ RunID string

+ SHA256 string

+ Size int64

+ Source string

+ TaskID int

+ Unavailable string

+ type AttachmentUsage struct

+ ProjectBytes int64

+ ProjectFiles int

+ TaskBytes int64

+ TaskFiles int

type AuditEvent

+ func ReadAuditRowAfter(conn *sql.DB, afterID int64) (AuditEvent, bool, error)

+ type AuditForwardAdvance struct

+ At time.Time

+ Delivered int64

+ FromHash string

+ FromID int64

+ ToHash string

+ ToID int64

+ ToRowAt time.Time

+ type AuditForwardCursor struct

+ AckedAt time.Time

+ AckedHash string

+ AckedID int64

+ AckedRowAt time.Time

+ Chain string

+ CreatedAt time.Time

+ Delivered int64

+ Dir string

+ Failures int64

+ LastError string

+ LastErrorAt time.Time

+ Marks []AuditForwardMark

+ RetiredAt time.Time

+ Sink string

+ Source string

+ UpdatedAt time.Time

+ func ReadAuditForwardCursors(conn *sql.DB) ([]AuditForwardCursor, error)

+ func (c AuditForwardCursor) Retired() bool

+ type AuditForwardHold struct

+ Sink string

+ Sinks map[string]int64

+ ThroughID int64

+ type AuditForwardKey struct

+ Chain string

+ Sink string

+ type AuditForwardMark struct

+ Hash string

+ ID int64

+ func ThinAuditForwardMarks(marks []AuditForwardMark, head int64) []AuditForwardMark

type DB

+ func (d *DB) AddTaskAttachment(row AttachmentRow) error

+ func (d *DB) AdvanceApprovalNotifyCursor(sink string, adv ApprovalNotifyAdvance) error

+ func (d *DB) AdvanceAuditForwardCursor(sink, chain string, adv AuditForwardAdvance) error

+ func (d *DB) AllTaskAttachments() ([]AttachmentRow, error)

+ func (d *DB) ApprovalNoticeRecorded(key string) (bool, error)

+ func (d *DB) ApprovalNoticesAfter(after int64, limit int) ([]ApprovalNotice, error)

+ func (d *DB) ApprovalNotifyCursorFor(sink string) (ApprovalNotifyCursor, bool, error)

+ func (d *DB) ApprovalNotifyCursors() ([]ApprovalNotifyCursor, error)

+ func (d *DB) ApproveAPIToken(id, by string, at time.Time) (bool, error)

+ func (d *DB) AttachmentIDs() (map[string]bool, error)

+ func (d *DB) AuditForwardCursorFor(sink, chain string) (AuditForwardCursor, bool, error)

+ func (d *DB) AuditForwardCursors() ([]AuditForwardCursor, error)

+ func (d *DB) AuditForwardHoldFor(chain string) (AuditForwardHold, bool, error)

+ func (d *DB) DecideForwarderBindingRequest(id, state, by, note, bindingID string, at time.Time) (bool, error)

+ func (d *DB) DeleteApprovalNotifyCursor(sink string) error

+ func (d *DB) DeleteTaskAttachment(taskID int, id string) (AttachmentRow, error)

+ func (d *DB) ExpireForwarderBindingRequests(now time.Time) ([]ForwarderBindingRequestRow, error)

+ func (d *DB) GetForwarder(forwarderID string) (ForwarderRow, error)

+ func (d *DB) GetForwarderBinding(id string) (ForwarderBindingRow, error)

+ func (d *DB) GetForwarderBindingRequest(id string) (ForwarderBindingRequestRow, error)

+ func (d *DB) GetForwarderEnrollment(id string) (ForwarderEnrollmentRow, error)

+ func (d *DB) InitApprovalNotifyCursor(sink string, at int64, now time.Time) (ApprovalNotifyCursor, error)

+ func (d *DB) InitAuditForwardCursor(c AuditForwardCursor, now time.Time) (AuditForwardCursor, error)

+ func (d *DB) InsertApprovalNotice(key, event, payload string, at time.Time) (bool, error)

+ func (d *DB) ListForwarderBindingRequests(state string) ([]ForwarderBindingRequestRow, error)

+ func (d *DB) ListForwarderBindings(f ForwarderBindingFilter) ([]ForwarderBindingRow, error)

+ func (d *DB) ListForwarderEnrollments() ([]ForwarderEnrollmentRow, error)

+ func (d *DB) ListForwarders() ([]ForwarderRow, error)

+ func (d *DB) MaxApprovalNoticeID() (int64, error)

+ func (d *DB) NoteApprovalNotifyFailure(sink string, at int64, message string, next, now time.Time) error

+ func (d *DB) NoteAuditForwardFailure(sink, chain, message string, at time.Time) error

+ func (d *DB) PlanAuditPruneThrough(cutoff time.Time, maxID int64) (AuditPruneCandidate, error)

+ func (d *DB) PruneApprovalNotices(cutoff time.Time, floor int64, keep map[string]bool) (int64, error)

+ func (d *DB) PutForwarder(row ForwarderRow) error

+ func (d *DB) PutForwarderBinding(row ForwarderBindingRow) error

+ func (d *DB) PutForwarderBindingRequest(row ForwarderBindingRequestRow) error

+ func (d *DB) PutForwarderEnrollment(row ForwarderEnrollmentRow) error

+ func (d *DB) RedeemForwarderEnrollment(id, forwarderID string, at time.Time) error

+ func (d *DB) RenewProxySession(kind, id, holder string, expiresAt, renewedAt time.Time) (bool, error)

+ func (d *DB) RevokeForwarder(forwarderID string, at time.Time) error

+ func (d *DB) RevokeForwarderBinding(id, by, reason string, at time.Time) (bool, error)

+ func (d *DB) RevokeForwarderBindingsOf(forwarderID, by, reason string, at time.Time) ([]string, error)

+ func (d *DB) RevokeForwarderEnrollment(id string, at time.Time) error

+ func (d *DB) SetForwarderBindingRequestBinding(id, bindingID string) error

+ func (d *DB) SetForwarderStatus(forwarderID, status string, at time.Time) error

+ func (d *DB) SetKEKRoot(id, root string) (bool, error)

+ func (d *DB) SyncAuditForwardCursors(live []AuditForwardKey, at time.Time) (retired, restored int, err error)

+ func (d *DB) TaskAttachment(taskID int, id string) (AttachmentRow, error)

+ func (d *DB) TaskAttachmentUsage(taskID int) (AttachmentUsage, error)

+ func (d *DB) TaskAttachments(taskID int) ([]AttachmentRow, error)

+ func (d *DB) TouchApprovalNotifyCursor(sink string, now time.Time) error

+ func (d *DB) TouchForwarder(forwarderID string, at time.Time) error

type EventType

+ const EventTaskAttachments

+ type ForwarderAuditInput struct

+ Action auditaction.Action

+ Actor string

+ Detail map[string]any

+ ForwarderID string

+ type ForwarderBindingFilter struct

+ ActiveAt time.Time

+ ForwarderID string

+ Project string

+ type ForwarderBindingRequestRow struct

+ BindingID string

+ CreatedAt time.Time

+ DecidedAt time.Time

+ DecidedBy string

+ DecisionNote string

+ ExpiresAt time.Time

+ ForwarderID string

+ ID string

+ InterfaceJSON string

+ Justification string

+ Project string

+ RequestedBy string

+ State string

+ TTL time.Duration

+ VirtualExecutor string

+ func (r ForwarderBindingRequestRow) Lapsed(now time.Time) bool

+ type ForwarderBindingRow struct

+ CreatedAt time.Time

+ CreatedBy string

+ ExpiresAt time.Time

+ ForwarderID string

+ ID string

+ InterfaceJSON string

+ Note string

+ Project string

+ RequestID string

+ RevokeReason string

+ RevokedAt time.Time

+ RevokedBy string

+ VirtualExecutor string

+ func (r ForwarderBindingRow) Active(now time.Time) bool

+ func (r ForwarderBindingRow) Expired(now time.Time) bool

+ func (r ForwarderBindingRow) Revoked() bool

+ type ForwarderEnrollmentRow struct

+ CreatedAt time.Time

+ CreatedBy string

+ DeviceJSON string

+ ExpiresAt time.Time

+ ID string

+ Name string

+ Owner string

+ RedeemedAt time.Time

+ RedeemedForwarderID string

+ RevokedAt time.Time

+ SecretHash string

+ type ForwarderRow struct

+ CreatedAt time.Time

+ DeviceJSON string

+ EnrollmentID string

+ ForwarderID string

+ LastSeen time.Time

+ Name string

+ Owner string

+ RevokedAt time.Time

+ SecretHash string

+ Status string

+ StatusAt time.Time

type KEKRow

+ Root string

type ProxySessionRow

+ RenewedAt time.Time

type SessionRefreshUpdate

+ KeepSealed bool

v0.0.5

Oct 12, 2026

Changes in this version

+ const AuditChainBroken

+ const AuditChainGaps

+ const AuditChainIntact

+ const BusyTimeoutMillis

+ const DispatchIntentDispatching

+ const DispatchIntentStarted

+ const ExecutorSessionFailoverExhausted

+ const GapRecordedAtExit

+ const GapRecordedAtShutdown

+ const GapRecordedByFlush

+ const GapRecordedOnRecovery

+ const JournalSizeLimitBytes

+ const LegacyKeyID

+ const ProjectClaimCreated

+ const ProjectClaimCreating

+ const ProxySessionEgress

+ const ProxySessionGit

+ const ProxySessionKube

+ const SessionKindBrowser

+ const SessionKindCLI

+ const WALCheckpointBusyTimeout

+ var ErrCISessionNotFound = errors.New("statedb: CI session not found")

+ var ErrCorruptTaskColumn = errors.New("statedb: corrupt task column")

+ var ErrDeviceAuthorizationNotFound = errors.New("statedb: device authorization not found")

+ var ErrDispatchIntentNotFound = errors.New("statedb: dispatch intent not found")

+ var ErrHubOwnerNotFound = errors.New("statedb: hub owner not found")

+ var ErrHubTLSNotFound = errors.New("statedb: no hub certificate by that id")

+ var ErrProjectMemberNotFound = errors.New("statedb: project member not found")

+ var ErrProxySessionNotFound = errors.New("statedb: proxy session not found")

+ var ErrSCIMNotFound = errors.New("statedb: scim resource not found")

+ var ErrSCIMVersion = errors.New("statedb: scim resource was changed concurrently")

+ var ErrSecretLeaseNotFound = errors.New("statedb: secret lease not found")

+ var ErrStaticTokenFingerprint = errors.New("statedb: a static token fingerprint is 64 lowercase hex characters")

+ var ErrVirtualExecutorExists = errors.New("statedb: an executor with this id already exists")

