Crate coven_database 

Owned SQLite writes and concurrent application reads.

Database serializes writes, sync bookkeeping, changeset capture and apply on its owned connection. store::StoreReads owns a bounded pool of read-only connections for application queries, with one transaction per operation and separate bounded workers for processing owned query results.

Hosts open coven with Coven::builder and run app SQL through CovenHandle::write or CovenHandle::read.

Re-exports

pub use test_support::synthetic_store;

pub use test_support::DatabaseImageTest;

pub use test_support::OutboxAttempt;

pub use test_support::RetainedRegistrationTamper;

pub use test_support::ScopedRoutingStateForTest;

pub use store::device_join_journal;

pub use store::device_join_journal::DeviceJoinJournalError;

pub use store::PayloadStoreError;

pub use store::activated_merge_membership_remote_objects;

pub use store::DeviceJoinBootstrapCommit;

pub use store::DeviceJoinBootstrapPlan;

pub use store::DeviceJoinBootstrapRowData;

pub use store::MembershipAuthorityBytes;

pub use store::PreparedMergeMaterialization;

pub use store::PreparedMergeMaterializationPackage;

pub use store::ResolvedDeviceJoinBootstrap;

pub use store::VerifiedStoreSnapshotAuthority;

pub use store::audience_moves_by_row;

pub use store::local_blob_cleanup_intents;

pub use store::AudienceBlobMoveStaging;

pub use store::PostUpload;

pub use store::StagedAudienceBlobRollback;

pub use store::projection_table_names;

pub use store::AcceptedStoreCommitEvidence;

pub use store::AcceptedStoreCommitPublication;

pub use store::AcceptedStorePublicationInterval;

pub use store::AdvancedReplayBaseline;

pub use store::BlobTransitionRoot;

pub use store::BlobUploadDrainPermit;

pub use store::BlockedWriteDiscard;

pub use store::CandidateCleanupObject;

pub use store::CircleAckPublicationInput;

pub use store::CreatedSnapshot;

pub use store::DeviceJoinJournalStore;

pub use store::DurableStoreReclaimObject;

pub use store::DurableStoreReclaimOperation;

pub use store::HostWriteBlobTransaction;

pub use store::HostWriteError;

pub use store::HostWriteOperation;

pub use store::IncomingTimestampPolicy;

pub use store::InstalledReplayBaseline;

pub use store::LocalBlobCleanup;

pub use store::MakeRemoteAdmission;

pub use store::MaterializedLocalBlob;

pub use store::ObservedStorePublication;

pub use store::OutboxEntry;

pub use store::OutboxFailure;

pub use store::OutboxFailureKind;

pub use store::OutboxOperation;

pub use store::OutboxUploadState;

pub use store::OwnStreamAuthorship;

pub use store::OwnedVerifiedMergeMaterialization;

pub use store::PreparedCircleObjects;

pub use store::ReclaimedStorePackage;

pub use store::RetainedAudiencePackage;

pub use store::RetainedMergeHistoryCheckpoint;

pub use store::RetainedMergeMaterializationKey;

pub use store::RetainedPackageApplication;

pub use store::RetainedReplayAuthority;

pub use store::RetainedReplayBaseline;

pub use store::RetainedReplayGenesisAuthority;

pub use store::SnapshotBlobFact;

pub use store::SnapshotDatabaseImage;

pub use store::SnapshotImageError;

pub use store::SnapshotImageOperationError;

pub use store::SnapshotPublicationPermit;

pub use store::StoreCommitPublicationOutcome;

pub use store::StoreDatabase;

pub use store::StorePublicationBoundary;

pub use store::StorePublicationPreparation;

pub use store::StoreReclaimJournalError;

pub use store::StoreRowWrites;

pub use store::StoreWritePreparation;

pub use store::StuckReclaimOperation;

pub use store::TableSchema;

pub use store::ValidatedChangeset;

pub use store::VerifiedMergeMaterialization;

pub use store::VerifiedMergeMembershipObjects;

pub use store::WinningRow;

pub use store::resolve_and_apply_changeset;

pub use store::ApplyResult;

pub use store::BlobFileFailure;

pub use store::BlobFileFailures;

pub use store::SqlContext;

pub use store::SqlReadContext;

pub use store::WriteBatch;

pub use store::CloudOutboxSnapshot;

pub use store::MakeRemoteProgress;

pub use store::QueuedDelete;

pub use store::QueuedMakeRemote;

pub use store::QueuedUpload;

pub use store::QueuedUploadPhase;

pub use rusqlite;

