@synopackageland/cli 0.5.0 → 0.6.0

package/dist/templates/native-go/backend/internal/helper/sdk_background_invalidation.go

@@ -1,218 +0,0 @@
-//go:build synopkgland_sdk_workers
-
-package helper
-
-import (
-	"context"
-	"dsmapp/internal/helper/jobcontract"
-	"math"
-	"slices"
-)
-
-// Runs inside the SAME authority transaction after its parent mutation. Close
-// every affected output gate before fsync; record fan-out is one snapshot R.
-// selected additionally revokes a changed actor's delegation on foreign grants.
-func (a *GrantAuthority) sdkInvalidateDerivedLocked(s *GrantStore, selected map[RelaxedIdentity]bool) (bool, Code) {
-	changed := false
-	for n := range s.Background {
-		r := &s.Background[n]
-		bind := r.Binding.Binding
-		g := findGrant(s, bind.ParentGrant.ID)
-		badParent := g == nil || g.State != GrantActive || g.Revision != bind.ParentGrant.Revision || sdkInventory(g.Inventory) != bind.Inventory || g.LastValidated.Epoch != bind.Epoch || g.ApprovalBinding != bind.ApprovalBinding || g.CapabilityDigest != bind.CapabilityDigest
-		if !badParent && !selected[sdkIdentity(r.Binding.Actor)] && !selected[sdkIdentity(r.Issuer)] {
-			continue
-		}
-		if a.sdkJobs != nil {
-			for _, j := range a.sdkJobs.jobs {
-				if j.request.Control.Binding.ParentGrant.ID == bind.ParentGrant.ID && badParent || j.background != nil && j.background.id == bind.Delegation.ID {
-					a.sdkJobs.reject(j, ErrRevoked)
-				}
-			}
-		}
-		if r.State != "active" && r.State != "consumed" {
-			continue
-		}
-		if r.Binding.Binding.Delegation.Revision == math.MaxUint64 {
-			return false, ErrLimit
-		}
-		r.State = "revoked"
-		r.Reason = jobcontract.SafeReason(ErrRevoked)
-		r.Binding.Binding.Delegation.Revision++
-		changed = true
-	}
-	if a.sdkJobs != nil {
-		for _, j := range a.sdkJobs.jobs {
-			p := findGrant(s, j.request.Control.Binding.ParentGrant.ID)
-			if p == nil || p.State != GrantActive || p.Revision != j.request.Control.Binding.ParentGrant.Revision || j.actor.IdentityBasis() == "uid-username" && selected[relaxedActorIdentity(j.actor)] {
-				a.sdkJobs.reject(j, ErrRevoked)
-			}
-		}
-	}
-	for id, intent := range a.intents {
-		if intent.background != nil {
-			p := findGrant(s, intent.background.record.Binding.Binding.ParentGrant.ID)
-			if p == nil || p.State != GrantActive || selected[sdkIdentity(intent.background.record.Binding.Actor)] {
-				delete(a.intents, id)
-			}
-		}
-	}
-	return changed, ""
-}
-
-// Complete bounded index: repository owner/issuer + delegations + retained
-// journal + current owner/cohort. No caller-provided 'complete' bit is trusted.
-// Journal I/O precedes the grant transaction (never reenters grants.lock).
