contract

const (
	SignatureHeader  = "X-Hatchet-Signature"
	EndpointIdHeader = "X-Hatchet-Endpoint-Id"
	// TimestampHeader carries the time the request was built as decimal Unix seconds (not
	// milliseconds or nanoseconds), the same value as the body's timestamp_unix_seconds. An
	// endpoint rejects a value more than RequestMaxAge (5 minutes) from its own clock in
	// either direction.
	TimestampHeader = "X-Hatchet-Timestamp"
)

Headers carried by every request the operator sends to an endpoint. Endpoints verify SignatureHeader by recomputing the HMAC-SHA256 hex digest of the raw body with their signing secret (Verify). The signed body of every POST (v1.ServerlessHealthcheckRequest, v1.ServerlessTriggerRequest) carries the operator's timestamp in Unix seconds; an endpoint rejects a body whose timestamp lies more than RequestMaxAge from its own clock in either direction, so a captured request cannot be replayed later. Within that window a delivery may be repeated: endpoints key side effects on (endpoint id, task run external id, retry count).

const (
	NonceHeader      = "X-Hatchet-Nonce"
	TaskIdHeader     = "X-Hatchet-Task-Id"
	InvocationHeader = "X-Hatchet-Invocation"
)

Headers carried only by the durable websocket upgrade, which has no body to sign. The endpoint verifies SignatureHeader against UpgradeSigningPayload with its signing secret, rejects a TimestampHeader more than UpgradeMaxAge from its clock in either direction, consumes NonceHeader from a nonce set after the signature verified so a captured upgrade cannot be replayed within the window (every accepted nonce is kept until its window has passed; an endpoint whose nonce storage cannot admit another refuses the upgrade rather than forget a live nonce), and checks that the first frame's task id and invocation are the ones the headers were signed for.

const (
	// ErrorCodeNonDeterminism reports a replay that diverged from the log.
	ErrorCodeNonDeterminism = "nondeterminism"
	// ErrorCodeUnspecified is every other engine-side error.
	ErrorCodeUnspecified = "unspecified"
)

Codes of v1.ServerlessErrorFrame.

const DoneStatusEvicted = "evicted"

DoneStatusEvicted is the v1.ServerlessDoneFrame status of an invocation that evicted itself.

const RequestMaxAge = 5 * time.Minute

RequestMaxAge is how far a signed timestamp may lie from the endpoint's clock, in either direction, before the endpoint rejects the request. It applies to the timestamp inside every signed POST body and to the upgrade's TimestampHeader.

const SigningSecretEncryptionDataID = "v1_serverless_endpoint_signing_secret" //nolint:gosec // associated-data label for envelope encryption, not a credential

SigningSecretEncryptionDataID is the associated data used when encrypting a serverless endpoint's signing secret with pkg/encryption. It binds the ciphertext in v1_serverless_endpoint.signing_secret_enc to that column so it cannot be replayed as any other secret.

const TriggerEnvelopeVersion = 1

TriggerEnvelopeVersion is the version field of v1.ServerlessTriggerRequest.

const UpgradeMaxAge = RequestMaxAge

UpgradeMaxAge is RequestMaxAge as it applies to the durable upgrade.