Modules

store

test_support

Structs

ActivatedStoreAck

An acknowledgement a device has activated, and the commit that activated it.

ActiveStorePublication

The exact conditional Store-publication attempt owned by one local operation.

AudienceMove

AudiencePartition

BlobActivation

The exact commit coordinate that first made a blob locator authoritative.

BlobDecls

The blob declarations for a database handle, resolved from the declared set + the live schema at open. A synced table absent from this map carries no blob.

CirclePartitionControl

CloudOutboxRecords

CovenSchemaManifest

Database

A cloneable handle to one owned database. The connection capability retains both the worker and its matching database context; this handle has no second path to either.

DatabaseTestTable

DurableCircleSnapshotPublication

DurableDeviceRegistration

DurableFounderGraph

DurableFounderMembership

DurableFounderMembershipJournal

DurableMembershipMutation

DurablePreparedProtocolObject

DurableSnapshotPublication

ExactProtocolObject

One loaded protocol object: its typed value, its canonical plaintext, and the bytes that go to storage.

ExternalBlob

An external user-owned file a blob id resolves to, read back from a local_blob_refs row. The blob’s plaintext lives at path (an absolute file Coven references but does not own); size is its registered plaintext length, combined with the row’s signed content hash to validate the exact file.

ForeignKeyEdge

FounderMembershipRefs

Gates

The gate model for a database handle, computed from the live schema at open.

InitialStoreMembershipAuthority

Migration

One ordered step in the host’s synced-schema ladder.

MigrationContext

Host SQL inside one schema-migration transaction.

OutboundStoreAck

OwnerRecoveryPublication

The exact Owner-recovery commit and publication staged before either is published. A retry reopens these same stored bytes instead of resealing the semantic objects into different exact identities.

PreparedAudienceBlob

PreparedAudienceObjects

PreparedAudiencePackage

PreparedCircleOperationRow

PreparedExternalBlob

A user-owned file whose plaintext size and SHA-256 digest Coven read in one pass. Its content facts stay private and can only be consumed by external blob registration.

PreparedProtocolObject

PreparedRemoteObject

PreparedSnapshotBlob

PreparedStoreSnapshot

A closed, migrated snapshot image and the directory owning its payloads. Installation opens the image only within the receiving database operation.

PreparedStoreWrite

PreparedStoreWriteCommit

PreparedStoreWritePartitions

PublicationBlob

Exact row facts captured with a durable Store write for one blob-bearing row.

PublishedCircleSnapshot

PublishedStoreAck

PublishedStoreSnapshot

RetiredStoreCandidate

RoutingChanges

StagedBlobRollbackFailure

A staged audience-move blob file that could not be rolled back, and why. Names the file so a host learns which staged bytes are left on disk.

StagedBlobRollbackFailures

Every staged file that could not be rolled back, in the order attempted.

StagedCircleAccess

Recipient-specific access resolved from an exact retained Circle activation. Its leaf bootstrap remains bound to the leaf even if a newer image is selected.

StagedCircleInstall

One Circle image selected against the restoring identity’s re-resolved access. Coverage references imported from the Store snapshot are removed as a set before these locally verified images are installed.

StagedCirclePackageRestore

StagedCircleRestore

StoreAudienceTransitions

StoreBatchCompletion

StoreBatchLocalCleanup

StoreOwnerAnchor

StoreWriteBase

StoreWriteBlobFact

StoreWriteBlobFacts

StoreWriteRemoteBlob

SyncRoutingContract

VerifiedSnapshotBootstrapInstall

Enums

ActiveStorePublicationAttempt

ActiveStorePublicationOwner

BlobDeclError

Why building the blob-declaration model failed.

