@synopackageland/cli 0.5.0 → 0.6.0

package/templates/native-go/backend/internal/helper/sdk_public_vm_linux_test.go

@@ -1,129 +0,0 @@
-//go:build linux && synopkgland_sdk_workers
-
-package helper
-
-import (
-	"bytes"
-	"dsmapp/internal/helper/jobcontract"
-	"encoding/json"
-	"os"
-	"os/exec"
-	"testing"
-	"time"
-)
-
-func sdkPublicCall(t *testing.T, p LinuxProcesses, cookie, method string, args any, into any) Code {
-	t.Helper()
-	inv, _ := json.Marshal(p.Expected)
-	raw, _ := json.Marshal(map[string]any{"method": method, "params": args})
-	cmd := exec.Command("/sdk-public-client", string(inv), cookie)
-	cmd.Stdin = bytes.NewReader(raw)
-	output, err := cmd.CombinedOutput()
-	if err != nil {
-		t.Fatalf("public client %v: %s", err, output)
-	}
-	var response struct {
-		Success bool            `json:"success"`
-		Data    json.RawMessage `json:"data"`
-		Error   struct {
-			Code Code `json:"code"`
-		} `json:"error"`
-	}
-	if json.Unmarshal(output, &response) != nil {
-		t.Fatalf("public envelope %s", output)
-	}
-	if !response.Success {
-		return response.Error.Code
-	}
-	if into != nil && json.Unmarshal(response.Data, into) != nil {
-		t.Fatalf("public data %s", output)
-	}
-	return ""
-}
-func TestLinuxSDKPublicRoutesExecuteAndExpireThroughProductionOwner(t *testing.T) {
-	p := sdkJobVMFixture(t, "/helper-sdk-public")
-	proc := startVMHelper(t, p)
-	var grant Grant
-	deadline := time.Now().Add(3 * time.Second)
-	for time.Now().Before(deadline) {
-		raw, _ := os.ReadFile(p.StateDir + "/grants.json")
-		store, c := DecodeGrantStore(bytes.NewReader(raw))
-		if c == "" && len(store.Grants) > 0 {
-			grant = store.Grants[len(store.Grants)-1]
-			break
-		}
-		time.Sleep(20 * time.Millisecond)
-	}
-	if grant.ID == "" {
-		t.Fatal("fixture root grant missing")
-	}
-	prepare := func() sdkPrepared {
-		var out sdkPrepared
-		amount := uint64(2 << 20)
-		c := sdkPublicCall(t, p, "sdk-vm-only", "jobs.prepare", sdkPrepareArgs{Worker: jobcontract.RevisionRef{ID: "scan", Revision: 1}, Parent: jobcontract.RevisionRef{ID: grant.ID, Revision: grant.Revision}, Input: jobcontract.Input{Steps: []jobcontract.Step{{Action: jobcontract.ReadStream, Segments: []string{"group"}, MaxBytes: &amount}}}}, &out)
-		if c != "" {
-			t.Fatal("prepare", c)
-		}
-		return out
-	}
-	for _, expire := range []bool{false, true} {
-		if expire {
-			os.WriteFile(sdkTestVMRoot+"/paced", nil, 0600)
-			os.WriteFile(sdkTestVMRoot+"/group", bytes.Repeat([]byte("x"), 1<<20), 0640)
-		}
-		prepared := prepare()
-		var lease sdkAttachReceipt
-		if c := sdkPublicCall(t, p, "sdk-vm-only", "jobs.submit", sdkSubmitArgs{prepared.IntentID, prepared.SummaryDigest}, &lease); c != "" {
-			t.Fatal("submit", c)
-		}
-		if lease.TTLMS != 6000 || lease.RenewAfterMS != 2000 {
-			t.Fatal(lease)
-		}
-		if c := sdkPublicCall(t, p, "foreign", "jobs.attach", sdkAttachArgs{lease.JobID, lease.AttachID}, nil); c != ErrDenied {
-			t.Fatal("foreign attach", c)
-		}
-		if !expire {
-			os.Remove(sdkTestVMRoot + "/hold")
-		}
-		deadline := time.Now().Add(9 * time.Second)
-		var found sdkJobDisplay
-		for time.Now().Before(deadline) {
