@sequenceholdings/managed-functions 0.4.5 → 0.5.1

package/dist/invocation-client.js

@@ -2,17 +2,17 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.readInvocationCredential = readInvocationCredential;
 exports.createInvocationReadTransport = createInvocationReadTransport;
-const zod_1 = require("zod");
+const adapters_1 = require("@sequenceholdings/platform/adapters");
 function readInvocationCredential({ request, header, maxBytes, claimsSchema, invalidContext, }) {
     const { headers } = request;
-    const matches = typeof headers.get === 'function'
+    const matches = typeof headers.get === "function"
         ? [headers.get(header)]
         : Object.entries(headers)
             .filter(([name]) => name.toLowerCase() === header)
             .map(([, value]) => value);
     const token = matches[0];
     if (matches.length !== 1 ||
-        typeof token !== 'string' ||
+        typeof token !== "string" ||
         token.length > maxBytes)
         throw invalidContext();
     const envelope = /^([A-Za-z0-9_-]+)\.([A-Za-z0-9_-]{43})$/.exec(token);
@@ -20,7 +20,7 @@ function readInvocationCredential({ request, header, maxBytes, claimsSchema, inv
         throw invalidContext();
     let value;
     try {
-        value = JSON.parse(Buffer.from(envelope[1], 'base64url').toString('utf8'));
+        value = JSON.parse(Buffer.from(envelope[1], "base64url").toString("utf8"));
     }
     catch {
         throw invalidContext();
@@ -30,61 +30,33 @@ function readInvocationCredential({ request, header, maxBytes, claimsSchema, inv
         throw invalidContext();
     return { token, expiresAt: parsed.data.exp };
 }
-function trustedOrigin({ baseUrl, error, }) {
-    let url;
-    try {
-        url = new URL(baseUrl);
-    }
-    catch {
-        throw error(400, 'invalid_configuration', 'Configure a trusted Atlas origin');
-    }
-    const loopback = url.protocol === 'http:' &&
-        ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname);
-    if ((!loopback && url.protocol !== 'https:') ||
-        url.username ||
-        url.password ||
-        url.pathname !== '/' ||
-        url.search ||
-        url.hash) {
-        throw error(400, 'invalid_configuration', 'Configure an HTTPS Atlas origin without credentials, path, query or fragment');
-    }
-    return url.origin;
-}
-const errorResponseSchema = zod_1.z.object({
-    code: zod_1.z.string().max(128).optional(),
-    detail: zod_1.z.string().max(2000).optional(),
-});
-function createInvocationReadTransport({ baseUrl, fetchImpl = globalThis.fetch, path, header, credential, additionalCredentials = [], timeoutMs, error, failure, }) {
-    const url = `${trustedOrigin({ baseUrl, error })}${path}`;
-    const credentials = [{ header, credential }, ...additionalCredentials];
-    const names = credentials.map((value) => value.header.toLowerCase());
-    if (new Set(names).size !== names.length || names.includes('content-type')) {
-        throw error(400, 'invalid_configuration', 'Credential headers must be distinct');
-    }
-    return async function read({ body, schema, }) {
-        if (credentials.some((value) => value.credential.expiresAt <= Date.now() / 1000)) {
-            throw error(401, 'expired_context', 'The invocation credential expired; start a new invocation');
-        }
-        const response = await fetchImpl(url, {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/json',
-                ...Object.fromEntries(credentials.map((value) => [value.header, value.credential.token])),
-            },
-            body: JSON.stringify(body),
-            redirect: 'error',
-            signal: AbortSignal.timeout(timeoutMs),
-        });
-        const result = await response.json().catch(() => null);
-        if (!response.ok) {
-            const parsed = errorResponseSchema.safeParse(result);
-            throw error(response.status, parsed.success ? (parsed.data.code ?? failure.code) : failure.code, parsed.success
-                ? (parsed.data.detail ?? failure.message)
-                : failure.message);
-        }
-        const validated = schema.safeParse(result);
-        if (!validated.success)
-            throw error(502, 'malformed_response', 'Atlas returned an invalid capability response');
-        return validated.data;
+function createInvocationReadTransport({ baseUrl, fetchImpl, path, header, credential, additionalCredentials = [], timeoutMs, error, failure, }) {
+    const domain = path === "/api/managed-functions/directory/members"
+        ? "caller-directory"
+        : path === "/api/managed-functions/processes/read"
+            ? "process-reference"
+            : null;
+    if (domain === null)
+        throw error(400, "invalid_configuration", "Unsupported invocation read domain");
+    const send = (0, adapters_1.createInvocationDomainTransport)({
+        baseUrl,
+        fetchImpl,
+        domain,
+        credentials: [
+            { header, ...credential },
+            ...additionalCredentials.map((value) => ({
+                header: value.header,
+                ...value.credential,
+            })),
+        ],
+        timeoutMs,
+        error,
+        failure,
+    });
+    return async ({ body, schema, }) => {
+        const parsed = schema.safeParse(await send(body));
+        if (!parsed.success)
+            throw error(502, "malformed_response", "Atlas returned an invalid capability response");
+        return parsed.data;
     };
 }

