@sequenceholdings/managed-functions 0.4.0 → 0.4.2

package/dist/workflow-source.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createFunctionServiceWorkflowsClient = createFunctionServiceWorkflowsClient;
+exports.createFunctionWorkflowEvidenceClient = createFunctionWorkflowEvidenceClient;
+const zod_1 = require("zod");
+const agent_source_evidence_contract_1 = require("./agent-source-evidence-contract");
+const workflow_source_contract_1 = require("./workflow-source-contract");
+function header(request, name) {
+    const { headers } = request;
+    const values = typeof headers.get === 'function' ? [headers.get(name)] : Object.entries(headers).filter(([key]) => key.toLowerCase() === name).map(([, value]) => value);
+    return values.length === 1 && typeof values[0] === 'string' ? values[0] : null;
+}
+const receiverSchema = zod_1.z.object({ sub: zod_1.z.string(), functionId: zod_1.z.uuid(), versionId: zod_1.z.uuid(), invocationId: zod_1.z.uuid(), serviceAccountId: zod_1.z.uuid(), org: zod_1.z.string().min(1), exp: zod_1.z.number().int() });
+function credential({ request, evidence }) {
+    const refused = () => new workflow_source_contract_1.FunctionWorkflowReadError(401, 'invalid_context', 'This invocation has no valid workflow-source credential');
+    const token = header(request, evidence ? workflow_source_contract_1.FUNCTION_WORKFLOW_EVIDENCE_TOKEN_HEADER : workflow_source_contract_1.FUNCTION_WORKFLOW_TOKEN_HEADER);
+    const body = token && token.length <= 16_384 ? /^([A-Za-z0-9_-]+)\.[A-Za-z0-9_-]{43}$/.exec(token)?.[1] : null;
+    if (!body || !token)
+        throw refused();
+    let value;
+    try {
+        value = JSON.parse(Buffer.from(body, 'base64url').toString('utf8'));
+    }
+    catch {
+        throw refused();
+    }
+    const binding = receiverSchema.extend({ audience: zod_1.z.literal(evidence ? 'atlas-managed-function-workflow-evidence' : 'atlas-managed-function-workflow-read') }).safeParse(value);
+    if (!binding.success || binding.data.sub !== `service-account|${binding.data.serviceAccountId}`)
+        throw refused();
+    return { token, binding: binding.data };
+}
+function origin(baseUrl) {
+    let url;
+    try {
+        url = new URL(baseUrl);
+    }
+    catch {
+        throw new workflow_source_contract_1.FunctionWorkflowReadError(400, 'invalid_configuration', 'Configure a trusted Atlas origin');
+    }
+    const loopback = url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname);
+    if ((!loopback && url.protocol !== 'https:') || url.username || url.password || url.pathname !== '/' || url.search || url.hash)
+        throw new workflow_source_contract_1.FunctionWorkflowReadError(400, 'invalid_configuration', 'Configure an HTTPS Atlas origin without credentials, path, query or fragment');
+    return url.origin;
+}
+function sameReceiver(left, right) {
+    return left.functionId === right.functionId && left.versionId === right.versionId && left.invocationId === right.invocationId && left.serviceAccountId === right.serviceAccountId && left.org === right.org && left.sub === right.sub;
+}
+async function post({ options, path, body, credentials }) {
+    const serialized = JSON.stringify(body);
+    if (Buffer.byteLength(serialized, 'utf8') > agent_source_evidence_contract_1.AGENT_SOURCE_VERIFY_MAX_BYTES)
+        throw new workflow_source_contract_1.FunctionWorkflowReadError(413, 'workflow_source_too_large', 'Workflow source verification exceeds 768 KiB; capture a smaller output before writing');
+    const lattice = header(options.request, 'x-sequence-lattice-execution-token');
+    const response = await (options.fetchImpl ?? globalThis.fetch)(`${origin(options.baseUrl)}${path}`, { method: 'POST', headers: { 'content-type': 'application/json', ...credentials, ...(lattice ? { 'x-sequence-lattice-execution-token': lattice } : {}) }, body: serialized, redirect: 'error', signal: AbortSignal.timeout(30_000) });
+    const result = await response.json().catch(() => null);
+    if (!response.ok) {
+        const error = zod_1.z.object({ detail: zod_1.z.string().max(2000).optional(), code: zod_1.z.string().max(128).optional() }).safeParse(result);
