Help us shape the future of Go! Take the 2026 Go Developer Survey

state

package
v0.1.0-rc.41 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 22, 2026 License: BSD-3-Clause Imports: 79 Imported by: 0

Documentation

Overview

Package controlstate stores persistent control state in PostgreSQL and changes that state in transactions. it also manages schema migrations.

Index

Constants

View Source 
const (
	MaxDatabaseDiagnosticSessions   = 64
	MaxDatabaseDiagnosticBlockers   = 8
	MaxDatabaseDiagnosticOperations = 64
	MaxDatabaseDiagnosticBytes      = 64 << 10
)

private diagnostic limits are shared with collectors. eight blocker PIDs per session keep a maximum-shaped snapshot within 64 KiB, leaving room for eight snapshots alongside the benchmark's periodic and failure metrics windows.

View Source 
const (
	GuestReadyAllowance = 15 * time.Minute
	GuestByteAllowance  = 5 << 20
	GuestLifetime       = 72 * time.Hour
)
View Source 
const CompanyAuthenticationLifetime = time.Hour
View Source 
const CompanyEligibilityLifetime = 24 * time.Hour
View Source 
const MaximumIngressRoutingTablePageSize = 1000
View Source 
const PrimaryIngressPoolID = string(ingresspool.PrimaryID)
View Source 
const PublisherAccessLifetime = 5 * time.Minute
View Source 
const PublisherEnrollmentLifetime = 10 * time.Minute
View Source 
const PublisherGroupLeaseLifetime = 2 * time.Minute
View Source 
const ReviewSchemaVersion = 1

ReviewSchemaVersion identifies the review records and JSON payloads written by this control build. record versions are independent of database migrations.

View Source 
const WorkloadHistoryRetention = serviceaudit.Retention

WorkloadHistoryRetention follows service audit's authored history policy. expiry, rather than lease loss or revocation, bounds credential/replay lifetime.

View Source 
const WorkloadLease = 90 * time.Second
View Source 
const WorkloadRenewAfter = 30 * time.Second

Variables

View Source 
var (
	ErrAdminInvalid               = errors.New("controlstate: invalid administration request")
	ErrMaintenanceControlNotFound = errors.New("controlstate: maintenance control not found")
)
View Source 
var (
	ErrProjectConfigurationInvalid = errors.New("project configuration is invalid")
	ErrProjectConfigurationStale   = errors.New("project configuration revision changed")
	ErrProjectSourceConflict       = errors.New("project label belongs to another source")
)
View Source 
var (
	ErrControlAuthentication = errors.New("controlstate: invalid control credential")
	ErrControlIdentity       = errors.New("controlstate: identity is unavailable")
	ErrManagedDomainMismatch = errors.New("controlstate: configured managed domain changed")
	ErrOIDCAssertionReplay   = errors.New("controlstate: OIDC assertion was already exchanged")
)
View Source 
var (
	ErrCertificateIssuanceGated       = errors.New("controlstate: certificate issuance is disabled")
	ErrCertificateIssuanceIdempotency = errors.New("controlstate: certificate issuance idempotency conflict")
	ErrCertificateIssuanceInvalid     = errors.New("controlstate: certificate issuance request is invalid")
	ErrCertificateIssuanceNotFound    = errors.New("controlstate: certificate issuance not found")
)
View Source 
var (
	ErrDNSAuthorityWorkStale   = errors.New("controlstate: DNS authority work lease is stale")
	ErrDNSAuthorityIdempotency = errors.New("controlstate: DNS authority idempotency conflict")
	ErrDNSAuthorityInvalid     = errors.New("controlstate: DNS authority request is invalid")
	ErrDNSAuthorityNotFound    = errors.New("controlstate: DNS authority not found")
)
View Source 
var (
	ErrDNSPublicURLWorkStale = errors.New("controlstate: DNS route work lease is stale")
	ErrDNSPublicURLInvalid   = errors.New("controlstate: DNS route work is invalid")
)
View Source 
var (
	ErrFeedbackNotFound    = errors.New("controlstate: feedback thread not found")
	ErrFeedbackInvalid     = errors.New("controlstate: feedback request is invalid")
	ErrFeedbackAccess      = errors.New("controlstate: feedback access denied")
	ErrFeedbackIdempotency = errors.New("controlstate: feedback idempotency conflict")
	ErrFeedbackState       = errors.New("controlstate: feedback state changed")
)
View Source 
var (
	ErrGuestUnknown    = errors.New("controlstate: guest credential is invalid")
	ErrGuestTrialSpent = errors.New("controlstate: guest demo trial is exhausted")
	ErrGuestIssuance   = errors.New("controlstate: guest demo creation is rate limited")
	ErrGuestNamespace  = errors.New("controlstate: guest namespace is reserved")
)
View Source 
var (
	ErrIngressAlreadyRunning = errors.New("controlstate: ingress identity already has a live process run")
	ErrIngressLeaseStale     = errors.New("controlstate: ingress lease identity or revision is stale")
)
View Source 
var (
	ErrPreviewNotFound = errors.New("controlstate: preview not found")
	ErrPreviewAccess   = errors.New("controlstate: preview access denied")
	ErrPreviewStale    = errors.New("controlstate: preview membership changed")
)
View Source 
var (
	ErrPublishRunCredential = errors.New("controlstate: publish-run credential is invalid")
	ErrPublishRunStale      = errors.New("controlstate: publish run identity or version is stale")
	ErrPublishRunNotReady   = errors.New("controlstate: publish run is not ready")
	ErrPublicURLCertificate = errors.New("controlstate: public URL certificate acknowledgement is invalid")
)
View Source 
var (
	ErrPublicURLAccess        = errors.New("controlstate: public URL access denied")
	ErrPublicURLConflict      = errors.New("controlstate: public URL hostname is already in use")
	ErrPublicURLCreationGated = errors.New("controlstate: public URL creation is disabled")
	ErrPublicURLIdempotency   = errors.New("controlstate: public URL idempotency conflict")
	ErrPublicURLInvalid       = errors.New("controlstate: public URL request is invalid")
	ErrPublishRunOpen         = errors.New("controlstate: public URL has an open publish run")
	ErrPublicURLMutationStale = errors.New("controlstate: authorized public URL state changed")
)
View Source 
var (
	ErrPublicURLNotFound         = errors.New("controlstate: public URL not found")
	ErrPublicURLNotEnabled       = errors.New("controlstate: public URL is not enabled")
	ErrPublicURLAuthority        = errors.New("controlstate: route authority is stale")
	ErrPublishRunConflict        = errors.New("controlstate: public URL already has a live session")
	ErrPublishRunIdempotency     = errors.New("controlstate: publish-run idempotency conflict")
	ErrPublishRunCreationGated   = errors.New("controlstate: publish-run creation is disabled")
	ErrInsufficientRelayServices = errors.New("controlstate: insufficient relay-service placement capacity")
)
View Source 
var (
	ErrRelayCertificateWorkStale   = errors.New("controlstate: relay certificate work lease is stale")
	ErrRelayCertificateWorkInvalid = errors.New("controlstate: relay certificate work is invalid")
)
View Source 
var (
	ErrRelayTransportCertificateInvalid    = errors.New("controlstate: relay transport certificate is invalid")
	ErrRelayTransportCertificateNotFound   = errors.New("controlstate: relay transport certificate is not available")
	ErrRelayTransportCertificateLeaseStale = errors.New("controlstate: relay transport certificate lease is stale")
)
View Source 
var (
	ErrRelayRegistrationConflict         = errors.New("controlstate: relay identity or service configuration conflicts with live state")
	ErrRelayLeaseStale                   = errors.New("controlstate: relay lease identity or revision is stale")
	ErrRelayDraining                     = errors.New("controlstate: relay is draining")
	ErrRelayConnectionCapacity           = errors.New("controlstate: relay connection capacity is exhausted")
	ErrPublisherConnectionUnavailable    = errors.New("controlstate: publisher connection is unavailable")
	ErrPublisherConnectionCredential     = errors.New("controlstate: publisher connection credential is invalid")
	ErrConnectionAssignmentStale         = errors.New("controlstate: connection assignment identity or revision is stale")
	ErrPublisherConnectionAlreadyClaimed = errors.New("controlstate: publisher connection is already claimed")
	ErrPublisherConnectionRelayService   = errors.New("controlstate: publisher connection is assigned to another relay service")
)
View Source 
var (
	ErrServiceManagerRequired       = errors.New("current service manager required")
	ErrServiceSourceSignInRequired  = errors.New("current company source sign-in required")
	ErrServiceVerifiedEmailRequired = errors.New("verified email required")
)
View Source 
var (
	ErrShareNotFound    = errors.New("controlstate: share not found")
	ErrShareInvalid     = errors.New("controlstate: share is invalid")
	ErrShareIdempotency = errors.New("controlstate: share idempotency conflict")
	ErrShareStale       = errors.New("controlstate: share public URL state changed")
	ErrShareLimit       = errors.New("controlstate: public URL has too many active shares or share cookies")
)
View Source 
var (
	ErrAuthorityAccess      = errors.New("controlstate: authority access denied")
	ErrAuthorityConflict    = errors.New("controlstate: authority state conflict")
	ErrAuthorityIdempotency = errors.New("controlstate: authority idempotency conflict")
	ErrAuthorityInvalid     = errors.New("controlstate: authority request is invalid")
	ErrMembershipNotFound   = errors.New("controlstate: membership not found")
	ErrTeamNotFound         = errors.New("controlstate: team not found")
	ErrTeamNameUnavailable  = errors.New("controlstate: team name unavailable")
	ErrMemberSlugRequired   = errors.New("controlstate: member slug required")
)
View Source 
var (
	ErrIngressUsageReportInvalid     = errors.New("controlstate: ingress usage report is invalid")
	ErrIngressUsageReportStale       = errors.New("controlstate: ingress usage report revision is stale")
	ErrIngressUsageReportConflict    = errors.New("controlstate: ingress usage report conflicts with stored state")
	ErrIngressUsagePublicURLNotFound = errors.New("controlstate: ingress usage publish run number was not found")
	ErrPublicURLUsageBucketFinalized = errors.New("controlstate: public URL usage bucket is finalized")
)
View Source 
var (
	ErrPublicURLUsageDeliveryWorkStale = errors.New("controlstate: public URL usage delivery work is stale")
	ErrPublicURLUsageDeliveryInvalid   = errors.New("controlstate: public URL usage delivery work is invalid")
)
View Source 
var (
	ErrWorkloadDenied   = errors.New("workload is not authorized by the saved workload policy")
	ErrWorkloadConflict = errors.New("workload execution is already bound to another key or scope")
	ErrWorkloadBinding  = errors.New("workload binding requires verified provider metadata")
	ErrWorkloadExpired  = fmt.Errorf("%w: workload session lease or fixed window has expired", ErrWorkloadDenied)
)
View Source 
var ErrACMEWorkStale = errors.New("controlstate: ACME work lease is stale")
View Source 
var ErrDNSChallengeNotFound = errors.New("controlstate: DNS challenge not found")
View Source 
var ErrDeviceLogin = errors.New("device login is invalid or expired")
View Source 
var ErrDomainNotFound = errors.New("controlstate: domain not found")
View Source 
var ErrEmailDeliveryLeaseStale = errors.New("email delivery lease is stale")
View Source 
var ErrIngressTransportCertificate = errors.New("controlstate: ingress transport certificate is unavailable")
View Source 
var ErrInsufficientPrivateIngresses = errors.New("controlstate: two live private connector ingress addresses are required")
View Source 
var ErrInvitationNotFound = errors.New("controlstate: invitation not found")
View Source 
var ErrPrivateIngressUnavailable = errors.New("private connector ingress assignment is unavailable")
View Source 
var ErrProjectManaged = errors.New("resource is managed by project configuration")

normal resource APIs cannot change definitions or grants owned by apply. extra visitor grants and operational publisher identity revocation are separate.

View Source 
var ErrPublicURLRecoveryEpisodeStale = errors.New("controlstate: route recovery episode is stale")
View Source 
var ErrPublisherDeploymentConflict = errors.New("publisher deployment binding conflicts with the recorded replica")
View Source 
var ErrPublisherEnrollment = errors.New("publisher enrollment is invalid, expired, or consumed")
View Source 
var ErrPublisherGroup = errors.New("publisher group lease or enrollment is unavailable")
View Source 
var ErrPublisherIdentity = errors.New("publisher identity or grant is unavailable")
View Source 
var ErrPublisherRuntimeStale = errors.New("publisher runtime has been replaced or stopped")
View Source 
var ErrServiceAccess = errors.New("service access denied or no current run")
View Source 
var ErrServiceAuditAccess = errors.New("service audit access denied")
View Source 
var ErrServiceConflict = errors.New("service name or idempotency key conflicts")
View Source 
var ErrServiceMetadata = errors.New("saved service trust is invalid")
View Source 
var ErrServicePortsExhausted = errors.New("ingress pool has no available service port")
View Source 
var ErrServicePortsInUse = errors.New("service port inventory excludes a held or quarantined port")
View Source 
var ErrTrafficSelection = errors.New("controlstate: invalid traffic selection")
View Source 
var ErrVisitorSignIn = errors.New("visitor sign-in required")

Functions

func AuthenticateVisitorSubjectKey 

func AuthenticateVisitorSubjectKey(ctx context.Context, tx pgx.Tx, subject VisitorSubject, service string, now time.Time) (ed25519.PublicKey, time.Time, error)

AuthenticateVisitorSubjectKey is the shared private credential seam for the transport adapter. workload sessions never borrow visitor_devices rows.

func CompanyActorNonce 

func CompanyActorNonce(method, path string, body []byte) string

CompanyActorNonce binds a verified standard OIDC nonce to one exact HTTP operation. the body digest is of the bytes sent, not reserialized JSON.

func Migrate 

func Migrate(ctx context.Context, directURL string) (retErr error)

Migrate applies every embedded control-state migration through a direct PostgreSQL URL. A persistent table lock allows only one migration at a time.

func RecordServiceAudit 

func RecordServiceAudit(ctx context.Context, tx pgx.Tx, event serviceaudit.Event, requestID string) error

RecordServiceAudit appends a safe management fact to the caller's transaction. requestID must identify the mutation, not contain configuration or credentials. callers authorize the operation before using this helper; service scope and actor syntax are independently checked here so a malformed scope rolls back.

func ServiceActorNonce 

func ServiceActorNonce(method, target string, body []byte) string

ServiceActorNonce binds only the service-access bridge, including the exact escaped request target (and raw query, if present) and the bytes sent.

func SetServiceAuditActor 

func SetServiceAuditActor(ctx context.Context, tx pgx.Tx, actor string) error

SetServiceAuditActor binds database-normalized events to an authenticated management actor for this transaction only. never call it with client claims.

func TeamUsageActorNonce 

func TeamUsageActorNonce(method, target string, body []byte) string

TeamUsageActorNonce separates usage reads from service management assertions. target includes the escaped path and exact raw query; body is the bytes sent.

func VisitorSubjectAccess 

func VisitorSubjectAccess(ctx context.Context, tx pgx.Tx, service string, subject VisitorSubject, now time.Time) (time.Time, int64, error)

VisitorSubjectAccess is shared by human and workload data-plane adapters. call while holding the service/team admission lock; it never grants access from human membership to a workload or expands the issued service snapshot.

func WithCompanyActorProof 

func WithCompanyActorProof(ctx context.Context, identity OIDCIdentity, expectedNonce string) context.Context

WithCompanyActorProof accepts only the result of the configured OIDC verifier. mutations consume the assertion and recheck current ownership in their own tx.

func WithControlPrincipal 

func WithControlPrincipal(ctx context.Context, principal ControlPrincipal) context.Context

WithControlPrincipal carries only a principal authenticated by control. callers must never build this value from HTTP fields or linked account metadata.

func WithServiceActorProof 

func WithServiceActorProof(ctx context.Context, identity OIDCIdentity, nonce string) context.Context

WithServiceActorProof accepts only configured-issuer verification at the authority bridge. it grants no control session or public URL authority.

Types

type ACMEAccount 

type ACMEAccount struct {
	ID            string
	DirectoryURL  string
	ContactEmail  string
	AccountKeyDER []byte
	AccountURL    string
	AcceptedTerms string
}

type ACMEAuthorizationState 

type ACMEAuthorizationState string

ACMEAuthorizationState is the persisted stage for one identifier in an order. cleaning records intent before a DNS provider call; complete records cleanup. 

const (
	ACMEAuthorizationPending    ACMEAuthorizationState = "pending"
	ACMEAuthorizationPresenting ACMEAuthorizationState = "presenting"
	ACMEAuthorizationPresented  ACMEAuthorizationState = "presented"
	ACMEAuthorizationValidating ACMEAuthorizationState = "validating"
	ACMEAuthorizationValid      ACMEAuthorizationState = "valid"
	ACMEAuthorizationCleaning   ACMEAuthorizationState = "cleaning"
	ACMEAuthorizationComplete   ACMEAuthorizationState = "complete"
	ACMEAuthorizationFailed     ACMEAuthorizationState = "failed"
	ACMEAuthorizationCanceled   ACMEAuthorizationState = "canceled"
)

type ACMEAuthorizationWork 

type ACMEAuthorizationWork struct {
	ID                    string
	Identifier            string
	AuthorizationURL      string
	ChallengeType         certificateidentity.ChallengeMethod
	ChallengeURL          string
	ChallengeToken        string
	ChallengeDigest       [32]byte
	PresentationReference string
	State                 ACMEAuthorizationState
	Revision              uint64
	Attempts              uint64
	AvailableAt           time.Time
	PresentedAt           *time.Time
	ValidatedAt           *time.Time
	CleanupCompletedAt    *time.Time
	ExpiresAt             *time.Time
	LastError             string
	CreatedAt             time.Time
	UpdatedAt             time.Time
}

type ACMEOrderState 

type ACMEOrderState string

ACMEOrderState is the persisted stage of one public URL certificate issuance. certificate availability and publisher installation are separate transitions. 

const (
	ACMEOrderPending           ACMEOrderState = "pending"
	ACMEOrderAuthorizing       ACMEOrderState = "authorizing"
	ACMEOrderReadyToFinalize   ACMEOrderState = "ready_to_finalize"
	ACMEOrderFinalizing        ACMEOrderState = "finalizing"
	ACMEOrderWaitingForInstall ACMEOrderState = "waiting_for_install"
	ACMEOrderInstalled         ACMEOrderState = "installed"
	ACMEOrderFailed            ACMEOrderState = "failed"
	ACMEOrderCanceled          ACMEOrderState = "canceled"
)

type ACMEOrderWork 

type ACMEOrderWork struct {
	Subject                CertificateSubject `json:"-"`
	ID                     string
	Account                ACMEAccount
	CertificateCacheKey    string
	CertificateScope       string
	CertificateIdentifiers []string
	ChallengeMethod        certificateidentity.ChallengeMethod
	CSRDER                 []byte
	CSRDigest              [32]byte
	State                  ACMEOrderState
	OrderRevision          uint64
	OrderURL               string
	FinalizeURL            string
	FinalizationPossible   bool
	CertificateURL         string
	CertificatePEM         []byte
	NotBefore              *time.Time
	NotAfter               *time.Time
	RenewAt                *time.Time
	Attempts               uint64
	AvailableAt            time.Time
	LastError              string
	CreatedAt              time.Time
	UpdatedAt              time.Time
	WorkerID               string
	WorkEpoch              uint64
	WorkExpiresAt          time.Time
	Authorizations         []ACMEAuthorizationWork
}

type AddPreviewPublicURLRequest 

type AddPreviewPublicURLRequest struct {
	PreviewID                string
	PublicURLID              string
	TeamID                   string
	IdentityID               string
	PolicyRevision           uint64
	ExpectedMutationRevision uint64
}

type AdminRelayPage 

type AdminRelayPage struct {
	Relays     []RelayLease
	NextCursor string
}

AdminRelayPage is one stable relay-ID-ordered page of unexpired leases.

type AdminRuntimeCounts 

type AdminRuntimeCounts struct {
	EnabledPublicURLs   int64
	SuspendedPublicURLs int64
	StartingPublishRuns int64
	ReadyPublishRuns    int64
	IngressLeases       int64
	RelayLeases         int64
}

AdminRuntimeCounts contains current stored state counts for server status.

