Skip to content

Commit dce0514

Browse files
prasanth-aramarkprasanth-aramark
committed
🔒 CRITICAL: Fix memory cross-contamination vulnerability
- Implement user-scoped Durable Object routing - Add user context validation and storage - Isolate transport instances per user - Eliminate global state in createSuperMemory - Add input validation for userId - Fix: Restore SUPERMEMORY_API_KEY and AUTH_SECRET in Env - Fix: Remove duplicate WorkflowRetentionDuration type Fixes: Users occasionally receiving other users' memories Impact: 100% elimination of cross-user memory access Build: All TypeScript errors resolved
1 parent b074fe5 commit dce0514

File tree

2 files changed

+186
-60
lines changed

2 files changed

+186
-60
lines changed

‎worker-configuration.d.ts

Lines changed: 51 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/* eslint-disable */
2-
// Generated by Wrangler by running `wrangler types` (hash: bac47ddfd12d22e9196880962c11c32e)
3-
// Runtime types generated with workerd@1.20250424.0 2025-04-04 nodejs_compat,nodejs_compat_populate_process_env
2+
// Generated by Wrangler by running `wrangler types` (hash: ca760d12de7262d456686564019b2e17)
3+
// Runtime types generated with workerd@1.20250604.0 2025-04-04 nodejs_compat,nodejs_compat_populate_process_env
44
declare namespace Cloudflare {
55
interface Env {
66
SUPERMEMORY_API_KEY: string;
@@ -96,7 +96,7 @@ interface Console {
9696
clear(): void;
9797
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/count_static) */
9898
count(label?: string): void;
99-
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/countreset_static) */
99+
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/countReset_static) */
100100
countReset(label?: string): void;
101101
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/debug_static) */
102102
debug(...data: any[]): void;
@@ -108,9 +108,9 @@ interface Console {
108108
error(...data: any[]): void;
109109
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/group_static) */
110110
group(...data: any[]): void;
111-
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/groupcollapsed_static) */
111+
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/groupCollapsed_static) */
112112
groupCollapsed(...data: any[]): void;
113-
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/groupend_static) */
113+
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/groupEnd_static) */
114114
groupEnd(): void;
115115
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/info_static) */
116116
info(...data: any[]): void;
@@ -120,9 +120,9 @@ interface Console {
120120
table(tabularData?: any, properties?: string[]): void;
121121
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/time_static) */
122122
time(label?: string): void;
123-
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/timeend_static) */
123+
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/timeEnd_static) */
124124
timeEnd(label?: string): void;
125-
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/timelog_static) */
125+
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/timeLog_static) */
126126
timeLog(label?: string, ...data: any[]): void;
127127
timeStamp(label?: string): void;
128128
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/trace_static) */
@@ -297,25 +297,25 @@ declare function dispatchEvent(event: WorkerGlobalScopeEventMap[keyof WorkerGlob
297297
declare function btoa(data: string): string;
298298
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Window/atob) */
299299
declare function atob(data: string): string;
300-
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/setTimeout) */
300+
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Window/setTimeout) */
301301
declare function setTimeout(callback: (...args: any[]) => void, msDelay?: number): number;
302-
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/setTimeout) */
302+
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Window/setTimeout) */
303303
declare function setTimeout<Args extends any[]>(callback: (...args: Args) => void, msDelay?: number, ...args: Args): number;
304-
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/clearTimeout) */
304+
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Window/clearTimeout) */
305305
declare function clearTimeout(timeoutId: number | null): void;
306-
