create-safest-tools 0.2.0

package/template/src/workflow-compiler.ts

@@ -0,0 +1,230 @@
+import { canonicalJson } from "./audit";
+import { sha256 } from "./report-crypto";
+import { ApiError } from "./report-http";
+import type {
+  CompiledWorkflowArtifact,
+  WorkflowAuthorityMode,
+  WorkflowGraphV1,
+} from "./workflow-platform-types";
+import {
+  canonicalWorkflowGraph,
+  graphForStorage,
+  validateWorkflowGraph,
+} from "./workflow-platform-validation";
+
+export const WORKFLOW_COMPILER_VERSION = "safest-workflow-compiler-v1";
+
+function dynamicWorkerSource(graph: WorkflowGraphV1, authorityMode: WorkflowAuthorityMode): string {
+  const graphJson = canonicalJson(graphForStorage(graph));
+  const authority = JSON.stringify(authorityMode);
+  return `import { WorkflowEntrypoint, WorkerEntrypoint } from "cloudflare:workers";
+
+const GRAPH = ${graphJson};
+const AUTHORITY_MODE = ${authority};
+const NODE_BY_ID = new Map(GRAPH.nodes.map((node) => [node.id, node]));
+const OUTGOING = new Map();
+for (const node of GRAPH.nodes) OUTGOING.set(node.id, []);
+for (const edge of GRAPH.edges) OUTGOING.get(edge.from.node_id).push(edge);
+
+function nextNode(node, result) {
+  const edges = OUTGOING.get(node.id) || [];
+  if (!edges.length) return null;
+  const selectedPort = result && typeof result.port === "string"
+    ? result.port
+    : typeof node.config.default_port === "string"
+      ? node.config.default_port
+      : edges.length === 1
+        ? edges[0].from.port
+        : null;
+  const edge = edges.find((candidate) => candidate.from.port === selectedPort);
+  if (!edge) throw new Error("workflow_port_unresolved:" + node.id);
+  return edge.to.node_id;
+}
+
+function stepConfig(node) {
+  const timeout = node.timeout_policy && node.timeout_policy.timeout_seconds;
+  const retry = node.retry_policy || GRAPH.default_policies.retry;
+  const config = {};
+  if (Number.isInteger(timeout) && timeout > 0) config.timeout = timeout * 1000;
+  if (retry && Number.isInteger(retry.limit) && retry.limit >= 0) {
+    config.retries = {
+      limit: Math.min(retry.limit, 10),
+      delay: Math.max(1000, Number(retry.delay_seconds || 1) * 1000),
+      backoff: ["constant", "linear", "exponential"].includes(retry.backoff) ? retry.backoff : "exponential",
+    };
+  }
+  return config;
+}
+
+export class TenantWorkflow extends WorkflowEntrypoint {
+  async run(event, step) {
+    const runId = event.payload.runId;
+    const executePath = async (initialNodeId, stopNodeId = null, branchKey = "") => {
+      let nodeId = initialNodeId;
+      let last = null;
+      while (nodeId && nodeId !== stopNodeId) {
+        const node = NODE_BY_ID.get(nodeId);
+        if (!node) throw new Error("workflow_node_missing:" + nodeId);
+        if (node.kind === "parallel_group") {
+          const joinNodeId = node.config.join_node_id;
+          const branches = (OUTGOING.get(node.id) || []).filter((edge) => node.config.branch_ports.includes(edge.from.port));
+          const branchResults = await Promise.all(branches.map((edge) => executePath(edge.to.node_id, joinNodeId, edge.from.port)));
+          const joinNode = NODE_BY_ID.get(joinNodeId);
+          if (!joinNode) throw new Error("workflow_join_missing:" + joinNodeId);
+          last = await step.do("node:" + joinNode.id, stepConfig(joinNode), async () => this.env.RUNTIME.executeNode({
+            runId, nodeId: joinNode.id, nodeKind: joinNode.kind, branchKey, authorityMode: AUTHORITY_MODE,
+            input: { branches: branchResults },
+          }));
+          nodeId = nextNode(joinNode, last);
+          continue;
+        }
+        if (node.kind === "wait_for_event" || (node.kind === "human_task" && AUTHORITY_MODE !== "shadow")) {
+          const prepared = await step.do("node:" + node.id + ":prepare", stepConfig(node), async () => this.env.RUNTIME.prepareWait({
+            runId, nodeId: node.id, nodeKind: node.kind, branchKey, authorityMode: AUTHORITY_MODE,
+          }));
+          let eventResult;
+          try {
+            const received = await step.waitForEvent("node:" + node.id + ":wait", {
+              type: prepared.eventType,
+              timeout: prepared.timeoutMs,
+            });
+            eventResult = { status: "received", event: received.payload };
+          } catch (error) {
+            eventResult = { status: "timed_out" };
+          }
+          last = await step.do("node:" + node.id + ":complete", async () => this.env.RUNTIME.completeWait({
+            runId, nodeId: node.id, branchKey, authorityMode: AUTHORITY_MODE, eventResult,
+          }));
+          nodeId = nextNode(node, last);
+          continue;
+        }
+        if (node.kind === "action") {
+          try {
+            const prepared = await step.do("node:" + node.id + ":prepare", stepConfig(node), async () => this.env.RUNTIME.prepareAction({
+              runId, nodeId: node.id, nodeKind: node.kind, branchKey, authorityMode: AUTHORITY_MODE,
+            }));
+            let actionResult = prepared;
+            if (prepared.status === "approval_required") {
+              let eventResult;
+              try {
+                const received = await step.waitForEvent("node:" + node.id + ":approval", {
+                  type: prepared.eventType,
+                  timeout: prepared.timeoutMs,
+                });