+ var ErrVirtualExecutorNotFound = errors.New("statedb: virtual executor not found")

+ func AdoptAuditFailureStatus(dir string) (int64, error)

+ func AuditAdoptRequested(d *DB, in AdoptRequestInput)

+ func AuditAnchorLink(a AuditAnchor) (want string, ok bool)

+ func AuditFailureStatusDir(workDir string) string

+ func AuditGapLostEvents(payload string) int64

+ func AuditProjectFirewall(d *DB, in ProjectFirewallAuditInput)

+ func AuditProjectLifecycle(d *DB, in ProjectAuditInput)

+ func AuditRunReexecuted(d *DB, in RunReexecInput)

+ func AuditTaskQuarantine(d *DB, t *pm.Task, q pm.TaskQuarantine, actor string)

+ func AuditTaskQuarantineRelease(d *DB, taskID int, q pm.TaskQuarantine, actor, via string)

+ func CheckSchemaAhead(path string) error

+ func DSN(path string, access Access) string

+ func FlushAuditGaps(recorded string)

+ func OpenConn(path string, access Access) (*sql.DB, error)

+ func PeekHubCluster(dbPath, kind string) (members []HubMemberRow, owners []HubOwnerRow, err error)

+ func PeekRunOwner(dbPath string) (*runbuild.Owner, error)

+ func ProjectMemberID(projectPath, identityKey string) string

+ func ReadHubMeta(conn *sql.DB, key string) (string, bool, error)

+ func SetAuditFailureStatusDir(dir string)

+ func SettleAuditFailuresAtExit()

+ func WALPath(dbPath string) string

+ func WALSize(dbPath string) (int64, error)

+ type Access int

+ const ReadOnly

+ const ReadWrite

+ func (a Access) String() string

+ type AdoptRequestInput struct

+ Actor string

+ Behind int

+ HubBuild runbuild.Build

+ PID int

+ ProjectPath string

+ RequestID string

+ RunBuild runbuild.Build

+ type AppTokenSlotRow struct

+ EnvExported bool

+ FileName string

+ GrantID string

+ Guarded bool

+ Holder string

+ LeaseID string

+ Scope string

+ SecretID string

+ SecretName string

+ SessionID string

+ TokenExpiresAt time.Time

+ UpdatedAt time.Time

+ type AuditChainFailures struct

+ Chain string

+ GapRows int64

+ GapWriteFailures int64

+ LastGapAt time.Time

+ LastGapError string

+ LastGapID int64

+ Path string

+ RecordedEvents int64

+ TotalEvents int64

+ Unrecorded AuditLoss

+ func AuditFailures() []AuditChainFailures

+ type AuditCheckpointClaim struct

+ Claimed bool

+ FutureMarker bool

+ HeldBy string

+ Prior AuditCheckpointWindow

+ RetryAt time.Time

+ Window int64

+ type AuditCheckpointWindow struct

+ ClaimedAt time.Time

+ Done bool

+ IntervalS int64

+ Member string

+ Window int64

+ type AuditFailureStatus struct

+ Chains []AuditChainFailures

+ File string

+ Host string

+ Instance string

+ PID int

+ ProcStart string

+ UpdatedAt time.Time

+ func ReadAuditFailureStatus(dir string) ([]AuditFailureStatus, error)

+ func (s AuditFailureStatus) ProcessRunning() bool

+ type AuditGapCount struct

+ Events int64

+ Name string

+ type AuditGapPayload struct

+ Actions []AuditGapCount

+ AdoptedFrom []int

+ FailedAppends int64

+ FirstError string

+ FirstFailedAt string

+ Host string

+ LastError string

+ LastFailedAt string

+ LostEvents int64

+ PIDs []int

+ Reasons []AuditGapCount

+ Recorded string

+ type AuditGapSummary struct

+ Events int64

+ FirstAt time.Time

+ Gaps int

+ LastAt time.Time

+ LastID int64

+ Truncated bool

+ type AuditHead struct

+ Anchor *AuditAnchor

+ FirstID int64

+ LastID int64

+ LastRowHash string

+ LastTimestamp time.Time

+ Rows int64

+ func ReadAuditHead(conn *sql.DB) (AuditHead, error)

+ type AuditLoss struct

+ Actions map[string]int64

+ AdoptedFrom []int

+ Appends int64

+ Events int64

+ FirstAt time.Time

+ FirstError string

+ LastAt time.Time

+ LastError string

+ PIDs []int

+ Reasons map[string]int64

+ func (l AuditLoss) Empty() bool

type AuditVerifyReport

+ GapEvents int64

+ GapIDs []int64

+ Gaps int

+ LastGapAt time.Time

+ func (r AuditVerifyReport) Status() string

type BrokerGrantRow

+ RevokedCause string

+ SupersededBy string

+ SuspendedAt string

+ SuspendedBy string

+ UnguardedAckAt string

+ UnguardedAckBy string

+ UnguardedAckReason string

+ type BrokerSecretTombstoneRow struct

+ Cause string

+ DeletedAt string

+ DeletedBy string

+ Kind string

+ Name string

+ Owner string

+ Reason string

+ SecretID string

+ type CISessionFilter struct

+ Holder string

+ OpenOnly bool

+ RuleID string

+ type CISessionRow struct

+ CloseReason string

+ ClosedAt time.Time

+ Counters string

+ ExpiresAt time.Time

+ Holder string

+ Instance string

+ IssuedAt time.Time

+ LastUsedAt time.Time

+ Policy string

+ Provenance string

+ RuleID string

+ SessionID string

+ TokenSHA256 string

+ UpdatedAt time.Time

+ func (r CISessionRow) Open() bool

type DB

+ func (d *DB) AbandonKEKs(ids []string, at time.Time) ([]string, error)

+ func (d *DB) AdjustQuotaCounter(identity, resource, bucket string, delta, limit float64, enforce bool, ...) (value float64, admitted bool, err error)

+ func (d *DB) AppendHubEvents(events []HubEventRow) (int64, error)

+ func (d *DB) AuditCheckpointWindowMarker() (AuditCheckpointWindow, bool, error)

+ func (d *DB) AuditGapSummary() (AuditGapSummary, error)

+ func (d *DB) AuditHead() (AuditHead, error)

+ func (d *DB) AuditRowAt(id int64) (AuditEvent, bool, error)

+ func (d *DB) CheckpointCISession(id, holder, counters string, lastUsed time.Time) (bool, error)

+ func (d *DB) CheckpointProxySession(kind, id, holder, counters string) (bool, error)

+ func (d *DB) ClaimAuditCheckpointWindow(w int64, interval time.Duration, member string, now time.Time, ...) (AuditCheckpointClaim, error)

+ func (d *DB) ClaimExecutorHandleMeta(handleID, key, expect, value string) (bool, error)

+ func (d *DB) ClaimHubOwner(row, expect HubOwnerRow) (bool, error)

+ func (d *DB) ClaimProjectPath(claim ProjectClaim, stale func(ProjectClaim) bool) (held *ProjectClaim, err error)

+ func (d *DB) ClearAdoptRequest(id string) (bool, error)

+ func (d *DB) ClearExecutorFirewall(executorID string) error

+ func (d *DB) ClearProjectFirewall(projectPath string) error

+ func (d *DB) ClearTaskQuarantine(taskID int) (bool, error)

+ func (d *DB) CloseCISession(id, holder string, at time.Time, reason, counters string) (bool, error)

+ func (d *DB) CloseCISessionAny(id string, at time.Time, reason string) (bool, error)

+ func (d *DB) CloseCISessionsForRule(ruleID string, at time.Time, reason string) ([]CISessionRow, error)

+ func (d *DB) CloseProxySession(kind, id, holder string, at time.Time, reason, counters string) (bool, error)

+ func (d *DB) CompleteAuditCheckpointWindow(w int64, member string) (bool, error)

+ func (d *DB) CompleteProjectClaim(path string, hubMade bool, root string) error

+ func (d *DB) CountDeviceAuthorizations(since time.Time) (int, error)

+ func (d *DB) CountHubTLSByKey() (map[string]int, error)

+ func (d *DB) CountLiveSessions(c SessionCutoffs) (int, error)

+ func (d *DB) CreateVirtualExecutor(v VirtualExecutor) error

+ func (d *DB) DeleteAppTokenSlot(leaseID, grantID, holder string) (bool, error)

+ func (d *DB) DeleteAppTokenSlots(leaseID, holder string) (int, error)

+ func (d *DB) DeleteBrokerSecretTombstoned(id string, tomb BrokerSecretTombstoneRow) error

+ func (d *DB) DeleteCISession(id, holder string) (bool, error)

+ func (d *DB) DeleteDeviceAuthorizationsBefore(cutoff time.Time) ([]DeviceAuthorizationRow, error)

+ func (d *DB) DeleteDispatchIntent(runID string) error

+ func (d *DB) DeleteDispatchIntentForHandle(executorID, handleID string) (bool, error)

+ func (d *DB) DeleteLegalHold(identity string, audit *AuditEvent) (bool, error)

+ func (d *DB) DeleteOrphanedAppTokenSlots() (int, error)

+ func (d *DB) DeleteProjectMember(projectPath, identityKey string, audit MemberAudit) (*ProjectMemberRow, error)

+ func (d *DB) DeleteProjectMembersOf(projectPath string, audit MemberAudit) ([]ProjectMemberRow, error)

+ func (d *DB) DeleteProxySession(kind, id, holder string) (bool, error)

+ func (d *DB) DeleteSCIMGroup(id string, audit []*AuditEvent) (bool, error)

+ func (d *DB) DeleteSCIMUser(id string, audit []*AuditEvent) (bool, error)

+ func (d *DB) DeleteSecretLease(leaseID, holder string) (bool, error)

+ func (d *DB) DeleteVirtualExecutor(id string) error

+ func (d *DB) ExecutorFirewall(executorID string) (FirewallRecord, bool, error)

+ func (d *DB) ExecutorSessionChain(id string) ([]ExecutorSessionRow, error)

+ func (d *DB) ExecutorSessionForHandle(executorID, handleID string) (ExecutorSessionRow, bool, error)

+ func (d *DB) ExecutorSessionSuccessor(id string) (string, bool, error)

+ func (d *DB) ExtendProxySession(kind, id, holder string, expiresAt time.Time) (bool, error)

+ func (d *DB) ExtendSecretLease(leaseID, holder string, expiresAt time.Time) (bool, error)

+ func (d *DB) FindSCIMGroups(byDisplayName bool, value string) ([]SCIMGroupRow, error)

+ func (d *DB) FindSCIMUsers(column, value string) ([]SCIMUserRow, error)

+ func (d *DB) GetBrokerSecretTombstone(secretID string) (BrokerSecretTombstoneRow, error)

