@codemation/core-nodes 0.9.0 → 0.10.1

package/CHANGELOG.md

@@ -1,5 +1,50 @@
 # @codemation/core-nodes
 
+## 0.10.1
+
+### Patch Changes
+
+- Updated dependencies [[`2fcb715`](https://github.com/MadeRelevant/codemation/commit/2fcb7153d9c732b2f846b8a8d1cc5626b4363fa6)]:
+  - @codemation/core@0.13.1
+
+## 0.10.0
+
+### Minor Changes
+
+- [#184](https://github.com/MadeRelevant/codemation/pull/184) [`8c5b213`](https://github.com/MadeRelevant/codemation/commit/8c5b213092501bb48aa0c575b0489bbd36b46c79) Thanks [@cblokland90](https://github.com/cblokland90)! - Add `CodemationDocumentScanner` node — managed document/image analysis returning `{ markdown, fields }` via the Codemation doc-scanner service, no Azure credential required.
+
+### Patch Changes
+
+- [#187](https://github.com/MadeRelevant/codemation/pull/187) [`cf45e88`](https://github.com/MadeRelevant/codemation/commit/cf45e88c28dcb3ba87bcf14e34c550ae0ac036e8) Thanks [@cblokland90](https://github.com/cblokland90)! - fix(aiagent): managed structured output no longer throws "schema is not a function"
+
+  AIAgentNode passed a consumer-created Zod `outputSchema` straight to the AI SDK's
+  `Output.object` on the managed (non-OpenAI) path. Consumer workflows build that schema
+  with their own tsx-loaded Zod — a different runtime copy than the framework's Zod — so the
+  SDK threw "schema is not a function". Now the schema is converted to a plain JSON Schema via
+  the schema's own instance method (`createJsonSchemaRecord`, dual-zod safe) and wrapped with
+  `jsonSchema()` for both paths, so `Output.object` never receives a raw cross-namespace Zod.
+
+- [#189](https://github.com/MadeRelevant/codemation/pull/189) [`c1b081f`](https://github.com/MadeRelevant/codemation/commit/c1b081ffc8b66b0c4593c94f1d57a1cdf5c41140) Thanks [@cblokland90](https://github.com/cblokland90)! - feat(core): add `getBytes`, `getText`, and `getJson<T>` to the binary API
+
+  `ExecutionBinaryService` (and `NodeBinaryAttachmentService`) now expose three read helpers:
+  - `getBytes(attachment, maxBytes?)` — bounded read into `Uint8Array` (size-checked before allocation).
+  - `getText(attachment, maxBytes?)` — bounded read + UTF-8 decode.
+  - `getJson<T>(attachment, maxBytes?)` — bounded read + decode + `JSON.parse` with a clear `SyntaxError` on invalid JSON.
+
+  The duplicate `readBinaryBody` helpers previously copied across `core-nodes` and `core-nodes-ocr` are removed; all callers now use `ctx.binary.getBytes()`. `openReadStream` remains for true streaming use cases.
+
+- [#184](https://github.com/MadeRelevant/codemation/pull/184) [`8c5b213`](https://github.com/MadeRelevant/codemation/commit/8c5b213092501bb48aa0c575b0489bbd36b46c79) Thanks [@cblokland90](https://github.com/cblokland90)! - Extract `managedHmacFetchFactory` from `CodemationChatModelFactory` into a shared
+  `ManagedHmacSignerFactory` module (story 05, doc-scanner sprint).
+
+  The helper is a package-internal refactor: not added to the public barrel export,
+  no public API surface change — patch is correct. It adds a `signBody` option
+  (default `true`, preserving LLM-chat behaviour) that implements LD11
+  empty-body-hash signing for the upcoming `CodemationDocumentScanner` node
+  (story 06).
+
+- Updated dependencies [[`c1b081f`](https://github.com/MadeRelevant/codemation/commit/c1b081ffc8b66b0c4593c94f1d57a1cdf5c41140), [`be520d2`](https://github.com/MadeRelevant/codemation/commit/be520d2755144a3709ecc109019b84e2c502337e)]:
+  - @codemation/core@0.13.0
+
 ## 0.9.0
 
