@synopackageland/cli 0.4.0 → 0.5.0

package/templates/native-go/backend/internal/helper/sdk_display.go

@@ -0,0 +1,488 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"dsmapp/internal/helper/jobcontract"
+	"encoding/hex"
+	"encoding/json"
+	"sort"
+	"time"
+)
+
+func newSDKJobViews(o *sdkJobOwner) *sdkJobViews {
+	if o != nil && o.views != nil {
+		return o.views
+	}
+	v := &sdkJobViews{owner: o, cursors: map[string]sdkStatusCursor{}, counts: map[uint32]int{}}
+	if o != nil {
+		o.views = v
+	}
+	return v
+}
+func (v *sdkJobViews) enter() bool {
+	if v.concurrent.Add(1) > 8 {
+		v.concurrent.Add(-1)
+		return false
+	}
+	return true
+}
+func (v *sdkJobViews) leave() { v.concurrent.Add(-1) }
+func (v *sdkJobViews) actor(ctx context.Context, c SessionCarriers) (NativeActor, Code) {
+	if v == nil || v.owner == nil {
+		return NativeActor{}, ErrUnavailable
+	}
+	a, code := v.owner.grants.authority.actor(ctx, c, nil)
+	if code != "" {
+		return NativeActor{}, code
+	}
+	if !nativeFresh(a.account.CheckedAt, v.owner.grants.cohort.now()) {
+		return NativeActor{}, ErrStale
+	}
+	return a, ""
+}
+func (v *sdkJobViews) budget(a NativeActor) Code {
+	second := v.owner.grants.cohort.now().Unix()
+	if second < v.second {
+		return ErrStale
+	}
+	if second != v.second {
+		v.second = second
+		v.counts = map[uint32]int{}
+	}
+	if v.counts[a.UID()] >= 2 {
+		return ErrBusy
+	}
+	if len(v.counts) >= 256 && v.counts[a.UID()] == 0 {
+		return ErrLimit
+	}
+	v.counts[a.UID()]++
+	return ""
+}
+func sdkCopyTime(p *uint64) *uint64 {
+	if p == nil {
+		return nil
+	}
+	n := *p
+	return &n
+}
+func (v *sdkJobViews) snapshot() ([]sdkJobDisplay, Code) {
+	if len(v.owner.jobs) > 256 {
+		return nil, ErrLimit
+	}
+	ids := make([]string, 0, len(v.owner.jobs))
+	for id := range v.owner.jobs {
+		ids = append(ids, id)
+	}
+	sort.Strings(ids)
+	a := v.owner.grants.authority
+	a.mu.Lock()
+	delegations := map[string]sdkDelegationDisplay{}
+	// Revoked records are readable while fresh native proof remains available.
+	// A lifecycle fence is not bypassed to manufacture a display identity.
+	code := a.transaction(func(store *GrantStore) (bool, Code) {
+		if store.Revision > (1<<53)-1 {
+			return false, ErrLimit
+		}
+		for _, r := range store.Background {
+			ref := r.Binding.Binding.Delegation
+			if ref != nil {
+				delegations[ref.ID] = sdkDelegationDisplay{ref.ID, ref.Revision, store.Revision, r.State, r.ExpiresAt}
+			}
+		}
+		return false, ""
+	})
+	a.mu.Unlock()
+	if code != "" {
+		return nil, code
+	}
+	items := make([]sdkJobDisplay, 0, len(ids))
+	for _, id := range ids {
+		j := v.owner.jobs[id]
+		r := j.receipt.Job
+		if !allReferences(id) || jobcontract.ValidateJob(r) != "" {
+			return nil, ErrInvalid
+		}
+		effects := j.counters
+		if effects == (jobcontract.Result{}) {
+			effects.ResultSchema = jobcontract.ResultSchema
+		}
+		if jobcontract.ValidateResult(effects) != "" {
+			return nil, ErrInvalid
+		}
+		var delegation *sdkDelegationDisplay
+		if j.background != nil {
+			d, ok := delegations[j.background.id]
+			if !ok {
+				return nil, ErrCleanupRequired
+			}
+			delegation = &d
+		}
+		p := r.Progress
+		p.TotalUnits = sdkCopyTime(p.TotalUnits)
+		items = append(items, sdkJobDisplay{Delegation: delegation, KnownEffects: effects, JobID: id, Mode: j.request.Control.Binding.Mode, State: r.State, SafeReason: r.Reason, Progress: p, AcceptedAt: r.AcceptedAt, StartedAt: sdkCopyTime(r.StartedAt), FinishedAt: sdkCopyTime(r.FinishedAt), CancelRequested: r.CancelRequested, Drained: r.Drained, EffectsUnknown: r.EffectsUnknown})
+	}
+	history, code := v.retainedDisplays(delegations)
+	if code != "" {
+		return nil, code
+	}
+	items = append(items, history...)
