@the-open-engine/zeroshot 6.30.2 → 6.31.0

package/src/agent-cli-provider/omp/sdk-protocol-types.ts

@@ -0,0 +1,156 @@
+import { OMP_SDK_TOOL_IDS } from './sdk-settings';
+import type {
+  OmpModelsConfig,
+  OmpSdkAuth,
+  OmpSdkToolId as SettingsOmpSdkToolId,
+} from './sdk-settings';
+import type { OmpSdkTerminalEvidence, ReasoningEffort, ResultEvent } from '../types';
+
+export const OMP_SDK_PROTOCOL_VERSION = 1 as const;
+export const OMP_SDK_BACKEND_VERSION = '17.2.1' as const;
+export const OMP_SDK_BUN_VERSION = '1.3.14' as const;
+export const OMP_SDK_MAX_REQUEST_BYTES = 8 * 1024 * 1024;
+export const OMP_SDK_MAX_FRAME_BYTES = 1024 * 1024;
+export const OMP_SDK_MAX_STDOUT_BYTES = 8 * 1024 * 1024;
+export const OMP_SDK_MAX_CREDENTIAL_BYTES = 64 * 1024;
+
+export const OMP_SDK_EXECUTION_CONTEXTS = ['host', 'detached', 'docker', 'benchmark'] as const;
+export { OMP_SDK_TOOL_IDS };
+export type OmpSdkToolId = SettingsOmpSdkToolId;
+export type OmpSdkRequestAuth = OmpSdkAuth;
+export type OmpSdkModelsConfig = OmpModelsConfig;
+export type OmpSdkOutputMode = 'json' | 'text';
+export type OmpSdkExecutionContext = (typeof OMP_SDK_EXECUTION_CONTEXTS)[number];
+
+interface OmpSdkRequestBase {
+  readonly protocolVersion: 1;
+  readonly runId: string;
+  readonly cwd: string;
+  readonly executionContext: OmpSdkExecutionContext;
+  readonly prompt: string;
+  readonly modelSelector: string;
+  readonly reasoningEffort: ReasoningEffort;
+  readonly modelsConfig: OmpSdkModelsConfig;
+  readonly auth: OmpSdkRequestAuth;
+  readonly tools: readonly OmpSdkToolId[];
+  readonly context: string;
+}
+
+export interface OmpSdkJsonSidecarRequest extends OmpSdkRequestBase {
+  readonly outputMode: 'json';
+  readonly outputSchema: boolean | Readonly<Record<string, unknown>>;
+}
+export interface OmpSdkTextSidecarRequest extends OmpSdkRequestBase {
+  readonly outputMode: 'text';
+  readonly outputSchema?: never;
+}
+export type OmpSdkSidecarRequest = OmpSdkJsonSidecarRequest | OmpSdkTextSidecarRequest;
+
+export const OMP_SDK_TEXT_OUTPUT_SCHEMA = Object.freeze({
+  type: 'object',
+  properties: Object.freeze({ result: Object.freeze({ type: 'string' }) }),
+  required: Object.freeze(['result']),
+  additionalProperties: false,
+}) as Readonly<Record<string, unknown>>;
+
+export const OMP_SDK_PROGRESS_STAGES = [
+  'starting',
+  'resolving-model',
+  'running',
+  'tearing-down',
+] as const;
+export type OmpSdkProgressStage = (typeof OMP_SDK_PROGRESS_STAGES)[number];
+
+export interface OmpSdkProtocolProgressFrame {
+  readonly protocolVersion: 1;
+  readonly type: 'progress';
+  readonly runId: string;
+  readonly sequence: number;
+  readonly stage: OmpSdkProgressStage;
+}
+export interface OmpSdkProtocolResultFrame extends OmpSdkTerminalEvidence {
+  readonly protocolVersion: 1;
+  readonly type: 'result';
+  readonly runId: string;
+  readonly value: unknown;
+}
+
+export const OMP_SDK_ERROR_CODES = [
+  'invalid-request',
+  'model-resolution',
+  'model-fallback',
+  'provider-auth',
+  'provider-rate-limit',
+  'provider-timeout',
+  'provider-error',
+  'schema-violation',
+  'cancelled',
+  'sdk-error',
+  'cleanup-error',
+  'internal-error',
+] as const;
+export type OmpSdkErrorCode = (typeof OMP_SDK_ERROR_CODES)[number];
+export type OmpSdkErrorCategory =
+  | 'request'
+  | 'model'
+  | 'auth'
+  | 'rate-limit'
+  | 'timeout'
+  | 'provider'
+  | 'schema'
