@contractspec/lib.contracts-integrations 2.0.0

package/dist/node/integrations/runtime.js

@@ -0,0 +1,208 @@
+// src/integrations/runtime.ts
+import { performance } from "node:perf_hooks";
+var DEFAULT_MAX_ATTEMPTS = 3;
+var DEFAULT_BACKOFF_MS = 250;
+
+class IntegrationCallGuard {
+  secretProvider;
+  telemetry;
+  maxAttempts;
+  backoffMs;
+  shouldRetry;
+  sleep;
+  now;
+  constructor(secretProvider, options = {}) {
+    this.secretProvider = secretProvider;
+    this.telemetry = options.telemetry;
+    this.maxAttempts = Math.max(1, options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS);
+    this.backoffMs = options.backoffMs ?? DEFAULT_BACKOFF_MS;
+    this.shouldRetry = options.shouldRetry ?? ((error) => typeof error === "object" && error !== null && ("retryable" in error) && Boolean(error.retryable));
+    this.sleep = options.sleep ?? ((ms) => ms <= 0 ? Promise.resolve() : new Promise((resolve) => setTimeout(resolve, ms)));
+    this.now = options.now ?? (() => new Date);
+  }
+  async executeWithGuards(slotId, operation, _input, resolvedConfig, executor) {
+    const integration = this.findIntegration(slotId, resolvedConfig);
+    if (!integration) {
+      return this.failure({
+        tenantId: resolvedConfig.tenantId,
+        appId: resolvedConfig.appId,
+        environment: resolvedConfig.environment,
+        blueprintName: resolvedConfig.blueprintName,
+        blueprintVersion: resolvedConfig.blueprintVersion,
+        configVersion: resolvedConfig.configVersion,
+        slotId,
+        operation
+      }, undefined, {
+        code: "SLOT_NOT_BOUND",
+        message: `Integration slot "${slotId}" is not bound for tenant "${resolvedConfig.tenantId}".`,
+        retryable: false
+      }, 0);
+    }
+    const status = integration.connection.status;
+    if (status === "disconnected" || status === "error") {
+      return this.failure(this.makeContext(slotId, operation, resolvedConfig), integration, {
+        code: "CONNECTION_NOT_READY",
+        message: `Integration connection "${integration.connection.meta.label}" is in status "${status}".`,
+        retryable: false
+      }, 0);
+    }
+    const secrets = await this.fetchSecrets(integration.connection);
+    let attempt = 0;
+    const started = performance.now();
+    while (attempt < this.maxAttempts) {
+      attempt += 1;
+      try {
+        const data = await executor(integration.connection, secrets);
+        const duration = performance.now() - started;
+        this.emitTelemetry(this.makeContext(slotId, operation, resolvedConfig), integration, "success", duration);
+        return {
+          success: true,
+          data,
+          metadata: {
+            latencyMs: duration,
+            connectionId: integration.connection.meta.id,
+            ownershipMode: integration.connection.ownershipMode,
+            attempts: attempt
+          }
+        };
+      } catch (error) {
+        const duration = performance.now() - started;
+        this.emitTelemetry(this.makeContext(slotId, operation, resolvedConfig), integration, "error", duration, this.errorCodeFor(error), error instanceof Error ? error.message : String(error));
+        const retryable = this.shouldRetry(error, attempt);
+        if (!retryable || attempt >= this.maxAttempts) {
+          return {
+            success: false,
+            error: {
+              code: this.errorCodeFor(error),
+              message: error instanceof Error ? error.message : String(error),
+              retryable,
+              cause: error
+            },
+            metadata: {
+              latencyMs: duration,
+              connectionId: integration.connection.meta.id,
+              ownershipMode: integration.connection.ownershipMode,
+              attempts: attempt
+            }
+          };
+        }
+        await this.sleep(this.backoffMs);
