@sequenceholdings/managed-functions 0.4.0 → 0.4.2

package/dist/sdk-range.d.ts

@@ -1,2 +1,3 @@
 export declare function concreteOrStaleSdkSpec(spec: string | undefined, minimum: string): string | null;
 export declare function sdkConstraintIsOlder(declared: string, minimum: string): boolean;
+export declare function sdkSpecAllowsOnlyAtOrAbove(declared: string, minimum: string): boolean;

package/dist/sdk-range.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.concreteOrStaleSdkSpec = concreteOrStaleSdkSpec;
 exports.sdkConstraintIsOlder = sdkConstraintIsOlder;
+exports.sdkSpecAllowsOnlyAtOrAbove = sdkSpecAllowsOnlyAtOrAbove;
 function parseSemver(raw) {
     const match = /^v?(\d+)\.(\d+)\.(\d+)$/.exec(raw.trim());
     if (!match)
@@ -144,3 +145,27 @@ function sdkConstraintIsOlder(declared, minimum) {
     }
     return concreteOrStaleSdkSpec(declared, minimum) === declared;
 }
+function sdkSpecAllowsOnlyAtOrAbove(declared, minimum) {
+    const target = parseSemver(minimum);
+    if (!target || !target.every(Number.isSafeInteger))
+        return false;
+    const alternatives = declared.trim().split('||');
+    if (alternatives.some((alternative) => alternative.trim() === ''))
+        return false;
+    return alternatives.every((alternative) => {
+        const versions = alternative.match(/\d+\.\d+\.\d+/g) ?? [];
+        if (!versions.every((version) => /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/.test(version)))
+            return false;
+        const bounds = clauseBounds(alternative);
+        if (!bounds || !bounds.min.every(Number.isSafeInteger) ||
+            (bounds.max && !bounds.max.every(Number.isSafeInteger)))
+            return false;
+        const first = bounds.minInclusive ? bounds.min : [bounds.min[0], bounds.min[1], bounds.min[2] + 1];
+        if (!first.every(Number.isSafeInteger) || compare(first, target) < 0)
+            return false;
+        if (!bounds.max)
+            return true;
+        const relation = compare(first, bounds.max);
+        return relation < 0 || (relation === 0 && bounds.maxInclusive);
+    });
+}

package/dist/service-directory.d.ts

@@ -0,0 +1,12 @@
+import { type DirectoryPrincipalResolveRequest, type DirectoryPrincipalResolution } from './directory-contract';
+export interface FunctionServiceDirectoryOptions {
+    request: {
+        headers: Pick<Headers, 'get'> | Readonly<Record<string, string | readonly string[] | undefined>>;
+    };
+    baseUrl: string;
+    fetchImpl?: typeof globalThis.fetch;
+}
+export interface FunctionServiceDirectoryClient {
+    resolve(input: DirectoryPrincipalResolveRequest): Promise<DirectoryPrincipalResolution>;
+}
+export declare function createFunctionServiceDirectoryClient({ request, baseUrl, fetchImpl }: FunctionServiceDirectoryOptions): FunctionServiceDirectoryClient;

