@synopackageland/cli 0.5.3 → 0.6.1

package/dist/templates/native-go/backend/internal/helper/grant_snapshot.go

@@ -1,78 +0,0 @@
-//go:build !synopkgland_sdk_workers
-
-//line dsmapp/internal/helper/grant_snapshot.go:1
-package helper
-
-import (
-	"math"
-	"reflect"
-	"slices"
-)
-
-// Pure snapshot invariants shared by the ordering owner and Linux persistence.
-func findGrant(s *GrantStore, id string) *Grant {
-	for n := range s.Grants {
-		if s.Grants[n].ID == id {
-			return &s.Grants[n]
-		}
-	}
-	return nil
-}
-func cloneAuthorityGrant(g Grant) Grant {
-	g.Actions = slices.Clone(g.Actions)
-	g.Scope.Segments = slices.Clone(g.Scope.Segments)
-	return g
-}
-
-func cloneAuthorityStore(s GrantStore) GrantStore { s.Grants = slicesCloneGrants(s.Grants); return s }
-func slicesCloneGrants(gs []Grant) []Grant {
-	out := make([]Grant, len(gs))
-	for i, g := range gs {
-		out[i] = cloneAuthorityGrant(g)
-	}
-	return out
-}
-
-// Root callback mistakes cannot drop tombstones, un-suspend, overwrite a grant's
-// scope/owner/actions, reuse IDs, or roll revisions back. Offline root disk
-// rollback remains outside the threat model; restart still suspends active.
-func validateGrantTransition(old, next GrantStore, p GrantPolicy) Code {
-	if reflect.DeepEqual(old, next) {
-		return ""
-	}
-	if old.Revision == math.MaxUint64 || next.Revision != old.Revision+1 {
-		return ErrStale
-	}
-	for _, before := range old.Grants {
-		after := findGrant(&next, before.ID)
-		if after == nil {
-			return ErrDenied
-		}
-		if reflect.DeepEqual(before, *after) {
-			continue
-		}
-		if before.State == GrantRevoked || before.Revision == math.MaxUint64 || after.Revision != before.Revision+1 {
-			return ErrDenied
-		}
-		if after.State != GrantRevoked && (before.State != GrantActive || after.State != GrantSuspended) {
-			return ErrDenied
-		}
-		normalized := cloneAuthorityGrant(*after)
-		normalized.Revision = before.Revision
-		normalized.State = before.State
-		normalized.Reason = before.Reason
-		normalized.RevokedAt = before.RevokedAt
-		if !reflect.DeepEqual(before, normalized) {
-			return ErrDenied
-		}
-	}
-	for _, g := range next.Grants {
-		if findGrant(&old, g.ID) == nil && (g.State != GrantActive || g.Revision != 1 || g.Inventory != p.Inventory || g.ApprovalBinding != p.ApprovalBinding || g.CapabilityDigest != p.CapabilityDigest || g.LastValidated.Epoch != p.Epoch || !p.Enabled) {
-			return ErrDenied
-		}
-	}
-	return ""
-}
-func completeQuiescence(q GrantQuiescence) bool {
-	return (q.Cohort == nil || (q.Cohort.Key == q.Key && q.Cohort.valid())) && allReferences(q.Key.Epoch, q.Key.GrantID) && q.Key.Revision > 0 && q.ChildrenReaped && q.RelayClosed && q.LeasesClosed && q.FDsClosed && q.EffectsRecorded
-}

package/dist/templates/native-go/backend/internal/helper/grant_supervisor_linux.go

@@ -1,134 +0,0 @@
-package helper
-
-import (
-	"context"
-	"crypto/rand"
-	"encoding/hex"
-	"encoding/json"
-	"net"
-	"os"
-	"path/filepath"
-	"time"
-)
-
-// Fixed S1/S5 integration point. No environment/plugin/CGI installs adapters.
-// Until current account, App permission and ACL continuity are proved,
-// native/consent/operation/output adapters remain unavailable in shipped builds.
-func supervisorGrantAdapters(c Client) supervisorGrantServices {
-	if c.Expected.Protocol == DataProtocol && c.Expected.DataAccess == "relaxed" {
-		// t-0049 identifies candidates, not certified target-build adapters.
-		// Missing registration/session/state/groups/ACL proof stays unavailable.