+  | 'cancelled'
+  | 'sdk'
+  | 'cleanup'
+  | 'internal';
+export interface OmpSdkSafeError {
+  readonly code: OmpSdkErrorCode;
+  readonly category: OmpSdkErrorCategory;
+  readonly retryable: boolean;
+  readonly redacted: true;
+}
+export interface OmpSdkProtocolErrorFrame {
+  readonly protocolVersion: 1;
+  readonly type: 'error';
+  readonly runId: string;
+  readonly backend: OmpSdkTerminalEvidence['backend'];
+  readonly runtime: OmpSdkTerminalEvidence['runtime'];
+  readonly error: OmpSdkSafeError;
+}
+export type OmpSdkProtocolFrame =
+  | OmpSdkProtocolProgressFrame
+  | OmpSdkProtocolResultFrame
+  | OmpSdkProtocolErrorFrame;
+export type OmpSdkProtocolTerminalFrame = OmpSdkProtocolResultFrame | OmpSdkProtocolErrorFrame;
+export type OmpSdkCollectedTerminal =
+  | {
+      readonly type: 'result';
+      readonly frame: OmpSdkProtocolResultFrame;
+      readonly event: ResultEvent;
+    }
+  | { readonly type: 'error'; readonly frame: OmpSdkProtocolErrorFrame };
+
+export interface OmpSdkProtocolCollectorOptions {
+  readonly request: OmpSdkSidecarRequest;
+  readonly maxFrameBytes?: number;
+  readonly maxStdoutBytes?: number;
+}
+export interface OmpSdkProtocolCollector {
+  readonly progress: readonly OmpSdkProtocolProgressFrame[];
+  write(chunk: string | Uint8Array): readonly OmpSdkProtocolFrame[];
+  finish(exitCode: number): OmpSdkCollectedTerminal;
+}
+
+export const CATEGORY: Readonly<Record<OmpSdkErrorCode, OmpSdkErrorCategory>> = {
+  'invalid-request': 'request',
+  'model-resolution': 'model',
+  'model-fallback': 'model',
+  'provider-auth': 'auth',
+  'provider-rate-limit': 'rate-limit',
+  'provider-timeout': 'timeout',
+  'provider-error': 'provider',
+  'schema-violation': 'schema',
+  cancelled: 'cancelled',
+  'sdk-error': 'sdk',
+  'cleanup-error': 'cleanup',
+  'internal-error': 'internal',
+};

package/src/agent-cli-provider/omp/sdk-protocol-value.ts

@@ -0,0 +1,234 @@
+import Ajv from 'ajv';
+
+import { contractError } from '../contract-errors';
+import { parseExactOmpModelSelector } from './sdk-settings';
+const MAX_RUN_ID_BYTES = 128;
+const MAX_SELECTOR_BYTES = 1024;
+const MAX_JSON_DEPTH = 64;
+const MAX_JSON_NODES = 100_000;
+const MAX_SCHEMA_STRING_BYTES = 16 * 1024;
+const MAX_SCHEMA_ARRAY_ITEMS = 4_096;
+const MAX_SCHEMA_OBJECT_KEYS = 4_096;
+const MAX_SCHEMA_KEY_BYTES = 1_024;
+const UNSAFE_REGEX_SCHEMA_KEYWORDS: Readonly<Record<string, true>> = {
+  pattern: true,
+  patternProperties: true,
+};
+
+export type Fail = (message: string, field?: string) => never;
+export function includesLiteral<T extends string>(
+  values: readonly T[],
+  value: unknown
+): value is T {
+  return typeof value === 'string' && values.some((candidate) => candidate === value);
+}
+function failure(code: string, message: string, field?: string): never {
+  throw contractError({ code, message, exitCode: 2, ...(field === undefined ? {} : { field }) });
+}
+export function protocolFailure(message: string, field?: string): never {
+  return failure('omp-sdk-protocol', message, field);
+}
+export function requestFailure(message: string, field?: string): never {
+  return failure('invalid-omp-sdk-request', message, field);
+}
+export function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+export function exact(
+  record: Record<string, unknown>,
+  required: readonly string[],
+  optional: readonly string[],
+  subject: string,
