registry

package
v2.0.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 15, 2026 License: MIT Imports: 26 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	ReleaseInstallNextActionApprovePermissions = "approve_permissions"
	ReleaseInstallNextActionRetryActivation    = "retry_activation"
)
View Source 
const ReleaseActivationEvidenceSchemaVersionV1 = "redevplugin.release_activation_evidence.v1"
View Source 
const SQLiteSchemaVersion = 7

Variables

View Source 
var (
	ErrInvalidAuthorizationRevisions = errors.New("authorization revisions are invalid")
	ErrAuthorizationRevisionConflict = errors.New("authorization revision conflict")
	ErrAuthorizationSchemaIncomplete = errors.New("authorization schema is incomplete")
)
View Source 
var (
	ErrReleaseInstallOperationNotFound = errors.New("release install operation not found")
	ErrReleaseInstallOperationConflict = errors.New("release install operation conflict")
	ErrInvalidReleaseInstallOperation  = errors.New("invalid release install operation")
)
View Source 
var ErrIncompatiblePersistedManifest = errors.New("persisted plugin manifest is incompatible")
View Source 
var ErrInvalidExternalPackageInstall = errors.New("invalid external package install")
View Source 
var ErrManagementRevisionConflict = errors.New("management revision conflict")
View Source 
var ErrNotFound = errors.New("plugin record not found")
View Source 
var ErrOwnerScopeMismatch = errors.New("plugin registry owner scope mismatch")

Functions

func RunnableAuthorizationState 

func RunnableAuthorizationState(state AuthorizationState) bool

func RunnablePluginRecord 

func RunnablePluginRecord(record PluginRecord) bool

RunnablePluginRecord preserves the legacy trust projection for records that predate external-package facts. External packages are governed by their environment-and-package-bound execution approval instead of signature state.

func RunnableTrustState 

func RunnableTrustState(state TrustState) bool

Types

type AuthorizationDecision 

type AuthorizationDecision struct {
	State              AuthorizationState        `json:"state"`
	Allowed            bool                      `json:"allowed"`
	MissingPermissions []string                  `json:"missing_permissions,omitempty"`
	PolicyEvaluation   security.PolicyEvaluation `json:"policy_evaluation"`
}

func EvaluateAuthorizationSnapshot 

func EvaluateAuthorizationSnapshot(snapshot AuthorizationSnapshot, req AuthorizeRequest) (AuthorizationDecision, error)

EvaluateAuthorizationSnapshot applies the canonical permission, policy, and revision checks to an authorization snapshot owned by another durable store.

type AuthorizationRevisionConflictError 

type AuthorizationRevisionConflictError struct {
	PluginInstanceID string
	Expected         AuthorizationRevisions
	Actual           AuthorizationRevisions
}

func (*AuthorizationRevisionConflictError) Error 

func (e *AuthorizationRevisionConflictError) Error() string

func (*AuthorizationRevisionConflictError) Unwrap 

func (e *AuthorizationRevisionConflictError) Unwrap() error

type AuthorizationRevisions 

type AuthorizationRevisions struct {
	PolicyRevision     uint64 `json:"policy_revision"`
	ManagementRevision uint64 `json:"management_revision"`
	RevokeEpoch        uint64 `json:"revoke_epoch"`
}

func AuthorizationRevisionsFromRecord 

func AuthorizationRevisionsFromRecord(record PluginRecord) AuthorizationRevisions

type AuthorizationSnapshot 

type AuthorizationSnapshot struct {
	Plugin PluginRecord           `json:"plugin"`
	Grants []permissions.Record   `json:"grants"`
	Policy *security.PolicyRecord `json:"policy,omitempty"`
}

func PrepareDeleteSecurityPolicy 

func PrepareDeleteSecurityPolicy(snapshot AuthorizationSnapshot, pluginInstanceID string, now time.Time, expected AuthorizationRevisions) (AuthorizationSnapshot, error)

func PrepareGrantPermission 

func PrepareGrantPermission(snapshot AuthorizationSnapshot, req permissions.GrantRequest, expected AuthorizationRevisions) (AuthorizationSnapshot, error)

func PrepareRevokePermission 

func PrepareRevokePermission(snapshot AuthorizationSnapshot, req permissions.RevokeRequest, expected AuthorizationRevisions) (AuthorizationSnapshot, error)

func PrepareSecurityPolicy 

func PrepareSecurityPolicy(snapshot AuthorizationSnapshot, req security.PutPolicyRequest, expected AuthorizationRevisions) (AuthorizationSnapshot, error)

type AuthorizationState 

type AuthorizationState struct {
	PluginInstanceID    string                 `json:"plugin_instance_id"`
	PluginVersion       string                 `json:"plugin_version"`
	ActiveFingerprint   string                 `json:"active_fingerprint"`
	TrustState          TrustState             `json:"trust_state"`
	SignatureAssessment SignatureAssessment    `json:"signature_assessment"`
	PackageSourceKind   PackageSourceKind      `json:"package_source_kind"`
	ExecutionApproval   ExecutionApproval      `json:"execution_approval"`
	EnableState         EnableState            `json:"enable_state"`
	Revisions           AuthorizationRevisions `json:"revisions"`
}