package/dist/invocation-contract.d.ts

@@ -1,59 +1,2 @@
-import { z } from 'zod';
-export declare const FUNCTION_INVOCATION_IDENTITY_TOKEN_HEADER = "x-sequence-invocation-identity-token";
-export declare const FUNCTION_INVOCATION_CONTEXT_PATH = "/api/managed-functions/invocation/context";
-export declare const functionInvocationIdentityCapabilitySchema: z.ZodObject<{
-    identity: z.ZodLiteral<true>;
-    caller_capabilities: z.ZodOptional<z.ZodLiteral<true>>;
-}, z.core.$strict>;
-export declare function readFunctionInvocationIdentityCapability(manifest: unknown): boolean;
-export declare const functionInvocationContextRequestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    operation: z.ZodLiteral<"getInvocationContext">;
-}, z.core.$strict>, z.ZodObject<{
-    operation: z.ZodLiteral<"getCallerCapabilities">;
-}, z.core.$strict>], "operation">;
-export type FunctionInvocationContextRequest = z.infer<typeof functionInvocationContextRequestSchema>;
-export declare const functionInvocationContextSchema: z.ZodObject<{
-    receiver: z.ZodObject<{
-        functionId: z.ZodString;
-        versionId: z.ZodString;
-        invocationId: z.ZodString;
-        orgId: z.ZodString;
-        serviceAccountId: z.ZodString;
-        serviceAccountSub: z.ZodString;
-    }, z.core.$strict>;
-    caller: z.ZodObject<{
-        kind: z.ZodEnum<{
-            human: "human";
-            service_account: "service_account";
-            system: "system";
-        }>;
-        sub: z.ZodString;
-    }, z.core.$strict>;
-}, z.core.$strict>;
-export type FunctionInvocationContext = z.infer<typeof functionInvocationContextSchema>;
-export declare class FunctionInvocationContextError extends Error {
-    readonly status: number;
-    readonly code: string;
-    readonly name = "FunctionInvocationContextError";
-    constructor(status: number, code: string, message: string);
-}
-export declare const functionInvocationCapabilitiesSchema: z.ZodObject<{
-    receiver: z.ZodObject<{
-        functionId: z.ZodString;
-        versionId: z.ZodString;
-        invocationId: z.ZodString;
-        orgId: z.ZodString;
-        serviceAccountId: z.ZodString;
-        serviceAccountSub: z.ZodString;
-    }, z.core.$strict>;
-    caller: z.ZodObject<{
-        kind: z.ZodEnum<{
-            human: "human";
-            service_account: "service_account";
-            system: "system";
-        }>;
-        sub: z.ZodString;
-    }, z.core.$strict>;
-    capabilities: z.ZodArray<z.ZodString>;
-}, z.core.$strict>;
-export type FunctionInvocationCapabilities = z.infer<typeof functionInvocationCapabilitiesSchema>;
+export { FUNCTION_INVOCATION_IDENTITY_TOKEN_HEADER, FUNCTION_INVOCATION_CONTEXT_PATH, functionInvocationIdentityCapabilitySchema, readFunctionInvocationIdentityCapability, functionInvocationContextRequestSchema, functionInvocationContextSchema, FunctionInvocationContextError, functionInvocationCapabilitiesSchema, } from "@sequenceholdings/platform/contracts";
+export type { FunctionInvocationContextRequest, FunctionInvocationContext, FunctionInvocationCapabilities, } from "@sequenceholdings/platform/contracts";

