Skip to content
Hyphae Cloud

Functions and secrets

A function is one JavaScript (ES module) file, stored by the Cloud with its version and SHA-256, and run per invocation as a separate process on the Cloud host — Node (or Deno when present). It must export a default handler:

export default async function handler(req) {
  // req.body is the JSON you sent; req.headers_subset, req.project_id, req.function are set
  return { status: 200, body: { hello: req.body?.name ?? "world" } };
}

Invoke with POST …/functions/{name}/invoke and a JSON body (≤ 32 KiB). The function’s own answer comes back with its status and body and an X-Hyphae-Function header; a Cloud error (timeout, bad output, missing runtime) comes back as a normal Cloud error and the Studio labels it cloud answered.

What v0 isolation is — exactly

Section titled “What v0 isolation is — exactly”
  • A separate process per invocation with its own process group and an environment of exactly CLOUD_ORIGIN, PROJECT_ID, FUNCTION_NAME and the project’s secrets. Never a project key.
  • A timeout (CLOUDD_FN_TIMEOUT_MS, 5 s by default): the process group is killed, the caller gets 504 function_timeout.
  • Bounded I/O: request body ≤ 32 KiB, one JSON object ≤ 1 MiB on stdout, source ≤ 512 KiB; anything else is 502 function_bad_output.
  • Bounded concurrency: two invocations per project at a time, 429 function_busy beyond.
  • Filesystem reads restricted to the function’s directory where the runtime supports it (Node’s --permission); network restricted only under Deno. Under Node the function has the host’s network.

It is trusted project code, not a sandbox. It can read what the daemon’s OS user can read, reach what the host can reach, and burn CPU until the timeout. The Cloud claims no container, VM, seccomp or cgroup boundary. See what it is not.

Secrets

Section titled “Secrets”

Secrets are owner-held values injected into every invoke of the project as NAME=value environment variables (after CLOUD_ORIGIN, PROJECT_ID, FUNCTION_NAME, which cannot be shadowed). Only the owner’s session can set, rotate, list or delete them, and only the name ever comes back — no route, receipt or log line carries a value. Set the same name again to rotate it (the version increments).

At rest, values are encrypted in the control store with XChaCha20-Poly1305 under the daemon’s process key, bound to project and name. That is process-key encryption, not a KMS: whoever holds the key can decrypt. Secrets are not Native-proved and not part of snapshots. Limits: 16 per project, 4 KiB each, names A-Z 0-9 _ starting with a letter.