harper 5.1.20 → 5.2.0-alpha.5

package/server/serverHelpers/progressEmitter.ts

@@ -16,6 +16,37 @@ export type ProgressListener = (event: ProgressEvent) => void;
 export class ProgressEmitter {
 	private listeners: ProgressListener[] = [];
 
+	/**
+	 * Set by {@link createSSEResponseStream} to a signal that aborts when the client
+	 * disconnects. Open-ended operations (e.g. a live log tail that never returns on its own)
+	 * read this to stop producing events and resolve, instead of running until process exit.
+	 */
+	signal?: AbortSignal;
+
+	/**
+	 * Backpressure signal for open-ended producers. {@link createSSEResponseStream} sets this
+	 * `true` when the underlying SSE stream's write buffer is full and clears it on `drain`. A
+	 * producer that can outrun a slow client (e.g. a log tail on a busy file) should await
+	 * {@link whenWritable} before emitting more, so buffered frames can't grow without bound.
+	 * Bounded producers (deploy) simply never check it.
+	 */
+	paused = false;
+	private drainWaiters: Array<() => void> = [];
+
+	/** Resolves once the SSE stream can accept more writes (immediately when not paused). */
+	whenWritable(): Promise<void> {
+		if (!this.paused) return Promise.resolve();
+		return new Promise((resolve) => this.drainWaiters.push(resolve));
+	}
+
+	/** Called by the SSE wrapper on `drain` (and on teardown) to release awaiting producers. */
+	resume(): void {
+		this.paused = false;
+		const waiters = this.drainWaiters;
+		this.drainWaiters = [];
+		for (const waiter of waiters) waiter();
+	}
+
 	emit(event: string, data: unknown): void {
 		// Snapshot before iteration so a listener that unsubscribes itself during dispatch
 		// doesn't shift indexes underneath us.
@@ -54,19 +85,32 @@ export function createSSEResponseStream(emitter: ProgressEmitter, operation: ()
 	// that consumers ignore, so it's safe filler.
 	stream.write(`: stream open\n\n`);
 
+	// Give the operation a way to observe client disconnect. `cleanup` runs when the stream
+	// closes/ends (and after the operation settles); aborting there lets an open-ended
+	// operation like a log tail stop and resolve rather than leak until the process exits.
+	const abortController = new AbortController();
+	emitter.signal = abortController.signal;
+
 	let active = true;
 	let errorEmitted = false;
 	const unsubscribe = emitter.subscribe((event) => {
 		if (active) {
-			writeSSE(stream, event);
+			// A `false` return means the stream's buffer is over its high-water mark; flag it so
+			// producers that check `whenWritable()` back off until the 'drain' below clears it.
+			const canWriteMore = writeSSE(stream, event);
+			if (!canWriteMore) emitter.paused = true;
 			if (event.event === 'error') errorEmitted = true;
 		}
 	});
+	stream.on('drain', () => emitter.resume());
 
 	const cleanup = () => {
 		if (active) {
 			active = false;
 			unsubscribe();
+			abortController.abort();
+			// Release any producer awaiting drain so the operation can settle instead of hanging.
+			emitter.resume();
 		}
 	};
 
@@ -100,11 +144,17 @@ export function createSSEResponseStream(emitter: ProgressEmitter, operation: ()
 	return stream;
 }
 
-function writeSSE(stream: PassThrough, event: ProgressEvent): void {
+/**
+ * Write one SSE record; returns `false` if any of its writes pushed the buffer past its
+ * high-water mark (so a dense multi-line payload that tips the buffer on an early `data:`
+ * line is still detected, not just the final `\n`). `stream.write(...)` is always the left
+ * operand so every line is written regardless of the accumulated backpressure flag.
+ */
+function writeSSE(stream: PassThrough, event: ProgressEvent): boolean {
 	const data = typeof event.data === 'string' ? event.data : JSON.stringify(event.data);
-	stream.write(`event: ${event.event}\n`);
+	let canWrite = stream.write(`event: ${event.event}\n`);
 	for (const line of data.split(/\r?\n/)) {
-		stream.write(`data: ${line}\n`);
+		canWrite = stream.write(`data: ${line}\n`) && canWrite;
 	}
-	stream.write('\n');
+	return stream.write('\n') && canWrite;
 }

package/server/serverHelpers/registeredOperations.ts

@@ -0,0 +1,259 @@
+/**
+ * Cross-thread bridge for `server.registerOperation()` (#1736).
+ *
+ * Components (jsResource `resources.js`, Plugin API `handleApplication`) load per-worker, so a
+ * `registerOperation()` call made there lands in that worker's module-local OPERATION_FUNCTION_MAP.
+ * The ops-API HTTP dispatcher runs only on the main thread and reads the main thread's copy of
+ * that map, so such operations were unreachable ("Operation '<name>' not found") for every caller.
+ *
+ * The bridge mirrors the RESOURCE_OPENAPI request/response pattern (operationsServer.ts /
+ * itc/serverHandlers.js), with one deliberate difference: executing an operation is side-effecting,
+ * so a request is sent to exactly ONE registering worker (never broadcast-first-wins).
+ *
+ *  - Worker: `registerOperation()` announces the name (OPERATION_REGISTERED) to all threads;
+ *    only the main thread records it, as name -> Set<threadId>.
+ *  - Main: on an OPERATION_FUNCTION_MAP miss, `getRemoteOperationFunction()` supplies a forwarding
+ *    function that sends the request body (OPERATION_EXECUTE_REQUEST) to one live registering
+ *    worker and awaits the correlated OPERATION_EXECUTE_RESPONSE.
+ *  - Worker: executes through the normal `chooseOperation` + `processLocalTransaction` path, so
+ *    permission checks run where the operation function (and its metadata) actually exists. The
+ *    main thread performs authentication only and forwards the resolved `hdb_user`.
+ */
+import { isMainThread, threadId } from 'node:worker_threads';
+import { Readable } from 'node:stream';
+import * as terms from '../../utility/hdbTerms.ts';
+import * as env from '../../utility/environment/environmentManager.ts';
+import harperLogger from '../../utility/logging/harper_logger.ts';
+import { ServerError } from '../../utility/errors/hdbError.ts';
+import { sendItcEvent } from '../threads/itc.js';
+import { onMessageByType, onThreadExit } from '../threads/manageThreads.js';
+
+const operationLog = harperLogger.loggerWithTag('operation');
+
+// The connected-ports array with `sendToThread` — assigned to the `threads` global by
+// manageThreads via _assignPackageExport (the same access pattern as itc/serverHandlers.js;
+// the globals.js `exports.threads` binding is reassigned after load, so it can't be imported).
+declare const threads: { sendToThread(threadId: number, message: any): boolean };
+
+// Fields attached to a request body by the HTTP/auth layer that must not (and often cannot)
+// cross the thread boundary via structured clone.
+const NON_FORWARDABLE_FIELDS = ['baseRequest', 'baseResponse', 'fastifyResponse', 'progress', 'parsed_sql_object'];
+
+// Bound how long the main thread waits for a worker to finish a forwarded operation. Past the
+// operations-API connection timeout the client socket is gone anyway; this just prevents a
+// wedged-but-alive worker from leaking pending forwards forever.
+const EXECUTE_TIMEOUT_MS = env.get(terms.CONFIG_PARAMS.OPERATIONSAPI_NETWORK_TIMEOUT) || 120_000;
+
+// Dispatch functions injected by serverUtilities at its module load (it statically imports this
+// module, so a plain import here would be a cycle; a runtime require of a .ts path doesn't
+// survive the dist build). A worker can only receive an execute request after announcing a
+// registration — which goes through serverUtilities — so these are always set on that path.
+let localDispatch: {
+	chooseOperation: (body: any) => Function;
+	processLocalTransaction: (req: any, operationFunction: Function) => Promise<any>;
+};
+export function setLocalOperationDispatch(dispatch: typeof localDispatch) {
+	localDispatch = dispatch;
+}
+
+/** name -> threadIds of workers that registered it (main thread only) */
+const registeredByWorker = new Map<string, Set<number>>();
+const pendingExecutions = new Map<
+	number,
+	{ targetThreadId: number; resolve: (result: any) => void; reject: (error: Error) => void }
+>();
+let nextRequestId = 1;
+let mainListenersAttached = false;
+
+/**
+ * Worker side: announce a registration so the main thread can forward calls here. Fire-and-forget —
