@positronic/cloudflare 0.0.56 → 0.0.58

package/dist/src/api/auth-middleware.js

@@ -0,0 +1,475 @@
+function _array_like_to_array(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_with_holes(arr) {
+    if (Array.isArray(arr)) return arr;
+}
+function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
+    }
+}
+function _async_to_generator(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _instanceof(left, right) {
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
+    } else {
+        return left instanceof right;
+    }
+}
+function _iterable_to_array_limit(arr, i) {
+    var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
+    if (_i == null) return;
+    var _arr = [];
+    var _n = true;
+    var _d = false;
+    var _s, _e;
+    try {
+        for(_i = _i.call(arr); !(_n = (_s = _i.next()).done); _n = true){
+            _arr.push(_s.value);
+            if (i && _arr.length === i) break;
+        }
+    } catch (err) {
+        _d = true;
+        _e = err;
+    } finally{
+        try {
+            if (!_n && _i["return"] != null) _i["return"]();
+        } finally{
+            if (_d) throw _e;
+        }
+    }
+    return _arr;
+}
+function _non_iterable_rest() {
+    throw new TypeError("Invalid attempt to destructure non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _sliced_to_array(arr, i) {
+    return _array_with_holes(arr) || _iterable_to_array_limit(arr, i) || _unsupported_iterable_to_array(arr, i) || _non_iterable_rest();
+}
+function _unsupported_iterable_to_array(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array(o, minLen);
+}
+function _ts_generator(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() {
+        return this;
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+import { parseRequestSignature } from '@misskey-dev/node-http-message-signatures';
+/**
+ * Get the algorithm parameters for SubtleCrypto based on JWK key type
+ */ function getAlgorithmForJwk(jwk) {
+    if (jwk.kty === 'RSA') {
+        return {
+            name: 'RSASSA-PKCS1-v1_5',
+            hash: 'SHA-256'
+        };
+    } else if (jwk.kty === 'EC') {
+        return {
+            name: 'ECDSA',
+            namedCurve: jwk.crv || 'P-256'
+        };
+    } else if (jwk.kty === 'OKP' && jwk.crv === 'Ed25519') {
+        return {
+            name: 'Ed25519'
+        };
+    }
+    throw new Error("Unsupported key type: ".concat(jwk.kty));
+}
+/**
+ * Get the algorithm parameters for signature verification
+ */ function getVerifyAlgorithm(jwk) {
+    if (jwk.kty === 'RSA') {
+        return {
+            name: 'RSASSA-PKCS1-v1_5',
+            hash: 'SHA-256'
+        };
+    } else if (jwk.kty === 'EC') {
+        return {
+            name: 'ECDSA',
+            hash: 'SHA-256'
+        };
+    } else if (jwk.kty === 'OKP' && jwk.crv === 'Ed25519') {
+        return {
+            name: 'Ed25519'
+        };
+    }
+    throw new Error("Unsupported key type: ".concat(jwk.kty));
+}
+/**
+ * Convert a JWK to a CryptoKey for signature verification
+ */ function jwkToCryptoKey(jwkString) {
+    return _async_to_generator(function() {
+        var jwk, algorithm;
+        return _ts_generator(this, function(_state) {
+            jwk = JSON.parse(jwkString);
+            algorithm = getAlgorithmForJwk(jwk);
+            return [
+                2,
+                crypto.subtle.importKey('jwk', jwk, algorithm, true, [
+                    'verify'
+                ])
+            ];
+        });
+    })();
+}
+/**
+ * Verify a signature using Web Crypto API
+ */ function verifySignatureWithKey(signatureBase, signatureB64, cryptoKey, jwk) {
+    return _async_to_generator(function() {
+        var encoder, data, signatureBytes, algorithm;
+        return _ts_generator(this, function(_state) {
+            encoder = new TextEncoder();
+            data = encoder.encode(signatureBase);
+            signatureBytes = Uint8Array.from(atob(signatureB64), function(c) {
+                return c.charCodeAt(0);
+            });
+            algorithm = getVerifyAlgorithm(jwk);
+            return [
+                2,
+                crypto.subtle.verify(algorithm, cryptoKey, signatureBytes, data)
+            ];
+        });
+    })();
+}
+/**
+ * Extract keyId and signature info from parsed signature
+ * Handles both draft and RFC9421 formats
+ */ function extractSignatureInfo(parsed) {
+    if (parsed.version === 'draft') {
+        return {
+            keyId: parsed.value.keyId,
+            signature: parsed.value.params.signature,
+            base: parsed.value.signingString
+        };
+    } else if (parsed.version === 'rfc9421') {
+        // RFC9421 returns an array of [label, value] tuples
+        var signatures = parsed.value;
+        if (signatures.length === 0) return null;
+        // Use the first signature (usually 'sig1')
+        var _signatures_ = _sliced_to_array(signatures[0], 2), sigValue = _signatures_[1];
+        return {
+            keyId: sigValue.keyid,
+            signature: sigValue.signature,
+            base: sigValue.base
+        };
+    }
+    return null;
+}
+/**
+ * Authentication middleware for the Positronic API
+ * Verifies HTTP message signatures (RFC 9421) using @misskey-dev/node-http-message-signatures for parsing
+ */ export function authMiddleware() {