-func (a *GrantAuthority) sdkIdentitiesLocked() ([]RelaxedIdentity, Code) {
-	identities := []RelaxedIdentity{}
-	add := func(id RelaxedIdentity) Code {
-		if !validRelaxedIdentity(id) {
-			return ErrCleanupRequired
-		}
-		if !slices.Contains(identities, id) {
-			identities = append(identities, id)
-		}
-		if len(identities) > 1024 {
-			return ErrLimit
-		}
-		return ""
-	}
-	if a.sdkBackground != nil {
-		records, c := a.sdkBackground.journal.Records()
-		if c != "" {
-			return nil, ErrCleanupRequired
-		}
-		for _, r := range records {
-			if c := add(sdkIdentity(r.Intent.Actor)); c != "" {
-				return nil, c
-			}
-		}
-	}
-	c := a.transaction(func(s *GrantStore) (bool, Code) {
-		if len(s.Background) > 0 && a.sdkBackground == nil {
-			return false, ErrCleanupRequired
-		}
-		for _, g := range s.Grants {
-			for _, p := range []Principal{g.Owner, g.Issuer} {
-				if p.IdentityBasis == "uid-username" {
-					if c := add(relaxedPrincipalIdentity(p)); c != "" {
-						return false, c
-					}
-				}
-			}
-		}
-		for _, r := range s.Background {
-			for _, p := range []jobcontract.Principal{r.Binding.Actor, r.Issuer} {
-				if c := add(sdkIdentity(p)); c != "" {
-					return false, c
-				}
-			}
-		}
-		return false, ""
-	})
-	if c != "" {
-		return nil, c
-	}
-	if a.sdkJobs != nil {
-		for _, j := range a.sdkJobs.jobs {
-			if j.actor.IdentityBasis() == "uid-username" {
-				if c := add(relaxedActorIdentity(j.actor)); c != "" {
-					return nil, c
-				}
-			}
-		}
-		for _, op := range a.sdkJobs.grants.cohort.operations {
-			if op.actor.IdentityBasis() == "uid-username" {
-				if c := add(relaxedActorIdentity(op.actor)); c != "" {
-					return nil, c
-				}
-			}
-		}
-	}
-	return identities, ""
-}
-func (a *GrantAuthority) sdkIdentityClosureLocked(seeds []RelaxedIdentity) ([]RelaxedIdentity, Code) {
-	recorded, c := a.sdkIdentitiesLocked()
-	if c != "" {
-		return nil, c
-	}
-	result := []RelaxedIdentity{}
-	for _, seed := range seeds {
-		closure, c := backgroundIdentityClosure([]RelaxedIdentity{seed}, recorded, true)
-		if c != "" {
-			return nil, c
-		}
-		for _, id := range closure {
-			if !slices.Contains(result, id) {
-				result = append(result, id)
-			}
-		}
-	}
-	return result, ""
-}
-func (b *sdkBackgroundOwner) finishRevokedLocked(j *sdkJob) Code {
-	if j.terminal {
-		return ""
-	}
-	if j.journalUncertain {
-		return ErrCleanupRequired
-	}
-	c := b.jobs.grants.cohort
-	if j.op != nil {
-		if _, exists := c.operations[j.op.binding.OperationID]; exists {
-			return ErrCleanupRequired
-		}
-		if j.op.process != nil {
-			if _, exists := c.receipts[j.op.binding.OperationID]; !exists {
-				return ErrCleanupRequired
-			}
-		}
-	}
-	if code := b.journal.Cancel(j.request.Control.Binding); code != "" {
-		b.fenceLocked(j, code)
-		return ErrCleanupRequired
-	}
-	r := j.receipt
-	now := uint64(max(b.jobs.grants.authority.now().UnixMilli(), int64(r.Job.AcceptedAt)))
-	r.Job.State = jobcontract.Canceled
-	r.Job.Reason = jobcontract.ReasonCanceled
-	r.Job.CancelRequested = true
-	r.Job.Drained = true
-	r.Job.FinishedAt = &now
-	r.Result = nil
-	if code := b.journal.Finish(r); code != "" {
-		b.fenceLocked(j, code)
-		return ErrCleanupRequired
-	}
-	j.receipt = r
-	j.terminal = true
-	j.carriers = SessionCarriers{}
-	return ""
-}
-func (b *sdkBackgroundOwner) finishParentLocked(id string) Code {
-	for _, j := range b.jobs.jobs {
-		if j.background != nil && j.request.Control.Binding.ParentGrant.ID == id && j.failure != "" {
-			if c := b.finishRevokedLocked(j); c != "" {
-				return c
-			}
-		}
-	}
-	return ""
-}
-func (b *sdkBackgroundOwner) finishIdentitiesLocked(selected map[RelaxedIdentity]bool) Code {
-	for _, j := range b.jobs.jobs {
-		if j.background != nil && selected[j.background.snapshot.identity] && j.failure != "" {
-			if c := b.finishRevokedLocked(j); c != "" {
-				return c
-			}
-		}
-	}
-	return ""
-}
-func (b *sdkBackgroundOwner) invalidateIdentities(ctx context.Context, ids []RelaxedIdentity) Code {
-	a := b.jobs.grants.authority
-	if a.native == nil || a.native.relaxed == nil {
-		a.Fence()
-		return ErrCleanupRequired
-	}
-	return a.native.relaxed.invalidate(ctx, ids)
-}

package/dist/templates/native-go/backend/internal/helper/sdk_background_lease.go

@@ -1,218 +0,0 @@
-//go:build synopkgland_sdk_workers
-
-package helper
-
-import (
-	"context"
-	"dsmapp/internal/helper/jobcontract"
-	"time"
-)
-
-// SDK-only monotonic source for the lifetime of one owner. Never serialize the
-// monotonic baseline or reconstruct it from a retained wall-clock deadline.