type AppendFeedbackRequest 

type AppendFeedbackRequest struct {
	FeedbackID     string
	Type           FeedbackEventType
	Text           string
	Evidence       json.RawMessage
	SourceState    json.RawMessage
	IdempotencyKey string
	Actor          FeedbackActor
}

type AppliedProjectConfiguration 

type AppliedProjectConfiguration struct {
	TeamID            string                       `json:"team_id"`
	ProjectKey        string                       `json:"project_key"`
	SourceFingerprint string                       `json:"source_fingerprint"`
	Revision          int64                        `json:"revision"`
	ConfigurationHash string                       `json:"configuration_hash"`
	Configuration     ProjectConfiguration         `json:"configuration"`
	Services          []AppliedProjectService      `json:"services"`
	Members           []PublisherGroupMemberStatus `json:"members"`
	Groups            []AppliedPublisherGroup      `json:"groups"`
}

type AppliedProjectService 

type AppliedProjectService struct {
	Service         string `json:"service"`
	PublisherGroup  string `json:"publisher_group"`
	Kind            string `json:"service_kind"`
	ServiceID       string `json:"service_id,omitempty"`
	Hostname        string `json:"hostname,omitempty"`
	DesiredRevision int64  `json:"desired_revision"`
	TrustRevision   int64  `json:"trust_revision"`
	Port            int    `json:"port,omitempty"`
	Public          bool   `json:"public,omitempty"`
}

type AppliedPublisherGroup 

type AppliedPublisherGroup struct {
	GroupNames []string `json:"group_names"`
	ID         string   `json:"id"`
	Name       string   `json:"name"`
	Namespace  string   `json:"namespace"`
	DomainID   string   `json:"domain_id"`
	Public     bool     `json:"public"`
}

type ApplyProjectConfigurationRequest 

type ApplyProjectConfigurationRequest struct {
	TeamID, ProjectKey, SourceFingerprint, ActorID string
	ProjectLabel                                   string
	ExpectedRevision                               int64
	Configuration                                  ProjectConfiguration
	DNSAutomation                                  bool
	TrafficDefaults, TrafficCeiling                trafficlimits.Limits
	Now                                            time.Time
}

type AuthorizedPublicURLDeleteRequest 

type AuthorizedPublicURLDeleteRequest struct {
	PublicURLID              string
	TeamID                   string
	ActingIdentityID         string
	GuestID                  string
	PolicyRevision           uint64
	ExpectedMutationRevision uint64
	PublisherIdentityID      string
	PublisherGrantID         string
}

type AuthorizedPublicURLUpdateRequest 

type AuthorizedPublicURLUpdateRequest struct {
	PublicURLID              string
	TeamID                   string
	ActingIdentityID         string
	Target                   string
	AllowedIPPrefixes        []string
	PolicyRevision           uint64
	ExpectedMutationRevision uint64
}

type AuthorizedSharePublicURL 

type AuthorizedSharePublicURL struct {
	PublicURLID              string
	ExpectedMutationRevision uint64
}

type AvailablePublicURL 

type AvailablePublicURL struct {
	ID                string `json:"id"`
	TeamID            string `json:"team_id"`
	TeamName          string `json:"team_name"`
	CanonicalHostname string `json:"canonical_hostname"`
	ServiceProtocol   string `json:"service_protocol"`
	VisitorAccess     string `json:"visitor_access"`
}

type AvailablePublicURLPage 

type AvailablePublicURLPage struct {
	PublicURLs []AvailablePublicURL `json:"public_urls"`
	NextCursor string               `json:"next_cursor,omitempty"`
}

type BrowserAccessSession 

type BrowserAccessSession struct {
	TeamMember             bool
	ParentControlSessionID string
	PreviewID              string
	PublicURLID            string
	IdentityID             string
	DisplayName            string
	AccessToken            string
	RefreshToken           string
	AccessExpiresAt        time.Time
	ExpiresAt              time.Time
}

type BrowserHandoff 

type BrowserHandoff struct {
	Origin      string
	Token       string
	PublicURLID string
	ReturnPath  string
}

type BrowserLoginAttempt 

type BrowserLoginAttempt struct {
	Subject       httpsubject.Subject
	ServiceRunIDs []string
	CompanyIntent *CompanyIntentBinding
	PublishRunID  string
	PreviewID     string
	PublicURLID   string
	ReturnPath    string
	Nonce         string
	Verifier      string
}

type BrowserTokenRotation 

type BrowserTokenRotation struct {
	IdentityID      string
	AccessToken     string
	RefreshToken    string
	AccessExpiresAt time.Time
}

type CertificateIssuance 

type CertificateIssuance struct {
	// new order facts describe a committed insertion, not an idempotent retry.
	NewOrder            bool
	DomainKind          DomainKind
	ID                  string
	PublishRunID        string
	PublicURLID         string
	PublishRunNumber    uint64
	ServiceRunID        string
	ServiceID           string
	ServiceRunNumber    uint64
	PublisherIdentityID string
	CertificatePlan     CertificatePlan
	State               ACMEOrderState
	CertificatePEM      string
	RetryAt             *time.Time
	NotBefore           *time.Time
	NotAfter            *time.Time
	CreatedAt           time.Time
	UpdatedAt           time.Time
}

type CertificatePlan 

type CertificatePlan struct {
	CacheKey        string                              `json:"cache_key"`
	Scope           string                              `json:"scope"`
	Identifiers     []string                            `json:"identifiers"`
	ChallengeMethod certificateidentity.ChallengeMethod `json:"challenge_method"`
}

type CertificateSubject 

type CertificateSubject struct {
	Kind      CertificateSubjectKind
	ID        string
	RunID     string
	RunNumber uint64
}

CertificateSubject binds one certificate order to exactly one service and run. IDs remain opaque; the discriminator, rather than an ID prefix, selects SQL.

func (CertificateSubject) Valid 

func (s CertificateSubject) Valid() bool

type CertificateSubjectKind 

type CertificateSubjectKind string
const (
	CertificateSubjectPublicURL CertificateSubjectKind = "public_url"
	CertificateSubjectService   CertificateSubjectKind = "service"
)

type ClaimDomainRequest 

type ClaimDomainRequest struct {
	IdentityID     string
	TeamID         string
	IdempotencyKey string
	RequestDigest  [32]byte
	Domain         string
	MakeDefault    bool
}

type ClaimedPublisherConnection 

type ClaimedPublisherConnection struct {
	ConnectionAssignmentIdentity
	RelayLeaseIdentity
	ClaimID                                string
	RelayAddress                           string
	TLSServerName                          string
	State                                  PublisherConnectionState
	PublisherConnectionCredentialExpiresAt time.Time
	ConnectedAt                            time.Time
	ReadyAt                                *time.Time
}

ClaimedPublisherConnection is the stored state of one claimed assignment.

type CompanyAdmissionPage 

type CompanyAdmissionPage struct {
	Requests   []CompanyAdmissionRequest `json:"requests"`
	NextCursor string                    `json:"next_cursor,omitempty"`
}

type CompanyAdmissionRequest 

type CompanyAdmissionRequest struct {
	ID                   string    `json:"request_id"`
	TeamID               string    `json:"team_id"`
	IdentityConnectionID string    `json:"identity_connection_id"`
	ConnectionRevision   int64     `json:"connection_revision"`
	IdentityID           string    `json:"identity_id"`
	Subject              string    `json:"subject"`
	MemberSlug           string    `json:"member_slug"`
	State                string    `json:"state"`
	CreatedAt            time.Time `json:"created_at"`
}

type CompanyConnections 

type CompanyConnections struct {
	Active *IdentityConnection `json:"active,omitempty"`
	Setup  *IdentityConnection `json:"setup,omitempty"`
}

type CompanyIntentBinding 

type CompanyIntentBinding struct {
	ID           string
	BindingToken string
	RedirectURI  string
}

type CompanyLoginIntent 

type CompanyLoginIntent struct {
	ID                   string    `json:"intent_id"`
	TeamID               string    `json:"team_id"`
	IdentityConnectionID string    `json:"identity_connection_id"`
	ConnectionRevision   int64     `json:"connection_revision"`
	SourceID             string    `json:"source_id"`
	Issuer               string    `json:"issuer"`
	ClientID             string    `json:"client_id"`
	RedirectURI          string    `json:"redirect_uri"`
	Nonce                string    `json:"nonce"`
	BindingToken         string    `json:"binding_token,omitempty"`
	ExpiresAt            time.Time `json:"expires_at"`
}

type CompanyMembershipDecision 

type CompanyMembershipDecision struct {
	Suspended                bool
	PersonalAccountException bool
}

suspension and a personal-account exception remain independent: an exception never unsuspends a member, including when both are explicitly set together.

type ConnectionAssignment 

type ConnectionAssignment struct {
	ConnectionAssignmentIdentity
	RelayAddress                           string
	TLSServerName                          string
	PublisherConnectionCredential          credentials.PublisherConnectionCredential
	PublisherConnectionCredentialExpiresAt time.Time
	State                                  PublisherConnectionState
}

ConnectionAssignment is one of the two independently assigned publisher connections returned by publish-run setup and heartbeat replenishment.

type ConnectionAssignmentIdentity 

type ConnectionAssignmentIdentity struct {
	PublishRunID                 string
	PublicURLID                  string
	PublishRunNumber             uint64
	ConnectionSlot               int
	PublisherConnectionID        string
	ConnectionAssignmentRevision uint64
	RelayServiceID               string
}

ConnectionAssignmentIdentity identifies one exact publisher connection assignment.

type ConnectorSession 

type ConnectorSession struct {
	Subject                                  VisitorSubject
	ID, ServiceID, IdentityID, Credential    string
	DeviceID                                 string
	IngressID, IngressAddress, TLSServerName string
	SourceIP                                 netip.Addr
	ExpiresAt                                time.Time
}

type ConnectorVisitor 

type ConnectorVisitor struct {
	SessionID, IdentityID, DeviceID, ConnectionID string
	Source                                        netip.Addr
}

ConnectorVisitor binds the publisher's trusted forwarding header to control's admitted stream. the visitor does not need a second application credential.

type ControlPrincipal 

type ControlPrincipal struct {
	SessionID               string
	IdentityID              string
	Administrator           bool
	RetrySecret             [32]byte
	RefreshExpiresAt        time.Time
	OIDCIssuer, OIDCSubject string
}

type ControlSession 

type ControlSession struct {
	CompanyAuthenticationExpiresAt *time.Time
	SessionID                      string
	AccessToken                    credentials.AccessToken
	AccessExpiresAt                time.Time
	RefreshToken                   credentials.RefreshToken
	RefreshExpiresAt               time.Time
	Identity                       IdentityContext
}

type CreateCertificateIssuanceRequest 

type CreateCertificateIssuanceRequest struct {
	Authentication PublishRunAuthentication
	DirectoryURL   string
	IdempotencyKey string
	RequestDigest  [32]byte
	CSRDER         []byte
}

type CreateDNSAuthorityRequest 

type CreateDNSAuthorityRequest struct {
	TeamID          string
	DomainID        string
	CanonicalDomain string
	IdempotencyKey  string
	RequestDigest   [32]byte
}

type CreateFeedbackRequest 

type CreateFeedbackRequest struct {
	PreviewID         string
	Service           string
	PagePath          string
	PageTitle         string
	ReportText        string
	AuthorDisplayName string
	Anchor            json.RawMessage
	Evidence          json.RawMessage
	SourceAtReport    json.RawMessage
	IdempotencyKey    string
	Actor             FeedbackActor
}

type CreateIdentityConnectionRequest 

type CreateIdentityConnectionRequest struct {
	TeamID           string
	Issuer           string
	Admission        string
	ReplaceID        string
	ExpectedRevision int64
	SourceID         string
}

type CreateInvitationRequest 

type CreateInvitationRequest struct {
	PersonalAccountException bool
	IdentityID               string
	TeamID                   string
	IdempotencyKey           string
	RequestDigest            [32]byte
	MemberSlug               string
	InitialRole              TeamRole
	ExpiresAt                time.Time
	EmailRestriction         string
	RetrySecret              []byte
	SendEmail                bool
}

type CreatePublicURLRequest 

type CreatePublicURLRequest struct {
	GuestID               string
	TeamID                string
	DomainID              string
	MembershipID          string
	ActingIdentityID      string
	IdempotencyKey        string
	RequestDigest         [32]byte
	CanonicalHostname     string
	Target                string
	PublisherPool         bool
	ServiceProtocol       PublicURLServiceProtocol
	PublicURLScope        PublicURLScope
	Purpose               PublicURLPurpose
	AccessMode            VisitorAccessMode
	ManagedURLMode        naming.ManagedURLMode
	AllowedIPPrefixes     []string
	DNSState              PublicURLDNSState
	DNSAuthorityReference string
	PolicyRevision        uint64
	Ephemeral             bool
	PublisherIdentityID   string
	PublisherGrantID      string
	PublisherInvocationID string
	PublisherNamespace    string
}

type CreatePublisherEnrollmentRequest 

type CreatePublisherEnrollmentRequest struct {
	Ownership                                string
	Scope                                    PublisherScope
	Name, Kind, EditorID, EditorMembershipID string
	PolicyRevision                           uint64
	Now                                      time.Time
}

type CreatePublisherGrantRequest 

type CreatePublisherGrantRequest struct {
	PublisherIdentityID          string
	Scope                        PublisherScope
	EditorID, EditorMembershipID string
	PolicyRevision               uint64
	ExpiresAt                    *time.Time
	Now                          time.Time
}

type CreateShareRequest 

type CreateShareRequest struct {
	PreviewID         string
	TeamID            string
	Label             string
	ActingIdentityID  string
	IdempotencyKey    string
	SecretFingerprint [32]byte
	ExpiresAt         time.Time
	PolicyRevision    uint64
	PublicURLs        []AuthorizedSharePublicURL
}

type CreateTeamRequest 

type CreateTeamRequest struct {
	IdentityID     string
	IdempotencyKey string
	RequestDigest  [32]byte
	DisplayName    string
	MemberSlug     string
}

type DNSAuthority 

type DNSAuthority struct {
	Reference       string
	TeamID          string
	DomainID        string
	CanonicalDomain string
	State           DNSAuthorityState
	RequiredRecords []DNSRecord
	LastError       string
	ProviderZoneID  string
	Nameservers     []string
	CreatedAt       time.Time
	UpdatedAt       time.Time
}

type DNSAuthorityState 

type DNSAuthorityState string

DNSAuthorityState is the stored state of a custom-domain DNS authority. 

const (
	DNSAuthorityPending   DNSAuthorityState = "pending"
	DNSAuthorityReady     DNSAuthorityState = "ready"
	DNSAuthorityReleasing DNSAuthorityState = "releasing"
	DNSAuthorityReleased  DNSAuthorityState = "released"
	DNSAuthorityFailed    DNSAuthorityState = "failed"
)

type DNSAuthorityWork 

type DNSAuthorityWork struct {
	DNSAuthority
	Provider       string
	ProviderZoneID string
	Nameservers    []string
	WorkRevision   uint64
	Attempts       uint64
	AvailableAt    time.Time
	WorkerID       string
	WorkEpoch      uint64
	WorkExpiresAt  time.Time
}

type DNSChallengeChange 

type DNSChallengeChange struct {
	DesiredDigest [32]byte
	ChangeID      string
}

type DNSChallengeContext 

type DNSChallengeContext struct {
	Subject               CertificateSubject `json:"-"`
	PublicURLID           string
	ServiceID             string
	TeamID                string
	DomainID              string
	DNSAuthorityReference string
	CanonicalDomain       string
	AuthorizationID       string
	Identifier            string
	PresentationReference string
	State                 ACMEAuthorizationState
	ChallengeDigest       [32]byte
	Presentations         []DNSChallengePresentation
}

type DNSChallengePresentation 

type DNSChallengePresentation struct {
	ChallengeDigest [32]byte
	Active          bool
}

type DNSPublicURLWork 

type DNSPublicURLWork struct {
	PublicURLID           string
	IngressPoolID         string
	DomainID              string
	DNSAuthorityReference string
	CanonicalHostname     string
	Namespace             string
	PublicURLScope        PublicURLScope
	State                 PublicURLDNSState
	DNSRevision           uint64
	Attempts              uint64
	AvailableAt           time.Time
	LastError             string
	WorkerID              string
	WorkEpoch             uint64
	WorkExpiresAt         time.Time
}

type DNSRecord 

type DNSRecord struct {
	Name  string
	Type  string
	Value string
}

type Database 

type Database struct {
	// contains filtered or unexported fields
}

Database is the PostgreSQL connection pool for control state. its database details remain private to this package.

func Open 

func Open(ctx context.Context, pooledURL, currentStorageKey, previousStorageKey string, modes ...naming.ManagedURLMode) (*Database, error)

Open connects to already-migrated control state using a pooled PostgreSQL URL. Open never creates or migrates schema objects.

func (*Database) AcceptInvitation 

func (d *Database) AcceptInvitation(
	ctx context.Context,
	identityID string,
	token credentials.InvitationToken,
	now time.Time,
) (result Membership, retErr error)

func (*Database) AcceptServiceInvitation 

func (d *Database) AcceptServiceInvitation(ctx context.Context, identityID, secret string, now time.Time) (result ServiceGrant, retErr error)

func (*Database) AcceptVisitorInvitation 

func (d *Database) AcceptVisitorInvitation(ctx context.Context, identityID, secret string, now time.Time) (result VisitorGrant, retErr error)

func (*Database) AcknowledgePublisherGroupConfiguration 

func (d *Database) AcknowledgePublisherGroupConfiguration(ctx context.Context, token string, revision int64, hash string, healthy bool, now time.Time) (retErr error)

func (*Database) AcquirePublisherGroupLease 

func (d *Database) AcquirePublisherGroupLease(ctx context.Context, id, group, assertion, audience string, now time.Time) (result PublisherGroupLease, retErr error)

func (*Database) ActivateIdentityConnection 

func (d *Database) ActivateIdentityConnection(ctx context.Context, p ControlPrincipal, team, id, setupToken string, revision int64, source OIDCIdentity, now time.Time, provisioningToken string) (result IdentityConnectionSecret, retErr error)

func (*Database) AddPreviewPublicURL 

func (d *Database) AddPreviewPublicURL(ctx context.Context, request AddPreviewPublicURLRequest, now time.Time) (result Preview, retErr error)

func (*Database) AdminRuntimeCounts 

func (d *Database) AdminRuntimeCounts(ctx context.Context, now time.Time) (AdminRuntimeCounts, error)

AdminRuntimeCounts returns counts evaluated against one captured timestamp.

func (*Database) AdmitDirectServiceVisitor 

func (d *Database) AdmitDirectServiceVisitor(ctx context.Context, lease IngressLeaseIdentity, pool, visitor string, port int, source netip.Addr, now time.Time) (result DirectVisitorAdmission, retErr error)

AdmitDirectServiceVisitor reserves only bounded pre-authentication capacity. the destination comes from a trusted socket or outer PROXY header, never SNI.

func (*Database) AdvanceIngressRoutingRetention 

func (d *Database) AdvanceIngressRoutingRetention(ctx context.Context, cutoff time.Time) (revision uint64, retErr error)

AdvanceIngressRoutingRetention advertises the oldest supported incremental cursor. snapshot and entry-revision anchors survive subsequent pruning. the cutoff is chosen by control, never supplied by an ingress request.

func (*Database) AllocateGuestDemoNumber 

func (d *Database) AllocateGuestDemoNumber(ctx context.Context, guestID string, at time.Time) (number int64, retErr error)

func (*Database) AllocatePublisherPublicURL 

func (d *Database) AllocatePublisherPublicURL(ctx context.Context, p PublisherIdentity, invocation, target string, prefixes []string, binding []byte, now time.Time, requestedMode ...VisitorAccessMode) (PublicURL, error)

func (*Database) AppendFeedback 

func (d *Database) AppendFeedback(ctx context.Context, request AppendFeedbackRequest, now time.Time) (result FeedbackEvent, retErr error)

func (*Database) ApplyProjectConfiguration 

func (d *Database) ApplyProjectConfiguration(ctx context.Context, r ApplyProjectConfigurationRequest) (result AppliedProjectConfiguration, retErr error)

func (*Database) ApproveDeviceLogin 

func (d *Database) ApproveDeviceLogin(ctx context.Context, code string, binding []byte, managedDomain string, access, refresh time.Duration, now time.Time) error

func (*Database) AttachWorkloadAssertion 

func (d *Database) AttachWorkloadAssertion(ctx context.Context, id, credential string, c oidc.WorkloadExecution, signature []byte, now time.Time) (result WorkloadSession, retErr error)

func (*Database) AuthenticateAccessToken 

func (d *Database) AuthenticateAccessToken(
	ctx context.Context,
	token credentials.AccessToken,
	now time.Time,
) (ControlPrincipal, error)

func (*Database) AuthenticatePublisherAccess 

func (d *Database) AuthenticatePublisherAccess(ctx context.Context, token, sourceIP string, now time.Time) (result PublisherIdentity, retErr error)

func (*Database) AuthenticateVisitorConnector 

func (d *Database) AuthenticateVisitorConnector(ctx context.Context, lease IngressLeaseIdentity, claim tunnelv1.VisitorConnectorClaim, source netip.Addr, now time.Time) (result ConnectorSession, retErr error)

AuthenticateVisitorConnector binds one assigned session once, with the exact subject's key and ingress-observed source. both visitor variants use this seam.

func (*Database) AuthorizePublisherManagement 

func (d *Database) AuthorizePublisherManagement(ctx context.Context, team, publisher, editor string) error

management requires current team authority. a member can manage only the identity they enrolled; team admins can revoke a durable grant after its issuing member leaves. this check does not affect grant use.

func (*Database) AuthorizeServiceClientCertificate 

func (d *Database) AuthorizeServiceClientCertificate(ctx context.Context, service, runID, token, visitor string, number int64, source netip.Addr, der []byte, now time.Time) (result ServiceVisitorValidity, retErr error)

func (*Database) AuthorizeServiceConnector 

func (d *Database) AuthorizeServiceConnector(ctx context.Context, service, runID, token string, number int64, visitor ConnectorVisitor, now time.Time) (result ServiceVisitorValidity, retErr error)

func (*Database) AuthorizeServiceHTTPVisitor 

func (d *Database) AuthorizeServiceHTTPVisitor(ctx context.Context, auth ServiceHTTPRun, input controlv1.ServiceHTTPVisitorRequest, now time.Time) (result ServiceVisitorValidity, retErr error)

func (*Database) AuthorizeServiceStream 

func (d *Database) AuthorizeServiceStream(ctx context.Context, lease IngressLeaseIdentity, serviceID, runID, sessionID, visitorID string, number int64, source netip.Addr, now time.Time) (result ServiceStreamAuthorization, retErr error)

func (*Database) AuthorizeTeamSession 

func (d *Database) AuthorizeTeamSession(ctx context.Context, p ControlPrincipal, team string, now time.Time) error

func (*Database) AuthorizeVisitorServiceConnector 

func (d *Database) AuthorizeVisitorServiceConnector(ctx context.Context, service, run, token string, number int64, v SubjectConnectorVisitor, now time.Time) (result ServiceVisitorValidity, retErr error)

AuthorizeVisitorServiceConnector is the publisher-facing subject-aware authorization API. a current run token and the exact admitted stream are both required; a workload credential cannot impersonate a publisher.

func (*Database) AuthorizeWebsiteTeamUsage 

func (d *Database) AuthorizeWebsiteTeamUsage(ctx context.Context, team, actor string, now time.Time) (retErr error)

AuthorizeWebsiteTeamUsage consumes one verified website assertion and checks current membership/source permission. it grants no service manager authority.

func (*Database) BeginAdminRelayDrain 

func (d *Database) BeginAdminRelayDrain(
	ctx context.Context,
	identity RelayLeaseIdentity,
	actorIdentityID, requestID string,
	now, deadline time.Time,
) (result RelayLease, retErr error)

BeginAdminRelayDrain drains one matching lease and records the administrator action in the same transaction.

func (*Database) BeginBrowserLogin 

func (d *Database) BeginBrowserLogin(ctx context.Context, previewID, publicURLID, path, nonce, verifier string, browserBinding []byte, intent *CompanyLoginIntent, now time.Time) (string, error)

func (*Database) BeginDeviceBrowser 

func (d *Database) BeginDeviceBrowser(ctx context.Context, code, state, nonce, verifier string, binding []byte, team string, intent *CompanyLoginIntent, now time.Time) error

func (*Database) BeginIdentityConnectionSetup 

func (d *Database) BeginIdentityConnectionSetup(ctx context.Context, p ControlPrincipal, r CreateIdentityConnectionRequest, now time.Time) (result IdentityConnectionSetup, retErr error)

BeginIdentityConnectionSetup leaves current access untouched until verified tenant consent activates this exact pending connection.

func (*Database) BeginIngressDrain 

func (d *Database) BeginIngressDrain(
	ctx context.Context,
	identity IngressLeaseIdentity,
	now time.Time,
	deadline time.Time,
) (result IngressLease, retErr error)

BeginIngressDrain removes one exact ingress process from readiness and keeps its lease current through the drain deadline.

func (*Database) BeginRelayDrain 

func (d *Database) BeginRelayDrain(
	ctx context.Context,
	identity RelayLeaseIdentity,
	now time.Time,
	deadline time.Time,
) (RelayLease, error)

BeginRelayDrain removes one exact relay process from placement and keeps its lease current through the deadline while established streams drain.

func (*Database) BeginServiceBrowserLogin 

func (d *Database) BeginServiceBrowserLogin(ctx context.Context, subject httpsubject.Subject, path, nonce, verifier string, binding []byte, intent *CompanyLoginIntent, now time.Time) (string, error)

func (*Database) BrowserAuthorizationForRun 

func (d *Database) BrowserAuthorizationForRun(ctx context.Context, auth PublishRunAuthentication, token string, now time.Time) (result VisitorPermission, retErr error)

BrowserAuthorizationForRun is the final decision after any identity-provider I/O. it holds the run through the session, identity, membership and grant checks.

func (*Database) BrowserSession 

func (d *Database) BrowserSession(ctx context.Context, publicURLID, token string, now time.Time) (BrowserAccessSession, error)

func (*Database) CancelDeviceLogin 

func (d *Database) CancelDeviceLogin(ctx context.Context, credential string, now time.Time) error

func (*Database) CheckWorkloadService 

func (d *Database) CheckWorkloadService(ctx context.Context, credential, service string, now time.Time) (r WorkloadServiceAuthorization, retErr error)

func (*Database) ClaimACMEOrderWork 

func (d *Database) ClaimACMEOrderWork(
	ctx context.Context,
	workerID string,
	now time.Time,
	leaseDuration time.Duration,
) (work ACMEOrderWork, found bool, retErr error)

func (*Database) ClaimDNSAuthorityWork 

func (d *Database) ClaimDNSAuthorityWork(
	ctx context.Context,
	workerID string,
	now time.Time,
	leaseDuration time.Duration,
) (DNSAuthorityWork, bool, error)

func (*Database) ClaimDNSPublicURLWork 

func (d *Database) ClaimDNSPublicURLWork(
	ctx context.Context,
	workerID string,
	now time.Time,
	leaseDuration time.Duration,
) (DNSPublicURLWork, bool, error)

func (*Database) ClaimInvitationEmail 

func (d *Database) ClaimInvitationEmail(ctx context.Context, owner string, now time.Time) (EmailDelivery, error)

func (*Database) ClaimPublicURLUsageDeliveries 

func (d *Database) ClaimPublicURLUsageDeliveries(
	ctx context.Context,
	workerID string,
	batchSize int,
	now time.Time,
	leaseDuration time.Duration,
) (result []PublicURLUsageDeliveryWork, retErr error)

ClaimPublicURLUsageDeliveries claims up to batchSize finalized buckets.

func (*Database) ClaimPublisherConnection 

func (d *Database) ClaimPublisherConnection(
	ctx context.Context,
	request PublisherConnectionClaimRequest,
	now time.Time,
) (result ClaimedPublisherConnection, retErr error)

ClaimPublisherConnection authenticates and claims one assignment in a transaction. the winning relay can repeat its claim; all other relays are rejected.

func (*Database) ClaimRelayCertificateOrderWork 

func (d *Database) ClaimRelayCertificateOrderWork(
	ctx context.Context,
	workerID string,
	now time.Time,
	leaseDuration time.Duration,
) (work RelayCertificateOrderWork, found bool, retErr error)

func (*Database) ClaimServiceEndpointDNSWork 

func (d *Database) ClaimServiceEndpointDNSWork(ctx context.Context, worker string, now time.Time, duration time.Duration) (ServiceEndpointDNSWork, bool, error)

func (*Database) ClaimServicePublisherConnection 

func (d *Database) ClaimServicePublisherConnection(ctx context.Context, connectionID, serviceID, runID string, runNumber, revision int64, credential string, lease RelayLeaseIdentity, now time.Time) (result ServicePublisherConnection, retErr error)

func (*Database) ClaimTeamDomain 

func (d *Database) ClaimTeamDomain(
	ctx context.Context,
	request ClaimDomainRequest,
	now time.Time,
) (result Domain, retErr error)

func (*Database) CleanupServiceAudit 

func (d *Database) CleanupServiceAudit(ctx context.Context, now time.Time, limit int) (removed int64, retErr error)

CleanupServiceAudit removes at most limit expired rows per worker call.

func (*Database) CleanupWorkloads 

func (d *Database) CleanupWorkloads(ctx context.Context, now time.Time, limit int) (int64, error)

CleanupWorkloads prunes at most limit rows from each of nine relations, in dependency order. each statement commits separately: later phases see removed children, and a timeout does not discard progress. blocked parents are filtered before selection so retained/live references cannot starve unrelated history.

func (*Database) Close 

func (d *Database) Close()

Close closes all runtime database connections. it is safe to call more than once.

func (*Database) CloseDirectServiceVisitor 

func (d *Database) CloseDirectServiceVisitor(ctx context.Context, lease IngressLeaseIdentity, visitor string, now time.Time) error

func (*Database) ClosePublishRun 

func (d *Database) ClosePublishRun(ctx context.Context, publishRunID string, token credentials.PublishRunToken, now time.Time) (retErr error)

func (*Database) CloseServiceRun 

func (d *Database) CloseServiceRun(ctx context.Context, serviceID, runID, token string, now time.Time) (retErr error)

func (*Database) CloseServiceStream 

func (d *Database) CloseServiceStream(ctx context.Context, lease IngressLeaseIdentity, sessionID, visitorID string, now time.Time) error

func (*Database) CompletePublicURLUsageDelivery 

func (d *Database) CompletePublicURLUsageDelivery(
	ctx context.Context,
	work PublicURLUsageDeliveryWork,
	now time.Time,
) error

func (*Database) CompleteStorageKeyRotation 

func (d *Database) CompleteStorageKeyRotation(ctx context.Context) error

CompleteStorageKeyRotation re-encrypts all currently claimable secrets. new writes always use the current key, so a successful pass cannot create more work for the configured previous key.

func (*Database) ConfigureIngressServicePorts 

func (d *Database) ConfigureIngressServicePorts(ctx context.Context, pool string, ranges []tcpport.Range) (retErr error)

ConfigureIngressServicePorts serializes with allocation. removing an active or quarantined port cannot silently strand a private or public client profile.

func (*Database) ConfigureOIDCAdmissions 

func (d *Database) ConfigureOIDCAdmissions(ctx context.Context, issuer string, rules []oidc.AdmissionRule, now time.Time) (retErr error)

ConfigureOIDCAdmissions runs once before serving. an existing/retired source is never replaced by configuration reconciliation; replacement is an explicit owner operation, and the new source's eligibility stays independently scoped.

func (*Database) ConfigureService 

func (d *Database) ConfigureService(ctx context.Context, serviceID, actorID string, metadata ServiceMetadata, now time.Time) (result ServiceRecord, retErr error)

metadata approval serializes with admission and publication. changing trust closes every old run so a visitor cannot receive bytes using old trust.

func (*Database) ConsumeBrowserLogin 

func (d *Database) ConsumeBrowserLogin(ctx context.Context, state string, browserBinding []byte, now time.Time) (BrowserLoginAttempt, error)

func (*Database) ConsumeDeviceBrowser 

func (d *Database) ConsumeDeviceBrowser(ctx context.Context, state string, binding []byte, now time.Time) (DeviceLogin, error)

consume before redeeming the one-use upstream code; an uncertain exchange requires a fresh browser attempt, never blind redemption of the same code.

func (*Database) CreateCertificateIssuance 

func (d *Database) CreateCertificateIssuance(
	ctx context.Context,
	request CreateCertificateIssuanceRequest,
	now time.Time,
) (result CertificateIssuance, retErr error)

func (*Database) CreateCompanyLoginIntent 

func (d *Database) CreateCompanyLoginIntent(ctx context.Context, team, issuer, client, redirect string, now time.Time) (result CompanyLoginIntent, retErr error)

func (*Database) CreateDNSAuthority 

func (d *Database) CreateDNSAuthority(
	ctx context.Context,
	request CreateDNSAuthorityRequest,
	now time.Time,
) (DNSAuthority, error)

func (*Database) CreateDeviceLogin 

func (d *Database) CreateDeviceLogin(ctx context.Context, options DeviceLoginOptions, now time.Time) (result DeviceLogin, credential string, retErr error)

func (*Database) CreateFeedback 

func (d *Database) CreateFeedback(ctx context.Context, auth PublishRunAuthentication, request CreateFeedbackRequest, now time.Time) (result FeedbackThread, retErr error)

func (*Database) CreateGuestShare 

func (d *Database) CreateGuestShare(ctx context.Context, guestID, publicURLID, key, label string, fingerprint [32]byte, expiresAt, now time.Time) (result Share, retErr error)

CreateGuestShare saves the same share capability used by regular URLs, but ties it to the live guest trial and its single demo URL.

func (*Database) CreateGuestTrial 

func (d *Database) CreateGuestTrial(ctx context.Context, guest NewGuestTrial, managedDomain string, now time.Time) (result string, retErr error)

CreateGuestTrial provisions the managed domain and reserves the label. the reservation and trial commit together before a signed-in user can claim it.

func (*Database) CreateIdentityVisitorGrant 

func (d *Database) CreateIdentityVisitorGrant(ctx context.Context, urlID, actorID, key, identityID string, expires *time.Time, now time.Time) (VisitorGrant, error)

func (*Database) CreateOIDCControlSession 

func (d *Database) CreateOIDCControlSession(
	ctx context.Context,
	managedDomain string,
	identity OIDCIdentity,
	accessLifetime time.Duration,
	refreshLifetime time.Duration,
	now time.Time,
) (result ControlSession, retErr error)

CreateOIDCControlSession consumes one verified assertion and creates or updates its named local identity before issuing a local control session.

func (*Database) CreatePreview 

func (d *Database) CreatePreview(ctx context.Context, teamID, identityID, key string, now time.Time) (Preview, error)

func (*Database) CreatePublicURL 

func (d *Database) CreatePublicURL(ctx context.Context, request CreatePublicURLRequest, now time.Time) (result PublicURL, retErr error)

func (*Database) CreatePublishRun 

func (d *Database) CreatePublishRun(
	ctx context.Context,
	request PublishRunRequest,
	now time.Time,
	publisherLeaseDuration time.Duration,
	connectionCredentialDuration time.Duration,
) (result PublishRunSetup, retErr error)

CreatePublishRun creates one publish run with two connection assignments on distinct relay services. an authenticated retry returns the same publish run and assignment credentials.

func (*Database) CreatePublishRunPreview 

func (d *Database) CreatePublishRunPreview(ctx context.Context, auth PublishRunAuthentication, now time.Time) (result Preview, retErr error)

func (*Database) CreatePublisherGrant 

func (d *Database) CreatePublisherGrant(ctx context.Context, r CreatePublisherGrantRequest) (result string, retErr error)

func (*Database) CreateServiceAt 

func (d *Database) CreateServiceAt(ctx context.Context, teamID, actorID, name, key string, placement ServicePlacement, now time.Time, metadata ServiceMetadata) (result ServiceRecord, retErr error)

func (*Database) CreateServiceCertificateIssuance 

func (d *Database) CreateServiceCertificateIssuance(ctx context.Context, service, runID, token, directory, key string, number int64, der []byte, now time.Time) (result CertificateIssuance, retErr error)

func (*Database) CreateServiceGrant 

func (d *Database) CreateServiceGrant(ctx context.Context, serviceID, actorID, key, kind, identityID string, expires *time.Time, now time.Time) (result ServiceGrant, retErr error)

func (*Database) CreateServiceHTTPGrant 

func (d *Database) CreateServiceHTTPGrant(ctx context.Context, service, actor string, input controlv1.CreateServiceHTTPGrantRequest, now time.Time) (result controlv1.ServiceHTTPGrant, retErr error)

func (*Database) CreateShare 

func (d *Database) CreateShare(ctx context.Context, request CreateShareRequest, now time.Time) (result Share, retErr error)

func (*Database) CreateTeam 

func (d *Database) CreateTeam(ctx context.Context, request CreateTeamRequest, now time.Time) (result Team, retErr error)

func (*Database) CreateTeamInvitation 

func (d *Database) CreateTeamInvitation(
	ctx context.Context,
	request CreateInvitationRequest,
	now time.Time,
) (result InvitationSecret, retErr error)

func (*Database) CreateTeamVisitorGrant 

func (d *Database) CreateTeamVisitorGrant(ctx context.Context, urlID, actorID, key string, expires *time.Time, now time.Time) (VisitorGrant, error)

func (*Database) CreateVisitorIngressAssignment 

func (d *Database) CreateVisitorIngressAssignment(ctx context.Context, identityID, deviceID, serviceID, excludeIngressID, key string, now time.Time) (ConnectorSession, error)

single-slot renewal reserves only one other ingress. exclusion narrows placement; it never grants access or revokes an existing session.

func (*Database) CreateVisitorIngressAssignments 

func (d *Database) CreateVisitorIngressAssignments(ctx context.Context, identityID, deviceID, serviceID, key string, now time.Time) (result []ConnectorSession, retErr error)

both assignments authenticate the same enrolled identity, but each has an independent session credential and ingress claim. neither grants a service.

func (*Database) CreateVisitorInvitation 

func (d *Database) CreateVisitorInvitation(ctx context.Context, urlID, actorID, key, email string, tokenDigest [32]byte, expires, now time.Time) (result VisitorInvitation, retErr error)

the client generates the secret; control stores only its digest.

func (*Database) CreateWorkloadIngressAssignmentSet 

func (d *Database) CreateWorkloadIngressAssignmentSet(ctx context.Context, credential, service, key string, count int, exclude string, now time.Time) (result WorkloadIngressAssignments, retErr error)

func (*Database) CreateWorkloadIngressAssignments 

func (d *Database) CreateWorkloadIngressAssignments(ctx context.Context, credential, service, key string, now time.Time) (result WorkloadIngressAssignments, retErr error)

func (*Database) DNSAuthorityReleaseReady 

func (d *Database) DNSAuthorityReleaseReady(ctx context.Context, domainID string, now time.Time) (bool, error)

func (*Database) DecideCompanyAdmission 

func (d *Database) DecideCompanyAdmission(ctx context.Context, p ControlPrincipal, team, request string, revision int64, decision string, now time.Time) (retErr error)

func (*Database) DeleteAuthorizedPublicURL 

func (d *Database) DeleteAuthorizedPublicURL(
	ctx context.Context,
	request AuthorizedPublicURLDeleteRequest,
	now time.Time,
) error

func (*Database) DeleteExpiredEphemeralPublicURLs 

func (d *Database) DeleteExpiredEphemeralPublicURLs(ctx context.Context, now time.Time) (count int, retErr error)

DeleteExpiredEphemeralPublicURLs removes a bounded batch of expired public URLs. it uses the same publish-run, routing-table, and DNS cleanup as explicit deletion.

func (*Database) DeletePublicURL 

func (d *Database) DeletePublicURL(ctx context.Context, identityID, publicURLID string, now time.Time) (retErr error)

func (*Database) DeleteService 

func (d *Database) DeleteService(ctx context.Context, serviceID, actorID string, now time.Time) (retErr error)

func (*Database) DenyDeviceBrowser 

func (d *Database) DenyDeviceBrowser(ctx context.Context, code string, binding []byte, now time.Time) error

func (*Database) Diagnostics 

func (d *Database) Diagnostics(parent context.Context) (result DatabaseDiagnostics, retErr error)

Diagnostics uses a separate connection through the configured pooled URL. It cannot be starved by the local pgx pool; pooler/database unavailability is still bounded by the timeout. it never returns query text or connection data.

func (*Database) DirectServiceVisitorStatus 

func (d *Database) DirectServiceVisitorStatus(ctx context.Context, lease IngressLeaseIdentity, visitor string, now time.Time) (result DirectVisitorStatus, retErr error)

func (*Database) DisconnectIdentityConnection 

func (d *Database) DisconnectIdentityConnection(ctx context.Context, p ControlPrincipal, team, id string, revision int64, now time.Time) (retErr error)

func (*Database) DisconnectPublisherConnection 

func (d *Database) DisconnectPublisherConnection(
	ctx context.Context,
	request PublisherConnectionClaimRequest,
	now time.Time,
	unexpected bool,
) (ClaimedPublisherConnection, error)

DisconnectPublisherConnection closes only the exact claimed connection.

func (*Database) DisconnectServicePublisherConnection 

func (d *Database) DisconnectServicePublisherConnection(ctx context.Context, connectionID, runID string, runNumber, revision int64, lease RelayLeaseIdentity, now time.Time) (result ServicePublisherConnection, retErr error)

func (*Database) EnableShareAccess 

func (d *Database) EnableShareAccess(ctx context.Context, authentication PublishRunAuthentication, previewID string) error

func (*Database) EnrollGuestPublisher 

func (d *Database) EnrollGuestPublisher(ctx context.Context, guestID, urlID, sourceIP string, public ed25519.PublicKey, now time.Time) (result PublisherIdentity, retErr error)

enroll a guest only after its demo URL exists. the trial credential is a bootstrap credential, never a publisher namespace or run credential.

func (*Database) EnrollVisitorDevice 

func (d *Database) EnrollVisitorDevice(ctx context.Context, identityID string, key ed25519.PublicKey, now time.Time) (result VisitorDevice, err error)

enrolling an existing key is retry-stable. revocation is permanent: signing in again cannot resurrect a stolen device key.

func (*Database) EnsureACMEAccount 

func (d *Database) EnsureACMEAccount(
	ctx context.Context,
	directoryURL string,
	contactEmail string,
	now time.Time,
) (ACMEAccount, error)

func (*Database) EnsureGuestPrincipal 

func (d *Database) EnsureGuestPrincipal(ctx context.Context, guestID string, now time.Time) (result [32]byte, retErr error)

func (*Database) EnsurePrimaryIngressPool 

func (d *Database) EnsurePrimaryIngressPool(ctx context.Context, ipv4, ipv6 string, now time.Time) (retErr error)

EnsurePrimaryIngressPool pins the public HTTP ingress address.

func (*Database) EnsureServiceIdentity 

func (d *Database) EnsureServiceIdentity(ctx context.Context, managedDomain string, identity OIDCIdentity, now time.Time) (result IdentityContext, retErr error)

EnsureServiceIdentity resolves identity facts supplied by the configured OIDC provider's website. it never issues a control session or changes team roles.

func (*Database) ExchangePublisherAssertion 

func (d *Database) ExchangePublisherAssertion(ctx context.Context, id, grant, audience, assertion, sourceIP string, now time.Time) (result PublisherAccess, retErr error)

func (*Database) ExchangeWorkload 

func (d *Database) ExchangeWorkload(ctx context.Context, r ExchangeWorkloadRequest, now time.Time) (result WorkloadSession, retErr error)

exchange is called only after provider signature/issuer/audience verification. jobs cannot establish repository metadata or alter applied policy here.

func (*Database) ExpireDeviceLogins 

func (d *Database) ExpireDeviceLogins(ctx context.Context, now time.Time) error

func (*Database) ExpireSavedPublishRuns 

func (d *Database) ExpireSavedPublishRuns(ctx context.Context, now time.Time) (count int, retErr error)

ExpireSavedPublishRuns closes expired HTTP and private runs, including runs no publisher will touch again. each closure releases its shared relay reservations and publishes a run-scoped routing tombstone.

func (*Database) ExpireServiceRuns 

func (d *Database) ExpireServiceRuns(ctx context.Context, now time.Time) (count int, retErr error)

private runs use the same expiration worker and relay reservation counters as HTTP runs. a departed publisher must not hold placement indefinitely.

func (*Database) ExpireVisitorIPs 

func (d *Database) ExpireVisitorIPs(ctx context.Context, now time.Time) (int, error)

ExpireVisitorIPs is replica-safe and bounded. call it from the control worker at least once per second; live permission reads also enforce expiry directly.

