@lostgradient/weft 0.2.1 → 0.4.0

package/dist/server/authentication/constant-time-api-key.js

@@ -0,0 +1,24 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+function digestApiKey(key) {
+  return createHash("sha256").update(key, "utf8").digest();
+}
+export function createConstantTimeApiKeyEntry(key, value) {
+  return { digest: digestApiKey(key), value };
+}
+export function createConstantTimeApiKeyMatcher(keys) {
+  const entries = keys.map((entry) => typeof entry === "string" ? createConstantTimeApiKeyEntry(entry, void 0) : createConstantTimeApiKeyEntry(entry.key, entry.value));
+  return {
+    entries,
+    matches(presentedKey) {
+      return findConstantTimeApiKeyMatch(presentedKey, entries) !== null;
+    }
+  };
+}
+export function findConstantTimeApiKeyMatch(presentedKey, entries) {
+  const presentedDigest = digestApiKey(presentedKey);
+  let matchedIndex = -1;
+  for (let index = 0;index < entries.length; index += 1)
+    if (timingSafeEqual(presentedDigest, entries[index].digest))
+      matchedIndex = index;
+  return matchedIndex === -1 ? null : entries[matchedIndex];
+}

package/dist/server/authentication/index.d.ts

@@ -36,7 +36,7 @@ export declare function validateAuthConfig(config: AuthConfig): void;
  *
  * The returned function checks each configured method in order:
  * 1. Public path bypass
- * 2. API key (O(1) set lookup)
+ * 2. API key (constant-time digest scan)
  * 3. JWT (signature + claims verification)
  * 4. mTLS (transport-level — any request that reaches the handler is authenticated)
  *

package/dist/server/authentication/index.js

@@ -1,5 +1,8 @@
 import { tryAdmitApiKey } from "./api-key.js";
 import { defaultAuthAuditSink, emitAuthAuditEvent } from "./audit.js";
+import {
+  createConstantTimeApiKeyMatcher
+} from "./constant-time-api-key.js";
 import { importJWTKey, verifyJWT } from "./crypto.js";
 import {
   DEFAULT_PUBLIC_PATHS,
@@ -52,10 +55,10 @@ function assertNoConflictingMethods(config) {
     throw Error("AuthConfig cannot combine resolveApiKeyPrincipal with jwt: the resolver consumes every Authorization: Bearer token before JWT verification, so the JWT method would be unreachable.");
 }
 async function authenticateViaApiKey(request, options) {
-  const presentedKey = extractApiKey(request), hasApiKeyPath = options.resolver !== void 0 || options.apiKeySet !== null;
+  const presentedKey = extractApiKey(request), hasApiKeyPath = options.resolver !== void 0 || options.apiKeyEntries !== null;
   if (!presentedKey || !hasApiKeyPath)
     return { explicitAuthAttempted: !1, result: null };
-  const result = await tryAdmitApiKey(presentedKey, options.resolver, options.apiKeySet, options.defaultApiKeyScopes);
+  const result = await tryAdmitApiKey(presentedKey, options.resolver, options.apiKeyEntries, options.defaultApiKeyScopes);
   return {
     explicitAuthAttempted: !0,
     result: result === "continue" ? null : result
@@ -83,13 +86,13 @@ export function validateAuthConfig(config) {
 }
 export async function createAuthenticator(config) {
   validateAuthConfig(config);
-  const apiKeySet = config.apiKeys?.length ? new Set(config.apiKeys) : null, resolver = config.resolveApiKeyPrincipal, defaultApiKeyScopes = config.defaultApiKeyScopes ?? [], jwtKey = config.jwt ? await importJWTKey(config.jwt) : null, publicPaths = new Set(config.publicPaths ?? DEFAULT_PUBLIC_PATHS), auditSink = config.auditSink ?? defaultAuthAuditSink;
+  const apiKeyEntries = config.apiKeys?.length ? createConstantTimeApiKeyMatcher(config.apiKeys).entries : null, resolver = config.resolveApiKeyPrincipal, defaultApiKeyScopes = config.defaultApiKeyScopes ?? [], jwtKey = config.jwt ? await importJWTKey(config.jwt) : null, publicPaths = new Set(config.publicPaths ?? DEFAULT_PUBLIC_PATHS), auditSink = config.auditSink ?? defaultAuthAuditSink;
   return async (request) => {
     if (publicPaths.has(normalizeRequestPathname(request)))
       return { authenticated: !0, method: "public" };
     const apiKeyAttempt = await authenticateViaApiKey(request, {
       resolver,
-      apiKeySet,
+      apiKeyEntries,
       defaultApiKeyScopes
     });
     if (apiKeyAttempt.result !== null)