+    return function(c, next) {
+        return _async_to_generator(function() {
+            var signatureHeader, signatureInputHeader, parsedSignature, requestForParsing, errorMessage, sigInfo, keyId, signature, base, authDoId, authDo, userKey, jwk, cryptoKey, isValid, error, errorMessage1, jwk1, cryptoKey1, isValid1, error1, errorMessage2;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        // Skip auth in development mode
+                        if (c.env.NODE_ENV === 'development') {
+                            c.set('auth', {
+                                userId: null,
+                                isRoot: true
+                            });
+                            return [
+                                2,
+                                next()
+                            ];
+                        }
+                        // Get signature headers
+                        signatureHeader = c.req.header('Signature');
+                        signatureInputHeader = c.req.header('Signature-Input');
+                        // If no signature headers, return 401
+                        if (!signatureHeader || !signatureInputHeader) {
+                            return [
+                                2,
+                                c.json({
+                                    error: 'Authentication required'
+                                }, 401)
+                            ];
+                        }
+                        try {
+                            // Build a request-like object for the library
+                            requestForParsing = {
+                                method: c.req.method,
+                                url: c.req.url,
+                                headers: Object.fromEntries(c.req.raw.headers.entries())
+                            };
+                            parsedSignature = parseRequestSignature(requestForParsing, {
+                                clockSkew: {
+                                    now: new Date(),
+                                    forward: 300000,
+                                    delay: 300000
+                                }
+                            });
+                        } catch (error) {
+                            // Log error type only - avoid logging request details that could contain sensitive data
+                            errorMessage = _instanceof(error, Error) ? error.message : 'Unknown error';
+                            console.error('Failed to parse signature:', errorMessage);
+                            return [
+                                2,
+                                c.json({
+                                    error: 'Invalid signature format'
+                                }, 401)
+                            ];
+                        }
+                        // Extract signature info from parsed result
+                        sigInfo = extractSignatureInfo(parsedSignature);
+                        if (!sigInfo) {
+                            return [
+                                2,
+                                c.json({
+                                    error: 'No valid signature found'
+                                }, 401)
+                            ];
+                        }
+                        keyId = sigInfo.keyId, signature = sigInfo.signature, base = sigInfo.base;
+                        // Try to find the key in the auth database
+                        authDoId = c.env.AUTH_DO.idFromName('auth');
+                        authDo = c.env.AUTH_DO.get(authDoId);
+                        return [
+                            4,
+                            authDo.getKeyByFingerprint(keyId)
+                        ];
+                    case 1:
+                        userKey = _state.sent();
+                        if (!userKey) return [
+                            3,
+                            6
+                        ];
+                        _state.label = 2;
+                    case 2:
+                        _state.trys.push([
+                            2,
+                            5,
+                            ,
+                            6
+                        ]);
+                        jwk = JSON.parse(userKey.jwk);
+                        return [
+                            4,
+                            jwkToCryptoKey(userKey.jwk)
+                        ];
+                    case 3:
+                        cryptoKey = _state.sent();
+                        return [
+                            4,
+                            verifySignatureWithKey(base, signature, cryptoKey, jwk)
+                        ];
+                    case 4:
+                        isValid = _state.sent();
+                        if (!isValid) {
+                            return [
+                                2,
+                                c.json({
+                                    error: 'Invalid signature'
+                                }, 401)
+                            ];
+                        }
+                        c.set('auth', {
+                            userId: userKey.userId,
+                            isRoot: false
+                        });
