@base44/functions-compiler 0.1.5 → 0.1.6

package/lib/dist/activation-shim.mjs

@@ -1,357 +0,0 @@
-// GENERATED by scripts/build-shim.ts from src/shim/activation.ts — do not edit.
-// Regenerate with `npm run build:shim`.
-
-// src/shim/activation.ts
-import { inflateSync } from "node:zlib";
-import { setRuntimeManifest } from "base44:private-data-sources/runtime-manifest-store";
-var ACTIVATION_CHALLENGE_HEADER = "Base44-Activation-Challenge";
-var ACTIVATION_PROOF_HEADER = "Base44-Activation-Proof";
-var ACTIVATION_ERROR_HEADER = "X-Base44-Activation-Error";
-var ACTIVATION_MARKER_HEADER = "X-Base44-Activation";
-var ACTIVATION_DIGEST_HEADER = "X-Base44-Activation-Digest";
-var ERROR_DIGEST_CONTEXT = "cf-activation-error-v1.";
-var MARKER_DIGEST_CONTEXT = "cf-activation-marker-v1.";
-var ACTIVATION_URL_ENV = "BASE44_ACTIVATION_URL";
-var ACTIVATION_KEY_ENV = "BASE44_ACTIVATION_KEY";
-var PULL_TIMEOUT_MS = 5e3;
-var PULL_COOLDOWN_MS = 1e3;
-var PROOF_CONTEXT = "cf-activation-proof-v1.";
-var NONCE_LEN = 12;
-var DATA_KEY_LEN = 32;
-var PULL_BODY_MAX_CHARS = 1024;
-var BLOB_BINDING_PREFIX = "BASE44_SECRETS_BLOB";
-var BLOB_KEY_ID_LEN = 1;
-var MANIFEST_KEY = "BASE44_PRIVATE_DATA_SOURCES";
-var LATCHED_REASONS = [
-  "url_missing",
-  "key_missing",
-  "url_not_https",
-  "blob_missing",
-  "blob_unreadable"
-];
-var _uncurry = Function.prototype.bind.bind(Function.prototype.call);
-var _subtle = crypto.subtle;
-var _subtleImportKey = _subtle.importKey.bind(_subtle);
-var _subtleDecrypt = _subtle.decrypt.bind(_subtle);
-var _subtleSign = _subtle.sign.bind(_subtle);
-var _subtleDigest = _subtle.digest.bind(_subtle);
-var _fetch = globalThis.fetch.bind(globalThis);
-var _abortTimeout = AbortSignal.timeout.bind(AbortSignal);
-var _DateNow = Date.now;
-var _JSONparse = JSON.parse;
-var _TextDecoder = TextDecoder;
-var _TextEncoder = TextEncoder;
-var _decodeUtf8 = _uncurry(TextDecoder.prototype.decode);
-var _encodeUtf8 = _uncurry(TextEncoder.prototype.encode);
-var _Uint8Array = Uint8Array;
-var _atob = atob;
-var _btoa = btoa;
-var _ObjectEntries = Object.entries;
-var _Headers = Headers;
-var _Request = Request;
-var _Response = Response;
-var _headersGet = _uncurry(Headers.prototype.get);
-var _headersAppend = _uncurry(Headers.prototype.append);
-var _headersEntries = _uncurry(Headers.prototype.entries);
-var _resText = _uncurry(Response.prototype.text);
-var _iterNext = _uncurry(Object.getPrototypeOf(new Headers().entries()).next);
-function accessor(proto, name) {
-  for (let o = proto; o; o = Object.getPrototypeOf(o)) {
-    const d = Object.getOwnPropertyDescriptor(o, name);
-    if (d?.get) return _uncurry(d.get);
-  }
-  return void 0;
-}
-var _reqHeaders = accessor(Request.prototype, "headers");
-var _resHeaders = accessor(Response.prototype, "headers");
-var _resStatus = accessor(Response.prototype, "status");
-var _resStatusText = accessor(Response.prototype, "statusText");
-var _resBody = accessor(Response.prototype, "body");
-var _resWebSocket = accessor(Response.prototype, "webSocket");
-var RUNTIME_SECRETS_HEADER_LC = "base44-runtime-secrets";
-var INBOUND_HEADERS_LC = ["base44-activation-challenge", RUNTIME_SECRETS_HEADER_LC];
-var SHIM_RESPONSE_HEADERS_LC = [
-  "x-base44-activation-error",
-  "x-base44-activation",
-  "x-base44-activation-digest",
-  "x-base44-needs-activation"
