@synopackageland/cli 0.8.0 → 0.9.0

package/templates/native-go-delegate/backend/internal/delegate/files.go

@@ -1,132 +0,0 @@
-package delegate
-
-import (
-	"context"
-	"dsmapp/internal/filestation"
-	"io"
-	"os"
-	"path"
-	"strings"
-)
-
-type ListOptions = filestation.ListOptions
-type JobContext struct {
-	Client                          ExecutorClient
-	callExecutor                    func(context.Context, string, map[string]any, any) error
-	JobID, DelegationID, StagingDir string
-}
-
-func (j JobContext) Files() filestation.Files { return jobFiles{j} }
-
-type jobFiles struct{ JobContext }
-
-var _ filestation.Files = jobFiles{}
-
-const MaxDownloadBytes int64 = 64 << 20
-
-func (f jobFiles) call(ctx context.Context, op string, p map[string]any, out any) error {
-	if f.JobID == "" || f.DelegationID == "" {
-		return fail("invalid-request")
-	}
-	p["job_id"] = f.JobID
-	p["delegation_id"] = f.DelegationID
-	if f.callExecutor != nil {
-		return f.callExecutor(ctx, op, p, out)
-	}
-	return f.Client.Call(ctx, op, nil, p, out)
-}
-func (f jobFiles) List(ctx context.Context, p string, o ListOptions) (filestation.Page, error) {
-	var out filestation.Page
-	// The fixed executor registry accepts path only; do not invent wire options.
-	if o != (ListOptions{}) {
-		return out, fail("unsupported")
-	}
-	e := f.call(ctx, "files.list", map[string]any{"path": p}, &out)
-	if e == nil && (out.Files == nil || out.Offset != 0 || out.Total < len(out.Files)) {
-		e = fail("EXECUTOR_PROTOCOL")
-	}
-	return out, e
-}
-func (f jobFiles) Info(ctx context.Context, p string) (filestation.Entry, error) {
-	var out struct {
-		Files []filestation.Entry `json:"files"`
-	}
-	e := f.call(ctx, "files.info", map[string]any{"path": p}, &out)
-	if e != nil {
-		return filestation.Entry{}, e
-	}
-	if len(out.Files) != 1 || out.Files[0].Path != p {
-		return filestation.Entry{}, fail("EXECUTOR_PROTOCOL")
-	}
-	return out.Files[0], nil
-}
-func (f jobFiles) CreateFolder(ctx context.Context, p, n string) error {
-	return f.call(ctx, "files.createFolder", map[string]any{"path": p, "name": n}, nil)
-}
-func (f jobFiles) CheckPermission(ctx context.Context, p string) error {
-	return f.call(ctx, "files.checkPermission", map[string]any{"path": p}, nil)
-}
-func validName(n string) bool {
-	return n != "" && n != "." && n != ".." && len(n) <= 255 && !strings.ContainsAny(n, "/\\\x00\r\n")
-}
-func validPath(p string) bool {
-	return strings.HasPrefix(p, "/") && path.Clean(p) == p && !strings.ContainsAny(p, "\x00\r\n\\") && len(p) <= 4096
-}
-
-// Write consumes at most size+1 bytes into a random private staging file, then
-// asks the executor to create the destination without overwriting it. Cleanup
-// runs on refusals, read failures, cancellation and uncertain responses too.
-func (f jobFiles) Write(ctx context.Context, dir, name string, source io.Reader, size int64) error {
-	if !validPath(dir) || !validName(name) || size < 0 || size > MaxDownloadBytes || source == nil {
-		return fail("invalid-request")
-	}
-	if e := os.MkdirAll(f.StagingDir, 0700); e != nil {
-		return fail("STAGING_UNAVAILABLE")
-	}
-	info, e := os.Lstat(f.StagingDir)
-	if e != nil || !info.IsDir() || info.Mode().Perm()&0077 != 0 {
-		return fail("STAGING_UNAVAILABLE")
-	}
-	root, e := os.OpenRoot(f.StagingDir)
-	if e != nil {
-		return fail("STAGING_UNAVAILABLE")
-	}
-	defer root.Close()
-	// CreateTemp generates names internally and uses O_EXCL with mode 0600.
-	staged, e := os.CreateTemp(f.StagingDir, "write-")
-	if e != nil {
-		return fail("STAGING_UNAVAILABLE")
-	}
-	base := path.Base(staged.Name())
-	defer root.Remove(base)
-	defer staged.Close()
-	n, e := io.Copy(staged, io.LimitReader(contextReader{ctx, source}, size+1))
-	if e != nil {
-		if ctx.Err() != nil {
-			return fail("canceled")
-		}
-		return fail("STAGING_UNAVAILABLE")
-	}
-	if n != size {
-		return fail("limit-exceeded")
-	}
-	if e = staged.Sync(); e != nil {
-		return fail("STAGING_UNAVAILABLE")
-	}
-	if e = staged.Close(); e != nil {
-		return fail("STAGING_UNAVAILABLE")
-	}
-	return f.call(ctx, "files.write", map[string]any{"staging": base, "dest_dir": dir, "name": name}, nil)
-}
-
-type contextReader struct {
-	ctx context.Context
-	r   io.Reader
-}
-
-func (r contextReader) Read(p []byte) (int, error) {
-	if e := r.ctx.Err(); e != nil {
-		return 0, e
-	}
-	return r.r.Read(p)
-}

package/templates/native-go-delegate/backend/internal/delegate/long_running_routes.go

@@ -1,92 +0,0 @@
-package delegate
-
-import (
-	"bytes"
-	"context"
-	"dsmapp/internal/api"
-	"encoding/json"
-	"net/http"
-)
-
-// The immutable SDK role map is assembled by W1. No route accepts a caller
-// chosen owner/UID, nor can an HTTP request use the sessionless daemon facade.
-func (s *Service) longRunningRoutes() []api.Route {
-	routes := []api.Route{}
-	for _, method := range []string{"delegate.example.export", "delegate.destination", "delegate.select_destination", "delegate.move_from_staging", "delegate.operations.list", "delegate.operations.get", "delegate.operations.cancel", "delegate.disable", "delegate.enable", "delegate.audit"} {
-		name := method
-		routes = append(routes, api.HandleRequest(name, func(ctx context.Context, caller api.Caller, r *http.Request, raw json.RawMessage) (any, error) {
-			if !caller.Authenticated() {
-				return nil, fail("session_required")
-			}
-			auth, err := api.DSMSession(r)
-			if err != nil {
-				return nil, err
-			}
-			switch name {
-			case "delegate.example.export":
-				var in struct {
-					Key   string `json:"key"`
-					JobID string `json:"job_id"`
-				}
-				if err = strict(raw, &in); err != nil {
-					return nil, err
-				}
-				return s.ExportExample(ctx, caller, r, in.Key, in.JobID)
-			case "delegate.destination":
-				var in struct {
-					Key string `json:"key"`
-				}
-				if err = strict(raw, &in); err != nil {
-					return nil, err
-				}
-				return s.Destination(ctx, caller, r, in.Key)
-			case "delegate.operations.list":
-				if bytes.Equal(bytes.TrimSpace(raw), []byte("null")) {
-					return nil, api.BadRequest("empty parameters required")
-				}
-				if err = strict(raw, &struct{}{}); err != nil {
-					return nil, err
-				}
-				return s.listOperations(ctx, caller, auth)
-			case "delegate.select_destination":
-				var in SelectDestinationParams
-				if err = strict(raw, &in); err != nil {
-					return nil, err
-				}
-				return s.SelectDestination(ctx, caller, r, in)
-			case "delegate.move_from_staging":
-				var in MoveParams
-				if err = strict(raw, &in); err != nil {
-					return nil, err
-				}
-				if err = validateMove(in); err != nil {
-					return nil, err
-				}
-				if err = s.verifyOperationOwner(ctx, caller, auth, in.DelegationID); err != nil {
-					return nil, err
-				}
-				return s.admitStaging(ctx, auth, in)
-			case "delegate.operations.get", "delegate.operations.cancel":
-				var in OperationRef
-				if err = strict(raw, &in); err != nil {
-					return nil, err
-				}
-				if name == "delegate.operations.cancel" {
-					return s.CancelOperation(ctx, auth, in)
-				}
-				return s.OperationStatus(ctx, auth, in)
-			default:
-				if (name == "delegate.disable" || name == "delegate.enable") && !caller.Admin() {
-					return nil, fail("admin_required")
-				}
-				if err = strict(raw, &struct{}{}); err != nil {
-					return nil, err
-				}
-				var out json.RawMessage
-				err = s.Client.Call(ctx, name, auth, nil, &out)
-				return out, err
-			}
-		}))
-	}
-	return routes
-}

package/templates/native-go-delegate/backend/internal/delegate/long_running_routes_test.go

@@ -1,99 +0,0 @@
-package delegate
-
-import (
-	"context"
-	"dsmapp/internal/api"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-)
-
-func longRPC(t *testing.T, s *Service, user, method, raw, token string) map[string]any {
-	t.Helper()
-	methods := map[string]string{}
-	// SDK routes use the shipped SDK roles, including the administrator floor.