package/dist/service-directory.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createFunctionServiceDirectoryClient = createFunctionServiceDirectoryClient;
+const zod_1 = require("zod");
+const directory_contract_1 = require("./directory-contract");
+function credential({ request }) {
+    const headers = request.headers;
+    const matches = typeof headers.get === 'function' ? [headers.get(directory_contract_1.FUNCTION_DIRECTORY_TOKEN_HEADER)]
+        : Object.entries(headers).filter(([key]) => key.toLowerCase() === directory_contract_1.FUNCTION_DIRECTORY_TOKEN_HEADER).map(([, value]) => value);
+    const token = matches[0];
+    const refused = () => new directory_contract_1.DirectoryPrincipalResolveError(401, 'invalid_context', 'This invocation has no valid directory credential');
+    if (matches.length !== 1 || typeof token !== 'string' || token.length > 16_384)
+        throw refused();
+    const envelope = /^([A-Za-z0-9_-]+)\.([A-Za-z0-9_-]{43})$/.exec(token);
+    if (!envelope?.[1])
+        throw refused();
+    let value;
+    try {
+        value = JSON.parse(Buffer.from(envelope[1], 'base64url').toString('utf8'));
+    }
+    catch {
+        throw refused();
+    }
+    const parsed = zod_1.z.object({ audience: zod_1.z.literal('atlas-managed-function-directory-resolve'), sub: zod_1.z.string().startsWith('service-account|'), functionId: zod_1.z.string().min(1), invocationId: zod_1.z.string().min(1), exp: zod_1.z.number() }).safeParse(value);
+    if (!parsed.success)
+        throw refused();
+    return { token, expiresAt: parsed.data.exp };
+}
+function origin(baseUrl) {
+    const refused = () => new directory_contract_1.DirectoryPrincipalResolveError(400, 'invalid_configuration', 'Configure a trusted HTTPS Atlas origin without credentials, path, query or fragment');
+    let url;
+    try {
+        url = new URL(baseUrl);
+    }
+    catch {
+        throw refused();
+    }
+    const loopback = url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname);
+    if ((!loopback && url.protocol !== 'https:') || url.username || url.password || url.pathname !== '/' || url.search || url.hash)
+        throw refused();
+    return url.origin;
+}
+function completeResolution({ result, query }) {
+    const expected = new Set(query.lookups.map((lookup) => `${lookup.type}:${lookup.value}`));
+    const received = [...result.resolved.map((value) => value.lookup), ...result.unresolved];
+    const actual = new Set(received.map((lookup) => `${lookup.type}:${lookup.value}`));
+    return received.length === expected.size && actual.size === expected.size && [...actual].every((key) => expected.has(key))
+        && result.resolved.every((value) => value.lookup.type !== 'email' || value.email === value.lookup.value);
+}
+function createFunctionServiceDirectoryClient({ request, baseUrl, fetchImpl = globalThis.fetch }) {
+    const url = `${origin(baseUrl)}${directory_contract_1.FUNCTION_DIRECTORY_RESOLVE_PATH}`;
+    const { token, expiresAt } = credential({ request });
+    return {
+        async resolve(input) {
+            if (expiresAt <= Date.now() / 1000)
+                throw new directory_contract_1.DirectoryPrincipalResolveError(401, 'expired_context', 'The directory credential expired; start a new invocation');
+            const query = directory_contract_1.directoryPrincipalResolveRequestSchema.safeParse(input);
+            if (!query.success)
+                throw new directory_contract_1.DirectoryPrincipalResolveError(400, 'invalid_request', 'Invalid exact directory resolution request');
+            const response = await fetchImpl(url, { method: 'POST', headers: { 'content-type': 'application/json', [directory_contract_1.FUNCTION_DIRECTORY_TOKEN_HEADER]: token }, body: JSON.stringify(query.data), redirect: 'error', signal: AbortSignal.timeout(30_000) });
+            const body = await response.json().catch(() => null);
+            if (!response.ok) {
+                const error = zod_1.z.object({ code: zod_1.z.string().max(128).optional(), detail: zod_1.z.string().max(2000).optional() }).safeParse(body);
+                throw new directory_contract_1.DirectoryPrincipalResolveError(response.status, error.success ? error.data.code ?? 'directory_resolve_failed' : 'directory_resolve_failed', error.success ? error.data.detail ?? 'Directory resolution failed' : 'Directory resolution failed');
+            }
+            const result = directory_contract_1.directoryPrincipalResolutionSchema.safeParse(body);
+            if (!result.success || !completeResolution({ result: result.data, query: query.data }))
+                throw new directory_contract_1.DirectoryPrincipalResolveError(502, 'malformed_response', 'Atlas returned an invalid directory resolution');
+            return result.data;
+        },
+    };
+}

package/dist/workflow-scopes-contract.d.ts

@@ -0,0 +1,8 @@
+import { z } from 'zod';
+export declare const functionWorkflowScopesSchema: z.ZodObject<{
+    read: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    evidence: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+export type FunctionWorkflowScopes = z.infer<typeof functionWorkflowScopesSchema>;
+export declare function readFunctionWorkflowScopes(manifest: unknown): string[];
+export declare function readFunctionWorkflowEvidenceScopes(manifest: unknown): string[];

package/dist/workflow-scopes-contract.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.functionWorkflowScopesSchema = void 0;
+exports.readFunctionWorkflowScopes = readFunctionWorkflowScopes;
+exports.readFunctionWorkflowEvidenceScopes = readFunctionWorkflowEvidenceScopes;
+const zod_1 = require("zod");
+const workflowId = zod_1.z.string().min(1).max(255).regex(/^[A-Za-z0-9._-]+$/);
+const exactWorkflowIds = zod_1.z.array(workflowId).min(1).max(64)
+    .refine((ids) => new Set(ids).size === ids.length, 'Workflow ids must be distinct')
+    .refine((ids) => ids.reduce((bytes, id) => bytes + id.length, 0) <= 8192, 'Workflow ids must fit within 8192 bytes');
+exports.functionWorkflowScopesSchema = zod_1.z.strictObject({
+    read: exactWorkflowIds.optional(),
+    evidence: exactWorkflowIds.optional(),
+}).refine((scopes) => scopes.read !== undefined || scopes.evidence !== undefined, 'Declare workflow reads or evidence verification');
+function readWorkflowCapabilities({ manifest }) {
+    if (typeof manifest !== 'object' || manifest === null)
+        return null;
+    const capabilities = Reflect.get(manifest, 'capabilities');
+    if (typeof capabilities !== 'object' || capabilities === null)
+        return null;
+    const workflows = Reflect.get(capabilities, 'workflows');
+    return workflows === undefined ? null : exports.functionWorkflowScopesSchema.parse(workflows);
+}
+function readFunctionWorkflowScopes(manifest) {
+    return readWorkflowCapabilities({ manifest })?.read ?? [];
+}
+function readFunctionWorkflowEvidenceScopes(manifest) {
+    return readWorkflowCapabilities({ manifest })?.evidence ?? [];
+}