func (*Database) ExpireVisitorPermissions 

func (d *Database) ExpireVisitorPermissions(ctx context.Context, now time.Time) error

func (*Database) FinalizePublicURLUsageBuckets 

func (d *Database) FinalizePublicURLUsageBuckets(
	ctx context.Context,
	through time.Time,
	now time.Time,
) (result int, retErr error)

FinalizePublicURLUsageBuckets closes aggregate buckets through a cutoff and creates delivery work for each finalized revision.

func (*Database) FinishInvitationEmail 

func (d *Database) FinishInvitationEmail(ctx context.Context, delivery EmailDelivery, status int, now time.Time) error

func (*Database) ForgetGuestPrivateState 

func (d *Database) ForgetGuestPrivateState(ctx context.Context, now time.Time) (int, error)

ForgetGuestPrivateState removes rate-limit digests after one hour and guest credentials after the trial ends and all of its public URLs are deleted.

func (*Database) GetAuthorizedPublicURLByHostname 

func (d *Database) GetAuthorizedPublicURLByHostname(ctx context.Context, teamID, hostname string) (PublicURL, error)

GetAuthorizedPublicURLByHostname reads one non-deleted public URL after a current team-read authorization decision, using the existing hostname index.

func (*Database) GetCertificateIssuance 

func (d *Database) GetCertificateIssuance(
	ctx context.Context,
	issuanceID string,
	token credentials.PublishRunToken,
	now time.Time,
) (result CertificateIssuance, retErr error)

func (*Database) GetDNSAuthority 

func (d *Database) GetDNSAuthority(ctx context.Context, reference string) (DNSAuthority, error)

func (*Database) GetDNSChallengeChange 

func (d *Database) GetDNSChallengeChange(ctx context.Context, zoneID, recordName string) (DNSChallengeChange, bool, error)

func (*Database) GetDNSChallengeContextForSubject 

func (d *Database) GetDNSChallengeContextForSubject(ctx context.Context, subject CertificateSubject, authorizationID string) (DNSChallengeContext, error)

func (*Database) GetFeedback 

func (d *Database) GetFeedback(ctx context.Context, id string) (FeedbackThread, error)

func (*Database) GetIngressPool 

func (d *Database) GetIngressPool(ctx context.Context, id string) (IngressPool, error)

func (*Database) GetIngressTransportCertificate 

func (d *Database) GetIngressTransportCertificate(ctx context.Context, identity IngressLeaseIdentity, now time.Time) (result IngressTransportCertificate, retErr error)

func (*Database) GetLocalProjectService 

func (d *Database) GetLocalProjectService(ctx context.Context, r GetLocalProjectServiceRequest) (result LocalProjectService, retErr error)

visitor lookup reads the recorded ID, never saved names or declarations. the read-only snapshot keeps provenance, live access and safe metadata consistent.

func (*Database) GetPreview 

func (d *Database) GetPreview(ctx context.Context, id string) (Preview, error)

func (*Database) GetProjectConfiguration 

func (d *Database) GetProjectConfiguration(ctx context.Context, team, key, actor string) (result AppliedProjectConfiguration, retErr error)

func (*Database) GetProjectPublicMetadata 

func (d *Database) GetProjectPublicMetadata(ctx context.Context, team, project, actor string, now time.Time) (result ProjectPublicMetadata, retErr error)

browser preparation receives only immutable public service IDs and hostnames. visitor permission never authorizes reading targets, trust, grants or config.

func (*Database) GetProjectService 

func (d *Database) GetProjectService(ctx context.Context, r GetProjectServiceRequest) (result ServiceRecord, retErr error)

visitor lookup follows the applied resource binding, never a friendly name. reading the encrypted project document or its targets requires manager access.

func (*Database) GetPublicURL 

func (d *Database) GetPublicURL(ctx context.Context, identityID, publicURLID string) (PublicURL, error)

func (*Database) GetPublicURLForAuthorization 

func (d *Database) GetPublicURLForAuthorization(ctx context.Context, publicURLID string) (PublicURL, error)

GetPublicURLForAuthorization returns saved state before the caller authorizes access. callers must not expose it before checking current membership.

func (*Database) GetPublicURLForFeedbackAuthorization 

func (d *Database) GetPublicURLForFeedbackAuthorization(ctx context.Context, id string) (PublicURL, error)

feedback authorization includes retained public URL tombstones, without exposing them through ordinary public URL reads or publishing operations.

func (*Database) GetPublicURLForPublishRunAuthorization 

func (d *Database) GetPublicURLForPublishRunAuthorization(ctx context.Context, publicURLID, key string) (PublicURL, error)

func (*Database) GetPublisherGroupAssignments 

func (d *Database) GetPublisherGroupAssignments(ctx context.Context, token string, now time.Time) (result PublisherGroupAssignments, retErr error)

func (*Database) GetRelayDNSChallengeContext 

func (d *Database) GetRelayDNSChallengeContext(ctx context.Context, orderID string) (RelayDNSChallengeContext, error)

func (*Database) GetRelayTransportCertificate 

func (d *Database) GetRelayTransportCertificate(
	ctx context.Context,
	identity RelayLeaseIdentity,
	now time.Time,
) (RelayTransportCertificate, error)

GetRelayTransportCertificate returns decrypted material only while the exact requesting relay process lease is current.

func (*Database) GetService 

func (d *Database) GetService(ctx context.Context, serviceID, actorID string) (result ServiceRecord, retErr error)

func (*Database) GetServiceCertificateIssuance 

func (d *Database) GetServiceCertificateIssuance(ctx context.Context, service, runID, token, issuance string, now time.Time) (result CertificateIssuance, retErr error)

func (*Database) GetServiceForPublisher 

func (d *Database) GetServiceForPublisher(ctx context.Context, id string, publisher PublisherIdentity, now time.Time) (result ServiceRecord, retErr error)

func (*Database) GetShare 

func (d *Database) GetShare(ctx context.Context, id string) (Share, error)

func (*Database) GetTeam 

func (d *Database) GetTeam(ctx context.Context, identityID, teamID string) (Team, error)

func (*Database) GetTeamFeedbackPolicy 

func (d *Database) GetTeamFeedbackPolicy(ctx context.Context, identityID, teamID string) (TeamFeedbackPolicy, error)

func (*Database) GetVisitorIngressTransportTrust 

func (d *Database) GetVisitorIngressTransportTrust(ctx context.Context, identityID, sessionID string, now time.Time) (result IngressTransportTrust, retErr error)

func (*Database) GetWorkloadIngressTransportTrust 

func (d *Database) GetWorkloadIngressTransportTrust(ctx context.Context, credential, session string, now time.Time) (result IngressTransportTrust, retErr error)

func (*Database) GuestIssuanceAllowed 

func (d *Database) GuestIssuanceAllowed(ctx context.Context, sourceIP netip.Addr, now time.Time) error

func (*Database) GuestOwnsPublicURL 

func (d *Database) GuestOwnsPublicURL(ctx context.Context, guestID, publicURLID string) (bool, error)

func (*Database) GuestSourceMatches 

func (d *Database) GuestSourceMatches(guest GuestTrial, prefix string) (bool, error)

func (*Database) GuestTrialByAccessToken 

func (d *Database) GuestTrialByAccessToken(ctx context.Context, token credentials.AccessToken) (GuestTrial, error)

func (*Database) HTTPVisitorPermission 

func (d *Database) HTTPVisitorPermission(ctx context.Context, auth PublishRunAuthentication, input HTTPVisitorRequest, now time.Time) (result VisitorPermission, retErr error)

func (*Database) Health 

func (d *Database) Health(ctx context.Context) error

Health verifies that the database can serve a query through the runtime pool.

func (*Database) HeartbeatPublishRun 

func (d *Database) HeartbeatPublishRun(
	ctx context.Context,
	authentication PublishRunAuthentication,
	now time.Time,
	leaseDuration time.Duration,
	connectionCredentialDuration time.Duration,
) (result PublishRunSetup, retErr error)

HeartbeatPublishRun extends one publish run and returns current or replacement publisher connection assignments.

func (*Database) HeartbeatServiceRun 

func (d *Database) HeartbeatServiceRun(ctx context.Context, serviceID, runID, token string, now time.Time, reports ...ServiceRunHealth) (result ServiceRunState, retErr error)

func (*Database) IdentifyWorkload 

func (d *Database) IdentifyWorkload(ctx context.Context, team, project, name, source string, c oidc.WorkloadExecution, now time.Time) (string, error)

IdentifyWorkload rechecks saved policy after provider verification. this is a cache-selection hint, never a visitor credential or permission to reuse a key.

func (*Database) IdentityContext 

func (d *Database) IdentityContext(ctx context.Context, identityID string) (IdentityContext, error)

func (*Database) IngestIngressServiceObservations 

func (d *Database) IngestIngressServiceObservations(ctx context.Context, lease IngressLeaseIdentity, batch serviceaudit.Batch, now time.Time) (result ServiceObservationResult, retErr error)

func (*Database) IngestPublisherServiceObservations 

func (d *Database) IngestPublisherServiceObservations(ctx context.Context, auth PublishRunAuthentication, batch serviceaudit.Batch, now time.Time) (result ServiceObservationResult, retErr error)

func (*Database) Instrument 

func (d *Database) Instrument(metrics *observability.Metrics)

Instrument sends completed state operations and request-pool queries to one process registry. configure it after Open and before serving requests.

func (*Database) InviteServiceVisitor 

func (d *Database) InviteServiceVisitor(ctx context.Context, serviceID, actorID, key, email string, expires, now time.Time) (result ServiceInvitation, retErr error)

func (*Database) IssueBrowserHandoff 

func (d *Database) IssueBrowserHandoff(ctx context.Context, attempt BrowserLoginAttempt, session BrowserAccessSession, now time.Time) (BrowserHandoff, error)

func (*Database) IssueControlBrowserHandoff 

func (d *Database) IssueControlBrowserHandoff(ctx context.Context, access credentials.AccessToken, refresh credentials.RefreshToken, urlID string, accessLifetime, refreshLifetime time.Duration, now time.Time) (handoff BrowserHandoff, hostname string, retErr error)

func (*Database) IssuePublisherEnrollment 

func (d *Database) IssuePublisherEnrollment(ctx context.Context, r CreatePublisherEnrollmentRequest) (result PublisherEnrollment, retErr error)

func (*Database) IssuePublisherGroupEnrollment 

func (d *Database) IssuePublisherGroupEnrollment(ctx context.Context, team, project, group, actor string, maxMembers int, lifetime time.Duration, now time.Time) (result PublisherGroupEnrollment, retErr error)

func (*Database) IssueServiceClientCertificate 

func (d *Database) IssueServiceClientCertificate(ctx context.Context, service, identity, device string, csr []byte, now time.Time) (result ServiceClientCertificate, retErr error)

func (*Database) IssueWorkloadServiceClientCertificate 

func (d *Database) IssueWorkloadServiceClientCertificate(ctx context.Context, credential, service string, csrDER []byte, now time.Time) (result ServiceClientCertificate, retErr error)

func (*Database) ListAdminRelayLeases 

func (d *Database) ListAdminRelayLeases(ctx context.Context, cursor string, now time.Time) (AdminRelayPage, error)

ListAdminRelayLeases returns one page of current relay process leases.

func (*Database) ListAuthorizedPublicURLs 

func (d *Database) ListAuthorizedPublicURLs(ctx context.Context, teamID, cursor string) (PublicURLPage, error)

ListAuthorizedPublicURLs returns one team page after the caller has obtained a current authorization decision. it does not consult local memberships.

func (*Database) ListAvailablePublicURLs 

func (d *Database) ListAvailablePublicURLs(ctx context.Context, identityID, teamID, cursor string, now time.Time) (AvailablePublicURLPage, error)

func (*Database) ListAvailableServices 

func (d *Database) ListAvailableServices(ctx context.Context, identityID, cursor string, now time.Time) ([]ServiceInventory, string, error)

func (*Database) ListCompanyAdmissions 

func (d *Database) ListCompanyAdmissions(ctx context.Context, p ControlPrincipal, team, after string, now time.Time) (result CompanyAdmissionPage, retErr error)

func (*Database) ListFeedbackEventsForTeam 

func (d *Database) ListFeedbackEventsForTeam(ctx context.Context, teamID string, after uint64) (FeedbackEventPage, error)

func (*Database) ListFeedbackEventsForThread 

func (d *Database) ListFeedbackEventsForThread(ctx context.Context, id string, after uint64) (FeedbackEventPage, error)

func (*Database) ListFeedbackForPage 

func (d *Database) ListFeedbackForPage(ctx context.Context, previewID, publicURLID, pagePath, cursor string) (FeedbackThreadPage, error)

func (*Database) ListFeedbackForPublicURL 

func (d *Database) ListFeedbackForPublicURL(ctx context.Context, previewID, publicURLID, pagePath, state, cursor string) (FeedbackThreadPage, error)

func (*Database) ListFeedbackForTeam 

func (d *Database) ListFeedbackForTeam(ctx context.Context, teamID, cursor string) (FeedbackThreadPage, error)

func (*Database) ListMaintenanceControls 

func (d *Database) ListMaintenanceControls(ctx context.Context) ([]MaintenanceControl, error)

ListMaintenanceControls returns all maintenance controls in name order.

func (*Database) ListPublicURLs 

func (d *Database) ListPublicURLs(ctx context.Context, identityID, teamID, cursor string) (PublicURLPage, error)

func (*Database) ListPublisherIdentities 

func (d *Database) ListPublisherIdentities(ctx context.Context, team, after string) (PublisherIdentityPage, error)

func (*Database) ListServiceAudit 

func (d *Database) ListServiceAudit(ctx context.Context, team, actor string, f ServiceAuditFilter, now time.Time) (page ServiceAuditPage, retErr error)

func (*Database) ListServiceGrants 

func (d *Database) ListServiceGrants(ctx context.Context, serviceID, actorID, after string) (result []ServiceGrant, next string, retErr error)

func (*Database) ListServiceHTTPGrants 

func (d *Database) ListServiceHTTPGrants(ctx context.Context, service, actor string, now time.Time) (result []controlv1.ServiceHTTPGrantSummary, retErr error)

func (*Database) ListServiceInvitations 

func (d *Database) ListServiceInvitations(ctx context.Context, serviceID, actorID, after string) (result []ServiceInvitation, next string, retErr error)

func (*Database) ListServices 

func (d *Database) ListServices(ctx context.Context, teamID, actorID, after string) ([]ServiceRecord, string, error)

func (*Database) ListShares 

func (d *Database) ListShares(ctx context.Context, previewID, cursor string) (SharePage, error)

func (*Database) ListTeamDomains 

func (d *Database) ListTeamDomains(ctx context.Context, identityID, teamID string) ([]Domain, error)

func (*Database) ListTeamInvitations 

func (d *Database) ListTeamInvitations(
	ctx context.Context,
	identityID, teamID string,
	now time.Time,
) (result []Invitation, retErr error)

func (*Database) ListTeamMemberships 

func (d *Database) ListTeamMemberships(ctx context.Context, identityID, teamID string) ([]Membership, error)

func (*Database) ListTeamShares 

func (d *Database) ListTeamShares(ctx context.Context, teamID, identityID, cursor string) (SharePage, error)

func (*Database) ListTeams 

func (d *Database) ListTeams(ctx context.Context, identityID string) ([]Team, error)

func (*Database) ListVisitorGrants 

func (d *Database) ListVisitorGrants(ctx context.Context, urlID, actorID string) (result []VisitorGrant, retErr error)

func (*Database) ListVisitorInvitations 

func (d *Database) ListVisitorInvitations(ctx context.Context, urlID, actorID string) (result []VisitorInvitation, retErr error)

func (*Database) ListWorkloadServices 

func (d *Database) ListWorkloadServices(ctx context.Context, credential string, now time.Time) (result []WorkloadService, retErr error)

func (*Database) MarkExpiredIngressUsageRunsIncomplete 

func (d *Database) MarkExpiredIngressUsageRunsIncomplete(ctx context.Context, now time.Time) (int, error)

MarkExpiredIngressUsageRunsIncomplete records only the uncovered tail of process runs that ended without a final report.

func (*Database) MarkPublicURLCertificateInstalled 

func (d *Database) MarkPublicURLCertificateInstalled(
	ctx context.Context,
	authentication PublishRunAuthentication,
	issuanceID string,
	notAfter time.Time,
	now time.Time,
) (result PublishRunLifecycle, retErr error)

MarkPublicURLCertificateInstalled records publisher acknowledgement of the installed public URL certificate. first routability still requires both connections.

func (*Database) MarkPublishRunReady 

func (d *Database) MarkPublishRunReady(
	ctx context.Context,
	authentication PublishRunAuthentication,
	now time.Time,
) (result PublishRunLifecycle, retErr error)

func (*Database) MarkPublisherConnectionReady 

func (d *Database) MarkPublisherConnectionReady(
	ctx context.Context,
	request PublisherConnectionClaimRequest,
	now time.Time,
) (result ClaimedPublisherConnection, retErr error)

MarkPublisherConnectionReady records that a claimed publisher connection can carry visitor streams.

func (*Database) MarkServiceCertificateInstalled 

func (d *Database) MarkServiceCertificateInstalled(ctx context.Context, service, runID, token, issuance string, number int64, notAfter, now time.Time) (retErr error)

func (*Database) Metrics 

func (d *Database) Metrics(now time.Time) DatabaseMetrics

Metrics returns one process-local database metrics snapshot.

func (*Database) MutateVisitorIPs 

func (d *Database) MutateVisitorIPs(ctx context.Context, urlID, actorID, operation, removeID string, input []VisitorIPGrantInput, now time.Time) (result []VisitorIPGrant, retErr error)

func (*Database) ObservePublicURLRecovery 

func (d *Database) ObservePublicURLRecovery(
	ctx context.Context,
	ingressIdentity IngressLeaseIdentity,
	publicURLID string,
	publishRunNumber uint64,
	recoveryEpisodeID uint64,
	observedAt time.Time,
) (result PublicURLRecoveryObservation, retErr error)

ObservePublicURLRecovery closes one open episode and updates its cumulative histogram in a transaction. repeating an observed episode is safe.

func (*Database) PollDeviceLogin 

func (d *Database) PollDeviceLogin(ctx context.Context, credential string, now time.Time) (DeviceLogin, error)

func (*Database) PoolStats 

func (d *Database) PoolStats() *pgxpool.Stat

PoolStats returns an in-memory snapshot without acquiring a connection.

func (*Database) PrepareCompanyBrowser 

func (d *Database) PrepareCompanyBrowser(ctx context.Context, team, issuer, client, redirect string, now time.Time) (*CompanyLoginIntent, error)

func (*Database) PrepareRelayCertificateOrder 

func (d *Database) PrepareRelayCertificateOrder(
	ctx context.Context,
	accountID string,
	now time.Time,
	failedRetryInterval time.Duration,
) (created bool, retErr error)

PrepareRelayCertificateOrder schedules managed material at its persisted RenewAt.

func (*Database) PrepareServiceRun 

func (d *Database) PrepareServiceRun(ctx context.Context, serviceID string, p PublisherIdentity, key string, now time.Time, metadata ServiceMetadata) (result ServiceRunPreparation, retErr error)

func (*Database) PreviewInvitation 

func (d *Database) PreviewInvitation(ctx context.Context, identityID string, secret string, now time.Time) (InvitationPreview, error)

func (*Database) PreviewServiceInvitation 

func (d *Database) PreviewServiceInvitation(ctx context.Context, actor, secret string, now time.Time) (result ServiceInvitationPreview, retErr error)

func (*Database) PreviewTeamAccessForPublicURL 

func (d *Database) PreviewTeamAccessForPublicURL(ctx context.Context, publicURLID string) (Preview, error)

func (*Database) PrometheusMetrics 

func (d *Database) PrometheusMetrics(now time.Time) observability.DatabaseSnapshot

PrometheusMetrics supplies the same passive database snapshot to runtime scrapes and local load tests. it never acquires a database connection.

func (*Database) PromoteDirectServiceVisitor 

func (d *Database) PromoteDirectServiceVisitor(ctx context.Context, lease IngressLeaseIdentity, visitor string, now time.Time) error

func (*Database) ProvisionCompanyEligibility 

func (d *Database) ProvisionCompanyEligibility(ctx context.Context, token string, r ProvisionCompanyEligibilityRequest, now time.Time) (retErr error)

ProvisionCompanyEligibility is a narrow delta, never an authoritative list. a source cannot assign roles, edit manual decisions, or revive a tombstone.

func (*Database) PruneIngressRoutingHistory 

func (d *Database) PruneIngressRoutingHistory(ctx context.Context, afterRevision uint64) (result RoutingHistoryPruneResult, retErr error)

PruneIngressRoutingHistory scans at most 1,000 committed events below the published floor. callers yield between batches, retain NextRevision within a sweep, and restart at zero after More is false. A canceled/failed batch must retry its previous cursor. Busy means another control owns the current batch.

func (*Database) PublishRunAuthentication 

func (d *Database) PublishRunAuthentication(
	ctx context.Context,
	publishRunID string,
	publishRunNumber uint64,
	token credentials.PublishRunToken,
) (PublishRunAuthentication, error)

func (*Database) PublishRunShareState 

func (d *Database) PublishRunShareState(ctx context.Context, authentication PublishRunAuthentication, now time.Time) ([]PublisherShare, error)

func (*Database) PublisherIdentityRecord 

func (d *Database) PublisherIdentityRecord(ctx context.Context, team, id string) (PublisherRecord, error)

func (*Database) PublisherMayStartRun 

func (d *Database) PublisherMayStartRun(ctx context.Context, p PublisherIdentity, id string) (bool, error)

func (*Database) PublisherRunPlan 

func (d *Database) PublisherRunPlan(ctx context.Context, p PublisherIdentity, u PublicURL, _ bool) (authorization.CertificatePlan, error)

func (*Database) PublisherRuntime 

func (d *Database) PublisherRuntime(ctx context.Context, r PublisherRuntimeRequest) (result PublisherRuntimeResponse, retErr error)

