~/bend-docscommunity

generation.bend relies on unsafe/foreign

raw source on the hub · import 0x665ae73e3f32ce98f72c7cf6844cfd3f/generation.bend as Generation

Generation on the host's cryptographic source =============================================

Generated identifiers and contexts on the host's cryptographic source: WebCrypto in JavaScript and the operating system's generator natively. They apply the rules of trace_context.bend: four words per trace ID candidate and two per span ID candidate, most significant first, eight candidates per identifier, no all-zero identifier, no reuse of an identifier to exclude, such as the parent's span ID or a received trace ID, and an immediate stop at the first source error. There is no time, counter or other fallback. TC.TraceId.generate_with, TC.Context.root_with and their siblings take a caller's source instead.

The generation machine itself is pure: section 6 of LAWS.bend states its behavior over replayed tapes. This file only connects it, and the native HTTP shortcuts of native_http.bend, to the host source of entropy.bend.

Every operation here relies on entropy.bend's foreign effect, so a check of a file that imports this module reports them and answers SOME PROOFS FAIL. No law imports it: the laws state the same operations on a caller's source, which is how PROOF.bend proves them without host code.

4 imports
import Base
import ./trace_context.bend as TC
import ./native_http.bend as Adapter
import ./entropy.bend as Entropy

Definitions

def Source.host source · line 30 · raw

@state:Unit -> IO(Pair(Unit, Result<&1, &1, Pair(U32, String), U32>))

The host source as the machine reads it: each read returns one word result from Entropy.read_u32, and the state is Unit because the host keeps none.

def on_host source · line 35 · raw

@-A:Type -> @action:IO(Pair(Unit, A)) -> IO(A)

The host source has no state to hand back.

def TraceId.generate source · line 41 · raw

@excluded:Maybe<&2, 0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.TraceId> -> IO(Result<&2, &2, 0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.GenerationError, 0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.TraceId>)

A trace ID alone, as an OpenTelemetry SDK generates one before its sampler decides on it (TC.TraceId.generate_with). It asserts random-trace-id and is never excluded, when there is one.

def SpanId.generate source · line 48 · raw

@excluded:Maybe<&2, 0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.SpanId> -> IO(Result<&2, &2, 0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.GenerationError, 0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.SpanId>)

A span ID alone, as an SDK generates one once its sampler has decided, or for a child span with its parent's span ID excluded (TC.SpanId.generate_with).

def Context.root source · line 57 · raw

@sampled:Bool -> IO(Result<&2, &2, 0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.GenerationError, 0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.LocalContext>)

Start a trace: a trace ID, then a span ID, as TC.Context.root_with composes them, with the sampled indication sampled, as it is given. The trace ID asserts random-trace-id, so the root is emitted with flags 03 when it is sampled and 02 when it is not: False gives an unsampled root, as Context.continue_or_start starts one by default.

def Context.child source · line 62 · raw

@parent:0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.Parent -> @sampling:0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.Sampling -> IO(Result<&2, &2, 0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.GenerationError, 0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.LocalContext>)

Continue a remote or local parent with a new operation.

def Context.restart source · line 68 · raw

@previous:0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.RemoteContext -> @sampled:Bool -> IO(Result<&2, &2, 0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.GenerationError, 0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.LocalContext>)

Start a new trace instead of continuing a received context, with the sampled indication sampled, as a root takes it.

def Context.continue_or_start source · line 77 · raw

@+extraction:0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.Extraction -> @reception:0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.Reception -> @sampling:0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.Sampling -> @+policy:0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.FailurePolicy -> IO(0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.FailurePolicy.result(policy, 0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.Service))

Give a service its own operation for a received message: a child of the context that extraction keeps, the message's or the base, a root without one, or a new trace in its place at a trust boundary (TC.Context.continue_or_start_with).

def Context.send source · line 85 · raw

@+limits:0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.Limits -> @service:0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.Service -> @sampling:0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.Sampling -> @+policy:0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.FailurePolicy -> @+carrier:List<&2, 0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.Header> -> IO(0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.FailurePolicy.result(policy, 0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.Sent))

Give one message that the service sends a new child of the service's operation, or the fallback when none can be generated (TC.Context.send_with).

def NativeHttp.continue_or_start source · line 94 · raw

@+limits:0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.Limits -> @headers:0x665ae73e3f32ce98f72c7cf6844cfd3f/native_http.HeaderMap -> @base:Maybe<&2, 0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.BaseContext> -> @reception:0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.Reception -> @sampling:0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.Sampling -> @+policy:0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.FailurePolicy -> IO(0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.FailurePolicy.result(policy, 0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.Service))

The service's own operation for a received request, from the header map of the request, on the host's cryptographic source: native_http.bend's continue_or_start_with on Source.host. base is the context to keep when the request carries no usable traceparent.

def NativeHttp.send source · line 104 · raw

@+limits:0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.Limits -> @service:0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.Service -> @sampling:0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.Sampling -> @+policy:0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.FailurePolicy -> @headers:0x665ae73e3f32ce98f72c7cf6844cfd3f/native_http.HeaderMap -> IO(0x665ae73e3f32ce98f72c7cf6844cfd3f/trace_context.FailurePolicy.result(policy, 0x665ae73e3f32ce98f72c7cf6844cfd3f/native_http.Outbound))

Give one request that the service sends the context of a new operation, on the host's cryptographic source: native_http.bend's send_with on Source.host, which replaces the context fields of headers, the request's own header map.