+	sort.Slice(items, func(i, j int) bool { return items[i].JobID < items[j].JobID })
+	raw, e := json.Marshal(items)
+	if e != nil {
+		return nil, ErrInvalid
+	}
+	h := sha256.Sum256(raw)
+	if v.revision == 0 || h != v.hash {
+		if v.revision >= (1<<53)-1 {
+			return nil, ErrLimit
+		}
+		v.revision++
+		v.hash = h
+	}
+	for i := range items {
+		items[i].Revision = v.revision
+	}
+	return items, ""
+}
+func sdkRandomRef() (string, Code) {
+	var b [32]byte
+	if _, e := rand.Read(b[:]); e != nil {
+		return "", ErrUnavailable
+	}
+	return hex.EncodeToString(b[:]), ""
+}
+func (v *sdkJobViews) ownerPage(ctx context.Context, c SessionCarriers, cursor string) (sdkJobPage, Code) {
+	return v.page(ctx, c, cursor, false)
+}
+func (v *sdkJobViews) page(ctx context.Context, c SessionCarriers, cursor string, admin bool) (sdkJobPage, Code) {
+	ctx, stop := context.WithTimeout(ctx, 3*time.Second)
+	defer stop()
+	a, code := v.actor(ctx, c)
+	if code != "" {
+		return sdkJobPage{}, code
+	}
+	if admin && !a.Admin() {
+		return sdkJobPage{}, ErrDenied
+	}
+	if code = v.budget(a); code != "" {
+		return sdkJobPage{}, code
+	}
+	items, code := v.snapshot()
+	if code != "" {
+		return sdkJobPage{}, code
+	}
+	now := v.owner.grants.cohort.now()
+	policy := v.owner.grants.authority.policy
+	offset := 0
+	if cursor != "" {
+		token, ok := v.cursors[cursor]
+		if !ok || token.admin != admin || !now.Before(token.expires) || token.principal != a.Principal() || token.session != a.SessionRef() || token.inventory != policy.Inventory || token.epoch != policy.Epoch || token.revision != v.revision {
+			return sdkJobPage{}, ErrStale
+		}
+		offset = token.offset
+	}
+	visible := make([]sdkJobDisplay, 0)
+	for _, item := range items {
+		if admin || v.owns(item.JobID, a) {
+			visible = append(visible, item)
+		}
+	}
+	if offset > len(visible) {
+		return sdkJobPage{}, ErrStale
+	}
+	end := offset + 10
+	if end > len(visible) {
+		end = len(visible)
+	}
+	page := sdkJobPage{Revision: v.revision, Items: visible[offset:end]}
+	if end < len(visible) {
+		for key, t := range v.cursors {
+			if !now.Before(t.expires) || t.revision != v.revision {
+				delete(v.cursors, key)
+			}
+		}
+		if len(v.cursors) >= 256 {
+			return sdkJobPage{}, ErrLimit
+		}
+		key, c := sdkRandomRef()
+		if c != "" {
+			return sdkJobPage{}, c
+		}
+		v.cursors[key] = sdkStatusCursor{admin, a.Principal(), a.SessionRef(), policy.Inventory, policy.Epoch, v.revision, end, now.Add(30 * time.Second)}
+		page.NextCursor = key
+	}
+	if _, code = v.owner.grants.authority.actor(ctx, c, &a); code != "" {
+		return sdkJobPage{}, code
+	}
+	raw, e := json.Marshal(page)
+	if e != nil || len(raw) > 16<<10 {
+		return sdkJobPage{}, ErrLimit
+	}
+	return page, ""
+}
+func (v *sdkJobViews) adminQuery(ctx context.Context, c SessionCarriers, cursor string) (sdkAdminJobPage, Code) {
+	page, code := v.page(ctx, c, cursor, true)
+	if code != "" {
+		return sdkAdminJobPage{}, code
+	}
+	out := sdkAdminJobPage{Revision: page.Revision, NextCursor: page.NextCursor, Items: []sdkAdminJobDisplay{}}
+	for _, i := range page.Items {
+		out.Items = append(out.Items, sdkAdminJobDisplay{i.JobID, i.Revision, i.State, i.SafeReason, i.CancelRequested, i.Drained, i.EffectsUnknown})
+	}
+	return out, ""
+}
+func (v *sdkJobViews) adminPage(ctx context.Context, c SessionCarriers) ([]sdkAdminJobDisplay, Code) {
+	page, code := v.adminQuery(ctx, c, "")
+	return page.Items, code
+}
+func (v *sdkJobViews) cancel(ctx context.Context, c SessionCarriers, id string, revision uint64) Code {
+	ctx, stop := context.WithTimeout(ctx, 3*time.Second)
+	defer stop()
+	a, code := v.actor(ctx, c)
+	if code != "" {
+		return code
+	}
+	j := v.owner.jobs[id]
+	if j == nil || (!a.Admin() && a.Principal() != j.actor.Principal()) {
+		return ErrDenied
+	}
+	items, code := v.snapshot()
+	if code != "" {
+		return code
+	}
+	if revision != v.revision {
+		return ErrStale
+	}
+	if _, code = v.owner.grants.authority.actor(ctx, c, &a); code != "" {
+		return code
+	}
+	// Admin management receives no private delegation mapping. Resolve it in
+	// the trusted snapshot, then use the original S3 store/delegation CAS path.
+	if j.background != nil && a.Admin() {
+		bg := v.owner.grants.authority.sdkBackground
+		if bg == nil {
+			return ErrUnavailable
+		}
+		for _, item := range items {
+			if item.JobID == id && item.Delegation != nil {
+				d := item.Delegation
+				_, code = bg.revoke(ctx, c, d.ID, d.Revision, d.StoreRevision)
+				return code
+			}
+		}
+		return ErrUnavailable
+	}
+	// Ordinary owners revoke background consent explicitly; disconnect/cancel
+	// must never silently turn into that different authorization operation.
+	return v.owner.cancelOwned(ctx, j)
+}
+func (v *sdkJobViews) result(ctx context.Context, c SessionCarriers, id string) (jobcontract.Result, Code) {
+	ctx, stop := context.WithTimeout(ctx, 3*time.Second)
+	defer stop()
+	a, code := v.actor(ctx, c)
+	if code != "" {
+		return jobcontract.Result{}, code
+	}
+	if code = v.budget(a); code != "" {
+		return jobcontract.Result{}, code
+	}
+	j := v.owner.jobs[id]
+	if j == nil || a.Principal() != j.actor.Principal() {
+		return jobcontract.Result{}, ErrDenied
+	}
+	if j.receipt.Job.State != jobcontract.Succeeded || j.receipt.Result == nil || j.failure != "" {
+		return jobcontract.Result{}, ErrUnavailable
+	}
+	// No background result adapter exists yet. Do not reuse the consent session.