+ func (d *DB) GetCISession(id string) (CISessionRow, error)

+ func (d *DB) GetDeviceAuthorization(deviceHash string) (DeviceAuthorizationRow, error)

+ func (d *DB) GetDeviceAuthorizationByUserCode(userCodeHash string) (DeviceAuthorizationRow, error)

+ func (d *DB) GetDispatchIntent(runID string) (DispatchIntentRow, error)

+ func (d *DB) GetHubOwner(kind, key string) (HubOwnerRow, error)

+ func (d *DB) GetHubTLS(id string) (HubTLSRow, error)

+ func (d *DB) GetProjectMember(projectPath, identityKey string) (ProjectMemberRow, error)

+ func (d *DB) GetProxySession(kind, id string) (ProxySessionRow, error)

+ func (d *DB) GetSCIMCredential(id string) (SCIMCredentialRow, error)

+ func (d *DB) GetSCIMGroup(id string) (SCIMGroupRow, error)

+ func (d *DB) GetSCIMUser(id string) (SCIMUserRow, error)

+ func (d *DB) GetSecretLease(leaseID string) (SecretLeaseRow, error)

+ func (d *DB) HeartbeatHubMember(instanceID string, at time.Time) (bool, error)

+ func (d *DB) History(q HistoryQuery) (HistoryPage, error)

+ func (d *DB) HistoryEvent(id int64) (*EventRow, error)

+ func (d *DB) HistoryStep(n int64) (*StepRow, error)

+ func (d *DB) HistoryTop() (HistoryCursor, error)

+ func (d *DB) HubEventBounds() (lowest, highest, issued int64, err error)

+ func (d *DB) HubEventsAfter(after int64, limit int) ([]HubEventRow, error)

+ func (d *DB) InsertCISession(row CISessionRow) error

+ func (d *DB) InsertHubTLS(row HubTLSRow) (inserted bool, err error)

+ func (d *DB) InsertSCIMCredential(c SCIMCredentialRow, audit *AuditEvent) error

+ func (d *DB) JoinHubMember(row HubMemberRow) error

+ func (d *DB) LeaseRevocations(leaseID string) ([]LeaseRevocationRow, error)

+ func (d *DB) LeaveHubMember(instanceID string, at time.Time) error

+ func (d *DB) LegalHoldFor(identities []string) (LegalHoldRow, bool, error)

+ func (d *DB) ListAppTokenSlots(leaseID string) ([]AppTokenSlotRow, error)

+ func (d *DB) ListCISessions(f CISessionFilter) ([]CISessionRow, error)

+ func (d *DB) ListDispatchIntents() ([]DispatchIntentRow, error)

+ func (d *DB) ListExecutorFirewalls() ([]FirewallRecord, error)

+ func (d *DB) ListHubMembers() ([]HubMemberRow, error)

+ func (d *DB) ListHubOwners(kind string) ([]HubOwnerRow, error)

+ func (d *DB) ListHubTLS() ([]HubTLSRow, error)

+ func (d *DB) ListHubTLSNotUnderKey(keyID string, limit int) ([]HubTLSRow, error)

+ func (d *DB) ListLeaseRevocations(pendingOnly bool) ([]LeaseRevocationRow, error)

+ func (d *DB) ListLegalHolds() ([]LegalHoldRow, error)

+ func (d *DB) ListProjectClaims() ([]ProjectClaim, error)

+ func (d *DB) ListProjectFirewalls() ([]FirewallRecord, error)

+ func (d *DB) ListProjectMembers() ([]ProjectMemberRow, error)

+ func (d *DB) ListProxySessions(f ProxySessionFilter) ([]ProxySessionRow, error)

+ func (d *DB) ListRetiredStaticTokens() ([]RetiredStaticTokenRow, error)

+ func (d *DB) ListSCIMCredentials() ([]SCIMCredentialRow, error)

+ func (d *DB) ListSCIMGroups(withMembers bool) ([]SCIMGroupRow, error)

+ func (d *DB) ListSCIMUsers() ([]SCIMUserRow, error)

+ func (d *DB) ListSecretLeases() ([]SecretLeaseRow, error)

+ func (d *DB) ListStaticTokenUse() ([]StaticTokenUseRow, error)

+ func (d *DB) ListTaskQuarantines() (map[int]*pm.TaskQuarantine, error)

+ func (d *DB) ListVirtualExecutors() ([]VirtualExecutor, error)

+ func (d *DB) LoadSCIMDirectory() (SCIMDirectory, error)

+ func (d *DB) MarkDispatchStarted(runID, handleID string, egressIDs []string) (bool, error)

+ func (d *DB) MarkHubSeen(kind, key string, expires, now time.Time) (bool, error)

+ func (d *DB) MarkLeaseRevocationEnforced(leaseID, grantID, by, detail string, at time.Time) (bool, error)

+ func (d *DB) MarkSCIMUserOffboarded(id string, at time.Time, audit []*AuditEvent) (bool, error)

+ func (d *DB) NarrowCISession(id, holder, instance, policy string, expiresAt time.Time) (bool, error)

+ func (d *DB) NoteDispatchIntent(runID, detail string) error

+ func (d *DB) NoteLeaseRevocation(leaseID, grantID, detail string) error

+ func (d *DB) OpenCISessionIDsHeldBy(holder string) ([]string, error)

+ func (d *DB) Path() string

+ func (d *DB) PendingSCIMOffboards(cutoff time.Time) ([]SCIMUserRow, error)

+ func (d *DB) ProjectClaimAt(path string) (ProjectClaim, bool, error)

+ func (d *DB) ProjectFirewall(projectPath string) (FirewallRecord, bool, error)

+ func (d *DB) PruneHubEvents(cutoff time.Time) (int64, error)

+ func (d *DB) PruneHubMembers(cutoff time.Time) (int64, error)

+ func (d *DB) PruneHubSeen(now time.Time) (int64, error)

+ func (d *DB) PruneLeaseRevocations(cutoff time.Time) (int64, error)

+ func (d *DB) PutAppTokenSlot(row AppTokenSlotRow) error

+ func (d *DB) PutDeviceAuthorization(row DeviceAuthorizationRow) error

+ func (d *DB) PutDispatchIntent(row DispatchIntentRow) error

+ func (d *DB) PutHubOwner(row HubOwnerRow) error

+ func (d *DB) PutLeaseRevocation(row LeaseRevocationRow) error

+ func (d *DB) PutLegalHold(h LegalHoldRow, audit *AuditEvent) error

+ func (d *DB) PutProjectMember(row ProjectMemberRow, audit MemberAudit) (ProjectMemberRow, *ProjectMemberRow, error)

+ func (d *DB) PutProxySession(row ProxySessionRow) error

+ func (d *DB) PutSecretLease(row SecretLeaseRow) error

+ func (d *DB) PutTaskQuarantine(taskID int, q pm.TaskQuarantine) error

+ func (d *DB) RecordTaskNodeLoss(taskID int, loss pm.NodeLoss) (bool, error)

+ func (d *DB) ReleaseHubOwner(kind, key, instanceID string) (bool, error)

+ func (d *DB) ReleaseHubOwnerIfClaim(expect HubOwnerRow) (bool, error)

+ func (d *DB) ReleaseProjectClaim(path string) error

+ func (d *DB) ReplaceHubTLS(next HubTLSRow, expectSerial string) (bool, error)

+ func (d *DB) ReplaceHubTLSSealed(id string, expect, next SealedRow) (bool, error)

+ func (d *DB) ReportStaticTokenUse(reports []StaticTokenUseReport) error

+ func (d *DB) RetireStaticToken(row RetiredStaticTokenRow, ev *AuditEvent) (stored RetiredStaticTokenRow, written bool, err error)

+ func (d *DB) RevokeBrokerGrantWithCause(id string, at time.Time, cause string) error

+ func (d *DB) RevokeSCIMCredential(id string, at time.Time, by string, audit *AuditEvent) (bool, error)

+ func (d *DB) RewriteSecretLeaseRecord(leaseID, holder, record string) (bool, error)

+ func (d *DB) RotateSCIMCredential(id, secretHash, previousHash string, previousExpires, at time.Time, by string, ...) error

+ func (d *DB) SCIMDirectoryVersion() (int64, error)

+ func (d *DB) SCIMGroupsOf(userID string) ([]string, error)

+ func (d *DB) SaveAdoptRequest(r *runbuild.Request) error

+ func (d *DB) SaveCommitPolicy(p *pm.CommitPolicy) error

+ func (d *DB) SaveFollowBuilds(on bool) error

+ func (d *DB) SaveReviewGate(g *pm.ReviewGate) error

+ func (d *DB) SaveRunOwner(o *runbuild.Owner) error

+ func (d *DB) SaveRunStatus(status string, reason *pausereason.Reason, updatedAt time.Time) error

+ func (d *DB) SetBrokerGrantUnguardedAck(id, at, by, reason string) error

+ func (d *DB) SetExecutorFirewall(executorID string, r executor.FirewallRules, setBy string) error

+ func (d *DB) SetExecutorSessionRunningTasks(id string, tasks []int) (bool, error)

+ func (d *DB) SetHubMetaIfAbsent(key, value string) (string, error)

+ func (d *DB) SetProjectFirewall(projectPath string, r executor.FirewallRules, setBy string) error

+ func (d *DB) SetQueryOnly(on bool) error

+ func (d *DB) SupersedeBrokerGrant(id string, at time.Time, successor string) error

+ func (d *DB) TakeAppTokenSlots(leaseID, from, holder string) (int, error)

+ func (d *DB) TakeCISession(id, from, holder, instance string) (bool, error)

+ func (d *DB) TakeProxySession(kind, id, from, holder string) (bool, error)

+ func (d *DB) TakeSecretLease(leaseID, from, holder string) (bool, error)

+ func (d *DB) TaskNodeLosses(taskID int) ([]pm.NodeLoss, error)

+ func (d *DB) TaskQuarantine(taskID int) (*pm.TaskQuarantine, error)

+ func (d *DB) TaskStatuses() (map[int]pm.TaskStatus, error)

+ func (d *DB) TouchSCIMCredential(id string, at time.Time) error

+ func (d *DB) UpdateAppTokenSlot(row AppTokenSlotRow) (bool, error)

+ func (d *DB) UpdateDeviceAuthorization(deviceHash string, change func(*DeviceAuthorizationRow) (bool, error)) (DeviceAuthorizationRow, error)

+ func (d *DB) UpdateFirewalls(fn func(*FirewallTx) error) error

+ func (d *DB) UpdateHubOwnerMeta(kind, key, instanceID, meta string, at time.Time) (bool, error)

+ func (d *DB) UpdateVirtualExecutor(id, name string, spec executor.VirtualSpec, by string) error

+ func (d *DB) VirtualExecutor(id string) (VirtualExecutor, bool, error)

