@ixo/flow-work 0.5.0 → 0.7.0

package/dist/provider-journal.js

@@ -0,0 +1,94 @@
+import { z } from 'zod';
+import { hash, text, parse, same, } from './bounded-protocol.js';
+const json = z.custom(() => true);
+export class ProviderOutcomeUnknown extends Error {
+    constructor() {
+        super('PROVIDER_OUTCOME_UNKNOWN');
+    }
+}
+/** Provider attempts and pure preparation records share a durable business key, never an attempt id. */
+export class ProviderJournal {
+    storage;
+    constructor(storage) {
+        this.storage = storage;
+        storage.sql.exec(`CREATE TABLE IF NOT EXISTS helper_provider (
+      operation_key TEXT NOT NULL, stage TEXT NOT NULL, fingerprint TEXT NOT NULL,
+      submitted TEXT NOT NULL, state TEXT NOT NULL, result TEXT,
+      PRIMARY KEY(operation_key,stage))`);
+        storage.sql.exec(`CREATE TABLE IF NOT EXISTS helper_preparation (
+      operation_key TEXT NOT NULL, stage TEXT NOT NULL, fingerprint TEXT NOT NULL,
+      result TEXT NOT NULL, PRIMARY KEY(operation_key,stage))`);
+    }
+    async prepare(key, stage, inputs, compute) {
+        const fingerprint = await hash(inputs);
+        const read = () => this.storage.sql
+            .exec('SELECT fingerprint,result FROM helper_preparation WHERE operation_key=? AND stage=?', key, stage)
+            .toArray()[0];
+        const prior = read();
+        if (prior) {
+            if (prior.fingerprint !== fingerprint)
+                throw new Error('PREPARATION_INPUT_CONFLICT');
+            return parse(json, String(prior.result));
+        }
+        const result = text(await compute());
+        return this.storage.transactionSync(() => {
+            this.storage.sql.exec('INSERT OR IGNORE INTO helper_preparation VALUES (?,?,?,?)', key, stage, fingerprint, result);
+            const accepted = read();
+            if (accepted.fingerprint !== fingerprint)
+                throw new Error('PREPARATION_INPUT_CONFLICT');
+            return parse(json, String(accepted.result));
+        });
+    }
+    async execute(options) {
+        const fingerprint = await hash(options.submitted);
+        const read = () => this.storage.sql
+            .exec('SELECT * FROM helper_provider WHERE operation_key=? AND stage=?', options.key, options.stage)
+            .toArray()[0];
+        const first = this.storage.transactionSync(() => {
+            const prior = read();
+            if (prior) {
+                if (prior.fingerprint !== fingerprint ||
+                    prior.submitted !== text(options.submitted))
+                    throw new Error('PROVIDER_FINGERPRINT_CONFLICT');
+                return false;
+            }
+            this.storage.sql.exec(`INSERT INTO helper_provider VALUES (?,?,?,?,'armed',NULL)`, options.key, options.stage, fingerprint, text(options.submitted));
+            return true;
+        });
+        const prior = read();
+        if (prior.state === 'complete')
+            return parse(json, String(prior.result));
+        let result;
+        try {
+            if (first)
+                result = await options.invoke();
+            else {
+                const evidence = await options.readback(parse(json, String(prior.submitted)));
+                if (!evidence.proven)
+                    throw new ProviderOutcomeUnknown();
+                result = evidence.result;
+            }
+            const encoded = text(result);
+            this.storage.transactionSync(() => {
+                const current = read();
+                if (current.result !== null &&
+                    !same(parse(json, String(current.result)), result))
+                    throw new Error('PROVIDER_RESULT_CONFLICT');
+                this.storage.sql.exec(`UPDATE helper_provider SET state='complete',result=? WHERE operation_key=? AND stage=?`, encoded, options.key, options.stage);
+            });
+            return result;
+        }
+        catch (error) {
+            this.storage.sql.exec(`UPDATE helper_provider SET state='needs_verification' WHERE operation_key=? AND stage=? AND state<>'complete'`, options.key, options.stage);
+            throw error;
+        }
+    }
+    /** Restore the exact provider request before any model or calendar default can change it. */
+    submitted(key, stage) {
+        const row = this.storage.sql
+            .exec('SELECT submitted FROM helper_provider WHERE operation_key=? AND stage=?', key, stage)
+            .toArray()[0];
+        return row ? parse(json, String(row.submitted)) : null;
+    }
+}
+//# sourceMappingURL=provider-journal.js.map