 ### Minor Changes

package/dist/index.cjs

@@ -4389,6 +4389,59 @@ var OpenAiChatModelPresets = class {
 };
 const openAiChatModelPresets = new OpenAiChatModelPresets();
 
+//#endregion
+//#region src/chatModels/ManagedHmacSignerFactory.types.ts
+/**
+* Creates an HMAC-signing fetch wrapper that authenticates requests to
+* Codemation managed services (LLM broker, doc-scanner) with the
+* Codemation-Hmac v=1 scheme.
+*
+* Mirrors HmacRequestSigner from @codemation/host/pairing without importing
+* that package (which would create a circular dependency since @codemation/host
+* depends on @codemation/core-nodes).
+*
+* @param workspaceId   - Workspace identifier injected by the CP provisioner.
+* @param pairingSecret - Base64-encoded 32-byte HMAC key injected by the provisioner.
+* @param options       - Optional behaviour flags and test seams.
+*/
+function managedHmacFetchFactory(workspaceId, pairingSecret, options) {
+	const signBody = options?.signBody ?? true;
+	return async (input, init) => {
+		const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+		const method = init?.method ?? "POST";
+		let bodyForSigning = "";
+		if (signBody && init?.body !== void 0 && init.body !== null) bodyForSigning = typeof init.body === "string" ? init.body : await new Response(init.body).text();
+		const authHeader = buildHmacAuthHeader(workspaceId, pairingSecret, method, url, bodyForSigning, options);
+		const headers = new Headers(init?.headers);
+		headers.set("Authorization", authHeader);
+		const outgoingBody = signBody ? bodyForSigning || init?.body : init?.body;
+		return fetch(input, {
+			...init,
+			body: outgoingBody,
+			headers
+		});
+	};
+}
+/**
+* Produces a Codemation-Hmac v=1 Authorization header value.
+* Algorithm must match HmacVerifier.computeSignature() in the control-plane.
+*/
+function buildHmacAuthHeader(workspaceId, pairingSecret, method, url, body, overrides) {
+	const ts = overrides?.now ? overrides.now() : Math.floor(Date.now() / 1e3);
+	const nonce = overrides?.nonce ? overrides.nonce() : (0, node_crypto.randomBytes)(16).toString("base64");
+	const parsed = new URL(url);
+	const path = (parsed.pathname + parsed.search).toLowerCase();
+	const bodyHash = (0, node_crypto.createHash)("sha256").update(body, "utf8").digest("hex");
+	const baseString = [
+		method.toUpperCase(),
+		path,
+		ts,
+		nonce,
+		bodyHash
+	].join("\n");
+	return `Codemation-Hmac v=1,workspaceId=${workspaceId},ts=${ts},nonce=${nonce},sig=${(0, node_crypto.createHmac)("sha256", Buffer.from(pairingSecret, "base64")).update(baseString, "utf8").digest("base64")}`;
+}
+
 //#endregion
 //#region src/chatModels/CodemationChatModelFactory.ts
 let CodemationChatModelFactory = class CodemationChatModelFactory$1 {
@@ -4398,7 +4451,7 @@ let CodemationChatModelFactory = class CodemationChatModelFactory$1 {