-		return supervisorGrantServices{native: NewRelaxedNativeProvider(RelaxedAdapters{})}
-	}
-	return supervisorGrantServices{}
-}
-
-func openSupervisorGrants(c Client, binary string, cohort *operationCohort) (*supervisorGrants, *FileGrantRepository, Code) {
-	repo, code := OpenFileGrantRepository(c.StateDir, c.Expected)
-	if code != "" {
-		return nil, nil, code
-	}
-	services := supervisorGrantAdapters(c)
-	s, code := newSupervisorGrants(repo, cohort, services)
-	if code != "" {
-		repo.Close()
-		return nil, nil, code
-	}
-	if services.writes.Create && services.writeIntents == nil {
-		services.writeIntents = fileWriteIntents{repo}
-		s.services.writeIntents = services.writeIntents
-	}
-	cohort.startChild = func(a NativeActor, b operationBinding) (operationProcess, error) {
-		if services.output == nil {
-			return nil, errTrust
-		}
-		out, code := services.output(b)
-		if code != "" || out == nil {
-			return nil, errTrust
-		}
-		op := cohort.operations[b.OperationID]
-		if op == nil || op.binding != b || op.work == nil && op.writeWork == nil {
-			out.Close()
-			return nil, errTrust
-		}
-		pin, ok := op.root.(*pinnedReadOnlyRoot)
-		if !ok || pin == nil {
-			out.Close()
-			return nil, ErrUnavailable
-		}
-		if op.writeWork != nil {
-			process, err := startLinuxWriteOperation(c, binary, a, b, pin, *op.writeWork, out)
-			if err != nil && process == nil {
-				out.Close()
-			}
-			return process, err
-		}
-		process, err := startLinuxReadOnlyOperation(c, binary, a, b, pin, *op.work, out)
-		if err != nil && process == nil {
-			out.Close()
-		}
-		return process, err
-	}
-	return s, repo, ""
-}
-
-// Root helper only. Verify the pinned parent both before and after connecting;
-// actual SO_PEERCRED must equal that parent. No package-side grant endpoint.
-func callSupervisorGrantRPC(c Client, request supervisorGrantRequest) (supervisorGrantResponse, Code) {
-	var res supervisorGrantResponse
-	want, err := readProcess(c.RunDir, 0)
-	if err != nil || want.PID != os.Getppid() || want.Inventory != c.Expected {
-		return res, ErrDenied
-	}
-	actual, err := inspectSupervisor(want.PID, c.Expected)
-	if err != nil || actual != want {
-		return res, ErrDenied
-	}
-	conn, err := net.DialUnix("unix", nil, &net.UnixAddr{Name: filepath.Join(c.RunDir, "supervisor.sock"), Net: "unix"})
-	if err != nil {
-		return res, ErrUnavailable
-	}
-	defer conn.Close()
-	peer, err := peerCredentials(conn)
-	if err != nil || peer.Uid != 0 || int(peer.Pid) != want.PID {
-		return res, ErrDenied
-	}
-	actual, err = inspectSupervisor(want.PID, c.Expected)
-	if err != nil || actual != want {
-		return res, ErrDenied
-	}
-	conn.SetDeadline(time.Now().Add(3 * time.Second))
-	var nonce [32]byte
-	if _, err = rand.Read(nonce[:]); err != nil {
-		return res, ErrUnavailable
-	}
-	raw, err := json.Marshal(request)
-	if err != nil {
-		return res, ErrInvalid
-	}
-	req := supervisorRequest{Process: want, Op: "grants", Nonce: hex.EncodeToString(nonce[:]), Data: raw}
-	frame, err := json.Marshal(req)
-	if err != nil || len(frame) > MaxControlBytes {
-		return res, ErrLimit
-	}
-	if _, err = conn.Write(frame); err != nil {
-		return res, ErrUnavailable
-	}
-	if err = conn.CloseWrite(); err != nil {
-		return res, ErrUnavailable
-	}
-	if code := decodeDataObject(conn, &res, MaxControlBytes); code != "" {
-		return res, code
-	}
-	if res.Nonce != req.Nonce {
-		return supervisorGrantResponse{}, ErrDenied
-	}
-	return res, ""
-}
-
-func dispatchSupervisorGrant(ctx context.Context, s *supervisorGrants, peer operationPeer, req supervisorRequest) supervisorGrantResponse {
-	if s == nil {
-		return supervisorGrantResponse{Nonce: req.Nonce, Code: ErrUnavailable}
-	}
-	return s.dispatch(ctx, peer, req.Nonce, req.Data)
-}

package/dist/templates/native-go/backend/internal/helper/grant_supervisor_linux_test.go

@@ -1,254 +0,0 @@
-package helper
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"fmt"
-	"net"
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-)
-
-func TestSupervisorGrantFrameBounds(t *testing.T) {
-	req := supervisorRequest{Op: "grants", Nonce: grantRef('a'), Data: json.RawMessage(`{"epoch":"fixture"}`)}
-	b, _ := json.Marshal(req)
-	if _, code := decodeSupervisorRequest(bytes.NewReader(b)); code != "" {
-		t.Fatal(code)
-	}