+      }
+    }
+    return {
+      success: false,
+      error: {
+        code: "UNKNOWN_ERROR",
+        message: "Integration call failed after retries.",
+        retryable: false
+      },
+      metadata: {
+        latencyMs: performance.now() - started,
+        connectionId: integration.connection.meta.id,
+        ownershipMode: integration.connection.ownershipMode,
+        attempts: this.maxAttempts
+      }
+    };
+  }
+  findIntegration(slotId, config) {
+    return config.integrations.find((integration) => integration.slot.slotId === slotId);
+  }
+  async fetchSecrets(connection) {
+    if (!this.secretProvider.canHandle(connection.secretRef)) {
+      throw new Error(`Secret provider "${this.secretProvider.id}" cannot handle reference "${connection.secretRef}".`);
+    }
+    const secret = await this.secretProvider.getSecret(connection.secretRef);
+    return this.parseSecret(secret);
+  }
+  parseSecret(secret) {
+    const text = new TextDecoder().decode(secret.data);
+    try {
+      const parsed = JSON.parse(text);
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+        const entries = Object.entries(parsed).filter(([, value]) => typeof value === "string" || typeof value === "number" || typeof value === "boolean");
+        return Object.fromEntries(entries.map(([key, value]) => [key, String(value)]));
+      }
+    } catch {}
+    return { secret: text };
+  }
+  emitTelemetry(context, integration, status, durationMs, errorCode, errorMessage) {
+    if (!this.telemetry || !integration)
+      return;
+    this.telemetry.record({
+      tenantId: context.tenantId,
+      appId: context.appId,
+      environment: context.environment,
+      slotId: context.slotId,
+      integrationKey: integration.connection.meta.integrationKey,
+      integrationVersion: integration.connection.meta.integrationVersion,
+      connectionId: integration.connection.meta.id,
+      status,
+      durationMs,
+      errorCode,
+      errorMessage,
+      occurredAt: this.now(),
+      metadata: {
+        blueprint: `${context.blueprintName}.v${context.blueprintVersion}`,
+        configVersion: context.configVersion,
+        operation: context.operation
+      }
+    });
+  }
+  failure(context, integration, error, attempts) {
+    if (integration) {
+      this.emitTelemetry(context, integration, "error", 0, error.code, error.message);
+    }
+    return {
+      success: false,
+      error,
+      metadata: {
+        latencyMs: 0,
+        connectionId: integration?.connection.meta.id ?? "unknown",
+        ownershipMode: integration?.connection.ownershipMode ?? "managed",
+        attempts
+      }
+    };
+  }
+  makeContext(slotId, operation, config) {
+    return {
+      tenantId: config.tenantId,
+      appId: config.appId,
+      environment: config.environment,
+      blueprintName: config.blueprintName,
+      blueprintVersion: config.blueprintVersion,
+      configVersion: config.configVersion,
+      slotId,
+      operation
+    };
+  }
+  errorCodeFor(error) {
+    if (typeof error === "object" && error !== null && "code" in error && typeof error.code === "string") {
+      return error.code;
+    }
+    return "PROVIDER_ERROR";
+  }
+}
+function ensureConnectionReady(integration) {
+  const status = integration.connection.status;
+  if (status === "disconnected" || status === "error") {
+    throw new Error(`Integration connection "${integration.connection.meta.label}" is in status "${status}".`);
+  }
+}
+function connectionStatusLabel(status) {
+  switch (status) {
+    case "connected":
+      return "connected";
+    case "disconnected":
+      return "disconnected";
+    case "error":
+      return "error";
+    case "unknown":
+    default:
+      return "unknown";
+  }
+}
+export {
+  ensureConnectionReady,
+  connectionStatusLabel,
+  IntegrationCallGuard