package/dist/server/authentication/rotating-api-key-store.d.ts

@@ -15,9 +15,11 @@
  * authenticate. Each key may also carry an absolute `expiresAt`, after which it
  * is rejected automatically without an explicit revoke.
  *
- * Lookups are constant-time map reads; the comparison is the map key itself,
- * not a per-byte string compare, so no early-exit timing channel is introduced
- * beyond what the JS engine's map hashing already does.
+ * Registration hashes stored keys to fixed-length digests once. Authentication
+ * lookups hash the presented key, then compare it with every stored digest via
+ * `timingSafeEqual` without early exit. The digest step avoids raw length
+ * checks, and scanning every digest avoids key-position leaks during the
+ * overlap window.
  *
  * @module server/authentication/rotating-api-key-store
  */

package/dist/server/authentication/rotating-api-key-store.js

@@ -1,28 +1,36 @@
 import { principalFromApiKey } from "../principal.js";
+import {
+  createConstantTimeApiKeyEntry,
+  findConstantTimeApiKeyMatch
+} from "./constant-time-api-key.js";
 function isExpired(stored, currentTime) {
   return stored.expiresAt !== void 0 && currentTime >= stored.expiresAt;
 }
 export function createRotatingApiKeyStore(now = Date.now) {
   const keys = new Map;
+  function findStoredKey(presentedKey) {
+    return findConstantTimeApiKeyMatch(presentedKey, [...keys.values()])?.value ?? null;
+  }
   return {
     add(key, registration) {
       if (key.length === 0)
         throw Error("Cannot register an empty API key");
-      keys.set(key, {
+      const stored = {
         subject: registration.subject,
         scopes: registration.scopes ?? [],
         expiresAt: registration.expiresAt
-      });
+      };
+      keys.set(key, createConstantTimeApiKeyEntry(key, { key, stored }));
     },
     revoke(key) {
       return keys.delete(key);
     },
     has(key) {
-      const stored = keys.get(key);
-      if (stored === void 0)
+      const match = findStoredKey(key);
+      if (match === null)
         return !1;
-      if (isExpired(stored, now())) {
-        keys.delete(key);
+      if (isExpired(match.stored, now())) {
+        keys.delete(match.key);
         return !1;
       }
       return !0;
@@ -31,13 +39,13 @@ export function createRotatingApiKeyStore(now = Date.now) {
       return keys.size;
     },
     resolve(presentedKey) {
-      const stored = keys.get(presentedKey);
-      if (stored === void 0 || isExpired(stored, now())) {
-        if (stored !== void 0)
-          keys.delete(presentedKey);
+      const match = findStoredKey(presentedKey);
+      if (match === null || isExpired(match.stored, now())) {
+        if (match !== null)
+          keys.delete(match.key);
         return Promise.resolve(null);
       }
-      return Promise.resolve(principalFromApiKey({ subject: stored.subject, scopes: stored.scopes }));
+      return Promise.resolve(principalFromApiKey({ subject: match.stored.subject, scopes: match.stored.scopes }));
     }
   };
 }

package/dist/server/engine-event-feed-backend.d.ts

@@ -9,11 +9,10 @@
  * share the same source of truth — the unified
  * `replayWorkflowFeed` / `snapshotWorkflowFeedTail` /
  * `subscribeWorkflowFeedCommits` triple on `Engine`. The subscription
- * fires only AFTER `storage.batch()` (events) or `storage.put()`
- * (tokens) resolves, so an event in the live buffer is already
- * durable and scannable by `replayWorkflowFeed`. This is the
- * invariant the feed's atomic-handoff (buffer-then-snapshot-then-
- * replay-then-drain) relies on.
+ * fires only AFTER the storage commit resolves, so an event in the live buffer
+ * is already durable and scannable by `replayWorkflowFeed`. This is the
+ * invariant the feed's atomic-handoff (buffer-then-snapshot-then-replay-then-
+ * drain) relies on.
  *
  * The backend is intentionally stateless — it holds only the `Engine`
  * reference. Listener state lives on the engine and is cleaned up by