-	for _, raw := range [][]byte{append(append([]byte{}, b...), b...), bytes.Replace(b, []byte(`"op":"grants"`), []byte(`"op":"grants","op":"admit"`), 1), append(bytes.Repeat([]byte(" "), MaxControlBytes), b...)} {
-		if _, code := decodeSupervisorRequest(bytes.NewReader(raw)); code == "" {
-			t.Fatal("invalid frame accepted")
-		}
-	}
-	legacy := supervisorRequest{Op: "admit", Nonce: grantRef('b')}
-	frame, _ := json.Marshal(legacy)
-	if _, code := decodeSupervisorRequest(bytes.NewReader(frame)); code != "" {
-		t.Fatal("legacy frame", code)
-	}
-	if _, code := decodeSupervisorRequest(bytes.NewReader(append(bytes.Repeat([]byte(" "), 4096), frame...))); code == "" {
-		t.Fatal("legacy frame limit ignored leading whitespace")
-	}
-
-	req.Op = "admit"
-	b, _ = json.Marshal(req)
-	if _, code := decodeSupervisorRequest(bytes.NewReader(b)); code != ErrInvalid {
-		t.Fatal(code)
-	}
-}
-func grantVMFixture(t *testing.T) LinuxProcesses {
-	t.Helper()
-	source := os.Getenv("M2_GRANT_FIXTURE")
-	if source == "" {
-		t.Skip("requires NIC-free Linux root VM")
-	}
-	t.Setenv("M1C_HELPER_FIXTURE", source)
-	p := linuxFixture(t)
-	p.Expected.Protocol = DataProtocol
-	return p
-}
-func grantVMCall(t *testing.T, p LinuxProcesses, method string, args any) supervisorGrantResponse {
-	t.Helper()
-	record, err := readRecord(p.StateDir, 0)
-	if err != nil {
-		t.Fatal(err)
-	}
-	raw, _ := json.Marshal(args)
-	req := supervisorGrantRequest{Epoch: record.Lifecycle.Epoch, Method: method, Args: raw}
-	b, _ := json.Marshal(req)
-	os.Remove(filepath.Join(p.RunDir, "grant-result"))
-	// The owned helper polls and removes this name. Publishing with WriteFile
-	// exposed a truncated/partial control and produced intermittent ErrInvalid
-	// before the write completed. Publish the complete fixture frame by rename.
-	tmp := filepath.Join(p.RunDir, "grant-command.tmp")
-	if err := os.WriteFile(tmp, b, 0600); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.Rename(tmp, filepath.Join(p.RunDir, "grant-command")); err != nil {
-		t.Fatal(err)
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), 4*time.Second)
-	defer cancel()
-	var res supervisorGrantResponse
-	if waitHealthy(ctx, func(context.Context) bool {
-		b, err := os.ReadFile(filepath.Join(p.RunDir, "grant-result"))
-		return err == nil && json.Unmarshal(b, &res) == nil
-	}) != nil {
-		t.Fatal("owned helper did not complete grant RPC", method)
-	}
-	return res
-}
-func grantVMCreate(t *testing.T, p LinuxProcesses) Grant {
-	t.Helper()
-	res := grantVMCall(t, p, "prepare", grantPrepareArgs{grantRef('c'), ScopePersonal, []Action{ActionRead}})
-	if res.Code != "" || res.Intent == nil {
-		t.Fatal(res)
-	}
-	b, err := os.ReadFile(filepath.Join(p.StateDir, "grants.json"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	store, code := DecodeGrantStore(bytes.NewReader(b))
-	if code != "" {
-		t.Fatal(code)
-	}
-	res = grantVMCall(t, p, "confirm", grantConfirmArgs{res.Intent.ID, res.Intent.SummaryDigest, store.Revision})
-	if res.Code != "" || res.Grant == nil {
-		t.Fatal(res)
-	}
-	return *res.Grant
-}
-func TestLinuxGrantRPCRevokeUsesS2DrainAndIsolatesGrants(t *testing.T) {
-	p := grantVMFixture(t)
-	proc := startVMHelper(t, p)
-	g := grantVMCreate(t, p)
-	other := grantVMCreate(t, p)
-	request := grantControl(t, g, '1', '2', '3', MaxBoundedBytes)
-	if res := grantVMCall(t, p, "operation.start", request); res.Code != "" {
-		t.Fatal(res)
-	}
-	grantVMMetadata(t, p, request)
-	if res := grantVMCall(t, p, "operation.chunk", grantControl(t, g, '1', '4', '5', MaxChunkBytes)); res.Code != "" {
-		t.Fatal(res)
-	}
-	if res := grantVMCall(t, p, "operation.start", grantControl(t, other, '6', '7', '8', MaxBoundedBytes)); res.Code != "" {
-		t.Fatal(res)
-	}
-	grantVMMetadata(t, p, grantControl(t, other, '6', '7', '8', MaxBoundedBytes))
-	children := processChildren(proc.PID)
-	if len(children) != 3 {
-		t.Fatal("missing real operations", children)
-	}
-	for _, pid := range children {
-		if pid == supervisedPIDByMode(t, proc.PID, "serve-child") {
-			continue
-		}
-		b, err := os.ReadFile(fmt.Sprintf("/proc/%d/status", pid))
-		if err != nil || !statusHasCredentials(b, 1001, 100, []uint32{101, 105}) {
-			t.Fatal("credentials", pid, err)
-		}
-	}
-	// A different root process knows the pinned identity but cannot mutate grants.