-			time.Sleep(600 * time.Millisecond)
-			var page sdkJobPage
-			c := sdkPublicCall(t, p, "sdk-vm-only", "jobs.status", sdkStatusArgs{}, &page)
-			if c == ErrBusy {
-				continue
-			}
-			if c != "" {
-				t.Fatal("status", c)
-			}
-			for _, item := range page.Items {
-				if item.JobID == lease.JobID {
-					found = item
-				}
-			}
-			if found.Drained {
-				break
-			}
-		}
-		if !found.Drained {
-			t.Fatal("no Q", found)
-		}
-		want := jobcontract.Succeeded
-		if expire {
-			want = jobcontract.Canceled
-		}
-		if found.State != want {
-			t.Fatal("terminal", found)
-		}
-		if expire {
-			if c := sdkPublicCall(t, p, "sdk-vm-only", "jobs.attach", sdkAttachArgs{lease.JobID, lease.AttachID}, nil); c == "" {
-				t.Fatal("late renewal accepted")
-			}
-		}
-		if len(processChildren(proc.PID)) != 1 {
-			t.Fatal("unreaped child")
-		}
-		time.Sleep(time.Second)
-	}
-}

package/templates/native-go/backend/internal/helper/sdk_relaxed_invalidation.go

@@ -1,242 +0,0 @@
-//go:build synopkgland_sdk_workers
-
-package helper
-
-import (
-	"context"
-	"math"
-)
-
-// A deleted account cannot supply its former UID. Select its recorded identity
-// by the validated native name, never drop invalidation because lookup failed.
-func (r *relaxedProvider) invalidateName(ctx context.Context, name string, observed ...RelaxedIdentity) Code {
-	a := r.authority
-	a.mu.Lock()
-	selected := map[RelaxedIdentity]bool{}
-	related := func(id RelaxedIdentity) bool {
-		if id.Username == name {
-			return true
-		}
-		for _, current := range observed {
-			if validRelaxedIdentity(current) && relaxedRelated(id, current) {
-				return true
-			}
-		}
-		return false
-	}
-	for id := range r.principals {
-		if related(id) {
-			selected[id] = true
-		}
-	}
-	code := a.transaction(func(s *GrantStore) (bool, Code) {
-		for _, g := range s.Grants {
-			for _, p := range []Principal{g.Owner, g.Issuer} {
-				if p.IdentityBasis == "uid-username" && related(relaxedPrincipalIdentity(p)) {
-					selected[relaxedPrincipalIdentity(p)] = true
-				}
-			}
-		}
-		return false, ""
-	})
-	if code != "" {
-		a.mu.Unlock()
-		return ErrCleanupRequired
-	}
-	if a.sdkJobs != nil || a.sdkBackground != nil {
-		records, c := a.sdkIdentitiesLocked()
-		if c != "" {
-			a.fenced = true
-			a.mu.Unlock()
-			return ErrCleanupRequired
-		}
-		for _, id := range records {
-			if related(id) {
-				selected[id] = true
-			}
-		}
-	}
-	if len(selected) == 0 {
-		a.mu.Unlock()
-		return ""
-	}
-	ids := make([]RelaxedIdentity, 0, len(selected))
-	for id := range selected {
-		ids = append(ids, id)
-	}
-	return r.invalidateLocked(ctx, ids)
-}
-
-// Observed identity changes use the existing S3 transaction/order, never an
-// auxiliary store. Old generations are denied before R and never reused.
-func (r *relaxedProvider) invalidate(ctx context.Context, ids []RelaxedIdentity) Code {
-	if r == nil || r.authority == nil {
-		return ErrUnavailable
-	}
-	r.authority.mu.Lock()
-	return r.invalidateLocked(ctx, ids)
-}
-
-// Takes ownership of the held admission lock; all exit paths release it.
-func (r *relaxedProvider) invalidateLocked(ctx context.Context, ids []RelaxedIdentity, prospective ...RelaxedIdentity) Code {
-	ctx, cancel := context.WithTimeout(ctx, MetadataTimeout)
-	defer cancel()
-	a := r.authority
-	var closureCode Code
-	ids, closureCode = a.sdkIdentityClosureLocked(ids)
-	if closureCode != "" {
-		a.fenced = true
-		clear(a.intents)
-		if a.gate != nil {
-			a.gate.fenceLocked("sdk-identity-index-incomplete")
-		}
-		a.mu.Unlock()
-		return ErrCleanupRequired
-	}
-	selected := map[RelaxedIdentity]bool{}
-	blocked := map[RelaxedIdentity]bool{}
-	for _, id := range append(append([]RelaxedIdentity{}, ids...), prospective...) {
-		if !validRelaxedIdentity(id) || r.blocked[id] {
-			a.fenced = true
-			a.mu.Unlock()
-			return ErrCleanupRequired
-		}
-		blocked[id] = true
-	}
-	for id := range blocked {
-		r.blocked[id] = true
-	}
-	for _, id := range ids {
-		selected[id] = true
-		delete(r.principals, id)
-	}
-	for id, pending := range a.intents {
-		if selected[relaxedActorIdentity(pending.actor)] {
-			delete(a.intents, id)
-		}
-	}
-	keys := []GrantDrainKey{}
-	code := safeGrantCode(a.repository.Transact(func(policy GrantPolicy, s *GrantStore) (bool, Code) {
-		if policy != a.policy || !policy.Enabled || a.fenced {
-			return false, ErrFenced
-		}
-		// Plan all revisions first, so overflow or malformed authority cannot partly R.
-		indices := []int{}
-		for n, g := range s.Grants {
-			affected := false
-			for _, p := range []Principal{g.Owner, g.Issuer} {
-				if p.IdentityBasis == "uid-username" && selected[relaxedPrincipalIdentity(p)] {
-					affected = true
-				}
-			}
-			if !affected {
-				continue
-			}
-			revision := g.Revision
-			if g.State != GrantRevoked {
-				if revision == math.MaxUint64 || s.Revision == math.MaxUint64 {
-					return false, ErrLimit
-				}
-				revision++
-				indices = append(indices, n)
-			}
-			keys = append(keys, GrantDrainKey{policy.Epoch, g.ID, revision})
-		}
-		for _, n := range indices {
-			g := &s.Grants[n]
-			g.State = GrantRevoked
-			g.Reason = ErrRevoked
-			g.RevokedAt = max(g.CreatedAt, a.now().UnixMilli())
-			g.Revision++
-		}
-		derived, c := a.sdkInvalidateDerivedLocked(s, selected)
-		if c != "" {
-			return false, c
-		}
-		changed := len(indices) > 0 || derived
-		if changed {
-			if s.Revision == math.MaxUint64 {
-				return false, ErrLimit
-			}
-			s.Revision++
-		}
-		return changed, ""
-	}))
-	if code != "" {
-		a.fenced = true
-		clear(a.intents)
-	}
-	a.mu.Unlock()
-	complete := code == ""
-	// The caller's operations on foreign shared grants must stop without rewriting
-	// those grants. This seam must prove actual owned-child/relay completion.