+  fail: Fail
+): void {
+  const allowed = new Set([...required, ...optional]);
+  for (const key of required) {
+    if (!Object.prototype.hasOwnProperty.call(record, key)) {
+      fail(`${subject}.${key} is required.`, `${subject}.${key}`);
+    }
+  }
+  for (const key of Object.keys(record)) {
+    if (!allowed.has(key)) fail(`${subject}.${key} is not allowed.`, `${subject}.${key}`);
+  }
+}
+export function string(
+  value: unknown,
+  field: string,
+  maxBytes: number,
+  empty: boolean,
+  fail: Fail
+): string {
+  if (typeof value !== 'string' || (!empty && value.length === 0)) {
+    return fail(`${field} must be ${empty ? 'a string' : 'a non-empty string'}.`, field);
+  }
+  if (Buffer.byteLength(value) > maxBytes)
+    return fail(`${field} exceeds ${maxBytes} bytes.`, field);
+  return value;
+}
+export function parseRunId(value: unknown, field: string, fail: Fail): string {
+  const parsed = string(value, field, MAX_RUN_ID_BYTES, false, fail);
+  if (!/^[A-Za-z0-9][A-Za-z0-9._:-]*$/.test(parsed)) {
+    fail(`${field} contains unsupported characters.`, field);
+  }
+  return parsed;
+}
+export function literal<T extends string | number | boolean>(
+  value: unknown,
+  expected: T,
+  field: string,
+  fail: Fail
+): T {
+  if (value !== expected) return fail(`${field} must be ${JSON.stringify(expected)}.`, field);
+  return expected;
+}
+export function number(value: unknown, field: string, integer: boolean): number {
+  if (
+    typeof value !== 'number' ||
+    !Number.isFinite(value) ||
+    value < 0 ||
+    (integer && !Number.isInteger(value))
+  ) {
+    protocolFailure(`${field} must be a finite nonnegative${integer ? ' integer' : ''}.`, field);
+  }
+  return value;
+}
+export function json(value: unknown, field: string, fail: Fail): void {
+  const stack: Array<{ value: unknown; depth: number; field: string }> = [
+    { value, depth: 0, field },
+  ];
+  const seen = new Set<object>();
+  let count = 0;
+  while (stack.length > 0) {
+    const item = stack.pop();
+    if (item === undefined) break;
+    if (++count > MAX_JSON_NODES) fail(`${field} exceeds ${MAX_JSON_NODES} JSON nodes.`, field);
+    if (item.depth > MAX_JSON_DEPTH) fail(`${field} exceeds JSON depth ${MAX_JSON_DEPTH}.`, field);
+    const current = item.value;
+    if (
+      current === null ||
+      typeof current === 'string' ||
+      typeof current === 'boolean' ||
+      (typeof current === 'number' && Number.isFinite(current))
+    ) {
+      continue;
+    }
+    if (typeof current !== 'object')
+      fail(`${item.field} must contain only JSON values.`, item.field);
+    if (seen.has(current))
+      fail(`${item.field} must not contain shared or cyclic objects.`, item.field);
+    seen.add(current);
+    if (Array.isArray(current)) {
+      current.forEach((child, index) =>
+        stack.push({ value: child, depth: item.depth + 1, field: `${item.field}[${index}]` })
+      );
+    } else {
+      const prototype = Reflect.getPrototypeOf(current);
+      if (prototype !== Object.prototype && prototype !== null) {
+        fail(`${item.field} must contain plain JSON objects.`, item.field);
+      }
+      Object.entries(current).forEach(([key, child]) =>
+        stack.push({ value: child, depth: item.depth + 1, field: `${item.field}.${key}` })
+      );
+    }
+  }
+}
+export function serializedLimit(value: unknown, max: number, subject: string, fail: Fail): void {