+};

package/dist/node/integrations/secrets/aws-secret-manager.js

@@ -0,0 +1,345 @@
+// src/integrations/secrets/provider.ts
+import { Buffer } from "node:buffer";
+
+class SecretProviderError extends Error {
+  provider;
+  reference;
+  code;
+  cause;
+  constructor(params) {
+    super(params.message);
+    this.name = "SecretProviderError";
+    this.provider = params.provider;
+    this.reference = params.reference;
+    this.code = params.code ?? "UNKNOWN";
+    this.cause = params.cause;
+  }
+}
+function parseSecretUri(reference) {
+  if (!reference) {
+    throw new SecretProviderError({
+      message: "Secret reference cannot be empty",
+      provider: "unknown",
+      reference,
+      code: "INVALID"
+    });
+  }
+  const [scheme, rest] = reference.split("://");
+  if (!scheme || !rest) {
+    throw new SecretProviderError({
+      message: `Invalid secret reference: ${reference}`,
+      provider: "unknown",
+      reference,
+      code: "INVALID"
+    });
+  }
+  const queryIndex = rest.indexOf("?");
+  if (queryIndex === -1) {
+    return {
+      provider: scheme,
+      path: rest
+    };
+  }
+  const path = rest.slice(0, queryIndex);
+  const query = rest.slice(queryIndex + 1);
+  const extras = Object.fromEntries(query.split("&").filter(Boolean).map((pair) => {
+    const [keyRaw, valueRaw] = pair.split("=");
+    const key = keyRaw ?? "";
+    const value = valueRaw ?? "";
+    return [decodeURIComponent(key), decodeURIComponent(value)];
+  }));
+  return {
+    provider: scheme,
+    path,
+    extras
+  };
+}
+function normalizeSecretPayload(payload) {
+  if (payload.data instanceof Uint8Array) {
+    return payload.data;
+  }
+  if (payload.encoding === "base64") {
+    return Buffer.from(payload.data, "base64");
+  }
+  if (payload.encoding === "binary") {
+    return Buffer.from(payload.data, "binary");
+  }
+  return Buffer.from(payload.data, "utf-8");
+}
+
+// src/integrations/secrets/aws-secret-manager.ts
+import { Buffer as Buffer2 } from "node:buffer";
+import {
+  CreateSecretCommand,
+  DeleteSecretCommand,
+  GetSecretValueCommand,
+  PutSecretValueCommand,
+  SecretsManagerClient
+} from "@aws-sdk/client-secrets-manager";
+var DEFAULT_DELETE_RECOVERY_DAYS = 7;
+
+class AwsSecretsManagerProvider {
+  id = "aws-secrets-manager";
+  explicitRegion;
+  injectedClient;
+  clientConfig;
+  clientsByRegion = new Map;
+  constructor(options = {}) {
+    this.explicitRegion = options.region;
+    this.injectedClient = options.client;
+    this.clientConfig = options.clientConfig;
+  }
+  canHandle(reference) {
+    try {
+      const parsed = parseSecretUri(reference);
+      return parsed.provider === "aws" && (parsed.path === "secretsmanager" || parsed.path.startsWith("secretsmanager/"));
+    } catch {
+      return false;
+    }
+  }
+  async getSecret(reference, options) {
+    const location = this.parseReference(reference);
+    const client = this.getClient(location.region);
+    const requestedVersion = options?.version ?? location.stage ?? location.version;
+    const input = {
+      SecretId: location.secretId,
+      ...this.buildVersionSelector(requestedVersion)
+    };
+    try {
+      const result = await client.send(new GetSecretValueCommand(input));
+      const data = extractAwsSecretBytes(result, reference, this.id);
+      return {
+        data,
+        version: typeof result.VersionId === "string" && result.VersionId ? result.VersionId : requestedVersion,
+        metadata: {
+          region: location.region,
+          secretId: location.secretId,
+          ...requestedVersion ? { requestedVersion } : {}
+        },
+        retrievedAt: new Date
+      };
+    } catch (error) {
+      throw toAwsSecretProviderError({
+        error,
+        provider: this.id,
+        reference,
+        operation: "getSecret"
+      });