package/dist/server/fault-to-http.js

@@ -18,7 +18,14 @@ function shapeTimeoutBody(base, data) {
   return Object.keys(defined).length === 0 ? base : { ...base, data: defined };
 }
 function shapeNotFoundBody(base, data) {
-  return data.identifier === void 0 ? { ...base, data: { resource: data.resource } } : { ...base, data };
+  const shaped = {
+    resource: data.resource
+  };
+  if (data.identifier !== void 0)
+    shaped.identifier = data.identifier;
+  if (data.weftCode !== void 0)
+    shaped.weftCode = data.weftCode;
+  return { ...base, data: shaped };
 }
 function filterDefined(input) {
   const output = {};

package/dist/server/fault-to-json-rpc.js

@@ -19,6 +19,7 @@ const EMPTY = {}, FAULT_DATA_EXTRACTORS = {
   Conflict: dataForConflict,
   NotFound: dataForNotFound,
   Timeout: dataForTimeout,
+  PayloadTooLarge: (data) => ({ maxBytes: data.maxBytes }),
   UnsupportedTransport: dataForUnsupportedTransport,
   SubscriptionOverflow: dataForSubscriptionOverflow,
   InvalidParams: dataForInvalidParams,

package/dist/server/fleet-event-feed.d.ts

@@ -0,0 +1,31 @@
+import { type Storage } from '../storage/interface.ts';
+import { type Cursor, type FeedEventKind, type ReplayLiveSubscribeOptions, type WorkflowEventFeedOptions } from './workflow-event-feed.ts';
+export type FleetEventEnvelope = {
+    readonly kind: FeedEventKind;
+    readonly workflowId?: string | undefined;
+    readonly sequence: number;
+    readonly cursor: Cursor;
+    readonly emittedAtMs: number;
+    readonly payload: unknown;
+};
+export type FleetEventInput = {
+    readonly kind: FeedEventKind;
+    readonly workflowId?: string | undefined;
+    readonly emittedAtMs: number;
+    readonly payload: unknown;
+};
+export type FleetWorkflowEventInput = FleetEventInput & {
+    readonly workflowId: string;
+};
+export type FleetEventFeed = {
+    append(event: FleetEventInput): Promise<FleetEventEnvelope>;
+    appendWorkflowEventIfPresent(event: FleetWorkflowEventInput): Promise<FleetEventEnvelope | null>;
+    replay(options?: {
+        fromCursor?: Cursor;
+        limit?: number;
+    }): AsyncIterable<FleetEventEnvelope>;
+    subscribe(options?: ReplayLiveSubscribeOptions<FleetEventEnvelope>): AsyncIterable<FleetEventEnvelope>;
+    snapshotTailSequence(): Promise<number>;
+    dispose(): void;
+};
+export declare function createFleetEventFeed(storage: Storage, feedOptions?: WorkflowEventFeedOptions): FleetEventFeed;