+                eventResult = { status: "received", event: received.payload };
+              } catch (error) {
+                eventResult = { status: "timed_out" };
+              }
+              actionResult = await step.do("node:" + node.id + ":approval-complete", stepConfig(node), async () => this.env.RUNTIME.completeAction({
+                runId, nodeId: node.id, nodeKind: node.kind, branchKey,
+                authorityMode: AUTHORITY_MODE, proposalId: prepared.proposalId, eventResult,
+              }));
+            }
+            if (actionResult.status === "delivery_pending") {
+              let deliveryResult;
+              try {
+                const received = await step.waitForEvent("node:" + node.id + ":delivery", {
+                  type: actionResult.eventType,
+                  timeout: actionResult.timeoutMs,
+                });
+                deliveryResult = { status: "received", event: received.payload };
+              } catch (error) {
+                deliveryResult = { status: "timed_out" };
+              }
+              last = await step.do("node:" + node.id + ":delivery-complete", async () => this.env.RUNTIME.completeAction({
+                runId, nodeId: node.id, nodeKind: node.kind, branchKey,
+                authorityMode: AUTHORITY_MODE, proposalId: actionResult.proposalId, eventResult: deliveryResult,
+              }));
+            } else {
+              last = actionResult;
+            }
+          } catch (error) {
+            last = await step.do("node:" + node.id + ":failure", async () => this.env.RUNTIME.failNode({
+              runId, nodeId: node.id, nodeKind: node.kind, branchKey,
+              authorityMode: AUTHORITY_MODE, errorCode: "action_execution_failed",
+            }));
+          }
+          nodeId = nextNode(node, last);
+          continue;
+        }
+        if (node.kind === "delay") {
+          await step.sleep("node:" + node.id + ":delay", node.config.duration_seconds * 1000);
+          last = await step.do("node:" + node.id + ":complete", async () => this.env.RUNTIME.executeNode({
+            runId, nodeId: node.id, nodeKind: node.kind, branchKey, authorityMode: AUTHORITY_MODE,
+            input: { delayed: true },
+          }));
+          nodeId = nextNode(node, last);
+          continue;
+        }
+        if (node.kind === "delay_until") {
+          const prepared = await step.do("node:" + node.id + ":prepare", async () => this.env.RUNTIME.executeNode({
+            runId, nodeId: node.id, nodeKind: node.kind, branchKey, authorityMode: AUTHORITY_MODE,
+            input: { prepare: true },
+          }));
+          await step.sleepUntil("node:" + node.id + ":delay", new Date(prepared.timestamp));
+          last = await step.do("node:" + node.id + ":complete", async () => this.env.RUNTIME.executeNode({
+            runId, nodeId: node.id, nodeKind: node.kind, branchKey, authorityMode: AUTHORITY_MODE,
+            input: { completed: true },
+          }));
+          nodeId = nextNode(node, last);
+          continue;
+        }
+        try {
+          last = await step.do("node:" + node.id, stepConfig(node), async () => this.env.RUNTIME.executeNode({
+            runId, nodeId: node.id, nodeKind: node.kind, branchKey, authorityMode: AUTHORITY_MODE,
+          }));
+        } catch (error) {
+          last = await step.do("node:" + node.id + ":failure", async () => this.env.RUNTIME.failNode({
+            runId, nodeId: node.id, nodeKind: node.kind, branchKey,
+            authorityMode: AUTHORITY_MODE, errorCode: "node_execution_failed",
+          }));
+        }
+        if (node.kind === "end") return last;
+        nodeId = nextNode(node, last);
+      }
+      return last;
+    };
+    return executePath(GRAPH.entry_node_id);
+  }
+}
+
+export default class WorkflowStarter extends WorkerEntrypoint {
+  async start(params) {
+    const instance = await this.env.WORKFLOWS.create({ id: params.instanceId, params });
+    return { id: await instance.id };
+  }
+}
+`;
+}
+
+export async function compileWorkflowGraph(
+  graph: WorkflowGraphV1,
+  authorityMode: WorkflowAuthorityMode,
+  compatibilityDate: string,
+): Promise<CompiledWorkflowArtifact> {
+  if (!/^\d{4}-\d{2}-\d{2}$/u.test(compatibilityDate)) throw new ApiError(500, "invalid_compatibility_date", "The workflow compiler compatibility date is invalid.");
+  const validation = validateWorkflowGraph(graph, authorityMode);
+  if (!validation.valid) {
+    throw new ApiError(400, "workflow_validation_failed", "The workflow cannot be compiled until validation errors are fixed.", {
+      errors: validation.errors,
+      warnings: validation.warnings,
+    });
+  }
+  const source = dynamicWorkerSource(graph, authorityMode);
+  const graphDigest = `sha256:${await sha256(canonicalWorkflowGraph(graph))}`;
+  const sourceDigest = `sha256:${await sha256(source)}`;
+  const bundleDigest = sourceDigest;
+  const manifestDigest = `sha256:${await sha256(canonicalJson(validation.capabilityManifest))}`;
+  return {
+    compilerVersion: WORKFLOW_COMPILER_VERSION,
+    compatibilityDate,
+    graphDigest,
+    sourceDigest,
+    bundleDigest,
+    manifestDigest,
+    source,
+    capabilityManifest: validation.capabilityManifest,
+    dependencyManifest: validation.dependencies,
+    warnings: validation.warnings,
+  };
+}