+  let encoded: unknown;
+  try {
+    encoded = JSON.stringify(value);
+  } catch {
+    fail(`${subject} is not JSON serializable.`);
+  }
+  if (typeof encoded !== 'string' || Buffer.byteLength(encoded) > max) {
+    fail(`${subject} exceeds ${max} bytes.`);
+  }
+}
+export function selector(value: unknown, field: string, fail: Fail): string {
+  const parsed = string(value, field, MAX_SELECTOR_BYTES, false, fail);
+  try {
+    parseExactOmpModelSelector(parsed);
+  } catch {
+    fail(`${field} must be an exact full provider/model selector.`, field);
+  }
+  return parsed;
+}
+export function validateSchemaSafety(schema: unknown): void {
+  const stack: Array<{ readonly value: unknown; readonly field: string }> = [
+    { value: schema, field: 'request.outputSchema' },
+  ];
+  while (stack.length > 0) {
+    const item = stack.pop();
+    if (item === undefined) break;
+    if (typeof item.value === 'string') {
+      if (Buffer.byteLength(item.value) > MAX_SCHEMA_STRING_BYTES) {
+        requestFailure(`${item.field} exceeds ${MAX_SCHEMA_STRING_BYTES} bytes.`, item.field);
+      }
+      continue;
+    }
+    if (Array.isArray(item.value)) {
+      if (item.value.length > MAX_SCHEMA_ARRAY_ITEMS) {
+        requestFailure(`${item.field} exceeds ${MAX_SCHEMA_ARRAY_ITEMS} items.`, item.field);
+      }
+      item.value.forEach((value, index) => stack.push({ value, field: `${item.field}[${index}]` }));
+      continue;
+    }
+    if (!isRecord(item.value)) continue;
+    const entries = Object.entries(item.value);
+    if (entries.length > MAX_SCHEMA_OBJECT_KEYS) {
+      requestFailure(`${item.field} exceeds ${MAX_SCHEMA_OBJECT_KEYS} properties.`, item.field);
+    }
+    for (const [key, value] of entries) {
+      if (Buffer.byteLength(key) > MAX_SCHEMA_KEY_BYTES) {
+        requestFailure(`${item.field} has an oversized keyword or property name.`, item.field);
+      }
+      const field = `${item.field}.${key}`;
+      if (UNSAFE_REGEX_SCHEMA_KEYWORDS[key] === true) {
+        requestFailure(
+          `${field} is forbidden because regular-expression schemas are not accepted.`,
+          field
+        );
+      }
+      stack.push({ value, field });
+    }
+  }
+}
+function deepFreezeJson(value: unknown): void {
+  if (typeof value !== 'object' || value === null || Object.isFrozen(value)) return;
+  if (Array.isArray(value)) {
+    value.forEach((child) => deepFreezeJson(child));
+  } else if (isRecord(value)) {
+    Object.values(value).forEach((child) => deepFreezeJson(child));
+  }
+  Object.freeze(value);
+}
+/** @returns A deeply frozen boolean or object JSON Schema snapshot. */
+export function immutableJsonSnapshot(value: unknown): boolean | Readonly<Record<string, unknown>> {
+  const encoded: unknown = JSON.stringify(value);
+  if (typeof encoded !== 'string') {
+    requestFailure('request.outputSchema is not JSON serializable.');
+  }
+  const parsed: unknown = JSON.parse(encoded);
+  if (typeof parsed !== 'boolean' && !isRecord(parsed)) {
+    requestFailure('request.outputSchema must be a JSON Schema object or boolean.');
+  }
+  deepFreezeJson(parsed);
+  return parsed;
+}
+export function schemaValidator(
+  schema: boolean | Readonly<Record<string, unknown>>
+): (value: unknown) => boolean {
+  try {
+    const validate = new Ajv({
+      allErrors: true,
+      coerceTypes: false,
+      strict: false,