+ * a lost announcement just means the op stays unreachable (the pre-#1736 status quo), and the
+ * broadcast has its own ack timeout.
+ */
+export function announceRegisteredOperation(name: string) {
+	if (isMainThread) return;
+	sendItcEvent({
+		type: terms.ITC_EVENT_TYPES.OPERATION_REGISTERED,
+		message: { name },
+	}).catch((error) => operationLog.error(`Failed to announce registered operation '${name}'`, error));
+}
+
+/**
+ * ITC handler (all threads receive the broadcast; only main records it).
+ */
+export function operationRegisteredHandler(event: { message: { name: string; originator: number } }) {
+	if (!isMainThread) return;
+	const { name, originator } = event.message;
+	if (typeof name !== 'string' || typeof originator !== 'number') return;
+	let workerIds = registeredByWorker.get(name);
+	if (!workerIds) registeredByWorker.set(name, (workerIds = new Set()));
+	workerIds.add(originator);
+	operationLog.debug(`Registered operation '${name}' announced by worker thread ${originator}`);
+}
+
+let rotation = 0;
+/**
+ * Main-thread dispatch fallback: if a worker registered `name`, return a forwarding operation
+ * function for it; otherwise undefined (caller falls through to the usual "not found" error).
+ * Permission checks are intentionally NOT run on the main thread for forwarded operations — the
+ * function and metadata that `verifyPerms` needs only exist on the worker, which runs the full
+ * `chooseOperation` check with the forwarded `hdb_user`.
+ */
+export function getRemoteOperationFunction(name: string): ((body: any) => Promise<any>) | undefined {
+	if (!isMainThread) return undefined;
+	if (!registeredByWorker.has(name)) return undefined;
+	return (body: any) => executeRemoteOperation(name, body);
+}
+
+function attachMainListeners() {
+	if (mainListenersAttached) return;
+	mainListenersAttached = true;
+	onMessageByType(terms.ITC_EVENT_TYPES.OPERATION_EXECUTE_RESPONSE, (event: any) => {
+		const { requestId, originator, result, error } = event.message ?? {};
+		const pending = pendingExecutions.get(requestId);
+		if (!pending) return;
+		// Defense-in-depth: only the worker the request was sent to may settle it.
+		if (originator !== pending.targetThreadId) return;
+		pendingExecutions.delete(requestId);
+		if (error) pending.reject(new ServerError(error.message, error.statusCode || 500));
+		else pending.resolve(result);
+	});
+	// A worker that dies mid-execution can never respond; fail its in-flight forwards rather
+	// than waiting out the timeout, and forget its registrations (a replacement worker
+	// re-registers on component load).
+	onThreadExit((deadThreadId: number) => {
+		for (const [name, workerIds] of registeredByWorker) {
+			workerIds.delete(deadThreadId);
+			if (workerIds.size === 0) registeredByWorker.delete(name);
+		}
+		for (const [requestId, pending] of pendingExecutions) {
+			if (pending.targetThreadId === deadThreadId) {
+				pendingExecutions.delete(requestId);
+				pending.reject(new ServerError('The worker thread executing this operation exited', 503));
+			}
+		}
+	});
+}
+
+async function executeRemoteOperation(name: string, body: any): Promise<any> {
+	attachMainListeners();
+	const workerIds = registeredByWorker.get(name);
+	const forwardBody = { ...body };
+	for (const field of NON_FORWARDABLE_FIELDS) delete forwardBody[field];
+
+	// Pick one live registering worker (rotating for spread), pruning ids whose port is gone.
+	// sendToThread returning false means the worker exited; try the next one.
+	while (workerIds?.size) {
+		const candidates = [...workerIds];
+		const targetThreadId = candidates[rotation++ % candidates.length];
+		const requestId = nextRequestId++;
+		let sent;
+		try {
+			sent = threads.sendToThread(targetThreadId, {
+				type: terms.ITC_EVENT_TYPES.OPERATION_EXECUTE_REQUEST,
+				message: { requestId, body: forwardBody, originator: threadId },
+			});
+		} catch (error) {
+			// Structured-clone failure (e.g. a function or native handle on the request body) is a
+			// server-side limitation, not a malformed client request — 500, not 400. No other worker
+			// will fare better with the same body.