+	if j.background != nil {
+		return jobcontract.Result{}, ErrUnavailable
+	}
+	copy := *j
+	copy.actor = a
+	copy.carriers = c
+	actor, proof, code := v.owner.validate(ctx, &copy, sdkJobCheckpoint{Phase: "before-result"})
+	if code != "" {
+		return jobcontract.Result{}, code
+	}
+	if code = v.owner.admission(&copy, actor, proof, 0, func() Code { return "" }); code != "" {
+		return jobcontract.Result{}, code
+	}
+	r := *j.receipt.Result
+	if jobcontract.ValidateResult(r) != "" {
+		return jobcontract.Result{}, ErrInvalid
+	}
+	return r, ""
+}
+func (v *sdkJobViews) aggregate() sdkJobAggregate {
+	out := sdkJobAggregate{Availability: "unavailable", Jobs: len(v.owner.jobs), Active: len(v.owner.grants.cohort.operations), JobCeiling: 256, ChildCeiling: 4}
+	for _, j := range v.owner.jobs {
+		if j.receipt.Job.State == jobcontract.CleanupRequired {
+			out.CleanupRequired++
+		}
+	}
+	return out
+}
+func (v *sdkJobViews) diagnose(ctx context.Context, c SessionCarriers, admin bool) (sdkJobDiagnostic, Code) {
+	ctx, stop := context.WithTimeout(ctx, 3*time.Second)
+	defer stop()
+	a, code := v.actor(ctx, c)
+	if code != "" {
+		return sdkJobDiagnostic{}, code
+	}
+	if admin && !a.Admin() {
+		return sdkJobDiagnostic{}, ErrDenied
+	}
+	if code = v.budget(a); code != "" {
+		return sdkJobDiagnostic{}, code
+	}
+	items, code := v.snapshot()
+	if code != "" {
+		return sdkJobDiagnostic{}, code
+	}
+	out := sdkJobDiagnostic{DiagnosticSchema: 1, Availability: "unavailable", Jobs: []sdkDiagnosticJob{}}
+	for _, i := range items {
+		if !admin && !v.owns(i.JobID, a) {
+			continue
+		}
+		out.Total++
+		if len(out.Jobs) == 10 {
+			out.Truncated = true
+			continue
+		}
+		alias, c := sdkRandomRef()
+		if c != "" {
+			return sdkJobDiagnostic{}, c
+		}
+		out.Jobs = append(out.Jobs, sdkDiagnosticJob{alias, i.State, i.SafeReason, i.CancelRequested, i.Drained, i.EffectsUnknown})
+	}
+	if _, code = v.owner.grants.authority.actor(ctx, c, &a); code != "" {
+		return sdkJobDiagnostic{}, code
+	}
+	raw, e := json.Marshal(out)
+	if e != nil || len(raw) > 32<<10 {
+		return sdkJobDiagnostic{}, ErrLimit
+	}
+	return out, ""
+}
+
+func (v *sdkJobViews) backgroundSummary(ctx context.Context, c SessionCarriers, id string) (sdkBackgroundSummary, Code) {
+	ctx, stop := context.WithTimeout(ctx, 3*time.Second)
+	defer stop()
+	actor, code := v.actor(ctx, c)
+	if code != "" {
+		return sdkBackgroundSummary{}, code
+	}
+	a := v.owner.grants.authority
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	p, ok := a.intents[id]
+	if !ok || p.background == nil || p.actor.Principal() != actor.Principal() || p.actor.SessionRef() != actor.SessionRef() {
+		return sdkBackgroundSummary{}, ErrDenied
+	}
+	if a.now().UnixMilli() >= p.intent.ExpiresAt {
+		return sdkBackgroundSummary{}, ErrExpired
+	}
+	if !nativeFresh(actor.account.CheckedAt, a.now()) {
+		return sdkBackgroundSummary{}, ErrStale
+	}
+	var revision uint64
+	if code = a.transaction(func(s *GrantStore) (bool, Code) { revision = s.Revision; return false, "" }); code != "" {
+		return sdkBackgroundSummary{}, code
+	}
+	pending := p.background
+	r := pending.record
+	b := r.Binding.Binding
+	// Clone canonical validated input; consumer mutation must not alter consent.