-	policy, _ := json.Marshal(map[string]any{"schema": 1, "default": "administrators", "methods": methods})
-	server, err := api.NewServerWithPermissions(identity{user}, policy, s.Routes()...)
-	if err != nil {
-		t.Fatal(err)
-	}
-	req := httptest.NewRequest("POST", "/", strings.NewReader(`{"method":"`+method+`","params":`+raw+`}`))
-	req.Header.Set("Content-Type", "application/json")
-	req.AddCookie(&http.Cookie{Name: "id", Value: "fake-cookie"})
-	req.Header.Set("X-SYNO-TOKEN", token)
-	recorder := httptest.NewRecorder()
-	server.ServeHTTP(recorder, req)
-	var out map[string]any
-	if json.Unmarshal(recorder.Body.Bytes(), &out) != nil {
-		t.Fatal(recorder.Body.String())
-	}
-	return out
-}
-func TestOperationRoutesForwardOwnerSessionAndRejectForgedIdentity(t *testing.T) {
-	s := service(t, nil)
-	calls := 0
-	s.Client = fakeExecutor(func(_ context.Context, op string, auth map[string]string, in, out any) error {
-		calls++
-		if op != "files.operationStatus" && op != "files.cancelOperation" {
-			t.Fatal(op)
-		}
-		if auth["dsm_synotoken"] != "alice-token" {
-			return fail("DELEGATION_DENIED")
-		}
-		return json.Unmarshal([]byte(`{"job_id":"export-1","state":"canceled"}`), out)
-	})
-	for _, method := range []string{"delegate.operations.get", "delegate.operations.cancel"} {
-		raw := `{"delegation_id":"grant","job_id":"export-1"}`
-		if out := longRPC(t, s, "alice", method, raw, "alice-token"); out["success"] != true {
-			t.Fatal(out)
-		}
-		if out := longRPC(t, s, "bob", method, raw, "bob-token"); out["success"] != false {
-			t.Fatal("other owner admitted", out)
-		}
-		before := calls
-		if out := longRPC(t, s, "alice", method, `{"delegation_id":"grant","job_id":"export-1","uid":0}`, "alice-token"); out["success"] != false || calls != before {
-			t.Fatal("forged UID reached executor", out)
-		}
-		if out := longRPC(t, s, "alice", method, raw, ""); out["success"] != false || calls != before {
-			t.Fatal("sessionless HTTP operation", out)
-		}
-	}
-	for _, method := range []string{"delegate.disable", "delegate.enable"} {
-		before := calls
-		if out := longRPC(t, s, "alice", method, `{}`, "alice-token"); out["success"] != false || calls != before {
-			t.Fatal("nonadmin management call", out)
-		}
-	}
-}
-
-func TestMoveRouteCannotReserveOtherOwnersMirror(t *testing.T) {
-	s, in := stagedService(t)
-	raw, _ := json.Marshal(in)
-	calls := 0
-	s.Client = fakeExecutor(func(_ context.Context, op string, auth map[string]string, _ any, out any) error {
-		switch op {
-		case "delegate.list":
-			if auth["dsm_synotoken"] == "bob-token" {
-				return json.Unmarshal([]byte(`{"delegations":[]}`), out)
-			}
-			return json.Unmarshal([]byte(`{"delegations":[{"delegation_id":"grant","subject":{"username":"alice","uid":1205}}]}`), out)
-		case "files.moveFromStaging":
-			calls++
-			return json.Unmarshal([]byte(`{"job_id":"export-1","state":"queued"}`), out)
-		default:
-			t.Fatal(op)
-			return nil
-		}
-	})
-	if out := longRPC(t, s, "bob", "delegate.move_from_staging", string(raw), "bob-token"); out["success"] != false {
-		t.Fatal(out)
-	}
-	if bindings, err := s.Store.PendingMoves(context.Background()); err != nil || len(bindings) != 0 || calls != 0 {
-		t.Fatal("other user reserved job", bindings, err, calls)