+			operationLog.error(`Failed to forward operation '${name}' to worker thread ${targetThreadId}`, error);
+			throw new ServerError(
+				`Operation '${name}' request could not be forwarded to a worker thread: ${error.message}`,
+				500
+			);
+		}
+		if (!sent) {
+			workerIds.delete(targetThreadId);
+			continue;
+		}
+		return new Promise((promiseResolve, promiseReject) => {
+			const timer = setTimeout(() => {
+				pendingExecutions.delete(requestId);
+				promiseReject(new ServerError(`Timed out waiting for worker thread to execute operation '${name}'`, 503));
+			}, EXECUTE_TIMEOUT_MS);
+			timer.unref();
+			pendingExecutions.set(requestId, {
+				targetThreadId,
+				resolve(result) {
+					clearTimeout(timer);
+					promiseResolve(result);
+				},
+				reject(error) {
+					clearTimeout(timer);
+					promiseReject(error);
+				},
+			});
+		});
+	}
+	if (registeredByWorker.get(name)?.size === 0) registeredByWorker.delete(name);
+	throw new ServerError(
+		`Operation '${name}' is registered by a component but no worker thread is available to run it`,
+		503
+	);
+}
+
+/**
+ * ITC handler, worker side: execute a forwarded operation through the normal dispatch path
+ * (permission check + processLocalTransaction) and send the result back to the main thread.
+ */
+export async function operationExecuteRequestHandler(event: {
+	message: { requestId: number; body: any; originator: number };
+}) {
+	const { requestId, body, originator } = event.message;
+	let response;
+	try {
+		if (!localDispatch) throw new ServerError('This worker thread cannot execute operations', 503);
+		// bypass_auth is trusted as forwarded: the main thread already strips it from external
+		// HTTP requests (handlePostRequest, before any dispatch decision), and an internal caller
+		// legitimately setting it (server.operation(op, context, false)) must see the same
+		// authorize:false behavior whether the operation happens to run locally or via this bridge.
+		// ITC is an internal, same-process trust boundary — a worker able to forge this message
+		// already has direct DB access and gains nothing by spoofing bypass_auth.
+		const operationFunction = localDispatch.chooseOperation(body);
+		const result = await localDispatch.processLocalTransaction({ body }, operationFunction);
+		if (result instanceof Readable || typeof result?.pipe === 'function') {
+			// Streaming results would need MessagePort transfer plumbing — explicitly unsupported
+			// for worker-registered operations for now (#1736), rather than failing opaquely.
+			// The handler already ran and the stream may hold an open fd/cursor/socket; destroy it
+			// rather than abandoning it to GC finalization.
+			result.destroy?.();
+			throw new ServerError(
+				`Operation '${body.operation}' returned a stream; streaming results are not supported for operations registered from a component`,
+				501
+			);
+		}
+		response = { requestId, result };
+	} catch (error) {
+		response = {
+			requestId,
+			error: {
+				message: error.http_resp_msg?.error ?? error.http_resp_msg ?? error.message,
+				statusCode: error.statusCode,
+			},
+		};
+	}
+	try {
+		sendExecuteResponse(originator, response);
+	} catch (error) {
+		// The result itself failed to structured-clone; report that instead of leaving the main
+		// thread to time out.
+		operationLog.error(`Failed to send result of operation '${body?.operation}' back to the main thread`, error);
+		sendExecuteResponse(originator, {
+			requestId,
+			error: {
+				message: `Operation '${body?.operation}' result could not be returned across threads: ${error.message}`,
+				statusCode: 500,
+			},
+		});
+	}
+}
+
+function sendExecuteResponse(requestOriginator: number, message: any) {
+	// Stamp this worker's threadId so the main thread can verify the response came from the
+	// worker the request was actually sent to.
+	message.originator = threadId;
+	if (!threads.sendToThread(requestOriginator, { type: terms.ITC_EVENT_TYPES.OPERATION_EXECUTE_RESPONSE, message })) {
+		operationLog.trace(`Dropping operation execute response for request ${message.requestId}: main thread unreachable`);
+	}
+}

package/server/serverHelpers/serverHandlers.js

@@ -25,11 +25,17 @@ const { applyImpersonation } = require('../../security/impersonation.ts');
 const { createGzip, constants } = require('zlib');
 const { ProgressEmitter, createSSEResponseStream } = require('./progressEmitter.ts');
 
-// Operations that support `Accept: text/event-stream` for live progress streaming. The
-// handler attaches a ProgressEmitter as req.body.progress so the operation can emit phase
-// events; the response body is the SSE-encoded emitter output. Non-SSE clients see the
-// historical single-response shape because progress is undefined on that path.
-const SSE_PROGRESS_OPERATIONS = new Set([terms.OPERATIONS_ENUM.DEPLOY_COMPONENT, terms.OPERATIONS_ENUM.GET_DEPLOYMENT]);
+// Operations that support `Accept: text/event-stream` for live streaming. The handler
+// attaches a ProgressEmitter as req.body.progress so the operation can emit events; the
+// response body is the SSE-encoded emitter output. Non-SSE clients see the historical
+// single-response shape because progress is undefined on that path. deploy_component /
+// get_deployment stream a bounded run and end; read_log tails the log and stays open until
+// the client disconnects (the emitter's abort signal), so subscribers see new lines live.
+const SSE_PROGRESS_OPERATIONS = new Set([
+	terms.OPERATIONS_ENUM.DEPLOY_COMPONENT,
+	terms.OPERATIONS_ENUM.GET_DEPLOYMENT,
+	terms.OPERATIONS_ENUM.READ_LOG,
+]);
 
 const NO_AUTH_OPERATIONS = [
 	terms.OPERATIONS_ENUM.CREATE_AUTHENTICATION_TOKENS,

package/server/serverHelpers/serverUtilities.ts

@@ -37,6 +37,14 @@ import type { Context } from '../../resources/ResourceInterface.ts';
 import * as status from '../status/index.ts';
 import * as regDeprecated from '../../resources/registrationDeprecated.ts';
 import * as deploymentOperations from '../../components/deploymentOperations.ts';
+import * as secretOperations from '../../components/secretOperations.ts';
+import { contextStorage } from '../../resources/transaction.ts';
+import { isMainThread } from 'node:worker_threads';
+import {
+	announceRegisteredOperation,
+	getRemoteOperationFunction,
+	setLocalOperationDispatch,
+} from './registeredOperations.ts';
 
 const pSearchSearch = util.promisify(search.search);
 let pEvaluateSql: (sql: string) => Promise<any>;
@@ -75,17 +83,37 @@ export async function processLocalTransaction(req: OperationRequest, operationFu
 				harperLogger.logLevel === terms.LOG_LEVELS.DEBUG ||
 				harperLogger.logLevel === terms.LOG_LEVELS.TRACE)
 		) {
-			// Need to remove auth variables, but we don't want to create an object unless
-			// the logging is actually going to happen.
+			// Need to remove auth variables and secret-bearing fields, but we don't want to create
+			// an object unless the logging is actually going to happen. registryAuth carries a
+			// transient private registry token on deploy_component; value/values carry .env secrets
+			// from set_env_value; value/envelope carry secrets from set_secret — none may reach the
+			// operations log.
 			// eslint-disable-next-line @typescript-eslint/no-unused-vars
-			const { hdb_user, hdbAuthHeader, password, payload, ...cleanBody } = req.body;
+			const { hdb_user, hdbAuthHeader, password, payload, registryAuth, value, values, envelope, ...cleanBody } =
+				req.body;
 			operationLog.info(cleanBody);
 		}
 	} catch (e) {
 		operationLog.error(e);
 	}
 
-	let data = await operationFunctionCaller.callOperationFunctionAsAwait(operationFunction, req.body, null);
+	// Bridge the authenticated user into the ambient async context so static Resource API calls
+	// (e.g. table.put) inside operation handlers inherit user attribution for audit records
+	// (issue #1591). An explicit context passed by a handler still takes precedence (the
+	// transactional wrappers only fall back to contextStorage when no context is provided), and
+	// an existing ambient context already carrying this user (e.g. server.operation() called
+	// from within a request handler) is preserved rather than shadowed. When the ambient user
+	// differs (or is absent), the ambient context is merged rather than replaced: other ambient
+	// properties (open transaction, signal, caches) are preserved so atomicity is unaffected and
+	// only the user is swapped for attribution; the outer context object itself is never mutated.
+	const hdbUser = req.body.hdb_user;
+	const currentStore = contextStorage.getStore();
+	const callOperationFunction = () =>
+		operationFunctionCaller.callOperationFunctionAsAwait(operationFunction, req.body, null);
+	let data =
+		hdbUser && currentStore?.user !== hdbUser
+			? await contextStorage.run({ ...currentStore, user: hdbUser }, callOperationFunction)
+			: await callOperationFunction();
 
 	if (typeof data !== 'object') {
 		data = { message: data };
@@ -113,6 +141,15 @@ export type OperationDefinition = {
 	httpMethod?: 'DELETE' | 'GET' | 'HEAD' | 'OPTIONS' | 'PATCH' | 'POST' | 'PUT' | 'TRACE'; // method to use for REST
 	isJob?: boolean;
 	parametersSchema?: any[];
+	// When set, the operation declares its authorization requirement to the central verifyPerms
+	// system so it participates in the role `operations` allowlist (grantable to a scoped role)
+	// instead of a hand-rolled inline check. Tri-state:
+	//   `true`  = super_user by default (grantable to a scoped role via the `operations` allowlist);
+	//   `false` = grantable AND open to ANY authenticated user with a valid role — it registers an
+	//             empty-perms entry, which verifyPerms treats as "no specific permission required"
+	//             and allows; use deliberately, it is NOT a "still locked down" default;
+	//   omit    = pre-existing behavior (no central entry; the caller enforces its own auth, if any).
+	requiresSuperUser?: boolean;
 };
 
 /**
@@ -120,7 +157,24 @@ export type OperationDefinition = {
  * @param operationDefinition
  */
 server.registerOperation = (operationDefinition: OperationDefinition) => {
-	OPERATION_FUNCTION_MAP.set(operationDefinition.name as any, new OperationFunctionObject(operationDefinition.execute));
+	const { name, execute, requiresSuperUser } = operationDefinition;
+	let handler = execute;
+	if (requiresSuperUser !== undefined) {
+		// verifyPerms keys requiredPermissions by the handler's function `.name`, but registered ops
+		// are typically anonymous arrows (all named "execute") which collide and can't be keyed. Wrap
+		// in a FRESH function named after the op so the lookup resolves the right entry. Wrap rather
+		// than rename `execute` in place: renaming would mutate a handler shared across two op names,
+		// causing the first op to be checked against the second op's permission entry. Forward all
+		// args (transparent pass-through) so the wrapper never changes the handler's call contract.
+		handler = (...args: any[]) => (execute as any)(...args);
+		Object.defineProperty(handler, 'name', { value: name, configurable: true });
+		opAuth.registerOperationPermission(name, { requiresSu: requiresSuperUser });
+	}
+	OPERATION_FUNCTION_MAP.set(name as any, new OperationFunctionObject(handler));
+	// Components load per-worker, so a registration made there is invisible to the main-thread
+	// ops-API dispatcher (each thread has its own OPERATION_FUNCTION_MAP instance). Announce it
+	// so the main thread can forward calls to this worker (#1736).
+	if (!isMainThread) announceRegisteredOperation(name);
 };
 