 		const workspaceId = process.env["WORKSPACE_ID"];
 		const pairingSecret = process.env["WORKSPACE_PAIRING_SECRET"];
 		if (!workspaceId || !pairingSecret) throw new Error("Codemation managed AI not available in this environment (workspace pairing is not configured).");
-		const hmacFetch = this.buildHmacSignedFetch(workspaceId, pairingSecret);
+		const hmacFetch = managedHmacFetchFactory(workspaceId, pairingSecret);
 		const languageModel = (0, __ai_sdk_openai.createOpenAI)({
 			baseURL: `${gatewayUrl}/v1`,
 			apiKey: "codemation-managed",
@@ -4414,52 +4467,6 @@ let CodemationChatModelFactory = class CodemationChatModelFactory$1 {
 			}
 		});
 	}
-	/**
-	* Creates an HMAC-signed fetch wrapper for use with AI SDK's createOpenAI.
-	* Each call signs the request body with the workspace pairing secret so the
-	* LLM broker can authenticate the workspace without a user-managed API key.
-	*
-	* Mirrors HmacRequestSigner from @codemation/host/pairing without importing
-	* that package (which would create a circular dependency since @codemation/host
-	* depends on @codemation/core-nodes).
-	*/
-	buildHmacSignedFetch(workspaceId, pairingSecret) {
-		return async (input, init) => {
-			const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
-			const method = init?.method ?? "POST";
-			let bodyString = "";
-			if (init?.body !== void 0 && init.body !== null) if (typeof init.body === "string") bodyString = init.body;
-			else bodyString = await new Response(init.body).text();
-			const authHeader = this.buildHmacAuthHeader(workspaceId, pairingSecret, method, url, bodyString);
-			const headers = new Headers(init?.headers);
-			headers.set("Authorization", authHeader);
-			const effectiveBody = bodyString || init?.body;
-			return fetch(input, {
-				...init,
-				body: effectiveBody,
-				headers
-			});
-		};
-	}
-	/**
-	* Produces a Codemation-Hmac v1 Authorization header value.
-	* The algorithm must match HmacVerifier.computeSignature() in the control-plane.
-	*/
-	buildHmacAuthHeader(workspaceId, pairingSecret, method, url, body) {
-		const ts = Math.floor(Date.now() / 1e3);
-		const nonce = (0, node_crypto.randomBytes)(16).toString("base64");
-		const parsed = new URL(url);
-		const path = (parsed.pathname + parsed.search).toLowerCase();
-		const bodyHash = (0, node_crypto.createHash)("sha256").update(body, "utf8").digest("hex");
-		const baseString = [
-			method.toUpperCase(),
-			path,
-			ts,
-			nonce,
-			bodyHash
-		].join("\n");
-		return `Codemation-Hmac v=1,workspaceId=${workspaceId},ts=${ts},nonce=${nonce},sig=${(0, node_crypto.createHmac)("sha256", Buffer.from(pairingSecret, "base64")).update(baseString, "utf8").digest("base64")}`;
-	}
 };
 CodemationChatModelFactory = __decorate([(0, __codemation_core.chatModel)({ packageName: "@codemation/core-nodes" })], CodemationChatModelFactory);
 