-	}
-	if out := longRPC(t, s, "alice", "delegate.move_from_staging", string(raw), "alice-token"); out["success"] != true || calls != 1 {
-		t.Fatal(out, calls)
-	}
-}

package/templates/native-go-delegate/backend/internal/delegate/move.go

@@ -1,348 +0,0 @@
-package delegate
-
-import (
-	"bytes"
-	"context"
-	"dsmapp/internal/background"
-	"encoding/json"
-	"errors"
-	"os"
-	"path"
-	"regexp"
-	"time"
-)
-
-const MaxMoveBytes int64 = 16 << 30
-
-// An operation the executor does not know is admitted again at most
-// maxMoveAdmissions times, waiting admissionBackoff after each such send.
-const (
-	maxMoveAdmissions     = 10
-	firstAdmissionBackoff = 2 * time.Second
-	maxAdmissionBackoff   = 5 * time.Minute
-)
-
-func admissionBackoff(attempts int) time.Duration {
-	delay := firstAdmissionBackoff
-	for ; attempts > 1 && delay < maxAdmissionBackoff; attempts-- {
-		delay *= 2
-	}
-	return min(delay, maxAdmissionBackoff)
-}
-
-type MoveParams struct {
-	DelegationID string `json:"delegation_id"`
-	JobID        string `json:"job_id"`
-	Staging      string `json:"staging"`
-	Name         string `json:"name"`
-	Size         int64  `json:"size"`
-}
-type OperationRef struct {
-	DelegationID string `json:"delegation_id"`
-	JobID        string `json:"job_id"`
-}
-type Receipt struct {
-	Path string `json:"path"`
-	Size int64  `json:"size"`
-}
-
-func (r *Receipt) UnmarshalJSON(data []byte) error {
-	var wire struct {
-		Path *string `json:"path"`
-		Size *int64  `json:"size"`
-	}
-	if json.Unmarshal(data, &wire) != nil || wire.Path == nil || wire.Size == nil {
-		return fail("EXECUTOR_PROTOCOL")
-	}
-	r.Path, r.Size = *wire.Path, *wire.Size
-	return nil
-}
-
-type OperationResult struct {
-	JobID   string   `json:"job_id"`
-	State   string   `json:"state"`
-	Receipt *Receipt `json:"receipt,omitempty"`
-	Code    string   `json:"code,omitempty"`
-	Reason  string   `json:"reason,omitempty"`
-}
-
-var operationToken = regexp.MustCompile(`^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$`)
-
-func validRef(in OperationRef) bool {
-	return operationToken.MatchString(in.DelegationID) && operationToken.MatchString(in.JobID)
-}
-func validMove(in MoveParams) bool {
-	return validRef(OperationRef{in.DelegationID, in.JobID}) && validStaging(in.Staging) && validName(in.Name) && in.Size >= 0 && in.Size <= MaxMoveBytes
-}
-func validateMove(in MoveParams) error {
-	if in.Size < 0 || in.Size > MaxMoveBytes {
-		return fail("invalid-size")
-	}
-	if !validMove(in) {
-		return fail("invalid-request")
-	}
-	return nil
-}
-
-func validOperation(out OperationResult, ref OperationRef) bool {
-	if out.JobID != ref.JobID || (out.Code != "" && !stableCode.MatchString(out.Code)) || (out.Reason != "" && !stableCode.MatchString(out.Reason)) {
-		return false
-	}
-	switch out.State {
-	case "queued", "copying", "canceled", "interrupted", "uncertain":
-		return out.Receipt == nil
-	case "committed":
-		return out.Receipt != nil && validPath(out.Receipt.Path) && out.Receipt.Path != "/" && out.Receipt.Size >= 0 && out.Receipt.Size <= MaxMoveBytes
-	default:
-		return false
-	}
-}
-
-// MoveFromStaging is the package backend/daemon completion hook. It never
-// accepts a destination path, owner or UID, and does not require a live session.