+      validateFormats: false,
+    }).compile(schema);
+    return (value: unknown): boolean => validate(value) === true;
+  } catch {
+    return requestFailure(
+      'request.outputSchema must be a valid JSON Schema.',
+      'request.outputSchema'
+    );
+  }
+}

package/src/agent-cli-provider/omp/sdk-protocol.ts

@@ -0,0 +1,46 @@
+export {
+  OMP_SDK_BACKEND_VERSION,
+  OMP_SDK_BUN_VERSION,
+  OMP_SDK_ERROR_CODES,
+  OMP_SDK_MAX_CREDENTIAL_BYTES,
+  OMP_SDK_MAX_FRAME_BYTES,
+  OMP_SDK_MAX_REQUEST_BYTES,
+  OMP_SDK_MAX_STDOUT_BYTES,
+  OMP_SDK_PROGRESS_STAGES,
+  OMP_SDK_PROTOCOL_VERSION,
+  OMP_SDK_TEXT_OUTPUT_SCHEMA,
+  OMP_SDK_TOOL_IDS,
+} from './sdk-protocol-types';
+export type {
+  OmpSdkCollectedTerminal,
+  OmpSdkErrorCategory,
+  OmpSdkErrorCode,
+  OmpSdkExecutionContext,
+  OmpSdkJsonSidecarRequest,
+  OmpSdkModelsConfig,
+  OmpSdkOutputMode,
+  OmpSdkProgressStage,
+  OmpSdkProtocolCollector,
+  OmpSdkProtocolCollectorOptions,
+  OmpSdkProtocolErrorFrame,
+  OmpSdkProtocolFrame,
+  OmpSdkProtocolProgressFrame,
+  OmpSdkProtocolResultFrame,
+  OmpSdkProtocolTerminalFrame,
+  OmpSdkRequestAuth,
+  OmpSdkSafeError,
+  OmpSdkSidecarRequest,
+  OmpSdkTextSidecarRequest,
+  OmpSdkToolId,
+} from './sdk-protocol-types';
+export {
+  decodeOmpSdkSidecarRequest,
+  ompSdkOutputSchemaForRequest,
+  parseOmpSdkSidecarRequest,
+} from './sdk-protocol-request';
+export { decodeOmpSdkProtocolFrame, parseOmpSdkProtocolFrame } from './sdk-protocol-frame';
+export {
+  normalizeOmpSdkResultFrame,
+  validateOmpSdkProtocolResultFrame,
+} from './sdk-protocol-result';
+export { createOmpSdkProtocolCollector } from './sdk-protocol-collector';

package/src/agent-cli-provider/omp/sdk-runtime.ts

@@ -0,0 +1,159 @@
+import { resolve } from 'node:path';
+import { isRecord } from '../json';
+
+export const OMP_SDK_HOST_SUPERVISOR_PROTOCOL_VERSION = 1 as const;
+export const OMP_SDK_MAX_SUPERVISOR_ATTESTATION_BYTES = 8 * 1024;
+
+export interface OmpSdkSupervisorSemanticOutcome {
+  readonly exitCode: number | null;
+  readonly signal: string | null;
+}
+
+export interface OmpSdkSupervisorCleanAttestation {
+  readonly protocolVersion: typeof OMP_SDK_HOST_SUPERVISOR_PROTOCOL_VERSION;
+  readonly type: 'cleanup-attestation';
+  readonly status: 'clean';
+  readonly mode: 'linux-subreaper-pidfd';
+  readonly subreaper: true;
+  readonly pidfd: true;
+  readonly terminalBuffered: true;
+  readonly ownedProcessCount: 0;
+  readonly cancelled: boolean;
+  readonly semantic: OmpSdkSupervisorSemanticOutcome;
+}
+
+export interface OmpSdkSupervisorErrorAttestation {
+  readonly protocolVersion: typeof OMP_SDK_HOST_SUPERVISOR_PROTOCOL_VERSION;
+  readonly type: 'cleanup-attestation';
+  readonly status: 'error';
+  readonly code: 'capability-unavailable' | 'cleanup-uncertain' | 'invalid-invocation';
+  readonly semanticStarted: boolean;
+}
+
+export type OmpSdkSupervisorAttestation =
+  | OmpSdkSupervisorCleanAttestation
+  | OmpSdkSupervisorErrorAttestation;
+
+
+function compareKeys(left: string, right: string): number {
+  if (left < right) return -1;
+  if (left > right) return 1;
+  return 0;
+}
+
+function hasExactKeys(value: Record<string, unknown>, expected: readonly string[]): boolean {
+  const actual = Object.keys(value).sort(compareKeys);
+  const keys = [...expected].sort(compareKeys);
+  return actual.length === keys.length && actual.every((key, index) => key === keys[index]);