+    }
+  }
+  async setSecret(reference, payload) {
+    const location = this.parseReference(reference);
+    const client = this.getClient(location.region);
+    const bytes = normalizeSecretPayload(payload);
+    try {
+      const result = await client.send(new PutSecretValueCommand({
+        SecretId: location.secretId,
+        SecretBinary: bytes
+      }));
+      const versionId = typeof result.VersionId === "string" && result.VersionId ? result.VersionId : "latest";
+      return {
+        reference: this.buildReference(location.region, location.secretId, {
+          version: versionId
+        }),
+        version: versionId
+      };
+    } catch (error) {
+      if (!isAwsNotFound(error)) {
+        throw toAwsSecretProviderError({
+          error,
+          provider: this.id,
+          reference,
+          operation: "putSecretValue"
+        });
+      }
+      if (looksLikeAwsArn(location.secretId)) {
+        throw new SecretProviderError({
+          message: `Secret not found: ${location.secretId}`,
+          provider: this.id,
+          reference,
+          code: "NOT_FOUND",
+          cause: error
+        });
+      }
+      try {
+        const created = await client.send(new CreateSecretCommand({
+          Name: location.secretId,
+          SecretBinary: bytes
+        }));
+        const versionId = typeof created.VersionId === "string" && created.VersionId ? created.VersionId : "latest";
+        return {
+          reference: this.buildReference(location.region, location.secretId, {
+            version: versionId
+          }),
+          version: versionId
+        };
+      } catch (creationError) {
+        throw toAwsSecretProviderError({
+          error: creationError,
+          provider: this.id,
+          reference,
+          operation: "createSecret"
+        });
+      }
+    }
+  }
+  async rotateSecret(reference, payload) {
+    return this.setSecret(reference, payload);
+  }
+  async deleteSecret(reference) {
+    const location = this.parseReference(reference);
+    const client = this.getClient(location.region);
+    try {
+      await client.send(new DeleteSecretCommand({
+        SecretId: location.secretId,
+        RecoveryWindowInDays: DEFAULT_DELETE_RECOVERY_DAYS
+      }));
+    } catch (error) {
+      throw toAwsSecretProviderError({
+        error,
+        provider: this.id,
+        reference,
+        operation: "deleteSecret"
+      });
+    }
+  }
+  getClient(region) {
+    if (this.injectedClient) {
+      return this.injectedClient;
+    }
+    const cached = this.clientsByRegion.get(region);
+    if (cached) {
+      return cached;
+    }
+    const client = new SecretsManagerClient({
+      ...this.clientConfig ?? {},
+      region
+    });
+    this.clientsByRegion.set(region, client);
+    return client;
+  }
+  parseReference(reference) {
+    const parsed = parseSecretUri(reference);
+    if (parsed.provider !== "aws") {
+      throw new SecretProviderError({
+        message: `Unsupported secret provider: ${parsed.provider}`,
+        provider: this.id,
+        reference,
+        code: "INVALID"
+      });
+    }
+    const segments = parsed.path.split("/").filter(Boolean);
+    if (segments.length < 3 || segments[0] !== "secretsmanager") {
+      throw new SecretProviderError({
+        message: "Expected secret reference format aws://secretsmanager/{region}/{secretIdOrArn}[?version=...]",
+        provider: this.id,
+        reference,
+        code: "INVALID"
+      });
+    }
+    const regionCandidate = segments[1];
+    const region = this.resolveRegion(regionCandidate);
+    const secretId = segments.slice(2).join("/");
+    if (!secretId) {
+      throw new SecretProviderError({
+        message: `Unable to resolve secret id from reference "${parsed.path}"`,
+        provider: this.id,
+        reference,