package/dist/server/fleet-event-feed.js

@@ -0,0 +1,157 @@
+import { decode, encode } from "../core/codec.js";
+import {
+  KEYS,
+  storageConditionalBatch
+} from "../storage/interface.js";
+import {
+  createReplayLiveFeed,
+  decodeCursor,
+  encodeCursor
+} from "./workflow-event-feed.js";
+const MAX_WORKFLOW_OWNED_APPEND_ATTEMPTS = 5;
+export function createFleetEventFeed(storage, feedOptions) {
+  const listeners = new Set;
+  let sequenceInitPromise = null, nextSequence = null, appendChain = Promise.resolve();
+  const replayLiveFeed = createReplayLiveFeed({
+    replay: replayPersistedFleetEvents,
+    snapshotTailSequence,
+    subscribeLive
+  }, feedOptions);
+  async function initializeNextSequence() {
+    if (nextSequence !== null)
+      return nextSequence;
+    if (sequenceInitPromise)
+      return sequenceInitPromise;
+    sequenceInitPromise = snapshotTailSequence().then((tailSequence) => {
+      nextSequence = tailSequence + 1;
+      return nextSequence;
+    }).catch((error) => {
+      sequenceInitPromise = null;
+      throw error;
+    });
+    return sequenceInitPromise;
+  }
+  async function append(event) {
+    return appendInternal(event);
+  }
+  async function appendWorkflowEventIfPresent(event) {
+    return appendInternal(event, async () => {
+      const workflowValue = await storage.get(KEYS.workflow(event.workflowId));
+      if (workflowValue === null)
+        return null;
+      return [{ key: KEYS.workflow(event.workflowId), expectedValue: workflowValue }];
+    });
+  }
+  async function appendInternal(event, loadConditions) {
+    const appended = appendChain.then(async () => {
+      for (let attempt = 1;attempt <= MAX_WORKFLOW_OWNED_APPEND_ATTEMPTS; attempt += 1) {
+        const conditions = loadConditions === void 0 ? void 0 : await loadConditions();
+        if (conditions === null)
+          return null;
+        const sequence = await initializeNextSequence(), envelope = {
+          kind: event.kind,
+          sequence,
+          cursor: encodeCursor(sequence),
+          emittedAtMs: event.emittedAtMs,
+          ...event.workflowId !== void 0 ? { workflowId: event.workflowId } : {},
+          payload: event.payload
+        }, operations = [
+          { type: "put", key: KEYS.fleetEvent(sequence), value: encode(envelope) },
+          { type: "put", key: KEYS.fleetEventTail(), value: encode({ sequence }) }
+        ];
+        if (event.workflowId !== void 0)
+          operations.push({
+            type: "put",
+            key: KEYS.fleetEventByWorkflow(event.workflowId, sequence),
+            value: new Uint8Array
+          });
+        if (conditions === void 0)
+          await storage.batch(operations);
+        else if (!await storageConditionalBatch(storage, [...conditions], operations))
+          continue;
+        nextSequence = sequence + 1;
+        fireLive(envelope);
+        return envelope;
+      }
+      throw Error(`Fleet event append for workflow "${event.workflowId ?? "<none>"}" lost its storage precondition after ${MAX_WORKFLOW_OWNED_APPEND_ATTEMPTS} attempts.`);
+    });
+    appendChain = appended.then(() => {
+      return;
+    }, () => {
+      return;
+    });
+    return appended;
+  }
+  async function* replayPersistedFleetEvents(options) {
+    const scanOptions = options.afterSequence >= 0 ? { gt: KEYS.fleetEvent(options.afterSequence) } : void 0;
+    for await (const [key, value] of storage.scan(KEYS.fleetEventPrefix(), scanOptions)) {
+      const sequence = parseFleetEventSequenceFromKey(key);
+      if (sequence === null || sequence <= options.afterSequence)
+        continue;
+      const decoded = decodeStorageValue(value);
+      if (!isFleetEventEnvelope(decoded))
+        continue;
+      yield decoded;
+    }
+  }
+  async function snapshotTailSequence() {
+    const storedTail = await storage.get(KEYS.fleetEventTail()), decodedTail = storedTail === null ? null : decodeStorageValue(storedTail);
+    if (isTailRecord(decodedTail))
+      return decodedTail.sequence;
+    for await (const [key] of storage.scan(KEYS.fleetEventPrefix(), { reverse: !0 })) {
+      const sequence = parseFleetEventSequenceFromKey(key);
+      if (sequence !== null)
+        return sequence;
+    }
+    return -1;
+  }
+  function subscribeLive(listener) {
+    listeners.add(listener);
+    return () => {
+      listeners.delete(listener);
+    };
+  }
+  function fireLive(envelope) {
+    const listenerSnapshot = Array.from(listeners);
+    for (const listener of listenerSnapshot)
+      try {
+        listener(envelope);
+      } catch {}
+  }
+  return {
+    append,
+    appendWorkflowEventIfPresent,
+    replay: (options) => replayLiveFeed.replay(options),
+    subscribe: (options) => replayLiveFeed.subscribe(options),
+    snapshotTailSequence,
+    dispose() {
+      listeners.clear();
+      replayLiveFeed.dispose();
+    }
+  };
+}
+function decodeStorageValue(value) {
+  try {
+    return decode(value);
+  } catch {
+    return null;
+  }
+}
+function parseFleetEventSequenceFromKey(key) {
+  if (!key.startsWith(KEYS.fleetEventPrefix()))
+    return null;
+  const rawSequence = key.slice(KEYS.fleetEventPrefix().length);
+  if (!/^\d+$/.test(rawSequence))
+    return null;
+  const sequence = Number(rawSequence);
+  return Number.isSafeInteger(sequence) ? sequence : null;
+}
+function isTailRecord(value) {
+  return typeof value === "object" && value !== null && "sequence" in value && Number.isSafeInteger(value.sequence);
+}
+function isFleetEventEnvelope(value) {
+  if (typeof value !== "object" || value === null)
+    return !1;
+  const record = value;
+  return typeof record.kind === "string" && Number.isSafeInteger(record.sequence) && typeof record.cursor === "string" && decodeCursor(record.cursor) === record.sequence && Number.isFinite(record.emittedAtMs) && (record.workflowId === void 0 || typeof record.workflowId === "string") && Object.hasOwn(record, "payload");
+}