package/dist/invocation-contract.js

@@ -1,63 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.functionInvocationCapabilitiesSchema = exports.FunctionInvocationContextError = exports.functionInvocationContextSchema = exports.functionInvocationContextRequestSchema = exports.functionInvocationIdentityCapabilitySchema = exports.FUNCTION_INVOCATION_CONTEXT_PATH = exports.FUNCTION_INVOCATION_IDENTITY_TOKEN_HEADER = void 0;
-exports.readFunctionInvocationIdentityCapability = readFunctionInvocationIdentityCapability;
-const zod_1 = require("zod");
-exports.FUNCTION_INVOCATION_IDENTITY_TOKEN_HEADER = 'x-sequence-invocation-identity-token';
-exports.FUNCTION_INVOCATION_CONTEXT_PATH = '/api/managed-functions/invocation/context';
-const identifier = zod_1.z.string().min(1).max(255);
-const principal = zod_1.z.string().min(1).max(512);
-exports.functionInvocationIdentityCapabilitySchema = zod_1.z.strictObject({
-    identity: zod_1.z.literal(true),
-    caller_capabilities: zod_1.z.literal(true).optional(),
-});
-function readFunctionInvocationIdentityCapability(manifest) {
-    if (typeof manifest !== 'object' || manifest === null)
-        return false;
-    const capabilities = Reflect.get(manifest, 'capabilities');
-    if (typeof capabilities !== 'object' || capabilities === null)
-        return false;
-    return exports.functionInvocationIdentityCapabilitySchema.safeParse(Reflect.get(capabilities, 'invocation')).success;
-}
-exports.functionInvocationContextRequestSchema = zod_1.z.discriminatedUnion('operation', [
-    zod_1.z.strictObject({ operation: zod_1.z.literal('getInvocationContext') }),
-    zod_1.z.strictObject({ operation: zod_1.z.literal('getCallerCapabilities') }),
-]);
-exports.functionInvocationContextSchema = zod_1.z.strictObject({
-    receiver: zod_1.z
-        .strictObject({
-        functionId: identifier,
-        versionId: identifier,
-        invocationId: identifier,
-        orgId: identifier,
-        serviceAccountId: identifier,
-        serviceAccountSub: principal,
-    })
-        .refine((value) => value.serviceAccountSub === `service-account|${value.serviceAccountId}`, 'The receiver subject must identify the attached service account'),
-    caller: zod_1.z.strictObject({
-        kind: zod_1.z.enum(['human', 'service_account', 'system']),
-        sub: principal,
-    }),
-});
-class FunctionInvocationContextError extends Error {
-    status;
-    code;
-    name = 'FunctionInvocationContextError';
-    constructor(status, code, message) {
-        super(message);
-        this.status = status;
-        this.code = code;
-    }
-}
-exports.FunctionInvocationContextError = FunctionInvocationContextError;
-exports.functionInvocationCapabilitiesSchema = exports.functionInvocationContextSchema
-    .extend({
-    capabilities: zod_1.z
-        .array(zod_1.z
-        .string()
-        .min(1)
-        .max(140)
-        .regex(/^[a-z0-9][a-z0-9/_.:-]*$/))
-        .max(256),
-})
-    .refine((value) => new Set(value.capabilities).size === value.capabilities.length, 'Capabilities must be unique');
+exports.functionInvocationCapabilitiesSchema = exports.FunctionInvocationContextError = exports.functionInvocationContextSchema = exports.functionInvocationContextRequestSchema = exports.readFunctionInvocationIdentityCapability = exports.functionInvocationIdentityCapabilitySchema = exports.FUNCTION_INVOCATION_CONTEXT_PATH = exports.FUNCTION_INVOCATION_IDENTITY_TOKEN_HEADER = void 0;
+var contracts_1 = require("@sequenceholdings/platform/contracts");
+Object.defineProperty(exports, "FUNCTION_INVOCATION_IDENTITY_TOKEN_HEADER", { enumerable: true, get: function () { return contracts_1.FUNCTION_INVOCATION_IDENTITY_TOKEN_HEADER; } });
+Object.defineProperty(exports, "FUNCTION_INVOCATION_CONTEXT_PATH", { enumerable: true, get: function () { return contracts_1.FUNCTION_INVOCATION_CONTEXT_PATH; } });
+Object.defineProperty(exports, "functionInvocationIdentityCapabilitySchema", { enumerable: true, get: function () { return contracts_1.functionInvocationIdentityCapabilitySchema; } });
+Object.defineProperty(exports, "readFunctionInvocationIdentityCapability", { enumerable: true, get: function () { return contracts_1.readFunctionInvocationIdentityCapability; } });
+Object.defineProperty(exports, "functionInvocationContextRequestSchema", { enumerable: true, get: function () { return contracts_1.functionInvocationContextRequestSchema; } });
+Object.defineProperty(exports, "functionInvocationContextSchema", { enumerable: true, get: function () { return contracts_1.functionInvocationContextSchema; } });
+Object.defineProperty(exports, "FunctionInvocationContextError", { enumerable: true, get: function () { return contracts_1.FunctionInvocationContextError; } });
+Object.defineProperty(exports, "functionInvocationCapabilitiesSchema", { enumerable: true, get: function () { return contracts_1.functionInvocationCapabilitiesSchema; } });