PublisherRuntime is the sole observation writer. enrollment, key verification, token exchange and preflight group leases never call it.

func (*Database) ReadCompanyConnections 

func (d *Database) ReadCompanyConnections(ctx context.Context, p ControlPrincipal, team string, now time.Time) (result CompanyConnections, retErr error)

func (*Database) ReadDeviceBrowser 

func (d *Database) ReadDeviceBrowser(ctx context.Context, code string, now time.Time) (DeviceLogin, error)

func (*Database) ReadIngressRoutingTableEvents 

func (d *Database) ReadIngressRoutingTableEvents(
	ctx context.Context,
	identity IngressLeaseIdentity,
	afterRevision uint64,
	pageSize int,
	now time.Time,
) (result IngressRoutingTablePage, retErr error)

ReadIngressRoutingTableEvents returns a size-limited page after one revision.

func (*Database) ReadIngressRoutingTableSnapshot 

func (d *Database) ReadIngressRoutingTableSnapshot(
	ctx context.Context,
	identity IngressLeaseIdentity,
	now time.Time,
) (result IngressRoutingTableSnapshot, retErr error)

ReadIngressRoutingTableSnapshot returns the latest unexpired projection for each public URL or challenge as of one repeatable-read high-water revision.

func (*Database) ReadServiceEvents 

func (d *Database) ReadServiceEvents(ctx context.Context, lease IngressLeaseIdentity, after int64, now time.Time) (result ServiceRoutingSnapshot, retErr error)

func (*Database) ReadServiceSnapshot 

func (d *Database) ReadServiceSnapshot(ctx context.Context, lease IngressLeaseIdentity, now time.Time) (result ServiceRoutingSnapshot, retErr error)

func (*Database) Readiness 

func (d *Database) Readiness(ctx context.Context) error

Readiness verifies runtime connectivity and schema compatibility. unlike Open, it is safe to call repeatedly from a readiness probe.

func (*Database) ReadyServicePublisherConnection 

func (d *Database) ReadyServicePublisherConnection(ctx context.Context, connectionID, runID string, runNumber, revision int64, lease RelayLeaseIdentity, now time.Time) (result ServicePublisherConnection, retErr error)

func (*Database) RealizeLocalProjectService 

func (d *Database) RealizeLocalProjectService(ctx context.Context, r RealizeLocalProjectServiceRequest) (result LocalProjectService, retErr error)

realization owns only this worktree's local resource. it neither evaluates nor applies remote declarations. private IDs are allocated here, never found by name. public IDs must be exact caller-owned app URLs allocated by the normal runtime.

func (*Database) RecentGuestTrialStats 

func (d *Database) RecentGuestTrialStats(ctx context.Context, now time.Time) (GuestTrialStats, error)

RecentGuestTrialStats returns service-wide counts from committed trial rows.

func (*Database) RecheckServiceVisitor 

func (d *Database) RecheckServiceVisitor(ctx context.Context, lease IngressLeaseIdentity, serviceID, runID, sessionID, identityID, visitorID string, runNumber int64, source netip.Addr, now time.Time) (result ServiceVisitorValidity, retErr error)

RecheckServiceVisitor verifies the exact admitted visitor connection. it does not extend publisher or ingress leases or grant new permission; a revoked grant, stopped run, or lost ingress lease denies.

func (*Database) RecheckVisitorServiceStream 

func (d *Database) RecheckVisitorServiceStream(ctx context.Context, lease IngressLeaseIdentity, service, run, session, visitor string, subject VisitorSubject, number int64, source netip.Addr, now time.Time) (result ServiceVisitorValidity, retErr error)

RecheckVisitorServiceStream is the subject-aware counterpart to the current human wire adapter. it never treats a workload session ID as an identity ID.

func (*Database) RecoverCompanyOwner 

func (d *Database) RecoverCompanyOwner(ctx context.Context, p ControlPrincipal, team, member string, now time.Time) (retErr error)

recovery grants a personal-account exception only to an existing owner. it never fabricates source eligibility or bypasses a removed membership.

func (*Database) RedeemBrowserHandoff 

func (d *Database) RedeemBrowserHandoff(ctx context.Context, auth PublishRunAuthentication, token string, now time.Time) (string, string, string, bool, time.Time, error)

func (*Database) RedeemPublisherEnrollment 

func (d *Database) RedeemPublisherEnrollment(ctx context.Context, secret string, public ed25519.PublicKey, now time.Time) (result PublisherIdentity, retErr error)

func (*Database) RedeemPublisherGroupEnrollment 

func (d *Database) RedeemPublisherGroupEnrollment(ctx context.Context, secret string, public ed25519.PublicKey, now time.Time) (result PublisherGroupMember, retErr error)

func (*Database) RedeemServiceBrowserHandoff 

func (d *Database) RedeemServiceBrowserHandoff(ctx context.Context, auth ServiceHTTPRun, ticket string, now time.Time) (result controlv1.BrowserHandoffResponse, retErr error)

func (*Database) RedeemShare 

func (d *Database) RedeemShare(ctx context.Context, authentication PublishRunAuthentication, shareID string, secret, handoff []byte, now time.Time) (result ShareRedemption, retErr error)

func (*Database) ReencryptStorageSecrets 

func (d *Database) ReencryptStorageSecrets(ctx context.Context, limit int) (rotated int, retErr error)

ReencryptStorageSecrets claims and re-encrypts up to limit rows written with the previous storage key. row locks last through commit, so concurrent control processes skip work already claimed by another process.

func (*Database) RefreshBrowserSession 

func (d *Database) RefreshBrowserSession(ctx context.Context, publicURLID, token string, now time.Time,
	refresh func(context.Context, string) (BrowserTokenRotation, error)) (result BrowserAccessSession, retErr error)

RefreshBrowserSession serializes authority refresh for every hostname using the same browser session. concurrent requests reuse the first rotation.

func (*Database) RefreshControlSession 

func (d *Database) RefreshControlSession(
	ctx context.Context,
	token credentials.RefreshToken,
	accessLifetime time.Duration,
	now time.Time,
) (result ControlSession, retErr error)

func (*Database) RefreshPortPoolMetrics 

func (d *Database) RefreshPortPoolMetrics(ctx context.Context, metrics *observability.Metrics) (retErr error)

RefreshPortPoolMetrics reads committed inventory on a worker, never a scrape. held includes services; a quarantined port stays unavailable until control releases it, regardless of an observer's clock.

func (*Database) RegisterIngress 

func (d *Database) RegisterIngress(
	ctx context.Context,
	registration IngressRegistration,
	now time.Time,
	leaseDuration time.Duration,
) (result IngressLease, retErr error)

RegisterIngress creates or renews one ingress process lease.

func (*Database) RegisterRelay 

func (d *Database) RegisterRelay(
	ctx context.Context,
	registration RelayRegistration,
	now time.Time,
	leaseDuration time.Duration,
) (RelayLease, error)

RegisterRelay creates or renews one relay process lease. A different process run cannot replace an unexpired lease for the same relay identity.

func (*Database) RejectPublicURLUsageDelivery 

func (d *Database) RejectPublicURLUsageDelivery(
	ctx context.Context,
	work PublicURLUsageDeliveryWork,
	reason string,
	now time.Time,
) error

func (*Database) ReleaseDNSAuthority 

func (d *Database) ReleaseDNSAuthority(
	ctx context.Context,
	reference, idempotencyKey string,
	now time.Time,
) (result DNSAuthority, retErr error)

func (*Database) ReleaseServicePorts 

func (d *Database) ReleaseServicePorts(ctx context.Context, now time.Time) (int64, error)

quarantine is bounded by real authority, not merely elapsed wall time. a late issuance or unfinished DNS cleanup keeps the old port reserved.

func (*Database) ReleaseTeamDomain 

func (d *Database) ReleaseTeamDomain(
	ctx context.Context,
	identityID, teamID, domainID string,
	now time.Time,
) (retErr error)

func (*Database) ReleaseVisitorIngressAssignment 

func (d *Database) ReleaseVisitorIngressAssignment(ctx context.Context, identityID, sessionID string, now time.Time) (retErr error)

release is idempotent for this person's exact device assignment. pending reservations stop counting immediately; bound sessions and their streams are revoked so active rechecks close them. no sibling assignment is touched.

func (*Database) ReleaseWorkloadIngressAssignment 

func (d *Database) ReleaseWorkloadIngressAssignment(ctx context.Context, credential, session string, now time.Time) (retErr error)

func (*Database) RemoveMembership 

func (d *Database) RemoveMembership(
	ctx context.Context,
	identityID, teamID, membershipID string,
	now time.Time,
) (retErr error)

func (*Database) RenamePublisherGroup 

func (d *Database) RenamePublisherGroup(ctx context.Context, team, project, old, name, actor string, expected int64, now time.Time) (result AppliedProjectConfiguration, retErr error)

rename changes the desired selector, not the durable namespace or credentials. historical names remain bound to this ID so a stale deployment cannot enroll into an unrelated group merely because its old key was reused.

func (*Database) RenamePublisherNamespace 

func (d *Database) RenamePublisherNamespace(ctx context.Context, r RenamePublisherNamespaceRequest) (result AppliedProjectConfiguration, retErr error)

RenamePublisherNamespace changes DNS and publication authority in one transaction. a retry returns the original encrypted response, even after a later mutation. selector rename is deliberately a separate operation.

func (*Database) RenewIngress 

func (d *Database) RenewIngress(
	ctx context.Context,
	renewal IngressRenewal,
	now time.Time,
	leaseDuration time.Duration,
) (result IngressLease, retErr error)

RenewIngress extends one exact, unexpired ingress lease.

func (*Database) RenewRelay 

func (d *Database) RenewRelay(
	ctx context.Context,
	renewal RelayRenewal,
	now time.Time,
	leaseDuration time.Duration,
) (RelayLease, error)

RenewRelay extends one exact, unexpired relay lease.

func (*Database) RenewWorkloadSession 

func (d *Database) RenewWorkloadSession(ctx context.Context, id, credential string, now time.Time) (r WorkloadSession, retErr error)

func (*Database) ReplaceVisitorAccess 

func (d *Database) ReplaceVisitorAccess(ctx context.Context, urlID, actorID string, mode VisitorAccessMode, values []string, expected uint64, now time.Time) (result PublicURL, retErr error)

ReplaceVisitorAccess updates the complete access policy in one transaction. the current publish run and its publisher connections remain unchanged.

func (*Database) ReportIngressUsage 

func (d *Database) ReportIngressUsage(
	ctx context.Context,
	identity IngressLeaseIdentity,
	batch IngressUsageBatch,
	receivedAt time.Time,
) (retErr error)

ReportIngressUsage deduplicates cumulative reports and applies only numeric deltas to aggregate public URL usage buckets.

func (*Database) RequestCompanyAdmission 

func (d *Database) RequestCompanyAdmission(ctx context.Context, p ControlPrincipal, team, connection string, revision int64, slug string, now time.Time) (result CompanyAdmissionRequest, retErr error)

func (*Database) ResolveCompanyAccount 

func (d *Database) ResolveCompanyAccount(ctx context.Context, issuer, subject string) (string, error)

func (*Database) ResolveCompanyEligibilityAccount 

func (d *Database) ResolveCompanyEligibilityAccount(ctx context.Context, issuer, subject string, eligible bool) (string, error)

negative eligibility may offboard a disabled identity, never reactivate it.

func (*Database) ResolveCompanyLoginIntent 

func (d *Database) ResolveCompanyLoginIntent(ctx context.Context, id, binding string, now time.Time) (result CompanyLoginIntent, retErr error)

func (*Database) ResolveLoginTeam 

func (d *Database) ResolveLoginTeam(ctx context.Context, name string) (string, error)

func (*Database) ResolveProjectConfiguration 

func (d *Database) ResolveProjectConfiguration(ctx context.Context, team, actor string, input ProjectConfiguration) (result ProjectConfiguration, retErr error)

resolve names without evaluating source files. apply repeats this read under its mutation transaction; the HTTP boundary uses it before hostname authorization.

func (*Database) RetryPublicURLUsageDelivery 

func (d *Database) RetryPublicURLUsageDelivery(
	ctx context.Context,
	work PublicURLUsageDeliveryWork,
	availableAt time.Time,
	lastError string,
	now time.Time,
) error

func (*Database) ReviewerFeedbackScope 

func (d *Database) ReviewerFeedbackScope(ctx context.Context, auth PublishRunAuthentication, previewID string, actor FeedbackActor, now time.Time) (teamID, publicURLID string, retErr error)

func (*Database) RevokeBrowserSession 

func (d *Database) RevokeBrowserSession(ctx context.Context, publicURLID, token string, now time.Time) error

func (*Database) RevokeControlSession 

func (d *Database) RevokeControlSession(ctx context.Context, principal ControlPrincipal, now time.Time) error

func (*Database) RevokePublisherGrant 

func (d *Database) RevokePublisherGrant(ctx context.Context, team, id, grant, editor string, now time.Time) (retErr error)

func (*Database) RevokePublisherGroupMember 

func (d *Database) RevokePublisherGroupMember(ctx context.Context, team, project, group, publisher, actor string, now time.Time) (retErr error)

func (*Database) RevokePublisherIdentity 

func (d *Database) RevokePublisherIdentity(ctx context.Context, team, id, editor string, now time.Time) (retErr error)

func (*Database) RevokeServiceGrant 

func (d *Database) RevokeServiceGrant(ctx context.Context, serviceID, actorID, grantID string, now time.Time) (retErr error)

func (*Database) RevokeServiceHTTPGrant 

func (d *Database) RevokeServiceHTTPGrant(ctx context.Context, service, actor, id string, now time.Time) (retErr error)

func (*Database) RevokeServiceInvitation 

func (d *Database) RevokeServiceInvitation(ctx context.Context, serviceID, actorID, invitationID string, now time.Time) (retErr error)

func (*Database) RevokeShare 

func (d *Database) RevokeShare(ctx context.Context, id, identityID string, now time.Time) (result Share, retErr error)

func (*Database) RevokeTeamInvitation 

func (d *Database) RevokeTeamInvitation(
	ctx context.Context,
	identityID, teamID, invitationID string,
	now time.Time,
) (retErr error)

func (*Database) RevokeVisitorDevice 

func (d *Database) RevokeVisitorDevice(ctx context.Context, identityID, deviceID string, now time.Time) (retErr error)

func (*Database) RevokeVisitorGrant 

func (d *Database) RevokeVisitorGrant(ctx context.Context, urlID, actorID, grantID string, now time.Time) (retErr error)

func (*Database) RevokeVisitorInvitation 

func (d *Database) RevokeVisitorInvitation(ctx context.Context, urlID, actorID, id string, now time.Time) (retErr error)

func (*Database) RevokeWorkloadSession 

func (d *Database) RevokeWorkloadSession(ctx context.Context, id, credential string, now time.Time) (retErr error)

func (*Database) RotateBrowserSession 

func (d *Database) RotateBrowserSession(ctx context.Context, token, access, refresh string, expiresAt time.Time) error

func (*Database) RotateCompanyProvisioningToken 

func (d *Database) RotateCompanyProvisioningToken(ctx context.Context, p ControlPrincipal, team, id string, revision int64, now time.Time) (result IdentityConnectionSecret, retErr error)

func (*Database) RotatePublisherKey 

func (d *Database) RotatePublisherKey(ctx context.Context, token, sourceIP, replacementID, audience string, public ed25519.PublicKey, proof, currentProof string, now time.Time) (retErr error)

func (*Database) SaveACMEOrderWork 

func (d *Database) SaveACMEOrderWork(
	ctx context.Context,
	work ACMEOrderWork,
	now time.Time,
) (result ACMEOrderWork, retErr error)

func (*Database) SaveDNSAuthorityWork 

func (d *Database) SaveDNSAuthorityWork(
	ctx context.Context,
	work DNSAuthorityWork,
	now time.Time,
) (result DNSAuthorityWork, retErr error)

func (*Database) SaveDNSChallengeChange 

func (d *Database) SaveDNSChallengeChange(ctx context.Context, zoneID, recordName string, desiredDigest [32]byte, changeID string, now time.Time) error

func (*Database) SaveDNSPublicURLWork 

func (d *Database) SaveDNSPublicURLWork(ctx context.Context, work DNSPublicURLWork, now time.Time) (DNSPublicURLWork, error)

func (*Database) SaveRelayCertificateOrderWork 

func (d *Database) SaveRelayCertificateOrderWork(
	ctx context.Context,
	work RelayCertificateOrderWork,
	now time.Time,
) (result RelayCertificateOrderWork, retErr error)

func (*Database) SaveServiceEndpointDNSWork 

func (d *Database) SaveServiceEndpointDNSWork(ctx context.Context, work ServiceEndpointDNSWork, now time.Time) (ServiceEndpointDNSWork, error)

func (*Database) SeedHumanAuthentication 

func (d *Database) SeedHumanAuthentication(ctx context.Context, domain string, seeds HumanAuthenticationSeeds, now time.Time) error

func (*Database) SelectServiceRun 

func (d *Database) SelectServiceRun(ctx context.Context, serviceID, identityID, deviceID string, now time.Time) (result ServiceSelection, retErr error)

func (*Database) SelectVisitorServiceRun 

func (d *Database) SelectVisitorServiceRun(ctx context.Context, serviceID string, subject VisitorSubject, now time.Time) (result ServiceSelection, retErr error)

func (*Database) SelectWorkloadServiceRun 

func (d *Database) SelectWorkloadServiceRun(ctx context.Context, credential, service string, now time.Time) (ServiceSelection, error)

selection authenticates only the workload credential, never a human session. the selected run still needs a new source-bound admission at ingress.

func (*Database) ServiceBrowserSession 

func (d *Database) ServiceBrowserSession(ctx context.Context, auth ServiceHTTPRun, secret string, revoke bool, now time.Time) (result VisitorPermission, retErr error)

func (*Database) ServiceClientIssuer 

func (d *Database) ServiceClientIssuer(ctx context.Context) (*controlvisitor.Issuer, error)

the seed is durable control-only state. losing an individual control process never changes the client issuer, and storage-key rotation preserves its key.

func (*Database) ServiceHTTPBrowserTeam 

func (d *Database) ServiceHTTPBrowserTeam(ctx context.Context, subject httpsubject.Subject, now time.Time) (string, error)

func (*Database) SetCompanyInvitationException 

func (d *Database) SetCompanyInvitationException(ctx context.Context, p ControlPrincipal, team, invitation string, exception bool, now time.Time) (retErr error)

func (*Database) SetMaintenanceControl 

func (d *Database) SetMaintenanceControl(
	ctx context.Context,
	name MaintenanceControlName,
	allowed bool,
	actorIdentityID, requestID string,
	now time.Time,
) (result MaintenanceControl, retErr error)

SetMaintenanceControl updates one gate and records the administrator action in the same transaction.

func (*Database) SetMembershipRole 

func (d *Database) SetMembershipRole(
	ctx context.Context,
	identityID, teamID, membershipID string,
	role TeamRole,
	now time.Time,
) (result Membership, retErr error)

func (*Database) SetPreviewTeamAccess 

func (d *Database) SetPreviewTeamAccess(ctx context.Context, request SetPreviewTeamAccessRequest, now time.Time) (result Preview, retErr error)

func (*Database) SetTeamDefaultDomain 

func (d *Database) SetTeamDefaultDomain(
	ctx context.Context,
	identityID, teamID, domainID string,
	now time.Time,
) (result Team, retErr error)

func (*Database) SetTeamFeedbackPolicy 

func (d *Database) SetTeamFeedbackPolicy(ctx context.Context, identityID, teamID, authors string, now time.Time) (result TeamFeedbackPolicy, retErr error)

func (*Database) StartServiceRun 

func (d *Database) StartServiceRun(ctx context.Context, service, id string, number int64, publisher PublisherIdentity, now time.Time) (result ServiceRunState, retErr error)

publisher authentication authorizes the exact prepared run and captured endpoint. the service's WebPKI certificate authenticates native visitor TLS.

func (*Database) StoreRelayTransportCertificate 

func (d *Database) StoreRelayTransportCertificate(
	ctx context.Context,
	relayServiceID, tlsServerName string,
	certificatePEM, privateKeyPEM []byte,
	now time.Time,
) (RelayTransportCertificate, error)

StoreRelayTransportCertificate validates and encrypts a new relay transport certificate and private key before storing them in PostgreSQL.

func (*Database) UpdateACMEAccountRegistration 

func (d *Database) UpdateACMEAccountRegistration(
	ctx context.Context,
	accountID string,
	contactEmail string,
	accountURL string,
	acceptedTermsURL string,
	now time.Time,
) (ACMEAccount, error)

func (*Database) UpdateAuthorizedPublicURL 

func (d *Database) UpdateAuthorizedPublicURL(
	ctx context.Context,
	request AuthorizedPublicURLUpdateRequest,
	now time.Time,
) (result PublicURL, retErr error)

func (*Database) UpdateCompanyMembershipDecision 

func (d *Database) UpdateCompanyMembershipDecision(ctx context.Context, p ControlPrincipal, team, member string, decision CompanyMembershipDecision, now time.Time) (retErr error)

func (*Database) ValidateServiceEndpointDNSWork 

func (d *Database) ValidateServiceEndpointDNSWork(ctx context.Context, work ServiceEndpointDNSWork, now time.Time) error

func (*Database) VerifyDeviceBrowser 

func (d *Database) VerifyDeviceBrowser(ctx context.Context, code string, binding []byte, identity OIDCIdentity, now time.Time) error

func (*Database) VerifyPublisherGroupIdentity 

func (d *Database) VerifyPublisherGroupIdentity(ctx context.Context, id, group, assertion, audience string, now time.Time) (result PublisherGroupVerification, retErr error)

verification consumes a one-use proof but never rotates the active lease.