-func newSDKEpochClock() sdkBackgroundClock {
-	origin := time.Now()
-	return func() (time.Time, time.Duration, bool) {
-		now := time.Now()
-		elapsed := now.Sub(origin)
-		return now, elapsed, elapsed >= 0
-	}
-}
-
-// Every step/chunk/result must enter this guard. The callback has the same
-// nonblocking/no-I/O rule as WithGrantAdmission and runs at its SAME ordering
-// point. A successful consume is never a lease for the entire job.
-func (b *sdkBackgroundOwner) admit(ctx context.Context, id string, step uint64, reserve func() Code) Code {
-	j := b.job(id)
-	if j == nil || j.background == nil || !j.background.consumed || reserve == nil || step >= uint64(len(j.request.Input.Steps)) {
-		return ErrInvalid
-	}
-	ctx, cancel := context.WithTimeout(ctx, MetadataTimeout)
-	defer cancel()
-	r, p, c := b.check(ctx, j)
-	if c != "" {
-		if c == ErrFenced {
-			b.observerFenced()
-			return c
-		}
-		b.invalidateJob(ctx, j, c)
-		return c
-	}
-	a := b.jobs.grants.authority
-	cohort := b.jobs.grants.cohort
-	a.mu.Lock()
-	c = a.transaction(func(s *GrantStore) (bool, Code) {
-		current := findBackground(s, id)
-		if current == nil || current.State != "consumed" || current.ExecutionKey != j.request.Control.Intent.ID || current.Binding.Binding.Delegation.Revision != r.Binding.Binding.Delegation.Revision {
-			return false, ErrRevoked
-		}
-		if c := b.clockCheck(j, *current); c != "" {
-			return false, c
-		}
-		if c := nativeContextCode(ctx); c != "" {
-			return false, c
-		}
-		now := a.now()
-		if !nativeFresh(j.background.snapshot.checkedAt, now) || !nativeFresh(p.CheckedAt, now) {
-			return false, ErrStale
-		}
-		if c := b.parentLocked(s, *current, j.request.Input, p); c != "" {
-			return false, c
-		}
-		if !cohort.allowed() {
-			return false, ErrFenced
-		}
-		if j.failure != "" || j.op == nil || j.op.canceled || cohort.operations[j.op.binding.OperationID] != j.op {
-			return false, ErrCanceled
-		}
-		return false, safeGrantCode(reserve())
-	})
-	a.mu.Unlock()
-	if c != "" {
-		if c == ErrFenced {
-			b.observerFenced()
-			return c
-		}
-		b.invalidateJob(ctx, j, c)
-	}
-	return c
-}
-
-// Existing owner loop polling: expired/unknown proofs latch denial and drain.
-// There are at most 16 pending + 2 active background jobs. No new queue/owner
-// goroutine, no dispatch, and progress cannot refresh any deadline.