package/dist/provider-journal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-journal.js","sourceRoot":"","sources":["../src/provider-journal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,IAAI,EACJ,IAAI,EACJ,KAAK,EACL,IAAI,GAEL,MAAM,uBAAuB,CAAC;AAI/B,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAc,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AAC/C,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C;QACE,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACpC,CAAC;CACF;AACD,wGAAwG;AACxG,MAAM,OAAO,eAAe;IACG;IAA7B,YAA6B,OAAgB;QAAhB,YAAO,GAAP,OAAO,CAAS;QAC3C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;;;wCAGmB,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;;8DAEyC,CAAC,CAAC;IAC9D,CAAC;IACD,KAAK,CAAC,OAAO,CACX,GAAW,EACX,KAAa,EACb,MAAmB,EACnB,OAAmC;QAEnC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,EAAE,CAChB,IAAI,CAAC,OAAO,CAAC,GAAG;aACb,IAAI,CACH,qFAAqF,EACrF,GAAG,EACH,KAAK,CACN;aACA,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAClB,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;QACrB,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW;gBACnC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAChD,OAAO,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,EAAE;YACvC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACnB,2DAA2D,EAC3D,GAAG,EACH,KAAK,EACL,WAAW,EACX,MAAM,CACP,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,EAAG,CAAC;YACzB,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW;gBACtC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAChD,OAAO,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,OAQb;QACC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,GAAG,EAAE,CAChB,IAAI,CAAC,OAAO,CAAC,GAAG;aACb,IAAI,CACH,iEAAiE,EACjE,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,KAAK,CACd;aACA,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,EAAE;YAC9C,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;YACrB,IAAI,KAAK,EAAE,CAAC;gBACV,IACE,KAAK,CAAC,WAAW,KAAK,WAAW;oBACjC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;oBAE3C,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;gBACnD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACnB,2DAA2D,EAC3D,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,KAAK,EACb,WAAW,EACX,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CACxB,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,EAAG,CAAC;QACtB,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,OAAO,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACzE,IAAI,MAAmB,CAAC;QACxB,IAAI,CAAC;YACH,IAAI,KAAK;gBAAE,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;iBACtC,CAAC;gBACJ,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CACrC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CACrC,CAAC;gBACF,IAAI,CAAC,QAAQ,CAAC,MAAM;oBAAE,MAAM,IAAI,sBAAsB,EAAE,CAAC;gBACzD,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC3B,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YAC7B,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,EAAE;gBAChC,MAAM,OAAO,GAAG,IAAI,EAAG,CAAC;gBACxB,IACE,OAAO,CAAC,MAAM,KAAK,IAAI;oBACvB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC;oBAElD,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;gBAC9C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACnB,wFAAwF,EACxF,OAAO,EACP,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,KAAK,CACd,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CACnB,+GAA+G,EAC/G,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,KAAK,CACd,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IACD,6FAA6F;IAC7F,SAAS,CAAC,GAAW,EAAE,KAAa;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG;aACzB,IAAI,CACH,yEAAyE,EACzE,GAAG,EACH,KAAK,CACN;aACA,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,CAAC;CACF"}

package/dist/work-authority.d.ts

@@ -0,0 +1,16 @@
+import { type BoundedWorkBinding } from './bounded-protocol.js';
+import { type ExecutionCatalog, type ExecutionAuthorityPort, type ExecutionDefinitionPort } from './execution-service.js';
+import type { WorkAuthority } from './durable-listener.js';
+/** The helper verifies its exact independently stored routing grant and the current execution authority. */
+export declare class DefinitionWorkAuthority implements WorkAuthority {
+    private readonly definitions;
+    private readonly authority;
+    private readonly catalog;
+    constructor(definitions: ExecutionDefinitionPort, authority: ExecutionAuthorityPort, catalog: Pick<ExecutionCatalog, 'validate'>);
+    authorize(binding: BoundedWorkBinding): Promise<{
+        expiresAt: number;
+        stateVersion: number;
+        grantDigest: string;
+    }>;
+}
+//# sourceMappingURL=work-authority.d.ts.map

package/dist/work-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"work-authority.d.ts","sourceRoot":"","sources":["../src/work-authority.ts"],"names":[],"mappings":"AACA,OAAO,EAML,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAGL,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D,4GAA4G;AAC5G,qBAAa,uBAAwB,YAAW,aAAa;IAEzD,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAFP,WAAW,EAAE,uBAAuB,EACpC,SAAS,EAAE,sBAAsB,EACjC,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,UAAU,CAAC;IAExD,SAAS,CAAC,OAAO,EAAE,kBAAkB;;;;;CA2B5C"}