+                        return [
+                            2,
+                            next()
+                        ];
+                    case 5:
+                        error = _state.sent();
+                        // Log error type only - avoid logging key material or signature data
+                        errorMessage1 = _instanceof(error, Error) ? error.message : 'Unknown error';
+                        console.error('Signature verification failed:', errorMessage1);
+                        return [
+                            2,
+                            c.json({
+                                error: 'Signature verification failed'
+                            }, 401)
+                        ];
+                    case 6:
+                        if (!c.env.ROOT_PUBLIC_KEY) return [
+                            3,
+                            11
+                        ];
+                        _state.label = 7;
+                    case 7:
+                        _state.trys.push([
+                            7,
+                            10,
+                            ,
+                            11
+                        ]);
+                        jwk1 = JSON.parse(c.env.ROOT_PUBLIC_KEY);
+                        return [
+                            4,
+                            jwkToCryptoKey(c.env.ROOT_PUBLIC_KEY)
+                        ];
+                    case 8:
+                        cryptoKey1 = _state.sent();
+                        return [
+                            4,
+                            verifySignatureWithKey(base, signature, cryptoKey1, jwk1)
+                        ];
+                    case 9:
+                        isValid1 = _state.sent();
+                        if (isValid1) {
+                            c.set('auth', {
+                                userId: null,
+                                isRoot: true
+                            });
+                            return [
+                                2,
+                                next()
+                            ];
+                        }
+                        return [
+                            3,
+                            11
+                        ];
+                    case 10:
+                        error1 = _state.sent();
+                        // Log error type only - avoid logging key material
+                        errorMessage2 = _instanceof(error1, Error) ? error1.message : 'Unknown error';
+                        console.error('Root key verification failed:', errorMessage2);
+                        return [
+                            3,
+                            11
+                        ];
+                    case 11:
+                        // No matching key found
+                        // Check if ROOT_PUBLIC_KEY is configured - if not, return specific error
+                        if (!c.env.ROOT_PUBLIC_KEY) {
+                            return [
+                                2,
+                                c.json({
+                                    error: 'ROOT_KEY_NOT_CONFIGURED'
+                                }, 401)
+                            ];
+                        }
+                        return [
+                            2,
+                            c.json({
+                                error: 'Unknown key'
+                            }, 401)
+                        ];
+                }
+            });
+        })();
+    };
+}

package/dist/src/api/brains.js

@@ -157,6 +157,7 @@ import { Hono } from 'hono';
 import { v4 as uuidv4 } from 'uuid';
 import { parseCronExpression } from 'cron-schedule';
 import Fuse from 'fuse.js';
+import { isSignalValid, brainMachineDefinition } from '@positronic/core';
 import { getManifest } from '../brain-runner-do.js';
 var brains = new Hono();
 brains.post('/runs', function(context) {
@@ -478,6 +479,165 @@ brains.delete('/runs/:runId', function(context) {
         });
     })();
 });
+// Signal endpoint - queue KILL, PAUSE, USER_MESSAGE, RESUME, or WEBHOOK_RESPONSE signals
+brains.post('/runs/:runId/signals', function(context) {
+    return _async_to_generator(function() {
+        var runId, body, monitorId, monitorStub, run, validation, namespace, doId, stub, signal;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    runId = context.req.param('runId');
+                    return [
+                        4,
+                        context.req.json()
+                    ];
+                case 1:
+                    body = _state.sent();
+                    // Validate signal type
+                    if (![
+                        'KILL',
+                        'PAUSE',
+                        'USER_MESSAGE',
+                        'RESUME',
+                        'WEBHOOK_RESPONSE'
+                    ].includes(body.type)) {
+                        return [
+                            2,
+                            context.json({
+                                error: 'Invalid signal type'
+                            }, 400)
+                        ];
+                    }
+                    // Check if the run exists in MonitorDO
+                    monitorId = context.env.MONITOR_DO.idFromName('singleton');