-	conn, err := net.DialUnix("unix", nil, &net.UnixAddr{Name: filepath.Join(p.RunDir, "supervisor.sock"), Net: "unix"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	raw := grantRPC(t, "revoke", g.LastValidated.Epoch, SessionCarriers{Cookie: "fixture"}, grantRevokeArgs{g.ID, 1, 3})
-	conn.SetDeadline(time.Now().Add(time.Second))
-	json.NewEncoder(conn).Encode(supervisorRequest{Process: proc, Op: "grants", Nonce: grantRef('f'), Data: raw})
-	conn.CloseWrite()
-	var foreign supervisorGrantResponse
-	if code := decodeDataObject(conn, &foreign, MaxControlBytes); code != "" || foreign.Code != ErrDenied {
-		t.Fatal("foreign root admitted", foreign, code)
-	}
-	conn.Close()
-	res := grantVMCall(t, p, "revoke", grantRevokeArgs{g.ID, 1, 3})
-	if res.Code != "" || res.Revoke == nil || !res.Revoke.Revoked || !res.Revoke.Drained {
-		t.Fatal(res)
-	}
-	b, err := os.ReadFile(filepath.Join(p.StateDir, "grant-q-"+g.ID+".json"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	var q GrantQuiescence
-	if json.Unmarshal(b, &q) != nil || !completeQuiescence(q) || q.Cohort == nil || q.Cohort.Started != 1 || q.Cohort.Reaped != 1 || q.Cohort.AdmittedBytes != MaxChunkBytes {
-		t.Fatal("Q without actual S2 proof", q)
-	}
-	if res := grantVMCall(t, p, "operation.start", grantControl(t, g, '9', 'a', 'b', 1)); res.Code != ErrRevoked {
-		t.Fatal("work after R", res)
-	}
-	if res := grantVMCall(t, p, "operation.chunk", grantControl(t, other, '6', 'c', 'd', 1)); res.Code != "" {
-		t.Fatal("unrelated grant fenced", res)
-	}
-	survivors := processChildren(proc.PID)
-	if len(survivors) != 2 {
-		t.Fatal("individual revoke drained unrelated grant", survivors)
-	}
-	vmUnit(t, "stop")
-	ctx, cancel := context.WithTimeout(context.Background(), 4*time.Second)
-	defer cancel()
-	if waitHealthy(ctx, func(context.Context) bool {
-		r, e := readRecord(p.StateDir, 0)
-		return e == nil && r.Lifecycle.Phase == "stopped"
-	}) != nil {
-		t.Fatal("global fence incomplete")
-	}
-	r, err := readRecord(p.StateDir, 0)
-	if err != nil {
-		t.Fatal(err)
-	}
-	proof, err := completionRecord(p.Client, r)
-	if err != nil || proof.Cohort == nil || proof.Cohort.Started != 2 || proof.Cohort.Reaped != 2 || !proof.Cohort.RelaysStopped {
-		t.Fatal(proof, err)
-	}
-	for _, pid := range children {
-		if _, e := os.Stat(fmt.Sprintf("/proc/%d", pid)); !os.IsNotExist(e) {
-			t.Fatal("child survived Q/fence", pid)
-		}
-	}
-	// Restart suspends only active authority; the prior revoked tombstone stays R.