package/dist/work-authority.js

@@ -0,0 +1,31 @@
+import { decodeDefinitionRecord } from './bounded-definitions.js';
+import { bounded, decodeBoundedJson, encodeBoundedJson, same, } from './bounded-protocol.js';
+import { actionReferenceSchema, workAuthorizationSchema, } from './execution-service.js';
+/** The helper verifies its exact independently stored routing grant and the current execution authority. */
+export class DefinitionWorkAuthority {
+    definitions;
+    authority;
+    catalog;
+    constructor(definitions, authority, catalog) {
+        this.definitions = definitions;
+        this.authority = authority;
+        this.catalog = catalog;
+    }
+    async authorize(binding) {
+        const a = binding.admission;
+        const stored = workAuthorizationSchema.parse(decodeBoundedJson(await this.definitions.readExecutionAuthorization(a.flowId, a.id)));
+        if (!('binding' in stored) || !same(stored.binding, binding))
+            throw new Error('STORED_WORK_AUTHORITY_MISMATCH');
+        const definition = decodeDefinitionRecord(await this.definitions.readExecutionDefinition(a.flowId, a.id));
+        if (definition.category !== 'step' ||
+            definition.value.stepId !== a.stepId ||
+            definition.value.resource !== binding.resource)
+            throw new Error('HELPER_DEFINITION_MISMATCH');
+        const action = bounded(actionReferenceSchema, definition.value.action);
+        if (action.type !== binding.actionType || action.can !== binding.capability)
+            throw new Error('HELPER_CONTRACT_MISMATCH');
+        this.catalog.validate(action);
+        return this.authority.authorizeExecution(a.flowId, encodeBoundedJson(a));
+    }
+}
+//# sourceMappingURL=work-authority.js.map

package/dist/work-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"work-authority.js","sourceRoot":"","sources":["../src/work-authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EACL,OAAO,EACP,iBAAiB,EACjB,iBAAiB,EACjB,IAAI,GAGL,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,qBAAqB,EACrB,uBAAuB,GAIxB,MAAM,wBAAwB,CAAC;AAGhC,4GAA4G;AAC5G,MAAM,OAAO,uBAAuB;IAEf;IACA;IACA;IAHnB,YACmB,WAAoC,EACpC,SAAiC,EACjC,OAA2C;QAF3C,gBAAW,GAAX,WAAW,CAAyB;QACpC,cAAS,GAAT,SAAS,CAAwB;QACjC,YAAO,GAAP,OAAO,CAAoC;IAC3D,CAAC;IACJ,KAAK,CAAC,SAAS,CAAC,OAA2B;QACzC,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;QAC5B,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAC1C,iBAAiB,CACf,MAAM,IAAI,CAAC,WAAW,CAAC,0BAA0B,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAClE,CACF,CAAC;QACF,IAAI,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,sBAAsB,CACvC,MAAM,IAAI,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAC/D,CAAC;QACF,IACE,UAAU,CAAC,QAAQ,KAAK,MAAM;YAC9B,UAAU,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YACpC,UAAU,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ;YAE9C,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,OAAO,CAAC,qBAAqB,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACvE,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,UAAU;YACzE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC,SAAS,CAAC,kBAAkB,CACtC,CAAC,CAAC,MAAM,EACR,iBAAiB,CAAC,CAA2B,CAAC,CAC/C,CAAC;IACJ,CAAC;CACF"}

package/package.json

@@ -1,12 +1,20 @@
 {
   "name": "@ixo/flow-work",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Oracle-side flow-work plugin: accept UCAN-delegated ixo.flow.work invocations from the IXO flow-manager over Matrix and post receipts.",
   "license": "Apache-2.0",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
+    "./bounded": {
+      "types": "./dist/bounded.d.ts",
+      "import": "./dist/bounded.js"
+    },
+    "./node-sqlite": {
+      "types": "./dist/node-sqlite.d.ts",
+      "import": "./dist/node-sqlite.js"
+    },
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
@@ -14,6 +22,30 @@
     "./input": {
       "types": "./dist/input.d.ts",
       "import": "./dist/input.js"
+    },
+    "./input-requests": {
+      "types": "./dist/input-requests.d.ts",
+      "import": "./dist/input-requests.js"
+    },
+    "./protocol": {
+      "types": "./dist/protocol.d.ts",
+      "import": "./dist/protocol.js"
+    },
+    "./listener": {
+      "types": "./dist/listener.d.ts",
+      "import": "./dist/listener.js"
+    },
+    "./capability": {
+      "types": "./dist/capability.d.ts",
+      "import": "./dist/capability.js"
+    },
+    "./ucan": {
+      "types": "./dist/ucan.d.ts",
+      "import": "./dist/ucan.js"
+    },
+    "./matrix-port": {
+      "types": "./dist/matrix-port-types.d.ts",
+      "import": "./dist/matrix-port-types.js"
     }
   },
   "files": [