func (*Database) WithDNSRecordLock 

func (d *Database) WithDNSRecordLock(ctx context.Context, recordName string, run func() error) (retErr error)

WithDNSRecordLock serializes the stored snapshot and DNS update for one record name across control processes. the dedicated transaction rolls back after the callback returns, releasing its lock; connection loss releases it too. the callback can still read through the pooled runtime connections.

func (*Database) WorkloadAssertionPolicy 

func (d *Database) WorkloadAssertionPolicy(ctx context.Context, id, credential string) (ProjectWorkload, error)

WorkloadAssertionPolicy authenticates the exact session before verifying a rotating assertion. attachment separately fences revocation and expired leases.

func (*Database) WorkloadPolicy 

func (d *Database) WorkloadPolicy(ctx context.Context, team, project, name, source string) (ProjectWorkload, error)

policy lookup returns only the selected trust policy; JWT input cannot choose endpoints.

type DatabaseConnectionCounts 

type DatabaseConnectionCounts struct {
	Open       int64 `json:"open"`
	Connecting int64 `json:"connecting"`
	Opened     int64 `json:"opened_total"`
	Closed     int64 `json:"closed_total"`
	Failed     int64 `json:"connect_failures_total"`
}

counts describe this process's client sockets, not PostgreSQL backend slots. only fixed purpose labels and counters are retained, never connection details.

type DatabaseDiagnostics 

type DatabaseDiagnostics struct {
	CapturedAt          time.Time                           `json:"captured_at"`
	Sessions            []DatabaseSession                   `json:"sessions"`
	Truncated           bool                                `json:"truncated"`
	ActiveOperations    []DatabaseOperation                 `json:"active_operations"`
	OperationsTruncated bool                                `json:"operations_truncated"`
	Connections         map[string]DatabaseConnectionCounts `json:"connections,omitempty"`
	Pooler              *DatabasePoolerDiagnostics          `json:"pooler,omitempty"`
	Error               string                              `json:"error,omitempty"`
}

DatabaseDiagnostics contains bounded, parameter-free PostgreSQL activity.

type DatabaseMetrics 

type DatabaseMetrics struct {
	Pool              *pgxpool.Stat
	ActiveOperations  []DatabaseOperation
	OperationsOmitted int
	Connections       map[string]DatabaseConnectionCounts
}

DatabaseMetrics contains process-local state that is safe to collect on every metrics scrape. it never acquires a database connection.

type DatabaseOperation 

type DatabaseOperation struct {
	Operation      string  `json:"operation"`
	ElapsedSeconds float64 `json:"elapsed_seconds"`
}

type DatabasePoolerClients 

type DatabasePoolerClients struct {
	Total     int  `json:"total"`
	Active    int  `json:"active"`
	Waiting   int  `json:"waiting"`
	Other     int  `json:"other"`
	Truncated bool `json:"truncated"`
}

type DatabasePoolerDiagnostics 

type DatabasePoolerDiagnostics struct {
	Settings map[string]string      `json:"settings,omitempty"`
	Clients  *DatabasePoolerClients `json:"clients,omitempty"`
	Error    string                 `json:"error,omitempty"`
}

PgBouncer may deny its admin console to the runtime user. unavailable values remain absent and carry a sanitized error; they are never inferred from SKU.

type DatabaseSession 

type DatabaseSession struct {
	PID                   int32    `json:"pid"`
	Operation             string   `json:"operation,omitempty"`
	State                 string   `json:"state"`
	WaitType              string   `json:"wait_type"`
	WaitEvent             string   `json:"wait_event"`
	TransactionAgeSeconds *float64 `json:"transaction_age_seconds"`
	QueryAgeSeconds       *float64 `json:"query_age_seconds"`
	QueryID               *int64   `json:"query_id,omitempty"`
	BlockingPIDs          []int32  `json:"blocking_pids"`
	BlockingPIDsTruncated bool     `json:"blocking_pids_truncated"`
}

type DeviceLogin 

type DeviceLogin struct {
	TeamID, PreviousSessionID, ExpectedIdentityID string
	CompanyIntent                                 *CompanyLoginIntent
	UserCode                                      string
	ExpiresAt                                     time.Time
	Status                                        DeviceLoginStatus
	State, Nonce, Verifier                        string
	Binding                                       []byte
	Identity                                      *OIDCIdentity
	Session                                       *ControlSession
}

type DeviceLoginOptions 

type DeviceLoginOptions struct{ Team, RefreshToken string }

type DeviceLoginStatus 

type DeviceLoginStatus string
const (
	DevicePending   DeviceLoginStatus = "pending"
	DeviceApproved  DeviceLoginStatus = "approved"
	DeviceCancelled DeviceLoginStatus = "cancelled"
	DeviceDenied    DeviceLoginStatus = "denied"
)

type DirectVisitorAdmission 

type DirectVisitorAdmission struct {
	ServiceID, RunID, ConnectionID string
	RunNumber                      int64
	ExpiresAt                      time.Time
	Relays                         []ServiceRelay
}

type DirectVisitorState 

type DirectVisitorState string
const (
	DirectVisitorPending       DirectVisitorState = "pending"
	DirectVisitorAuthenticated DirectVisitorState = "authenticated"
	DirectVisitorAllowed       DirectVisitorState = "allowed"
	DirectVisitorDenied        DirectVisitorState = "denied"
)

type DirectVisitorStatus 

type DirectVisitorStatus struct {
	State      DirectVisitorState
	ValidUntil time.Time
}

DirectVisitorStatus distinguishes TLS setup from an authenticated application stream. pending never extends its original admission deadline.

type Domain 

type Domain struct {
	ID                    string
	Kind                  DomainKind
	TeamID                string
	CanonicalDomain       string
	DNSAuthorityReference string
	State                 DomainState
	AuthorityRevision     int64
	RequiredRecords       []DNSRecord
	CreatedAt             time.Time
	VerifiedAt            time.Time
	UpdatedAt             time.Time
}

type DomainKind 

type DomainKind string

DomainKind distinguishes managed and custom team domains. 

const (
	DomainKindManaged DomainKind = "managed"
	DomainKindCustom  DomainKind = "custom"
)

type DomainState 

type DomainState string

DomainState is the stored state of a team domain, including released domains. the team-domain query excludes released domains from public responses. 

const (
	DomainPending   DomainState = "pending"
	DomainReady     DomainState = "ready"
	DomainReleasing DomainState = "releasing"
	DomainReleased  DomainState = "released"
	DomainFailed    DomainState = "failed"
)

type EmailDelivery 

type EmailDelivery struct {
	ID       string
	Owner    string
	Attempts int64
	Payload  authorityv1.EmailDeliveryRequest
}

type ExchangeWorkloadRequest 

type ExchangeWorkloadRequest struct {
	TeamID, ProjectKey, Workload, SourceFingerprint, Nonce string
	Execution                                              oidc.WorkloadExecution
	PublicKey                                              ed25519.PublicKey
	Signature                                              []byte
	Services                                               []string
}

type FeedbackAction 

type FeedbackAction struct {
	Type   string `json:"type"`
	Path   string `json:"path,omitempty"`
	Label  string `json:"label,omitempty"`
	TestID string `json:"test_id,omitempty"`
}

type FeedbackActor 

type FeedbackActor struct {
	SourceIP                 string
	PublishRunAuthentication *PublishRunAuthentication
	Kind                     string
	IdentityID               string
	DisplayName              string
	BrowserCookieSecret      []byte
	TeamMember               bool
	ShareID                  string
	CookieSecret             []byte
	ShareSecret              []byte
	VisitAllowed             bool
	PolicyRevision           uint64
	ExpectedMutationRevision uint64
}

type FeedbackAnchor 

type FeedbackAnchor struct {
	SchemaVersion int      `json:"schema_version"`
	Selectors     []string `json:"selectors"`
	X             float64  `json:"x"`
	Y             float64  `json:"y"`
	Selection     *struct {
		Start FeedbackTextBoundary `json:"start"`
		End   FeedbackTextBoundary `json:"end"`
		Text  string               `json:"text"`
	} `json:"selection,omitempty"`
}

type FeedbackChangedFile 

type FeedbackChangedFile struct {
	Path   string `json:"path"`
	Status string `json:"status"`
	BlobID string `json:"blob_id,omitempty"`
	Mode   string `json:"mode,omitempty"`
}

type FeedbackElement 

type FeedbackElement struct {
	Role   string `json:"role,omitempty"`
	Label  string `json:"label,omitempty"`
	TestID string `json:"test_id,omitempty"`
	HTML   string `json:"html,omitempty"`
}

type FeedbackEvent 

type FeedbackEvent struct {
	SchemaVersion     int
	Cursor            uint64
	FeedbackID        string
	TeamID            string
	Type              FeedbackEventType
	ActorKind         string
	ActorReference    string
	AuthorDisplayName string
	AuthorIdentityID  string
	AuthorVerified    bool
	Text              string
	Evidence          json.RawMessage
	SourceState       json.RawMessage
	At                time.Time
}

type FeedbackEventPage 

type FeedbackEventPage struct {
	Events      []FeedbackEvent
	NextCursor  uint64
	EventCursor uint64
}

type FeedbackEventType 

type FeedbackEventType string
const (
	FeedbackCreated        FeedbackEventType = "thread.created"
	FeedbackReply          FeedbackEventType = "reply"
	FeedbackUpdate         FeedbackEventType = "update"
	FeedbackThreadResolved FeedbackEventType = "thread.resolved"
	FeedbackThreadReopened FeedbackEventType = "thread.reopened"
)

type FeedbackEvidence 

type FeedbackEvidence struct {
	SchemaVersion  int                     `json:"schema_version"`
	Element        *FeedbackElement        `json:"element,omitempty"`
	Actions        []FeedbackAction        `json:"actions"`
	FailedRequests []FeedbackFailedRequest `json:"failed_requests"`
}

type FeedbackFailedRequest 

type FeedbackFailedRequest struct {
	Method     string `json:"method"`
	Path       string `json:"path"`
	Status     int    `json:"status"`
	DurationMS int    `json:"duration_ms"`
}

type FeedbackTextBoundary 

type FeedbackTextBoundary struct {
	Selectors []string `json:"selectors"`
	TextNode  int      `json:"text_node"`
	Offset    int      `json:"offset"`
}

type FeedbackThread 

type FeedbackThread struct {
	SchemaVersion     int
	ID                string
	PreviewID         string
	TeamID            string
	PublicURLID       string
	PublishRunID      string
	PublishRunNumber  uint64
	Service           string
	PagePath          string
	PageTitle         string
	MessageCount      uint64
	LatestEventCursor uint64
	State             FeedbackThreadState
	ReportText        string
	AuthorDisplayName string
	AuthorIdentityID  string
	AuthorVerified    bool
	Anchor            json.RawMessage
	Evidence          json.RawMessage
	SourceAtReport    json.RawMessage
	CreatedAt         time.Time
	StateUpdatedAt    time.Time
}

type FeedbackThreadPage 

type FeedbackThreadPage struct {
	Threads     []FeedbackThread
	NextCursor  string
	EventCursor uint64
}

type FeedbackThreadState 

type FeedbackThreadState string
const (
	FeedbackOpen     FeedbackThreadState = "open"
	FeedbackResolved FeedbackThreadState = "resolved"
)

type GetLocalProjectServiceRequest 

type GetLocalProjectServiceRequest struct {
	TeamID, ProjectKey, SourceFingerprint, Service, WorktreeKey, ActorID string
	Now                                                                  time.Time
}

type GetProjectServiceRequest 

type GetProjectServiceRequest struct {
	TeamID, ProjectKey, SourceFingerprint, Service, IdentityID string
	Now                                                        time.Time
}

type GuestTrial 

type GuestTrial struct {
	ID                    string
	NamespaceLabel        string
	TeamID                string
	MembershipID          string
	DomainID              string
	DNSAuthorityReference string
	SourceIPDigest        string
	SourceIPKeyID         string
	ExpiresAt             time.Time
	UsedReady             time.Duration
	UsedBytes             int64
	LastDemoNumber        int64
}

type GuestTrialStats 

type GuestTrialStats struct {
	Issued        int64
	Allocated     int64
	Ready         int64
	Expired       int64
	ReadyLimit    int64
	TransferLimit int64
}

type HTTPVisitorRequest 

type HTTPVisitorRequest struct {
	SourceIP, BrowserCookieSecret, ShareID string
	ShareCookieSecret, ShareSecret         []byte
}

type HumanAuthenticationSeeds 

type HumanAuthenticationSeeds struct {
	Issuer             string
	Administrators     []string
	TeamOwners         map[string]string
	DefaultTeam        string
	DefaultTeamMembers []string
}

HumanAuthenticationSeeds are explicit identities at one exact configured issuer. each privilege seed is applied once, never reconciled on restart.

type IPPolicy 

type IPPolicy string

IPPolicy is the stored visitor address policy for a public URL. 

const (
	IPPolicyAllowAll        IPPolicy = "allow_all"
	IPPolicyAllowlist       IPPolicy = "allowlist"
	IPPolicyHashedAllowlist IPPolicy = "hashed_allowlist"
)

type Identity 

type Identity struct {
	ID              string
	DisplayName     string
	NormalizedEmail string
	EmailVerified   bool
	Administrator   bool
	CreatedAt       time.Time
}

type IdentityConnection 

type IdentityConnection struct {
	ID        string `json:"identity_connection_id"`
	TeamID    string `json:"team_id"`
	Issuer    string `json:"issuer"`
	Admission string `json:"admission"`
	State     string `json:"state"`
	Revision  int64  `json:"revision"`
	SourceID  string `json:"source_id"`
}

type IdentityConnectionSecret 

type IdentityConnectionSecret struct {
	IdentityConnection
	ProvisioningToken string `json:"provisioning_token"`
}

type IdentityConnectionSetup 

type IdentityConnectionSetup struct {
	IdentityConnection
	SetupToken string    `json:"setup_token"`
	ExpiresAt  time.Time `json:"expires_at"`
}

type IdentityContext 

type IdentityContext struct {
	Identity       Identity
	PersonalTeamID string
	DefaultTeamID  string
	Memberships    []Membership
}

type IngressLease 

type IngressLease struct {
	IngressLeaseIdentity
	ProtocolVersion        uint64
	ConnectionCapacity     uint64
	ReportedConnections    uint64
	RoutingTableRevision   uint64
	VisitorNetworkHashKeys [2]VisitorNetworkHashKey
	Draining               bool
	DrainDeadline          *time.Time
	RegisteredAt           time.Time
	RenewedAt              time.Time
	LeaseExpiresAt         time.Time
}

IngressLease is the control-issued lease for one ingress process.

type IngressLeaseIdentity 

type IngressLeaseIdentity struct {
	IngressID            string
	IngressRunID         string
	IngressLeaseRevision uint64
}

IngressLeaseIdentity identifies one exact ingress process lease.

type IngressPool 

type IngressPool struct {
	ID          string
	IPv4Address netip.Addr
	IPv6Address netip.Addr
	State       IngressPoolState
}

IngressPool identifies one public ingress address group shared by ingress processes.

type IngressPoolState 

type IngressPoolState string
const (
	IngressPoolDisabled IngressPoolState = "disabled"
	IngressPoolEnabled  IngressPoolState = "enabled"
	IngressPoolDraining IngressPoolState = "draining"
)

type IngressRegistration 

type IngressRegistration struct {
	IngressID                                string
	IngressRunID                             string
	ProtocolVersion                          uint64
	ConnectionCapacity                       uint64
	IngressPoolID                            string
	ServicePorts                             []int32
	ConnectorAddress, ConnectorTLSServerName string
}

IngressRegistration describes one ingress process run.

type IngressRenewal 

type IngressRenewal struct {
	IngressLeaseIdentity
	ReportedConnections  uint64
	RoutingTableRevision uint64
}

IngressRenewal reports load and applied routing-table state.

type IngressRoutingTableEvent 

type IngressRoutingTableEvent struct {
	RoutingTableRevision uint64
	Kind                 IngressRoutingTableEventKind
	PublicURLID          string
	PublishRunNumber     uint64
	CanonicalHostname    string
	EntryRevision        uint64
	Projection           IngressRoutingTableProjection
	PublicUrlExpiresAt   *time.Time
	CreatedAt            time.Time
}

IngressRoutingTableEvent is one stored, ordered projection update.

type IngressRoutingTableEventKind 

type IngressRoutingTableEventKind string

IngressRoutingTableEventKind identifies one routing-table projection mutation. 

const (
	IngressPublicURLUpsert    IngressRoutingTableEventKind = "public_url_upsert"
	IngressPublicURLTombstone IngressRoutingTableEventKind = "public_url_tombstone"
)

type IngressRoutingTablePage 

type IngressRoutingTablePage struct {
	ThroughRevision       uint64
	RetainedAfterRevision uint64
	NextRevision          uint64
	More                  bool
	ResnapshotRequired    bool
	Events                []IngressRoutingTableEvent
}

IngressRoutingTablePage is an ordered revision response.

type IngressRoutingTableProjection 

type IngressRoutingTableProjection struct {
	PublishRunID         string                                   `json:"publish_run_id"`
	PublishRunClosed     bool                                     `json:"publish_run_closed,omitempty"`
	PublicURLID          string                                   `json:"public_url_id"`
	PublishRunNumber     uint64                                   `json:"publish_run_number"`
	CanonicalHostname    string                                   `json:"canonical_hostname"`
	IngressPoolID        string                                   `json:"ingress_pool_id,omitempty"`
	ServiceProtocol      PublicURLServiceProtocol                 `json:"service_protocol,omitempty"`
	Traffic              *trafficlimits.Limits                    `json:"traffic,omitempty"`
	PolicyRevision       uint64                                   `json:"policy_revision"`
	AccessMode           VisitorAccessMode                        `json:"access_mode"`
	IPPolicy             IPPolicy                                 `json:"ip_policy"`
	AllowedIPHashes      []ippolicy.Entry                         `json:"allowed_ip_hashes,omitempty"`
	IPPolicyKeyID        string                                   `json:"ip_policy_key_id,omitempty"`
	IPPolicyKey          [32]byte                                 `json:"-"`
	PublicUrlExpiresAt   time.Time                                `json:"public_url_expires_at"`
	RecoveryEpisodeID    *uint64                                  `json:"recovery_episode_id,omitempty"`
	PublisherConnections []IngressRoutingTablePublisherConnection `json:"publisher_connections"`
}

IngressRoutingTableProjection is the stored public URL view used by ingress.

type IngressRoutingTablePublisherConnection 

type IngressRoutingTablePublisherConnection struct {
	ConnectionSlot               int       `json:"connection_slot"`
	PublisherConnectionID        string    `json:"publisher_connection_id"`
	ConnectionAssignmentRevision uint64    `json:"connection_assignment_revision"`
	RelayServiceID               string    `json:"relay_service_id"`
	RelayID                      string    `json:"relay_id"`
	RelayRunID                   string    `json:"relay_run_id"`
	RelayLeaseRevision           uint64    `json:"relay_lease_revision"`
	InternalRelayAddress         string    `json:"internal_relay_address"`
	TLSServerName                string    `json:"tls_server_name"`
	LeaseExpiresAt               time.Time `json:"lease_expires_at"`
	AvailableStreams             *int64    `json:"available_streams,omitempty"`
}

IngressRoutingTablePublisherConnection identifies one connected relay that ingress may use for a visitor connection.

type IngressRoutingTableSnapshot 

type IngressRoutingTableSnapshot struct {
	RoutingTableRevision  uint64
	RetainedAfterRevision uint64
	Entries               []IngressRoutingTableEvent
}

IngressRoutingTableSnapshot is a repeatable-read view through one revision.

type IngressTransportCertificate 

type IngressTransportCertificate struct {
	IngressTransportTrust
	PrivateKeyPEM string
}

private key material is returned only on the cluster-authenticated node API. visitor trust responses contain only IngressTransportTrust.

func (IngressTransportCertificate) GoString 

func (IngressTransportCertificate) GoString() string

func (IngressTransportCertificate) String 

func (IngressTransportCertificate) String() string

type IngressTransportTrust 

type IngressTransportTrust struct {
	IngressLeaseIdentity
	TLSServerName, CertificatePEM, IssuerPEM, PublicKeySHA256, LeaseURI string
	IssuerRevision                                                      int64
	NotBefore, NotAfter, ValidUntil                                     time.Time
}

type IngressUsageBatch 

type IngressUsageBatch struct {
	Reports         []IngressUsageReport
	ObservedThrough *time.Time
	Complete        bool
}

IngressUsageBatch advances one ingress process run only after every report through the optional watermark has been committed.

type IngressUsageReport 

type IngressUsageReport struct {
	PublicURLID               string
	PublishRunNumber          uint64
	BucketStart               time.Time
	BucketEnd                 time.Time
	ObservedThrough           time.Time
	ReportRevision            uint64
	ConnectionAttempts        uint64
	PolicyDenials             uint64
	CapacityDenials           uint64
	VisitorStreamOpenFailures uint64
	SuccessfulStreams         uint64
	ConnectionNanoseconds     uint64
	IngressBytes              uint64
	EgressBytes               uint64
	HistogramData             []byte
	Final                     bool
}

IngressUsageReport contains cumulative usage for one ingress process, public URL, publish run number, and time bucket.

type Invitation 

type Invitation struct {
	PersonalAccountException   bool
	ID                         string
	TeamID                     string
	MemberSlug                 string
	InitialRole                TeamRole
	NormalizedEmailRestriction string
	State                      InvitationState
	CreatedAt                  time.Time
	ExpiresAt                  time.Time
}

type InvitationPreview 

type InvitationPreview struct {
	TeamDisplayName string
	InitialRole     TeamRole
	ExpiresAt       time.Time
}

type InvitationSecret 

type InvitationSecret struct {
	Invitation Invitation
	Secret     string
}

type InvitationState 

type InvitationState string

InvitationState is the stored state of a team invitation. 