package/dist/invocation.d.ts

@@ -1,7 +1,7 @@
-import { type FunctionInvocationCapabilities, type FunctionInvocationContext } from './invocation-contract';
-export * from './invocation-contract';
-import type { FunctionInvocationClientOptions } from './invocation-client';
-export type { FunctionInvocationClientOptions } from './invocation-client';
+import { type FunctionInvocationCapabilities, type FunctionInvocationContext } from "./invocation-contract";
+export * from "./invocation-contract";
+import type { FunctionInvocationClientOptions } from "./invocation-client";
+export type { FunctionInvocationClientOptions } from "./invocation-client";
 export interface FunctionInvocationClient {
     getInvocationContext(): Promise<FunctionInvocationContext>;
     getCallerCapabilities(): Promise<FunctionInvocationCapabilities>;

package/dist/invocation.js

@@ -15,20 +15,21 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createFunctionInvocationClient = createFunctionInvocationClient;
+const adapters_1 = require("@sequenceholdings/platform/adapters");
 const zod_1 = require("zod");
 const invocation_contract_1 = require("./invocation-contract");
 __exportStar(require("./invocation-contract"), exports);
 const identifier = zod_1.z.string().min(1).max(255);
 const principal = zod_1.z.string().min(1).max(512);
 const tokenClaimsSchema = zod_1.z.strictObject({
-    audience: zod_1.z.literal('atlas-managed-function-invocation-identity'),
+    audience: zod_1.z.literal("atlas-managed-function-invocation-identity"),
     environment: zod_1.z.string().min(1).max(4096),
     functionId: identifier,
     versionId: identifier,
     invocationId: identifier,
     serviceAccountId: identifier,
     org: identifier,
-    callerKind: zod_1.z.enum(['human', 'service_account', 'system']),
+    callerKind: zod_1.z.enum(["human", "service_account", "system"]),
     callerSub: principal,
     callerAuthenticationMethod: identifier,
     exp: zod_1.z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
@@ -41,26 +42,28 @@ const errorSchema = zod_1.z.strictObject({
         .regex(/^[a-z][a-z0-9_]*$/),
     detail: zod_1.z.string().min(1).max(2000),
 });
-const invalidContext = () => new invocation_contract_1.FunctionInvocationContextError(401, 'invalid_context', 'This invocation has no valid identity credential');
-function readCredential({ request }) {
+const invalidContext = () => new invocation_contract_1.FunctionInvocationContextError(401, "invalid_context", "This invocation has no valid identity credential");
+function readCredential({ request, }) {
     const { headers } = request;
-    const matches = typeof headers.get === 'function'
+    const matches = typeof headers.get === "function"
         ? [headers.get(invocation_contract_1.FUNCTION_INVOCATION_IDENTITY_TOKEN_HEADER)]
         : Object.entries(headers)
             .filter(([name]) => name.toLowerCase() === invocation_contract_1.FUNCTION_INVOCATION_IDENTITY_TOKEN_HEADER)
             .map(([, value]) => value);
     const token = matches[0];
-    if (matches.length !== 1 || typeof token !== 'string' || token.length > 16_384)
+    if (matches.length !== 1 ||
+        typeof token !== "string" ||
+        token.length > 16_384)
         throw invalidContext();
     const envelope = /^([A-Za-z0-9_-]+)\.([A-Za-z0-9_-]{43})$/.exec(token);
     if (!envelope?.[1])
         throw invalidContext();
     let value;
     try {
-        const decoded = Buffer.from(envelope[1], 'base64url');
-        if (decoded.toString('base64url') !== envelope[1])
+        const decoded = Buffer.from(envelope[1], "base64url");
+        if (decoded.toString("base64url") !== envelope[1])
             throw invalidContext();
-        value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(decoded));
+        value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(decoded));
     }
     catch {
         throw invalidContext();
@@ -71,7 +74,7 @@ function readCredential({ request }) {
     return { token, claims: parsed.data };
 }
 function trustedOrigin(baseUrl) {
-    const invalid = () => new invocation_contract_1.FunctionInvocationContextError(400, 'invalid_configuration', 'Configure a trusted HTTPS Atlas origin without credentials, path, query or fragment');
+    const invalid = () => new invocation_contract_1.FunctionInvocationContextError(400, "invalid_configuration", "Configure a trusted HTTPS Atlas origin without credentials, path, query or fragment");
     let url;
     try {
         url = new URL(baseUrl);
@@ -79,66 +82,42 @@ function trustedOrigin(baseUrl) {
     catch {
         throw invalid();
     }