-func (b *sdkBackgroundOwner) poll(ctx context.Context) Code {
-	for _, j := range b.jobs.jobs {
-		if j.background == nil || j.terminal {
-			continue
-		}
-		if j.failure != "" {
-			a := b.jobs.grants.authority
-			a.mu.Lock()
-			fenced := a.fenced
-			a.mu.Unlock()
-			if fenced || j.journalUncertain {
-				return ErrCleanupRequired
-			}
-			if c := b.invalidateJob(ctx, j, j.failure); c != "" {
-				return c
-			}
-			continue
-		}
-		if _, _, c := b.check(ctx, j); c != "" {
-			if c == ErrFenced {
-				b.observerFenced()
-				return c
-			}
-			if c := b.invalidateJob(ctx, j, c); c != "" {
-				return c
-			}
-		}
-	}
-	return ""
-}
-
-type sdkBackgroundRevokeResult struct {
-	DelegationID string `json:"delegationId"`
-	Revision     uint64 `json:"revision"`
-	Revoked      bool   `json:"revoked"`
-	Drained      bool   `json:"drained"`
-}
-
-func (b *sdkBackgroundOwner) revoke(ctx context.Context, carriers SessionCarriers, id string, revision, storeRevision uint64) (sdkBackgroundRevokeResult, Code) {
-	result := sdkBackgroundRevokeResult{}
-	if !allReferences(id) || revision == 0 || storeRevision == 0 {
-		return result, ErrInvalid
-	}
-	a := b.jobs.grants.authority
-	actor, c := a.actor(ctx, carriers, nil)
-	if c != "" {
-		return result, c
-	}
-	j := b.job(id)
-	a.mu.Lock()
-	c = a.transaction(func(s *GrantStore) (bool, Code) {
-		if c := nativeContextCode(ctx); c != "" {
-			return false, c
-		}
-		if !nativeFresh(actor.account.CheckedAt, a.now()) {
-			return false, ErrStale
-		}
-		r := findBackground(s, id)
-		if r == nil {
-			return false, ErrDenied
-		}
-		if !actor.Admin() && sdkIdentity(r.Binding.Actor) != relaxedActorIdentity(actor) {
-			return false, ErrDenied
-		}
-		if s.Revision != storeRevision || r.Binding.Binding.Delegation.Revision != revision {
-			return false, ErrStale
-		}
-		if j != nil {
-			b.jobs.reject(j, ErrRevoked)
-		}
-		result.DelegationID = id
-		result.Revision = revision
-		if r.State == "revoked" || r.State == "expired" || r.State == "suspended" {
-			return false, ""
-		}
-		if revision == ^uint64(0) || s.Revision == ^uint64(0) {
-			return false, ErrLimit
-		}
-		r.State = "revoked"
-		r.Reason = jobcontract.SafeReason(ErrRevoked)
-		r.Binding.Binding.Delegation.Revision++
-		s.Revision++
-		result.Revision++
-		return true, ""
-	})
-	if c != "" && result.DelegationID != "" {
-		b.fenceLocked(j, c)
-	}
-	a.mu.Unlock()
-	if c != "" {
-		if result.DelegationID != "" && j != nil {
-			b.drainJob(ctx, j)
-		}
-		return result, c
-	}
-	result.Revoked = true
-	if j == nil {
-		return result, ErrCleanupRequired
-	} // old epoch needs separate lifetime proof
-	if c := b.drainJob(ctx, j); c != "" {
-		return result, c
-	}
-	result.Drained = true
-	return result, ""
-}
-func (b *sdkBackgroundOwner) drainJob(ctx context.Context, j *sdkJob) Code {
-	a := b.jobs.grants.authority
-	a.mu.Lock()
-	c := b.journal.Cancel(j.request.Control.Binding)
-	if c != "" {
-		b.fenceLocked(j, c)
-	}
-	a.mu.Unlock()
-	drainCtx, cancel := context.WithTimeout(ctx, RevokeDrainTimeout)
-	defer cancel()
-	err := b.jobs.grants.cohort.drainSelected(drainCtx, TerminateGrace, func(op *cohortOperation) bool { return op == j.op })
-	a.mu.Lock()
-	defer a.mu.Unlock()
-	if c != "" || err != nil {
-		b.fenceLocked(j, ErrCleanupRequired)
-		return ErrCleanupRequired
-	}
-	return b.finishRevokedLocked(j)
-}
-
-// An observer/lifecycle fence closes every output immediately, but signals
-// belong to the existing owner after its durable lifecycle fence, as in S2.
-func (b *sdkBackgroundOwner) observerFenced() {
-	a := b.jobs.grants.authority
-	a.mu.Lock()
-	defer a.mu.Unlock()
-	for _, j := range b.jobs.jobs {
-		b.jobs.reject(j, ErrFenced)
-	}
-}

package/dist/templates/native-go/backend/internal/helper/sdk_background_snapshot.go

@@ -1,110 +0,0 @@
-//go:build synopkgland_sdk_workers
-
-package helper
-
-import (
-	"dsmapp/internal/helper/jobcontract"
-	"math"
-	"reflect"
-)
-
-func cloneSDKBackgrounds(rs []jobcontract.BackgroundRecord) []jobcontract.BackgroundRecord {
-	if rs == nil {
-		return nil
-	}
-	out := make([]jobcontract.BackgroundRecord, len(rs))
-	copy(out, rs)
-	for n := range out {
-		if d := out[n].Binding.Binding.Delegation; d != nil {
-			v := *d
-			out[n].Binding.Binding.Delegation = &v
-		}
-	}
-	return out
-}
-func findBackground(s *GrantStore, id string) *jobcontract.BackgroundRecord {
-	for n := range s.Background {
-		r := &s.Background[n]
-		if r.Binding.Binding.Delegation != nil && r.Binding.Binding.Delegation.ID == id {
-			return r
-		}
-	}
-	return nil
-}
-func validateSDKBackgroundStore(s GrantStore) Code {
-	seen := map[string]bool{}
-	jobs := map[string]bool{}
-	keys := map[string]bool{}
-	for _, g := range s.Grants {
-		seen[g.ID] = true
-	}
-	for _, r := range s.Background {
-		if c := jobcontract.ValidateBackground(r); c != "" {
-			return sdkCode(c)
-		}
-		b := r.Binding.Binding
-		id := b.Delegation.ID
-		if seen[id] || jobs[b.Job.ID] {
-			return ErrInvalid
-		}
-		seen[id] = true
-		jobs[b.Job.ID] = true
-		if r.ExecutionKey != "" {
-			if keys[r.ExecutionKey] {
-				return ErrReplay
-			}
-			keys[r.ExecutionKey] = true
-		}
-		g := findGrant(&s, b.ParentGrant.ID)
-		if g == nil {
-			return ErrInvalid
-		}
-		if r.State == "active" || r.State == "consumed" {
-			if g.State != GrantActive || g.Revision != b.ParentGrant.Revision || sdkInventory(g.Inventory) != b.Inventory || g.ApprovalBinding != b.ApprovalBinding || g.CapabilityDigest != b.CapabilityDigest || g.LastValidated.Epoch != b.Epoch {
-				return ErrDenied
-			}
-		}
-	}
-	return ""
-}
-func validateSDKBackgroundTransition(old, next GrantStore, p GrantPolicy) Code {
-	for _, before := range old.Background {
-		after := findBackground(&next, before.Binding.Binding.Delegation.ID)
-		if after == nil {
-			return ErrDenied
-		}
-		if reflect.DeepEqual(before, *after) {
-			continue
-		}
-		revision := before.Binding.Binding.Delegation.Revision
-		if revision == math.MaxUint64 || after.Binding.Binding.Delegation.Revision != revision+1 {
-			return ErrStale
-		}
-		if before.State != "active" && before.State != "consumed" {
-			return ErrDenied
-		}
-		if after.State != "revoked" && after.State != "expired" && after.State != "suspended" && !(before.State == "active" && after.State == "consumed") {
-			return ErrDenied
-		}
-		normalized := cloneSDKBackgrounds([]jobcontract.BackgroundRecord{*after})[0]
-		normalized.Binding.Binding.Delegation.Revision = revision
-		normalized.State = before.State
-		normalized.Reason = before.Reason
-		if before.State == "active" && after.State == "consumed" {
-			normalized.ExecutionKey = before.ExecutionKey
-		}
-		if !reflect.DeepEqual(before, normalized) {
-			return ErrDenied
-		}
-	}
-	for _, r := range next.Background {
-		if findBackground(&old, r.Binding.Binding.Delegation.ID) != nil {
-			continue
-		}
-		b := r.Binding.Binding
-		if next.Schema != 2 || r.State != "active" || b.Delegation.Revision != 1 || b.Epoch != p.Epoch || b.Inventory != sdkInventory(p.Inventory) || b.ApprovalBinding != p.ApprovalBinding || b.CapabilityDigest != p.CapabilityDigest || !p.Enabled {
-			return ErrDenied
-		}
-	}
-	return ""
-}