@apifuse/provider-sdk 2.2.0-beta.2 → 2.2.0-beta.21

package/src/runtime/executor.ts

@@ -1,11 +1,16 @@
-import { ProviderError, SessionExpiredError } from "../errors";
-import { parseSchema } from "../schema";
-import type { ProviderContext, ProviderDefinition } from "../types";
+import {
+	isSessionExpiredError,
+	isValidationError,
+	ProviderError,
+	SessionExpiredError,
+	ValidationError,
+} from "../errors.js";
+import { z } from "zod";
+import { parseSchema } from "../schema.js";
+import type { ProviderContext, ProviderDefinition } from "../types.js";
+import { assertRequiredSecretsPresent } from "./secrets.js";
 
-export function isStreamingOperation(
-	provider: ProviderDefinition,
-	operationId: string,
-): boolean {
+export function isStreamingOperation(provider: ProviderDefinition, operationId: string): boolean {
 	const kind = provider.operations[operationId]?.transport?.kind ?? "json";
 	return kind !== "json";
 }
@@ -31,15 +36,19 @@ export async function executeOperation(
 	const operation = provider.operations[operationId];
 
 	if (!operation) {
-		throw new ProviderError(
-			`Unknown operation: ${provider.id}/${operationId}`,
-			{
-				code: "NOT_FOUND",
-				fix: `Valid operations: ${Object.keys(provider.operations).join(", ")}`,
-			},
-		);
+		throw new ProviderError(`Unknown operation: ${provider.id}/${operationId}`, {
+			code: "NOT_FOUND",
+			fix: `Valid operations: ${Object.keys(provider.operations).join(", ")}`,
+		});
 	}
 
+	// SDK-owned secret presence gate (single source of truth): declared
+	// `required: true` secrets are validated here, before input parsing and the
+	// handler, so every invocation path (serve /v1, self-test probes, perf,
+	// record) fails with the same structured MISSING_SECRET error instead of a
+	// handler-specific crash. Providers must not re-check presence locally.
+	assertRequiredSecretsPresent(provider, ctx.env);
+
 	const validatedInput = await parseSchema(
 		operation.input,
 		input,
@@ -64,7 +73,12 @@ export async function executeOperation(
 		// operation is safe to re-drive after refresh, which we signal by marking
 		// the surfaced error retryable; non-idempotent operations (the default)
 		// stay non-retryable so they are not auto-re-driven. See design.md §4.3 D3.
-		if (error instanceof SessionExpiredError && operation.retryOnAuthRefresh) {
+		// Use the branded guard, not `instanceof`: a handler loaded through a
+		// duplicate/published SDK module can throw a correctly branded
+		// SessionExpiredError whose constructor identity differs from this
+		// executor's, which `instanceof` would miss — dropping the retryable
+		// upgrade and stranding an operation that opted into auth refresh.
+		if (isSessionExpiredError(error) && operation.retryOnAuthRefresh) {
 			throw new SessionExpiredError(error.message, { retryable: true });
 		}
 		throw error;
@@ -74,9 +88,18 @@ export async function executeOperation(
 		return result;
 	}
 
-	return parseSchema(
-		operation.output,
-		result,
-		`operations.${operationId}.output`,
-	);
+	try {
+		return await parseSchema(operation.output, result, `operations.${operationId}.output`);
+	} catch (cause) {
+		if (!(cause instanceof z.ZodError) && !isValidationError(cause)) {
+			throw cause;
+		}
+		throw new ValidationError(`Operation handler output failed schema validation.`, {
+			code: "OUTPUT_VALIDATION_FAILED",
+			category: "output_validation",
+			retryable: false,
+			zodError: isValidationError(cause) ? cause.zodError : cause,
+			...(cause instanceof Error ? { cause } : {}),
+		});
+	}
 }