runtime

func AdoptOwnedNode ¶

func AdoptOwnedNode(path, serviceName, nodeID string, recordedAt time.Time, retire bool) error

AdoptOwnedNode records a one-time reviewed proof for an exact device match. Orphans are retired immediately as explicit cleanup authorization; services still present in registry.json receive active proof without retired_at.

func CurrentRegistryFingerprint ¶

func CurrentRegistryFingerprint(path string) (string, error)

CurrentRegistryFingerprint fingerprints registry.json at path the way the daemon does, for comparison with the fingerprint in runtime.json.

func MarkOwnedNodeIDsRetired ¶

func MarkOwnedNodeIDsRetired(path string, nodeIDs []string, retiredAt time.Time) error

MarkOwnedNodeIDsRetired records that remove reviewed the exact ownership rows before unregistering their service. Rows remain until remote deletion succeeds or proves the device already absent.

func RecordOwnedNode ¶

func RecordOwnedNode(path, serviceName, nodeID string, recordedAt time.Time) error

RecordOwnedNode idempotently records exact NodeID ownership for a service.

func RegistryFingerprint ¶

func RegistryFingerprint(reg *registry.Registry, issues []registry.ServiceIssue) (string, error)

RegistryFingerprint is the one derivation of the registry fingerprint: the daemon writes it into runtime.json and the CLI compares against it. Its input is every service entry registry.LoadForRuntime decodes, in file order, the valid ones and the ones isolated as per-service issues alike. The daemon passes what it loaded; the CLI calls CurrentRegistryFingerprint. A fingerprint over only the valid entries on one side would call a snapshot stale for as long as any service has an issue, which says nothing about whether the daemon applied the latest registry.

func Remove ¶

func Remove(path string) error

func RemoveOwnedNodeIDs ¶

func RemoveOwnedNodeIDs(path string, nodeIDs []string) error

RemoveOwnedNodeIDs forgets only ownership IDs that remote reconciliation has proved deleted or already absent.

func RemoveOwnedNodeIDsContext ¶

func RemoveOwnedNodeIDsContext(ctx context.Context, path string, nodeIDs []string) error

func RemoveServiceNodeState ¶

func RemoveServiceNodeState(configDir, name string) error

RemoveServiceNodeState deletes the tsnet state directory a service kept inside configDir.

configDir is a parameter rather than something this function reads from the environment, and the callers derive it from the registry path they just wrote. That is what keeps the deletion inside the same config directory as the decision that authorised it: a caller operating on one registry while config.Dir() resolves to another would otherwise delete a live service's node identity out of an unrelated installation, and the deletion would look entirely normal from inside that caller.

The name is validated as a registry service name before anything is removed. Callers reach this with a name that came out of the ownership ledger or off a command line, and a registry service name is a DNS label -- no separator, no dot segment, no empty string -- so the validation is what keeps a malformed or hostile name from turning a RemoveAll of one directory into a RemoveAll of the nodes directory itself, or of something beside it.

It is deliberately not a decision about *whether* removing the state is safe. That decision needs facts this package does not have (was the remote node actually deleted, is a tsnet server still holding the directory), so it stays with the callers that have them.

func Save ¶

func Save(path string, snapshot Snapshot) error

func ServiceNodeStateConfigDir ¶

func ServiceNodeStateConfigDir(registryPath string) string

ServiceNodeStateConfigDir maps a registry path to the config directory that owns it. Registry and node state are siblings by construction, so this is the one derivation both callers use.

func TryRemoveOwnedNodesIfUnchanged ¶

func TryRemoveOwnedNodesIfUnchanged(path string, oldNodes []OwnedNode) (bool, error)

TryRemoveOwnedNodesIfUnchanged clears only the exact rows that were proved resolved before local cleanup. A newly recorded identity with the same ID must survive a writer arriving after the final state deletion.

func TryUpdateOwnership ¶

func TryUpdateOwnership(path string, update func(*OwnershipLedger) (bool, error)) (bool, error)

TryUpdateOwnership updates the ledger atomically without waiting for a writer. A busy lock leaves both the local state and its retry evidence unchanged.

func TryWithLockedOwnership ¶

func TryWithLockedOwnership(path string, fn func(OwnershipLedger) error) (bool, error)

TryWithLockedOwnership reports false on contention without invoking fn.

func UpdateOwnership ¶

func UpdateOwnership(path string, update func(*OwnershipLedger) (changed bool, err error)) error

UpdateOwnership loads the ledger under its lock and hands it to update, saving it afterwards when update reports a change. What update reads, and any action it takes on that basis, happens before any other writer can change the ledger.

func WithLockedOwnership ¶

func WithLockedOwnership(path string, fn func(OwnershipLedger) error) error

WithLockedOwnership keeps a read and its local-state action atomic with RecordOwnedNode and RemoveOwnedNodeIDs. The callback must not write the ownership ledger or acquire this lock again.

func WithOwnershipLock ¶

func WithOwnershipLock(path string, fn func() error) error

WithOwnershipLock runs fn while holding the ledger's lock, the lock every ledger writer in this package takes in every process. A decision fn makes cannot be overtaken by a RecordOwnedNode, MarkOwnedNodeIDsRetired or RemoveOwnedNodeIDs. The lock is not reentrant: fn must not call those writers, or UpdateOwnership.