ChangesetError

ChangesetIdentityError

CircleControlFailure

CirclePartitionControlError

CovenMigrationError

CovenMigrationPolicy

CreateTableSchemaError

DbError

An error from the owned database.

ForeignKeySchemaError

GateError

LocalDeviceRegistrationState

MakeRemoteIntentState

MaterializationHold

MigrationError

Why running the synced-schema ladder failed. Carried as its own arm of OpenError at the Database::open boundary — not flattened into a DbError string — so the variants stay typed for the engine’s own tests, the snapshot bootstrap gate, and hosts matching MigrationError::SchemaTooNew to prompt an app update.

MigrationStep

How a migration applies its change to the synced schema.

OpenError

Why opening the database failed. Splits a migration-ladder failure from every other open-time database error so the MigrationError a host acts on — MigrationError::SchemaTooNew, whose remedy is “update the app” — stays matchable at the open boundary instead of being flattened into a DbError string.

OutboundStoreAckActivation

OutboxIdentity

RetiredStoreCandidateInputs

StagedBlobRollbackReason

StagedCircleBase

The verified starting state for one accessible Circle.

StoreSnapshotPublicationStage

StoreWriteBlobMoveMaterialization

StoreWriteRouting

StoredBlobReferenceState

SyncRoutingContractError

Constants

COVEN_INITIALIZED_STATE_KEY

COVEN_INITIALIZED_STATE_VALUE

COVEN_SCHEMA_MANIFEST_STATE_KEY

LOCAL_DEVICE_ID_STATE_KEY

STORE_DEVICE_GENESIS_STATE_KEY

SYNC_ROUTING_CONTRACT_STATE_KEY

SYNC_ROUTING_HASH_STATE_KEY

Functions

candidate_graph_exact_objects

expected_coven_schema_manifest

from_tables_call_count

gate_from_tables_call_count

is_reserved_table_name

Whether name is a table coven owns for sync bookkeeping. Hosts may not declare these as synced tables.

is_routing_table

outbox_identity

parse_circle_operation_row

Rebuild one operation from the three places it is stored.

parse_store_reclaim_operation

prepare_external_blob

Stream a user-owned file once and prepare its opaque content identity for registration. progress receives the cumulative bytes consumed after each read.

quote_ident

Quote an SQL identifier (table/column name), doubling any embedded quote, so a trusted-but-unbindable name interpolates safely. Identifiers cannot be passed as bound parameters; this is the safe interpolation path for them.

remote_audience_to_db

reset_from_tables_call_count

reset_gate_from_tables_call_count

rewrite_create_into_schema

Qualify a CREATE TABLE <name> ... statement so it builds the table inside the attached schema alias, replacing only the table-name token.

row_to_outbox_entry

snapshot_generation_as_i64

store_audience_transitions

store_reclaim_journal_error

supported_version

The top synced-schema version this binary supports: the count of registered migrations. run_migrations validates the set is 1..=N contiguous, so the count is the highest version (and 0 for an empty ladder — no synced schema). The snapshot bootstrap gate compares an incoming snapshot’s version against this before adopting the image, so it lives beside the ladder rather than being re-derived at each bootstrap call site.

validate_prepared_audience_blob_graph

validate_snapshot_author

validate_snapshot_image

value_ref_to_string

Render a changeset/column [ValueRef] as an owned String, or None for SQL NULL. Mirrors sqlite3_value_text: text and blob bytes become a string (lossy on invalid UTF-8), and integers/reals their decimal text — so the _updated_at row-arbitration comparison and blob-plan column reads see the same strings the raw FFI path (gate.rs) produces.

walk_changeset

Walk a changeset and return every row change with its column values.

walk_old_changeset

Type Aliases

LocalDeviceRegistrationJournalRow

MaterializationOutcome

PreparedLocalDeviceRegistrationRow