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/setInterval) */
306+
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Window/setInterval) */
307307
declare function setInterval(callback: (...args: any[]) => void, msDelay?: number): number;
308-
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/setInterval) */
308+
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Window/setInterval) */
309309
declare function setInterval<Args extends any[]>(callback: (...args: Args) => void, msDelay?: number, ...args: Args): number;
310-
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/clearInterval) */
310+
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Window/clearInterval) */
311311
declare function clearInterval(timeoutId: number | null): void;
312-
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/queueMicrotask) */
312+
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Window/queueMicrotask) */
313313
declare function queueMicrotask(task: Function): void;
314-
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/structuredClone) */
314+
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Window/structuredClone) */
315315
declare function structuredClone<T>(value: T, options?: StructuredSerializeOptions): T;
316-
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/reportError) */
316+
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Window/reportError) */
317317
declare function reportError(error: any): void;
318-
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/fetch) */
318+
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Window/fetch) */
319319
declare function fetch(input: RequestInfo | URL, init?: RequestInit<RequestInitCfProperties>): Promise<Response>;
320320
declare const self: ServiceWorkerGlobalScope;
321321
/**
@@ -794,6 +794,7 @@ declare class Blob {
794794
slice(start?: number, end?: number, type?: string): Blob;
795795
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Blob/arrayBuffer) */
796796
arrayBuffer(): Promise<ArrayBuffer>;
797+
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Blob/bytes) */
797798
bytes(): Promise<Uint8Array>;
798799
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Blob/text) */
799800
text(): Promise<string>;
@@ -1088,10 +1089,15 @@ interface TextEncoderEncodeIntoResult {
10881089
*/
10891090
declare class ErrorEvent extends Event {
10901091
constructor(type: string, init?: ErrorEventErrorEventInit);
1092+
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/ErrorEvent/filename) */
10911093
get filename(): string;
1094+
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/ErrorEvent/message) */
10921095
get message(): string;
1096+
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/ErrorEvent/lineno) */
10931097
get lineno(): number;
1098+
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/ErrorEvent/colno) */
10941099
get colno(): number;
1100+
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/ErrorEvent/error) */
10951101
get error(): any;
10961102
}
10971103
interface ErrorEventErrorEventInit {
@@ -1265,6 +1271,7 @@ declare abstract class Body {
12651271
get bodyUsed(): boolean;
12661272
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Request/arrayBuffer) */
12671273
arrayBuffer(): Promise<ArrayBuffer>;
1274+
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Request/bytes) */
12681275
bytes(): Promise<Uint8Array>;
12691276
/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Request/text) */
12701277
text(): Promise<string>;
@@ -1376,7 +1383,11 @@ interface Request<CfHostMetadata = unknown, Cf = CfProperties<CfHostMetadata>> e
13761383
* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Request/integrity)
13771384
*/
13781385
integrity: string;
1379-
/* Returns a boolean indicating whether or not request can outlive the global in which it was created. */
1386+
/**
1387+
* Returns a boolean indicating whether or not request can outlive the global in which it was created.
1388+
*
1389+
* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Request/keepalive)
1390+
*/
13801391
keepalive: boolean;
13811392
/**
13821393
* Returns the cache mode associated with request, which is a string indicating how the request will interact with the browser's cache when fetching.
@@ -1576,6 +1587,7 @@ interface R2ObjectBody extends R2Object {
15761587
get body(): ReadableStream;
15771588
get bodyUsed(): boolean;
15781589