+        throw new workflow_source_contract_1.FunctionWorkflowReadError(response.status, error.success ? (error.data.code ?? 'workflow_source_failed') : 'workflow_source_failed', error.success ? (error.data.detail ?? 'Workflow source request failed') : 'Workflow source request failed');
+    }
+    return result;
+}
+function assertLive(binding) {
+    if (binding.exp <= Date.now() / 1000)
+        throw new workflow_source_contract_1.FunctionWorkflowReadError(401, 'expired_context', 'The workflow-source credential expired; start a new invocation');
+}
+function createFunctionServiceWorkflowsClient(options) {
+    origin(options.baseUrl);
+    const read = credential({ request: options.request, evidence: false });
+    const evidence = credential({ request: options.request, evidence: true });
+    if (!sameReceiver(read.binding, evidence.binding))
+        throw new workflow_source_contract_1.FunctionWorkflowReadError(401, 'invalid_context', 'Workflow capture credentials name different invocations');
+    return { async captureCompletedRun(query) {
+            assertLive(read.binding);
+            assertLive(evidence.binding);
+            const parsed = workflow_source_contract_1.functionWorkflowSourceCaptureSchema.safeParse(await post({ options, path: workflow_source_contract_1.FUNCTION_WORKFLOW_CAPTURE_PATH, body: { ...workflow_source_contract_1.functionWorkflowCompletedRunQuerySchema.parse(query), operation: 'captureCompletedRun' }, credentials: { [workflow_source_contract_1.FUNCTION_WORKFLOW_TOKEN_HEADER]: read.token, [workflow_source_contract_1.FUNCTION_WORKFLOW_EVIDENCE_TOKEN_HEADER]: evidence.token } }));
+            if (!parsed.success || parsed.data.response.workflow !== query.workflow || parsed.data.response.runId !== query.runId)
+                throw new workflow_source_contract_1.FunctionWorkflowReadError(502, 'malformed_response', 'Atlas returned a different completed workflow source');
+            return parsed.data;
+        } };
+}
+function createFunctionWorkflowEvidenceClient(options) {
+    origin(options.baseUrl);
+    const evidence = credential({ request: options.request, evidence: true });
+    return { async verifySourceEvidence(input) {
+            assertLive(evidence.binding);
+            const parsed = workflow_source_contract_1.functionWorkflowSourceVerificationSchema.safeParse(await post({ options, path: workflow_source_contract_1.FUNCTION_WORKFLOW_EVIDENCE_PATH, body: workflow_source_contract_1.functionWorkflowSourceEvidenceRequestSchema.parse({ ...input, operation: 'verifySourceEvidence' }), credentials: { [workflow_source_contract_1.FUNCTION_WORKFLOW_EVIDENCE_TOKEN_HEADER]: evidence.token } }));
+            if (!parsed.success)
+                throw new workflow_source_contract_1.FunctionWorkflowReadError(502, 'malformed_response', 'Atlas returned invalid workflow source verification');
+            const { source, receiver } = parsed.data;
+            if (source.workflowId !== input.workflow || source.runId !== input.runId || source.responseHash !== input.responseHash || receiver.functionId !== evidence.binding.functionId || receiver.versionId !== evidence.binding.versionId || receiver.invocationId !== evidence.binding.invocationId || receiver.serviceAccountId !== evidence.binding.serviceAccountId || receiver.org !== evidence.binding.org)
+                throw new workflow_source_contract_1.FunctionWorkflowReadError(502, 'malformed_response', 'Atlas returned workflow evidence for another request or invocation');
+            return parsed.data;
+        } };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sequenceholdings/managed-functions",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "Managed Function context and opt-in cache runtime",
   "license": "UNLICENSED",
   "main": "./dist/index.js",
@@ -48,7 +48,7 @@
     "vitest": "^4.1.11",
     "esbuild": "^0.25.0",
     "tsup": "^8.3.0",
-    "@sequenceholdings/orm": "2.6.0"
+    "@sequenceholdings/orm": "2.6.2"
   },
   "engines": {
     "node": ">=20"