-    const loopback = url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname);
-    if ((!loopback && url.protocol !== 'https:') ||
+    const loopback = url.protocol === "http:" &&
+        ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+    if ((!loopback && url.protocol !== "https:") ||
         url.username ||
         url.password ||
-        url.pathname !== '/' ||
+        url.pathname !== "/" ||
         url.search ||
         url.hash)
         throw invalid();
     return url.origin;
 }
-function requireFresh(claims) {
-    if (claims.exp <= Date.now() / 1000)
-        throw new invocation_contract_1.FunctionInvocationContextError(401, 'expired_context', 'The identity credential expired; start a new invocation');
-}
-function matchesInvocation({ context, claims, }) {
-    const { receiver, caller } = context;
-    return (receiver.functionId === claims.functionId &&
-        receiver.versionId === claims.versionId &&
-        receiver.invocationId === claims.invocationId &&
-        receiver.orgId === claims.org &&
-        receiver.serviceAccountId === claims.serviceAccountId &&
-        caller.kind === claims.callerKind &&
-        caller.sub === claims.callerSub);
-}
 function createFunctionInvocationClient({ request, baseUrl, fetchImpl = globalThis.fetch, }) {
-    const url = `${trustedOrigin(baseUrl)}${invocation_contract_1.FUNCTION_INVOCATION_CONTEXT_PATH}`;
+    trustedOrigin(baseUrl);
     const { token, claims } = readCredential({ request });
-    async function read(operation, schema) {
-        requireFresh(claims);
-        let response;
-        try {
-            response = await fetchImpl(url, {
-                method: 'POST',
-                headers: {
-                    'content-type': 'application/json',
-                    [invocation_contract_1.FUNCTION_INVOCATION_IDENTITY_TOKEN_HEADER]: token,
-                },
-                body: JSON.stringify(invocation_contract_1.functionInvocationContextRequestSchema.parse({ operation })),
-                redirect: 'error',
-                signal: AbortSignal.timeout(30_000),
-            });
-        }
-        catch {
-            throw new invocation_contract_1.FunctionInvocationContextError(502, 'context_request_failed', 'The invocation context request failed');
-        }
-        if (response.redirected || (response.status >= 300 && response.status < 400))
-            throw new invocation_contract_1.FunctionInvocationContextError(502, 'redirect_refused', 'The invocation context request must not redirect');
-        const result = await response.json().catch(() => null);
-        if (!response.ok) {
-            const error = errorSchema.safeParse(result);
-            throw new invocation_contract_1.FunctionInvocationContextError(response.status, error.success ? error.data.code : 'context_read_failed', error.success && !error.data.detail.includes(token) ? error.data.detail : 'Invocation context read failed');
-        }
-        requireFresh(claims);
-        const parsed = schema.safeParse(result);
-        if (!parsed.success || !matchesInvocation({ context: parsed.data, claims }))
-            throw new invocation_contract_1.FunctionInvocationContextError(502, 'malformed_response', 'Atlas returned an invalid invocation context response');
-        return parsed.data;
-    }
-    return {
-        getInvocationContext: () => read('getInvocationContext', invocation_contract_1.functionInvocationContextSchema),
-        getCallerCapabilities: () => read('getCallerCapabilities', invocation_contract_1.functionInvocationCapabilitiesSchema),
-    };
+    const send = (0, adapters_1.createInvocationDomainTransport)({
+        baseUrl,
+        fetchImpl,
+        domain: "invocation",
+        credentials: [
+            {
+                header: invocation_contract_1.FUNCTION_INVOCATION_IDENTITY_TOKEN_HEADER,
+                token,
+                expiresAt: claims.exp,
+            },
+        ],
+        error: (status, code, message) => new invocation_contract_1.FunctionInvocationContextError(["transport_failed", "timeout", "redirect_refused"].includes(code)
+            ? 502
+            : status, ["transport_failed", "timeout"].includes(code)
+            ? "context_request_failed"
+            : code, ["transport_failed", "timeout"].includes(code)
+            ? "The invocation context request failed"
+            : message),
+        failure: {
+            code: "context_read_failed",
+            message: "Invocation context read failed",
+        },
+    });
+    return (0, adapters_1.createInvocationContextClient)({ claims, send });
 }