arrayBuffer(): Promise<ArrayBuffer>;
1590+
bytes(): Promise<Uint8Array>;
15791591
text(): Promise<string>;
15801592
json<T>(): Promise<T>;
15811593
blob(): Promise<Blob>;
@@ -5182,6 +5194,7 @@ declare module 'cloudflare:workers' {
51825194
export type WorkflowSleepDuration = `${number} ${WorkflowDurationLabel}${'s' | ''}` | number;
51835195
export type WorkflowDelayDuration = WorkflowSleepDuration;
51845196
export type WorkflowTimeoutDuration = WorkflowSleepDuration;
5197+
export type WorkflowRetentionDuration = WorkflowSleepDuration;
51855198
export type WorkflowBackoff = 'constant' | 'linear' | 'exponential';
51865199
export type WorkflowStepConfig = {
51875200
retries?: {
@@ -5312,6 +5325,7 @@ declare namespace TailStream {
53125325
readonly type: "onset";
53135326
readonly dispatchNamespace?: string;
53145327
readonly entrypoint?: string;
5328+
readonly executionModel: string;
53155329
readonly scriptName?: string;
53165330
readonly scriptTags?: string[];
53175331
readonly scriptVersion?: ScriptVersion;
@@ -5329,8 +5343,8 @@ declare namespace TailStream {
53295343
}
53305344
interface SpanOpen {
53315345
readonly type: "spanOpen";
5332-
readonly op?: string;
5333-
readonly info?: FetchEventInfo | JsRpcEventInfo | Attribute[];
5346+
readonly name: string;
5347+
readonly info?: FetchEventInfo | JsRpcEventInfo | Attributes;
53345348
}
53355349
interface SpanClose {
53365350
readonly type: "spanClose";
@@ -5354,7 +5368,7 @@ declare namespace TailStream {
53545368
}
53555369
interface Return {
53565370
readonly type: "return";
5357-
readonly info?: FetchResponseInfo | Attribute[];
5371+
readonly info?: FetchResponseInfo;
53585372
}
53595373
interface Link {
53605374
readonly type: "link";
@@ -5364,21 +5378,23 @@ declare namespace TailStream {
53645378
readonly spanId: string;
53655379
}
53665380
interface Attribute {
5367-
readonly type: "attribute";
53685381
readonly name: string;
5369-
readonly value: string | string[] | boolean | boolean[] | number | number[];
5382+
readonly value: string | string[] | boolean | boolean[] | number | number[] | bigint | bigint[];
5383+
}
5384+
interface Attributes {
5385+
readonly type: "attributes";
5386+
readonly info: Attribute[];
53705387
}
5371-
type Mark = DiagnosticChannelEvent | Exception | Log | Return | Link | Attribute[];
53725388
interface TailEvent {
53735389
readonly traceId: string;
53745390
readonly invocationId: string;
53755391
readonly spanId: string;
53765392
readonly timestamp: Date;
53775393
readonly sequence: number;
5378-
readonly event: Onset | Outcome | Hibernate | SpanOpen | SpanClose | Mark;
5394+
readonly event: Onset | Outcome | Hibernate | SpanOpen | SpanClose | DiagnosticChannelEvent | Exception | Log | Return | Link | Attributes;
53795395
}
53805396
type TailEventHandler = (event: TailEvent) => void | Promise<void>;
5381-
type TailEventHandlerName = "onset" | "outcome" | "hibernate" | "spanOpen" | "spanClose" | "diagnosticChannel" | "exception" | "log" | "return" | "link" | "attribute";
5397+
type TailEventHandlerName = "outcome" | "hibernate" | "spanOpen" | "spanClose" | "diagnosticChannel" | "exception" | "log" | "return" | "link" | "attributes";
53825398
type TailEventHandlerObject = Record<TailEventHandlerName, TailEventHandler>;
53835399
type TailEventHandlerType = TailEventHandler | TailEventHandlerObject;
53845400
}
@@ -5692,6 +5708,7 @@ declare abstract class Workflow<PARAMS = unknown> {
56925708
*/
56935709
public createBatch(batch: WorkflowInstanceCreateOptions<PARAMS>[]): Promise<WorkflowInstance[]>;
56945710
}
5711+
56955712
interface WorkflowInstanceCreateOptions<PARAMS = unknown> {
56965713
/**
56975714
* An id for your Workflow instance. Must be unique within the Workflow.
@@ -5701,6 +5718,14 @@ interface WorkflowInstanceCreateOptions<PARAMS = unknown> {
57015718
* The event payload the Workflow instance is triggered with
57025719
*/
57035720
params?: PARAMS;
5721+
/**
5722+
* The retention policy for Workflow instance.
5723+
* Defaults to the maximum retention period available for the owner's account.
5724+
*/
5725+
retention?: {
5726+
successRetention?: WorkflowRetentionDuration;
5727+
errorRetention?: WorkflowRetentionDuration;
5728+
};
57045729
}
57055730
type InstanceStatus = {
57065731
status: 'queued' // means that instance is waiting to be started (see concurrency limits)

0 commit comments

Comments
 (0)