Struct Service 

pub struct Service { /* private fields */ }

Wraps a Store (records) and a BlobStore (content-addressed slices) and exposes their operations to the daemon transports. The daemon backs both with the same FsStore.

Implementations

impl Service

pub fn new(store: Arc<dyn Store>, blobs: Arc<dyn BlobStore>) -> Self

pub fn with_max_blob_size(self, n: usize) -> Self

Override the per-blob size ceiling (bytes) used by the HTTP body limit and the gRPC decode limit.

pub fn max_blob_size(&self) -> usize

The per-blob size ceiling (bytes).

pub async fn get_blob(&self, hash: &ContentHash) -> Result<Option<Vec<u8>>>

pub async fn put_blob(&self, content: &[u8]) -> Result<ContentHash>

pub async fn list_blobs(&self) -> Result<Vec<BlobEntry>>

pub async fn delete_blob(&self, hash: &ContentHash) -> Result<()>

pub async fn has_blob(&self, hash: &ContentHash) -> Result<bool>

Whether hash is stored, without reading it. Substrates answer with a cheap existence check (try_exists on a filesystem, HeadObject on S3), which is what lets HEAD /v1/blobs/{hash} and the HasBlob RPC cost a stat rather than a read (#329).

pub fn with_graph_root(self, graph_root: impl Into<PathBuf>) -> Self

Serve code-graph queries from persistent SQLite graphs rooted at graph_root (matching gonzalo index’s <store_root>/graphs), falling back to slice assembly for views without an indexed db.

pub async fn get(&self, key: &RecordKey) -> Result<Option<Record>>

pub async fn ready(&self) -> bool

Readiness probe: whether the backing store is reachable. Does a cheap point lookup of a sentinel key — Ok (even Ok(None)) means the store answered, Err means it is unreachable (bad endpoint/bucket, down backend), so a load balancer should route around this replica. Backs GET /readyz; liveness (/healthz) needs no store access.

pub async fn put( &self, record: Record, expected: Option<Revision>, ) -> Result<PutResult>

pub async fn list(&self, prefix: &KeyPrefix) -> Result<Vec<RecordKey>>

pub async fn delete_as( &self, key: &RecordKey, expected: Option<Revision>, author: Option<Identity>, ) -> Result<DeleteResult>

Delete key by writing a tombstone. author, when set, becomes the tombstone’s meta.author; transports compute it with Principal::delete_author (ADR 0015, gonzalo#203).

pub async fn get_raw(&self, key: &RecordKey) -> Result<Option<Record>>

Like get, but returns tombstones. Replication only.

pub async fn list_raw(&self, prefix: &KeyPrefix) -> Result<Vec<RecordKey>>

Like list, but includes tombstoned keys. Replication only.

pub async fn put_raw( &self, record: Record, expected: Option<Revision>, ) -> Result<PutResult>

Replication write: stores record verbatim (the revision is never re-stamped). Authorship policy belongs to the transport (see put_raw_record).

pub async fn purge( &self, key: &RecordKey, expected: Revision, ) -> Result<DeleteResult>

Physically remove the record at key iff its current revision is expected. The only physical removal in the system.

Refuses to remove a live record (gonzalo#341), as gonzalo purge does, so the daemon and the CLI — the system’s two operator surfaces — agree. plan_purge is kind-blind and removes whatever matches the revision, and purging a live record leaves no tombstone behind, so a peer that has not synced since would resurrect it: the exact failure tombstones exist to prevent (ADR 0021).

The refusal is deliberately narrow — only a revision that matches a live record, which is the only call that would actually remove one. Two neighbouring cases must keep their existing answers, because tombstone collection depends on both:

• A mismatched revision over a live record is collect losing an OCC race to a recreate between listing and purging. plan_purge answers Conflict and removes nothing, which collect records in CollectReport::conflicts; refusing here instead would fail the whole run (conformance::purge_conflicts_after_recreation).
• A key that is already gone still reports Deleted, so re-running collection after a partial run stays safe.

pub async fn ticket_sync( &self, conn: &Connection, author: &str, ) -> Result<IngestSummary, TicketSyncError>

Build a source for conn from the registry and ingest its tickets into the backing store. The error is typed so each transport can return the right status: a misconfigured request is a client error, a build/ingest failure is a server error.

pub async fn view_exists(&self, repo: &str, view_id: &str) -> Result<bool>

Whether (repo, view_id) names a view that exists — a persistent graph under graph_root, or a manifest record in the store.

pub async fn graph_views(&self) -> Result<Vec<ViewSummary>>

Every indexed view, for discovery. Cheap by design — this is the call an agent makes first, so it reads manifests (and the recorded base commit) rather than loading each view’s graph. Use overview for symbol counts.

pub async fn graph_definitions( &self, repo: &str, view_id: &str, name: &str, ) -> Result<Vec<Located<Symbol>>>

Definitions of name in the view, each with its path.

pub async fn graph_references_to( &self, repo: &str, view_id: &str, name: &str, ) -> Result<Vec<Located<Reference>>>

References to name in the view, each with its path.

pub async fn graph_callers_of( &self, repo: &str, view_id: &str, name: &str, ) -> Result<Vec<String>>

Enclosing functions that call name in the view.

pub async fn graph_callers_scoped( &self, repo: &str, view_id: &str, name: &str, ) -> Result<Vec<(String, FromScope)>>

Callers of name, each with whether it is a function or a module-level binding (#268).

pub async fn graph_callees( &self, repo: &str, view_id: &str, name: &str, ) -> Result<Vec<String>>

Names called from within name in the view.

pub async fn graph_impact( &self, repo: &str, view_id: &str, name: &str, max_depth: Option<usize>, ) -> Result<ImpactReport>

Transitive caller closure of name (impact of changing it). Symbols transitively affected if name changes, following only call edges that resolve to a specific definition.

Uses resolved_impact rather than the name-matched GraphStore::impact, which merged unrelated subgraphs through shared identifiers (#207). Edges that cannot be attributed are counted in the report instead of being traversed or silently dropped.

pub async fn graph_impact_names( &self, repo: &str, view_id: &str, name: &str, ) -> Result<Vec<String>>

graph_impact flattened to distinct caller names.

The daemon transports speak a shared name-list shape for callers_of, callees and impact, so they take this projection. They still get the resolution-gated walk — only the ambiguous_edges and per-node paths are dropped, which is why the MCP surface returns the full report.

pub async fn graph_overview( &self, repo: &str, view_id: &str, largest: usize, ) -> Result<ViewOverview>

Aggregate shape of the view: counts, breakdowns by kind and language, and the largest files by symbol count.

pub async fn graph_top( &self, repo: &str, view_id: &str, ranking: Ranking, limit: usize, ) -> Result<Page<RankedSymbol>>

Top limit symbol names in the view by ranking.

pub async fn graph_list( &self, repo: &str, view_id: &str, filter: &SymbolFilter, limit: usize, ) -> Result<Page<Located<Symbol>>>

Symbols in the view matching filter, bounded by limit.

pub async fn graph_unreferenced( &self, repo: &str, view_id: &str, filter: &SymbolFilter, exclude_tests: bool, limit: usize, ) -> Result<Page<Located<Symbol>>>

Dead-code candidates in the view: symbols with no inbound reference, heuristic — see GraphStore::unreferenced for the blind spots.

pub async fn graph_diff( &self, repo: &str, view_a: &str, view_b: &str, ) -> Result<GraphDiff>

Structural diff of two views of repo (view_a → view_b): symbols and references added or removed.

Trait Implementations

impl Clone for Service

fn clone(&self) -> Service

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.