-type OperationAdmission struct {
-	JobID string `json:"job_id"`
-	State string `json:"state"`
-}
-
-func (s *Service) admitStaging(ctx context.Context, auth map[string]string, in MoveParams) (OperationAdmission, error) {
-	out, err := s.moveFromStaging(ctx, auth, in)
-	if err != nil {
-		return OperationAdmission{}, err
-	}
-	return OperationAdmission{JobID: out.JobID, State: out.State}, nil
-}
-
-func (s *Service) MoveFromStaging(ctx context.Context, in MoveParams) (OperationAdmission, error) {
-	return s.admitStaging(ctx, nil, in)
-}
-func (s *Service) moveFromStaging(ctx context.Context, auth map[string]string, in MoveParams) (OperationResult, error) {
-	if background.RefuseRoot(os.Geteuid()) != nil {
-		return OperationResult{}, fail("STAGING_UNAVAILABLE")
-	}
-	if s.Lifetime != "until-revoked" || !contains(s.Operations, "files.moveFromStaging") {
-		return OperationResult{}, fail("unsupported")
-	}
-	if err := validateMove(in); err != nil {
-		return OperationResult{}, err
-	}
-	if s.Store == nil {
-		return OperationResult{}, fail("STAGING_UNAVAILABLE")
-	}
-	params, _ := json.Marshal(in)
-	ref := OperationRef{in.DelegationID, in.JobID}
-	binding, err := s.Store.MoveBinding(ctx, in.JobID)
-	fresh := false
-	if errors.Is(err, os.ErrNotExist) {
-		source, err := pinSource(s.StagingDir, in.Staging, in.Size)
-		if err != nil {
-			return OperationResult{}, err
-		}
-		binding, fresh, err = s.Store.ReserveMove(ctx, background.MoveBinding{JobID: in.JobID, DelegationID: in.DelegationID, Params: params, Source: source, Phase: background.MoveReserved})
-		if err != nil {
-			if errors.Is(err, background.ErrKeyConflict) {
-				return OperationResult{}, fail("operation-conflict")
-			}
-			return s.journalUnavailable(ctx, auth, ref, err)
-		}
-	} else if err != nil {
-		return s.journalUnavailable(ctx, auth, ref, err)
-	}
-	if binding.DelegationID != in.DelegationID || !bytes.Equal(binding.Params, params) {
-		return OperationResult{}, fail("operation-conflict")
-	}
-	if binding.Refusal != "" {
-		return OperationResult{}, fail(binding.Refusal)
-	}
-	if binding.CancelRequested {
-		// A canceled reference is never admitted again; the cancel is forwarded.
-		return s.operation(ctx, auth, ref, "files.cancelOperation")
-	}
-	// A request that may have been sent is looked up first. Only an operation the
-	// executor does not know is admitted again with the original params; the
-	// executor deduplicates the exact tuple, so a racing original is not copied twice.
