providerreads

package

v0.26.0 Latest Latest Go to latest Published: Oct 19, 2026 License: Apache-2.0 Imports: 18 Imported by: 3

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/openvaultdb/openvaultdb-go

Links

Open Source Insights

Documentation ¶

Overview ¶

Package providerreads implements the closed ovdb-provider-read/1 evidence contract. Evidence records consumed transient bytes, never bodies or rows.

Index ¶

Constants
func Canonical(value any) ([]byte, error)
func Digest(value any) (string, error)
func ObservationDigest(ex Execution, b Binding, o Observation) (string, error)
func RequestDigest(r Request) (string, error)
func RightsDigest(right license.SourceRight) (string, error)
func Validate(e Envelope, p Plan, used []string) error
func ValidateMetadata(metadata Metadata, plan Plan, admittedUsed []string) error
type Binding
type Collector
- func NewCollector(plan Plan) (*Collector, error)
- func (c *Collector) Add(request Request, read Observation) error
- func (c *Collector) Finish(used []string) (Envelope, error)
type Envelope
- func Decode(raw []byte) (Envelope, error)
type Execution
type Metadata
type Observation
type Plan
type Request
type Usage

Constants ¶

View Source

const Format = "ovdb-provider-read/1"

View Source

const MaxItems = 64

View Source

const MaxMetadataBytes = 256 * 1024

Variables ¶

This section is empty.

Functions ¶

func Canonical ¶

func Canonical(value any) ([]byte, error)

Canonical returns RFC 8785 JSON, with ECMAScript numbers and UTF-16 key order. No Unicode normalization or recursive field removal is performed.

func Digest ¶

func Digest(value any) (string, error)

func ObservationDigest ¶

func ObservationDigest(ex Execution, b Binding, o Observation) (string, error)

func RequestDigest ¶

func RequestDigest(r Request) (string, error)

func RightsDigest ¶

func RightsDigest(right license.SourceRight) (string, error)

func Validate ¶

func Validate(e Envelope, p Plan, used []string) error

Validate verifies detached producer/consumer facts against trusted preflight, including actual legacy usage supplied by the execution, before output.

func ValidateMetadata ¶

func ValidateMetadata(metadata Metadata, plan Plan, admittedUsed []string) error

ValidateMetadata requires full response-rights and legacy-usage equality with independent admission facts before checking the envelope/digest bindings.

Types ¶

type Binding ¶

type Binding struct {
	ProviderSourceID string `json:"providerSourceId"`
	RightsSourceID   string `json:"rightsSourceId"`
	ResourceID       string `json:"resourceId"`
	DefinitionDigest string `json:"definitionDigest"`
	DecoderDigest    string `json:"decoderDigest"`
	RightsDigest     string `json:"rightsDigest"`
}

type Collector ¶

type Collector struct {
	// contains filtered or unexported fields
}

Collector owns only observation metadata for one execution. It cannot fetch, retain source bytes or deduplicate network reads. Callers must reuse the actual transient response for any admitted self-join; joins remain unsupported here.

func NewCollector ¶

func NewCollector(plan Plan) (*Collector, error)

func (*Collector) Add ¶

func (c *Collector) Add(request Request, read Observation) error

Add consumes an adapter observation, never a response body. Request must be independently admitted; the caller cannot introduce a late arbitrary URL.

func (*Collector) Finish ¶

func (c *Collector) Finish(used []string) (Envelope, error)

type Envelope ¶

type Envelope struct {
	Format    string        `json:"format"`
	Execution Execution     `json:"execution"`
	Bindings  []Binding     `json:"bindings"`
	Reads     []Observation `json:"reads"`
	Usage     []Usage       `json:"usage"`
}

func Decode ¶

func Decode(raw []byte) (Envelope, error)

Decode reads the closed wire envelope without accepting unknown, duplicate, missing, null or invalid-Unicode fields. Validate must follow with trusted Plan.

type Execution ¶

type Execution struct {
	ID         string `json:"id"`
	Mode       string `json:"mode"`
	ExecutorID string `json:"executorId"`
}

type Metadata ¶

type Metadata struct {
	SourceRights  []license.SourceRight `json:"sourceRights"`
	UsedSourceIDs []string              `json:"usedSourceIds"`
	ProviderReads *Envelope             `json:"providerReads"`
}

Metadata captures only response evidence. Rows and other parent response fields must not be accessed or cloned by the evidence gate.

type Observation ¶

type Observation struct {
	ObservationID string `json:"observationId"`
	ResourceID    string `json:"resourceId"`
	RequestDigest string `json:"requestDigest"`
	FetchedAt     string `json:"fetchedAt"`
	UpstreamURL   string `json:"upstreamUrl"`
	Status        int    `json:"status"`
	ContentType   string `json:"contentType"`
	SHA256        string `json:"sha256"`
	Bytes         int64  `json:"bytes"`
	ReferenceDate string `json:"referenceDate,omitempty"`
	LastModified  string `json:"lastModified,omitempty"`
	ETag          string `json:"etag,omitempty"`
	Attestation   string `json:"attestation"`
}

type Plan ¶

type Plan struct {
	Execution        Execution
	Bindings         []Binding
	Requests         []Request
	SourceRights     []license.SourceRight
	MaxReads         *int
	MaxMetadataBytes int
}

Plan is trusted admission input, detached before reads. DefinitionDigest must resolve a verified immutable definition that binds exact model/meaning artifacts.

type Request ¶

type Request struct {
	ResourceID  string         `json:"resourceId"`
	Method      string         `json:"method"`
	UpstreamURL string         `json:"upstreamUrl"`
	Params      map[string]any `json:"params"`
}

type Usage ¶

type Usage struct {
	ProviderSourceID string   `json:"providerSourceId"`
	RightsSourceID   string   `json:"rightsSourceId"`
	ObservationIDs   []string `json:"observationIds"`
}

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL