@sequenceholdings/managed-functions 0.4.5 → 0.5.1

package/dist/workflow-source.js

@@ -2,30 +2,56 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createFunctionServiceWorkflowsClient = createFunctionServiceWorkflowsClient;
 exports.createFunctionWorkflowEvidenceClient = createFunctionWorkflowEvidenceClient;
+const adapters_1 = require("@sequenceholdings/platform/adapters");
 const zod_1 = require("zod");
 const agent_source_evidence_contract_1 = require("./agent-source-evidence-contract");
 const workflow_source_contract_1 = require("./workflow-source-contract");
 function header(request, name) {
     const { headers } = request;
-    const values = typeof headers.get === 'function' ? [headers.get(name)] : Object.entries(headers).filter(([key]) => key.toLowerCase() === name).map(([, value]) => value);
-    return values.length === 1 && typeof values[0] === 'string' ? values[0] : null;
+    const values = typeof headers.get === "function"
+        ? [headers.get(name)]
+        : Object.entries(headers)
+            .filter(([key]) => key.toLowerCase() === name)
+            .map(([, value]) => value);
+    return values.length === 1 && typeof values[0] === "string"
+        ? values[0]
+        : null;
 }
-const receiverSchema = zod_1.z.object({ sub: zod_1.z.string(), functionId: zod_1.z.uuid(), versionId: zod_1.z.uuid(), invocationId: zod_1.z.uuid(), serviceAccountId: zod_1.z.uuid(), org: zod_1.z.string().min(1), exp: zod_1.z.number().int() });
-function credential({ request, evidence }) {
-    const refused = () => new workflow_source_contract_1.FunctionWorkflowReadError(401, 'invalid_context', 'This invocation has no valid workflow-source credential');
-    const token = header(request, evidence ? workflow_source_contract_1.FUNCTION_WORKFLOW_EVIDENCE_TOKEN_HEADER : workflow_source_contract_1.FUNCTION_WORKFLOW_TOKEN_HEADER);
-    const body = token && token.length <= 16_384 ? /^([A-Za-z0-9_-]+)\.[A-Za-z0-9_-]{43}$/.exec(token)?.[1] : null;
+const receiverSchema = zod_1.z.object({
+    sub: zod_1.z.string(),
+    functionId: zod_1.z.uuid(),
+    versionId: zod_1.z.uuid(),
+    invocationId: zod_1.z.uuid(),
+    serviceAccountId: zod_1.z.uuid(),
+    org: zod_1.z.string().min(1),
+    exp: zod_1.z.number().int(),
+});
+function credential({ request, evidence, }) {
+    const refused = () => new workflow_source_contract_1.FunctionWorkflowReadError(401, "invalid_context", "This invocation has no valid workflow-source credential");
+    const token = header(request, evidence
+        ? workflow_source_contract_1.FUNCTION_WORKFLOW_EVIDENCE_TOKEN_HEADER
+        : workflow_source_contract_1.FUNCTION_WORKFLOW_TOKEN_HEADER);
+    const body = token && token.length <= 16_384
+        ? /^([A-Za-z0-9_-]+)\.[A-Za-z0-9_-]{43}$/.exec(token)?.[1]
+        : null;
     if (!body || !token)
         throw refused();
     let value;
     try {
-        value = JSON.parse(Buffer.from(body, 'base64url').toString('utf8'));
+        value = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
     }
     catch {
         throw refused();
     }
-    const binding = receiverSchema.extend({ audience: zod_1.z.literal(evidence ? 'atlas-managed-function-workflow-evidence' : 'atlas-managed-function-workflow-read') }).safeParse(value);
-    if (!binding.success || binding.data.sub !== `service-account|${binding.data.serviceAccountId}`)
+    const binding = receiverSchema
+        .extend({
+        audience: zod_1.z.literal(evidence
+            ? "atlas-managed-function-workflow-evidence"
+            : "atlas-managed-function-workflow-read"),
+    })
+        .safeParse(value);
+    if (!binding.success ||
+        binding.data.sub !== `service-account|${binding.data.serviceAccountId}`)
         throw refused();
     return { token, binding: binding.data };
 }
@@ -35,59 +61,96 @@ function origin(baseUrl) {
         url = new URL(baseUrl);
     }
     catch {
-        throw new workflow_source_contract_1.FunctionWorkflowReadError(400, 'invalid_configuration', 'Configure a trusted Atlas origin');
+        throw new workflow_source_contract_1.FunctionWorkflowReadError(400, "invalid_configuration", "Configure a trusted Atlas origin");
     }
-    const loopback = url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname);
-    if ((!loopback && url.protocol !== 'https:') || url.username || url.password || url.pathname !== '/' || url.search || url.hash)
-        throw new workflow_source_contract_1.FunctionWorkflowReadError(400, 'invalid_configuration', 'Configure an HTTPS Atlas origin without credentials, path, query or fragment');
+    const loopback = url.protocol === "http:" &&
+        ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+    if ((!loopback && url.protocol !== "https:") ||
+        url.username ||
+        url.password ||
+        url.pathname !== "/" ||
+        url.search ||
+        url.hash)
+        throw new workflow_source_contract_1.FunctionWorkflowReadError(400, "invalid_configuration", "Configure an HTTPS Atlas origin without credentials, path, query or fragment");
     return url.origin;
 }
 function sameReceiver(left, right) {
-    return left.functionId === right.functionId && left.versionId === right.versionId && left.invocationId === right.invocationId && left.serviceAccountId === right.serviceAccountId && left.org === right.org && left.sub === right.sub;
+    return (left.functionId === right.functionId &&
+        left.versionId === right.versionId &&
+        left.invocationId === right.invocationId &&
+        left.serviceAccountId === right.serviceAccountId &&
+        left.org === right.org &&
+        left.sub === right.sub);
 }
-async function post({ options, path, body, credentials }) {
+async function post({ options, path, body, credentials, }) {
     const serialized = JSON.stringify(body);
-    if (Buffer.byteLength(serialized, 'utf8') > agent_source_evidence_contract_1.AGENT_SOURCE_VERIFY_MAX_BYTES)
-        throw new workflow_source_contract_1.FunctionWorkflowReadError(413, 'workflow_source_too_large', 'Workflow source verification exceeds 768 KiB; capture a smaller output before writing');
-    const lattice = header(options.request, 'x-sequence-lattice-execution-token');
-    const response = await (options.fetchImpl ?? globalThis.fetch)(`${origin(options.baseUrl)}${path}`, { method: 'POST', headers: { 'content-type': 'application/json', ...credentials, ...(lattice ? { 'x-sequence-lattice-execution-token': lattice } : {}) }, body: serialized, redirect: 'error', signal: AbortSignal.timeout(30_000) });
-    const result = await response.json().catch(() => null);
-    if (!response.ok) {
-        const error = zod_1.z.object({ detail: zod_1.z.string().max(2000).optional(), code: zod_1.z.string().max(128).optional() }).safeParse(result);
-        throw new workflow_source_contract_1.FunctionWorkflowReadError(response.status, error.success ? (error.data.code ?? 'workflow_source_failed') : 'workflow_source_failed', error.success ? (error.data.detail ?? 'Workflow source request failed') : 'Workflow source request failed');
-    }
-    return result;
+    if (Buffer.byteLength(serialized, "utf8") > agent_source_evidence_contract_1.AGENT_SOURCE_VERIFY_MAX_BYTES)
+        throw new workflow_source_contract_1.FunctionWorkflowReadError(413, "workflow_source_too_large", "Workflow source verification exceeds 768 KiB; capture a smaller output before writing");
+    const lattice = header(options.request, "x-sequence-lattice-execution-token");
+    const send = (0, adapters_1.createInvocationDomainTransport)({
+        baseUrl: options.baseUrl,
+        fetchImpl: options.fetchImpl,
+        domain: path === workflow_source_contract_1.FUNCTION_WORKFLOW_CAPTURE_PATH
+            ? "workflows-capture"
+            : "workflows-evidence",
+        credentials: [
+            ...Object.entries(credentials).map(([header, token]) => ({
+                header,
+                token,
+            })),
+            ...(lattice
+                ? [{ header: "x-sequence-lattice-execution-token", token: lattice }]
+                : []),
+        ],
+        error: (status, code, message) => new workflow_source_contract_1.FunctionWorkflowReadError(status, code, message),
+        failure: {
+            code: "workflow_source_failed",
+            message: "Workflow source request failed",
+        },
+    });
+    return send(body);
 }
 function assertLive(binding) {
     if (binding.exp <= Date.now() / 1000)
-        throw new workflow_source_contract_1.FunctionWorkflowReadError(401, 'expired_context', 'The workflow-source credential expired; start a new invocation');
+        throw new workflow_source_contract_1.FunctionWorkflowReadError(401, "expired_context", "The workflow-source credential expired; start a new invocation");
 }
 function createFunctionServiceWorkflowsClient(options) {
     origin(options.baseUrl);
     const read = credential({ request: options.request, evidence: false });
     const evidence = credential({ request: options.request, evidence: true });
     if (!sameReceiver(read.binding, evidence.binding))
-        throw new workflow_source_contract_1.FunctionWorkflowReadError(401, 'invalid_context', 'Workflow capture credentials name different invocations');
-    return { async captureCompletedRun(query) {
+        throw new workflow_source_contract_1.FunctionWorkflowReadError(401, "invalid_context", "Workflow capture credentials name different invocations");
+    return (0, adapters_1.createWorkflowSourceClient)({
+        send: (body) => {
             assertLive(read.binding);
             assertLive(evidence.binding);
-            const parsed = workflow_source_contract_1.functionWorkflowSourceCaptureSchema.safeParse(await post({ options, path: workflow_source_contract_1.FUNCTION_WORKFLOW_CAPTURE_PATH, body: { ...workflow_source_contract_1.functionWorkflowCompletedRunQuerySchema.parse(query), operation: 'captureCompletedRun' }, credentials: { [workflow_source_contract_1.FUNCTION_WORKFLOW_TOKEN_HEADER]: read.token, [workflow_source_contract_1.FUNCTION_WORKFLOW_EVIDENCE_TOKEN_HEADER]: evidence.token } }));
-            if (!parsed.success || parsed.data.response.workflow !== query.workflow || parsed.data.response.runId !== query.runId)
-                throw new workflow_source_contract_1.FunctionWorkflowReadError(502, 'malformed_response', 'Atlas returned a different completed workflow source');
-            return parsed.data;
-        } };
+            return post({
+                options,
+                path: workflow_source_contract_1.FUNCTION_WORKFLOW_CAPTURE_PATH,
+                body,
+                credentials: {
+                    [workflow_source_contract_1.FUNCTION_WORKFLOW_TOKEN_HEADER]: read.token,
+                    [workflow_source_contract_1.FUNCTION_WORKFLOW_EVIDENCE_TOKEN_HEADER]: evidence.token,
+                },
+            });
+        },
+    });
 }
 function createFunctionWorkflowEvidenceClient(options) {
     origin(options.baseUrl);
     const evidence = credential({ request: options.request, evidence: true });
-    return { async verifySourceEvidence(input) {
+    return (0, adapters_1.createWorkflowEvidenceClient)({
+        binding: evidence.binding,
+        send: (body) => {
             assertLive(evidence.binding);
-            const parsed = workflow_source_contract_1.functionWorkflowSourceVerificationSchema.safeParse(await post({ options, path: workflow_source_contract_1.FUNCTION_WORKFLOW_EVIDENCE_PATH, body: workflow_source_contract_1.functionWorkflowSourceEvidenceRequestSchema.parse({ ...input, operation: 'verifySourceEvidence' }), credentials: { [workflow_source_contract_1.FUNCTION_WORKFLOW_EVIDENCE_TOKEN_HEADER]: evidence.token } }));
-            if (!parsed.success)
-                throw new workflow_source_contract_1.FunctionWorkflowReadError(502, 'malformed_response', 'Atlas returned invalid workflow source verification');
-            const { source, receiver } = parsed.data;
-            if (source.workflowId !== input.workflow || source.runId !== input.runId || source.responseHash !== input.responseHash || receiver.functionId !== evidence.binding.functionId || receiver.versionId !== evidence.binding.versionId || receiver.invocationId !== evidence.binding.invocationId || receiver.serviceAccountId !== evidence.binding.serviceAccountId || receiver.org !== evidence.binding.org)
-                throw new workflow_source_contract_1.FunctionWorkflowReadError(502, 'malformed_response', 'Atlas returned workflow evidence for another request or invocation');
-            return parsed.data;
-        } };
+            return post({
+                options,
+                path: workflow_source_contract_1.FUNCTION_WORKFLOW_EVIDENCE_PATH,
+                body,
+                credentials: {
+                    [workflow_source_contract_1.FUNCTION_WORKFLOW_EVIDENCE_TOKEN_HEADER]: evidence.token,
+                },
+            });
+        },
+    });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sequenceholdings/managed-functions",
-  "version": "0.4.5",
+  "version": "0.5.1",
   "description": "Managed Function context and opt-in cache runtime",
   "license": "UNLICENSED",
   "main": "./dist/index.js",
@@ -40,7 +40,8 @@
     "zod": "^4.1.13",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/sdk-trace-base": "^2.5.1",
-    "@sequenceholdings/storage": "0.1.2"
+    "@sequenceholdings/storage": "0.1.3",
+    "@sequenceholdings/platform": "0.1.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
@@ -48,7 +49,7 @@
     "vitest": "^4.1.11",
     "esbuild": "^0.25.0",
     "tsup": "^8.3.0",
-    "@sequenceholdings/orm": "2.7.1"
+    "@sequenceholdings/orm": "2.8.1"
   },
   "engines": {
     "node": ">=20"