cadrumo.adapters.persistence.storage.runtime_repository module¶

Runtime-owned SecureObjectRepository factories.

Builds SecureObjectRepository instances bound to the active profile’s unlocked storage route, so callers obtain a repository without resolving the storage namespace or key material themselves.

secure_object_repository_for_bucket(bucket_id, settings=None)[source]¶

Return a bucket-attached SecureObjectRepository through storage runtime.

Return type:

SecureObjectRepository

Parameters:

bucket_id (str)
settings (Settings | None)

secure_object_repository_for_active_bucket()[source]¶

Return a SecureObjectRepository attached to the selected active profile bucket.

Return type:: SecureObjectRepository

secure_object_repository_for_active_bucket_or_default_route(settings=None)[source]¶

Return a SecureObjectRepository for the active bucket, or the process default.

This lower-level storage helper is for repository base classes that still support explicit injected/default SQL engines in tests and bootstrap-adjacent code. It does not catch active-bucket runtime errors: once a bucket is selected, route/session failures surface from secure_object_repository_for_bucket instead of falling back to a bare repository.

Return type:: SecureObjectRepository
Parameters:: settings (Settings | None)

secure_object_repository_for_cold_bootstrap_state(settings=None)[source]¶

Return a SecureObjectRepository for cold-root recovery reads.

This is the narrow bootstrap exception used before any active profile bucket pointer exists. Normal profile-bound code must use secure_object_repository_for_active_bucket or secure_object_repository_for_bucket so route/session mismatches fail closed at the storage runtime boundary.

Return type:: SecureObjectRepository
Parameters:: settings (Settings | None)

secure_object_repository_for_staged_bucket(bucket_id, *, database_file)[source]¶

Yield a repository for a bucket’s database BEFORE its capsule is published.

The one route the storage runtime cannot serve, and the reason is structural rather than an oversight. secure_object_repository() rebuilds its settings from a storage root plus an active profile, so it always resolves the FINAL buckets/<bucket_id>/ path; and capsule creation writes revision one into a staging directory that becomes that bucket only at the publishing rename. The cold-bootstrap factory is no substitute either – it refuses an explicit database route by design, because its own job is the no-pointer-yet case rather than this one.

So the staging database is addressed explicitly. What stays runtime-owned is everything that made a direct construction worth forbidding: the namespace registry, the session-bucket binding, the secure-session requirement, and the engine’s lifetime. A caller receives an open repository and cannot leak the engine behind it.

The caller still owns binding the DEK that opens these rows: the staged capsule’s key exists only in the creating transaction, which is precisely why no ambient session serves this bucket yet.

Parameters:

bucket_id (str) – The profile UUID the staged rows will belong to. Bound as the repository’s session bucket, so a session serving a different profile refuses rather than writing across capsules.
database_file (Path) – The staging database’s path. Directory creation is left to the engine deliberately: it refuses to bring a bucket root into existence – a bucket exists only once its capsule is published – and creates the parents only after that check. Creating them here first would satisfy the guard by making its subject exist, which is exactly the second bucket creator the refusal is written against.

Yields:

A SecureObjectRepository open on the staged database.

Return type:

Generator[SecureObjectRepository]