postgres

func (*Store) Addon ¶

func (s *Store) Addon(ctx context.Context, name string) (controlplane.AddonInfo, error)

Addon returns the add-on with the given name, or ErrNotFound. The returned info has Ready false — readiness is probed live, never read from the registry.

func (*Store) Addons ¶

func (s *Store) Addons(ctx context.Context) ([]controlplane.AddonInfo, error)

Addons returns all registered add-ons, name order. Each row has Ready false — readiness is a live property, probed by the caller, not stored.

func (*Store) AppEnv ¶

func (s *Store) AppEnv(ctx context.Context, app string) (map[string]string, error)

AppEnv returns the non-secret environment store for app (ADR-0028). An app with no env yields an empty map and no error.

func (*Store) AppendAudit ¶

func (s *Store) AppendAudit(ctx context.Context, e controlplane.AuditEntry) error

AppendAudit appends one audit row (ADR-0027). The log is append-only: there is only this INSERT and the Audit SELECT — no update or delete path. The store assigns id.

func (*Store) Audit ¶

func (s *Store) Audit(ctx context.Context, filter controlplane.AuditFilter) ([]controlplane.AuditEntry, error)

Audit returns audit rows matching filter, newest first, capped by filter.Limit (a default when unset). The filter clauses are optional and ANDed; an empty filter returns the latest rows up to the cap.

func (*Store) AutoDeployCandidates ¶ added in v0.13.0

func (s *Store) AutoDeployCandidates(ctx context.Context) ([]controlplane.AppEnvRef, error)

AutoDeployCandidates returns the distinct (app, environment) pairs that have at least one recorded release — the set the pull-based watcher may reconcile (ADR-0052 Phase 4b). Auto-deploy is on by default, so candidacy is "has a running release" (a version to compare a registry tag against), not "has an app_autodeploy row"; the poller reads each pair's level and skips those set to off. Rows are ordered by app then environment for a deterministic reconcile order.

func (*Store) AutoDeployLevel ¶ added in v0.13.0

func (s *Store) AutoDeployLevel(ctx context.Context, app, env string) (controlplane.AutoDeployLevel, error)

AutoDeployLevel returns app's auto-deploy level in env (ADR-0052 §2). A missing row resolves to DefaultAutoDeployLevel (off): the table holds only opt-ins, so an app runs at the default level with no row (auto-deploy is opt-in — ADR-0058).

func (*Store) AutoDeployReason ¶ added in v0.13.0

func (s *Store) AutoDeployReason(ctx context.Context, app, env string) (string, error)

AutoDeployReason returns the stored disable reason for app in env, or "" when the level was human-set or is the default (no row) — the reason surfaced next to an off level (ADR-0052 §5).

func (*Store) Close ¶

func (s *Store) Close() error

Close releases the database connections.

func (*Store) CreateEnvironment ¶ added in v0.7.0

func (s *Store) CreateEnvironment(ctx context.Context, name, namespace string) error

CreateEnvironment registers a named environment mapping name to namespace (ADR-0035 phase 2). The name is the primary key, so a duplicate is rejected: the INSERT ... ON CONFLICT DO NOTHING affects no rows, which is reported as an ErrInvalid-wrapped duplicate error.

func (*Store) DeleteAddon ¶

func (s *Store) DeleteAddon(ctx context.Context, name string) error

DeleteAddon removes the add-on row with the given name, or ErrNotFound if no such row exists.

func (*Store) DeleteReleases ¶

func (s *Store) DeleteReleases(ctx context.Context, app string) error

DeleteReleases removes every release record for app. Deleting the releases of an app that has none is a no-op (no RowsAffected check) — absence is fine.

func (*Store) DisableAutoDeploy ¶ added in v0.13.0

func (s *Store) DisableAutoDeploy(ctx context.Context, app, env, reason string) error

DisableAutoDeploy sets app's auto-deploy level in env to off and records why (e.g. "disabled by rollback") — the safety stop of ADR-0052 §5, so the watcher does not fight a deliberate downgrade. It is keyed by (app, environment) and upserts, overwriting any prior level and reason.

func (*Store) GetBackup ¶

func (s *Store) GetBackup(ctx context.Context, id string) (controlplane.Backup, error)

GetBackup returns the backup with the given id, or ErrNotFound.

func (*Store) GetEnvironment ¶ added in v0.7.0

func (s *Store) GetEnvironment(ctx context.Context, name string) (controlplane.Environment, error)

GetEnvironment returns the registered environment with the given name, or ErrNotFound.

func (*Store) LatestRelease ¶

func (s *Store) LatestRelease(ctx context.Context, app, env string) (controlplane.Release, error)

LatestRelease returns the most recently saved release for app in env, keyed per (app, environment) — env is the canonical environment name (ADR-0052 Phase 4a).

func (*Store) ListBackups ¶

func (s *Store) ListBackups(ctx context.Context, app string) ([]controlplane.Backup, error)