-	identityCohort, ok := a.cohort.(relaxedIdentityCohort)
-	if !ok {
-		complete = false
-	} else {
-		for id := range selected {
-			if c := nativeObservationCode(ctx, identityCohort.drainRelaxedIdentity(ctx, id)); c != "" {
-				complete = false
-			}
-		}
-	}
-	for _, key := range keys {
-		q, c := a.drain(ctx, key)
-		if c != "" {
-			complete = false
-			continue
-		}
-		if code == "" {
-			a.mu.Lock()
-			saved := safeGrantCode(a.repository.SaveQuiescence(q))
-			if saved == "" && a.sdkBackground != nil {
-				saved = a.sdkBackground.finishParentLocked(key.GrantID)
-			}
-			a.mu.Unlock()
-			if saved != "" {
-				complete = false
-			}
-		}
-	}
-	a.mu.Lock()
-	defer a.mu.Unlock()
-	if complete && a.sdkBackground != nil {
-		if c := a.sdkBackground.finishIdentitiesLocked(selected); c != "" {
-			complete = false
-		}
-	}
-	if !complete {
-		a.fenced = true
-		clear(a.intents)
-		if a.gate != nil {
-			a.gate.fenceLocked("relaxed-identity-cleanup-required")
-		}
-		return ErrCleanupRequired
-	}
-	for id := range blocked {
-		delete(r.blocked, id)
-	}
-	// The revoked grants remain revoked; a subsequent Resolve gets a new opaque
-	// generation and consent must create a new grant. Completed Q is not consent.
-	return ""
-}
-
-// This is the existing S2 owner/reaper, not a new identity process manager.
-func (c *operationCohort) drainRelaxedIdentity(ctx context.Context, id RelaxedIdentity) Code {
-	ctx, cancel := context.WithTimeout(ctx, RevokeDrainTimeout)
-	defer cancel()
-	if err := c.drainSelected(ctx, TerminateGrace, func(op *cohortOperation) bool {
-		return op.actor.relaxed != nil && relaxedActorIdentity(op.actor) == id
-	}); err != nil {
-		return ErrCleanupRequired
-	}
-	if nativeContextCode(ctx) != "" {
-		return ErrCleanupRequired
-	}
-	for _, op := range c.operations {
-		if op.actor.relaxed != nil && relaxedActorIdentity(op.actor) == id {
-			return ErrCleanupRequired
-		}
-	}
-	return ""
-}

package/templates/native-go/backend/internal/helper/sdk_rpc.go

@@ -1,299 +0,0 @@
-//go:build synopkgland_sdk_workers
-
-package helper
-
-import (
-	"bytes"
-	"context"
-	"crypto/sha256"
-	"dsmapp/internal/helper/jobcontract"
-	"encoding/hex"
-	"encoding/json"
-	"strings"
-)
-
-// One fixed decoder shared by the CGI client, helper daemon, and root owner.
-// Unknown methods never acquire a generic handler or execute inert workers.
-func sdkArgs(method string, raw []byte) (any, Code) {
-	var dst any
-	switch method {
-	case "jobs.prepare":
-		dst = &sdkPrepareArgs{}
-	case "jobs.submit":
-		dst = &sdkSubmitArgs{}
-	case "jobs.status", "jobs.admin.status":
-		dst = &sdkStatusArgs{}
-	case "jobs.lookup":
-		dst = &sdkLookupArgs{}
-	case "jobs.result":
-		dst = &sdkResultArgs{}
-	case "jobs.cancel", "jobs.admin.cancel":
-		dst = &sdkCancelArgs{}
-	case "jobs.revoke":
-		dst = &sdkRevokeArgs{}
-	case "jobs.attach":
-		dst = &sdkAttachArgs{}
-	case "jobs.diagnose":
-		dst = &struct{}{}
-	default:
-		return nil, ErrUnsupported
-	}
-	if c := decodeDataObject(bytes.NewReader(raw), dst, MaxControlBytes); c != "" {
-		return nil, c
-	}
-	return dst, ""
-}
-func (o *sdkJobOwner) prepareInteractive(ctx context.Context, carriers SessionCarriers, in sdkPrepareArgs) (sdkPrepared, Code) {
-	a := o.grants.authority
-	w, ok := o.workers[in.Worker.ID]
-	if !ok || in.Worker.Revision != w.Revision {