const (
	InvitationPending  InvitationState = "pending"
	InvitationAccepted InvitationState = "accepted"
	InvitationRevoked  InvitationState = "revoked"
	InvitationExpired  InvitationState = "expired"
)

type LocalProjectService 

type LocalProjectService struct {
	Service     string           `json:"service"`
	WorktreeKey string           `json:"worktree_key"`
	Kind        string           `json:"service_kind"`
	ServiceID   string           `json:"service_id"`
	Hostname    string           `json:"hostname,omitempty"`
	Metadata    *ServiceMetadata `json:"metadata,omitempty"`
}

type LocalServiceSource 

type LocalServiceSource struct {
	ProjectKey        string `json:"project_key"`
	SourceFingerprint string `json:"source_fingerprint"`
	Service           string `json:"service"`
	WorktreeKey       string `json:"worktree_key"`
}

type MaintenanceControl 

type MaintenanceControl struct {
	Name      MaintenanceControlName
	Allowed   bool
	Revision  uint64
	UpdatedAt time.Time
	UpdatedBy string
}

MaintenanceControl is one stored gate for starting new work.

type MaintenanceControlName 

type MaintenanceControlName string
const (
	MaintenanceControlPublicURLCreation   MaintenanceControlName = "public_url_creation"
	MaintenanceControlPublishRunCreation  MaintenanceControlName = "publish_run_creation"
	MaintenanceControlCertificateIssuance MaintenanceControlName = "certificate_issuance"
)

type Membership 

type Membership struct {
	TeamManagedLabel         string
	IdentityConnectionID     string
	ManualSuspendedAt        time.Time
	PersonalAccountException bool
	CompanySignInRequired    bool
	Active                   bool
	ID                       string
	TeamID                   string
	IdentityID               string
	TeamDisplayName          string
	TeamKind                 TeamKind
	Role                     TeamRole
	MemberSlug               string
	ManagedLabel             string
	PolicyRevision           int64
	CreatedAt                time.Time
	UpdatedAt                time.Time
}

type NewGuestTrial 

type NewGuestTrial struct {
	GuestTrial
	Token        credentials.AccessToken
	CredentialID credentials.CredentialID
	Hash         credentials.SecretHash
	SourceIP     netip.Addr
}

func NewGuestTrialCredential 

func NewGuestTrialCredential(sourceIP netip.Addr) (NewGuestTrial, error)

type OIDCIdentity 

type OIDCIdentity struct {
	Issuer                 string
	Subject                string
	DisplayName            string
	NormalizedEmail        string
	EmailVerified          bool
	AssertionDigest        [32]byte
	AssertionID            string
	AssertionExpiry        time.Time
	TeamContexts           []oidc.TeamContext
	Nonce                  string
	ClientID               string
	IssuedAt               time.Time
	CompanyIntent          *CompanyIntentBinding
	AuthenticatedAt        time.Time
	TenantID, HostedDomain string
	Groups                 []string
}

OIDCIdentity contains the limited identity and assertion fields verified from an ID token.

type Preview 

type Preview struct {
	SchemaVersion       int
	ID                  string
	TeamID              string
	CreatedByIdentityID string
	PublicURLIDs        []string
	TeamAccessEnabled   bool
	CreatedAt           time.Time
}

type ProjectApplicationRate 

type ProjectApplicationRate struct {
	Count int    `json:"count"`
	Per   string `json:"per"`
	Burst *int   `json:"burst,omitempty"`
}

type ProjectConfiguration 

type ProjectConfiguration struct {
	Workloads       map[string]ProjectWorkload             `json:"workloads,omitempty"`
	PublisherGroups map[string]ProjectPublisherGroup       `json:"publisher_groups"`
	Services        map[string]ProjectServiceConfiguration `json:"services"`
	OAuth           bool                                   `json:"oauth"`
	Webhooks        map[string]ProjectWebhook              `json:"webhooks"`
}

func NormalizeProjectConfiguration 

func NormalizeProjectConfiguration(input ProjectConfiguration) (ProjectConfiguration, string, error)

normalize a declarative value only. server code never evaluates project files.

type ProjectHTTPApplicationLimits 

type ProjectHTTPApplicationLimits struct {
	Total       *int                    `json:"total,omitempty"`
	Concurrency *int                    `json:"concurrency,omitempty"`
	Rate        *ProjectApplicationRate `json:"rate,omitempty"`
}

type ProjectPublicAccess 

type ProjectPublicAccess struct {
	Mode string   `json:"mode,omitempty"`
	IP   []string `json:"ip,omitempty"`
}

type ProjectPublicLimits 

type ProjectPublicLimits struct {
	HTTP    *ProjectHTTPApplicationLimits `json:"http,omitempty"`
	Traffic *trafficlimits.Selection      `json:"traffic,omitempty"`
}

type ProjectPublicMetadata 

type ProjectPublicMetadata struct {
	SourceFingerprint string                 `json:"source_fingerprint"`
	Services          []ProjectPublicService `json:"services"`
}

type ProjectPublicService 

type ProjectPublicService struct {
	Service     string `json:"service"`
	PublicURLID string `json:"public_url_id,omitempty"`
	ServiceID   string `json:"service_id,omitempty"`
	Port        int    `json:"port"`
	Hostname    string `json:"hostname"`
}

type ProjectPublisherGroup 

type ProjectPublisherGroup struct {
	Description string `json:"description,omitempty"`
	DomainID    string `json:"domain_id,omitempty"`
	Public      bool   `json:"public,omitempty"`
}

type ProjectServiceAccess 

type ProjectServiceAccess struct {
	Team bool `json:"team"`
}

type ProjectServiceConfiguration 

type ProjectServiceConfiguration struct {
	TargetDiscovery *ProjectTargetDiscovery  `json:"target_discovery,omitempty"`
	PublisherGroup  string                   `json:"publisher_group,omitempty"`
	Name            string                   `json:"name,omitempty"`
	Protocol        string                   `json:"protocol,omitempty"`
	Target          string                   `json:"target"`
	PublicURL       *ProjectServicePublicURL `json:"public_url,omitempty"`
	TargetTLS       *ProjectTargetTLS        `json:"target_tls,omitempty"`
	Access          *ProjectServiceAccess    `json:"access,omitempty"`
	HTTP            *config.HTTPService      `json:"http,omitempty"`
}

type ProjectServicePublicURL 

type ProjectServicePublicURL struct {
	DomainID  string               `json:"domain_id,omitempty"`
	Hostname  string               `json:"hostname,omitempty"`
	Access    *ProjectPublicAccess `json:"access,omitempty"`
	Limits    *ProjectPublicLimits `json:"limits,omitempty"`
	Ephemeral bool                 `json:"ephemeral,omitempty"`
}

type ProjectTargetDiscovery 

type ProjectTargetDiscovery struct {
	Type     string  `json:"type"`
	Region   string  `json:"region"`
	Cluster  *string `json:"cluster,omitempty"`
	Instance *string `json:"instance,omitempty"`
	Endpoint *string `json:"endpoint,omitempty"`
}

ProjectTargetDiscovery is handed unchanged to the assigned publisher. no resolved address, provider credential, application credential or local CA path is supplied by apply. protocol verification and target trust belong to discovery.

func (*ProjectTargetDiscovery) Normalize 

func (t *ProjectTargetDiscovery) Normalize(protocol string) (*ProjectTargetDiscovery, error)

Normalize returns a fresh descriptor with explicit defaults. validation never changes a stored descriptor or a caller's source configuration.

func (*ProjectTargetDiscovery) Validate 

func (t *ProjectTargetDiscovery) Validate(protocol string) error

type ProjectTargetTLS 

type ProjectTargetTLS struct {
	Hostname string `json:"hostname"`
	CAPEM    string `json:"ca_pem,omitempty"`
	Digest   string `json:"digest"`
}

type ProjectWebhook 

type ProjectWebhook struct {
	Service   string   `json:"service"`
	Path      string   `json:"path"`
	Provider  string   `json:"provider"`
	Delivery  string   `json:"delivery,omitempty"`
	Methods   []string `json:"methods,omitempty"`
	SourceIPs []string `json:"source_ips,omitempty"`
}

type ProjectWorkload 

type ProjectWorkload struct {
	Provider           string                 `json:"provider"`
	Trust              oidc.WorkloadTrust     `json:"trust"`
	GitHub             *ProjectWorkloadGitHub `json:"github,omitempty"`
	Services           []string               `json:"services"`
	MaxDurationSeconds int                    `json:"max_duration_seconds"`
}

type ProjectWorkloadGitHub 

type ProjectWorkloadGitHub struct {
	Repository        string   `json:"repository"`
	RepositoryID      string   `json:"repository_id"`
	RepositoryOwnerID string   `json:"repository_owner_id"`
	WorkflowRef       string   `json:"workflow_ref"`
	Ref               string   `json:"ref"`
	Events            []string `json:"events"`
	Environment       string   `json:"environment,omitempty"`
	JobWorkflowRef    string   `json:"job_workflow_ref,omitempty"`
}

type ProvisionCompanyEligibilityRequest 

type ProvisionCompanyEligibilityRequest struct {
	TeamID               string    `json:"team_id"`
	IdentityConnectionID string    `json:"identity_connection_id"`
	ConnectionRevision   int64     `json:"connection_revision"`
	IdentityID           string    `json:"identity_id"`
	Subject              string    `json:"subject"`
	Revision             int64     `json:"revision"`
	Eligible             bool      `json:"eligible"`
	ValidUntil           time.Time `json:"valid_until"`
	MemberSlug           string    `json:"member_slug"`
}

type PublicURL 

type PublicURL struct {
	ID                            string
	TeamID                        string
	DomainID                      string
	MembershipID                  string
	CanonicalHostname             string
	Namespace                     string
	Target                        string
	ServiceProtocol               PublicURLServiceProtocol
	PublisherPool                 bool
	PublicURLScope                PublicURLScope
	Purpose                       PublicURLPurpose
	AccessMode                    VisitorAccessMode
	PolicyRevision                int64
	LifecycleState                PublicURLLifecycleState
	DNSAuthorityReference         string
	DNSState                      PublicURLDNSState
	AllowedIPPrefixes             []netip.Prefix
	NextPublishRunNumber          int64
	MutationRevision              uint64
	AuthorizationPublishRunNumber uint64
	Ephemeral                     bool
	ExpiresAt                     *time.Time
	OpenPublishRunID              string
	CreatedAt                     time.Time
	UpdatedAt                     time.Time
}

type PublicURLDNSState 

type PublicURLDNSState string

PublicURLDNSState is the stored state of public URL DNS. 

const (
	PublicURLDNSUnmanaged PublicURLDNSState = "unmanaged"
	PublicURLDNSPending   PublicURLDNSState = "pending"
	PublicURLDNSPublished PublicURLDNSState = "published"
	PublicURLDNSRemoving  PublicURLDNSState = "removing"
	PublicURLDNSRemoved   PublicURLDNSState = "removed"
	PublicURLDNSFailed    PublicURLDNSState = "failed"
)

type PublicURLLifecycleState 

type PublicURLLifecycleState string

PublicURLLifecycleState is the stored state of a public URL. 

const (
	PublicURLLifecycleEnabled   PublicURLLifecycleState = "enabled"
	PublicURLLifecycleSuspended PublicURLLifecycleState = "suspended"
	PublicURLLifecycleDeleted   PublicURLLifecycleState = "deleted"
)

type PublicURLPage 

type PublicURLPage struct {
	PublicURLs []PublicURL
	NextCursor string
}

type PublicURLPurpose 

type PublicURLPurpose string

PublicURLPurpose is the immutable, client-declared use of a saved public URL. 

const (
	PublicURLPurposeApp      PublicURLPurpose = "app"
	PublicURLPurposeAlias    PublicURLPurpose = "alias"
	PublicURLPurposeDemo     PublicURLPurpose = "demo"
	PublicURLPurposeOAuth    PublicURLPurpose = "oauth"
	PublicURLPurposeWebhooks PublicURLPurpose = "webhooks"
)

func (PublicURLPurpose) ValidForCreation 

func (p PublicURLPurpose) ValidForCreation() bool

type PublicURLRecoveryObservation 

type PublicURLRecoveryObservation struct {
	RecoveryEpisodeID uint64
	PublicURLID       string
	PublishRunNumber  uint64
	OpenedAt          time.Time
	ObservedAt        time.Time
	ObservedSeconds   float64
}

PublicURLRecoveryObservation is one stored public URL recovery measurement.

type PublicURLScope 

type PublicURLScope string

PublicURLScope identifies whether a public URL belongs to one membership or a team. 

const (
	PublicURLScopeMember PublicURLScope = "member"
	PublicURLScopeShared PublicURLScope = "shared"
)

type PublicURLServiceProtocol 

type PublicURLServiceProtocol string

PublicURLServiceProtocol selects the visitor handshake at the publisher. 

const (
	PublicURLServiceHTTP PublicURLServiceProtocol = "http"
)

func (PublicURLServiceProtocol) Valid 

func (protocol PublicURLServiceProtocol) Valid() bool

func (PublicURLServiceProtocol) ValidCreateTarget 

func (protocol PublicURLServiceProtocol) ValidCreateTarget(purpose PublicURLPurpose, target string, ephemeral bool) bool

ValidCreateTarget checks how a public URL receives its local target.

type PublicURLUsageDeliveryWork 

type PublicURLUsageDeliveryWork struct {
	DeliveryID                uint64
	DeliveryKey               string
	SourceRevision            uint64
	PublicURLID               string
	PublishRunNumber          uint64
	TeamID                    string
	ActingIdentityID          string
	BucketStart               time.Time
	BucketEnd                 time.Time
	ObservedThrough           time.Time
	ConnectionAttempts        uint64
	PolicyDenials             uint64
	CapacityDenials           uint64
	VisitorStreamOpenFailures uint64
	SuccessfulStreams         uint64
	ConnectionNanoseconds     uint64
	IngressBytes              uint64
	EgressBytes               uint64
	Checkpoint                publicurlusage.Checkpoint
	Complete                  bool
	Attempts                  uint64
	WorkerID                  string
	WorkEpoch                 uint64
	WorkExpiresAt             time.Time
}

PublicURLUsageDeliveryWork is one immutable finalized bucket held under a PostgreSQL work lease.

type PublishRunAuthentication 

type PublishRunAuthentication struct {
	PublishRunID     string
	PublicURLID      string
	PublishRunNumber uint64
	PublishRunToken  credentials.PublishRunToken
}

PublishRunAuthentication binds a publish run credential to one exact publish run number.

type PublishRunLifecycle 

type PublishRunLifecycle struct {
	PublishRunID                  string
	PublicURLID                   string
	TeamID                        string
	MembershipID                  string
	PublishRunNumber              uint64
	PolicyRevision                uint64
	State                         PublishRunState
	CreatedAt                     time.Time
	ExpiresAt                     time.Time
	ReadyAt                       *time.Time
	CertificateAt                 *time.Time
	ClosedAt                      *time.Time
	ReadyPublisherConnectionCount int
	Routable                      bool
	RoutingTableRevision          uint64
	PublicURLEntryRevision        uint64
}

PublishRunLifecycle reports saved readiness and current publisher connection availability.

type PublishRunNotReadyError 

type PublishRunNotReadyError struct {
	CertificateInstalled          bool
	ReadyPublisherConnectionCount int
	DNSState                      PublicURLDNSState
	CreatedAt                     time.Time
}

PublishRunNotReadyError reports the prerequisites checked under the public URL and publish run locks. it does not contain credentials or certificate material.

func (*PublishRunNotReadyError) Error 

func (e *PublishRunNotReadyError) Error() string

func (*PublishRunNotReadyError) Reason 

func (e *PublishRunNotReadyError) Reason() readiness.Outcome

func (*PublishRunNotReadyError) Unwrap 

func (e *PublishRunNotReadyError) Unwrap() error

type PublishRunRequest 

type PublishRunRequest struct {
	PublicURLID              string
	TeamID                   string
	MembershipID             string
	ActingIdentityID         string
	GuestID                  string
	RetrySecret              []byte
	IdempotencyKey           string
	RequestDigest            [32]byte
	PolicyRevision           uint64
	CertificateCacheKey      string
	CertificateScope         string
	CertificateIdentifiers   []string
	CertificateChallenge     certificateidentity.ChallengeMethod
	ExpectedMutationRevision uint64
	PublisherIdentityID      string
	PublisherGrantID         string
	PublisherKeyID           string
	PublisherRunProof        string
	PublisherSourceIP        string
	TrafficSelection         *trafficlimits.Selection
	TrafficDefaults          trafficlimits.Limits
	TrafficCeiling           trafficlimits.Limits
}

PublishRunRequest carries authority already established by the control API and the authenticated request secret used for retry-stable credentials.

type PublishRunSetup 

type PublishRunSetup struct {
	PublishRunID          string
	PublicURLID           string
	TeamID                string
	MembershipID          string
	PublishRunNumber      uint64
	PolicyRevision        uint64
	PublishRunToken       credentials.PublishRunToken
	State                 PublishRunState
	CreatedAt             time.Time
	ExpiresAt             time.Time
	ReadyAt               *time.Time
	ClosedAt              *time.Time
	PolicyDenials         uint64
	VisitorPolicyRevision int64
	Traffic               trafficlimits.Limits
	PublisherConnections  [publishRunConnectionCount]ConnectionAssignment
}

PublishRunSetup is the retry-stable result of publish-run creation.

type PublishRunState 

type PublishRunState string

PublishRunState is the stored state of one publish run. 

const (
	PublishRunStarting PublishRunState = "starting"
	PublishRunReady    PublishRunState = "ready"
	PublishRunClosed   PublishRunState = "closed"
	PublishRunExpired  PublishRunState = "expired"
	PublishRunCanceled PublishRunState = "canceled"
)

type PublisherAccess 

type PublisherAccess struct {
	PublisherIdentity
	Token string
	Until time.Time
}

type PublisherConnectionClaimRequest 

type PublisherConnectionClaimRequest struct {
	ConnectionAssignmentIdentity
	RelayLeaseIdentity
	ClaimID          string
	CredentialDigest [32]byte
}

PublisherConnectionClaimRequest contains the assignment, relay lease, and credential hash needed to claim one publisher connection in a transaction.

type PublisherConnectionState 

type PublisherConnectionState string

PublisherConnectionState is the stored state of one connection slot. 

const (
	PublisherConnectionAssigned  PublisherConnectionState = "assigned"
	PublisherConnectionConnected PublisherConnectionState = "connected"
	PublisherConnectionReady     PublisherConnectionState = "ready"
	PublisherConnectionDraining  PublisherConnectionState = "draining"
	PublisherConnectionClosed    PublisherConnectionState = "closed"
	PublisherConnectionExpired   PublisherConnectionState = "expired"
)

type PublisherEnrollment 

type PublisherEnrollment struct {
	ID, Key string
	Scope   PublisherScope
	Until   time.Time
}

type PublisherGroupAssignments 

type PublisherGroupAssignments struct {
	Member                PublisherGroupMember              `json:"member"`
	Revision              int64                             `json:"revision"`
	ConfigurationHash     string                            `json:"configuration_hash"`
	Services              []PublisherGroupServiceAssignment `json:"services"`
	CertificateStatePlans []CertificatePlan                 `json:"certificate_state_plans"`
}

type PublisherGroupEnrollment 

type PublisherGroupEnrollment struct {
	Key        string    `json:"enrollment_key"`
	GroupID    string    `json:"group_id"`
	ExpiresAt  time.Time `json:"expires_at"`
	MaxMembers int       `json:"max_members"`
}

type PublisherGroupLease 

type PublisherGroupLease struct {
	AccessToken string    `json:"access_token"`
	ExpiresAt   time.Time `json:"expires_at"`
}

type PublisherGroupMember 

type PublisherGroupMember struct {
	TeamID              string `json:"team_id"`
	ProjectKey          string `json:"project_key"`
	GroupID             string `json:"group_id"`
	GroupName           string `json:"group_name"`
	PublisherIdentityID string `json:"publisher_identity_id"`
	KeyID               string `json:"key_id"`
}

type PublisherGroupMemberStatus 

type PublisherGroupMemberStatus struct {
	PublisherGroupMember
	Runtime          *PublisherRuntimeStatus `json:"runtime,omitempty"`
	ObservedRevision int64                   `json:"observed_revision"`
	CurrentRevision  int64                   `json:"current_revision"`
	SnapshotAt       time.Time               `json:"snapshot_at"`
	AcknowledgedAt   *time.Time              `json:"acknowledged_at,omitempty"`
	Healthy          bool                    `json:"healthy"`
	LeaseExpiresAt   *time.Time              `json:"lease_expires_at,omitempty"`
}

type PublisherGroupServiceAssignment 

type PublisherGroupServiceAssignment struct {
	Service       string                      `json:"service"`
	ServiceID     string                      `json:"service_id"`
	Kind          string                      `json:"service_kind"`
	GrantID       string                      `json:"grant_id"`
	Hostname      string                      `json:"hostname,omitempty"`
	TrustRevision int64                       `json:"trust_revision"`
	Configuration ProjectServiceConfiguration `json:"configuration"`
}

type PublisherGroupVerification 

type PublisherGroupVerification struct {
	Member     PublisherGroupMember `json:"member"`
	GroupNames []string             `json:"group_names"`
}

type PublisherIdentity 

type PublisherIdentity struct {
	ID, KeyID, GrantID, CreatorID, Kind, GuestID string
	Ownership, OwnerMembershipID                 string
	Scope                                        PublisherScope
}

type PublisherIdentityPage 

type PublisherIdentityPage struct {
	Identities []PublisherRecord
	NextCursor string
}

type PublisherRecord 

type PublisherRecord struct {
	Identity controlstatedb.ControlPublisherIdentity
	Grants   []controlstatedb.ControlPublisherGrant
	Runtime  *PublisherRuntimeStatus
}

type PublisherRuntimeRequest 

type PublisherRuntimeRequest struct {
	PublisherIdentityID string
	ScopeID             string
	ProcessRunID        string
	Action              string
	Assertion           string
	Audience            string
	SourceIP            string
	ExpectedEpoch       int64
	Now                 time.Time
	Deployment          *controlv1.PublisherDeploymentReport
}

type PublisherRuntimeResponse 

type PublisherRuntimeResponse struct {
	Epoch          int64                `json:"epoch"`
	LeaseExpiresAt *time.Time           `json:"lease_expires_at,omitempty"`
	GroupLease     *PublisherGroupLease `json:"group_lease,omitempty"`
}

type PublisherRuntimeStatus 

type PublisherRuntimeStatus struct {
	PublisherIdentityID string                                    `json:"publisher_identity_id"`
	TeamID              string                                    `json:"team_id"`
	ProcessRunID        string                                    `json:"process_run_id"`
	Epoch               int64                                     `json:"epoch"`
	Evidence            string                                    `json:"evidence"`
	Address             string                                    `json:"address,omitempty"`
	AddressFamily       string                                    `json:"address_family"`
	StartedAt           time.Time                                 `json:"started_at"`
	ObservedAt          time.Time                                 `json:"observed_at"`
	LastSeenAt          time.Time                                 `json:"last_seen_at"`
	LeaseExpiresAt      time.Time                                 `json:"lease_expires_at"`
	StoppedAt           *time.Time                                `json:"stopped_at,omitempty"`
	Active              bool                                      `json:"active"`
	Deployment          *controlv1.PublisherDeploymentObservation `json:"deployment,omitempty"`
}

type PublisherScope 

type PublisherScope struct {
	TeamID, Kind, PublicURLID, ServiceID, DomainID, Namespace, MembershipID string
	PublicURLScope                                                          PublicURLScope
}

type PublisherShare 

type PublisherShare struct {
	ID                string
	SecretFingerprint [32]byte
	ExpiresAt         time.Time
	CookieHashes      [][32]byte
}

type RealizeLocalProjectServiceRequest 

type RealizeLocalProjectServiceRequest struct {
	TeamID, ProjectKey, SourceFingerprint, Service, WorktreeKey, ActorID string
	PublicURLID                                                          string
	DomainID, WorktreeLabel                                              string
	DNSAutomation                                                        bool
	Configuration                                                        ProjectServiceConfiguration
	Now                                                                  time.Time
}

type RelayCertificateOrderState 

type RelayCertificateOrderState string

RelayCertificateOrderState is the persisted stage of relay transport certificate issuance. cleaning precedes installation; failed_cleaning preserves cleanup after failure. 