+}
+
+function isExitCode(value: unknown): value is number | null {
+  return (
+    value === null ||
+    (typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 && value <= 255)
+  );
+}
+
+function isSignal(value: unknown): value is string | null {
+  return value === null || (typeof value === 'string' && /^SIG[A-Z0-9]+$/u.test(value));
+}
+
+function isSupervisorErrorCode(
+  value: unknown
+): value is OmpSdkSupervisorErrorAttestation['code'] {
+  return (
+    value === 'capability-unavailable' ||
+    value === 'cleanup-uncertain' ||
+    value === 'invalid-invocation'
+  );
+}
+
+function isSupervisorSemanticOutcome(value: unknown): value is OmpSdkSupervisorSemanticOutcome {
+  if (
+    !isRecord(value) ||
+    !hasExactKeys(value, ['exitCode', 'signal']) ||
+    !isExitCode(value.exitCode) ||
+    !isSignal(value.signal)
+  ) {
+    return false;
+  }
+  return (value.exitCode === null) !== (value.signal === null);
+}
+
+function isSupervisorErrorAttestation(
+  value: unknown
+): value is OmpSdkSupervisorErrorAttestation {
+  return (
+    isRecord(value) &&
+    hasExactKeys(value, ['protocolVersion', 'type', 'status', 'code', 'semanticStarted']) &&
+    value.protocolVersion === OMP_SDK_HOST_SUPERVISOR_PROTOCOL_VERSION &&
+    value.type === 'cleanup-attestation' &&
+    value.status === 'error' &&
+    isSupervisorErrorCode(value.code) &&
+    typeof value.semanticStarted === 'boolean'
+  );
+}
+
+function isSupervisorCleanAttestation(
+  value: unknown
+): value is OmpSdkSupervisorCleanAttestation {
+  return (
+    isRecord(value) &&
+    hasExactKeys(value, [
+      'protocolVersion',
+      'type',
+      'status',
+      'mode',
+      'subreaper',
+      'pidfd',
+      'terminalBuffered',
+      'ownedProcessCount',
+      'cancelled',
+      'semantic',
+    ]) &&
+    value.protocolVersion === OMP_SDK_HOST_SUPERVISOR_PROTOCOL_VERSION &&
+    value.type === 'cleanup-attestation' &&
+    value.status === 'clean' &&
+    value.mode === 'linux-subreaper-pidfd' &&
+    value.subreaper === true &&
+    value.pidfd === true &&
+    value.terminalBuffered === true &&
+    value.ownedProcessCount === 0 &&
+    typeof value.cancelled === 'boolean' &&
+    isSupervisorSemanticOutcome(value.semantic)
+  );
+}
+
+export function parseOmpSdkSupervisorAttestation(bytes: Buffer): OmpSdkSupervisorAttestation {
+  if (bytes.byteLength === 0 || bytes.byteLength > OMP_SDK_MAX_SUPERVISOR_ATTESTATION_BYTES) {
+    throw new Error('OMP SDK supervisor attestation size is invalid.');
+  }
+  const source = bytes.toString('utf8');
+  if (!source.endsWith('\n') || source.slice(0, -1).includes('\n')) {
+    throw new Error('OMP SDK supervisor must emit exactly one attestation frame.');
+  }
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(source.slice(0, -1));
+  } catch {
+    throw new Error('OMP SDK supervisor attestation is malformed.');
+  }
+  if (!isRecord(parsed) || parsed.protocolVersion !== OMP_SDK_HOST_SUPERVISOR_PROTOCOL_VERSION ||
+      parsed.type !== 'cleanup-attestation' || (parsed.status !== 'clean' && parsed.status !== 'error')) {
+    throw new Error('OMP SDK supervisor attestation identity is invalid.');
+  }
+  if (parsed.status === 'error') {
+    if (!isSupervisorErrorAttestation(parsed)) {
+      throw new Error('OMP SDK supervisor error attestation is invalid.');
+    }
+    return parsed;
+  }