-		return sdkPrepared{}, ErrIncompatible
-	}
-	if !allReferences(in.Parent.ID) || in.Parent.Revision == 0 {
-		return sdkPrepared{}, ErrInvalid
-	}
-	if c := jobcontract.ValidatePlan(w, in.Input, jobcontract.Interactive); c != "" {
-		return sdkPrepared{}, sdkCode(c)
-	}
-	ids := make([]string, 4)
-	for n := range ids {
-		var c Code
-		ids[n], c = sdkRandomRef()
-		if c != "" {
-			return sdkPrepared{}, c
-		}
-	}
-	digest, why := jobcontract.InputDigest(in.Input, w.InputSchemaDigest)
-	if why != "" {
-		return sdkPrepared{}, sdkCode(why)
-	}
-	p := a.policy
-	bind := jobcontract.Binding{Inventory: sdkInventory(p.Inventory), JobSchema: 1, Epoch: p.Epoch, Job: jobcontract.RevisionRef{ID: ids[0], Revision: 1}, Worker: in.Worker, ParentGrant: in.Parent, ApprovalBinding: p.ApprovalBinding, CapabilityDigest: p.CapabilityDigest, InputSchemaDigest: w.InputSchemaDigest, InputDigest: digest, Mode: jobcontract.Interactive}
-	request := sdkJobRequest{Control: jobcontract.Control{Op: "jobs.submit", Binding: bind, Intent: jobcontract.RevisionRef{ID: ids[1], Revision: 1}, Nonce: ids[2], Ticket: ids[3]}, Input: in.Input}
-	request, code := cloneSDKRequest(request)
-	if code != "" {
-		return sdkPrepared{}, code
-	}
-	j := &sdkJob{request: request, worker: w, carriers: carriers}
-	actor, proof, code := o.validate(ctx, j, sdkJobCheckpoint{Phase: "prepare"})
-	if code != "" {
-		return sdkPrepared{}, code
-	}
-	// No attach lease until submit. Preparation only reserves bounded consent.
-	raw, _ := json.Marshal(request)
-	sum := sha256.Sum256(raw)
-	summary := hex.EncodeToString(sum[:])
-	var out sdkPrepared
-	code = a.WithGrantAdmission(GrantAdmission{actor, in.Parent.ID, in.Parent.Revision, Action(in.Input.Steps[0].Action), proof.Continuity, proof.Continuous}, func(g Grant, current NativeActor) Code {
-		if c := nativeContextCode(ctx); c != "" {
-			return c
-		}
-		now := a.now()
-		if !nativeFresh(proof.CheckedAt, now) || !now.Before(proof.ExpiresAt) {
-			return ErrStale
-		}
-		for _, step := range in.Input.Steps {
-			if !containsAction(g.Actions, Action(step.Action)) {
-				return ErrDenied
-			}
-		}
-		count := 0
-		for id, pending := range a.intents {
-			if now.UnixMilli() >= pending.intent.ExpiresAt {
-				delete(a.intents, id)
-			} else if pending.intent.SubjectRef == current.Principal().SubjectRef {
-				count++
-			}
-		}
-		if count >= MaxLiveIntents || len(a.intents) >= MaxReplayEntries || len(o.jobs) >= jobcontract.MaxExecutionKeys {
-			return ErrBusy
-		}
-		mono := o.attachNow()
-		if mono < 0 {
-			return ErrExpired
-		}
-		out = sdkPrepared{ids[1], ids[0], summary, now.Add(IntentTTL).UnixMilli()}
-		a.intents[ids[1]] = pendingConsent{intent: Intent{ID: ids[1], Inventory: p.Inventory, Epoch: p.Epoch, SubjectRef: current.Principal().SubjectRef, SessionRef: current.SessionRef(), SummaryDigest: summary, ExpiresAt: out.ExpiresAt}, actor: current, interactive: &sdkInteractivePending{request, mono + IntentTTL}}
-		return ""
-	})
-	return out, code
-}
-func containsAction(actions []Action, want Action) bool {
-	for _, a := range actions {
-		if a == want {
-			return true
-		}
-	}
-	return false
-}
-func (o *sdkJobOwner) submitInteractive(ctx context.Context, peer operationPeer, carriers SessionCarriers, in sdkSubmitArgs) (sdkAttachReceipt, Code) {