-];
-delete process.env[ACTIVATION_URL_ENV];
-delete process.env[ACTIVATION_KEY_ENV];
-function listHas(list, value) {
-  for (let i = 0; i < list.length; i++) if (list[i] === value) return true;
-  return false;
-}
-function headersWithout(src, dropLowercased) {
-  const out = new _Headers();
-  const it = _headersEntries(src);
-  for (; ; ) {
-    const step = _iterNext(it);
-    if (step.done) break;
-    if (!listHas(dropLowercased, step.value[0])) {
-      _headersAppend(out, step.value[0], step.value[1]);
-    }
-  }
-  return out;
-}
-var ActivationError = class extends Error {
-  constructor(reason) {
-    super(reason);
-    this.reason = reason;
-  }
-  reason;
-};
-function reasonOf(e) {
-  return e instanceof ActivationError ? e.reason : "internal";
-}
-async function phase(reason, run) {
-  try {
-    return await run();
-  } catch (e) {
-    throw e instanceof ActivationError ? e : new ActivationError(reason);
-  }
-}
-var installed = false;
-var pendingInstall = null;
-var installChain = Promise.resolve();
-var latchedReason = null;
-var cooldownReason = null;
-var nextPullAt = 0;
-async function activationProof(activationKeyB64, challenge) {
-  const key = await _subtleImportKey(
-    "raw",
-    fromBase64Url(activationKeyB64),
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["sign"]
-  );
-  const message = _encodeUtf8(new _TextEncoder(), PROOF_CONTEXT + challenge);
-  return toBase64Url(new _Uint8Array(await _subtleSign("HMAC", key, message)));
-}
-function endpointReason(status) {
-  switch (status) {
-    case 400:
-      return "endpoint_400";
-    case 401:
-      return "endpoint_401";
-    case 409:
-      return "endpoint_409";
-    case 429:
-      return "endpoint_429";
-  }
-  if (status >= 400 && status < 500) return "endpoint_4xx";
-  if (status >= 500 && status < 600) return "endpoint_5xx";
-  return "response_malformed";
-}
-async function pullDataKey(challenge, env) {
-  const bindings = env ?? {};
-  const url = bindings[ACTIVATION_URL_ENV];
-  const activationKeyB64 = bindings[ACTIVATION_KEY_ENV];
-  if (typeof url !== "string" || !url) throw new ActivationError("url_missing");
-  if (typeof activationKeyB64 !== "string" || !activationKeyB64) {
-    throw new ActivationError("key_missing");
-  }
-  if (!url.startsWith("https://")) throw new ActivationError("url_not_https");
-  const headers = new _Headers();
-  _headersAppend(headers, ACTIVATION_CHALLENGE_HEADER, challenge);
-  _headersAppend(
-    headers,
-    ACTIVATION_PROOF_HEADER,
-    await activationProof(activationKeyB64, challenge)
-  );
-  const signal = _abortTimeout(PULL_TIMEOUT_MS);
-  const transport = () => signal.aborted ? "endpoint_timeout" : "endpoint_unreachable";
-  let res;
-  try {
-    res = await _fetch(url, { method: "POST", headers, redirect: "manual", signal });
-  } catch {
-    throw new ActivationError(transport());
-  }
-  const status = _resStatus(res);
-  if (status !== 200) throw new ActivationError(endpointReason(status));
-  let body;
-  try {
-    body = await _resText(res);
-  } catch {
-    throw new ActivationError(transport());
-  }
-  if (body.length > PULL_BODY_MAX_CHARS) throw new ActivationError("response_malformed");
-  const parsed = await phase("response_malformed", () => _JSONparse(body));
-  const keyB64 = parsed !== null && typeof parsed === "object" ? parsed.key : void 0;
-  if (typeof keyB64 !== "string") throw new ActivationError("response_malformed");
-  const dataKey = await phase("response_malformed", () => fromBase64Url(keyB64));
-  if (dataKey.length !== DATA_KEY_LEN) throw new ActivationError("response_malformed");
-  return dataKey;
-}
-async function installFromDataKey(dataKeyBytes, env) {
-  const bindings = env ?? {};
-  const appId = bindings.BASE44_APP_ID;
-  const aad = _encodeUtf8(new _TextEncoder(), typeof appId === "string" ? appId : "");
-  let blobB64 = "";
-  for (let i = 0; ; i++) {
-    const part = bindings[`${BLOB_BINDING_PREFIX}_${i}`];
-    if (typeof part !== "string") break;
-    blobB64 += part;
-  }
-  if (blobB64 === "") throw new ActivationError("blob_missing");
-  const secrets = await phase("blob_unreadable", async () => {
-    const blob = fromBase64Url(blobB64);
-    const dataKey = await _subtleImportKey("raw", dataKeyBytes, "AES-GCM", false, ["decrypt"]);
-    const plaintext = await _subtleDecrypt(
-      {
-        name: "AES-GCM",
-        iv: blob.slice(BLOB_KEY_ID_LEN, BLOB_KEY_ID_LEN + NONCE_LEN),
-        additionalData: aad
-      },
-      dataKey,
-      blob.slice(BLOB_KEY_ID_LEN + NONCE_LEN)
-    );
-    const payload = _JSONparse(
-      _decodeUtf8(new _TextDecoder(), inflateSync(new _Uint8Array(plaintext)))
-    );
-    return payload && typeof payload === "object" && payload.secrets ? payload.secrets : {};
-  });
-  const manifestValue = secrets[MANIFEST_KEY];
-  setRuntimeManifest(typeof manifestValue === "string" ? manifestValue : "");
-  for (const [key, value] of _ObjectEntries(secrets)) {
-    if (key !== MANIFEST_KEY && typeof value === "string") process.env[key] = value;
-  }
-  installed = true;
-}
-function gateClosed() {
-  if (latchedReason) return latchedReason;
-  return _DateNow() < nextPullAt ? cooldownReason : null;
-}
-function installOnce(challenge, env) {
-  const run = installChain.then(async () => {
-    if (installed) return false;
-    const closed = gateClosed();
-    if (closed) throw new ActivationError(closed);
-    try {
-      await installFromDataKey(await pullDataKey(challenge, env), env);
-      return true;
-    } catch (e) {
-      const reason = reasonOf(e);
-      if (listHas(LATCHED_REASONS, reason)) {
-        latchedReason = reason;
-      } else if (reason !== "endpoint_409") {
-        cooldownReason = reason;
-        nextPullAt = _DateNow() + PULL_COOLDOWN_MS;
-      }
-      console.error(`Base44 runtime-secrets activation failed: ${reason}`);
-      throw new ActivationError(reason);
-    }
-  });
-  installChain = run.then(void 0, () => {
-  });
-  pendingInstall = run;
-  const clear = () => {
-    if (pendingInstall === run) pendingInstall = null;
-  };
-  run.then(clear, clear);
-  return run;
-}
-var PROCEED = Object.freeze({ response: null, pulledMs: null, markerDigest: null });
-async function digestOf(text) {
-  return toBase64Url(new _Uint8Array(await _subtleDigest("SHA-256", _encodeUtf8(new _TextEncoder(), text))));
-}
-function errorDigest(reason, challenge) {
-  return digestOf(`${ERROR_DIGEST_CONTEXT}${reason}.${challenge}`);
-}
-function markerDigest(challenge) {
-  return digestOf(`${MARKER_DIGEST_CONTEXT}${challenge}`);
-}
-async function failure(reason, challenge) {