+	request, code := cloneSDKRequest(pending.request)
+	if code != "" {
+		return sdkBackgroundSummary{}, code
+	}
+	summary := sdkBackgroundSummary{Input: request.Input, IntentID: id, JobID: b.Job.ID, SummaryDigest: p.intent.SummaryDigest, StoreRevision: revision, App: b.Inventory.Package, Worker: b.Worker.ID, Parent: b.ParentGrant, Actions: []jobcontract.Action{}, Steps: len(request.Input.Steps), ExpiresAt: r.ExpiresAt, NotBefore: r.NotBefore, IntentExpiresAt: p.intent.ExpiresAt}
+	for _, action := range p.intent.Actions {
+		summary.Actions = append(summary.Actions, jobcontract.Action(action))
+	}
+	if code = nativeContextCode(ctx); code != "" {
+		return sdkBackgroundSummary{}, code
+	}
+	if !nativeFresh(actor.account.CheckedAt, a.now()) {
+		return sdkBackgroundSummary{}, ErrStale
+	}
+	if a.now().UnixMilli() >= p.intent.ExpiresAt {
+		return sdkBackgroundSummary{}, ErrExpired
+	}
+	raw, e := json.Marshal(summary)
+	if e != nil || len(raw) > 16<<10 || revision > (1<<53)-1 {
+		return sdkBackgroundSummary{}, ErrLimit
+	}
+	return summary, ""
+}
+func (v *sdkJobViews) lookupIntent(ctx context.Context, c SessionCarriers, id string) (sdkJobDisplay, Code) {
+	ctx, stop := context.WithTimeout(ctx, 3*time.Second)
+	defer stop()
+	actor, code := v.actor(ctx, c)
+	if code != "" {
+		return sdkJobDisplay{}, code
+	}
+	if code = v.budget(actor); code != "" {
+		return sdkJobDisplay{}, code
+	}
+	items, code := v.snapshot()
+	if code != "" {
+		return sdkJobDisplay{}, code
+	}
+	for _, item := range items {
+		if v.intentID(item.JobID) == id {
+			if !v.owns(item.JobID, actor) {
+				return sdkJobDisplay{}, ErrDenied
+			}
+			if _, code = v.owner.grants.authority.actor(ctx, c, &actor); code != "" {
+				return sdkJobDisplay{}, code
+			}
+			return item, ""
+		}
+	}
+	// A still-pending owner intent may be queried after a lost confirm reply;
+	// absence of a job never authorizes UI to create a replacement execution key.
+	a := v.owner.grants.authority
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	if p, ok := a.intents[id]; ok && p.actor.Principal() == actor.Principal() {
+		return sdkJobDisplay{}, ErrUnavailable
+	}
+	return sdkJobDisplay{}, ErrDenied
+}
+
+// Explicit CAS on both snapshot and durable delegation/store revisions. Admin
+// can revoke others, but never receives their private consent/input/result.
+func (v *sdkJobViews) revoke(ctx context.Context, c SessionCarriers, id string, snapshotRevision, delegationRevision, storeRevision uint64) (sdkBackgroundRevokeResult, Code) {
+	ctx, stop := context.WithTimeout(ctx, 3*time.Second)
+	defer stop()
+	actor, code := v.actor(ctx, c)
+	if code != "" {
+		return sdkBackgroundRevokeResult{}, code
+	}
+	items, code := v.snapshot()
+	if code != "" {
+		return sdkBackgroundRevokeResult{}, code
+	}
+	if !actor.Admin() && !v.owns(id, actor) {
+		return sdkBackgroundRevokeResult{}, ErrDenied
+	}
+	if snapshotRevision != v.revision {
+		return sdkBackgroundRevokeResult{}, ErrStale
+	}
+	bg := v.owner.grants.authority.sdkBackground
+	if bg == nil {
+		return sdkBackgroundRevokeResult{}, ErrUnsupported
+	}
+	for _, item := range items {
+		if item.JobID == id && item.Delegation != nil {
+			return bg.revoke(ctx, c, item.Delegation.ID, delegationRevision, storeRevision)
+		}
+	}
+	return sdkBackgroundRevokeResult{}, ErrUnsupported
+}

package/templates/native-go/backend/internal/helper/sdk_display_contract.go

@@ -0,0 +1,121 @@
+//go:build synopkgland_sdk_workers
+
+package helper
+
+import (
+	"dsmapp/internal/helper/jobcontract"
+	"sync/atomic"
+	"time"
+)
+
+// S5 display projections. These references index trusted-owner records, never
+// grant execution authority. No Binding, principal, session or input is public.