type AuthorizationStore 

type AuthorizationStore interface {
	GrantPermission(ctx context.Context, req permissions.GrantRequest, expected AuthorizationRevisions) (AuthorizationSnapshot, error)
	RevokePermission(ctx context.Context, req permissions.RevokeRequest, expected AuthorizationRevisions) (AuthorizationSnapshot, error)
	PutSecurityPolicy(ctx context.Context, req security.PutPolicyRequest, expected AuthorizationRevisions) (AuthorizationSnapshot, error)
	DeleteSecurityPolicy(ctx context.Context, pluginInstanceID string, now time.Time, expected AuthorizationRevisions) (AuthorizationSnapshot, error)
	GetAuthorization(ctx context.Context, pluginInstanceID string) (AuthorizationSnapshot, error)
	ListAuthorization(ctx context.Context) ([]AuthorizationSnapshot, error)
	Authorize(ctx context.Context, req AuthorizeRequest) (AuthorizationDecision, error)
}

type AuthorizeRequest 

type AuthorizeRequest struct {
	PluginInstanceID string                 `json:"plugin_instance_id"`
	Method           string                 `json:"method"`
	PermissionIDs    []string               `json:"permission_ids,omitempty"`
	Expected         AuthorizationRevisions `json:"expected"`
	Now              time.Time              `json:"-"`
}

type EnableState 

type EnableState string
const (
	EnableDisabled             EnableState = "disabled"
	EnableEnabled              EnableState = "enabled"
	EnableDisabledByPolicy     EnableState = "disabled_by_policy"
	EnableDisabledIncompatible EnableState = "disabled_incompatible"
)

type ExecutionApproval 

type ExecutionApproval struct {
	Status            ExecutionApprovalStatus `json:"state"`
	OwnerEnvHash      string                  `json:"owner_env_hash,omitempty"`
	PackageSHA256     string                  `json:"package_sha256,omitempty"`
	ReasonCodes       []string                `json:"reason_codes,omitempty"`
	EvidenceReference string                  `json:"evidence_reference,omitempty"`
	PolicyEpoch       string                  `json:"policy_epoch,omitempty"`
	AssessedAt        time.Time               `json:"assessed_at,omitempty"`
	ApprovedAt        time.Time               `json:"approved_at,omitempty"`
}

ExecutionApproval is durable package authorization. Its audience is exactly one environment and one immutable package digest; session audiences must not be persisted here.

type ExecutionApprovalStatus 

type ExecutionApprovalStatus string
const (
	ExecutionApprovalPending        ExecutionApprovalStatus = "pending"
	ExecutionApprovalUserApproved   ExecutionApprovalStatus = "user_approved"
	ExecutionApprovalPolicyApproved ExecutionApprovalStatus = "policy_approved"
	ExecutionApprovalPolicyBlocked  ExecutionApprovalStatus = "policy_blocked"
)

type ExternalPackageInstallIntent 

type ExternalPackageInstallIntent string
const (
	ExternalPackageInstall ExternalPackageInstallIntent = "install"
	ExternalPackageUpdate  ExternalPackageInstallIntent = "update"
)

type InstallExternalPackageRequest 

type InstallExternalPackageRequest struct {
	Intent                     ExternalPackageInstallIntent `json:"intent"`
	ExpectedManagementRevision uint64                       `json:"expected_management_revision"`
	Record                     PluginRecord                 `json:"record"`
	Now                        time.Time                    `json:"-"`
}

type LocalImportProvenance 

type LocalImportProvenance struct {
	ImportID       string `json:"import_id"`
	Distribution   string `json:"distribution"`
	PolicyEpoch    string `json:"policy_epoch"`
	UnsignedPolicy string `json:"unsigned_policy"`
	AssessedAt     string `json:"assessed_at"`
}

type ManagementRevisionConflictError 

type ManagementRevisionConflictError struct {
	PluginInstanceID string
	Expected         uint64
	Actual           uint64
}

func (*ManagementRevisionConflictError) Error 

func (e *ManagementRevisionConflictError) Error() string

func (*ManagementRevisionConflictError) Unwrap 

func (e *ManagementRevisionConflictError) Unwrap() error

type MemoryStore 

type MemoryStore struct {
	// contains filtered or unexported fields
}

func NewMemoryStore 

func NewMemoryStore() *MemoryStore

func (*MemoryStore) AbortInstall 

func (s *MemoryStore) AbortInstall(ctx context.Context, pluginInstanceID string) error

func (*MemoryStore) Authorize 

func (s *MemoryStore) Authorize(ctx context.Context, req AuthorizeRequest) (AuthorizationDecision, error)

func (*MemoryStore) BindRetained 

func (s *MemoryStore) BindRetained(ctx context.Context, expected plugindata.Binding, targetPluginInstanceID string, targetExpectedManagementRevision uint64, targetShape plugindata.Shape, now time.Time) (plugindata.Binding, error)

func (*MemoryStore) CleanupExpired 

func (s *MemoryStore) CleanupExpired(ctx context.Context, now time.Time, expected []plugindata.Binding) ([]plugindata.Binding, error)

func (*MemoryStore) CommitEnable 

func (s *MemoryStore) CommitEnable(ctx context.Context, expectedManagementRevision uint64, expected *plugindata.Binding, next plugindata.Binding, shape plugindata.Shape, now time.Time) error

func (*MemoryStore) CommitUninstall 

func (s *MemoryStore) CommitUninstall(ctx context.Context, req plugindata.CommitUninstallRequest) (plugindata.CommitUninstallResult, error)

func (*MemoryStore) CreateObject 

func (s *MemoryStore) CreateObject(ctx context.Context, scope sessionctx.ScopeKind, object plugindata.Object) error

func (*MemoryStore) DeleteObject 

func (s *MemoryStore) DeleteObject(ctx context.Context, scope sessionctx.ScopeKind, pluginInstanceID, objectID string) error

func (*MemoryStore) DeleteRetained 

func (s *MemoryStore) DeleteRetained(ctx context.Context, expected plugindata.Binding) error

func (*MemoryStore) DeleteSecurityPolicy 

func (s *MemoryStore) DeleteSecurityPolicy(ctx context.Context, pluginInstanceID string, now time.Time, expected AuthorizationRevisions) (AuthorizationSnapshot, error)

func (*MemoryStore) Durable 

func (*MemoryStore) Durable() bool

func (*MemoryStore) GetAuthorization 

func (s *MemoryStore) GetAuthorization(ctx context.Context, pluginInstanceID string) (AuthorizationSnapshot, error)

func (*MemoryStore) GetBinding 

func (s *MemoryStore) GetBinding(ctx context.Context, pluginInstanceID string) (plugindata.Binding, bool, error)

func (*MemoryStore) GetObject 

func (s *MemoryStore) GetObject(ctx context.Context, scope sessionctx.ScopeKind, pluginInstanceID, objectID string) (plugindata.Object, bool, error)

func (*MemoryStore) GetPlugin 

func (s *MemoryStore) GetPlugin(ctx context.Context, pluginInstanceID string) (PluginRecord, error)

func (*MemoryStore) GrantPermission 

func (s *MemoryStore) GrantPermission(ctx context.Context, req permissions.GrantRequest, expected AuthorizationRevisions) (AuthorizationSnapshot, error)

func (*MemoryStore) ListAllBindingsForMaintenance 

func (s *MemoryStore) ListAllBindingsForMaintenance(_ context.Context, cursor string, limit int) ([]plugindata.MaintenanceBinding, string, error)

func (*MemoryStore) ListAllObjectsForMaintenance 

func (s *MemoryStore) ListAllObjectsForMaintenance(_ context.Context, cursor string, limit int) ([]plugindata.MaintenanceObject, string, error)

func (*MemoryStore) ListAuthorization 

func (s *MemoryStore) ListAuthorization(ctx context.Context) ([]AuthorizationSnapshot, error)

func (*MemoryStore) ListBindings 

func (s *MemoryStore) ListBindings(ctx context.Context, cursor string, limit int) ([]plugindata.Binding, string, error)

func (*MemoryStore) ListObjects 

func (s *MemoryStore) ListObjects(ctx context.Context, scope sessionctx.ScopeKind, pluginInstanceID, cursor string, limit int) ([]plugindata.Object, string, error)

func (*MemoryStore) ListPlugins 

func (s *MemoryStore) ListPlugins(ctx context.Context) ([]PluginRecord, error)

func (*MemoryStore) PutPlugin 

func (s *MemoryStore) PutPlugin(ctx context.Context, record PluginRecord, opts PutOptions) (PluginRecord, error)

func (*MemoryStore) PutSecurityPolicy 

func (s *MemoryStore) PutSecurityPolicy(ctx context.Context, req security.PutPolicyRequest, expected AuthorizationRevisions) (AuthorizationSnapshot, error)

func (*MemoryStore) RevokePermission 

func (s *MemoryStore) RevokePermission(ctx context.Context, req permissions.RevokeRequest, expected AuthorizationRevisions) (AuthorizationSnapshot, error)

func (*MemoryStore) SetEnableState 

func (s *MemoryStore) SetEnableState(ctx context.Context, pluginInstanceID string, state EnableState, reason string, now time.Time) (PluginRecord, error)

func (*MemoryStore) SwapImport 

func (s *MemoryStore) SwapImport(ctx context.Context, expectedManagementRevision uint64, expected *plugindata.Binding, next plugindata.Binding, shape plugindata.Shape, now time.Time) error

type PackageSourceKind 

type PackageSourceKind string
const (
	PackageSourceGitHubRepository PackageSourceKind = "github_repository"
	PackageSourcePackageURL       PackageSourceKind = "package_url"
	PackageSourcePackageUpload    PackageSourceKind = "package_upload"
	PackageSourceOfficialCatalog  PackageSourceKind = "official_catalog"
	PackageSourceApprovedCatalog  PackageSourceKind = "approved_catalog"
	PackageSourceLocalGenerated   PackageSourceKind = "local_generated"
	PackageSourceLegacyRegistry   PackageSourceKind = "legacy_registry"
)

type PackageSourceProvenance 

type PackageSourceProvenance struct {
	Kind               PackageSourceKind          `json:"kind"`
	UploadID           string                     `json:"upload_id,omitempty"`
	SourceOrigin       string                     `json:"source_origin,omitempty"`
	SourceURL          string                     `json:"source_url,omitempty"`
	FinalURL           string                     `json:"final_url,omitempty"`
	RedirectChain      []PackageSourceRedirectHop `json:"redirect_chain,omitempty"`
	RepositoryURL      string                     `json:"repository_url,omitempty"`
	GitHubRepositoryID string                     `json:"repository_id,omitempty"`
	GitHubReleaseID    string                     `json:"release_id,omitempty"`
	GitHubAssetID      string                     `json:"asset_id,omitempty"`
	GitHubOwner        string                     `json:"owner,omitempty"`
	GitHubRepository   string                     `json:"repository,omitempty"`
	ReleaseTag         string                     `json:"release_tag,omitempty"`
	AssetName          string                     `json:"asset_name,omitempty"`
	PackageSHA256      string                     `json:"package_sha256,omitempty"`
	SourceReference    string                     `json:"source_reference,omitempty"`
	SourcePath         string                     `json:"source_path,omitempty"`
	ResolvedRevision   string                     `json:"resolved_commit_sha,omitempty"`
	CatalogEntryID     string                     `json:"catalog_entry_id,omitempty"`
	RetrievedAt        time.Time                  `json:"resolved_at,omitempty"`
}

type PackageSourceRedirectHop 

type PackageSourceRedirectHop struct {
	Origin string `json:"origin"`
	Path   string `json:"path"`
}

type PluginRecord 

type PluginRecord struct {
	OwnerEnvHash              string                    `json:"-"`
	PluginInstanceID          string                    `json:"plugin_instance_id"`
	PublisherID               string                    `json:"publisher_id"`
	PluginID                  string                    `json:"plugin_id"`
	Version                   string                    `json:"version"`
	ActiveFingerprint         string                    `json:"active_fingerprint"`
	PackageHash               string                    `json:"package_hash"`
	ManifestHash              string                    `json:"manifest_hash"`
	EntriesHash               string                    `json:"entries_hash"`
	TrustState                TrustState                `json:"trust_state"`
	TrustAssessment           TrustAssessment           `json:"trust_assessment"`
	SignatureAssessment       SignatureAssessment       `json:"signature_assessment"`
	PackageSourceProvenance   PackageSourceProvenance   `json:"source_provenance"`
	ExecutionApproval         ExecutionApproval         `json:"execution_approval"`
	UpdateEligibility         UpdateEligibility         `json:"update_eligibility"`
	SecurityCapabilitySummary SecurityCapabilitySummary `json:"security_summary"`
	ReleaseTrustBinding       *ReleaseTrustBinding      `json:"release_trust_binding,omitempty"`
	LocalImportProvenance     *LocalImportProvenance    `json:"local_import_provenance,omitempty"`
	CapabilityContracts       []capabilitycontract.Pin  `json:"capability_contracts,omitempty"`
	EnableState               EnableState               `json:"enable_state"`
	DisabledReason            string                    `json:"disabled_reason,omitempty"`
	PolicyRevision            uint64                    `json:"policy_revision"`
	ManagementRevision        uint64                    `json:"management_revision"`
	RevokeEpoch               uint64                    `json:"revoke_epoch"`
	Manifest                  manifest.Manifest         `json:"manifest"`
	ManifestModel             manifest.Model            `json:"-"`
	ManifestSource            string                    `json:"manifest_source,omitempty"`
	PackageEntries            []pluginpkg.Entry         `json:"package_entries"`
	RuntimeRequirement        *RuntimeRequirement       `json:"runtime_requirement,omitempty"`
	VersionHistory            []PluginVersion           `json:"version_history,omitempty"`
	InstalledAt               time.Time                 `json:"installed_at"`
	EnabledAt                 *time.Time                `json:"enabled_at,omitempty"`
	UpdatedAt                 time.Time                 `json:"updated_at"`
	DeletedAt                 *time.Time                `json:"deleted_at,omitempty"`
	Metadata                  map[string]string         `json:"metadata,omitempty"`
}

func PrepareEnableState 

func PrepareEnableState(record PluginRecord, state EnableState, reason string, now time.Time) PluginRecord

func PrepareExternalPackageInstall 

func PrepareExternalPackageInstall(ownerEnvHash string, req InstallExternalPackageRequest, existing *PluginRecord) (PluginRecord, error)

PrepareExternalPackageInstall applies the canonical external-package validation, owner binding, revision transition, and security normalization without persisting state. Persistent authorities use this function inside their own atomic transaction so Host has one installation state machine.

func PreparePluginPut 

func PreparePluginPut(ownerEnvHash string, record PluginRecord, existing *PluginRecord, now time.Time) (PluginRecord, error)

type PluginVersion 

type PluginVersion struct {
	Version                   string                        `json:"version"`
	ActiveFingerprint         string                        `json:"active_fingerprint"`
	PackageHash               string                        `json:"package_hash"`
	ManifestHash              string                        `json:"manifest_hash"`
	EntriesHash               string                        `json:"entries_hash"`
	TrustState                TrustState                    `json:"trust_state"`
	TrustAssessment           TrustAssessment               `json:"trust_assessment"`
	SignatureAssessment       SignatureAssessment           `json:"signature_assessment"`
	PackageSourceProvenance   PackageSourceProvenance       `json:"source_provenance"`
	ExecutionApproval         ExecutionApproval             `json:"execution_approval"`
	UpdateEligibility         UpdateEligibility             `json:"update_eligibility"`
	SecurityCapabilitySummary SecurityCapabilitySummary     `json:"security_summary"`
	ReleaseTrustBinding       *ReleaseTrustBinding          `json:"release_trust_binding,omitempty"`
	LocalImportProvenance     *LocalImportProvenance        `json:"local_import_provenance,omitempty"`
	CapabilityContracts       []capabilitycontract.Pin      `json:"capability_contracts,omitempty"`
	Manifest                  manifest.Manifest             `json:"manifest"`
	ManifestModel             manifest.Model                `json:"-"`
	ManifestSource            string                        `json:"manifest_source,omitempty"`
	ManifestAPI               manifest.PublicAPIRequirement `json:"manifest_api,omitempty"`
	ManifestPermissions       []manifest.PermissionID       `json:"manifest_permissions,omitempty"`
	PackageEntries            []pluginpkg.Entry             `json:"package_entries"`
	RuntimeRequirement        *RuntimeRequirement           `json:"runtime_requirement,omitempty"`
	ActivatedAt               time.Time                     `json:"activated_at"`
	Metadata                  map[string]string             `json:"metadata,omitempty"`
}

type PutOptions 

type PutOptions struct {
	Now time.Time `json:"-"`
}

type ReleaseInstallActivation 

type ReleaseInstallActivation struct {
	Status               ReleaseInstallActivationStatus `json:"status"`
	MissingPermissionIDs []string                       `json:"missing_permission_ids,omitempty"`
	NextAction           string                         `json:"next_action,omitempty"`
}

type ReleaseInstallActivationMode 

type ReleaseInstallActivationMode string
const (
	ReleaseInstallActivationAutomatic ReleaseInstallActivationMode = "automatic"
	ReleaseInstallActivationRequested ReleaseInstallActivationMode = "requested"
	ReleaseInstallActivationDisabled  ReleaseInstallActivationMode = "disabled"
)

type ReleaseInstallActivationRequest 

type ReleaseInstallActivationRequest struct {
	Mode                  ReleaseInstallActivationMode `json:"mode"`
	ApprovedPermissionIDs []string                     `json:"approved_permission_ids,omitempty"`
}

type ReleaseInstallActivationStatus 

type ReleaseInstallActivationStatus string
const (
	ReleaseInstallActivationPending        ReleaseInstallActivationStatus = "pending"
	ReleaseInstallActivationEnabled        ReleaseInstallActivationStatus = "enabled"
	ReleaseInstallActivationNeedsAttention ReleaseInstallActivationStatus = "needs_attention"
	ReleaseInstallActivationNotRequested   ReleaseInstallActivationStatus = "not_requested"
)

type ReleaseInstallFailure 

type ReleaseInstallFailure struct {
	Code      string `json:"code"`
	Retryable bool   `json:"retryable"`
}

type ReleaseInstallIdentity 

type ReleaseInstallIdentity struct {
	SourceID              string `json:"source_id"`
	Channel               string `json:"channel"`
	ReleaseMetadataRef    string `json:"release_metadata_ref"`
	ReleaseMetadataSHA256 string `json:"release_metadata_sha256"`
	PublisherID           string `json:"publisher_id"`
	PluginID              string `json:"plugin_id"`
	Version               string `json:"version"`
	PackageSHA256         string `json:"package_sha256"`
	ManifestSHA256        string `json:"manifest_sha256"`
	EntriesSHA256         string `json:"entries_sha256"`
}

ReleaseInstallIdentity is the immutable signed-release coordinate required to reconcile an interrupted installation without retaining a source URL.

type ReleaseInstallOperation 

type ReleaseInstallOperation struct {
	Execution         execution.Execution             `json:"-"`
	RequestID         string                          `json:"request_id"`
	PluginInstanceID  string                          `json:"plugin_instance_id"`
	RequestSHA256     string                          `json:"request_sha256"`
	Phase             string                          `json:"phase"`
	Progress          ReleaseInstallProgress          `json:"progress"`
	Attempt           int                             `json:"attempt"`
	RetryAfterMS      int64                           `json:"retry_after_ms"`
	MutationOutcome   mutation.Outcome                `json:"mutation_outcome"`
	Failure           *ReleaseInstallFailure          `json:"failure,omitempty"`
	PluginRecord      *PluginRecord                   `json:"plugin_record,omitempty"`
	Activation        ReleaseInstallActivation        `json:"activation"`
	PhaseDiagnostics  []ReleaseInstallPhaseDiagnostic `json:"phase_diagnostics"`
	Release           ReleaseInstallIdentity          `json:"-"`
	ActivationRequest ReleaseInstallActivationRequest `json:"-"`
}

func ApplyReleaseInstallOperationUpdate 

func ApplyReleaseInstallOperationUpdate(current ReleaseInstallOperation, req UpdateReleaseInstallOperationRequest) (ReleaseInstallOperation, error)

ApplyReleaseInstallOperationUpdate is the canonical transition helper used by Host-owned durable execution stores.

func PrepareReleaseInstallOperation 

func PrepareReleaseInstallOperation(req StartReleaseInstallOperationRequest) (ReleaseInstallOperation, error)

PrepareReleaseInstallOperation validates one request and constructs the canonical initial payload for a Host-owned Execution.

type ReleaseInstallPhaseDiagnostic 

type ReleaseInstallPhaseDiagnostic struct {
	Phase        string                 `json:"phase"`
	ArtifactRole string                 `json:"artifact_role,omitempty"`
	Attempt      int                    `json:"attempt"`
	Progress     ReleaseInstallProgress `json:"progress"`
	CacheHit     bool                   `json:"cache_hit"`
	StartedAt    time.Time              `json:"started_at"`
	CompletedAt  *time.Time             `json:"completed_at,omitempty"`
	DurationMS   int64                  `json:"duration_ms,omitempty"`
}

type ReleaseInstallProgress 

type ReleaseInstallProgress struct {
	Kind      ReleaseInstallProgressKind `json:"kind"`
	Completed int64                      `json:"completed,omitempty"`
	Total     int64                      `json:"total,omitempty"`
}

type ReleaseInstallProgressKind 

type ReleaseInstallProgressKind string
const (
	ReleaseInstallProgressIndeterminate ReleaseInstallProgressKind = "indeterminate"
	ReleaseInstallProgressItems         ReleaseInstallProgressKind = "items"
	ReleaseInstallProgressBytes         ReleaseInstallProgressKind = "bytes"
)

type ReleaseTrustBinding 

type ReleaseTrustBinding struct {
	SourceID              string `json:"source_id"`
	Channel               string `json:"channel"`
	ReleaseMetadataRef    string `json:"release_metadata_ref"`
	ReleaseMetadataSHA256 string `json:"release_metadata_sha256"`
	PublisherID           string `json:"publisher_id"`
	PluginID              string `json:"plugin_id"`
	Version               string `json:"version"`
	PackageSigningKeyID   string `json:"package_signing_key_id"`
	RootEpoch             string `json:"root_epoch"`
	PolicyEpoch           string `json:"policy_epoch"`
	RevocationEpoch       string `json:"revocation_epoch"`
}

type RuntimeRequirement 

type RuntimeRequirement struct {
	MinVersion       string                 `json:"min_version"`
	SupportedTargets []runtimetarget.Target `json:"supported_targets,omitempty"`
}

RuntimeRequirement is the exact worker-runtime compatibility contract that was verified for an installed package version. UI-only packages leave it nil.

type SQLiteStore 

type SQLiteStore struct {
	// contains filtered or unexported fields
}

func NewSQLiteStore 

func NewSQLiteStore(ctx context.Context, path string) (*SQLiteStore, error)

func (*SQLiteStore) AbortInstall 

func (s *SQLiteStore) AbortInstall(ctx context.Context, pluginInstanceID string) error

func (*SQLiteStore) Authorize 

func (s *SQLiteStore) Authorize(ctx context.Context, req AuthorizeRequest) (AuthorizationDecision, error)

func (*SQLiteStore) BindRetained 

func (s *SQLiteStore) BindRetained(ctx context.Context, expected plugindata.Binding, targetPluginInstanceID string, targetExpectedManagementRevision uint64, targetShape plugindata.Shape, now time.Time) (plugindata.Binding, error)

func (*SQLiteStore) CleanupExpired 

func (s *SQLiteStore) CleanupExpired(ctx context.Context, now time.Time, expected []plugindata.Binding) ([]plugindata.Binding, error)

func (*SQLiteStore) Close 

func (s *SQLiteStore) Close() error

func (*SQLiteStore) CommitEnable 

func (s *SQLiteStore) CommitEnable(ctx context.Context, expectedManagementRevision uint64, expected *plugindata.Binding, next plugindata.Binding, shape plugindata.Shape, now time.Time) error

func (*SQLiteStore) CommitUninstall 

func (s *SQLiteStore) CommitUninstall(ctx context.Context, req plugindata.CommitUninstallRequest) (plugindata.CommitUninstallResult, error)

func (*SQLiteStore) CreateObject 

func (s *SQLiteStore) CreateObject(ctx context.Context, scope sessionctx.ScopeKind, object plugindata.Object) error

func (*SQLiteStore) DeleteObject 

func (s *SQLiteStore) DeleteObject(ctx context.Context, scope sessionctx.ScopeKind, pluginInstanceID, objectID string) error

func (*SQLiteStore) DeleteRetained 

func (s *SQLiteStore) DeleteRetained(ctx context.Context, expected plugindata.Binding) error

func (*SQLiteStore) DeleteSecurityPolicy 

func (s *SQLiteStore) DeleteSecurityPolicy(ctx context.Context, pluginInstanceID string, now time.Time, expected AuthorizationRevisions) (AuthorizationSnapshot, error)

func (*SQLiteStore) Durable 

func (*SQLiteStore) Durable() bool

func (*SQLiteStore) GetAuthorization 

func (s *SQLiteStore) GetAuthorization(ctx context.Context, pluginInstanceID string) (AuthorizationSnapshot, error)

func (*SQLiteStore) GetBinding 

func (s *SQLiteStore) GetBinding(ctx context.Context, pluginInstanceID string) (plugindata.Binding, bool, error)

func (*SQLiteStore) GetObject 

func (s *SQLiteStore) GetObject(ctx context.Context, scope sessionctx.ScopeKind, pluginInstanceID, objectID string) (plugindata.Object, bool, error)

func (*SQLiteStore) GetPlugin 

func (s *SQLiteStore) GetPlugin(ctx context.Context, pluginInstanceID string) (PluginRecord, error)

func (*SQLiteStore) GrantPermission 

func (s *SQLiteStore) GrantPermission(ctx context.Context, req permissions.GrantRequest, expected AuthorizationRevisions) (AuthorizationSnapshot, error)

func (*SQLiteStore) ListAllBindingsForMaintenance 

func (s *SQLiteStore) ListAllBindingsForMaintenance(ctx context.Context, cursor string, limit int) ([]plugindata.MaintenanceBinding, string, error)

func (*SQLiteStore) ListAllObjectsForMaintenance 

func (s *SQLiteStore) ListAllObjectsForMaintenance(ctx context.Context, cursor string, limit int) ([]plugindata.MaintenanceObject, string, error)

func (*SQLiteStore) ListAuthorization 

func (s *SQLiteStore) ListAuthorization(ctx context.Context) ([]AuthorizationSnapshot, error)

func (*SQLiteStore) ListBindings 

func (s *SQLiteStore) ListBindings(ctx context.Context, cursor string, limit int) ([]plugindata.Binding, string, error)

func (*SQLiteStore) ListObjects 

func (s *SQLiteStore) ListObjects(ctx context.Context, scope sessionctx.ScopeKind, pluginInstanceID, cursor string, limit int) ([]plugindata.Object, string, error)

func (*SQLiteStore) ListPlugins 

func (s *SQLiteStore) ListPlugins(ctx context.Context) ([]PluginRecord, error)

func (*SQLiteStore) PutPlugin 

func (s *SQLiteStore) PutPlugin(ctx context.Context, record PluginRecord, opts PutOptions) (PluginRecord, error)

func (*SQLiteStore) PutSecurityPolicy 

func (s *SQLiteStore) PutSecurityPolicy(ctx context.Context, req security.PutPolicyRequest, expected AuthorizationRevisions) (AuthorizationSnapshot, error)

func (*SQLiteStore) RevokePermission 

func (s *SQLiteStore) RevokePermission(ctx context.Context, req permissions.RevokeRequest, expected AuthorizationRevisions) (AuthorizationSnapshot, error)

func (*SQLiteStore) SetEnableState 

func (s *SQLiteStore) SetEnableState(ctx context.Context, pluginInstanceID string, state EnableState, reason string, now time.Time) (PluginRecord, error)

func (*SQLiteStore) SwapImport 

func (s *SQLiteStore) SwapImport(ctx context.Context, expectedManagementRevision uint64, expected *plugindata.Binding, next plugindata.Binding, shape plugindata.Shape, now time.Time) error

type SecurityCapabilitySummary 

type SecurityCapabilitySummary struct {
	SchemaVersion string   `json:"schema_version,omitempty"`
	CapabilityIDs []string `json:"capability_ids,omitempty"`
	Summary       string   `json:"summary,omitempty"`
	CanonicalJSON string   `json:"canonical_json,omitempty"`
	Reference     string   `json:"reference,omitempty"`
	SHA256        string   `json:"sha256,omitempty"`
}

type SignatureAssessment 

type SignatureAssessment struct {
	Status               SignatureAssessmentStatus `json:"state"`
	Algorithm            string                    `json:"algorithm,omitempty"`
	KeyID                string                    `json:"key_id,omitempty"`
	AssessedHashes       TrustHashSet              `json:"assessed_hashes"`
	PackageSHA256        string                    `json:"package_sha256,omitempty"`
	ManifestSHA256       string                    `json:"manifest_sha256,omitempty"`
	EntriesSHA256        string                    `json:"entries_sha256,omitempty"`
	KeyringGeneration    string                    `json:"keyring_generation,omitempty"`
	RevocationGeneration string                    `json:"revocation_generation,omitempty"`
	AssessmentEpoch      string                    `json:"assessment_epoch,omitempty"`
	TrustRootEpoch       string                    `json:"trust_root_epoch,omitempty"`
	PolicyEpoch          string                    `json:"policy_epoch,omitempty"`
	RevocationEpoch      string                    `json:"revocation_epoch,omitempty"`
	ReasonCodes          []string                  `json:"reason_codes,omitempty"`
	EvidenceReference    string                    `json:"evidence_reference,omitempty"`
	AssessedAt           time.Time                 `json:"assessed_at,omitempty"`
}

type SignatureAssessmentStatus 

type SignatureAssessmentStatus string
const (
	SignatureVerified      SignatureAssessmentStatus = "verified"
	SignatureAbsent        SignatureAssessmentStatus = "absent"
	SignatureUnknownSigner SignatureAssessmentStatus = "unknown_signer"
	SignatureInvalid       SignatureAssessmentStatus = "invalid"
	SignatureRevoked       SignatureAssessmentStatus = "revoked"
	SignatureUnavailable   SignatureAssessmentStatus = "unavailable"
)

type StartReleaseInstallOperationRequest 

type StartReleaseInstallOperationRequest struct {
	RequestID        string                          `json:"request_id"`
	ExecutionID      string                          `json:"execution_id"`
	PluginInstanceID string                          `json:"plugin_instance_id"`
	Release          ReleaseInstallIdentity          `json:"release"`
	Activation       ReleaseInstallActivationRequest `json:"activation"`
	Now              time.Time                       `json:"-"`
}

type Store 

type Store interface {
	Durable() bool
	AuthorizationStore
	plugindata.Catalog
	PutPlugin(ctx context.Context, record PluginRecord, opts PutOptions) (PluginRecord, error)
	GetPlugin(ctx context.Context, pluginInstanceID string) (PluginRecord, error)
	ListPlugins(ctx context.Context) ([]PluginRecord, error)
	SetEnableState(ctx context.Context, pluginInstanceID string, state EnableState, reason string, now time.Time) (PluginRecord, error)
	CommitUninstall(ctx context.Context, req plugindata.CommitUninstallRequest) (plugindata.CommitUninstallResult, error)
	AbortInstall(ctx context.Context, pluginInstanceID string) error
}

type TrustAssessment 

type TrustAssessment struct {
	TrustState           TrustState         `json:"trust_state"`
	ReasonCodes          []string           `json:"reason_codes,omitempty"`
	VerifiedHashes       TrustHashSet       `json:"verified_hashes"`
	VerifiedSignature    *VerifiedSignature `json:"verified_signature,omitempty"`
	TrustAssessmentEpoch string             `json:"trust_assessment_epoch,omitempty"`
	PolicyEpoch          string             `json:"policy_epoch,omitempty"`
	RevocationEpoch      string             `json:"revocation_epoch,omitempty"`
	Metadata             map[string]string  `json:"metadata,omitempty"`
}

type TrustHashSet 

type TrustHashSet struct {
	PackageSHA256  string `json:"package_sha256"`
	ManifestSHA256 string `json:"manifest_sha256"`
	EntriesSHA256  string `json:"entries_sha256"`
}

type TrustState 

type TrustState string
const (
	TrustVerified        TrustState = "verified"
	TrustUnsignedLocal   TrustState = "unsigned_local"
	TrustUntrusted       TrustState = "untrusted"
	TrustNeedsReview     TrustState = "needs_review"
	TrustUnavailable     TrustState = "trust_unavailable"
	TrustBlockedSecurity TrustState = "blocked_security"
)

type UpdateEligibility 

type UpdateEligibility string
const (
	UpdateManualOnly        UpdateEligibility = "manual_only"
	UpdateAutomaticEligible UpdateEligibility = "automatic_eligible"
)

type UpdateReleaseInstallOperationRequest 

type UpdateReleaseInstallOperationRequest struct {
	ExecutionID     string
	ExpectedCursor  uint64
	Status          string
	Phase           string
	Progress        ReleaseInstallProgress
	ArtifactRole    string
	CacheHit        bool
	Attempt         int
	RetryAfterMS    int64
	MutationOutcome mutation.Outcome
	Failure         *ReleaseInstallFailure
	PluginRecord    *PluginRecord
	Activation      ReleaseInstallActivation
	Now             time.Time
}

type VerifiedSignature 

type VerifiedSignature struct {
	Algorithm string `json:"algorithm"`
	KeyID     string `json:"key_id"`
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.