+ func (d *DB) WriteSCIMGroup(w SCIMGroupWrite) (SCIMGroupApplied, error)

+ func (d *DB) WriteSCIMUser(w SCIMUserWrite) (SCIMUserApplied, error)

+ type DeviceAuthorizationRow struct

+ Approver string

+ ApproverSession string

+ ClientHostname string

+ ClientIP string

+ ClientUserAgent string

+ CreatedAt time.Time

+ CredentialHash string

+ DecidedAt time.Time

+ DeviceHash string

+ ExpiresAt time.Time

+ IntervalSeconds int

+ LastPolledAt time.Time

+ Reason string

+ Status string

+ Subject string

+ UserCodeHash string

+ type DispatchIntentRow struct

+ CreatedAt time.Time

+ Detail string

+ Driver string

+ EgressIDs []string

+ ExecutorID string

+ HandleID string

+ InstanceID string

+ LeaseIDs []string

+ ProjectPath string

+ RunID string

+ State string

+ UpdatedAt time.Time

type EventType

+ const EventCredentialRefresh

+ const EventCredentialRefused

+ const EventDiskLimit

+ const EventEgress

+ const EventFailover

+ const EventFirewall

+ const EventRunAdoption

+ const EventRunReexecuted

+ const EventTaskInterrupted

+ const EventTaskReview

type ExecutorSessionRow

+ RunningTasks []int

+ type FirewallRecord struct

+ Fingerprint string

+ Rules executor.FirewallRules

+ SetAt time.Time

+ SetBy string

+ Subject string

+ type FirewallTx struct

+ func (t *FirewallTx) ClearExecutorFirewall(executorID string) error

+ func (t *FirewallTx) ClearProjectFirewall(projectPath string) error

+ func (t *FirewallTx) CreateVirtualExecutor(v VirtualExecutor) error

+ func (t *FirewallTx) ExecutorFirewall(executorID string) (FirewallRecord, bool, error)

+ func (t *FirewallTx) ListProjectFirewalls() ([]FirewallRecord, error)

+ func (t *FirewallTx) ProjectExecutor(projectPath string) (string, bool, error)

+ func (t *FirewallTx) ProjectFirewall(projectPath string) (FirewallRecord, bool, error)

+ func (t *FirewallTx) ProjectsBoundTo(ids ...string) ([]string, error)

+ func (t *FirewallTx) SetExecutorFirewall(executorID string, r executor.FirewallRules, setBy string) error

+ func (t *FirewallTx) SetProjectFirewall(projectPath string, r executor.FirewallRules, setBy string) error

+ func (t *FirewallTx) SetVirtualExecutorSpec(id string, spec executor.VirtualSpec, by string) error

+ func (t *FirewallTx) UpdateVirtualExecutor(id, name string, spec executor.VirtualSpec, by string) error

+ func (t *FirewallTx) VirtualExecutor(id string) (VirtualExecutor, bool, error)

+ func (t *FirewallTx) VirtualExecutorsOf(parentID string) ([]VirtualExecutor, error)

+ type HistoryCursor struct

+ Event int64

+ Step int64

+ type HistoryPage struct

+ Bottom *HistoryPlace

+ Gap bool

+ More bool

+ Rows []HistoryRow

+ Top HistoryCursor

+ type HistoryPlace struct

+ Day float64

+ Event bool

+ Key int64

+ type HistoryQuery struct

+ After *HistoryCursor

+ Before *HistoryPlace

+ Limit int

+ MaxValue int

+ Offset int

+ type HistoryRow struct

+ Cut int

+ Event *EventRow

+ Place HistoryPlace

+ Step *StepRow

+ type HubEventRow struct

+ CreatedAt time.Time

+ Key string

+ Origin string

+ Payload string

+ Seq int64

+ Target string

+ Topic string

+ type HubMemberRow struct

+ Address string

+ AdvertiseURL string

+ BootID string

+ HeartbeatAt time.Time

+ Hostname string

+ InstanceID string

+ LeftAt time.Time

+ Meta string

+ PID int

+ StartedAt time.Time

+ Version string

+ type HubOwnerRow struct

+ ClaimedAt time.Time

+ InstanceID string

+ Key string

+ Kind string

+ Meta string

+ UpdatedAt time.Time

+ type HubTLSRow struct

+ CertPEM string

+ ID string

+ IssuedAt time.Time

+ IssuedBy string

+ Issuer string

+ KeyID string

+ KeySealed []byte

+ Kind string

+ NotAfter time.Time

+ NotBefore time.Time

+ SANs []string

+ Serial string

+ WrappedDEK []byte

+ type LeaseRevocationRow struct

+ Action string

+ Actor string

+ Detail string

+ EnforcedAt time.Time

+ EnforcedBy string

+ ExecutorID string

+ GrantID string

+ Holder string

+ LeaseID string

+ ProjectID string

+ Reason string

+ RevokedAt time.Time

+ func (r LeaseRevocationRow) Pending() bool

+ type LegalHoldRow struct

+ Identity string

+ PlacedAt time.Time

+ PlacedBy string

+ Reason string

+ type MemberAudit func(prev, next *ProjectMemberRow) ([]*AuditEvent, error)

type MigrationCompat

+ const CompatAdditiveColumns

type OffboardApplied

+ Members []ProjectMemberRow

type OffboardWrite

+ MemberKeys []string

+ type ProjectAuditInput struct

+ Action auditaction.Action

+ Actor string

+ Detail map[string]any

+ Path string

+ type ProjectClaim struct

+ ClaimedAt time.Time

+ ClaimedBy string

+ HubMade bool

+ Owner string

+ Path string

+ Root string

+ State string

+ UpdatedAt time.Time

+ type ProjectFirewallAuditInput struct

+ Action string

+ Actor string

+ Detail map[string]any

+ ExecutorID string

+ ProjectPath string

+ type ProjectMemberRow struct

+ GrantedAt time.Time

+ GrantedBy string

+ ID string

+ IdentityKey string

+ ProjectPath string

+ Reason string

+ Role string

+ type ProxySessionFilter struct

+ Holder string

+ Kind string

+ LeaseIDs []string

+ OpenOnly bool

+ RunID string

+ SessionIDs []string

+ type ProxySessionRow struct

+ Actor string

+ CloseReason string

+ ClosedAt time.Time

+ Counters string

+ ExecutorID string

+ ExpiresAt time.Time

+ GrantID string

+ Holder string

+ IssuedAt time.Time

+ Kind string

+ LeaseID string

+ ProjectID string

+ RunID string

+ Scope string

+ SessionID string

+ TaskID string

+ TokenSHA256 string

+ UpdatedAt time.Time

+ func (r ProxySessionRow) Open() bool

+ type QuarantinedTask struct

+ Mark pm.TaskQuarantine

+ Status string

+ TaskID int

+ Title string

+ func PeekTaskQuarantines(dbPath string) ([]QuarantinedTask, error)

+ type RetiredStaticTokenRow struct

+ Fingerprint string

+ Reason string

+ RetiredAt time.Time

+ RetiredBy string

+ type RunReexecInput struct

+ From runbuild.Build

+ PID int

+ ProjectPath string

+ Reason string

+ Reexecs int

+ RunID string

+ To runbuild.Build

+ type SCIMConflict struct

+ Column string

+ Label string

+ OtherID string

+ Value string

+ func (c *SCIMConflict) Error() string

+ type SCIMCredentialRow struct

+ CreatedAt time.Time

+ CreatedBy string

+ ID string

+ LastUsedAt time.Time

+ Name string

+ PreviousExpiresAt time.Time

+ PreviousHash string

+ RevokedAt time.Time

+ RevokedBy string

+ RotatedAt time.Time

+ RotatedBy string

+ SecretHash string

+ func (c SCIMCredentialRow) Revoked() bool

+ type SCIMDirectory struct

+ Groups map[string]SCIMDirectoryGroup

+ Users []SCIMDirectoryUser

+ Version int64

+ type SCIMDirectoryGroup struct

+ DisplayName string

+ ExternalID string

+ type SCIMDirectoryUser struct

+ Active bool

+ Email string

+ ExternalID string

+ GroupIDs []string

+ ID string

+ UserName string

+ type SCIMGroupApplied struct

+ Added []string

+ At time.Time

+ Removed []string

+ Row SCIMGroupRow

+ Unknown []string

+ type SCIMGroupRow struct

+ CreatedAt time.Time

+ CreatedBy string

+ DisplayName string

+ ExternalID string

+ ID string

+ Members []string

+ ResourceJSON string

+ UpdatedAt time.Time

+ UpdatedBy string

+ Version int64

+ type SCIMGroupWrite struct

+ At time.Time

+ Audit func(SCIMGroupApplied) ([]*AuditEvent, error)

+ Create bool

+ ExpectVersion int64

+ Row SCIMGroupRow

+ SetMembers bool

+ type SCIMSuspendWrite struct

+ Denies []RoleBindingRow

+ GlassesIDs []string

+ GrantIDs []string

+ Record SCIMSuspensionRecord

+ SessionIDs []string

+ TokenIDs []string

+ type SCIMSuspensionRecord struct

+ At time.Time

+ By string

+ Denies []string

+ Emails []string

+ Grants []string

+ Identity string

+ Reason string

+ Subjects []string

+ type SCIMUnique struct

+ Column string

+ Label string

+ Value string

+ type SCIMUserApplied struct

+ At time.Time

+ DeniesInForce []string

+ DeniesKept []string

+ DeniesLifted []string

+ DeniesWritten []string

+ GlassesRevoked []string

+ GrantsResumed []string

+ GrantsSuspended []string

+ Row SCIMUserRow

+ SessionsDeleted []string

+ TokensRevoked []string

+ type SCIMUserRow struct

+ Active bool

+ CreatedAt time.Time

+ CreatedBy string

+ DeactivatedAt time.Time

+ DisplayName string

+ Email string

+ ExternalID string

+ ID string

+ OffboardedAt time.Time

+ ResourceJSON string

+ Suspension string

+ UpdatedAt time.Time

+ UpdatedBy string

+ UserName string

+ Version int64

+ func (r SCIMUserRow) SuspensionRecord() (SCIMSuspensionRecord, bool)

+ type SCIMUserWrite struct

+ At time.Time

+ Audit func(SCIMUserApplied) ([]*AuditEvent, error)

+ Create bool

+ ExpectVersion int64

+ Lift bool

+ Row SCIMUserRow

+ Suspend *SCIMSuspendWrite

+ Unique []SCIMUnique

+ type SchemaState struct

+ HoldsProject bool

+ PreFramework bool

+ Version int

+ func InspectSchema(path string) (SchemaState, error)

type SchemaTooNewError

+ func (e *SchemaTooNewError) Blockers() string

+ type SealedFacts struct

+ KEKs []KEKRow

+ LegacySalt string

+ LegacySample []byte

+ Rows map[string]map[string]int

+ func ReadSealedFacts(conn *sql.DB, legacySaltKey string) (SealedFacts, error)

+ func (f SealedFacts) ByKey() map[string]int

+ func (f SealedFacts) Sets() []string

type SecretLeaseDirRow

+ InstanceID string

+ type SecretLeaseRow struct

+ ExecutorID string

+ ExpiresAt time.Time

+ Holder string

+ IssuedAt time.Time

+ LeaseID string

+ ProjectID string

+ Record string

+ RunID string

+ UpdatedAt time.Time

+ type SessionCutoffs struct

+ Absolute time.Time

+ CLIIdle time.Time

+ Idle time.Time

type SessionRow

+ Client string

+ Kind string

+ OID string

+ Username string

type State

+ AdoptRequest *runbuild.Request

+ CommitPolicy *pm.CommitPolicy

+ FollowBuilds bool

+ ReviewGate *pm.ReviewGate

+ RunOwner *runbuild.Owner

+ type StaticTokenUseReport struct

+ At time.Time

+ Fingerprint string

+ Held bool

+ HeldBy string

+ Refused int64

+ RefusedAt time.Time

+ RefusedIP string

+ SSO bool

+ UsedAt time.Time

+ UsedIP string

+ type StaticTokenUseRow struct

+ Fingerprint string

+ FirstSeenAt time.Time

+ HeldAt time.Time

+ HeldBy string

+ LastRefusedAt time.Time

+ LastRefusedIP string

+ LastUsedAt time.Time

+ LastUsedIP string

+ RefusedCount int64

+ SSO bool

+ type VirtualExecutor struct

+ CreatedAt time.Time

+ CreatedBy string

+ ID string

+ Name string

+ ParentID string

+ Spec executor.VirtualSpec

+ UpdatedAt time.Time

+ UpdatedBy string

+ type WALCheckpoint struct

+ Busy bool

+ BytesAfter int64

+ BytesBefore int64

+ CheckpointedFrames int

+ Duration time.Duration

+ LogFrames int

+ func CheckpointWAL(dbPath string, busy time.Duration) (WALCheckpoint, error)

+ func (c WALCheckpoint) BytesFreed() int64

+ func (c WALCheckpoint) Truncated() bool

v0.0.4

Sep 27, 2026

v0.0.3

Sep 27, 2026

Changes in this version

+ func SandboxSettingsFor(d *DB, executorID string) (executor.SandboxSettings, error)

+ func SetAutoUpdatePolicy(d *DB, p autoupdate.Policy, setBy string) error

+ type AutoUpdatePolicy struct

+ Policy autoupdate.Policy

+ SetAt time.Time

+ SetBy string

+ func AutoUpdatePolicyFor(d *DB) (AutoUpdatePolicy, error)

type DB

+ func (d *DB) AddExecutorAudience(executorID, kind, value, addedBy string) error

+ func (d *DB) AllExecutorAudiences() (map[string][]ExecutorAudienceEntry, error)

+ func (d *DB) ClearExecutorAudience(executorID string) error

+ func (d *DB) ClearExecutorResourceLimit(executorID string) error

+ func (d *DB) ClearExecutorSandbox(executorID string) error

+ func (d *DB) ExecutorAudience(executorID string) ([]ExecutorAudienceEntry, error)

+ func (d *DB) ExecutorResourceCeiling(executorID string) (executor.ResourceCeiling, bool, error)

+ func (d *DB) ExecutorSandboxRecord(executorID string) (ExecutorSandbox, bool, error)

+ func (d *DB) ExecutorSandboxSettings(executorID string) (executor.SandboxSettings, bool, error)

+ func (d *DB) ListExecutorResourceLimits() ([]ExecutorResourceLimit, error)

+ func (d *DB) ListExecutorSandboxes() ([]ExecutorSandbox, error)

+ func (d *DB) RemoveExecutorAudience(executorID, kind, value string) error

+ func (d *DB) SetExecutorResourceLimit(executorID string, c executor.ResourceCeiling, setBy string) error

+ func (d *DB) SetExecutorSandbox(executorID string, s executor.SandboxSettings, setBy string) error

type EventType

+ const EventFeatureCreated

+ const EventFeaturePR

+ const EventFeatureRemoved

+ const EventProjectResult

+ const EventProjectSeed

+ type ExecutorAudienceEntry struct

+ AddedAt time.Time

+ AddedBy string

+ ExecutorID string

+ Kind string

+ Value string

+ func (e ExecutorAudienceEntry) Member() authz.AudienceMember

+ type ExecutorResourceLimit struct

+ Ceiling executor.ResourceCeiling

+ ExecutorID string

+ SetAt time.Time

+ SetBy string

+ type ExecutorSandbox struct

+ ExecutorID string

+ SetAt time.Time

+ SetBy string

+ Settings executor.SandboxSettings

type MigrationReport

+ Divergent []VersionDivergence

+ type VersionDivergence struct

+ Embedded string

+ Recorded string

+ Version int

v0.0.2

Sep 17, 2026

Changes in this version

+ const ProviderCallBodiesPrunedKey

+ const RoleEffectAllow

+ const RoleEffectDeny

+ const TelemetryMaxLimit

+ const TelemetryMaxRows

+ var ErrCIPipelineRuleNotFound = errors.New("statedb: ci pipeline rule not found")

+ var ErrGrantRequestNotFound = errors.New("statedb: grant request not found")

+ var ErrRoleBindingNotFound = errors.New("statedb: role binding not found")

+ func AuditAttachSession(d *DB, in AttachAuditInput)

+ func AuditCapPause(d *DB, in CapPauseInput)

+ func AuditCapResume(d *DB, in CapResumeInput)

+ func AuditTaskDispatch(d *DB, in TaskDispatchInput)

+ func GrowthTables() []string

+ func ProviderCallBodiesPruned(headersJSON string) (time.Time, bool)

+ func RoleBindingID(effect, claim, value, project, executor string) string

+ func UserErrorf(sentinel error, format string, args ...any) error

+ type AttachAuditInput struct

+ Actor string

+ Command string

+ Detail string

+ Event auditaction.Action

+ ExecutorID string

+ HandleID string

+ SessionID string

+ TaskID int

+ Writable bool

type BrokerGrantRow

+ Owner string

type BrokerSecretRow

+ Owner string

+ type CIExchangeRow struct

+ Accepted bool

+ Actor string

+ At time.Time

+ Claims map[string]any

+ Detail string

+ EventName string

+ ID string

+ Issuer string

+ Reason string

+ Ref string

+ RemoteAddr string

+ Repository string

+ RuleID string

+ RuleName string

+ RunID string

+ SessionID string

+ Subject string

+ Workflow string

+ type CIPipelineRuleRow struct

+ Actor string

+ Condition string

+ CreatedAt time.Time

+ CreatedBy string

+ Enabled bool

+ Environment string

+ EventName string

+ ID string

+ LastMatchedAt time.Time

+ MaxOutputTokens int

+ MaxRequests int

+ Models []string

+ Name string

+ Project string

+ Ref string

+ Repository string

+ TTLSeconds int

+ UpdatedAt time.Time

+ Workflow string

+ type CapPauseInput struct

+ Actor string

+ Cap float64

+ Detail string

+ ProjectPath string

+ ResumesAt time.Time

+ Utilization float64

+ Windows []string

+ type CapResumeInput struct

+ Actor string

+ PausedDetail string

+ ProjectPath string

+ ResumedAt time.Time

+ ResumesAt time.Time

type CostEntry

+ Identity string

+ RowID int64

type DB

+ func (d *DB) AdvanceSpendCursor(projectPath string, from, to int64) (won bool, err error)

+ func (d *DB) AppendTelemetry(events []telemetry.Event) error

+ func (d *DB) AsControlPlane() *DB

+ func (d *DB) AsProject() *DB

+ func (d *DB) AttributeRequestUseTasks() (int, error)

+ func (d *DB) ClearProjectResourceLimit(projectPath string) error

+ func (d *DB) DeleteCIPipelineRule(id string) (bool, error)

+ func (d *DB) DeleteHubMeta(key string) error

+ func (d *DB) DeleteRoleBinding(id string) (bool, error)

+ func (d *DB) ExpireGrantRequests(now time.Time) ([]GrantRequestRow, error)

+ func (d *DB) GetCIPipelineRule(id string) (CIPipelineRuleRow, error)

+ func (d *DB) GetGrantRequest(id string) (GrantRequestRow, error)

+ func (d *DB) GetRoleBinding(id string) (RoleBindingRow, error)

+ func (d *DB) GrowthTableStats() ([]TableStat, error)

+ func (d *DB) HubMeta(key string) (string, bool, error)

+ func (d *DB) ListCIExchanges(limit int) ([]CIExchangeRow, error)

+ func (d *DB) ListCIPipelineRules() ([]CIPipelineRuleRow, error)

+ func (d *DB) ListGrantRequestUses(requestID string) ([]GrantRequestUseRow, error)

+ func (d *DB) ListGrantRequests() ([]GrantRequestRow, error)

+ func (d *DB) ListProjectResourceLimits() ([]ProjectResourceLimit, error)

+ func (d *DB) ListRoleBindings() ([]RoleBindingRow, error)

+ func (d *DB) ListTelemetrySessions(source string, limit int) ([]TelemetrySession, error)

+ func (d *DB) LoadSpendCursor(projectPath string) (SpendCursor, bool, error)

+ func (d *DB) MaxCostRowID() (int64, error)

+ func (d *DB) OffboardIdentity(w OffboardWrite) (OffboardApplied, error)

+ func (d *DB) OpenSpendCursor(projectPath, identity string, startAt int64) error

+ func (d *DB) ProjectResourceCeiling(projectPath string) (executor.ResourceCeiling, bool, error)

+ func (d *DB) PruneCIExchanges(keep int) (int, error)

+ func (d *DB) PruneCosts(p RowRetention, now time.Time, dryRun bool) (RowPruneResult, error)

+ func (d *DB) PruneEvents(p RowRetention, now time.Time, dryRun bool) (RowPruneResult, error)

+ func (d *DB) PruneProviderCalls(p ProviderCallRetention, now time.Time, dryRun bool) (ProviderCallPruneResult, error)

+ func (d *DB) PruneSteps(p RowRetention, now time.Time, dryRun bool) (RowPruneResult, error)

+ func (d *DB) PruneTelemetry(cutoff time.Time) (int64, error)

+ func (d *DB) PruneTelemetryRows(p RowRetention, now time.Time, dryRun bool) (RowPruneResult, error)