+        code: "INVALID"
+      });
+    }
+    return {
+      region,
+      secretId,
+      version: parsed.extras?.version,
+      stage: parsed.extras?.stage
+    };
+  }
+  resolveRegion(regionCandidate) {
+    const region = regionCandidate ?? this.explicitRegion ?? process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION;
+    if (!region) {
+      throw new SecretProviderError({
+        message: "AWS region must be provided either in reference (aws://secretsmanager/{region}/...) or via AWS_REGION/AWS_DEFAULT_REGION.",
+        provider: this.id,
+        reference: "aws://secretsmanager//",
+        code: "INVALID"
+      });
+    }
+    return region;
+  }
+  buildVersionSelector(version) {
+    if (!version)
+      return {};
+    if (version === "latest" || version === "current") {
+      return { VersionStage: "AWSCURRENT" };
+    }
+    if (version.startsWith("AWS")) {
+      return { VersionStage: version };
+    }
+    return { VersionId: version };
+  }
+  buildReference(region, secretId, extras) {
+    const base = `aws://secretsmanager/${region}/${secretId}`;
+    const query = extras ? Object.entries(extras).filter(([, value]) => Boolean(value)).map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join("&") : "";
+    return query ? `${base}?${query}` : base;
+  }
+}
+function extractAwsSecretBytes(result, reference, provider) {
+  if (!result || typeof result !== "object") {
+    throw new SecretProviderError({
+      message: "Invalid AWS Secrets Manager response",
+      provider,
+      reference,
+      code: "UNKNOWN",
+      cause: result
+    });
+  }
+  const record = result;
+  if (record.SecretBinary instanceof Uint8Array) {
+    return record.SecretBinary;
+  }
+  if (typeof record.SecretBinary === "string") {
+    return Buffer2.from(record.SecretBinary, "base64");
+  }
+  if (typeof record.SecretString === "string") {
+    return Buffer2.from(record.SecretString, "utf-8");
+  }
+  throw new SecretProviderError({
+    message: "AWS secret value is empty",
+    provider,
+    reference,
+    code: "NOT_FOUND",
+    cause: result
+  });
+}
+function looksLikeAwsArn(secretId) {
+  return secretId.startsWith("arn:aws:secretsmanager:");
+}
+function isAwsNotFound(error) {
+  if (!error || typeof error !== "object")
+    return false;
+  const err = error;
+  if (typeof err.$metadata?.httpStatusCode === "number") {
+    return err.$metadata.httpStatusCode === 404;
+  }
+  return err.name === "ResourceNotFoundException";
+}
+function toAwsSecretProviderError(params) {
+  const { error, provider, reference, operation } = params;
+  if (error instanceof SecretProviderError) {
+    return error;
+  }
+  const httpStatusCode = typeof error === "object" && error !== null && "$metadata" in error && typeof error.$metadata === "object" && error.$metadata?.httpStatusCode;
+  const code = httpStatusCode === 404 ? "NOT_FOUND" : httpStatusCode === 401 || httpStatusCode === 403 ? "FORBIDDEN" : httpStatusCode === 400 ? "INVALID" : "UNKNOWN";
+  const message = error instanceof Error ? error.message : `Unknown error during ${operation}`;
+  return new SecretProviderError({
+    message,
+    provider,
+    reference,
+    code,
+    cause: error
+  });
+}
+export {
+  AwsSecretsManagerProvider
+};

package/dist/node/integrations/secrets/env-secret-provider.js

@@ -0,0 +1,158 @@
+// src/integrations/secrets/provider.ts
+import { Buffer as Buffer2 } from "node:buffer";
+
+class SecretProviderError extends Error {
+  provider;
+  reference;
+  code;
+  cause;
+  constructor(params) {
+    super(params.message);
+    this.name = "SecretProviderError";
+    this.provider = params.provider;
+    this.reference = params.reference;
+    this.code = params.code ?? "UNKNOWN";
+    this.cause = params.cause;
+  }
+}
+function parseSecretUri(reference) {
+  if (!reference) {
