datasource

type DefinitionAuthorizer ¶ added in v0.1.57

type DefinitionAuthorizer func(context.Context, *dsproto.DataSource, map[string]interface{}) error

type FeedRefResolver ¶

type FeedRefResolver interface {
	ResolveFeed(ctx context.Context, feedID string) (interface{}, error)
}

FeedRefResolver resolves a feed_ref backend to its already-emitted payload. Implementation lives in sdk layer (feeds); service/datasource keeps the interface here so the core has no import cycle.

type FetchOptions ¶

type FetchOptions struct {
	SelectionBinding *identity.SelectionBinding
	WindowParameters map[string]any
	// ResourceProof is opaque provider provenance for a standalone datasource.
	// The provider still verifies the signature and fresh resource authorization.
	ResourceProof *primitive.ExecutionProof
	Target        *types.WindowTarget
	Resource      *identity.ResolvedResource
	// BypassCache forces a fresh backend call and writes the result back
	// into cache.
	BypassCache bool

	// WriteThrough (with BypassCache=false) means: on hit, still kick off
	// a background refresh if stale-while-revalidate is set. When used as
	// a prewarm, set BypassCache=true.
	WriteThrough bool
}

FetchOptions are per-call overrides carried on the wire.

type Identity ¶

type Identity struct {
	User         string
	Conversation string
}

Identity is the cache-key identity extracted from ctx. It is never used for auth decisions — auth is already attached to ctx by the time Fetch runs.

type IdentityFunc ¶

type IdentityFunc func(ctx context.Context) Identity

IdentityFunc extracts a cache-key identity (user, conversation) from ctx. Tests and non-HTTP callers can supply their own; the default reads well-known keys from ctx.

type MCPResourceReader ¶ added in v0.1.57

type MCPResourceReader interface {
	ReadResource(context.Context, string, string) (json.RawMessage, error)
}

MCPResourceReader reads authored resource URIs through an admitted MCP connection. The host owns credentials, provider identity, authorization and original leases; implementations must return JSON and never derive a network endpoint from uri.

type MemoryStore ¶

type MemoryStore struct {
	// contains filtered or unexported fields
}

MemoryStore is a minimal thread-safe Store implementation suitable for tests and for callers that manage datasources in-process. Production wiring loads from extension/forge/datasources/*.yaml via the workspace repository; that repository's List() output feeds MemoryStore.Replace.

func NewMemoryStore() *MemoryStore

func (s *MemoryStore) Get(id string) (*dsproto.DataSource, bool)

func (s *MemoryStore) List() []string

func (s *MemoryStore) Put(ds *dsproto.DataSource)

func (s *MemoryStore) Replace(items []*dsproto.DataSource)

type NativeComponentTransport ¶ added in v0.1.57

type NativeComponentTransport interface {
	ObserveNativeComponent(context.Context, string, string) (windowprotocol.ComponentBinding, error)
	ExecuteNativeComponent(context.Context, string, string, windowprotocol.ComponentBinding, map[string]interface{}) (json.RawMessage, error)
}

NativeComponentTransport is the deprecated client-bound component API. It is retained only so legacy callers receive an explicit migration error.

type NativeMCPComponentDispatcher ¶ added in v0.1.57

type NativeMCPComponentDispatcher struct{}

func NewNativeMCPComponentDispatcher(NativeComponentTransport, []string) (*NativeMCPComponentDispatcher, error)

func (d *NativeMCPComponentDispatcher) ExecuteComponent(context.Context, string, string, windowprotocol.ComponentBinding, map[string]interface{}) (json.RawMessage, error)

func (d *NativeMCPComponentDispatcher) IsComponentProducer(string) bool

func (d *NativeMCPComponentDispatcher) ObserveComponent(context.Context, string, string, windowprotocol.ComponentBinding) (windowprotocol.ComponentBinding, error)

type NewDeliveryPreparer ¶ added in v0.1.57

type NewDeliveryPreparer func(context.Context, OriginalDelivery) (context.Context, *PreparedDelivery, error)

NewDeliveryPreparer must verify the full original signed selection, fresh canonical actor, current namespace exposure and exact candidate, then mint fresh target/provider proofs. It must never retry a business operation. The returned context must derive from the supplied context to preserve managed MCP credentials, cache identity, conversation, and operation values. It may refresh trusted values but must not substitute an ambient/background context.

type Options ¶

type Options struct {
	// NewDeliveryPreparer is optional trusted server wiring; never a wire callback.
	NewDeliveryPreparer NewDeliveryPreparer
	// ReadSequence owns pure PRE/POST metadata facts; dispatch barriers end PRE.
	ReadSequence        func(context.Context) (context.Context, func() error, error)
	ReadContext         func(context.Context) (context.Context, error)
	ResourceReader      MCPResourceReader
	ProviderExecute     ProviderExecutor
	ExecutionContext    func(context.Context) context.Context
	ResolveDefinition   ResourceDefinitionResolver
	PermissionResolver  permittedview.Resolver
	ComponentDispatcher windowprotocol.ComponentDispatcher
	ResolveResource     ResourceRevalidator
	AuthorizeDefinition DefinitionAuthorizer
	Store               Store
	Executor            ToolExecutor
	Identity            IdentityFunc // if nil, uses defaultIdentity (reads generic ctx keys)
	FeedRef             FeedRefResolver
	Now                 func() time.Time // for tests; defaults to time.Now
	// Authorize is checked on every fetch, including cache hits. The host
	// resolves datasource identity and exact inputs from trusted mappings.
	Authorize func(context.Context, string, map[string]interface{}) error
	// DisableCache prevents a prior account's result from being reused while
	// account-bound authorization is active and no account-aware cache key exists.
	DisableCache bool
}

type OriginalDelivery ¶ added in v0.1.57

type OriginalDelivery struct {
	Resource         *identity.ResolvedResource
	Target           *types.WindowTarget
	ResourceProof    *primitive.ExecutionProof
	SelectionBinding *identity.SelectionBinding
	WindowParameters map[string]any
}

OriginalDelivery holds immutable selection provenance for a new interaction. Inputs and historical facts remain outside this preparation contract.

type PreparedDelivery ¶ added in v0.1.57

type PreparedDelivery struct {
	Resource      *identity.ResolvedResource
	Target        *types.WindowTarget
	ResourceProof *primitive.ExecutionProof
}

PreparedDelivery is a detached, freshly verified artifact delivery context. Preparation grants no read/write business permission; managing MCP execution remains authoritative for each operation.

type ProviderExecutor ¶ added in v0.1.57

type ProviderExecutor func(context.Context, *dsproto.DataSource, map[string]interface{}) (json.RawMessage, error)

type ResourceDefinitionResolver ¶ added in v0.1.57

type ResourceDefinitionResolver func(context.Context, identity.ResolvedResource, *types.WindowTarget, string) (*dsproto.DataSource, error)

type ResourceRevalidator ¶ added in v0.1.57

type ResourceRevalidator func(context.Context, identity.ResolvedResource) (*identity.ResolvedResource, error)

Options are the construction options for New. DefinitionAuthorizer binds execution to a resolved resource's exact backend descriptor. It runs before dispatch/cache access and before returning rows.

type Service ¶

type Service struct {
	// contains filtered or unexported fields
}

Service is the public entry point. Construct with New, then call Fetch.

func New(opts Options) *Service

func (s *Service) Fetch(ctx context.Context, id string, inputs map[string]interface{}, opts FetchOptions) (result *dsproto.FetchResult, resultErr error)

func (s *Service) FetchPublished(ctx context.Context, ds *dsproto.DataSource, inputs map[string]interface{}, windowParameters map[string]any) (result *dsproto.FetchResult, fetchErr error)

func (s *Service) InvalidateCache(ctx context.Context, id, inputsHash string) error

func (s *Service) InvalidateDefinitionCache(ctx context.Context, ds *dsproto.DataSource, inputsHash string) error

type Store ¶

type Store interface {
	Get(id string) (*dsproto.DataSource, bool)
}

Store is the workspace-scoped registry of loaded datasources.

type ToolExecutor ¶

type ToolExecutor interface {
	// Execute calls an MCP tool by fully qualified name "service:method"
	// with args and returns the raw JSON string result (the registry's
	// documented return type). ctx carries identity (auth token is
	// attached by the registry via WithAuthTokenContext).
	Execute(ctx context.Context, name string, args map[string]interface{}) (string, error)
}

ToolExecutor is the seam to invoke an MCP tool. In production this is wired to internal/tool/registry.Registry.Execute which dispatches under the caller's ctx identity. Tests can supply an in-memory stub.