+ func (d *DB) PutCIExchange(row CIExchangeRow) error

+ func (d *DB) PutCIPipelineRule(row CIPipelineRuleRow) error

+ func (d *DB) PutGrantRequest(row GrantRequestRow) error

+ func (d *DB) PutGrantRequestUse(row GrantRequestUseRow) error

+ func (d *DB) PutRoleBinding(row RoleBindingRow) (RoleBindingRow, error)

+ func (d *DB) QueryTelemetry(f TelemetryFilter) ([]telemetry.Event, int, error)

+ func (d *DB) ReadCostsAfterID(afterID int64, limit int) ([]CostEntry, error)

+ func (d *DB) ReconstructTask(taskID int) (TaskStory, error)

+ func (d *DB) Role() Role

+ func (d *DB) SetHubMeta(key, value string) error

+ func (d *DB) SetProjectResourceLimit(projectPath string, c executor.ResourceCeiling, setBy string) error

+ func (d *DB) SpendByIdentity(from, to time.Time) ([]IdentitySpend, error)

+ func (d *DB) TaskRunID(taskID int) (string, bool, error)

+ func (d *DB) TouchCIPipelineRule(id string, at time.Time) error

type EventType

+ const EventResourceCeiling

+ type GrantRequestRow struct

+ ConstraintsJSON string

+ CreatedAt string

+ DecidedAt string

+ DecidedBy string

+ DecisionNote string

+ ExpiresAt string

+ GrantExpiresAt string

+ GrantID string

+ ID string

+ Justification string

+ Kind string

+ RequestedBy string

+ Scope string

+ SecretID string

+ SecretName string

+ State string

+ SubjectType string

+ SubjectValue string

+ TTLSeconds int64

+ type GrantRequestUseRow struct

+ ExecutorID string

+ FirstSeen string

+ GrantID string

+ LastSeen string

+ LeaseID string

+ ProjectPath string

+ RequestID string

+ TaskID int

+ type IdentitySpend struct

+ Entries int

+ EstimatedUSD float64

+ Identity string

+ InputTokens int

+ OutputTokens int

+ ThinkingTokens int

+ type MigrationCompat string

+ const CompatAdditive

+ const CompatBreaking

+ const CompatUnknown

+ func (c MigrationCompat) Tolerable() bool

+ type OffboardApplied struct

+ At time.Time

+ DenyBindingIDs []string

+ Glasses []string

+ Sessions []string

+ Tokens []string

+ func (a OffboardApplied) Severed() bool

+ type OffboardWrite struct

+ At time.Time

+ Audit func(OffboardApplied) ([]*AuditEvent, error)

+ DenyBindings []RoleBindingRow

+ GlassesIDs []string

+ IdentityKey string

+ SessionIDs []string

+ TokenIDs []string

+ type ProjectResourceLimit struct

+ Ceiling executor.ResourceCeiling

+ ProjectPath string

+ SetAt time.Time

+ SetBy string

+ type ProviderCallPruneResult struct

+ Stripped int64

+ StrippedBytes int64

+ type ProviderCallRetention struct

+ BodyMaxAge time.Duration

+ Rows RowRetention

+ func (p ProviderCallRetention) Active() bool

+ type Role int32

+ const RoleControlPlane

+ const RoleProject

+ const RoleUnknown

+ func (r Role) String() string

+ type RoleBindingRow struct

+ Claim string

+ CreatedAt time.Time

+ CreatedBy string

+ Effect string

+ Executor string

+ ID string

+ Project string

+ Reason string

+ Role string

+ Value string

+ type RowPruneResult struct

+ BytesReleased int64

+ Deleted int64

+ Remaining int64

+ type RowRetention struct

+ MaxAge time.Duration

+ MaxRows int

+ func (r RowRetention) Active() bool

+ func (r RowRetention) Bounded() bool

type SchemaStamp

+ Compat MigrationCompat

type SchemaTooNewError

+ Blocking []SchemaStamp

+ type SessionClaims struct

+ Groups []string

+ Roles []string

+ type SessionRefreshUpdate struct

+ CheckedAt time.Time

+ Claims *SessionClaims

+ ClaimsAsOf time.Time

+ ClaimsExpireAt time.Time

+ KeyID string

+ Sealed []byte

+ WrappedDEK []byte

type SessionRow

+ ClaimsAsOf time.Time

+ ClaimsExpireAt time.Time

+ type SpendCursor struct

+ Identity string

+ LastCostRowID int64

+ ProjectPath string

+ UpdatedAt time.Time

type State

+ PauseReason *pausereason.Reason

+ type TableStat struct

+ Bytes int64

+ Name string

+ Oldest time.Time

+ Rows int64

+ type TaskDispatchInput struct

+ Actor string

+ ExecutorID string

+ ExecutorKind string

+ Isolation string

+ LeaseIDs []string

+ PinnedImage string

+ ProjectPath string

+ RequestedImage string

+ RunID string

+ SetupHash string

+ SpecHash string

+ TaskID int

+ TaskTitle string

+ type TaskRunStory struct

+ Actor string

+ Dispatched *AuditEvent

+ DurationMS int64

+ ExecutorID string

+ ExecutorKind string

+ Finished *AuditEvent

+ Isolation string

+ LeaseEvents []AuditEvent

+ LeaseIDs []string

+ Outcome string

+ PinnedImage string

+ Reason string

+ RunID string

+ SpecHash string

+ func (r TaskRunStory) Duration() string

+ func (r TaskRunStory) RanOnHost() bool

+ type TaskStory struct

+ Events []AuditEvent

+ Runs []TaskRunStory

+ TaskID int

+ Title string

+ Unattributed int

+ type TelemetryFilter struct

+ Kind string

+ Limit int

+ Offset int

+ Search string

+ Session string

+ Since time.Time

+ Source string

+ type TelemetrySession struct

+ Actor string

+ Errors int

+ Events int

+ FirstSeen time.Time

+ LastSeen time.Time

+ Release string

+ Session string

+ Source string

+ UserAgent string

v0.0.1

Sep 13, 2026

Changes in this version

+ const AuditGenesisHash

+ const EnvAllowSchemaDowngrade

+ const ExecutorSessionFailed

+ const ExecutorSessionFinished

+ const ExecutorSessionRequeued

+ const ExecutorSessionRunning

+ const ExecutorStatusDegraded

+ const ExecutorStatusOffline

+ const ExecutorStatusOnline

+ const ExecutorStatusUnknown

+ const HubScope

+ const LatestVersion

+ const NoStep

+ var ErrAPITokenNotFound = errors.New("statedb: api token not found")

+ var ErrAgentCredentialNotFound = errors.New("statedb: agent credential not found")

+ var ErrAuditAnchorNotFound = errors.New("statedb: no audit anchor")

+ var ErrBrokerGrantNotFound = errors.New("statedb: broker grant not found")

+ var ErrBrokerSecretNotFound = errors.New("statedb: broker secret not found")

+ var ErrDBLocked = errors.New("statedb: database busy")

+ var ErrEgressGrantNotFound = errors.New("statedb: egress grant not found")

+ var ErrEnrollmentNotFound = errors.New("statedb: enrollment token not found")

+ var ErrEnrollmentSpent = errors.New("statedb: enrollment token already redeemed or revoked")

+ var ErrExecutorHandleNotFound = errors.New("statedb: executor handle not found")

+ var ErrExecutorHealthNotFound = errors.New("statedb: executor health not found")

+ var ErrExecutorNotFound = errors.New("statedb: executor not found")

+ var ErrExecutorSessionClaimLost = errors.New("statedb: executor session claim lost")

+ var ErrExecutorSessionNotFound = errors.New("statedb: executor session not found")

+ var ErrHubLeaseNotFound = errors.New("statedb: hub lease not found")

+ var ErrKEKInUse = errors.New("statedb: sealing key still referenced by sealed rows")

+ var ErrKEKNotFound = errors.New("statedb: sealing key not found")

+ var ErrProjectNotFound = errors.New("statedb: project not found")

+ var ErrSchemaMismatch = errors.New("statedb: schema mismatch")

+ var ErrSchemaTooNew = errors.New("statedb: database schema is newer than this binary")

+ var ErrSessionNotFound = errors.New("statedb: session not found")

+ var ErrStaleVersion = errors.New("statedb: stale plan version")

+ var ErrTaskNotFound = errors.New("statedb: task not found")

+ func AllowSchemaDowngradeFromEnv() bool

+ func AuditChainLink(ev AuditEvent) (want string, ok bool)

+ func AuditExecutorLifecycle(d *DB, in ExecutorAuditInput)

+ func AuditImagePolicyDenial(d *DB, in ImagePolicyDenialInput)

+ func AuditSecretDecision(d *DB, in SecretAuditInput)

+ func AuditTaskDelete(d *DB, taskID int, actor string)

+ func AuditTaskStatus(d *DB, taskID int, oldStatus, newStatus, actor string)

+ func AuditTaskUpsert(d *DB, t *pm.Task, actor string)

+ func AuditWorkspaceProvision(d *DB, in WorkspaceAuditInput)

+ func HTTPStatus(err error) int

+ func LatestSchemaVersion() (int, error)

+ func MarshalAuditPayload(v any) string

+ func MarshalHandleMeta(meta map[string]string) string

+ func SealedSetNames() []string

+ func SetAuditEnabled(on bool)

+ func SetBinaryVersion(v string)

+ func UnmarshalHandleMeta(s string) map[string]string

+ type APITokenRow struct

+ CreatedAt time.Time

+ CreatedBy string

+ ExpiresAt time.Time

+ Hash string

+ ID string

+ Kind string

+ LastUsedAt time.Time

+ Name string

+ OwnerJSON string

+ Prefix string

+ ProjectScope []string

+ RevokedAt time.Time

+ Roles []string

+ type AgentCredentialRow struct

+ AgentID string

+ CreatedAt time.Time

+ EnrollmentID string

+ Labels map[string]string

+ LastSeen time.Time

+ Name string

+ RevokedAt time.Time

+ SecretHash string

+ WorkDirRoot string

+ type AuditAnchor struct

+ Actor string

+ AnchorHash string

+ BoundaryHash string

+ CreatedAt time.Time

+ Cutoff time.Time

+ ExportBytes int64

+ ExportFormat string

+ ExportPath string

+ ExportSHA256 string

+ ID int64

+ PrevAnchorHash string

+ PrunedCount int64

+ PrunedFirstID int64

+ PrunedThroughID int64

+ RetainedFromID int64

+ type AuditEvent struct

+ Actor string

+ EntityID string

+ EntityType string

+ EventType string

+ ID int64

+ Payload string

+ PrevHash string

+ RowHash string

+ Timestamp time.Time

+ type AuditFilter struct

+ Actor string

+ EntityID string

+ EntityType string

+ EventType string

+ FromID int64

+ Limit int

+ Offset int

+ Order string

+ Search string

+ Since time.Time

+ ToID int64

+ Until time.Time

+ type AuditPruneCandidate struct

+ BoundaryHash string

+ Count int64

+ FirstID int64

+ Remaining int64

+ ThroughID int64

+ type AuditVerifyReport struct

+ ActualHash string

+ AnchorID int64

+ Anchored bool

+ BreakAtID int64

+ ExpectedHash string

+ ExportPath string

+ ExportSHA256 string

+ OK bool

+ PrunedCount int64

+ Reason string

+ Total int

+ VerifiedFromID int64

+ type BrokerGrantRow struct

+ ConstraintsJSON string

+ CreatedAt string

+ CreatedBy string

+ ExpiresAt string

+ ID string

+ RevokedAt string

+ Scope string

+ SecretID string

+ SubjectType string

+ SubjectValue string

+ type BrokerSecretRow struct

+ CreatedAt string

+ CreatedBy string

+ ID string

+ KeyID string

+ Kind string

+ MetadataJSON string

+ Name string

+ Payload []byte

+ WrappedDEK []byte

+ type CostEntry struct

+ EstimatedUSD float64

+ InputTokens int

+ Model string

+ OutputTokens int

+ Provider string

+ TaskID int

+ TaskTitle string

+ ThinkingTokens int

+ Timestamp time.Time

+ type DB struct

+ func Open(dbPath string) (*DB, error)