package/dist/server/handler/index.js

@@ -37,7 +37,7 @@ function validateHandlerOptions(options) {
 async function dispatchRestBinding(request, engine, bindingMatch, operationRegistry, options, url) {
   try {
     const principal = authContextToPrincipal(options?.authContext);
-    return await dispatchViaExecuteOperation(request, engine, bindingMatch.binding, bindingMatch.pathParams, operationRegistry, principal, options?.pipelineTrace);
+    return await dispatchViaExecuteOperation(request, engine, bindingMatch.binding, bindingMatch.pathParams, operationRegistry, principal, options?.pipelineTrace, options?.maxRequestBodyBytes);
   } catch (error) {
     console.error("Unhandled error in dispatchViaExecuteOperation", {
       method: request.method,

package/dist/server/handler/response-helpers.js

@@ -1,3 +1,4 @@
+import { copyBytesToArrayBuffer } from "../../core/byte-arrays.js";
 import { encode } from "../../core/codec.js";
 export function jsonResponse(body, status = 200) {
   return new Response(JSON.stringify(body), {
@@ -6,7 +7,7 @@ export function jsonResponse(body, status = 200) {
   });
 }
 function msgpackResponse(body, status = 200) {
-  return new Response(encode(body), {
+  return new Response(copyBytesToArrayBuffer(encode(body)), {
     status,
     headers: { "Content-Type": "application/msgpack" }
   });

package/dist/server/handler/route-dispatch.d.ts

@@ -81,6 +81,8 @@ export interface HandlerOptions {
      * can otherwise poison the discovery URLs.
      */
     trustedHosts?: ReadonlyArray<string>;
+    /** Maximum REST operation request body size in bytes. Defaults to 1 MB. */
+    maxRequestBodyBytes?: number;
     /**
      * Optional pipeline-trace observer. **Internal test seam** used by the
      * dispatch-audit suite to prove every transport drives the full
@@ -98,7 +100,7 @@ export type RouteExecutionContext = {
 };
 export type RouteExecutor = (context: RouteExecutionContext) => Promise<Response>;
 export declare const DIRECT_ROUTE_EXECUTORS: Record<DirectRouteHandlerName, RouteExecutor>;
-export declare function dispatchViaExecuteOperation(request: Request, engine: Engine, binding: UnknownRestBinding, pathParams: Record<string, string>, registry: OperationRegistry, principal: Principal, pipelineTrace?: PipelineTrace): Promise<Response>;
+export declare function dispatchViaExecuteOperation(request: Request, engine: Engine, binding: UnknownRestBinding, pathParams: Record<string, string>, registry: OperationRegistry, principal: Principal, pipelineTrace?: PipelineTrace, maxRequestBodyBytes?: number): Promise<Response>;
 /**
  * Type guard that returns true if the value structurally resembles an
  * {@link OperationFault} (carries `code`, `message`, and `data` properties).
@@ -125,8 +127,9 @@ export declare function dispatchViaExecuteOperation(request: Request, engine: En
 export declare function isOperationFaultLike(value: unknown): value is OperationFault;
 /**
  * Convert the REST transport's `authContext` into a `Principal`. The
- * authenticator (`serve()`) only reports method + optional claims; this
- * shim bridges that into the richer `Principal` the pipeline expects.
+ * authenticator (`serve()`) reports method + optional claims; this maps
+ * that transport authentication result into the `Principal` used by the
+ * operation pipeline.
  * Returns `anonymousPrincipal()` when no context is provided (public
  * request).
  *

package/dist/server/handler/route-dispatch.js

@@ -113,10 +113,10 @@ export const DIRECT_ROUTE_EXECUTORS = {
     ...options?.discoveryInfo !== void 0 ? { discoveryInfo: options.discoveryInfo } : {}
   }))
 };
-export async function dispatchViaExecuteOperation(request, engine, binding, pathParams, registry, principal, pipelineTrace) {
+export async function dispatchViaExecuteOperation(request, engine, binding, pathParams, registry, principal, pipelineTrace, maxRequestBodyBytes) {
   let input;
   try {
-    input = await binding.extractInput(request, pathParams);
+    input = await binding.extractInput(request, pathParams, maxRequestBodyBytes !== void 0 ? { maxBodyBytes: maxRequestBodyBytes } : {});
   } catch (error) {
     if (isOperationFaultLike(error))
       return binding.shapeFault ? binding.shapeFault(error) : faultToHttpResponse(error);