const (
	RelayCertificatePending         RelayCertificateOrderState = "pending"
	RelayCertificateAuthorizing     RelayCertificateOrderState = "authorizing"
	RelayCertificatePresenting      RelayCertificateOrderState = "presenting"
	RelayCertificatePresented       RelayCertificateOrderState = "presented"
	RelayCertificateValidating      RelayCertificateOrderState = "validating"
	RelayCertificateReadyToFinalize RelayCertificateOrderState = "ready_to_finalize"
	RelayCertificateFinalizing      RelayCertificateOrderState = "finalizing"
	RelayCertificateCleaning        RelayCertificateOrderState = "cleaning"
	RelayCertificateFailedCleaning  RelayCertificateOrderState = "failed_cleaning"
	RelayCertificateComplete        RelayCertificateOrderState = "complete"
	RelayCertificateFailed          RelayCertificateOrderState = "failed"
)

type RelayCertificateOrderWork 

type RelayCertificateOrderWork struct {
	ID                     string
	Account                ACMEAccount
	RelayServiceID         string
	TLSServerName          string
	PrivateKeyPEM          []byte
	CSRDER                 []byte
	CSRDigest              [32]byte
	State                  RelayCertificateOrderState
	OrderRevision          uint64
	OrderURL               string
	FinalizeURL            string
	CertificateURL         string
	AuthorizationURL       string
	AuthorizationExpiresAt *time.Time
	ChallengeURL           string
	ChallengeToken         string
	ChallengeDigest        [32]byte
	PresentationReference  string
	CertificatePEM         []byte
	NotBefore              *time.Time
	NotAfter               *time.Time
	RenewAt                *time.Time
	Attempts               uint64
	AvailableAt            time.Time
	LastError              string
	CreatedAt              time.Time
	UpdatedAt              time.Time
	WorkerID               string
	WorkEpoch              uint64
	WorkExpiresAt          time.Time
}

type RelayDNSChallengeContext 

type RelayDNSChallengeContext struct {
	OrderID               string
	RelayServiceID        string
	TLSServerName         string
	State                 RelayCertificateOrderState
	ChallengeDigest       [32]byte
	PresentationReference string
	Presentations         []DNSChallengePresentation
}

type RelayLease 

type RelayLease struct {
	RelayLeaseIdentity
	ProtocolVersion      uint64
	RelayAddress         string
	TLSServerName        string
	InternalRelayAddress string
	ObservedAddress      *netip.Addr
	InternalNetworks     []netip.Prefix
	ConnectionCapacity   uint64
	StreamCapacity       uint64
	ReportedConnections  uint64
	ReportedStreams      uint64
	Draining             bool
	DrainDeadline        *time.Time
	RegisteredAt         time.Time
	RenewedAt            time.Time
	LeaseExpiresAt       time.Time
}

RelayLease is the control-issued lease for one relay process.

type RelayLeaseIdentity 

type RelayLeaseIdentity struct {
	RelayServiceID     string
	RelayID            string
	RelayRunID         string
	RelayLeaseRevision uint64
}

RelayLeaseIdentity identifies one exact relay process lease.

type RelayRegistration 

type RelayRegistration struct {
	RelayServiceID       string
	RelayID              string
	RelayRunID           string
	ProtocolVersion      uint64
	RelayAddress         string
	TLSServerName        string
	InternalRelayAddress string
	InternalNetworks     []netip.Prefix
	ConnectionCapacity   uint64
	StreamCapacity       uint64
}

RelayRegistration describes one relay process and its relay service.

type RelayRenewal 

type RelayRenewal struct {
	RelayLeaseIdentity
	ReportedConnections uint64
	ReportedStreams     uint64
}

RelayRenewal reports the relay process's current load.

type RelayTransportCertificate 

type RelayTransportCertificate struct {
	RelayServiceID string
	TLSServerName  string
	CertificatePEM string
	PrivateKeyPEM  string
	Serial         string
	NotAfter       time.Time
}

RelayTransportCertificate contains a relay transport certificate and private key. it is returned only to a relay process with a current lease for the matching relay service.

type RenamePublisherNamespaceRequest 

type RenamePublisherNamespaceRequest struct {
	TeamID, ProjectKey, Group, NamespaceLabel, ActorID, IdempotencyKey string
	ExpectedRevision                                                   int64
	DNSAutomation                                                      bool
	Now                                                                time.Time
}

type RoutingHistoryPruneResult 

type RoutingHistoryPruneResult struct {
	NextRevision uint64
	Scanned      int64
	Deleted      int64
	More         bool
	Busy         bool
}

type ServiceAuditFilter 

type ServiceAuditFilter struct {
	ServiceID string
	Service   string
	After     string
	Since     *time.Time
	Limit     int
}

type ServiceAuditPage 

type ServiceAuditPage struct {
	Events     []serviceaudit.Event `json:"events"`
	NextCursor string               `json:"next_cursor,omitempty"`
}

type ServiceClientCertificate 

type ServiceClientCertificate struct {
	ServiceID      string    `json:"service_id"`
	CertificatePEM string    `json:"certificate_pem"`
	IssuerPEM      string    `json:"issuer_pem"`
	ExpiresAt      time.Time `json:"expires_at"`
}

type ServiceEndpoint 

type ServiceEndpoint struct {
	Hostname string `json:"hostname"`
	Port     int    `json:"port"`
	Public   bool   `json:"public"`
}

type ServiceEndpointDNSWork 

type ServiceEndpointDNSWork struct {
	Hostname, ServiceID, OwnerID, DomainID, PoolID, AuthorityReference string
	Public                                                             bool
	State                                                              PublicURLDNSState
	Revision, Epoch, Attempts                                          int64
	Worker                                                             string
	ExpiresAt, AvailableAt                                             time.Time
	LastError                                                          string
}

type ServiceGrant 

type ServiceGrant struct {
	ID, ServiceID, Kind, IdentityID, InvitationID string
	CreatedAt                                     time.Time
	ExpiresAt, RevokedAt                          *time.Time
}

type ServiceHTTPRun 

type ServiceHTTPRun struct {
	Subject httpsubject.Subject
	RunID   string
	Number  int64
	Token   credentials.ServiceRunToken
}

ServiceHTTPRun carries an exact service/run credential. public URL run tokens and browser/share scopes cannot be interpreted as service permission.

type ServiceInventory 

type ServiceInventory struct {
	ServiceMetadata
	KubernetesAuth                 *controlv1.KubernetesAuth
	ID, TeamID, Name, ServiceRunID string
	RunNumber                      int64
	CreatedAt                      time.Time
}

type ServiceInvitation 

type ServiceInvitation struct {
	ID, ServiceID, Email, Secret string
	ExpiresAt                    time.Time
	AcceptedAt, RevokedAt        *time.Time
}

type ServiceInvitationPreview 

type ServiceInvitationPreview struct {
	ServiceID string    `json:"service_id"`
	TeamID    string    `json:"team_id"`
	Name      string    `json:"name"`
	Protocol  string    `json:"protocol"`
	ExpiresAt time.Time `json:"expires_at"`
}

type ServiceMetadata 

type ServiceMetadata struct {
	Protocol      string            `json:"protocol"`
	TLS           *ServiceTargetTLS `json:"target_tls,omitempty"`
	PublisherPool bool              `json:"publisher_pool"`
	TrustRevision int64             `json:"trust_revision"`
	Endpoint      *ServiceEndpoint  `json:"endpoint,omitempty"`
}

func (ServiceMetadata) Validate 

func (m ServiceMetadata) Validate() error

type ServiceObservationResult 

type ServiceObservationResult struct {
	Accepted   int `json:"accepted"`
	Duplicates int `json:"duplicates"`
}

type ServicePlacement 

type ServicePlacement struct {
	DomainID      string `json:"domain_id,omitempty"`
	WorktreeKey   string `json:"worktree_key,omitempty"`
	WorktreeLabel string `json:"worktree_label,omitempty"`
	DNSAutomation bool   `json:"-"`
	SourceKey     string `json:"-"`
}

ServicePlacement selects a ready team domain and a source-bound local worktree. control captures the resulting identity once; defaults never rename it.

func (ServicePlacement) Validate 

func (p ServicePlacement) Validate() error

type ServiceProjection 

type ServiceProjection struct {
	ServiceID, ServiceRunID, Kind string
	RunNumber, Revision           int64
	ExpiresAt                     time.Time
	ConnectedRelays               []ServiceRelay
}

type ServicePublisherConnection 

type ServicePublisherConnection struct {
	ServiceID, RunID, ConnectionID, RelayServiceID string
	RunNumber, Revision                            int64
}

type ServiceRecord 

type ServiceRecord struct {
	ServiceMetadata
	ID, TeamID, DomainID, Name string
	Placement                  *ServicePlacement   `json:"placement,omitempty"`
	Source                     *LocalServiceSource `json:"source,omitempty"`
	HTTPLimits                 *ProjectHTTPApplicationLimits
	Enabled                    bool
	CreatedAt                  time.Time
}

type ServiceRelay 

type ServiceRelay struct {
	TLSServerName                string    `json:"tls_server_name"`
	PublisherConnectionID        string    `json:"publisher_connection_id"`
	ConnectionSlot               int16     `json:"connection_slot"`
	RelayServiceID               string    `json:"relay_service_id"`
	RelayID                      string    `json:"relay_id"`
	RelayRunID                   string    `json:"relay_run_id"`
	InternalRelayAddress         string    `json:"internal_relay_address"`
	RelayLeaseRevision           int64     `json:"relay_lease_revision"`
	ConnectionAssignmentRevision int64     `json:"connection_assignment_revision"`
	LeaseExpiresAt               time.Time `json:"lease_expires_at"`
}

type ServiceRoutingSnapshot 

type ServiceRoutingSnapshot struct {
	Revision int64
	Entries  []ServiceProjection
}

type ServiceRunAssignment 

type ServiceRunAssignment struct {
	PublisherConnectionID, RelayServiceID, RelayAddress, TLSServerName, Credential, State string
	ConnectionSlot                                                                        int16
	Revision                                                                              int64
	CredentialExpiresAt                                                                   time.Time
}

type ServiceRunHealth 

type ServiceRunHealth struct {
	Healthy                       bool
	StreamCapacity, ActiveStreams int32
}

type ServiceRunPreparation 

type ServiceRunPreparation struct {
	ServiceID, TeamID, RunID, PublisherIdentityID, PublisherGrantID, PublisherKeyID, IdempotencyKey string
	RunNumber                                                                                       int64
	ExpiresAt                                                                                       time.Time
	CertificatePlan                                                                                 CertificatePlan
	Hostname, DomainID                                                                              string
	ServicePort                                                                                     int
}

type ServiceRunState 

type ServiceRunState struct {
	ServiceID, RunID, Token, State  string
	RunNumber                       int64
	ExpiresAt                       time.Time
	Connections                     []ServiceRunAssignment
	Healthy                         bool
	StreamCapacity, ReportedStreams int32
}

type ServiceSelection 

type ServiceSelection struct {
	Subject VisitorSubject
	ServiceMetadata
	ServiceID, ServiceRunID, IdentityID, DeviceID string
	RunNumber                                     int64
	ExpiresAt                                     time.Time
}

type ServiceStreamAuthorization 

type ServiceStreamAuthorization struct {
	ServiceSelection
	ConnectorSessionID, VisitorConnectionID string
	SourceIP                                netip.Addr
	GrantRevision                           int64
	ValidUntil                              time.Time
}

type ServiceTargetTLS 

type ServiceTargetTLS struct {
	Hostname string `json:"hostname"`
	System   bool   `json:"system"`
	PEM      string `json:"pem,omitempty"`
	Digest   string `json:"digest"`
}

private metadata contains public trust material only, never a target address, target credential, local path, remote bundle URL, or publisher private key.

type ServiceVisitorValidity 

type ServiceVisitorValidity struct {
	Allowed    bool
	Admitted   bool
	ValidUntil time.Time
}

type SetPreviewTeamAccessRequest 

type SetPreviewTeamAccessRequest struct {
	PreviewID      string
	TeamID         string
	IdentityID     string
	Enabled        bool
	PolicyRevision uint64
	PublicURLs     []AuthorizedSharePublicURL
}

type Share 

type Share struct {
	SchemaVersion       int
	ID                  string
	PreviewID           string
	TeamID              string
	Scope               string
	Label               string
	PublicURLIDs        []string
	CreatedByIdentityID string
	CreatedAt           time.Time
	ExpiresAt           time.Time
	RevokedAt           *time.Time
}

type SharePage 

type SharePage struct {
	Shares     []Share
	NextCursor string
}

type ShareRedemption 

type ShareRedemption struct {
	ShareID      string
	CookieSecret string
	ExpiresAt    time.Time
	NextURL      string
	Bridge       bool
}

type SourceState 

type SourceState struct {
	SchemaVersion int                   `json:"schema_version"`
	HeadCommit    string                `json:"head_commit"`
	ProjectPath   string                `json:"project_path"`
	Branch        string                `json:"branch"`
	ChangedFiles  []FeedbackChangedFile `json:"changed_files"`
	Complete      *bool                 `json:"complete"`
}

type SubjectConnectorVisitor 

type SubjectConnectorVisitor struct {
	Subject                 VisitorSubject
	SessionID, ConnectionID string
	Source                  netip.Addr
	GrantRevision           int64
}

type Team 

type Team struct {
	ID              string
	Kind            TeamKind
	DisplayName     string
	ManagedLabel    string
	DefaultDomainID string
	PolicyRevision  int64
	CreatedAt       time.Time
	UpdatedAt       time.Time
}

type TeamFeedbackPolicy 

type TeamFeedbackPolicy struct {
	Authors string `json:"authors"`
}

type TeamKind 

type TeamKind string

TeamKind distinguishes personal and organization teams. 

const (
	TeamKindPersonal     TeamKind = "personal"
	TeamKindOrganization TeamKind = "organization"
)

type TeamRole 

type TeamRole string

TeamRole is a membership's authorization role. 

const (
	TeamRoleMember TeamRole = "member"
	TeamRoleAdmin  TeamRole = "admin"
	TeamRoleOwner  TeamRole = "owner"
)

type VisitorAccessMode 

type VisitorAccessMode string

VisitorAccessMode selects whether tnl requires a visitor credential. 

const (
	VisitorAccessRestricted VisitorAccessMode = "restricted"
	VisitorAccessAnonymous  VisitorAccessMode = "anonymous"
)

func (VisitorAccessMode) Valid 

func (mode VisitorAccessMode) Valid() bool

type VisitorDevice 

type VisitorDevice struct {
	ID         string     `json:"id"`
	IdentityID string     `json:"identity_id"`
	PublicKey  string     `json:"public_key"`
	CreatedAt  time.Time  `json:"created_at"`
	RevokedAt  *time.Time `json:"revoked_at,omitempty"`
}

type VisitorGrant 

type VisitorGrant struct {
	ID          string     `json:"id"`
	PublicURLID string     `json:"public_url_id"`
	Kind        string     `json:"kind"`
	IdentityID  string     `json:"identity_id,omitempty"`
	CreatedAt   time.Time  `json:"created_at"`
	ExpiresAt   *time.Time `json:"expires_at,omitempty"`
	RevokedAt   *time.Time `json:"revoked_at,omitempty"`
}

type VisitorIPGrant 

type VisitorIPGrant struct {
	ID        string     `json:"id"`
	Prefix    string     `json:"prefix"`
	ExpiresAt *time.Time `json:"expires_at,omitempty"`
}

type VisitorIPGrantInput 

type VisitorIPGrantInput struct {
	Prefix    string     `json:"prefix"`
	ExpiresAt *time.Time `json:"expires_at,omitempty"`
}

type VisitorInvitation 

type VisitorInvitation struct {
	ID                 string     `json:"id"`
	PublicURLID        string     `json:"public_url_id"`
	Email              string     `json:"email"`
	ExpiresAt          time.Time  `json:"expires_at"`
	AcceptedIdentityID string     `json:"accepted_identity_id,omitempty"`
	RevokedAt          *time.Time `json:"revoked_at,omitempty"`
}

type VisitorNetworkHashKey 

type VisitorNetworkHashKey struct {
	UTCDate time.Time
	Key     [32]byte
}

VisitorNetworkHashKey limits visitor-network pseudonyms to one UTC date.

type VisitorPermission 

type VisitorPermission struct {
	Authenticated bool
	IdentityID    string
	DisplayName   string
	TeamMember    bool
	VisitAllowed  bool
	Reason        string
	ExpiresAt     *time.Time
}

VisitorPermission is a current decision, not a reusable authorization token.

type VisitorSubject 

type VisitorSubject = tunnelv1.VisitorSubject

type WorkloadGitHubExecution 

type WorkloadGitHubExecution struct {
	RepositoryID      string `json:"repository_id"`
	RepositoryOwnerID string `json:"repository_owner_id"`
	RunID             string `json:"run_id"`
	RunAttempt        string `json:"run_attempt"`
	CheckRunID        string `json:"check_run_id"`
}

type WorkloadIngressAssignment 

type WorkloadIngressAssignment struct {
	ID             string    `json:"id"`
	ServiceID      string    `json:"service_id"`
	Credential     string    `json:"credential"`
	ExpiresAt      time.Time `json:"expires_at"`
	IngressID      string    `json:"ingress_id"`
	IngressAddress string    `json:"ingress_address"`
	TLSServerName  string    `json:"tls_server_name"`
}

type WorkloadIngressAssignments 

type WorkloadIngressAssignments struct {
	Subject     VisitorSubject              `json:"subject"`
	Assignments []WorkloadIngressAssignment `json:"assignments"`
}

type WorkloadService 

type WorkloadService struct {
	ID             string                    `json:"id"`
	Service        string                    `json:"service"`
	Protocol       string                    `json:"protocol"`
	Endpoint       *ServiceEndpoint          `json:"endpoint"`
	KubernetesAuth *controlv1.KubernetesAuth `json:"kubernetes_auth,omitempty"`
}

type WorkloadServiceAuthorization 

type WorkloadServiceAuthorization struct {
	Subject        VisitorSubject `json:"subject"`
	ServiceID      string         `json:"service_id"`
	ValidUntil     time.Time      `json:"valid_until"`
	PolicyRevision int64          `json:"policy_revision"`
}

type WorkloadSession 

type WorkloadSession struct {
	ID                 string                   `json:"id"`
	Credential         string                   `json:"credential"`
	TeamID             string                   `json:"team_id"`
	ProjectKey         string                   `json:"project_key"`
	Workload           string                   `json:"workload"`
	Provider           string                   `json:"provider"`
	Subject            VisitorSubject           `json:"subject"`
	LeaseExpiresAt     time.Time                `json:"lease_expires_at"`
	ExpiresAt          time.Time                `json:"expires_at"`
	RenewAfter         time.Time                `json:"renew_after"`
	ServiceIDs         []string                 `json:"service_ids"`
	Binding            string                   `json:"binding"`
	AssertionExpiresAt *time.Time               `json:"assertion_expires_at,omitempty"`
	GitHub             *WorkloadGitHubExecution `json:"github,omitempty"`
}

func (WorkloadSession) ExecutionReference 

func (r WorkloadSession) ExecutionReference() string

a trace-safe execution reference contains no JWT, credential or public key.

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.