-	queried := false
-	if !fresh && binding.Phase != background.MoveReserved {
-		out, err := s.OperationStatus(ctx, auth, ref)
-		if errorCode(err) != "operation-not-found" || binding.Phase == background.MoveAccepted || binding.Settled || binding.CleanupDone {
-			return out, err
-		}
-		queried = true
-	}
-	if !fresh {
-		if source, err := pinSource(s.StagingDir, in.Staging, in.Size); err != nil || source != binding.Source {
-			return OperationResult{}, fail("STAGING_CHANGED")
-		}
-	}
-	binding, claimed, err := s.Store.ClaimAdmission(ctx, in.JobID, s.clockNow(), maxMoveAdmissions, admissionBackoff)
-	if err != nil {
-		return s.journalUnavailable(ctx, auth, ref, err)
-	}
-	if !claimed {
-		return s.unclaimedAdmission(ctx, auth, ref, binding, queried)
-	}
-	return s.sendAdmission(ctx, auth, in)
-}
-
-// journalUnavailable answers a same-ref call the journal could not serve. An
-// operation the executor already has is reported read-only; anything else keeps
-// the retryable store code, so nothing is admitted without a durable reservation.
-// An unsafe or corrupt spool stays terminal.
-func (s *Service) journalUnavailable(ctx context.Context, auth map[string]string, ref OperationRef, err error) (OperationResult, error) {
-	err = jobError(err)
-	if code := errorCode(err); code != "jobs_busy" && code != "canceled" && code != "jobs_unavailable" {
-		return OperationResult{}, err
-	}
-	if out, found := s.OperationStatus(ctx, auth, ref); found == nil {
-		return out, nil
-	}
-	return OperationResult{}, err
-}
-
-// unclaimedAdmission answers a caller that may not send now: another caller
-// holds the send, its backoff has not ended, or the bound is spent.
-func (s *Service) unclaimedAdmission(ctx context.Context, auth map[string]string, ref OperationRef, binding background.MoveBinding, queried bool) (OperationResult, error) {
-	if binding.Refusal != "" {
-		return OperationResult{}, fail(binding.Refusal)
-	}
-	if !queried {
-		out, err := s.OperationStatus(ctx, auth, ref)
-		if errorCode(err) != "operation-not-found" {
-			return out, err
-		}
-	}
-	if binding.Attempts >= maxMoveAdmissions {
-		return OperationResult{}, fail("ADMISSION_EXHAUSTED")
-	}
-	return OperationResult{}, fail("ADMISSION_PENDING")
-}
-
-func (s *Service) sendAdmission(ctx context.Context, auth map[string]string, in MoveParams) (OperationResult, error) {
-	ref := OperationRef{in.DelegationID, in.JobID}
-	// Mirror writes survive a caller deadline that ended the request.
-	persist, done := context.WithTimeout(context.Background(), 10*time.Second)
-	defer done()
-	var out OperationResult
-	err := s.Client.Call(ctx, "files.moveFromStaging", auth, in, &out)
-	if err != nil {
-		var dial *dialFailure
-		code := errorCode(err)
-		switch {
-		case errors.As(err, &dial) || code == "EXECUTOR_PAUSED" || code == "queue-full":
-			// Proven not admitted: no connection, or refused before an operation existed.
-			_ = s.Store.ReleaseAdmission(persist, in.JobID)
-			return OperationResult{}, err
-		case code == "EXECUTOR_UNAVAILABLE" || code == "EXECUTOR_TIMEOUT" || code == "EXECUTOR_PROTOCOL" || code == "STORAGE_ERROR" || code == "canceled":
-			// The request might have arrived; inspect only the original operation.
-			out, err = s.OperationStatus(ctx, auth, ref)
-			if errorCode(err) == "operation-not-found" {
-				return OperationResult{}, fail("ADMISSION_PENDING")
-			}
-			return out, err
-		}
-		_ = s.Store.FinishMoveMirror(persist, in.JobID, false, code)
-		return OperationResult{}, err
-	}
-	// Admission promises a reference/state only; a committed receipt is obtained
-	// by status and is never invented from the requested name or size.
-	if out.JobID != in.JobID {
-		return OperationResult{}, fail("EXECUTOR_PROTOCOL")
-	}
-	_ = s.Store.AcceptMove(persist, in.JobID)
-	switch out.State {
-	case "queued", "copying", "canceled", "interrupted", "uncertain":
-		if out.Receipt != nil {
-			return OperationResult{}, fail("EXECUTOR_PROTOCOL")
-		}
-		return out, nil
-	case "committed":
-		return s.OperationStatus(ctx, auth, ref)
-	default:
-		return OperationResult{}, fail("EXECUTOR_PROTOCOL")
-	}
-}
-
-func (s *Service) operation(ctx context.Context, auth map[string]string, ref OperationRef, op string) (OperationResult, error) {
-	var out OperationResult
-	if !validRef(ref) {
-		return out, fail("invalid-request")
-	}
-	err := s.Client.Call(ctx, op, auth, ref, &out)
-	if err != nil {
-		return OperationResult{}, err
-	}
-	if !validOperation(out, ref) {
-		return OperationResult{}, fail("EXECUTOR_PROTOCOL")
-	}
-	if s.Store != nil {
-		// A found operation is never admitted again, even if history is later lost.
-		_ = s.Store.AcceptMove(ctx, ref.JobID)
-	}
-	if out.State == "committed" && s.Store != nil {
-		binding, err := s.Store.MoveBinding(ctx, ref.JobID)
-		if err != nil && !errors.Is(err, os.ErrNotExist) {
-			return out, nil
-		}
-		if err == nil && binding.DelegationID == ref.DelegationID && !binding.CleanupDone {
-			var input MoveParams
-			if json.Unmarshal(binding.Params, &input) != nil || input.JobID != ref.JobID || out.Receipt.Size != input.Size || path.Base(out.Receipt.Path) != input.Name {
-				return OperationResult{}, fail("EXECUTOR_PROTOCOL")
-			}
-			// A cleanup failure leaves source and mirror available for package retry.
-			// Committed remains committed and its protected receipt remains the result.
-			if cleanupSource(s.StagingDir, input.Staging, binding.Source) == nil {
-				_ = s.Store.FinishMoveMirror(ctx, ref.JobID, true, "")
-			}
-		}
-	}
-	if s.Store != nil && (out.State == "canceled" || out.State == "interrupted" || out.State == "uncertain") {
-		_ = s.Store.SettleMoveMirror(ctx, ref.JobID)
-	}
-	return out, nil
-}
-func (s *Service) OperationStatus(ctx context.Context, auth map[string]string, ref OperationRef) (OperationResult, error) {
-	return s.operation(ctx, auth, ref, "files.operationStatus")
-}
-
-// CancelOperation acknowledges a copy in flight with state copying and code
-// CANCEL_REQUESTED; poll OperationStatus for the terminal state. A producer
-// (no session) cancel is made durable in the mirror first, so the SDK's
-// admission recovery forwards it instead of sending the admission. A mirror
-// write failure does not hold the cancel back: the executor stays authoritative.
-func (s *Service) CancelOperation(ctx context.Context, auth map[string]string, ref OperationRef) (OperationResult, error) {
-	if len(auth) == 0 && s.Store != nil && validRef(ref) {
-		_ = s.Store.RequestMoveCancel(ctx, ref.JobID, ref.DelegationID)
-	}
-	return s.operation(ctx, auth, ref, "files.cancelOperation")
-}
-
-// SweepMoves queries mirrors using the package peer identity after logout/boot.
-// An operation the executor does not know is recovered like a repeated
-// MoveFromStaging call. It never revokes a reusable destination grant.
-func (s *Service) SweepMoves(ctx context.Context) error {
-	if s.Store == nil {
-		return nil
-	}
-	bindings, err := s.Store.PendingMoves(ctx)
-	if err != nil {
-		return err
-	}
-	var result error
-	for _, binding := range bindings {
-		var in MoveParams
-		var out OperationResult
-		if json.Unmarshal(binding.Params, &in) == nil {
-			out, err = s.moveFromStaging(ctx, nil, in)
-		} else {
-			out, err = s.OperationStatus(ctx, nil, OperationRef{binding.DelegationID, binding.JobID})
-		}
-		if err == nil && out.State == "committed" {
-			mirror, readErr := s.Store.MoveBinding(ctx, binding.JobID)
-			if readErr != nil || !mirror.CleanupDone {
-				err = fail("STAGING_CLEANUP_PENDING")
-			}
-		}
-		result = errors.Join(result, err)
-	}
-	return result
-}