+  if (!isSupervisorCleanAttestation(parsed)) {
+    throw new Error('OMP SDK supervisor clean attestation is invalid.');
+  }
+  return parsed;
+}
+
+export function resolveOmpSdkHostSupervisorPath(): string {
+  return resolve(__dirname, '..', '..', '..', 'scripts', 'omp', 'host-supervisor.ts');
+}

package/src/agent-cli-provider/omp/sdk-settings-auth.ts

@@ -0,0 +1,78 @@
+import * as path from 'node:path';
+
+import { invalidField } from '../contract-errors';
+import { isRecord } from '../json';
+import { ENV_NAME } from './sdk-settings-constants';
+import type { OmpSdkAuth, OmpSettingsValidationContext } from './sdk-settings-types';
+import { assertProviderId, enumValue, rejectUnknown } from './sdk-settings-values';
+
+export function normalizeAuth(value: unknown, context: OmpSettingsValidationContext): OmpSdkAuth {
+  if (!isRecord(value)) {
+    invalidField('providerSettings.omp.auth', 'OMP auth must be a discriminated object.');
+  }
+  const mode = enumValue(
+    value.mode,
+    ['environment', 'broker', 'omp-home', 'none'] as const,
+    'providerSettings.omp.auth.mode'
+  );
+  if (mode === 'environment') {
+    rejectUnknown(value, new Set(['mode', 'credentials']), 'providerSettings.omp.auth');
+    if (!isRecord(value.credentials) || Object.keys(value.credentials).length === 0) {
+      invalidField(
+        'providerSettings.omp.auth.credentials',
+        'Environment auth requires at least one provider credential reference.'
+      );
+    }
+    const credentials: Record<string, { env: string }> = {};
+    for (const [provider, credential] of Object.entries(value.credentials)) {
+      assertProviderId(provider, `providerSettings.omp.auth.credentials.${provider}`);
+      if (!isRecord(credential)) {
+        invalidField(
+          `providerSettings.omp.auth.credentials.${provider}`,
+          'Provider credential references must be objects.'
+        );
+      }
+      rejectUnknown(
+        credential,
+        new Set(['env']),
+        `providerSettings.omp.auth.credentials.${provider}`
+      );
+      if (typeof credential.env !== 'string' || !ENV_NAME.test(credential.env)) {
+        invalidField(
+          `providerSettings.omp.auth.credentials.${provider}.env`,
+          'Credential references must contain only a valid environment variable name.'
+        );
+      }
+      credentials[provider] = { env: credential.env };
+    }
+    return { mode, credentials };
+  }
+  if (mode === 'broker') {
+    rejectUnknown(value, new Set(['mode']), 'providerSettings.omp.auth');
+    return { mode };
+  }
+  if (mode === 'none') {
+    rejectUnknown(value, new Set(['mode']), 'providerSettings.omp.auth');
+    return { mode };
+  }
+
+  rejectUnknown(value, new Set(['mode', 'path']), 'providerSettings.omp.auth');
+  if (context.executionContext !== undefined && context.executionContext !== 'host') {
+    invalidField(
+      'providerSettings.omp.auth.mode',
+      'omp-home authentication is local host-only and forbidden for detached or Docker execution.'
+    );
+  }
+  if (
+    typeof value.path !== 'string' ||
+    !path.isAbsolute(value.path) ||
+    value.path.includes('\0') ||
+    value.path.trim() !== value.path
+  ) {
+    invalidField(
+      'providerSettings.omp.auth.path',
+      'omp-home authentication requires an explicit absolute local path.'
+    );
+  }
+  return { mode, path: path.normalize(value.path) };
+}