ListBackups returns recorded backups, newest first. An empty app lists every app's backups; a non-empty app restricts to that app. No matches yields an empty slice and no error.

func (*Store) ListEnvironments ¶ added in v0.7.0

func (s *Store) ListEnvironments(ctx context.Context) ([]controlplane.Environment, error)

ListEnvironments returns the registered environments ordered by name (ADR-0035 phase 2). The synthesized `default` environment is not stored here; the engine prepends it.

func (*Store) ListReleases ¶ added in v0.13.0

func (s *Store) ListReleases(ctx context.Context, app, env string) ([]controlplane.Release, error)

ListReleases returns every release for app in env, newest first (by insertion order) — the deploy timeline the history surface reads. It reads the same rows deploys write, ordered the opposite way from Releases. Releases are keyed per (app, environment) (ADR-0052 Phase 4a), so it selects by both.

func (*Store) Migrate ¶

func (s *Store) Migrate(ctx context.Context, appVersion string) error

Migrate brings the database schema up to date and records appVersion as the version that last migrated it. It first enforces the single-minor-step upgrade gate (ADR-0013): if the database was last migrated by a different version, the upgrade must be exactly one minor step forward within the same major, or Migrate refuses before changing anything. Migrations are applied under a Postgres advisory lock, so concurrent control-plane replicas do not race. Migrate is safe to call on every startup; with no pending migrations it only re-stamps the version.

func (*Store) Policy ¶

func (s *Store) Policy(ctx context.Context) (controlplane.Policy, error)

Policy returns the current guardrail policy: the built-in defaults with any stored guardrail dispositions overlaid (ADR-0020). An empty table yields DefaultPolicy.

func (*Store) Provider ¶

func (s *Store) Provider(ctx context.Context, name string) (controlplane.Provider, error)

Provider returns the provider with the given name, or ErrNotFound.

func (*Store) Providers ¶

func (s *Store) Providers(ctx context.Context) ([]controlplane.Provider, error)

Providers returns all configured providers, name order.

func (*Store) RecordBackup ¶

func (s *Store) RecordBackup(ctx context.Context, b controlplane.Backup) error

RecordBackup persists a new backup row (ADR-0032). burrowd records it pending before starting the backup Job, then SetBackupStatus moves it to completed/failed when the Job finishes. An existing row with the same id is overwritten. The row names the app, the on-PVC path, and the status — never a credential.

func (*Store) Release ¶

func (s *Store) Release(ctx context.Context, id string) (controlplane.Release, error)

func (*Store) Releases ¶

func (s *Store) Releases(ctx context.Context, app, env string) ([]controlplane.Release, error)

Releases returns every release for app in env, oldest first, keyed per (app, environment).

func (*Store) SaveAddon ¶

func (s *Store) SaveAddon(ctx context.Context, a controlplane.AddonInfo) error

SaveAddon upserts an add-on in the registry by name (ADR-0025). It records the non-secret registry entry — type, mode, backend, where it lives, and the capabilities it serves. Ready is a live property of the cluster and is never persisted; it is probed at list time.

func (*Store) SaveProvider ¶

func (s *Store) SaveProvider(ctx context.Context, p controlplane.Provider) error

SaveProvider upserts a provider in the registry by name (ADR-0023). It records only the non-secret registry entry; the token lives in the burrow-credentials Secret.

func (*Store) SaveRelease ¶

func (s *Store) SaveRelease(ctx context.Context, r controlplane.Release) error

func (*Store) SetAppEnv ¶

func (s *Store) SetAppEnv(ctx context.Context, app, key, value string) error

SetAppEnv upserts one env key for app.

func (*Store) SetAutoDeployLevel ¶ added in v0.13.0

func (s *Store) SetAutoDeployLevel(ctx context.Context, app, env string, level controlplane.AutoDeployLevel) error

SetAutoDeployLevel upserts app's auto-deploy level in env, keyed by (app, environment). It CLEARS any stored disable reason: a human setting the level (the re-enable path) removes the rollback or downgrade note, because re-enabling is a deliberate human action (ADR-0052 §5).

func (*Store) SetBackupStatus ¶

func (s *Store) SetBackupStatus(ctx context.Context, id string, status controlplane.BackupStatus, sizeBytes int64) error

SetBackupStatus updates a recorded backup's status and size (the Job-finished transition). Setting the status of an unknown backup id returns ErrNotFound.

func (*Store) SetGuardrail ¶

func (s *Store) SetGuardrail(ctx context.Context, code controlplane.GuardrailCode, disp controlplane.Disposition) error

SetGuardrail upserts one guardrail's disposition.

func (*Store) UnsetAppEnv ¶

func (s *Store) UnsetAppEnv(ctx context.Context, app, key string) error

UnsetAppEnv removes one env key for app. Removing a key that is not set is a no-op.