-	if !allReferences(in.IntentID, in.SummaryDigest) {
-		return sdkAttachReceipt{}, ErrInvalid
-	}
-	a := o.grants.authority
-	actor, code := a.actor(ctx, carriers, nil)
-	if code != "" {
-		return sdkAttachReceipt{}, code
-	}
-	a.mu.Lock()
-	pending, ok := a.intents[in.IntentID]
-	if !ok || pending.interactive == nil {
-		a.mu.Unlock()
-		return sdkAttachReceipt{}, ErrReplay
-	}
-	if pending.actor.Principal() != actor.Principal() || pending.actor.SessionRef() != actor.SessionRef() || pending.intent.SummaryDigest != in.SummaryDigest {
-		a.mu.Unlock()
-		return sdkAttachReceipt{}, ErrDenied
-	}
-	if a.now().UnixMilli() >= pending.intent.ExpiresAt || o.attachNow() >= pending.interactive.expires || o.attachNow() < pending.interactive.expires-IntentTTL {
-		delete(a.intents, in.IntentID)
-		a.mu.Unlock()
-		return sdkAttachReceipt{}, ErrExpired
-	}
-	delete(a.intents, in.IntentID) // one attempt, including busy/bootstrap failure
-	a.mu.Unlock()
-	if code = o.submit(ctx, peer, carriers, pending.interactive.request); code != "" {
-		return sdkAttachReceipt{}, code
-	}
-	j := o.jobs[pending.interactive.request.Control.Binding.Job.ID]
-	v := newSDKJobViews(o)
-	if _, c := v.snapshot(); c != "" {
-		return sdkAttachReceipt{}, c
-	}
-	return sdkAttachReceipt{JobID: j.request.Control.Binding.Job.ID, Revision: v.revision, AttachID: j.attach.id, RenewAfterMS: sdkAttachRenewInterval.Milliseconds(), TTLMS: sdkAttachTTL.Milliseconds()}, ""
-}
-func (o *sdkJobOwner) dispatchSDK(ctx context.Context, peer operationPeer, raw []byte) sdkWireResponse {
-	res := sdkWireResponse{Inventory: o.grants.cohort.inventory}
-	if !o.grants.cohort.peerAllowed(peer) {
-		res.Code = ErrDenied
-		return res
-	}
-	var req sdkWireRequest
-	if res.Code = decodeDataObject(bytes.NewReader(raw), &req, MaxControlBytes); res.Code != "" {
-		return res
-	}
-	res.Nonce = req.Nonce
-	if req.Inventory != res.Inventory {
-		res.Code = ErrIncompatible
-		return res
-	}
-	if !allReferences(req.Nonce) || len(req.Carriers.Cookie) > 4096 || len(req.Carriers.SynoToken) > 4096 || len(req.Carriers.ClientAddress) > 256 {
-		res.Code = ErrInvalid
-		return res
-	}
-	args, code := sdkArgs(req.Method, req.Args)
-	if code != "" {
-		res.Code = code
-		return res
-	}
-	if o.session != nil {
-		value, c := o.session.dispatch(ctx, SessionCarriers{req.Carriers.Cookie, req.Carriers.SynoToken, req.Carriers.ClientAddress}, req.Method, req.Nonce, args)
-		if c == "" && (!o.session.ready() || ctx.Err() != nil) {
-			c = ErrFenced
-		}
-		if c == ErrFenced && ctx.Err() == nil {
-			c = o.session.refusalCode()
-		}
-		res.Code = safeGrantCode(c)
-		if c == "" {
-			data, e := json.Marshal(value)
-			if e != nil || len(data) > jobcontract.MaxStatusBytes-1024 {
-				res.Code = ErrLimit
-			} else {
-				res.Data = data
-			}
-		}
-		return res
-	}
-	v := newSDKJobViews(o)
-	if !v.enter() {
-		res.Code = ErrBusy
-		return res
-	}
-	defer v.leave()
-	carriers := SessionCarriers{req.Carriers.Cookie, req.Carriers.SynoToken, req.Carriers.ClientAddress}
-	if strings.HasPrefix(req.Method, "jobs.admin.") {
-		actor, c := v.actor(ctx, carriers)
-		if c != "" {
-			res.Code = c
-			return res
-		}
-		if !actor.Admin() {
-			res.Code = ErrDenied
-			return res
-		}
-	}
-	// Mutation replay is independent from status/attach read budgets.