 export function chooseOperation(json: OperationRequestBody) {
@@ -128,6 +182,15 @@ export function chooseOperation(json: OperationRequestBody) {
 	try {
 		getOpResult = getOperationFunction(json);
 	} catch (err) {
+		// Not in this thread's map — a component may have registered it on a worker thread
+		// (components load per-worker). Forward there for execution; the worker runs the
+		// full permission check (with the forwarded hdb_user) where the operation function
+		// and its metadata actually exist, so no perm check is skipped by returning early
+		// here (#1736). Workers never re-forward, so an unknown op can't loop.
+		if (isMainThread) {
+			const remoteOperationFunction = getRemoteOperationFunction(json.operation);
+			if (remoteOperationFunction) return remoteOperationFunction;
+		}
 		operationLog.error(`Error when selecting operation function - ${err}`);
 		throw err;
 	}
@@ -210,6 +273,11 @@ export function getOperationFunction(json: OperationRequestBody): OperationFunct
 	);
 }
 
+// Give the cross-thread bridge (#1736) the worker-side dispatch path for forwarded operations.
+// Injected (rather than imported there) because registeredOperations is imported above — a
+// static import back into this module would be a cycle.
+setLocalOperationDispatch({ chooseOperation, processLocalTransaction });
+
 _assignPackageExport('operation', operation);
 /**
  * Standalone function to execute an operation
@@ -403,6 +471,12 @@ function initializeOperationFunctionMap(): Map<OperationFunctionName, OperationF
 		terms.OPERATIONS_ENUM.SET_COMPONENT_FILE,
 		new OperationFunctionObject(customFunctionOperations.setComponentFile)
 	);
+	opFuncMap.set(terms.OPERATIONS_ENUM.GET_ENV_KEYS, new OperationFunctionObject(customFunctionOperations.getEnvKeys));
+	opFuncMap.set(terms.OPERATIONS_ENUM.SET_ENV_VALUE, new OperationFunctionObject(customFunctionOperations.setEnvValue));
+	opFuncMap.set(
+		terms.OPERATIONS_ENUM.DELETE_ENV_VALUE,
+		new OperationFunctionObject(customFunctionOperations.deleteEnvValue)
+	);
 	opFuncMap.set(
 		terms.OPERATIONS_ENUM.DROP_COMPONENT,
 		new OperationFunctionObject(customFunctionOperations.dropComponent)
@@ -455,6 +529,15 @@ function initializeOperationFunctionMap(): Map<OperationFunctionName, OperationF
 		terms.OPERATIONS_ENUM.GET_DEPLOYMENT,
 		new OperationFunctionObject(deploymentOperations.handleGetDeployment)
 	);
+	opFuncMap.set(terms.OPERATIONS_ENUM.SET_SECRET, new OperationFunctionObject(secretOperations.setSecret));
+	opFuncMap.set(terms.OPERATIONS_ENUM.GRANT_SECRET, new OperationFunctionObject(secretOperations.grantSecret));
+	opFuncMap.set(terms.OPERATIONS_ENUM.REVOKE_SECRET, new OperationFunctionObject(secretOperations.revokeSecret));
+	opFuncMap.set(terms.OPERATIONS_ENUM.LIST_SECRETS, new OperationFunctionObject(secretOperations.listSecrets));
+	opFuncMap.set(terms.OPERATIONS_ENUM.DELETE_SECRET, new OperationFunctionObject(secretOperations.deleteSecret));
+	opFuncMap.set(
+		terms.OPERATIONS_ENUM.GET_SECRETS_PUBLIC_KEY,
+		new OperationFunctionObject(secretOperations.getSecretsPublicKey)
+	);
 	opFuncMap.set(
 		terms.OPERATIONS_ENUM.READ_TRANSACTION_LOG,
 		new OperationFunctionObject(transactionLog.readTransactionLog)