+ func OpenWithOptions(dbPath string, opts OpenOptions) (*DB, error)

+ func (d *DB) AcquireHubLease(row HubLeaseRow, expect HubLeaseRow) (bool, error)

+ func (d *DB) Analyze() error

+ func (d *DB) AppendAuditEvent(ev *AuditEvent) error

+ func (d *DB) AppendAuditEvents(evs []*AuditEvent) error

+ func (d *DB) AppendCost(entry CostEntry) error

+ func (d *DB) AppendMaintenanceLog(e MaintenanceLogEntry) (int64, error)

+ func (d *DB) AppendProviderCall(row ProviderCallRow) (int64, error)

+ func (d *DB) AppendStep(row StepRow) error

+ func (d *DB) AuditDistinctActors() ([]string, error)

+ func (d *DB) AuditDistinctEntityTypes() ([]string, error)

+ func (d *DB) BindProjectExecutor(projectPath, executorID, boundBy string) error

+ func (d *DB) BrokerMeta(key string) (string, bool, error)

+ func (d *DB) ClaimExecutorSessionRequeue(id, claimToken, newClaimToken string, at time.Time) (ExecutorSessionRow, error)

+ func (d *DB) ClearHubLease(scope string, expect HubLeaseRow, at time.Time) (bool, error)

+ func (d *DB) ClearKill(taskID int) error

+ func (d *DB) Close() error

+ func (d *DB) CloseExecutorSession(id, state string, at time.Time) error

+ func (d *DB) CountBrokerSecretsByKey() (map[string]int, error)

+ func (d *DB) CountEvents() (int, error)

+ func (d *DB) CountRunningExecutorSessions(executorID string) (int, error)

+ func (d *DB) CountSessionsByKey() (map[string]int, error)

+ func (d *DB) CurrentSchemaVersion() (int, error)

+ func (d *DB) DeleteBrokerSecret(id string) error

+ func (d *DB) DeleteExecutor(id string) error

+ func (d *DB) DeleteExecutorHandle(handleID string) error

+ func (d *DB) DeleteExecutorHealth(executorID string) error

+ func (d *DB) DeleteExpiredSessions(absoluteCutoff, idleCutoff time.Time) ([]SessionRow, error)

+ func (d *DB) DeleteQuotaOverride(identity string) (bool, error)

+ func (d *DB) DeleteSecretLeaseDir(dir string) error

+ func (d *DB) DeleteSession(id string) (bool, error)

+ func (d *DB) DeleteSessionsBySubject(subject, keepID string) ([]SessionRow, error)

+ func (d *DB) DeleteTask(id int) error

+ func (d *DB) GetAPIToken(id string) (APITokenRow, error)

+ func (d *DB) GetAgentCredential(agentID string) (AgentCredentialRow, error)

+ func (d *DB) GetBrokerGrant(id string) (BrokerGrantRow, error)

+ func (d *DB) GetBrokerSecret(id string) (BrokerSecretRow, error)

+ func (d *DB) GetConfigBlob() (string, error)

+ func (d *DB) GetEgressGrant(id string) (EgressGrantRow, error)

+ func (d *DB) GetEnrollmentToken(id string) (EnrollmentTokenRow, error)

+ func (d *DB) GetExecutor(id string) (ExecutorRow, error)

+ func (d *DB) GetExecutorHandle(handleID string) (ExecutorHandleRow, error)

+ func (d *DB) GetExecutorHealth(executorID string) (ExecutorHealthRow, error)

+ func (d *DB) GetExecutorSession(id string) (ExecutorSessionRow, error)

+ func (d *DB) GetHubLease(scope string) (HubLeaseRow, error)

+ func (d *DB) GetSession(id string) (SessionRow, error)

+ func (d *DB) HasProjectState() (bool, error)

+ func (d *DB) LastMaintenanceLog() (*MaintenanceLogEntry, error)

+ func (d *DB) LatestAuditAnchor() (AuditAnchor, error)

+ func (d *DB) ListAPITokens() ([]APITokenRow, error)

+ func (d *DB) ListAgentCredentials() ([]AgentCredentialRow, error)

+ func (d *DB) ListAuditAnchors() ([]AuditAnchor, error)

+ func (d *DB) ListAuditEvents(f AuditFilter) (rows []AuditEvent, total int, err error)

+ func (d *DB) ListBrokerGrants() ([]BrokerGrantRow, error)

+ func (d *DB) ListBrokerSecrets() ([]BrokerSecretRow, error)

+ func (d *DB) ListBrokerSecretsNotUnderKey(keyID string, limit int) ([]SealedRow, error)

+ func (d *DB) ListEgressGrants() ([]EgressGrantRow, error)

+ func (d *DB) ListEnrollmentTokens() ([]EnrollmentTokenRow, error)

+ func (d *DB) ListEvents(offset, limit int) (rows []EventRow, total int, err error)

+ func (d *DB) ListExecutorHandles(executorID string) ([]ExecutorHandleRow, error)

+ func (d *DB) ListExecutorHealth() ([]ExecutorHealthRow, error)

+ func (d *DB) ListExecutorSessions(executorID string, onlyRunning bool) ([]ExecutorSessionRow, error)

+ func (d *DB) ListExecutors() ([]ExecutorRow, error)

+ func (d *DB) ListKEKs() ([]KEKRow, error)

+ func (d *DB) ListProjectExecutorBindings() ([]ProjectExecutorBinding, error)

+ func (d *DB) ListProviderCalls(offset, limit, taskID int, provider string) (rows []ProviderCallRow, total int, err error)

+ func (d *DB) ListQuotaCounters() ([]QuotaCounterRow, error)

+ func (d *DB) ListQuotaOverrides() ([]QuotaOverrideRow, error)

+ func (d *DB) ListRotations(limit int) ([]RotationRow, error)

+ func (d *DB) ListSecretLeaseDirs() ([]SecretLeaseDirRow, error)

+ func (d *DB) ListSessions() ([]SessionRow, error)

+ func (d *DB) ListSessionsNotUnderKey(keyID string, limit int) ([]SealedRow, error)

+ func (d *DB) LoadProviderCall(id int64) (*ProviderCallRow, error)

+ func (d *DB) LoadState() (*State, error)

+ func (d *DB) LoadStateLite() (*State, error)

+ func (d *DB) LoadTask(id int) (*pm.Task, error)

+ func (d *DB) LookupKill(taskID int) (KillRequest, bool, error)

+ func (d *DB) MaxAuditID() (int64, error)

+ func (d *DB) MonthlyCosts(year, month int) ([]CostEntry, error)

+ func (d *DB) OpenExecutorSession(row ExecutorSessionRow) error

+ func (d *DB) PendingKills() ([]KillRequest, error)

+ func (d *DB) PingContext(ctx context.Context) error

+ func (d *DB) PlanAuditPrune(cutoff time.Time) (AuditPruneCandidate, error)

+ func (d *DB) PrimaryKEK() (KEKRow, bool, error)

+ func (d *DB) ProjectExecutor(projectPath string) (string, bool, error)

+ func (d *DB) PromoteKEK(id string, at time.Time) error

+ func (d *DB) PruneAuditPrefix(a AuditAnchor) (AuditAnchor, error)

+ func (d *DB) PruneQuotaCounters(bucket string) error

+ func (d *DB) PutAPIToken(row APITokenRow) error

+ func (d *DB) PutAgentCredential(row AgentCredentialRow) error

+ func (d *DB) PutBrokerGrant(row BrokerGrantRow) error

+ func (d *DB) PutBrokerSecret(row BrokerSecretRow) error

+ func (d *DB) PutEgressGrant(row EgressGrantRow) error

+ func (d *DB) PutEnrollmentToken(row EnrollmentTokenRow) error

+ func (d *DB) PutExecutorHandle(row ExecutorHandleRow) error

+ func (d *DB) PutExecutorHealth(row ExecutorHealthRow) error

+ func (d *DB) PutKEK(row KEKRow) error

+ func (d *DB) PutQuotaCounter(row QuotaCounterRow) error

+ func (d *DB) PutQuotaOverride(row QuotaOverrideRow) error

+ func (d *DB) PutRotation(row RotationRow) error

+ func (d *DB) PutSecretLeaseDir(row SecretLeaseDirRow) error

+ func (d *DB) PutSession(row SessionRow) error

+ func (d *DB) ReadAuditRange(fromID, throughID int64, limit int) ([]AuditEvent, error)

+ func (d *DB) ReadCosts() ([]CostEntry, error)

+ func (d *DB) ReadCostsSince(since time.Time) ([]CostEntry, error)

+ func (d *DB) RecordEvent(row EventRow) error

+ func (d *DB) RedeemEnrollmentToken(id, agentID string, at time.Time) error

+ func (d *DB) ReleaseHubLease(scope, instanceID string, at time.Time) (bool, error)

+ func (d *DB) RenewHubLease(scope, instanceID string, at time.Time) (bool, error)

+ func (d *DB) ReplaceBrokerSecretSealed(id string, expect, next SealedRow) (bool, error)

+ func (d *DB) ReplaceQuotaGauges(rows []QuotaCounterRow) error

+ func (d *DB) ReplaceSessionSealed(id string, expect, next SealedRow) (bool, error)