+                    monitorStub = context.env.MONITOR_DO.get(monitorId);
+                    return [
+                        4,
+                        monitorStub.getRun(runId)
+                    ];
+                case 2:
+                    run = _state.sent();
+                    if (!run) {
+                        return [
+                            2,
+                            context.json({
+                                error: 'Brain run not found'
+                            }, 404)
+                        ];
+                    }
+                    // Validate control signals against current brain state using state machine definition
+                    // USER_MESSAGE is a data signal that gets queued and processed during agent execution,
+                    // so it doesn't need state validation - it can always be queued
+                    if (body.type !== 'USER_MESSAGE') {
+                        validation = isSignalValid(brainMachineDefinition, run.status, body.type);
+                        if (!validation.valid) {
+                            return [
+                                2,
+                                context.json({
+                                    error: validation.reason
+                                }, 409)
+                            ];
+                        }
+                    }
+                    // Get BrainRunnerDO stub and queue the signal
+                    namespace = context.env.BRAIN_RUNNER_DO;
+                    doId = namespace.idFromName(runId);
+                    stub = namespace.get(doId);
+                    return [
+                        4,
+                        stub.queueSignal(body)
+                    ];
+                case 3:
+                    signal = _state.sent();
+                    if (!(body.type === 'RESUME')) return [
+                        3,
+                        5
+                    ];
+                    return [
+                        4,
+                        stub.wakeUp(runId)
+                    ];
+                case 4:
+                    _state.sent();
+                    _state.label = 5;
+                case 5:
+                    return [
+                        2,
+                        context.json({
+                            success: true,
+                            signal: {
+                                type: signal.type,
+                                queuedAt: signal.queuedAt
+                            }
+                        }, 202)
+                    ];
+            }
+        });
+    })();
+});
+// Resume endpoint - resume a paused brain using signal-based approach
+brains.post('/runs/:runId/resume', function(context) {
+    return _async_to_generator(function() {
+        var runId, monitorId, monitorStub, run, namespace, doId, stub;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    runId = context.req.param('runId');
+                    // Check if the run exists and is paused via MonitorDO
+                    monitorId = context.env.MONITOR_DO.idFromName('singleton');
+                    monitorStub = context.env.MONITOR_DO.get(monitorId);
+                    return [
+                        4,
+                        monitorStub.getRun(runId)
+                    ];
+                case 1:
+                    run = _state.sent();
+                    if (!run) {
+                        return [
+                            2,
+                            context.json({
+                                error: 'Brain run not found'
+                            }, 404)
+                        ];
+                    }
+                    if (run.status !== 'paused') {
+                        return [
+                            2,
+                            context.json({
+                                error: "Cannot resume brain in '".concat(run.status, "' state. Only paused brains can be resumed.")
+                            }, 409)
+                        ];
+                    }
+                    // Queue RESUME signal and wake up the brain
+                    namespace = context.env.BRAIN_RUNNER_DO;
+                    doId = namespace.idFromName(runId);
+                    stub = namespace.get(doId);
+                    // Queue the RESUME signal first, then wake up the brain
+                    return [
+                        4,
+                        stub.queueSignal({
+                            type: 'RESUME'
+                        })
+                    ];
+                case 2:
+                    _state.sent();
+                    return [
+                        4,
+                        stub.wakeUp(runId)
+                    ];
+                case 3:
+                    _state.sent();
+                    return [
+                        2,
+                        context.json({
+                            success: true,
+                            action: 'resumed'
+                        }, 202)
+                    ];
+            }
+        });
+    })();
+});
 brains.get('/:identifier/history', function(context) {
     return _async_to_generator(function() {
         var identifier, limit, manifest, resolution, brain, brainTitle, monitorId, monitorStub, runs;