+type sdkDelegationDisplay struct {
+	ID            string `json:"id"`
+	Revision      uint64 `json:"revision"`
+	StoreRevision uint64 `json:"storeRevision"`
+	State         string `json:"state"`
+	ExpiresAt     uint64 `json:"expiresAt"`
+}
+type sdkJobDisplay struct {
+	Delegation      *sdkDelegationDisplay  `json:"delegation,omitempty"`
+	KnownEffects    jobcontract.Result     `json:"knownEffects"`
+	JobID           string                 `json:"jobId"`
+	Revision        uint64                 `json:"revision"`
+	Mode            jobcontract.Mode       `json:"mode"`
+	State           jobcontract.State      `json:"state"`
+	SafeReason      jobcontract.SafeReason `json:"safeReason,omitempty"`
+	Progress        jobcontract.Progress   `json:"progress"`
+	AcceptedAt      uint64                 `json:"acceptedAt"`
+	StartedAt       *uint64                `json:"startedAt,omitempty"`
+	FinishedAt      *uint64                `json:"finishedAt,omitempty"`
+	CancelRequested bool                   `json:"cancelRequested"`
+	Drained         bool                   `json:"drained"`
+	EffectsUnknown  bool                   `json:"effectsUnknown"`
+}
+type sdkAdminJobDisplay struct {
+	JobID           string                 `json:"jobId"`
+	Revision        uint64                 `json:"revision"`
+	State           jobcontract.State      `json:"state"`
+	SafeReason      jobcontract.SafeReason `json:"safeReason,omitempty"`
+	CancelRequested bool                   `json:"cancelRequested"`
+	Drained         bool                   `json:"drained"`
+	EffectsUnknown  bool                   `json:"effectsUnknown"`
+}
+type sdkJobPage struct {
+	Revision   uint64          `json:"revision"`
+	Items      []sdkJobDisplay `json:"items"`
+	NextCursor string          `json:"nextCursor,omitempty"`
+}
+type sdkJobAggregate struct {
+	Availability    string `json:"availability"`
+	Jobs            int    `json:"jobs"`
+	Active          int    `json:"active"`
+	CleanupRequired int    `json:"cleanupRequired"`
+	JobCeiling      int    `json:"jobCeiling"`
+	ChildCeiling    int    `json:"childCeiling"`
+}
+type sdkDiagnosticJob struct {
+	Alias           string                 `json:"alias"`
+	State           jobcontract.State      `json:"state"`
+	SafeReason      jobcontract.SafeReason `json:"safeReason,omitempty"`
+	CancelRequested bool                   `json:"cancelRequested"`
+	Drained         bool                   `json:"drained"`
+	EffectsUnknown  bool                   `json:"effectsUnknown"`
+}
+type sdkJobDiagnostic struct {
+	DiagnosticSchema int                `json:"diagnosticSchema"`
+	Availability     string             `json:"availability"`
+	Jobs             []sdkDiagnosticJob `json:"jobs"`
+	Total            int                `json:"total"`
+	Truncated        bool               `json:"truncated"`
+}
+
+// Summary is produced from the exact pending server record, never browser text.
+// Scope is an opaque parent reference. S7 can supply a separately authorized
+// display label; paths/input segments must never enter diagnostic exports.
+type sdkBackgroundSummary struct {
+	Input           jobcontract.Input       `json:"input"`
+	IntentID        string                  `json:"intentId"`
+	JobID           string                  `json:"jobId"`
+	SummaryDigest   string                  `json:"summaryDigest"`
+	StoreRevision   uint64                  `json:"storeRevision"`
+	App             string                  `json:"app"`
+	Worker          string                  `json:"worker"`
+	Parent          jobcontract.RevisionRef `json:"parent"`
+	Actions         []jobcontract.Action    `json:"actions"`
+	Steps           int                     `json:"steps"`
+	ExpiresAt       uint64                  `json:"expiresAt"`
+	NotBefore       uint64                  `json:"notBefore"`
+	IntentExpiresAt int64                   `json:"intentExpiresAt"`
+}
+
+// Pagination carries no owner progress or counters into the admin DTO.
+type sdkAdminJobPage struct {
+	Revision   uint64               `json:"revision"`
+	Items      []sdkAdminJobDisplay `json:"items"`
+	NextCursor string               `json:"nextCursor,omitempty"`
+}
+
+// Owned by the same sole supervisor loop. Only enter/leave may run at ingress;
+// S7 must enqueue every other call. No production constructor installs this.
+type sdkJobViews struct {
+	history    map[string]sdkJournalRecord // display-only; never loaded into owner jobs
+	owner      *sdkJobOwner
+	revision   uint64
+	hash       [32]byte
+	cursors    map[string]sdkStatusCursor
+	counts     map[uint32]int
+	second     int64
+	concurrent atomic.Int32
+}
+type sdkStatusCursor struct {
+	admin     bool
+	principal Principal
+	session   string
+	inventory Inventory
+	epoch     string
+	revision  uint64
+	offset    int
+	expires   time.Time
+}