+ func (d *DB) RequestKill(req KillRequest) error

+ func (d *DB) RetireKEK(id string, at time.Time) error

+ func (d *DB) RevokeAPIToken(id string, at time.Time) error

+ func (d *DB) RevokeAgentCredential(agentID string, at time.Time) error

+ func (d *DB) RevokeBrokerGrant(id string, at time.Time) error

+ func (d *DB) RevokeEgressGrant(id string, at time.Time) error

+ func (d *DB) RevokeEnrollmentToken(id string, at time.Time) error

+ func (d *DB) SaveState(s *State) error

+ func (d *DB) SchemaStamp() (SchemaStamp, error)

+ func (d *DB) SessionsDueForRefresh(cutoff time.Time, limit int) ([]SessionRow, error)

+ func (d *DB) SetBrokerMeta(key, value string) error

+ func (d *DB) SetConfigBlob(yamlBlob string) error

+ func (d *DB) SizeStats() (SizeStats, error)

+ func (d *DB) TouchAPIToken(id string, at time.Time) error

+ func (d *DB) TouchAgentCredential(agentID string, at time.Time) error

+ func (d *DB) TouchExecutorHeartbeat(id, status string, at time.Time) error

+ func (d *DB) TouchSession(id string, t time.Time) error

+ func (d *DB) UnbindProjectExecutor(projectPath string) error

+ func (d *DB) UpdateSessionRefresh(id, keyID string, wrappedDEK, sealed []byte, checkedAt time.Time) error

+ func (d *DB) UpsertExecutor(row ExecutorRow) error

+ func (d *DB) UpsertTask(t *pm.Task) error

+ func (d *DB) Vacuum() error

+ func (d *DB) VacuumInto(outPath string) error

+ func (d *DB) VerifyAuditChain() (AuditVerifyReport, error)

+ func (d *DB) WALCheckpointTruncate() (string, error)

+ type EgressGrantRow struct

+ CreatedAt string

+ CreatedBy string

+ ExpiresAt string

+ ID string

+ PolicyJSON string

+ RevokedAt string

+ Scope string

+ SubjectType string

+ SubjectValue string

+ type EnrollmentTokenRow struct

+ CreatedAt time.Time

+ CreatedBy string

+ ExpiresAt time.Time

+ ID string

+ Labels map[string]string

+ Name string

+ RedeemedAgentID string

+ RedeemedAt time.Time

+ RevokedAt time.Time

+ SecretHash string

+ WorkDirRoot string

+ type EventRow struct

+ Details string

+ ID int64

+ Message string

+ Step int

+ TaskID int

+ TaskTitle string

+ Timestamp time.Time

+ Type EventType

+ type EventType string

+ const EventEvolveDiscovered

+ const EventEvolveNoOp

+ const EventEvolveRoundStart

+ const EventPlanComplete

+ const EventSessionFailed

+ const EventSessionPaused

+ const EventSessionStarted

+ const EventTaskAborted

+ const EventTaskAdded

+ const EventTaskAddedExternal

+ const EventTaskBackground

+ const EventTaskDeleted

+ const EventTaskDone

+ const EventTaskFailed

+ const EventTaskHeal

+ const EventTaskKilled

+ const EventTaskSkipped

+ const EventTaskStarted

+ const EventTaskStatusChange

+ const EventWriteBack

+ type ExecutorAuditInput struct

+ Action string

+ Actor string

+ Detail map[string]any

+ ExecutorID string

+ type ExecutorHandleRow struct

+ Deadline time.Time

+ Driver string

+ ExecutorID string

+ ExternalID string

+ HandleID string

+ Image string

+ MetaJSON string

+ PID int

+ ProjectPath string

+ SecretsJSON string

+ StartedAt time.Time

+ TaskID int

+ UpdatedAt time.Time

+ type ExecutorHealthRow struct

+ ConsecutiveFailures int

+ ExecutorID string

+ LastProbe time.Time

+ LastSeen time.Time

+ Reason string

+ State string

+ StateChangedAt time.Time

+ type ExecutorInventory struct

+ AgentVersion string

+ Arch string

+ CPUs int

+ ContainerRuntimes []string

+ Harnesses []string

+ MemoryMB int

+ OS string

+ WorkDirRoot string

+ func (i ExecutorInventory) Known() bool

+ type ExecutorRow struct

+ Capabilities json.RawMessage

+ CreatedAt time.Time

+ Endpoint string

+ EnrolledBy string

+ ID string

+ Inventory ExecutorInventory

+ Kind string

+ Labels map[string]string

+ LastHeartbeat time.Time

+ Name string

+ Status string

+ type ExecutorSessionRow struct

+ Attempt int

+ ClaimToken string

+ EndedAt time.Time

+ ExecutorID string

+ HandleID string

+ ID string

+ ProjectPath string

+ RequeuedFrom string

+ SpecJSON string

+ StartedAt time.Time

+ State string

+ TaskID int

+ UpdatedAt time.Time

+ type HubLeaseRow struct

+ AcquiredAt time.Time

+ Address string

+ BootID string

+ HeartbeatAt time.Time

+ Hostname string

+ InstanceID string

+ PID int

+ ReleasedAt time.Time

+ Scope string

+ Version string

+ func (r HubLeaseRow) Held() bool

+ type ImagePolicyDenialInput struct

+ Actor string

+ Image string

+ ProjectPath string

+ Reason string

+ Registry string

+ Repository string

+ Rule string

+ type KEKRow struct

+ CheckValue []byte

+ CreatedAt string

+ CreatedBy string

+ ID string

+ RetiredAt string

+ Salt string

+ State string

+ type KillRequest struct

+ Attempt string

+ RequestedAt time.Time

+ RequestedBy string

+ TargetStatus string

+ TaskID int

+ type MaintenanceLogEntry struct

+ BytesAfter int64

+ BytesBefore int64

+ CompletedAt time.Time

+ ID int64

+ Note string

+ Operation string

+ PageCountAfter int64

+ PageCountBefore int64

+ PageSize int64

+ StartedAt time.Time

+ func (e MaintenanceLogEntry) BytesFreed() int64

+ type MigrateOptions struct

+ AllowSchemaDowngrade bool

+ Target int

+ type MigrationReport struct

+ Applied []int

+ BaselineApplied bool

+ EndVersion int

+ StartVersion int

+ func Migrate(db *sql.DB) (*MigrationReport, error)

+ func MigrateTo(db *sql.DB, target int) (*MigrationReport, error)

+ func MigrateWithOptions(db *sql.DB, opts MigrateOptions) (*MigrationReport, error)

+ type OpenOptions struct

+ AllowSchemaDowngrade bool

+ type ProjectExecutorBinding struct

+ BoundAt time.Time

+ BoundBy string

+ ExecutorID string

+ ProjectPath string

+ type ProviderCallRow struct

+ ErrorMessage string

+ Headers string

+ ID int64

+ InputTokens int

+ LatencyMs int

+ Model string

+ OutputTokens int

+ Prompt string

+ Provider string

+ RequestID string

+ Response string

+ Status string

+ SystemPrompt string

+ TaskID int

+ TaskTitle string

+ ThinkingTokens int

+ Timestamp time.Time

+ type QuotaCounterRow struct

+ Bucket string

+ Identity string

+ Resource string

+ UpdatedAt time.Time

+ Value float64

+ type QuotaOverrideRow struct

+ Identity string

+ LimitsJSON string

+ UpdatedAt time.Time

+ UpdatedBy string

+ type RotationRow struct

+ Failed int

+ FinishedAt string

+ ID string

+ LastError string

+ Rewrapped int

+ Skipped int

+ StartedAt string

+ StartedBy string

+ State string

+ ToKeyID string

+ Total int

+ UpdatedAt string

+ type SchemaStamp struct

+ AppliedAt time.Time

+ AppliedBy string

+ Name string

+ Version int

+ type SchemaTooNewError struct

+ BinaryVersion int

+ DBVersion int

+ Stamp SchemaStamp

+ func (e *SchemaTooNewError) Error() string

+ func (e *SchemaTooNewError) Is(target error) bool

+ type SealedRow struct

+ Ciphertext []byte

+ ID string

+ KeyID string

+ WrappedDEK []byte

+ type SecretAuditInput struct

+ Actor string

+ EntityID string

+ EventType string

+ Payload map[string]any

+ Timestamp time.Time

+ type SecretLeaseDirRow struct

+ CreatedAt time.Time

+ Dir string

+ ExecutorID string

+ ExpiresAt time.Time

+ LeaseID string

+ ProjectPath string

+ type SessionRow struct

+ DisplayName string

+ Email string

+ ExpiresAt time.Time

+ Groups []string

+ ID string

+ IP string

+ IssuedAt time.Time

+ Issuer string

+ LastSeen time.Time

+ OwnerKey string

+ RefreshCheckedAt time.Time

+ RefreshKeyID string

+ RefreshSealed []byte

+ RefreshWrappedDEK []byte

+ Roles []string

+ Subject string

+ UserAgent string

+ type SizeStats struct

+ Bytes int64

+ FreelistPages int64

+ PageCount int64

+ PageSize int64

+ func (s SizeStats) FreelistBytes() int64

+ type State struct

+ AutoEvolve bool

+ CreatedAt time.Time

+ CurrentStep int

+ DefaultMaxMinutes int

+ DryRun bool

+ Effort string

+ EvolveStep int

+ Goal string

+ InnovateMode bool

+ Instructions string

+ LastStepTime time.Time

+ MaxParallel int

+ MaxSteps int

+ Milestones []*milestone.Milestone

+ Model string

+ PMMode bool

+ Parallel bool

+ Plan *pm.Plan

+ PlanOnly bool

+ Provider string

+ RetryFailed bool

+ SkipClarify bool

+ Status string

+ StepCount int

+ Steps []StepRow

+ TotalInputTokens int

+ TotalOutputTokens int

+ UpdatedAt time.Time

+ WorkDir string

+ WorktreeParallel bool

+ type StepRow struct

+ Duration string

+ ExitCode int

+ InputTokens int

+ Output string

+ OutputTokens int

+ Step int

+ Task string

+ Time time.Time

+ type Store interface

+ AppendCost func(entry CostEntry) error

+ AppendStep func(row StepRow) error

+ Close func() error

+ LoadState func() (*State, error)

+ LoadTask func(id int) (*pm.Task, error)

+ MonthlyCosts func(year, month int) ([]CostEntry, error)

+ PingContext func(ctx context.Context) error

+ ReadCosts func() ([]CostEntry, error)

+ ReadCostsSince func(since time.Time) ([]CostEntry, error)

+ SaveState func(s *State) error

+ UpsertTask func(t *pm.Task) error

+ type WorkspaceAuditInput struct

+ Actor string

+ Depth int

+ DurationMS int64

+ Err string

+ ExecutorID string

+ ExecutorKind string

+ GrantID string

+ HandleID string

+ Kind string

+ LeaseID string

+ Phase string

+ ProjectPath string

+ Ref string

+ Repo string

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL