code wiki / _hdl_build / nx_mgmt_upload.nx
`nx_mgmt_upload.nx` source

1// nx_mgmt_upload.nx -- CAP-API-UPLOAD: the #1 census gap = binary UPLOAD over /api, the "not-on-LAN deploy"
2// unblocker. The mgmt accept loop reads one request into a fixed SD_REQCAP(64KB) buffer, so a multi-MB binary
3// cannot ride a single POST. Answer: CHUNKED staging -- the client sends ordered ~48KB `POST /api/upload?target=..&seq=N`
4// chunks; this primitive assembles them into the allowlisted staging file (seq 0 = fresh/truncate, seq>0 = append),
5// then /api/deploy promotes + the self-safe marker (nx_deploy_marker) restarts. Deterministic + resumable-by-seq.
6// SECURITY: `path` MUST be pre-resolved through the deploy allowlist (md_resolve_target) by the caller -- this is the
7// write primitive only, single-responsibility. license_tier: ORIGINAL
8import "nx_syscalls.nx"
9const MU_MAGIC_3750763034362895579: i64 = 3750763034362895579
10const MU_MAGIC_65536: i64 = 65536
11const MU_MAGIC_1099511628211: i64 = 1099511628211
12
13const MU_MODE: i64 = 0x1a4   // 0644
14
15// stage one ORDERED chunk. seq==0 truncates (fresh upload), seq>0 appends. Returns bytes written, or -1 on open fail.
16func mu_stage_chunk(path: *u8, seq: i64, chunk: *u8, chunk_n: i64) -> i64 {
17    var fd: i64 = 0
18    if seq == 0 { fd = sys_openat_wr(path, MU_MODE) } else { fd = sys_openat_append(path, MU_MODE) }
19    if fd < 0 { return 0 - 1 }
20    let wr: i64 = sys_write(fd, chunk, chunk_n)
21    sys_close(fd)
22    return wr
23}
24
25// current staged size (bytes) via SEEK_END -- the endpoint verifies this against the client's declared total before
26// promoting, so a truncated/interrupted upload is NEVER promoted (fail-closed, never-brick).
27func mu_staged_size(path: *u8) -> i64 {
28    let fd: i64 = sys_openat_rd(path)
29    if fd < 0 { return 0 - 1 }
30    let sz: i64 = sys_lseek(fd, 0, 2)   // whence=2 SEEK_END
31    sys_close(fd)
32    return sz
33}
34
35// FNV-1a 64-bit content hash of the staged file (streamed, bounded buffer) -- the deterministic content-address the
36// client compares against, so upload integrity is verified by construction (the sovereign exceed over blind promote).
37func mu_staged_fnv1a(path: *u8) -> i64 {
38    let fd: i64 = sys_openat_rd(path)
39    if fd < 0 { return 0 }
40    var h: i64 = 0-MU_MAGIC_3750763034362895579        // 0xcbf29ce484222325 as signed i64
41    let buf: *u8 = sys_mmap(MU_MAGIC_65536)
42    var go: i64 = 1
43    while go == 1 {
44        let nr: i64 = sys_read(fd, buf, MU_MAGIC_65536)
45        if nr <= 0 { go = 0 }
46        if nr > 0 {
47            var i: i64 = 0
48            while i < nr { h = (h ^ ((buf[i] as i64) & 0xff)) * MU_MAGIC_1099511628211; i = i + 1 }
49        }
50    }
51    sys_close(fd)
52    return h
53}
nx_mgmt_upload.nx source

`nx_mgmt_upload.nx` source