-	mutation := req.Method == "jobs.cancel" || req.Method == "jobs.admin.cancel" || req.Method == "jobs.revoke"
-	if mutation {
-		if o.grants.rpcNonces[req.Nonce] {
-			res.Code = ErrReplay
-			return res
-		}
-		if len(o.grants.rpcNonces) >= MaxReplayEntries {
-			res.Code = ErrBusy
-			return res
-		}
-		// No unauthenticated caller can burn the mutation window.
-		if _, c := v.actor(ctx, carriers); c != "" {
-			res.Code = c
-			return res
-		}
-		o.grants.rpcNonces[req.Nonce] = true
-	}
-	var value any
-	switch req.Method {
-	case "jobs.prepare":
-		value, code = o.prepareInteractive(ctx, carriers, *args.(*sdkPrepareArgs))
-	case "jobs.submit":
-		value, code = o.submitInteractive(ctx, peer, carriers, *args.(*sdkSubmitArgs))
-	case "jobs.status":
-		value, code = v.ownerPage(ctx, carriers, args.(*sdkStatusArgs).Cursor)
-	case "jobs.admin.status":
-		value, code = v.adminQuery(ctx, carriers, args.(*sdkStatusArgs).Cursor)
-	case "jobs.lookup":
-		value, code = v.lookupIntent(ctx, carriers, args.(*sdkLookupArgs).IntentID)
-	case "jobs.result":
-		value, code = v.result(ctx, carriers, args.(*sdkResultArgs).JobID)
-	case "jobs.cancel", "jobs.admin.cancel":
-		p := args.(*sdkCancelArgs)
-		code = v.cancel(ctx, carriers, p.JobID, p.Revision)
-		value = struct{}{}
-	case "jobs.revoke":
-		p := args.(*sdkRevokeArgs)
-		value, code = v.revoke(ctx, carriers, p.JobID, p.Revision, p.DelegationRevision, p.StoreRevision)
-	case "jobs.attach":
-		p := args.(*sdkAttachArgs)
-		code = o.renewAttach(ctx, carriers, p.JobID, p.AttachID)
-		value = struct{}{}
-	case "jobs.diagnose":
-		value, code = v.diagnose(ctx, carriers, false)
-	}
-	res.Code = safeGrantCode(code)
-	if code == "" {
-		data, err := json.Marshal(value)
-		if err != nil || len(data) > jobcontract.MaxStatusBytes-1024 {
-			res.Code = ErrLimit
-		} else {
-			res.Data = data
-		}
-	}
-	return res
-}
-
-// ValidateSDKEnvelope is a syntax guard only. CGI authentication and root native
-// proof still occur for every registered route, including unknown job methods.
-func ValidateSDKEnvelope(raw []byte) Code {
-	var r struct {
-		Method string          `json:"method"`
-		Params json.RawMessage `json:"params,omitempty"`
-	}
-	if c := decodeDataObject(bytes.NewReader(raw), &r, 1<<20); c != "" {
-		return c
-	}
-	if strings.HasPrefix(r.Method, "jobs.") && len(raw) > MaxControlBytes {
-		return ErrLimit
-	}
-	return ""
-}
-func ValidateSDKArgs(method string, raw []byte) Code { _, c := sdkArgs(method, raw); return c }