Documentation
¶
Overview ¶
Copyright 2026 Sneat.co
Copyright 2026 Sneat.co ¶
Copyright 2026 Sneat.co ¶
Package facade4datatug holds the DataTug extension's application commands.
It is storage-agnostic by construction: the only persistence API it uses is dal-go, so it never learns whether the host backs it with Firestore, an in-memory database (tests), or anything else. Platform needs arrive through ports declared in ports.go.
Copyright 2026 Sneat.co ¶
Copyright 2026 Sneat.co ¶
Copyright 2026 Sneat.co ¶
Copyright 2026 Sneat.co ¶
Copyright 2026 Sneat.co ¶
Copyright 2026 Sneat.co ¶
Copyright 2026 Sneat.co ¶
Copyright 2026 Sneat.co ¶
Copyright 2026 Sneat.co ¶
Copyright 2026 Sneat.co ¶
Copyright 2026 Sneat.co ¶
Copyright 2026 Sneat.co
Index ¶
- Constants
- Variables
- func EmbeddedDemoSessionScope(space, project, environment string) (sessioncontext.Scope, sessioncontext.Subject, error)
- func InitializeProtectedProjectQuota(ctx context.Context, db dal.DB, options PaidSharedProjectOptions, ...) error
- func SessionNativeRepository(mounted sessioncontext.MountedDatabase, scope SessionOperationScope) (*sessioncontext.DALRepository, error)
- func ValidatePlanConfig(config PlanConfig) error
- type AccountPlanEffect
- type AccountPlanWriter
- type AdmissionReader
- type AdmissionState
- type BusinessActivityActorVerifier
- type BusinessActivityBinding
- type BusinessActivityBindingReader
- type BusinessActivityBindingReaderOptions
- type BusinessProjectAccessPolicy
- type BusinessProjectAccessVerifier
- type BusinessQueryActivityService
- func (s *BusinessQueryActivityService) IssueContext(ctx context.Context, actorID, spaceID, projectID string) (QueryActivityContextResponse, error)
- func (s *BusinessQueryActivityService) Report(ctx context.Context, actorID, spaceID string, request QueryActivityReport) (QueryActivityReportResult, error)
- type BusinessSharedProjectOptions
- type BusinessUsageCloseTerms
- type BusinessUsageCloseTermsReader
- type BusinessUsageLifecycleResult
- type BusinessUsageLifecycleWorker
- func NewBusinessUsageLifecycleWorker(db dal.DB, query dal.QueryExecutor, periods *BusinessUsagePeriodService, ...) (*BusinessUsageLifecycleWorker, error)
- func NewBusinessUsageLifecycleWorkerWithInvoices(mode contract4paymentus.Mode, db dal.DB, query dal.QueryExecutor, ...) (*BusinessUsageLifecycleWorker, error)
- type BusinessUsagePeriodAuthorityOptions
- type BusinessUsagePeriodOpener
- type BusinessUsagePeriodService
- func (s *BusinessUsagePeriodService) Close(ctx context.Context, request contract4paymentus.UsageCloseRequest) (contract4paymentus.UsagePeriodClose, error)
- func (s *BusinessUsagePeriodService) CloseDue(ctx context.Context, ref contract4paymentus.UsagePeriodRef) (contract4paymentus.UsagePeriodClose, error)
- func (s *BusinessUsagePeriodService) OpenCurrent(ctx context.Context, spaceID string) (contract4paymentus.UsagePeriodSnapshot, error)
- func (s *BusinessUsagePeriodService) ResumeOpening(ctx context.Context, ref contract4paymentus.UsagePeriodRef) (contract4paymentus.UsagePeriodSnapshot, error)
- type BusinessUsageRuntime
- type BusinessUsageRuntimeOptions
- type BusinessUsageTaxPolicyRegistration
- type BusinessUsageTestClockRuntime
- func (r *BusinessUsageTestClockRuntime) CloseDue(ctx context.Context, ref contract4paymentus.UsagePeriodRef) (contract4paymentus.UsagePeriodClose, error)
- func (r *BusinessUsageTestClockRuntime) Drain(ctx context.Context, spaceID string, request QueryActivityDrainRequest) (QueryActivityDrainResult, error)
- func (r *BusinessUsageTestClockRuntime) IssueContext(ctx context.Context, actorID, spaceID, projectID string) (QueryActivityContextResponse, error)
- func (r *BusinessUsageTestClockRuntime) OpenCurrent(ctx context.Context, spaceID string) (contract4paymentus.UsagePeriodSnapshot, error)
- func (r *BusinessUsageTestClockRuntime) PrepareInvoice(ctx context.Context, ref contract4paymentus.UsagePeriodRef) (contract4paymentus.UsageInvoiceResult, error)
- func (r *BusinessUsageTestClockRuntime) ProcessInvoice(ctx context.Context, ref contract4paymentus.UsagePeriodRef) (contract4paymentus.UsageInvoiceResult, error)
- func (r *BusinessUsageTestClockRuntime) ReadInvoice(ctx context.Context, ref contract4paymentus.UsagePeriodRef) (contract4paymentus.UsageInvoiceResult, error)
- func (r *BusinessUsageTestClockRuntime) ReadPeriod(ctx context.Context, ref contract4paymentus.UsagePeriodRef) (contract4paymentus.UsagePeriodState, error)
- func (r *BusinessUsageTestClockRuntime) ReplayPendingInvoicePaid(ctx context.Context, spaceID, eventID string, ...) error
- func (r *BusinessUsageTestClockRuntime) Report(ctx context.Context, actorID, spaceID string, request QueryActivityReport) (QueryActivityReportResult, error)
- func (r *BusinessUsageTestClockRuntime) UsageInvoiceBuyerLookup() (contract4paymentus.UsageInvoiceBuyerLookup, error)
- type CallerAdmissionReader
- type ConfiguredProLimits
- type CurrentProjectContactPort
- type DALProtectedProjectInventory
- type DemoPersonalSpaceProvisioner
- type DetectiveDemoProjectRequest
- type DetectivePersonalActivationOptions
- type DetectiveService
- func (s *DetectiveService) AIConfirm(ctx context.Context, actor string, request HostedAIConfirm) (detectiveai.Receipt, error)
- func (s *DetectiveService) AIGenerate(ctx context.Context, actor string, request HostedAIGenerate, ...) (detectiveai.Response, error)
- func (s *DetectiveService) AIProposals(ctx context.Context, actor, space, project, after string) (HostedAIPage, error)
- func (s *DetectiveService) AIReview(ctx context.Context, actor string, request HostedAIReview) (detectiveai.Proposal, error)
- func (s *DetectiveService) Action(ctx context.Context, actor string, request HostedDetectiveAction) (HostedDetectiveResponse, error)
- func (s *DetectiveService) CaseEvents(ctx context.Context, actor, space, project, caseID string, before int) (detective.CaseEventsPage, error)
- func (s *DetectiveService) ConfigureDemo(space DemoPersonalSpaceProvisioner, authority SharedProjectCreateAuthority) error
- func (s *DetectiveService) ConfigureDemoWithActivation(space DemoPersonalSpaceProvisioner, owner PersonalPlanOwnerPort, ...) error
- func (s *DetectiveService) ConfigureIncidents(store incidents.APIStore, storeID string) error
- func (s *DetectiveService) ConfigurePaidEnvironments(provider HostedProjectEnvironmentProvider) error
- func (s *DetectiveService) CreateOrResumeDemo(ctx context.Context, actor string, request DetectiveDemoProjectRequest) (models4datatug.SharedProjectRef, error)
- func (s *DetectiveService) IncidentAction(ctx context.Context, actor string, request HostedIncidentAction) (HostedIncidentResponse, error)
- func (s *DetectiveService) KnowledgeAction(ctx context.Context, actor string, request HostedKnowledgeAction) (HostedKnowledgeResponse, error)
- func (s *DetectiveService) KnowledgeProposals(ctx context.Context, actor, space, project, after string) (HostedKnowledgePage, error)
- func (s *DetectiveService) LinkedIncidents(ctx context.Context, actor, space, project, caseID string) (HostedIncidentLinks, error)
- func (s *DetectiveService) RunSavedQuery(ctx context.Context, actor string, request HostedQueryRunRequest) (HostedQueryRunResponse, error)
- func (s *DetectiveService) State(ctx context.Context, actor, space, project, runsBefore string) (detective.State, error)
- type Facade
- type FirstAdmittedMonthReader
- type GitHubActivityScope
- type GitHubCreateRepository
- type GitHubCreateRepositoryScope
- type GitHubProjectAccess
- type GitHubProjectCreateCommand
- type GitHubProjectCreateResult
- type GitHubQueryExpectedFile
- type GitHubQueryFileChange
- type GitHubQueryRepository
- type GitHubQuerySavePlan
- type HostedAIConfirm
- type HostedAIGenerate
- type HostedAIPage
- type HostedAIProjectRef
- type HostedAIReview
- type HostedDemoExecutor
- type HostedDetectiveAction
- type HostedDetectiveQueryExecutor
- type HostedDetectiveResponse
- type HostedEmbeddedDemoExecutor
- type HostedIncidentAction
- type HostedIncidentLinks
- type HostedIncidentResponse
- type HostedIncidentStore
- func (s *HostedIncidentStore) Append(ctx context.Context, mutation incidents.Mutation) (incidents.AppendResult, error)
- func (s *HostedIncidentStore) Create(ctx context.Context, mutation incidents.CreateMutation) (incidents.CreateResult, error)
- func (s *HostedIncidentStore) Events(ctx context.Context, ref incidents.IncidentRef, afterSeq uint64) ([]incidents.Event, error)
- func (s *HostedIncidentStore) List(ctx context.Context, query incidents.CandidateListQuery) ([]incidents.Incident, error)
- func (*HostedIncidentStore) Merge(context.Context, incidents.MergeMutation) (incidents.MergeResult, error)
- func (s *HostedIncidentStore) Projection(ctx context.Context, ref incidents.IncidentRef, at *time.Time) (incidents.Incident, error)
- func (s *HostedIncidentStore) Watch(ctx context.Context, query incidents.WatchQuery) (incidents.EventStream, error)
- type HostedKnowledgeAction
- type HostedKnowledgeHandoff
- type HostedKnowledgePage
- type HostedKnowledgeProposal
- type HostedKnowledgeResponse
- type HostedKnowledgeTarget
- type HostedOVDBExecutor
- type HostedProjectEnvironmentBinding
- type HostedProjectEnvironmentProvider
- type HostedProjectSourceBinding
- type HostedQueryRunRequest
- type HostedQueryRunResponse
- type HostedSavedQueryExecution
- type HostedSavedQueryResult
- type HostedSessionDetectiveOptions
- type HostedSessionDetectiveService
- func (s *HostedSessionDetectiveService) Dispatch(ctx context.Context, actor string, scope SessionOperationScope, ...) (SessionDetectiveStatus, error)
- func (s *HostedSessionDetectiveService) Enabled() bool
- func (s *HostedSessionDetectiveService) ProviderAvailable() bool
- func (s *HostedSessionDetectiveService) RedactAcceptedPins(ctx context.Context, actor string, scope SessionOperationScope, ...) (string, error)
- func (s *HostedSessionDetectiveService) RequireActiveAccount(ctx context.Context, actor string) error
- func (s *HostedSessionDetectiveService) Status(ctx context.Context, actor string, scope SessionOperationScope, op string, ...) (SessionDetectiveStatus, error)
- type IDGenerator
- type InitialProtectedProjectBasis
- type NativeBusinessActivityBindingReader
- type NativeBusinessUsageCloseTermsReader
- type NativeBusinessUsagePeriodAuthority
- type NativeProjectContactRoleTarget
- type NativeProjectRoleManager
- type PaidMonthAllocator
- type PaidProjectLinkageOptions
- type PaidProjectLinkagePolicy
- type PaidProjectOwnerLinksOptions
- type PaidSharedProjectOptions
- type PersonalAccount
- type PersonalAccountDirectory
- type PersonalPlanOwnerPort
- type PersonalPlanService
- type PlanAI
- type PlanAccount
- type PlanApplyOutcome
- type PlanClock
- type PlanConfig
- type PlanConfigReader
- type PlanEffectAuthority
- type PlanEffectGrants
- type PlanEffectOwnerPort
- type PlanFacts
- type PlanModel
- type PlanMoneyFence
- type PlanOwnerFence
- type PlanPayment
- type PlanPaymentLine
- type PlanReader
- type PlanRefund
- type PlanResponse
- type PlanStateResult
- type PlanToday
- type PreparedSharedProjectCreate
- type ProBusinessSharedProjectOptions
- type ProLimitsResolver
- type ProLimitsSnapshot
- type ProjectAIEligibility
- type ProjectContactRoleChange
- type ProjectContactRoleTargetPort
- type ProjectContactState
- type ProjectOwnerContactPort
- type ProjectRoleCatalog
- type ProjectRoleEvidence
- type ProjectRoleManagerPort
- type ProjectRoleMutationAuthorization
- type ProtectedProjectBasisAuthority
- type PurchaseReadiness
- type PurchaseReadinessRequest
- type QueryActivityContextResponse
- type QueryActivityContextService
- type QueryActivityDrainRequest
- type QueryActivityDrainResult
- type QueryActivityReport
- type QueryActivityReportResult
- type QueryActivityService
- func (s *QueryActivityService) Deliver(ctx context.Context, spaceID, receiptID string) error
- func (s *QueryActivityService) Drain(ctx context.Context, spaceID string, request QueryActivityDrainRequest) (QueryActivityDrainResult, error)
- func (s *QueryActivityService) IssueContext(ctx context.Context, actorID, spaceID, projectID string) (QueryActivityContextResponse, error)
- func (s *QueryActivityService) Report(ctx context.Context, actorID, spaceID string, report QueryActivityReport) (QueryActivityReportResult, error)
- type QueryActivityUsageAuthority
- type RegisterGithubProjectRequest
- type ServiceRefundProof
- type SessionDetectiveBinding
- type SessionDetectiveRequest
- type SessionDetectiveStatus
- type SessionOperationScope
- type SharedProjectActivationOptions
- type SharedProjectBillingIntent
- type SharedProjectCreateAuthority
- type SharedProjectCreateBinding
- type SharedProjectCreateCommand
- type SharedProjectCreateTransactionAuthority
- type SharedProjectQueryOperationScope
- type SharedProjectQueryReadResult
- type SharedProjectService
- func NewActivatingBusinessSharedProjectService(db dal.DB, ids IDGenerator, now func() time.Time, ...) (*SharedProjectService, error)
- func NewActivatingPaidSharedProjectService(db dal.DB, ids IDGenerator, now func() time.Time, ...) (*SharedProjectService, error)
- func NewActivatingProBusinessSharedProjectService(db dal.DB, ids IDGenerator, now func() time.Time, ...) (*SharedProjectService, error)
- func NewBusinessSharedProjectService(db dal.DB, ids IDGenerator, authority SharedProjectCreateAuthority, ...) (*SharedProjectService, error)
- func NewDetectiveSharedProjectService(db dal.DB, ids IDGenerator, now func() time.Time, ...) (*SharedProjectService, error)
- func NewPaidSharedProjectService(db dal.DB, ids IDGenerator, authority SharedProjectCreateAuthority, ...) (*SharedProjectService, error)
- func NewProBusinessSharedProjectService(db dal.DB, ids IDGenerator, authority SharedProjectCreateAuthority, ...) (*SharedProjectService, error)
- func NewSharedProjectService(db dal.DB, ids IDGenerator, authority SharedProjectCreateAuthority, ...) (*SharedProjectService, error)
- func (s *SharedProjectService) AuthorizeGitHubProjectWrite(ctx context.Context, actorID string, repositoryID int64, ...) (GitHubProjectAccess, error)
- func (s *SharedProjectService) AuthorizeSessionContextProject(ctx context.Context, actor, spaceID, projectID string) error
- func (s *SharedProjectService) Create(ctx context.Context, command SharedProjectCreateCommand) (models4datatug.SharedProjectRef, error)
- func (s *SharedProjectService) CreateGitHubProject(ctx context.Context, command GitHubProjectCreateCommand, ...) (GitHubProjectCreateResult, error)
- func (s *SharedProjectService) EnsureProtectedProjectQuotaForCreate(ctx facade.ContextWithUser, binding SharedProjectCreateBinding) error
- func (s *SharedProjectService) ListSharedProjectQueries(ctx context.Context, actorID, spaceID, projectID string) ([]datatug.QueryDefWithFolderPath, error)
- func (s *SharedProjectService) PlanExplicitProjectCreateActivationInTransaction(ctx facade.ContextWithUser, tx dal.ReadwriteTransaction, ...) (contract4spaceus.PreparedRoleCapabilityActivation, error)
- func (s *SharedProjectService) ReadGitHubProjectAIEligibility(ctx context.Context, actorID string, repositoryID int64, ...) (ProjectAIEligibility, error)
- func (s *SharedProjectService) ReadSharedProjectAIEligibility(ctx context.Context, actorID, spaceID, projectID string) (ProjectAIEligibility, error)
- func (s *SharedProjectService) ReadSharedProjectQuery(ctx context.Context, actorID, spaceID, projectID, folderPath, queryID string) (*SharedProjectQueryReadResult, error)
- func (s *SharedProjectService) ReadSharedProjectSummary(ctx context.Context, actorID, spaceID, projectID string) (json.RawMessage, error)
- func (s *SharedProjectService) ResolveGitHubProject(ctx context.Context, actorID string, repositoryID int64, ...) (GitHubProjectAccess, error)
- func (s *SharedProjectService) SaveGitHubQuery(ctx context.Context, actorID string, repositoryID int64, ...) (*dto.SaveQueryResponse, error)
- func (s *SharedProjectService) SaveSharedProjectQuery(ctx context.Context, actorID, spaceID string, request dto.SaveQueryRequest) (*dto.SaveQueryResponse, error)
- func (s *SharedProjectService) SessionContextDemoEnvironments(ctx context.Context, actor, spaceID, projectID string) ([]string, error)
- func (s *SharedProjectService) SharedProjectQueryCapabilities(ctx context.Context, actorID, spaceID, projectID string) (dto.ProjectCapabilities, error)
- type SpaceServiceAccess
- type UsageReader
Constants ¶
const ( BusinessProjectProductID = "datatug-business-usage" BusinessProjectServiceID = "datatug" BusinessProjectOwnerFamily = "datatug" BusinessProjectAccountKind = "space" BusinessMonthlyPlanID = "datatug-business-usage-monthly" BusinessAnnualPlanID = "datatug-business-usage-annual" )
const BusinessUsageCloseGrace = 48 * time.Hour
const BusinessUsageLifecycleMaxPageSize = 100
const HostedEmbeddedDemoOrigin = "https://detective-demo.internal"
const QueryActivityMaxDrainBatchSize = 100
const QueryActivityWatermarkBatchSize = 128
Variables ¶
var ( ErrBusinessServiceUnproved = errors.New("business space service access is unproved") ErrBusinessServiceEnded = errors.New("business space service has ended") )
var ( ErrDetectiveInvalid = errors.New("invalid hosted Detective request") ErrDetectiveConflict = errors.New("hosted Detective operation conflict") ErrDetectiveCapacity = errors.New("hosted Detective capacity reached") ErrDetectiveSnapshot = errors.New("hosted execution snapshot unavailable") ErrDetectiveInterrupted = errors.New("hosted execution interrupted; start a new authorized operation") )
var ( ErrGitHubProjectConflict = errors.New("GitHub project create conflict") ErrGitHubOutcomeUncertain = errors.New("GitHub project create outcome uncertain") ErrGitHubProjectInvalid = errors.New("invalid GitHub project create command") )
var ( // ErrOrgRequired is returned when a GitHub project is registered without // its repository owner. ErrOrgRequired = errors.New("github org is required") // ErrRepoRequired is returned when a GitHub project is registered without // its repository name. ErrRepoRequired = errors.New("github repo is required") )
var ( ErrForeignAccount = errors.New("account is not the caller's personal account") )
var ( // ErrUserIDRequired is returned when a command is called without a user. ErrUserIDRequired = errors.New("user id is required") // ErrTitleRequired is returned when a project is created without a title. ErrTitleRequired = errors.New("project title is required") // ErrUnsupportedStore is returned for a store this API does not serve. A // project in a GitHub repo is created by the client holding the user's // GitHub credential, and a local filesystem project by the datatug CLI // agent — only the DataTug cloud store is created here. ErrUnsupportedStore = errors.New("store is not served by the DataTug cloud API") )
var ( ErrQueryActivityInvalid = errors.New("invalid query activity request") ErrQueryActivityConflict = errors.New("query activity identity conflicts") ErrQueryActivityRateLimited = errors.New("query activity rate limit exceeded") )
var ( )
var ( )
var ErrGitHubProjectNotRegistered = errors.New("GitHub project is not registered")
var ErrGitHubQueryConflict = errors.New("GitHub query mutation conflict")
var ErrGitHubQueryInvalid = errors.New("invalid GitHub query mutation")
var ErrGitHubQueryOutcomeUncertain = errors.New("GitHub query mutation outcome uncertain")
var ErrPlanEffectUnproved = errors.New("plan effect is not proved")
var ErrProjectContactLimit = errors.New("protected project contact limit unavailable or exhausted")
var ErrProtectedProjectInventory = errors.New("protected project inventory could not be proved complete")
var ErrProtectedProjectQuota = errors.New("protected project quota unavailable or exhausted")
Functions ¶
func EmbeddedDemoSessionScope ¶ added in v0.30.0
func EmbeddedDemoSessionScope(space, project, environment string) (sessioncontext.Scope, sessioncontext.Subject, error)
EmbeddedDemoSessionScope names the real immutable native invoice source. It deliberately differs from Chinook even when both contain invoice ID 1. Fixture, template and reviewed catalog changes invalidate this identity.
func InitializeProtectedProjectQuota ¶ added in v0.11.0
func InitializeProtectedProjectQuota(ctx context.Context, db dal.DB, options PaidSharedProjectOptions, actor, payer string, basis InitialProtectedProjectBasis, authority ProtectedProjectBasisAuthority) error
InitializeProtectedProjectQuota is one-time and transaction fenced. A host must bind an actual empty/import proof source before calling it; a caller or operator claim alone is insufficient. All creates refuse absent quota, so concurrent initialization cannot race an uncounted admission. Deletion and quota release require a future atomic allocation-retirement command; this count is not reset on payment renewal or subscription replacement.
func SessionNativeRepository ¶ added in v0.30.0
func SessionNativeRepository(mounted sessioncontext.MountedDatabase, scope SessionOperationScope) (*sessioncontext.DALRepository, error)
SessionNativeRepository reconstructs only the declared operational parent. The caller still authenticates its actor and matches accepted stored identity.
func ValidatePlanConfig ¶ added in v0.7.0
func ValidatePlanConfig(config PlanConfig) error
ValidatePlanConfig checks the shared plan settings before they are used for plan reads, purchase readiness, or checkout activation.
Types ¶
type AccountPlanEffect ¶ added in v0.5.0
type AccountPlanEffect struct {
Fence PlanOwnerFence
BuyerID string
AccountKind string
PlanID string
PlaceID string `json:",omitempty"`
Tier string
Period string
Status string
LastPaidEnd time.Time
ScheduledEnd time.Time
EffectiveEnd time.Time
PaidService bool
AppliedPercent int
LaunchGrant bool
Grants PlanEffectGrants
Payments []PlanPayment
CashBasisKnown bool
MoneyIngestEpoch int64
ObservedAt time.Time
CheckoutStartedAt time.Time
QuoteKey string
PaidServiceProofID string
BasisOnly bool
SourceSubscriptionID string
SourceRevision int64
SourcePaidService bool
SourceQuoteKey string
SourcePaidServiceProofID string
LastServiceRefund *ServiceRefundProof
TerminalFullRefund bool `json:"terminalFullRefund,omitempty"`
}
AccountPlanEffect is a provider-neutral copy of the accepted payment fact. The host passes the *complete* source fact to VerifyCurrentEffect and ReconcileMoney; this type never substitutes for paymentus's accepted digest.
type AccountPlanWriter ¶ added in v0.5.0
type AccountPlanWriter struct {
DB dal.DB
Owner PlanEffectOwnerPort
Personal PersonalPlanOwnerPort
Allocator PaidMonthAllocator
Limits ProLimitsResolver
Clock PlanClock
}
AccountPlanWriter is the DataTug domain writer. Its ports are bound by the host to one DAL database; no provider or cross-extension package is imported.
func (AccountPlanWriter) Apply ¶ added in v0.5.0
func (w AccountPlanWriter) Apply(ctx context.Context, effect AccountPlanEffect) (PlanApplyOutcome, error)
type AdmissionReader ¶ added in v0.4.0
type AdmissionState ¶ added in v0.4.0
AdmissionState supplies guards that are authoritative outside this module. Blocked is empty, daily, free_budget, or unverified.
type BusinessActivityActorVerifier ¶ added in v0.23.0
type BusinessActivityActorVerifier interface {
VerifyBusinessActivityActor(context.Context, dal.ReadTransaction, string) error
}
BusinessActivityActorVerifier must bind actorID to the authenticated server identity for this request. Implementations must use only the supplied transaction and must not trust an actor ID copied from a request body.
type BusinessActivityBinding ¶ added in v0.20.0
type BusinessActivityBinding struct {
Period contract4paymentus.UsagePeriodRef
PeriodStartUTC, PeriodEndUTC, PaidUntilUTC time.Time
PaidBindingProofID, PayerBindingDigest, QueryUseProofID string
QueryUseAllowed bool
}
BusinessActivityBinding is returned only by the host's transaction-bound financial and membership authority. It contains canonical paid-period facts, not caller claims. QueryUseAllowed includes current actor/project query-use access; publish/contributor permission is deliberately not required.
type BusinessActivityBindingReader ¶ added in v0.20.0
type BusinessActivityBindingReader interface {
ReadCurrentBusinessActivityBinding(context.Context, dal.ReadTransaction, string, string, string, time.Time) (BusinessActivityBinding, error)
}
BusinessActivityBindingReader must validate current reciprocal membership, query-use permission and paid service binding using the supplied transaction. It must not start a transaction or call a provider.
type BusinessActivityBindingReaderOptions ¶ added in v0.23.0
type BusinessActivityBindingReaderOptions struct {
Access *BusinessProjectAccessVerifier
InitialStarts contract4paymentus.InitialServiceStartReader
Periods contract4paymentus.UsagePeriodReader
Contacts CurrentProjectContactPort
Actors BusinessActivityActorVerifier
}
type BusinessProjectAccessPolicy ¶ added in v0.21.0
type BusinessProjectAccessPolicy struct {
GrantVersion string
// Mode is fixed by trusted server composition. Request values never select
// the Paymentus environment.
Mode contract4paymentus.Mode
}
BusinessProjectAccessPolicy is server configuration. Unlimited project and contact grants come from this versioned product policy, never from a money field or the absence of Pro limits.
type BusinessProjectAccessVerifier ¶ added in v0.19.0
type BusinessProjectAccessVerifier struct {
// contains filtered or unexported fields
}
BusinessProjectAccessVerifier contains no provider or mutation handle. The Paymentus reader can only inspect the caller's transaction; paid end and evidence expiry are both enforced before DataTug uses this result.
func NewBusinessProjectAccessVerifier ¶ added in v0.19.0
func NewBusinessProjectAccessVerifier(reader contract4paymentus.CurrentSpaceServiceReader, policy BusinessProjectAccessPolicy, now func() time.Time) (*BusinessProjectAccessVerifier, error)
func (*BusinessProjectAccessVerifier) Mode ¶ added in v0.23.3
func (v *BusinessProjectAccessVerifier) Mode() contract4paymentus.Mode
func (*BusinessProjectAccessVerifier) ReadCurrent ¶ added in v0.19.0
func (v *BusinessProjectAccessVerifier) ReadCurrent(ctx context.Context, tx dal.ReadTransaction, spaceID string) (SpaceServiceAccess, error)
ReadCurrent verifies the selected Space's explicitly configured DataTug Business service. Current contact membership and action-specific roles are separate checks. Same-Space owner replacement is allowed: the admission's original proof remains provenance, while this read verifies the current owner.
type BusinessQueryActivityService ¶ added in v0.23.2
type BusinessQueryActivityService struct {
// contains filtered or unexported fields
}
BusinessQueryActivityService is the thin route composition used by the host. It opens and verifies the current server-owned period before issuing a query activity context; Report continues through the existing authority and checkpoint fences.
func NewBusinessQueryActivityService ¶ added in v0.23.2
func NewBusinessQueryActivityService(periods BusinessUsagePeriodOpener, activity QueryActivityContextService) (*BusinessQueryActivityService, error)
func (*BusinessQueryActivityService) IssueContext ¶ added in v0.23.2
func (s *BusinessQueryActivityService) IssueContext(ctx context.Context, actorID, spaceID, projectID string) (QueryActivityContextResponse, error)
func (*BusinessQueryActivityService) Report ¶ added in v0.23.2
func (s *BusinessQueryActivityService) Report(ctx context.Context, actorID, spaceID string, request QueryActivityReport) (QueryActivityReportResult, error)
type BusinessSharedProjectOptions ¶ added in v0.21.0
type BusinessSharedProjectOptions struct {
}
BusinessSharedProjectOptions are trusted host composition. The caller's existing Space authority remains required for each create command; current paid access is separately read from Paymentus in that same transaction.
type BusinessUsageCloseTerms ¶ added in v0.23.1
type BusinessUsageCloseTerms struct {
Capacity contract4paymentus.UsageCapacityEvidence
BaseEvent contract4paymentus.UsageBaseEvent
BillMonthlyOverage bool
DiscountPercent int
}
BusinessUsageCloseTerms is server-derived close authority. A request's capacity digest and pricing choices are not accepted unless this port independently resolves the same frozen terms from the caller's transaction.
type BusinessUsageCloseTermsReader ¶ added in v0.23.1
type BusinessUsageCloseTermsReader interface {
ReadBusinessUsageCloseTerms(context.Context, dal.ReadTransaction, contract4paymentus.UsagePeriodSnapshot) (BusinessUsageCloseTerms, error)
}
BusinessUsageCloseTermsReader must verify all capacity and pricing inputs from the supplied transaction. It must not use a provider or open a nested transaction. The native implementation refuses any non-empty prepaid basis until DataTug's partial-window coverage policy is approved.
type BusinessUsageLifecycleResult ¶ added in v0.23.2
type BusinessUsageLifecycleResult struct {
CheckpointsScanned int
PeriodsOpened int
PeriodsClosed int
InvoicesProcessed int
ActivitySpaces int
ActivityScanned int
ActivityDelivered int
Failures int
CheckpointAfter string
PendingAfter string
CheckpointHasMore bool
PendingHasMore bool
}
BusinessUsageLifecycleResult reports bounded progress. Cursors are durable scan positions and carry no authority; candidates are re-read from their Space-scoped records before any lifecycle operation.
type BusinessUsageLifecycleWorker ¶ added in v0.23.2
type BusinessUsageLifecycleWorker struct {
// contains filtered or unexported fields
}
BusinessUsageLifecycleWorker is an owning-module scheduler port. It uses collection-group queries only to discover bounded pages of Space-owned records; all financial authority and writes remain in the native services.
func NewBusinessUsageLifecycleWorker ¶ added in v0.23.2
func NewBusinessUsageLifecycleWorker(db dal.DB, query dal.QueryExecutor, periods *BusinessUsagePeriodService, activity *QueryActivityService, now func() time.Time) (*BusinessUsageLifecycleWorker, error)
func NewBusinessUsageLifecycleWorkerWithInvoices ¶ added in v0.23.3
func NewBusinessUsageLifecycleWorkerWithInvoices(mode contract4paymentus.Mode, db dal.DB, query dal.QueryExecutor, periods *BusinessUsagePeriodService, activity *QueryActivityService, invoices contract4paymentus.UsageInvoiceService, now func() time.Time) (*BusinessUsageLifecycleWorker, error)
func (*BusinessUsageLifecycleWorker) Run ¶ added in v0.23.2
func (w *BusinessUsageLifecycleWorker) Run(ctx context.Context, pageSize int) (BusinessUsageLifecycleResult, error)
Run performs at most one page from each collection group. Failed candidates are counted and skipped for this pass; cursors wrap on a later pass so a single held Space cannot starve other Spaces. The underlying operations are idempotent and safe to retry after interruption.
type BusinessUsagePeriodAuthorityOptions ¶ added in v0.23.1
type BusinessUsagePeriodAuthorityOptions struct {
Mode contract4paymentus.Mode
Access *BusinessProjectAccessVerifier
InitialStarts contract4paymentus.InitialServiceStartReader
Periods contract4paymentus.UsagePeriodReader
CloseTerms BusinessUsageCloseTermsReader
// Pricing resolves the current server-approved config for new periods. It
// is a server-owned dependency, never request input. Existing periods keep
// the config frozen in their native snapshot.
Pricing func() contract4paymentus.UsagePricingConfig
Now func() time.Time
}
type BusinessUsagePeriodOpener ¶ added in v0.23.2
type BusinessUsagePeriodOpener interface {
OpenCurrent(context.Context, string) (contract4paymentus.UsagePeriodSnapshot, error)
}
type BusinessUsagePeriodService ¶ added in v0.23.1
type BusinessUsagePeriodService struct {
// contains filtered or unexported fields
}
BusinessUsagePeriodService makes the staged open/close sequence externally idempotent. A partial stage leaves a non-ready checkpoint that cannot admit reports or close; retry completes only after the native ledger confirms the exact stored period.
func NewBusinessUsagePeriodService ¶ added in v0.23.1
func NewBusinessUsagePeriodService(db dal.DB, authority *NativeBusinessUsagePeriodAuthority, ledger contract4paymentus.UsageLedger, now func() time.Time) (*BusinessUsagePeriodService, error)
func (*BusinessUsagePeriodService) Close ¶ added in v0.23.1
func (s *BusinessUsagePeriodService) Close(ctx context.Context, request contract4paymentus.UsageCloseRequest) (contract4paymentus.UsagePeriodClose, error)
func (*BusinessUsagePeriodService) CloseDue ¶ added in v0.23.2
func (s *BusinessUsagePeriodService) CloseDue(ctx context.Context, ref contract4paymentus.UsagePeriodRef) (contract4paymentus.UsagePeriodClose, error)
CloseDue derives the close request from the server clock, the stored completeness checkpoint, the frozen native period, and server-verified close terms. Callers cannot select a close time, capacity, or price inputs. A previously staged or completed close reuses its immutable request.
func (*BusinessUsagePeriodService) OpenCurrent ¶ added in v0.23.1
func (s *BusinessUsagePeriodService) OpenCurrent(ctx context.Context, spaceID string) (contract4paymentus.UsagePeriodSnapshot, error)
func (*BusinessUsagePeriodService) ResumeOpening ¶ added in v0.23.2
func (s *BusinessUsagePeriodService) ResumeOpening(ctx context.Context, ref contract4paymentus.UsagePeriodRef) (contract4paymentus.UsagePeriodSnapshot, error)
ResumeOpening recovers an Opening checkpoint without granting current access. If the native Open never committed, it may retry only while the exact same anchored period is still current and independently authorized.
type BusinessUsageRuntime ¶ added in v0.23.3
type BusinessUsageRuntime struct {
Access *BusinessProjectAccessVerifier
Activity *BusinessQueryActivityService
Periods *BusinessUsagePeriodService
Invoices contract4paymentus.UsageInvoiceService
Worker *BusinessUsageLifecycleWorker
Ledger contract4paymentus.UsageLedger
PeriodReader contract4paymentus.UsagePeriodReader
PayerAuthority contract4paymentus.UsagePeriodInvoicePayerAuthority
// contains filtered or unexported fields
}
BusinessUsageRuntime exposes the server-owned composition used by project activity intake and the bounded lifecycle scheduler.
func NewBusinessUsageRuntime ¶ added in v0.23.3
func NewBusinessUsageRuntime(options BusinessUsageRuntimeOptions) (*BusinessUsageRuntime, error)
type BusinessUsageRuntimeOptions ¶ added in v0.23.3
type BusinessUsageRuntimeOptions struct {
DB dal.DB
Query dal.QueryExecutor
Mode contract4paymentus.Mode
CurrentService contract4paymentus.CurrentSpaceServiceReader
InitialStarts contract4paymentus.InitialServiceStartReader
Contacts CurrentProjectContactPort
Actors BusinessActivityActorVerifier
AccessPolicy BusinessProjectAccessPolicy
TaxPolicies []BusinessUsageTaxPolicyRegistration
InvoiceProvider contract4paymentus.UsageInvoiceProvider
Pricing func() contract4paymentus.UsagePricingConfig
Now func() time.Time
// contains filtered or unexported fields
}
BusinessUsageRuntimeOptions binds a complete usage runtime to one fixed provider mode. Every authority and worker created here uses that same mode. The invoice provider is supplied through the published Paymentus contract; callers do not pass provider IDs or tax choices in activity requests.
type BusinessUsageTaxPolicyRegistration ¶ added in v0.23.3
type BusinessUsageTaxPolicyRegistration struct {
Policy contract4paymentus.UsageInvoiceStripeTaxPolicy
Current bool
}
BusinessUsageTaxPolicyRegistration is immutable server configuration. One entry is selected for new periods; non-current entries remain available to validate historical closed periods after a tax policy revision.
type BusinessUsageTestClockRuntime ¶ added in v0.24.0
type BusinessUsageTestClockRuntime struct {
// contains filtered or unexported fields
}
BusinessUsageTestClockRuntime is a Space-scoped TEST harness surface. It deliberately omits the global lifecycle worker and refreshes its provider capability before every exposed operation.
func NewBusinessUsageTestClockRuntime ¶ added in v0.24.0
func NewBusinessUsageTestClockRuntime(options BusinessUsageRuntimeOptions, clock *contract4paymentus.ServiceTestClockCapability, spaceID string) (*BusinessUsageTestClockRuntime, error)
NewBusinessUsageTestClockRuntime composes the normal native runtime with a verified, exact-Space TEST clock. Caller-provided clocks are never accepted.
func (*BusinessUsageTestClockRuntime) CloseDue ¶ added in v0.24.0
func (r *BusinessUsageTestClockRuntime) CloseDue(ctx context.Context, ref contract4paymentus.UsagePeriodRef) (contract4paymentus.UsagePeriodClose, error)
func (*BusinessUsageTestClockRuntime) Drain ¶ added in v0.26.0
func (r *BusinessUsageTestClockRuntime) Drain(ctx context.Context, spaceID string, request QueryActivityDrainRequest) (QueryActivityDrainResult, error)
Drain delivers one bounded page from this Space's native activity outbox. It never invokes the global lifecycle worker or scans another Space.
func (*BusinessUsageTestClockRuntime) IssueContext ¶ added in v0.24.0
func (r *BusinessUsageTestClockRuntime) IssueContext(ctx context.Context, actorID, spaceID, projectID string) (QueryActivityContextResponse, error)
IssueContext and Report are the only activity operations exposed to the harness; the server refreshes the clock before entering existing authority.
func (*BusinessUsageTestClockRuntime) OpenCurrent ¶ added in v0.24.0
func (r *BusinessUsageTestClockRuntime) OpenCurrent(ctx context.Context, spaceID string) (contract4paymentus.UsagePeriodSnapshot, error)
func (*BusinessUsageTestClockRuntime) PrepareInvoice ¶ added in v0.24.0
func (r *BusinessUsageTestClockRuntime) PrepareInvoice(ctx context.Context, ref contract4paymentus.UsagePeriodRef) (contract4paymentus.UsageInvoiceResult, error)
func (*BusinessUsageTestClockRuntime) ProcessInvoice ¶ added in v0.24.0
func (r *BusinessUsageTestClockRuntime) ProcessInvoice(ctx context.Context, ref contract4paymentus.UsagePeriodRef) (contract4paymentus.UsageInvoiceResult, error)
func (*BusinessUsageTestClockRuntime) ReadInvoice ¶ added in v0.24.0
func (r *BusinessUsageTestClockRuntime) ReadInvoice(ctx context.Context, ref contract4paymentus.UsagePeriodRef) (contract4paymentus.UsageInvoiceResult, error)
func (*BusinessUsageTestClockRuntime) ReadPeriod ¶ added in v0.26.0
func (r *BusinessUsageTestClockRuntime) ReadPeriod(ctx context.Context, ref contract4paymentus.UsagePeriodRef) (contract4paymentus.UsagePeriodState, error)
ReadPeriod returns only the native verified ledger state for this exact TEST Space. The period service validates its original anchor and checkpoint in one read-only transaction; it does not reacquire current paid access.
func (*BusinessUsageTestClockRuntime) ReplayPendingInvoicePaid ¶ added in v0.26.0
func (r *BusinessUsageTestClockRuntime) ReplayPendingInvoicePaid(ctx context.Context, spaceID, eventID string, signed *contract4paymentus.ServiceSignedEventService) error
ReplayPendingInvoicePaid retries one previously verified signed invoice event through Paymentus' opaque capability-bound invoice replay. The signed service constructs its native router internally; this wrapper never exposes or mutates that router.
func (*BusinessUsageTestClockRuntime) Report ¶ added in v0.24.0
func (r *BusinessUsageTestClockRuntime) Report(ctx context.Context, actorID, spaceID string, request QueryActivityReport) (QueryActivityReportResult, error)
func (*BusinessUsageTestClockRuntime) UsageInvoiceBuyerLookup ¶ added in v0.26.1
func (r *BusinessUsageTestClockRuntime) UsageInvoiceBuyerLookup() (contract4paymentus.UsageInvoiceBuyerLookup, error)
UsageInvoiceBuyerLookup exposes only the Paymentus read-only actor lookup bound to this runtime's native invoice service and exact TEST capability. It accepts no scope or buyer selectors from callers.
type CallerAdmissionReader ¶ added in v0.6.0
type CallerAdmissionReader interface {
ReadAdmissionForCaller(context.Context, string, string, time.Time) (AdmissionState, error)
}
CallerAdmissionReader lets the host read admission for the authenticated caller and the personal account already proved by PersonalAccountDirectory. The implementation must supply the actual daily count, not a placeholder.
type ConfiguredProLimits ¶ added in v0.5.0
type ConfiguredProLimits struct {
ByPlanID map[string]ProLimitsSnapshot
}
ConfiguredProLimits is a pure, versioned source of complete Pro grants. Production values are supplied by the host's reviewed configuration.
func (ConfiguredProLimits) ResolveProLimits ¶ added in v0.5.0
func (c ConfiguredProLimits) ResolveProLimits(planID string, grants PlanEffectGrants) (ProLimitsSnapshot, error)
type CurrentProjectContactPort ¶ added in v0.12.0
type CurrentProjectContactPort interface {
ReadCurrentProjectContact(context.Context, dal.ReadTransaction, contract4linkage.RelationshipEntityRef) (ProjectContactState, error)
}
type DALProtectedProjectInventory ¶ added in v0.15.0
type DALProtectedProjectInventory struct {
// contains filtered or unexported fields
}
DALProtectedProjectInventory uses collection-group scans but accepts records only under the exact spaces/{id}/ext/datatug/projects and spaces/{id}/ext/datatug/projectAdmissions ancestry. Group scans also find orphan subcollections whose parent Space document was deleted. The scan is intentionally unbounded by Firestore query limits; a hard local ceiling fails closed rather than returning a truncated count.
func NewDALProtectedProjectInventory ¶ added in v0.15.0
func NewDALProtectedProjectInventory(query dal.QueryExecutor) (*DALProtectedProjectInventory, error)
func (*DALProtectedProjectInventory) CompleteProtectedProjectBasis ¶ added in v0.15.0
func (i *DALProtectedProjectInventory) CompleteProtectedProjectBasis(ctx context.Context, mode, product, payer string) (InitialProtectedProjectBasis, error)
type DemoPersonalSpaceProvisioner ¶ added in v0.29.1
type DemoPersonalSpaceProvisioner interface {
EnsurePersonalSpace(context.Context, string) (PersonalAccount, error)
}
DemoPersonalSpaceProvisioner is an owning-Core host port. It resolves or provisions the verified caller's Personal Space before any demo mutation. A browser-provided space ID is only a hint and must equal this proof.
type DetectiveDemoProjectRequest ¶ added in v0.29.1
type DetectivePersonalActivationOptions ¶ added in v0.29.1
type DetectivePersonalActivationOptions struct {
Activator contract4spaceus.TransactionalPersonalCapabilityActivator
}
ConfigureDemoWithActivation lets the owning host enable DataTug on a newly resolved Personal Space inside the same transaction as demo creation. It does not configure any paid project grant.
type DetectiveService ¶ added in v0.29.1
type DetectiveService struct {
// contains filtered or unexported fields
}
func NewDetectiveService ¶ added in v0.29.1
func NewDetectiveService(project *SharedProjectService, executor HostedDetectiveQueryExecutor) (*DetectiveService, error)
func (*DetectiveService) AIConfirm ¶ added in v0.29.1
func (s *DetectiveService) AIConfirm(ctx context.Context, actor string, request HostedAIConfirm) (detectiveai.Receipt, error)
func (*DetectiveService) AIGenerate ¶ added in v0.29.1
func (s *DetectiveService) AIGenerate(ctx context.Context, actor string, request HostedAIGenerate, provider ai.LLMProvider) (detectiveai.Response, error)
func (*DetectiveService) AIProposals ¶ added in v0.29.1
func (s *DetectiveService) AIProposals(ctx context.Context, actor, space, project, after string) (HostedAIPage, error)
func (*DetectiveService) AIReview ¶ added in v0.29.1
func (s *DetectiveService) AIReview(ctx context.Context, actor string, request HostedAIReview) (detectiveai.Proposal, error)
func (*DetectiveService) Action ¶ added in v0.29.1
func (s *DetectiveService) Action(ctx context.Context, actor string, request HostedDetectiveAction) (HostedDetectiveResponse, error)
Action applies one reviewed mutation with current project authorization, optimistic versions, immutable idempotency and metadata-only audit in the same retryable database transaction. Runs use a separate accept/execute/ finalize path so external query execution is never retried by Firestore.
func (*DetectiveService) CaseEvents ¶ added in v0.29.1
func (s *DetectiveService) CaseEvents(ctx context.Context, actor, space, project, caseID string, before int) (detective.CaseEventsPage, error)
CaseEvents pages the append-only event records by ordinal. The Case's timeline is a recent preview only; older history remains direct-readable.
func (*DetectiveService) ConfigureDemo ¶ added in v0.29.1
func (s *DetectiveService) ConfigureDemo(space DemoPersonalSpaceProvisioner, authority SharedProjectCreateAuthority) error
func (*DetectiveService) ConfigureDemoWithActivation ¶ added in v0.29.1
func (s *DetectiveService) ConfigureDemoWithActivation(space DemoPersonalSpaceProvisioner, owner PersonalPlanOwnerPort, activation DetectivePersonalActivationOptions) error
func (*DetectiveService) ConfigureIncidents ¶ added in v0.29.1
func (s *DetectiveService) ConfigureIncidents(store incidents.APIStore, storeID string) error
ConfigureIncidents binds a dedicated Incidentius APIStore. Its durable Create/Append/Projection implementation belongs to the host's Incidentius provider; Detective only owns verified Case linkage and current-policy views.
func (*DetectiveService) ConfigurePaidEnvironments ¶ added in v0.29.1
func (s *DetectiveService) ConfigurePaidEnvironments(provider HostedProjectEnvironmentProvider) error
func (*DetectiveService) CreateOrResumeDemo ¶ added in v0.29.1
func (s *DetectiveService) CreateOrResumeDemo(ctx context.Context, actor string, request DetectiveDemoProjectRequest) (models4datatug.SharedProjectRef, error)
func (*DetectiveService) IncidentAction ¶ added in v0.29.1
func (s *DetectiveService) IncidentAction(ctx context.Context, actor string, request HostedIncidentAction) (HostedIncidentResponse, error)
IncidentAction uses Incidentius's durable mutation ID for a cross-store create; a retry after a crash replays Create, then safely retries the Case linkage. A private Detective operation receipt is committed with the Case.
func (*DetectiveService) KnowledgeAction ¶ added in v0.29.1
func (s *DetectiveService) KnowledgeAction(ctx context.Context, actor string, request HostedKnowledgeAction) (HostedKnowledgeResponse, error)
func (*DetectiveService) KnowledgeProposals ¶ added in v0.29.1
func (s *DetectiveService) KnowledgeProposals(ctx context.Context, actor, space, project, after string) (HostedKnowledgePage, error)
func (*DetectiveService) LinkedIncidents ¶ added in v0.29.1
func (s *DetectiveService) LinkedIncidents(ctx context.Context, actor, space, project, caseID string) (HostedIncidentLinks, error)
LinkedIncidents independently checks current project authorization, Case ownership, and each Incidentius projection before exposing a policy view.
func (*DetectiveService) RunSavedQuery ¶ added in v0.29.1
func (s *DetectiveService) RunSavedQuery(ctx context.Context, actor string, request HostedQueryRunRequest) (HostedQueryRunResponse, error)
type Facade ¶
type Facade struct {
// contains filtered or unexported fields
}
Facade carries the injected database and ports for the DataTug extension's application commands. The host constructs one Facade at composition time (sneat-go/pkg/modules/datatug), wiring a real adapter per port; tests construct it over an in-memory database with fakes.
func NewFacade ¶
func NewFacade(db dal.DB, ids IDGenerator) Facade
NewFacade returns a Facade over the given database and ports.
func (Facade) CreateProject ¶
func (f Facade) CreateProject( ctx context.Context, userID, storeID, title string, ) (projectID string, err error)
CreateProject creates a DataTug project in the cloud store and registers its brief in the user's DataTug index, both in one transaction. It returns the id of the created project.
func (Facade) RegisterGithubProject ¶ added in v0.2.0
func (f Facade) RegisterGithubProject( ctx context.Context, userID string, request RegisterGithubProjectRequest, ) (projectID string, err error)
RegisterGithubProject records a project that lives in a GitHub repository in the user's DataTug index, so it shows up among the user's projects.
The project files themselves are created by the client that holds the user's GitHub credential — this command only keeps the index; the cloud never talks to GitHub. It returns the project id the web client addresses the project by (`repo@org@folder`).
type FirstAdmittedMonthReader ¶ added in v0.4.0
type FirstAdmittedMonthReader interface {
ReadFirstAdmittedMonth(context.Context, string, string, string) (string, error)
}
FirstAdmittedMonthReader reads the same immutable, server-only first-admission marker used by the AI meter. Empty means no question has been admitted yet. It is keyed by product and caller, with the proved personal account included so the host can reject a mismatched binding.
type GitHubActivityScope ¶ added in v0.25.0
type GitHubCreateRepository ¶ added in v0.14.0
type GitHubCreateRepository interface {
Scope() GitHubCreateRepositoryScope
CurrentHead(context.Context, string) (string, error)
EnsureFolderEmpty(context.Context, string, string) error
CreateFilesCommit(context.Context, string, string, string, map[string][]byte) (string, error)
FindCommitByMarker(context.Context, string, string, string, map[string][]byte) (string, error)
}
GitHubCreateRepository is implemented by a per-request, actor-bound adapter around githubauth4datatug.AuthorizedGitHubRepository. Its methods never expose OAuth or installation tokens to this module or to a caller.
type GitHubCreateRepositoryScope ¶ added in v0.14.0
type GitHubProjectAccess ¶ added in v0.14.0
type GitHubProjectAccess struct {
SpaceID string
Binding models4datatug.GitHubProjectBinding
// ActivityScope is present only for a validated registered Business v2
// admission. It is a client-side selector, not an authorization grant.
ActivityScope *GitHubActivityScope `json:"-"`
}
type GitHubProjectCreateCommand ¶ added in v0.14.0
type GitHubProjectCreateCommand struct {
ActorID, SpaceID, OperationID, Title string
BillingIntent SharedProjectBillingIntent
Source models4datatug.GitHubCreateSource
}
func (GitHubProjectCreateCommand) Validate ¶ added in v0.14.0
func (c GitHubProjectCreateCommand) Validate() error
type GitHubProjectCreateResult ¶ added in v0.14.0
type GitHubProjectCreateResult struct {
ID string `json:"id"`
Storage string `json:"storage"`
Project string `json:"project"`
SpaceID string `json:"spaceID"`
Branch string `json:"branch"`
BranchHead string `json:"branchHead"`
Revision string `json:"revision"`
TemplateID string `json:"templateID"`
TemplateCommit string `json:"templateCommit"`
}
type GitHubQueryExpectedFile ¶ added in v0.14.0
type GitHubQueryFileChange ¶ added in v0.14.0
type GitHubQueryRepository ¶ added in v0.14.0
type GitHubQueryRepository interface {
Scope() GitHubCreateRepositoryScope
PrepareQuerySave(context.Context, string, string, string, dto.SaveQueryRequest) (*GitHubQuerySavePlan, error)
CurrentHead(context.Context, string) (string, error)
CreateQueryCommit(context.Context, string, string, string, *GitHubQuerySavePlan) (string, error)
FindQueryCommit(context.Context, string, string, string, *GitHubQuerySavePlan) (string, error)
}
type GitHubQuerySavePlan ¶ added in v0.14.0
type GitHubQuerySavePlan struct {
Changes []GitHubQueryFileChange
ExpectedTree map[string]GitHubQueryExpectedFile
Response dto.SaveQueryResponse
BodyChanged bool
}
type HostedAIConfirm ¶ added in v0.29.1
type HostedAIConfirm struct {
HostedAIProjectRef
detectiveai.ConfirmRequest
}
type HostedAIGenerate ¶ added in v0.29.1
type HostedAIGenerate struct {
HostedAIProjectRef
OperationID string `json:"operationId"`
Text string `json:"text"`
CaseID string `json:"caseId,omitempty"`
ExpectedCounts map[string]int `json:"expectedCounts,omitempty"`
Sources []detectiveai.Source `json:"sources,omitempty"`
}
type HostedAIPage ¶ added in v0.29.1
type HostedAIPage struct {
Proposals []detectiveai.Proposal `json:"proposals"`
HasMore bool `json:"hasMore"`
NextCursor string `json:"nextCursor,omitempty"`
}
type HostedAIProjectRef ¶ added in v0.29.1
type HostedAIReview ¶ added in v0.29.1
type HostedAIReview struct {
HostedAIProjectRef
Type string `json:"type"`
Draft *detectiveai.ReviewedDraftRequest `json:"draft,omitempty"`
Context *detectiveai.ContextReviewRequest `json:"context,omitempty"`
}
type HostedDemoExecutor ¶ added in v0.29.1
type HostedDemoExecutor struct {
Embedded *HostedEmbeddedDemoExecutor
Public *HostedOVDBExecutor
}
HostedDemoExecutor dispatches only the two operator-owned origins. The saved query's own federation URL can select a pinned adapter but cannot create a new network destination.
func (*HostedDemoExecutor) ExecuteSavedQuery ¶ added in v0.29.1
func (e *HostedDemoExecutor) ExecuteSavedQuery(ctx context.Context, request HostedSavedQueryExecution) (HostedSavedQueryResult, error)
type HostedDetectiveAction ¶ added in v0.29.1
type HostedDetectiveAction struct {
Storage string `json:"storage"`
SpaceID string `json:"spaceID"`
OperationID string `json:"operationId"`
IfMatch int64 `json:"ifMatch,omitempty"`
detective.ActionRequest
// contains filtered or unexported fields
}
HostedDetectiveAction is the cloud envelope around Core's shared action contract. The actor is always supplied by verified HTTP identity, never here.
type HostedDetectiveQueryExecutor ¶ added in v0.29.1
type HostedDetectiveQueryExecutor interface {
ExecuteSavedQuery(context.Context, HostedSavedQueryExecution) (HostedSavedQueryResult, error)
}
The host supplies an admitted read-only execution adapter. This service resolves the saved query and revision in the authorized project before the adapter sees it; the adapter must enforce its own source and row limits.
type HostedDetectiveResponse ¶ added in v0.29.1
type HostedDetectiveResponse struct {
detective.ActionResponse
Revision int64 `json:"revision,omitempty"`
Receipt string `json:"receipt,omitempty"`
CaseLinkStatus string `json:"caseLinkStatus,omitempty"`
}
type HostedEmbeddedDemoExecutor ¶ added in v0.29.1
type HostedEmbeddedDemoExecutor struct {
*HostedOVDBExecutor
// contains filtered or unexported fields
}
HostedEmbeddedDemoExecutor runs admitted DTQL against two immutable, synthetic SQLite snapshots through OpenVaultDB's actual mount and HTTP query handler. Its transport never dials: requests are dispatched to a private in-process read-only handler. The operator owns this instance and closes it at shutdown.
func NewHostedEmbeddedDemoExecutor ¶ added in v0.29.1
func NewHostedEmbeddedDemoExecutor(now func() time.Time) (_ *HostedEmbeddedDemoExecutor, err error)
func (*HostedEmbeddedDemoExecutor) Close ¶ added in v0.29.1
func (d *HostedEmbeddedDemoExecutor) Close() error
type HostedIncidentAction ¶ added in v0.29.1
type HostedIncidentAction struct {
Storage string `json:"storage"`
SpaceID string `json:"spaceID"`
Project string `json:"project"`
OperationID string `json:"operationId"`
IfMatch int64 `json:"ifMatch,omitempty"`
Type string `json:"type"` // create | link | start-case
CaseID string `json:"caseId,omitempty"`
IncidentRef string `json:"incidentRef,omitempty"`
Environment string `json:"environment"`
Title string `json:"title,omitempty"`
Description string `json:"description,omitempty"`
Case *detective.Case `json:"case,omitempty"`
}
type HostedIncidentLinks ¶ added in v0.29.1
type HostedIncidentLinks struct {
CaseID string `json:"caseId"`
Incidents []incidents.IncidentView `json:"incidents"`
}
type HostedIncidentResponse ¶ added in v0.29.1
type HostedIncidentResponse struct {
Incident incidents.IncidentView `json:"incident"`
Case *detective.Case `json:"case,omitempty"`
Receipt string `json:"receipt"`
CaseLinkStatus string `json:"caseLinkStatus,omitempty"` // linked | already-linked | link-pending
LinkPendingReason string `json:"linkPendingReason,omitempty"`
}
type HostedIncidentStore ¶ added in v0.29.1
type HostedIncidentStore struct {
// contains filtered or unexported fields
}
HostedIncidentStore is the Firestore Incidentius provider. Each operation requires a private scope inserted by the authenticated Detective facade and rechecks the current project grant inside its own transaction. A single storeID is safe because all records are under the Space/project namespace.
func NewHostedIncidentStore ¶ added in v0.29.1
func NewHostedIncidentStore(project *SharedProjectService, storeID string) (*HostedIncidentStore, error)
func (*HostedIncidentStore) Append ¶ added in v0.29.1
func (s *HostedIncidentStore) Append(ctx context.Context, mutation incidents.Mutation) (incidents.AppendResult, error)
Append folds the entire bounded event stream with Core before committing the new event, projection, and immutable mutation receipt in one transaction.
func (*HostedIncidentStore) Create ¶ added in v0.29.1
func (s *HostedIncidentStore) Create(ctx context.Context, mutation incidents.CreateMutation) (incidents.CreateResult, error)
func (*HostedIncidentStore) Events ¶ added in v0.29.1
func (s *HostedIncidentStore) Events(ctx context.Context, ref incidents.IncidentRef, afterSeq uint64) ([]incidents.Event, error)
func (*HostedIncidentStore) List ¶ added in v0.29.1
func (s *HostedIncidentStore) List(ctx context.Context, query incidents.CandidateListQuery) ([]incidents.Incident, error)
func (*HostedIncidentStore) Merge ¶ added in v0.29.1
func (*HostedIncidentStore) Merge(context.Context, incidents.MergeMutation) (incidents.MergeResult, error)
Merge is outside the project-scoped hosted Detective admission: importing an entire second incident requires a dedicated cross-resource visibility and receipt protocol. A caller gets an explicit capability error.
func (*HostedIncidentStore) Projection ¶ added in v0.29.1
func (s *HostedIncidentStore) Projection(ctx context.Context, ref incidents.IncidentRef, at *time.Time) (incidents.Incident, error)
func (*HostedIncidentStore) Watch ¶ added in v0.29.1
func (s *HostedIncidentStore) Watch(ctx context.Context, query incidents.WatchQuery) (incidents.EventStream, error)
type HostedKnowledgeAction ¶ added in v0.29.1
type HostedKnowledgeAction struct {
Storage string `json:"storage"`
SpaceID string `json:"spaceID"`
Project string `json:"project"`
OperationID string `json:"operationId"`
IfMatch int64 `json:"ifMatch,omitempty"`
Type string `json:"type"` // save-draft | review | reject | export
Proposal *HostedKnowledgeProposal `json:"proposal,omitempty"`
ProposalID string `json:"proposalId,omitempty"`
ReviewNote string `json:"reviewNote,omitempty"`
Target *HostedKnowledgeTarget `json:"target,omitempty"`
}
type HostedKnowledgeHandoff ¶ added in v0.29.1
type HostedKnowledgeHandoff struct {
Kind string `json:"kind"`
Status string `json:"status"` // ready-for-target-review
Target HostedKnowledgeTarget `json:"target"`
ProposalID string `json:"proposalId"`
ProposalVersion int64 `json:"proposalVersion"`
CaseID string `json:"caseId"`
ClaimStatus string `json:"claimStatus"`
Statement string `json:"statement"`
EvidenceRefs []string `json:"evidenceRefs"`
FindingRefs []string `json:"findingRefs,omitempty"`
PreparedAt time.Time `json:"preparedAt"`
PreparedBy string `json:"preparedBy"`
Receipt string `json:"receipt"`
}
type HostedKnowledgePage ¶ added in v0.29.1
type HostedKnowledgePage struct {
Proposals []HostedKnowledgeProposal `json:"proposals"`
NextCursor string `json:"nextCursor,omitempty"`
HasMore bool `json:"hasMore"`
}
type HostedKnowledgeProposal ¶ added in v0.29.1
type HostedKnowledgeProposal struct {
ID string `json:"id"`
CaseID string `json:"caseId"`
Kind string `json:"kind"` // field-meaning | relationship | invariant | query | scenario
Title string `json:"title"`
Statement string `json:"statement"`
EvidenceRefs []string `json:"evidenceRefs"`
FindingRefs []string `json:"findingRefs,omitempty"`
ClaimStatus string `json:"claimStatus"` // hypothesis | confirmed
Status string `json:"status"` // draft | reviewed | rejected
Version int64 `json:"version"`
CreatedAt time.Time `json:"createdAt"`
CreatedBy string `json:"createdBy"`
ReviewedAt time.Time `json:"reviewedAt,omitempty"`
ReviewedBy string `json:"reviewedBy,omitempty"`
ReviewNote string `json:"reviewNote,omitempty"`
Handoffs []HostedKnowledgeHandoff `json:"handoffs,omitempty"`
}
HostedKnowledgeProposal is a private, reviewable discovery. An exported proposal is a typed portable record; no route writes it to a public MeaningGraph or ModelSpec registry without that registry's own authority.
type HostedKnowledgeResponse ¶ added in v0.29.1
type HostedKnowledgeResponse struct {
Proposal *HostedKnowledgeProposal `json:"proposal,omitempty"`
Export *HostedKnowledgeHandoff `json:"export,omitempty"`
Receipt string `json:"receipt"`
}
type HostedKnowledgeTarget ¶ added in v0.29.1
type HostedKnowledgeTarget struct {
System string `json:"system"` // meaninggraph | modelspec
Repository string `json:"repository"`
ResourceID string `json:"resourceId"`
ExpectedRevision string `json:"expectedRevision"`
}
A handoff identifies a specific external resource and the revision the reviewer expects to change. It is a private portable record, not a write to MeaningGraph or ModelSpec and not a claim that either accepted the proposal.
type HostedOVDBExecutor ¶ added in v0.29.1
type HostedOVDBExecutor struct {
Origin string
AllowedSources map[string]map[string]bool
Client *http.Client
Now func() time.Time
}
HostedOVDBExecutor executes admitted, saved DTQL against one operator-pinned OVDB origin. AllowedSources is an operator-owned database/collection map; query federation metadata cannot expand it. A production host must provide the public origin and source list it has actually published.
func (*HostedOVDBExecutor) ExecuteSavedQuery ¶ added in v0.29.1
func (e *HostedOVDBExecutor) ExecuteSavedQuery(ctx context.Context, request HostedSavedQueryExecution) (HostedSavedQueryResult, error)
type HostedProjectEnvironmentBinding ¶ added in v0.29.1
type HostedProjectEnvironmentBinding struct {
SpaceID string
ProjectID string
Name string
Sources []HostedProjectSourceBinding
}
type HostedProjectEnvironmentProvider ¶ added in v0.29.1
type HostedProjectEnvironmentProvider interface {
ReadProjectEnvironments(context.Context, dal.ReadTransaction, string, string) ([]HostedProjectEnvironmentBinding, error)
}
type HostedProjectSourceBinding ¶ added in v0.29.1
The owning host supplies admitted logical environments and physical source mappings for paid Space projects. A missing, foreign, or ambiguous mapping never becomes a runnable environment. The executor separately enforces its operator-owned origin and collection allowlist.
type HostedQueryRunRequest ¶ added in v0.29.1
type HostedQueryRunRequest struct {
Storage string `json:"storage"`
SpaceID string `json:"spaceID"`
Project string `json:"project"`
OperationID string `json:"operationId"`
QueryID string `json:"queryId"`
Environment string `json:"environment"`
Inputs map[string]apicontract.TypedValueOrSet `json:"inputs,omitempty"`
}
type HostedQueryRunResponse ¶ added in v0.29.1
type HostedQueryRunResponse struct {
Result apicontract.Result `json:"result"`
QueryRevision string `json:"queryRevision"`
ResultFingerprint string `json:"resultFingerprint"`
Receipt string `json:"receipt"`
}
type HostedSavedQueryExecution ¶ added in v0.29.1
type HostedSavedQueryExecution struct {
ActorID, SpaceID, ProjectID, QueryID, Revision, Environment string
QueryJSON []byte
Inputs map[string]apicontract.TypedValueOrSet
}
type HostedSavedQueryResult ¶ added in v0.29.1
type HostedSessionDetectiveOptions ¶ added in v0.30.0
type HostedSessionDetectiveOptions struct {
Mounted sessioncontext.MountedDatabase
Detective *DetectiveService
ActiveAccount func(context.Context, string) error
AuthorizeContent func(context.Context, string, SessionOperationScope, *sessioncontext.Scope) error
Enabled bool
}
HostedSessionDetectiveOptions is supplied by trusted composition only. Enabled remains false until local and hosted execution/recovery are proved.
type HostedSessionDetectiveService ¶ added in v0.30.0
type HostedSessionDetectiveService struct {
// contains filtered or unexported fields
}
func NewHostedSessionDetectiveService ¶ added in v0.30.0
func NewHostedSessionDetectiveService(options HostedSessionDetectiveOptions) (*HostedSessionDetectiveService, error)
func (*HostedSessionDetectiveService) Dispatch ¶ added in v0.30.0
func (s *HostedSessionDetectiveService) Dispatch(ctx context.Context, actor string, scope SessionOperationScope, request SessionDetectiveRequest) (SessionDetectiveStatus, error)
func (*HostedSessionDetectiveService) Enabled ¶ added in v0.30.0
func (s *HostedSessionDetectiveService) Enabled() bool
func (*HostedSessionDetectiveService) ProviderAvailable ¶ added in v0.30.0
func (s *HostedSessionDetectiveService) ProviderAvailable() bool
func (*HostedSessionDetectiveService) RedactAcceptedPins ¶ added in v0.30.0
func (s *HostedSessionDetectiveService) RedactAcceptedPins(ctx context.Context, actor string, scope SessionOperationScope, operation, deleteOperation, cursor string, limit int) (string, error)
RedactAcceptedPins is a bounded trusted deletion worker operation. It resumes with Core's opaque cursor and never deletes separately owned Case evidence or produced native result receipts. A first page still requires content-delete authorization; active account ownership alone cannot initiate deletion.
func (*HostedSessionDetectiveService) RequireActiveAccount ¶ added in v0.30.0
func (s *HostedSessionDetectiveService) RequireActiveAccount(ctx context.Context, actor string) error
func (*HostedSessionDetectiveService) Status ¶ added in v0.30.0
func (s *HostedSessionDetectiveService) Status(ctx context.Context, actor string, scope SessionOperationScope, op string, reconcile bool) (SessionDetectiveStatus, error)
type IDGenerator ¶
type IDGenerator interface {
// NewID returns the id of a new record.
NewID(ctx context.Context) (string, error)
}
IDGenerator is a PORT: extension implementation packages stay outside this module. Published contracts and their DTO aliases may be reused; behavior crosses a small interface defined here and is satisfied by an adapter in the host composition root (sneat-go/pkg/modules/datatug/adapters.go). Domain tests fake the port — see facade_test.go's fakeIDGenerator.
type InitialProtectedProjectBasis ¶ added in v0.11.0
InitialProtectedProjectBasis must be issued by a trusted complete-inventory verifier. It includes existing allocations across ALL Spaces for this payer. It must also independently bind actor to the verified context and may only read. No runtime reset or missing-record zero inference is provided. An imported count requires the verifier to prove matching immutable allocation records.
type NativeBusinessActivityBindingReader ¶ added in v0.23.0
type NativeBusinessActivityBindingReader struct {
// contains filtered or unexported fields
}
NativeBusinessActivityBindingReader composes DataTug project authorization with Paymentus' current paid-service and immutable original-start readers. Every authority read is confined to the caller's transaction.
func NewNativeBusinessActivityBindingReader ¶ added in v0.23.0
func NewNativeBusinessActivityBindingReader(options BusinessActivityBindingReaderOptions) (*NativeBusinessActivityBindingReader, error)
func (*NativeBusinessActivityBindingReader) ReadCurrentBusinessActivityBinding ¶ added in v0.23.0
func (r *NativeBusinessActivityBindingReader) ReadCurrentBusinessActivityBinding( ctx context.Context, tx dal.ReadTransaction, actorID, spaceID, projectID string, at time.Time, ) (BusinessActivityBinding, error)
type NativeBusinessUsageCloseTermsReader ¶ added in v0.23.1
type NativeBusinessUsageCloseTermsReader struct {
// contains filtered or unexported fields
}
NativeBusinessUsageCloseTermsReader composes the existing native paid-lot reader with the immutable Business anchor and exact open usage period. Empty paid-capacity basis is the only supported close today; it does not choose an unapproved lot-window rule.
func NewNativeBusinessUsageCloseTermsReader ¶ added in v0.23.1
func NewNativeBusinessUsageCloseTermsReader(mode contract4paymentus.Mode, db dal.DB, initialStarts contract4paymentus.InitialServiceStartReader, periods contract4paymentus.UsagePeriodReader) (*NativeBusinessUsageCloseTermsReader, error)
func (*NativeBusinessUsageCloseTermsReader) ReadBusinessUsageCloseTerms ¶ added in v0.23.1
func (r *NativeBusinessUsageCloseTermsReader) ReadBusinessUsageCloseTerms(ctx context.Context, tx dal.ReadTransaction, period contract4paymentus.UsagePeriodSnapshot) (BusinessUsageCloseTerms, error)
type NativeBusinessUsagePeriodAuthority ¶ added in v0.23.1
type NativeBusinessUsagePeriodAuthority struct {
// contains filtered or unexported fields
}
NativeBusinessUsagePeriodAuthority combines current paid access for Open, the immutable original start for both Open and historical Close, and the accepted-receipt completeness checkpoint. It never grants new query access.
func NewNativeBusinessUsagePeriodAuthority ¶ added in v0.23.1
func NewNativeBusinessUsagePeriodAuthority(options BusinessUsagePeriodAuthorityOptions) (*NativeBusinessUsagePeriodAuthority, error)
func (*NativeBusinessUsagePeriodAuthority) VerifyUsage ¶ added in v0.23.1
func (a *NativeBusinessUsagePeriodAuthority) VerifyUsage(ctx context.Context, tx dal.ReadTransaction, operation contract4paymentus.UsageOperation) error
type NativeProjectContactRoleTarget ¶ added in v0.26.0
type NativeProjectContactRoleTarget struct {
// contains filtered or unexported fields
}
NativeProjectContactRoleTarget validates additions against the current full Contactus record. Stale assignments may only be removed as a strict subset; the linkage policy separately verifies both reciprocal records in its caller transaction before calling this port.
func NewNativeProjectContactRoleTarget ¶ added in v0.26.0
func NewNativeProjectContactRoleTarget(contacts CurrentProjectContactPort, actors BusinessActivityActorVerifier) (*NativeProjectContactRoleTarget, error)
func (*NativeProjectContactRoleTarget) AuthorizeProjectContactRoleChange ¶ added in v0.26.0
func (a *NativeProjectContactRoleTarget) AuthorizeProjectContactRoleChange(ctx context.Context, tx dal.ReadTransaction, request ProjectRoleMutationAuthorization, change ProjectContactRoleChange) error
type NativeProjectRoleManager ¶ added in v0.26.0
type NativeProjectRoleManager struct {
// contains filtered or unexported fields
}
NativeProjectRoleManager authorizes project assignment changes from the current versioned role catalog and a server-verified actor identity.
func NewNativeProjectRoleManager ¶ added in v0.26.0
func NewNativeProjectRoleManager(actors BusinessActivityActorVerifier) (*NativeProjectRoleManager, error)
func (*NativeProjectRoleManager) AuthorizeProjectRoleMutation ¶ added in v0.26.0
func (a *NativeProjectRoleManager) AuthorizeProjectRoleMutation(ctx context.Context, tx dal.ReadTransaction, request ProjectRoleMutationAuthorization) error
type PaidMonthAllocator ¶ added in v0.5.0
type PaidMonthAllocator interface {
AllocatePaidMonths(PlanPayment, string) (map[string]int64, error)
}
PaidMonthAllocator is a narrow host translation to core's existing AllocatePaidMonths. The writer owns deduplication and aggregation.
type PaidProjectLinkageOptions ¶ added in v0.12.0
type PaidProjectLinkageOptions struct {
Paid PaidSharedProjectOptions
Business *BusinessProjectAccessVerifier
Roles ProjectRoleCatalog
Contacts CurrentProjectContactPort
Manager ProjectRoleManagerPort
Targets ProjectContactRoleTargetPort
Now func() time.Time
}
type PaidProjectLinkagePolicy ¶ added in v0.12.0
type PaidProjectLinkagePolicy struct {
// contains filtered or unexported fields
}
PaidProjectLinkagePolicy is the DataTug implementation of Core's generic transaction policy. Host activation MUST declare datatug/projects protected before binding generic routes or creating records, then bind this policy for BOTH linkage directions. A UI role list never supplies authority.
func NewPaidProjectLinkagePolicy ¶ added in v0.12.0
func NewPaidProjectLinkagePolicy(o PaidProjectLinkageOptions) (*PaidProjectLinkagePolicy, error)
func (*PaidProjectLinkagePolicy) AuthorizeRelationshipMutation ¶ added in v0.12.0
func (p *PaidProjectLinkagePolicy) AuthorizeRelationshipMutation(ctx context.Context, tx dal.ReadTransaction, b contract4linkage.RelationshipMutationBatch) error
type PaidProjectOwnerLinksOptions ¶ added in v0.12.0
type PaidProjectOwnerLinksOptions struct {
Roles ProjectRoleCatalog
Owner ProjectOwnerContactPort
Contacts CurrentProjectContactPort
}
type PaidSharedProjectOptions ¶ added in v0.11.0
type PaidSharedProjectOptions struct {
PaidSharedProjectOptions are reviewed server configuration, never request fields. This slice supports current personal Pro only. Business grant/AI policy is not inferred from missing limits or historical tier fixtures. Product mutation is LIVE-only: TEST checkout projections never create real shared projects. Future TEST product isolation needs a separate ref namespace.
type PersonalAccount ¶ added in v0.4.0
type PersonalAccount struct{ ID, Title string }
PersonalAccount is an ownership assertion made by the host directory.
func ResolvePersonalPayer ¶ added in v0.4.0
func ResolvePersonalPayer(ctx context.Context, callerID, accountHint string, directory PersonalAccountDirectory) (PersonalAccount, error)
PersonalPayer is shared by plan reads and the later AI adapter. A foreign account hint is refused before any plan or usage read for that hint.
type PersonalAccountDirectory ¶ added in v0.4.0
type PersonalAccountDirectory interface {
PersonalAccount(context.Context, string) (PersonalAccount, error)
}
PersonalAccountDirectory must prove ownership and provision the personal account through the host. This domain never infers an account from a user ID.
type PersonalPlanOwnerPort ¶ added in v0.5.0
type PersonalPlanService ¶ added in v0.4.0
type PersonalPlanService struct {
Directory PersonalAccountDirectory
Plans PlanReader
Usage UsageReader
Admission AdmissionReader
// CallerAdmission takes precedence when bound. Admission remains supported
// for existing consumers; a new host must bind this caller-aware port.
CallerAdmission CallerAdmissionReader
Config PlanConfigReader
Clock PlanClock
FirstMonth FirstAdmittedMonthReader
}
PersonalPlanService composes ports without depending on transport or store.
func (PersonalPlanService) Read ¶ added in v0.4.0
func (s PersonalPlanService) Read(ctx context.Context, callerID, accountHint, _ string) (PlanResponse, error)
type PlanAI ¶ added in v0.4.0
type PlanAI struct {
Unit string `json:"unit"`
Enforced bool `json:"enforced"`
PeriodID string `json:"periodId"`
Used int64 `json:"used"`
Limit int64 `json:"limit"`
Left int64 `json:"left"`
ResetsAt time.Time `json:"resetsAt"`
Today PlanToday `json:"today"`
Blocked *string `json:"blocked"`
Models []PlanModel `json:"models"`
}
type PlanAccount ¶ added in v0.4.0
type PlanApplyOutcome ¶ added in v0.5.0
type PlanApplyOutcome string
const ( PlanApplied PlanApplyOutcome = "applied" PlanIdempotent PlanApplyOutcome = "idempotent" PlanObsolete PlanApplyOutcome = "obsolete" )
type PlanConfig ¶ added in v0.4.0
type PlanConfig struct {
FreeFirstMonthLimits models4datatug.PlanLimits
FreeLaterMonthLimits models4datatug.PlanLimits
ProLimits models4datatug.PlanLimits
FreeModels []PlanModel
ProModels []PlanModel
DailyLimit int64
// Zero grace stops paid access exactly at PaidUntil. Positive values are
// explicit legacy policy; do not configure them for strict paid-through plans.
ActiveGrace time.Duration
PastDueGrace time.Duration
Enforced bool
UpgradeURL string
ManageURL string
SupportEmail string
}
PlanConfig is supplied by the host, rather than encoded in plan policy. The two Free grants differ by the month of the first admitted question, which is independently read from the meter's server-only marker.
type PlanConfigReader ¶ added in v0.4.0
type PlanConfigReader interface {
ReadPlanConfig(context.Context, string, time.Time) (PlanConfig, error)
}
PlanConfigReader receives the proved account and the one UTC instant sampled for this response; settings can change at runtime without implicit context.
type PlanEffectAuthority ¶ added in v0.5.0
type PlanEffectAuthority string
const ( PlanEffectCurrent PlanEffectAuthority = "current" PlanEffectObsolete PlanEffectAuthority = "obsolete" PlanEffectUnproved PlanEffectAuthority = "unproved" )
type PlanEffectGrants ¶ added in v0.5.0
type PlanEffectGrants struct {
Contributors, ProjectContributors, AIQuestions int64
AIPaysFor string
ProtectedProjects *int64 `json:"protectedProjects,omitempty"`
ProtectedProjectUsers *int64 `json:"protectedProjectUsers,omitempty"`
}
PlanEffectGrants mirrors the values frozen by the payment effect. The protected pair is optional only for accepted legacy effects; complete Pro limits still require a separately versioned server configuration.
type PlanEffectOwnerPort ¶ added in v0.5.0
type PlanEffectOwnerPort interface {
ReadOwner(context.Context, dal.ReadTransaction, string, string, string) (PlanOwnerFence, error)
ReadMoneyFence(context.Context, dal.ReadTransaction, string, string, string) (PlanMoneyFence, error)
ClassifyEffect(context.Context, dal.ReadTransaction, PlanOwnerFence) (PlanEffectAuthority, error)
VerifyCurrentEffect(context.Context, dal.ReadTransaction, AccountPlanEffect) error
ReconcileMoney(context.Context, dal.ReadwriteTransaction, AccountPlanEffect) error
}
PlanEffectOwnerPort is bound to paymentus's transaction-aware owner reader. Every method receives the same DAL transaction as the product writer.
type PlanFacts ¶ added in v0.4.0
type PlanFacts struct {
AccountKind string `json:"accountKind"`
Tier string `json:"tier"`
Period string `json:"period"`
ProviderStatus string `json:"providerStatus"`
PaidUntil *time.Time `json:"paidUntil,omitempty"`
EndsAt *time.Time `json:"endsAt,omitempty"`
LastInvoiceRefundedInFull bool `json:"lastInvoiceRefundedInFull"`
TerminalFullRefund bool `json:"terminalFullRefund,omitempty"`
RefundedAt *time.Time `json:"refundedAt,omitempty"`
FirstPaidAt *time.Time `json:"firstPaidAt,omitempty"`
Founding bool `json:"founding"`
Grants *models4datatug.PlanLimits `json:"grants,omitempty"`
}
PlanFacts are plain, provider-independent inputs to the plan-state mapping.
type PlanMoneyFence ¶ added in v0.5.0
type PlanOwnerFence ¶ added in v0.5.0
type PlanOwnerFence struct {
Mode, Family, AccountID, OwnerSubscriptionID string
OwnerGeneration, SubscriptionRevision int64
}
PlanOwnerFence is copied from the private payment owner tuple by the host.
type PlanPayment ¶ added in v0.5.0
type PlanPayment struct {
Mode, Provider, InvoiceID, PaymentID, SubscriptionID, AccountID string
Currency string
ReceivedCents int64
CashConfirmed, RefundsKnown, DisputeResolved bool
Lines []PlanPaymentLine
Refunds []PlanRefund
}
type PlanPaymentLine ¶ added in v0.5.0
type PlanReader ¶ added in v0.4.0
type PlanReader interface {
ReadCurrentPlan(context.Context, string) (*models4datatug.PlanRecord, error)
}
PlanReader reads only plan/current; an unreadable record falls toward Free.
type PlanRefund ¶ added in v0.5.0
type PlanResponse ¶ added in v0.4.0
type PlanResponse struct {
V int `json:"v"`
Payer string `json:"payer"`
AccountID string `json:"accountId"`
AccountTitle string `json:"accountTitle"`
Role string `json:"role"`
Plan string `json:"plan"`
EffectivePlan string `json:"effectivePlan"`
Status string `json:"status"`
Period string `json:"period"`
PaidUntil *time.Time `json:"paidUntil,omitempty"`
Founding bool `json:"founding"`
Limits models4datatug.PlanLimits `json:"limits"`
AI PlanAI `json:"ai"`
OwnKeyWorks bool `json:"ownKeyWorks"`
CanUpgrade bool `json:"canUpgrade"`
UpgradeURL string `json:"upgradeUrl"`
ManageURL string `json:"manageUrl,omitempty"`
SupportEmail string `json:"supportEmail,omitempty"`
Accounts []PlanAccount `json:"accounts"`
}
type PlanStateResult ¶ added in v0.4.0
type PlanStateResult struct {
Outcome string `json:"outcome"`
Reason string `json:"reason,omitempty"`
Record *models4datatug.PlanRecord `json:"record,omitempty"`
}
PlanStateResult names a write, leave, or refusal. The writer retains the previous aiExtraQuestions and stamps updatedAt outside this pure function.
func PlanStateFor ¶ added in v0.4.0
func PlanStateFor(f PlanFacts) PlanStateResult
PlanStateFor follows the ordered precedence of the version-1 state table. This slice grants paid access only to personal Pro; ended states remain mappable even when a provider reports a now-unsupported tier.
type PreparedSharedProjectCreate ¶ added in v0.10.0
type PreparedSharedProjectCreate struct {
}
PreparedSharedProjectCreate is server-to-server only. Its validator privately owns the opaque Core reservation; that reservation never enters this DTO or a public response. The domain checks Binding and captures its validation clock AFTER preparation, before entering any retryable callback.
type ProBusinessSharedProjectOptions ¶ added in v0.21.0
type ProBusinessSharedProjectOptions struct {
}
ProBusinessSharedProjectOptions configures both plans on one route service. Billing intent selects only which authority to prove; it never grants one.
type ProLimitsResolver ¶ added in v0.5.0
type ProLimitsResolver interface {
ResolveProLimits(string, PlanEffectGrants) (ProLimitsSnapshot, error)
}
type ProLimitsSnapshot ¶ added in v0.5.0
type ProLimitsSnapshot struct {
Version string
ProjectGuestsKnown bool
Limits models4datatug.PlanLimits
}
type ProjectAIEligibility ¶ added in v0.16.0
type ProjectAIEligibility struct {
AIAllowed bool `json:"aiAllowed"`
Reason string `json:"reason,omitempty"`
}
ProjectAIEligibility is a minimal, server-computed projection. Actor membership and sponsor entitlement are proved separately before it is returned; no payer or subscription identifiers leave this package.
type ProjectContactRoleChange ¶ added in v0.12.0
type ProjectContactRoleChange struct {
Contact ProjectContactState
Before, Proposed []string
}
type ProjectContactRoleTargetPort ¶ added in v0.12.0
type ProjectContactRoleTargetPort interface {
AuthorizeProjectContactRoleChange(context.Context, dal.ReadTransaction, ProjectRoleMutationAuthorization, ProjectContactRoleChange) error
}
Target authority decides eligibility of adds/removals, including deliberate stale-contact cleanup; counting a stale link does not approve assigning one.
type ProjectContactState ¶ added in v0.12.0
type ProjectContactState struct {
Ref contract4linkage.RelationshipEntityRef
Exists, Active bool
UserID string
}
ProjectContactState comes from the current full contact record in the supplied transaction, never a cached active-contact brief. Missing/inactive contacts still count while linked. UserID is used for authentication only. Being a Space member is not a requirement for an assigned project contact.
type ProjectOwnerContactPort ¶ added in v0.12.0
type ProjectOwnerContactPort interface {
ResolveProjectOwnerContact(context.Context, dal.ReadTransaction, SharedProjectCreateBinding) (contract4linkage.RelationshipEntityRef, error)
}
This port resolves an EXISTING contact in the original create transaction. It must independently bind the actor to the verified context, without writes, nested transactions, new contacts or automatic Space membership. The domain rechecks current status/UID and constructs only reciprocal linkage writes.
type ProjectRoleCatalog ¶ added in v0.12.0
ProjectRoleCatalog is server configuration. This list approves role IDs only; it grants no operations or authority. The host's current role/permission ports separately authorize the operation. No public request may supply the list.
type ProjectRoleEvidence ¶ added in v0.12.0
type ProjectRoleEvidence struct {
Contact ProjectContactState
Roles []string
}
type ProjectRoleManagerPort ¶ added in v0.12.0
type ProjectRoleManagerPort interface {
AuthorizeProjectRoleMutation(context.Context, dal.ReadTransaction, ProjectRoleMutationAuthorization) error
}
Manager authority must independently bind ActorID to the authenticated context and authorize with CURRENT project roles and platform guards. Space role alone does not supply a project role. Multiple contacts for one UID are separate evidence: the port must not silently union their privileges.
type ProjectRoleMutationAuthorization ¶ added in v0.12.0
type ProjectRoleMutationAuthorization struct {
ActorID string
Project models4datatug.SharedProjectRef
ActorContacts []ProjectRoleEvidence
Changes []ProjectContactRoleChange
}
type ProtectedProjectBasisAuthority ¶ added in v0.11.0
type ProtectedProjectBasisAuthority interface {
VerifyInitialProtectedProjectBasisInTransaction(context.Context, dal.ReadwriteTransaction, string, string, string, string, InitialProtectedProjectBasis) error
}
type PurchaseReadiness ¶ added in v0.5.0
type PurchaseReadiness struct {
DB dal.DB
Owner PlanEffectOwnerPort
Personal PersonalPlanOwnerPort
Config PlanConfigReader
Clock PlanClock
}
PurchaseReadiness verifies the current owner, the last actual Pro plan application, and its effective public plan in one read-only transaction.
func (PurchaseReadiness) ReadyForPurchase ¶ added in v0.5.0
func (r PurchaseReadiness) ReadyForPurchase(ctx context.Context, req PurchaseReadinessRequest) (bool, error)
type PurchaseReadinessRequest ¶ added in v0.5.0
type PurchaseReadinessRequest struct {
BuyerID, Mode, SiteID, Family, AccountID string
SubscriptionID, QuoteKey, SessionID, PlanID string
}
PurchaseReadinessRequest contains only server-verified session and quote identity. The host translates the authenticated payment status request.
type QueryActivityContextResponse ¶ added in v0.20.0
type QueryActivityContextService ¶ added in v0.23.2
type QueryActivityContextService interface {
IssueContext(context.Context, string, string, string) (QueryActivityContextResponse, error)
Report(context.Context, string, string, QueryActivityReport) (QueryActivityReportResult, error)
}
type QueryActivityDrainRequest ¶ added in v0.20.0
type QueryActivityDrainResult ¶ added in v0.20.0
type QueryActivityReport ¶ added in v0.20.0
type QueryActivityReport struct {
ContextID string `json:"contextID"`
OperationID string `json:"operationID"`
Kind models4datatug.QueryActivityKind `json:"kind"`
}
type QueryActivityReportResult ¶ added in v0.20.0
type QueryActivityService ¶ added in v0.20.0
type QueryActivityService struct {
// contains filtered or unexported fields
}
QueryActivityService is an opt-in server intake and outbox. Its zero value and an unbound instance fail closed; browser attribution remains reported, first-party activity rather than proof of local execution.
func NewQueryActivityService ¶ added in v0.20.0
func NewQueryActivityService(mode contract4paymentus.Mode, db dal.DB, binding BusinessActivityBindingReader, ledger contract4paymentus.UsageLedger, corrections contract4paymentus.UsageCorrectionInbox, now func() time.Time) (*QueryActivityService, error)
func (*QueryActivityService) Deliver ¶ added in v0.20.0
func (s *QueryActivityService) Deliver(ctx context.Context, spaceID, receiptID string) error
Deliver replays a committed pending receipt through the Paymentus ledger. Ledger admission and late-evidence retention happen outside the acceptance transaction. A crash before marking completion is safe to replay.
func (*QueryActivityService) Drain ¶ added in v0.20.0
func (s *QueryActivityService) Drain(ctx context.Context, spaceID string, request QueryActivityDrainRequest) (QueryActivityDrainResult, error)
Drain discovers pending work from the server-owned Space subtree, then delivers one bounded page. Failures remain pending and do not block later records in this page; the returned cursor advances so a worker can finish a full pass before resetting to the beginning and retrying earlier failures. Cancellation returns the partial result and the last completed scan position, leaving the current and remaining rows eligible for continuation. The cursor is only a scan position, never an identity or authorization fact.
func (*QueryActivityService) IssueContext ¶ added in v0.20.0
func (s *QueryActivityService) IssueContext(ctx context.Context, actorID, spaceID, projectID string) (QueryActivityContextResponse, error)
IssueContext returns a reusable actor/project/period context. Repeated loads and authority refreshes update its proof snapshot in place, so they do not create unbounded rows or change an accepted receipt's original evidence.
func (*QueryActivityService) Report ¶ added in v0.20.0
func (s *QueryActivityService) Report(ctx context.Context, actorID, spaceID string, report QueryActivityReport) (QueryActivityReportResult, error)
Report accepts only a context, an operation identity and a closed action enum. It rechecks authority in the same transaction that commits the receipt and pending delivery outbox.
type QueryActivityUsageAuthority ¶ added in v0.20.0
type QueryActivityUsageAuthority struct{}
QueryActivityUsageAuthority proves that Paymentus is admitting or retaining the exact activity backed by DataTug's immutable accepted receipt. It reads through the ledger or inbox caller's transaction; it has no database or mutable authority dependency of its own.
func NewQueryActivityUsageAuthority ¶ added in v0.20.0
func NewQueryActivityUsageAuthority() QueryActivityUsageAuthority
NewQueryActivityUsageAuthority constructs the receipt-only activity authority. UsageOpen, UsageClose and private late-evidence reads/scans need the separately composed period authority and are always denied here.
func (QueryActivityUsageAuthority) VerifyUsage ¶ added in v0.20.0
func (QueryActivityUsageAuthority) VerifyUsage(ctx context.Context, tx dal.ReadTransaction, operation contract4paymentus.UsageOperation) error
type RegisterGithubProjectRequest ¶ added in v0.2.0
type RegisterGithubProjectRequest struct {
Org string `json:"org"`
Repo string `json:"repo"`
Folder string `json:"folder"`
Title string `json:"title"`
}
RegisterGithubProjectRequest describes a project that already exists in a GitHub repository.
func (RegisterGithubProjectRequest) Validate ¶ added in v0.2.0
func (v RegisterGithubProjectRequest) Validate() error
Validate validates the request.
type ServiceRefundProof ¶ added in v0.5.0
type ServiceRefundProof struct {
Known bool
HasPaidServiceInvoice bool
InvoiceID string
ServiceStartUTC time.Time
ServiceEndUTC time.Time
RefundedInFull bool
}
ServiceRefundProof describes the current owner's service plan, even when a historical subscription caused this revision. It is never inferred from the account-wide A+C cash snapshot. Unknown and absence are distinct.
type SessionDetectiveBinding ¶ added in v0.30.0
type SessionDetectiveRequest ¶ added in v0.30.0
type SessionDetectiveRequest struct {
OpID string `json:"operationId"`
SessionID string `json:"sessionId"`
ExpectedVersion int64 `json:"expectedVersion"`
ExpectedContextSetID string `json:"expectedContextSetId"`
Scope sessioncontext.Scope `json:"scope"`
CheckID string `json:"checkId"`
CaseID string `json:"caseId,omitempty"`
Attachments []sessioncontext.EntryRef `json:"attachments,omitempty"`
Bindings []SessionDetectiveBinding `json:"bindings,omitempty"`
Inputs map[string]detective.InputValue `json:"inputs,omitempty"`
}
type SessionDetectiveStatus ¶ added in v0.30.0
type SessionDetectiveStatus struct {
OperationID string `json:"operationId"`
Status sessioncontext.AcceptedDetectiveStatus `json:"status"`
OperationScope SessionOperationScope `json:"operationScope"`
}
type SessionOperationScope ¶ added in v0.30.0
type SessionOperationScope struct {
Storage string `json:"storage"`
Project string `json:"project"`
SpaceID string `json:"spaceID,omitempty"`
DatabaseID string `json:"databaseId"`
ProjectID string `json:"projectId"`
NamespaceID string `json:"namespaceId"`
}
SessionOperationScope is public routing metadata. It grants no content or execution authority. Storage/Project name the source; the remaining identity is the private operational namespace fixed by the mounted host.
func SessionOperationScopeFor ¶ added in v0.30.0
func SessionOperationScopeFor(mounted sessioncontext.MountedDatabase, storage, source, space, project string) (SessionOperationScope, error)
type SharedProjectActivationOptions ¶ added in v0.15.0
type SharedProjectActivationOptions struct {
}
SharedProjectActivationOptions are trusted host composition. The Core activator never runs for passive reads or precommitted reservations.
type SharedProjectBillingIntent ¶ added in v0.21.0
type SharedProjectBillingIntent string
SharedProjectBillingIntent is only a user's plan choice. It grants no access: the service still verifies current Pro or Business authority.
const ( BillingIntentPersonalPro SharedProjectBillingIntent = "personal_pro" BillingIntentSpaceBusiness SharedProjectBillingIntent = "space_business" )
func (SharedProjectBillingIntent) Validate ¶ added in v0.21.0
func (i SharedProjectBillingIntent) Validate() error
type SharedProjectCreateAuthority ¶ added in v0.10.0
type SharedProjectCreateAuthority interface {
}
SharedProjectCreateAuthority is supplied by the host using released Core Space contracts: existing DataTug capability, current ordinary active Space, and server-configured content-management roles. It must not enable a module. Core reservation labels have a narrower grammar than client command IDs: the adapter must derive a server-owned lowercase command digest (<=64 chars) and purpose/stage labels, not pass arbitrary client CommandID through Core.
type SharedProjectCreateBinding ¶ added in v0.10.0
type SharedProjectCreateBinding struct {
SharedProjectCreateBinding contains only immutable values. ActorID must come from the verified request context, never an HTTP body. A trusted adapter must independently bind it to that context when preparing Space authority.
type SharedProjectCreateCommand ¶ added in v0.10.0
type SharedProjectCreateCommand struct {
func (SharedProjectCreateCommand) Validate ¶ added in v0.10.0
func (c SharedProjectCreateCommand) Validate() error
type SharedProjectCreateTransactionAuthority ¶ added in v0.10.0
type SharedProjectCreateTransactionAuthority interface {
// membership/role, enabled module and durable reservation evidence in this
// exact transaction on EVERY invocation, including command replay. It may
// only read: no nested transaction, writes, provider call or clock read.
ValidateSharedProjectCreateInTransaction(context.Context, dal.ReadwriteTransaction, SharedProjectCreateBinding, time.Time) error
}
type SharedProjectQueryOperationScope ¶ added in v0.27.0
type SharedProjectQueryOperationScope struct {
SharedProjectQueryOperationScope records the full immutable receipt scope in one value for audit and exact replay checks.
func (SharedProjectQueryOperationScope) Validate ¶ added in v0.27.0
func (s SharedProjectQueryOperationScope) Validate() error
type SharedProjectQueryReadResult ¶ added in v0.27.0
type SharedProjectQueryReadResult struct {
}
type SharedProjectService ¶ added in v0.10.0
type SharedProjectService struct {
// contains filtered or unexported fields
}
SharedProjectService is deliberately separate from the private-project Facade, so existing callers do not acquire shared creation implicitly.
func NewActivatingBusinessSharedProjectService ¶ added in v0.21.0
func NewActivatingBusinessSharedProjectService( db dal.DB, ids IDGenerator, now func() time.Time, options BusinessSharedProjectOptions, activation SharedProjectActivationOptions, ) (*SharedProjectService, error)
NewActivatingBusinessSharedProjectService composes Business access with the same explicit-submit Core capability activation used for Pro. A Space that has not enabled DataTug can therefore create its first shared project; the capability marker is still planned and applied only in the create transaction after current paid, membership, and owner-contact checks.
func NewActivatingPaidSharedProjectService ¶ added in v0.15.0
func NewActivatingPaidSharedProjectService( db dal.DB, ids IDGenerator, now func() time.Time, paid PaidSharedProjectOptions, activation SharedProjectActivationOptions, ) (*SharedProjectService, error)
NewActivatingPaidSharedProjectService is the explicit-create composition. It has no preflight SharedProjectCreateAuthority because a new Space may not yet have the DataTug capability. Its Create methods seed a complete paid quota basis before mutation, then plan/apply capability activation in the same transaction as project admission.
func NewActivatingProBusinessSharedProjectService ¶ added in v0.21.0
func NewActivatingProBusinessSharedProjectService(db dal.DB, ids IDGenerator, now func() time.Time, options ProBusinessSharedProjectOptions, activationOptions SharedProjectActivationOptions) (*SharedProjectService, error)
NewActivatingProBusinessSharedProjectService adds explicit-submit Core activation for first creation in a Space. Pro quota inventory remains mandatory, while Business creation does not initialize or consume it.
func NewBusinessSharedProjectService ¶ added in v0.21.0
func NewBusinessSharedProjectService( db dal.DB, ids IDGenerator, authority SharedProjectCreateAuthority, now func() time.Time, options BusinessSharedProjectOptions, ) (*SharedProjectService, error)
NewBusinessSharedProjectService enables only the DataTug Business shared project path. It has no Pro directory, finite quota, or AI entitlement.
func NewDetectiveSharedProjectService ¶ added in v0.29.1
func NewDetectiveSharedProjectService(db dal.DB, ids IDGenerator, now func() time.Time, links *PaidProjectOwnerLinksOptions) (*SharedProjectService, error)
NewDetectiveSharedProjectService supplies current owner/contact proof for private demo projects without granting paid project creation or admission. The demo capability must be configured separately on DetectiveService.
func NewPaidSharedProjectService ¶ added in v0.11.0
func NewPaidSharedProjectService(db dal.DB, ids IDGenerator, authority SharedProjectCreateAuthority, now func() time.Time, options PaidSharedProjectOptions) (*SharedProjectService, error)
NewPaidSharedProjectService connects admission to Create's own transaction. Activation still requires proved quota initialization/import, private rules, project contact-role guards and project-scoped hosted-write/AI enforcement. The legacy constructor remains ownership-only and must not activate paid routes.
func NewProBusinessSharedProjectService ¶ added in v0.21.0
func NewProBusinessSharedProjectService(db dal.DB, ids IDGenerator, authority SharedProjectCreateAuthority, now func() time.Time, options ProBusinessSharedProjectOptions) (*SharedProjectService, error)
NewProBusinessSharedProjectService enables both finite personal Pro and explicit Space Business access on a single shared-project route service.
func NewSharedProjectService ¶ added in v0.10.0
func NewSharedProjectService(db dal.DB, ids IDGenerator, authority SharedProjectCreateAuthority, now func() time.Time) (*SharedProjectService, error)
func (*SharedProjectService) AuthorizeGitHubProjectWrite ¶ added in v0.14.0
func (s *SharedProjectService) AuthorizeGitHubProjectWrite(ctx context.Context, actorID string, repositoryID int64, owner, name, folder string) (GitHubProjectAccess, error)
AuthorizeGitHubProjectWrite adds a current configured Pro or Business grant to registered linked-contact membership. GitHub itself independently decides whether the current actor can write; Space roles are not a second GitHub edit ACL.
func (*SharedProjectService) AuthorizeSessionContextProject ¶ added in v0.28.0
func (s *SharedProjectService) AuthorizeSessionContextProject(ctx context.Context, actor, spaceID, projectID string) error
AuthorizeSessionContextProject applies the existing assigned-contact admission to private working context. Ending a paid term does not destroy read access. Every transport request, including operation recovery, must call this anew.
func (*SharedProjectService) Create ¶ added in v0.10.0
func (s *SharedProjectService) Create(ctx context.Context, command SharedProjectCreateCommand) (models4datatug.SharedProjectRef, error)
func (*SharedProjectService) CreateGitHubProject ¶ added in v0.14.0
func (s *SharedProjectService) CreateGitHubProject(ctx context.Context, command GitHubProjectCreateCommand, repo GitHubCreateRepository) (GitHubProjectCreateResult, error)
CreateGitHubProject reserves paid shared-project capacity and owner linkage before provider mutation, then commits the exact pinned files with a branch head precondition. A failed/unknown provider result leaves the hidden intent and quota reserved for safe same-operation recovery; it never creates a second commit or silently frees capacity.
func (*SharedProjectService) EnsureProtectedProjectQuotaForCreate ¶ added in v0.15.0
func (s *SharedProjectService) EnsureProtectedProjectQuotaForCreate(ctx facade.ContextWithUser, binding SharedProjectCreateBinding) error
EnsureProtectedProjectQuotaForCreate is a command-bound explicit-submit preflight. It requires current paid, owner-contact and Core Space authority before scanning or seeding a missing quota. All protected allocation writers require an existing quota in their own transaction, so absence fences target-payer writes while the complete scan runs. The seed transaction repeats the command authority checks and continued quota absence before inserting the basis.
func (*SharedProjectService) ListSharedProjectQueries ¶ added in v0.27.0
func (s *SharedProjectService) ListSharedProjectQueries(ctx context.Context, actorID, spaceID, projectID string) ([]datatug.QueryDefWithFolderPath, error)
ListSharedProjectQueries returns the bounded current query snapshot for an assigned contact. Query bodies are omitted from the folder items, matching the existing GitHub folder-tree response; bodies are loaded by revision.
func (*SharedProjectService) PlanExplicitProjectCreateActivationInTransaction ¶ added in v0.15.0
func (s *SharedProjectService) PlanExplicitProjectCreateActivationInTransaction( ctx facade.ContextWithUser, tx dal.ReadwriteTransaction, binding SharedProjectCreateBinding, observedAt time.Time, ) (contract4spaceus.PreparedRoleCapabilityActivation, error)
PlanExplicitProjectCreateActivationInTransaction binds Core's activation plan to the verified caller and immutable paid create command. The caller must run all of its authorization, quota, receipt, repository, and owner contact checks before calling Apply on the returned value in this same DAL transaction, immediately before its first write.
func (*SharedProjectService) ReadGitHubProjectAIEligibility ¶ added in v0.16.0
func (s *SharedProjectService) ReadGitHubProjectAIEligibility(ctx context.Context, actorID string, repositoryID int64, owner, name, folder string) (ProjectAIEligibility, error)
ReadGitHubProjectAIEligibility binds the entitlement read to the registered immutable GitHub locator. The HTTP layer separately obtains fresh GitHub read permission for the exact repository before calling this method.
func (*SharedProjectService) ReadSharedProjectAIEligibility ¶ added in v0.16.0
func (s *SharedProjectService) ReadSharedProjectAIEligibility(ctx context.Context, actorID, spaceID, projectID string) (ProjectAIEligibility, error)
ReadSharedProjectAIEligibility authorizes the current linked project reader and then evaluates the payer recorded by that project's immutable admission. The client supplies a project locator only; it cannot select the payer.
func (*SharedProjectService) ReadSharedProjectQuery ¶ added in v0.27.0
func (s *SharedProjectService) ReadSharedProjectQuery(ctx context.Context, actorID, spaceID, projectID, folderPath, queryID string) (*SharedProjectQueryReadResult, error)
ReadSharedProjectQuery authorizes the current assigned project contact in the same transaction as the query read. Space membership alone grants no access. It is the Cloud counterpart of the existing selected-branch query reader and deliberately has no GitHub or provider dependency.
func (*SharedProjectService) ReadSharedProjectSummary ¶ added in v0.27.0
func (s *SharedProjectService) ReadSharedProjectSummary(ctx context.Context, actorID, spaceID, projectID string) (json.RawMessage, error)
func (*SharedProjectService) ResolveGitHubProject ¶ added in v0.14.0
func (s *SharedProjectService) ResolveGitHubProject(ctx context.Context, actorID string, repositoryID int64, owner, name, folder string) (GitHubProjectAccess, error)
ResolveGitHubProject verifies a ready immutable locator, paid admission provenance and a CURRENT active linked contact for this Firebase UID. It deliberately does not require an active paid term: reads survive a Pro plan ending. The caller also needs fresh GitHub user+App read authority for the exact immutable repository; this Space proof never replaces that check.
func (*SharedProjectService) SaveGitHubQuery ¶ added in v0.14.0
func (s *SharedProjectService) SaveGitHubQuery(ctx context.Context, actorID string, repositoryID int64, owner, name, folder string, request dto.SaveQueryRequest, repo GitHubQueryRepository) (*dto.SaveQueryResponse, error)
SaveGitHubQuery is the paid, actor-bound Cloud command. The provider commit is one CAS operation containing the metadata/body pair. A durable intent precedes that commit; retries prove the original commit before finalizing.
func (*SharedProjectService) SaveSharedProjectQuery ¶ added in v0.27.0
func (s *SharedProjectService) SaveSharedProjectQuery(ctx context.Context, actorID, spaceID string, request dto.SaveQueryRequest) (*dto.SaveQueryResponse, error)
SaveSharedProjectQuery applies Core's storage-neutral create/update contract to the Space-owned Firestore project. The query, opaque revision, and actor/scope/payload-bound operation receipt commit atomically. The caller supplies only the authenticated actor and the explicit Space/project scope.
func (*SharedProjectService) SessionContextDemoEnvironments ¶ added in v0.29.2
func (s *SharedProjectService) SessionContextDemoEnvironments(ctx context.Context, actor, spaceID, projectID string) ([]string, error)
SessionContextDemoEnvironments admits only the pinned private demo and its currently assigned actor. Ordinary shared projects still require host catalog configuration. This fresh transaction is required for every transport request.
func (*SharedProjectService) SharedProjectQueryCapabilities ¶ added in v0.27.0
func (s *SharedProjectService) SharedProjectQueryCapabilities(ctx context.Context, actorID, spaceID, projectID string) (dto.ProjectCapabilities, error)
type SpaceServiceAccess ¶ added in v0.19.0
type SpaceServiceAccess struct {
Mode, ServiceID, PayerSpaceID, OwnerFamily, AccountKind, ProductID, PlanID string
ProviderAccountID, CustomerID, LineageID, OwnerSubscriptionID string
PaidServiceProofID, GrantVersion string
OwnerGeneration, OwnerRevision int64
PaidUntilUTC time.Time
State string // active or ended, after complete source reconciliation
UnlimitedProjects, UnlimitedContacts bool
// contains filtered or unexported fields
}
SpaceServiceAccess is the product-authorized current service projection. It is derived from Paymentus' read-only financial projection plus this versioned DataTug entitlement policy. The client cannot supply any field.
type UsageReader ¶ added in v0.4.0
type UsageReader interface {
ReadUsage(context.Context, string, string) (*models4datatug.AIUsageRecord, error)
}
UsageReader reads the requested UTC month; nil means no count document.
Source Files
¶
- business_activity_binding.go
- business_project_access.go
- business_project_admission.go
- business_project_service.go
- business_query_activity_service.go
- business_usage_lifecycle_worker.go
- business_usage_period.go
- business_usage_runtime.go
- business_usage_test_clock_runtime.go
- detective.go
- detective_action.go
- detective_ai.go
- detective_ai_dispatch.go
- detective_ai_snapshot.go
- detective_demo.go
- detective_demo_definitions.go
- detective_demo_queries.go
- detective_embedded_ovdb.go
- detective_events.go
- detective_incident_store.go
- detective_incident_store_mutation.go
- detective_incidents.go
- detective_knowledge.go
- detective_ovdb.go
- detective_query_run.go
- detective_run.go
- facade.go
- github_project_access.go
- github_project_create.go
- github_project_register.go
- github_query_mutation.go
- plan_effect.go
- plan_read.go
- plan_readiness.go
- plan_state.go
- plan_writer.go
- ports.go
- project_create.go
- project_index.go
- protected_project_inventory.go
- query_activity.go
- query_activity_drain.go
- query_activity_usage.go
- session_context.go
- session_detective.go
- session_detective_evidence.go
- session_detective_native.go
- session_detective_pin.go
- session_detective_source.go
- shared_project_activation.go
- shared_project_admission.go
- shared_project_ai_eligibility.go
- shared_project_create.go
- shared_project_linkage_graph.go
- shared_project_linkage_policy.go
- shared_project_linkage_ports.go
- shared_project_linkage_proof.go
- shared_project_owner_link.go
- shared_project_paid_access.go
- shared_project_plan_selector.go
- shared_project_query.go
- shared_project_role_authority.go
- shared_project_role_catalog.go