@@ -6815,7 +6822,11 @@ let AIAgentNode = class AIAgentNode$1 {
 		});
 		try {
 			const callOptions = this.resolveCallOptions(model, guardrails.modelInvocationOptions);
-			const outputSchema = structuredOptions?.strict && !this.isZodSchema(schema) ? ai.Output.object({ schema: (0, ai.jsonSchema)(schema) }) : ai.Output.object({ schema });
+			const schemaRecord = this.isZodSchema(schema) ? this.executionHelpers.createJsonSchemaRecord(schema, {
+				schemaName: structuredOptions?.schemaName ?? "structured_output",
+				requireObjectRoot: true
+			}) : schema;
+			const outputSchema = ai.Output.object({ schema: (0, ai.jsonSchema)(schemaRecord) });
 			const result = await (0, ai.generateText)({
 				model: model.languageModel,
 				messages: [...messages],
@@ -9051,6 +9062,86 @@ const inboxApproval = (0, __codemation_core.defineHumanApprovalNode)({
 	}
 });
 
+//#endregion
+//#region src/nodes/codemationDocumentScannerNode.ts
+const ANALYZER_TYPES = [
+	"document",
+	"invoice",
+	"image",
+	"auto"
+];
+const codemationDocumentScannerNode = (0, __codemation_core.defineNode)({
+	key: "codemation.document-scanner",
+	title: "Codemation Document Scanner",
+	description: "Analyzes a binary attachment (document or image) via the managed Codemation document-scanning service and returns markdown text plus structured fields. No Azure credential required — auth uses the workspace pairing secret. Enable includeConfidence to get per-field confidence scores (0–1).",
+	icon: "lucide:scan-text",
+	input: {
+		binaryField: "data",
+		analyzerType: "auto",
+		contentType: void 0,
+		includeConfidence: false,
+		maxBytes: void 0
+	},
+	configSchema: object({
+		binaryField: string().optional(),
+		analyzerType: _enum(ANALYZER_TYPES).optional(),
+		contentType: string().optional(),
+		includeConfidence: boolean().optional(),
+		maxBytes: number().int().positive().optional()
+	}),
+	inspectorSummary({ config: config$1 }) {
+		const cfg = config$1;
+		const rows = [{
+			label: "Analyzer type",
+			value: cfg.analyzerType ?? "auto"
+		}];
+		const binaryField = cfg.binaryField ?? "data";
+		if (binaryField !== "data") rows.push({
+			label: "Binary field",
+			value: binaryField
+		});
+		if (cfg.includeConfidence) rows.push({
+			label: "Confidence",
+			value: "enabled"
+		});
+		if (cfg.contentType) rows.push({
+			label: "Content type",
+			value: cfg.contentType
+		});
+		return rows;
+	},
+	async execute({ item, ctx }, { config: rawConfig }) {
+		const config$1 = rawConfig;
+		const gatewayUrl = process.env["DOC_SCANNER_GATEWAY_URL"];
+		if (!gatewayUrl) throw new Error("Codemation Document Scanner not available in this environment (DOC_SCANNER_GATEWAY_URL is not set).");
+		const workspaceId = process.env["WORKSPACE_ID"];
+		const pairingSecret = process.env["WORKSPACE_PAIRING_SECRET"];
+		if (!workspaceId || !pairingSecret) throw new Error("Codemation Document Scanner not available (workspace pairing is not configured).");
+		const binaryField = config$1.binaryField ?? "data";
+		const attachment = item.binary?.[binaryField];
+		if (!attachment) throw new Error(`Codemation Document Scanner: no binary attachment at key "${binaryField}".`);
+		const body = await ctx.binary.getBytes(attachment, config$1.maxBytes);
+		const contentType = config$1.contentType ?? attachment.mimeType ?? "application/octet-stream";
+		const analyzerType = config$1.analyzerType ?? "auto";
+		const confidenceSuffix = config$1.includeConfidence ?? false ? "&confidence=true" : "";
+		const url = `${gatewayUrl}/analyze?type=${encodeURIComponent(analyzerType)}${confidenceSuffix}`;
+		const response = await managedHmacFetchFactory(workspaceId, pairingSecret, { signBody: false })(url, {
+			method: "POST",
+			body: body.buffer,
+			headers: {
+				"Content-Type": contentType,
+				"Content-Length": String(body.byteLength),
+				"X-Codemation-Caller": "workflow-node"
+			}
+		});
+		if (!response.ok) {
+			const text = await response.text().catch(() => "(unreadable)");
+			throw new Error(`Codemation Document Scanner: service responded ${response.status} ${response.statusText} — ${text}`);
+		}
+		return await response.json();
+	}
+});
+
 //#endregion
 exports.AIAgent = AIAgent;
 exports.AIAgentConnectionWorkflowExpander = AIAgentConnectionWorkflowExpander;
@@ -9279,6 +9370,7 @@ exports.WorkflowChain = WorkflowChain;
 exports.apiKeyCredentialType = apiKeyCredentialType;
 exports.basicAuthCredentialType = basicAuthCredentialType;
 exports.bearerTokenCredentialType = bearerTokenCredentialType;
+exports.codemationDocumentScannerNode = codemationDocumentScannerNode;
 exports.collectionDeleteNode = collectionDeleteNode;
 exports.collectionFindOneNode = collectionFindOneNode;
 exports.collectionGetNode = collectionGetNode;