+    throw new SecretProviderError({
+      message: "Secret reference cannot be empty",
+      provider: "unknown",
+      reference,
+      code: "INVALID"
+    });
+  }
+  const [scheme, rest] = reference.split("://");
+  if (!scheme || !rest) {
+    throw new SecretProviderError({
+      message: `Invalid secret reference: ${reference}`,
+      provider: "unknown",
+      reference,
+      code: "INVALID"
+    });
+  }
+  const queryIndex = rest.indexOf("?");
+  if (queryIndex === -1) {
+    return {
+      provider: scheme,
+      path: rest
+    };
+  }
+  const path = rest.slice(0, queryIndex);
+  const query = rest.slice(queryIndex + 1);
+  const extras = Object.fromEntries(query.split("&").filter(Boolean).map((pair) => {
+    const [keyRaw, valueRaw] = pair.split("=");
+    const key = keyRaw ?? "";
+    const value = valueRaw ?? "";
+    return [decodeURIComponent(key), decodeURIComponent(value)];
+  }));
+  return {
+    provider: scheme,
+    path,
+    extras
+  };
+}
+function normalizeSecretPayload(payload) {
+  if (payload.data instanceof Uint8Array) {
+    return payload.data;
+  }
+  if (payload.encoding === "base64") {
+    return Buffer2.from(payload.data, "base64");
+  }
+  if (payload.encoding === "binary") {
+    return Buffer2.from(payload.data, "binary");
+  }
+  return Buffer2.from(payload.data, "utf-8");
+}
+
+// src/integrations/secrets/env-secret-provider.ts
+class EnvSecretProvider {
+  id = "env";
+  aliases;
+  constructor(options = {}) {
+    this.aliases = options.aliases ?? {};
+  }
+  canHandle(reference) {
+    const envKey = this.resolveEnvKey(reference);
+    return envKey !== undefined && process.env[envKey] !== undefined;
+  }
+  async getSecret(reference) {
+    const envKey = this.resolveEnvKey(reference);
+    if (!envKey) {
+      throw new SecretProviderError({
+        message: `Unable to resolve environment variable for reference "${reference}".`,
+        provider: this.id,
+        reference,
+        code: "INVALID"
+      });
+    }
+    const value = process.env[envKey];
+    if (value === undefined) {
+      throw new SecretProviderError({
+        message: `Environment variable "${envKey}" not found for reference "${reference}".`,
+        provider: this.id,
+        reference,
+        code: "NOT_FOUND"
+      });
+    }
+    return {
+      data: Buffer.from(value, "utf-8"),
+      version: "current",
+      metadata: {
+        source: "env",
+        envKey
+      },
+      retrievedAt: new Date
+    };
+  }
+  async setSecret(reference, _payload) {
+    throw this.forbiddenError("setSecret", reference);
+  }
+  async rotateSecret(reference, _payload) {
+    throw this.forbiddenError("rotateSecret", reference);
+  }
+  async deleteSecret(reference) {
+    throw this.forbiddenError("deleteSecret", reference);
+  }
+  resolveEnvKey(reference) {
+    if (!reference) {
+      return;
+    }
+    if (this.aliases[reference]) {
+      return this.aliases[reference];
+    }
+    if (!reference.includes("://")) {
+      return reference;
+    }
+    try {
+      const parsed = parseSecretUri(reference);
+      if (parsed.provider === "env") {
+        return parsed.path;
+      }
+      if (parsed.extras?.env) {
+        return parsed.extras.env;
+      }
+      return this.deriveEnvKey(parsed.path);
+    } catch {
+      return reference;
+    }
+  }
+  deriveEnvKey(path) {
+    if (!path)
+      return;
+    return path.split(/[\/:\-\.]/).filter(Boolean).map((segment) => segment.replace(/[^a-zA-Z0-9]/g, "_").replace(/_{2,}/g, "_").toUpperCase()).join("_");
+  }
+  forbiddenError(operation, reference) {
+    return new SecretProviderError({
+      message: `EnvSecretProvider is read-only. "${operation}" is not allowed for ${reference}.`,
+      provider: this.id,
+      reference,
+      code: "FORBIDDEN"
+    });
+  }
+}
+export {
+  EnvSecretProvider
+};