-  const headers = new _Headers();
-  _headersAppend(headers, ACTIVATION_ERROR_HEADER, reason);
-  if (challenge) {
-    try {
-      _headersAppend(headers, ACTIVATION_DIGEST_HEADER, await errorDigest(reason, challenge));
-    } catch {
-    }
-  }
-  _headersAppend(headers, "Cache-Control", "no-store");
-  return { response: new _Response(null, { status: 503, headers }), pulledMs: null, markerDigest: null };
-}
-async function ensureActivation(challenge, env) {
-  if (installed) return PROCEED;
-  try {
-    if (pendingInstall) {
-      try {
-        await pendingInstall;
-        return PROCEED;
-      } catch {
-      }
-    }
-    if (latchedReason) return await failure(latchedReason, challenge);
-    if (!challenge) return await failure("challenge_missing", null);
-    const closed = gateClosed();
-    if (closed) return await failure(closed, challenge);
-    const started = _DateNow();
-    if (!await installOnce(challenge, env)) return PROCEED;
-    const pulledMs = _DateNow() - started;
-    let digest = null;
-    try {
-      digest = await markerDigest(challenge);
-    } catch {
-    }
-    return { response: null, pulledMs, markerDigest: digest };
-  } catch (e) {
-    return failure(reasonOf(e), challenge);
-  }
-}
-function takeActivationChallenge(request) {
-  const raw = _reqHeaders(request);
-  const challenge = _headersGet(raw, ACTIVATION_CHALLENGE_HEADER);
-  if (challenge === null && _headersGet(raw, RUNTIME_SECRETS_HEADER_LC) === null) return { challenge, request };
-  return { challenge, request: new _Request(request, { headers: headersWithout(raw, INBOUND_HEADERS_LC) }) };
-}
-function withoutActivationHeaders(response, activation) {
-  const raw = _resHeaders(response);
-  let forged = false;
-  for (let i = 0; i < SHIM_RESPONSE_HEADERS_LC.length; i++) {
-    if (_headersGet(raw, SHIM_RESPONSE_HEADERS_LC[i]) !== null) forged = true;
-  }
-  if (!forged) {
-    if (activation.pulledMs === null) return response;
-    try {
-      stampMarker(raw, activation);
-      return response;
-    } catch {
-    }
-  }
-  const headers = headersWithout(raw, SHIM_RESPONSE_HEADERS_LC);
-  if (activation.pulledMs !== null) stampMarker(headers, activation);
-  return new _Response(_resBody(response), {
-    status: _resStatus(response),
-    statusText: _resStatusText(response),
-    headers,
-    // Preserved or a 101 upgrade would fail to reconstruct.
-    webSocket: _resWebSocket ? _resWebSocket(response) : void 0
-  });
-}
-function stampMarker(headers, activation) {
-  _headersAppend(headers, ACTIVATION_MARKER_HEADER, `pulled;ms=${activation.pulledMs}`);
-  if (activation.markerDigest) _headersAppend(headers, ACTIVATION_DIGEST_HEADER, activation.markerDigest);
-}
-function toBase64Url(bytes) {
-  let bin = "";
-  for (const b of bytes) bin += String.fromCharCode(b);
-  return _btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function fromBase64Url(value) {
-  const b64 = value.replace(/-/g, "+").replace(/_/g, "/");
-  const padded = b64 + "=".repeat((4 - b64.length % 4) % 4);
-  const bin = _atob(padded);
-  const bytes = new _Uint8Array(bin.length);
-  for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);
-  return bytes;
-}
-export {
-  activationProof,
-  ensureActivation,
-  errorDigest,
-  markerDigest,
-  takeActivationChallenge,
-  withoutActivationHeaders
-};