-	vmUnit(t, "start")
-	startVMHelper(t, p)
-
-	var store GrantStore
-	if waitHealthy(ctx, func(context.Context) bool {
-		b, e := os.ReadFile(filepath.Join(p.StateDir, "grants.json"))
-		if e != nil {
-			return false
-		}
-		var code Code
-		store, code = DecodeGrantStore(bytes.NewReader(b))
-		if code != "" {
-			return false
-		}
-		revoked, active := findGrant(&store, g.ID), findGrant(&store, other.ID)
-		return revoked != nil && active != nil && revoked.State == GrantRevoked && active.State == GrantSuspended
-	}) != nil {
-		t.Fatal("restart did not reconcile before grant admission", store)
-	}
-	suspended := *findGrant(&store, other.ID)
-	request = grantControl(t, suspended, 'e', 'f', '0', 1)
-	current, err := readRecord(p.StateDir, 0)
-	if err != nil {
-		t.Fatal(err)
-	}
-	request.Epoch = current.Lifecycle.Epoch
-	if res := grantVMCall(t, p, "operation.start", request); res.Code != ErrSuspended {
-		t.Fatal("restart admitted suspended grant", res)
-	}
-
-}
-func TestLinuxGrantProductionAdaptersFailClosed(t *testing.T) {
-	p := grantVMFixture(t)
-	// VM fixture swaps only the trusted adapters; nil is the production default.
-	if s := supervisorGrantAdapters(p.Client); s.native != nil || s.consent != nil || s.operations != nil || s.output != nil {
-		t.Fatal("shipped adapters unexpectedly installed")
-	}
-}
-
-func TestLinuxGrantWaitsForDurableActivationHandoff(t *testing.T) {
-	p := grantVMFixture(t)
-	lifecycle := vmLifecycle(t, p)
-	record(t, p.Client, Record{Inventory: p.Expected, Enabled: true, Residual: true, Lifecycle: lifecycle})
-	if err := p.Start(p.Expected); err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() {
-		(Controller{Client: p.Client, Processes: p, Observe: observeLinux}).Control(context.Background(), "disable")
-	})
-	args := grantPrepareArgs{grantRef('c'), ScopePersonal, []Action{ActionRead}}
-	if res := grantVMCall(t, p, "prepare", args); res.Code != ErrUnavailable {
-		t.Fatal("residual approval enabled grants", res)
-	}
-	if _, err := os.Stat(filepath.Join(p.StateDir, "grants.json")); !os.IsNotExist(err) {
-		t.Fatal("authority initialized against residual snapshot", err)
-	}
-	if err := finalizeStart(p.Client, lifecycle.Epoch); err != nil {
-		t.Fatal(err)
-	}
-	if res := grantVMCall(t, p, "prepare", args); res.Code != "" || res.Intent == nil {
-		t.Fatal("durable activation handoff fenced authority", res)
-	}
-}

package/dist/templates/native-go/backend/internal/helper/jobcontract/bindings.go

@@ -1,48 +0,0 @@
-package jobcontract
-
-import (
-	"crypto/sha256"
-	"embed"
-	"encoding/binary"
-	"encoding/hex"
-)
-
-// Source-backed schema fingerprints deliberately overbind the S0 validator,
-// decoder and types. A semantic change cannot silently keep a version label.
-// Test files are excluded. Keep the file lists in sync with worker-registry.ts.
-//
-//go:embed decode.go digest.go types.go validate.go result.go stub.go
-var bindingSources embed.FS
-
-type WorkerSourceBindings struct {
-	HandlerBinding     string
-	InputSchemaDigest  string
-	OutputSchemaDigest string
-}
-
-var compiledSourceBindings = WorkerSourceBindings{
-	HandlerBinding:     sourceDigest("handler", "stub.go"),
-	InputSchemaDigest:  sourceDigest("input", "decode.go", "digest.go", "types.go", "validate.go"),
-	OutputSchemaDigest: sourceDigest("result", "decode.go", "result.go", "types.go", "validate.go"),
-}
-
-func CompiledBindings() WorkerSourceBindings { return compiledSourceBindings }
-
-// SHA256(domain NUL, then u32be name length/name and u32be bytes length/bytes).
-func sourceDigest(kind string, names ...string) string {
-	h := sha256.New()
-	h.Write([]byte("synopkgland/m3/" + kind + "/source-v1\x00"))
-	for _, name := range names {
-		b, err := bindingSources.ReadFile(name)
-		if err != nil {
-			panic("missing compiled worker source")
-		}
-		for _, chunk := range [][]byte{[]byte(name), b} {
-			var n [4]byte
-			binary.BigEndian.PutUint32(n[:], uint32(len(chunk)))
-			h.Write(n[:])
-			h.Write(chunk)
-		}
-	}
-	return hex.EncodeToString(h.Sum(nil))
-}