@archlast/server 0.0.1

package/dist/webhook/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/webhook/index.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,4DAMoC;AALhC,wGAAA,OAAO,OAAA;AACP,oHAAA,mBAAmB,OAAA;AAOvB,6CAAkG;AAAzF,kHAAA,mBAAmB,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AAG1E,uCAKoB;AAJhB,8GAAA,kBAAkB,OAAA;AAClB,2GAAA,eAAe,OAAA;AACf,kHAAA,sBAAsB,OAAA;AACtB,kHAAA,sBAAsB,OAAA"}

package/dist/webhook/verifier.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Webhook Signature Verification
+ * Utilities for verifying webhook signatures from various providers
+ */
+export interface VerificationResult {
+    valid: boolean;
+    error?: string;
+}
+/**
+ * Verify HMAC signature
+ */
+export declare function verifyHmacSignature(payload: string, signature: string, secret: string, algorithm?: string, encoding?: "hex" | "base64"): VerificationResult;
+/**
+ * Verify Stripe webhook signature
+ * Format: t=timestamp,v1=signature
+ */
+export declare function verifyStripeSignature(payload: string, signatureHeader: string, secret: string, tolerance?: number): VerificationResult;
+/**
+ * Verify GitHub webhook signature
+ * Header: X-Hub-Signature-256
+ * Format: sha256=signature
+ */
+export declare function verifyGitHubSignature(payload: string, signatureHeader: string, secret: string): VerificationResult;
+//# sourceMappingURL=verifier.d.ts.map

package/dist/webhook/verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../src/webhook/verifier.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,kBAAkB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAC/B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,SAAS,GAAE,MAAiB,EAC5B,QAAQ,GAAE,KAAK,GAAG,QAAgB,GACnC,kBAAkB,CAsBpB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACjC,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,EACd,SAAS,GAAE,MAAY,GACxB,kBAAkB,CA8CpB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACjC,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,GACf,kBAAkB,CA0BpB"}

package/dist/webhook/verifier.js

@@ -0,0 +1,107 @@
+"use strict";
+/**
+ * Webhook Signature Verification
+ * Utilities for verifying webhook signatures from various providers
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyHmacSignature = verifyHmacSignature;
+exports.verifyStripeSignature = verifyStripeSignature;
+exports.verifyGitHubSignature = verifyGitHubSignature;
+const crypto_1 = require("crypto");
+/**
+ * Verify HMAC signature
+ */
+function verifyHmacSignature(payload, signature, secret, algorithm = "sha256", encoding = "hex") {
+    try {
+        const hmac = (0, crypto_1.createHmac)(algorithm, secret);
+        hmac.update(payload);
+        const expectedSignature = hmac.digest(encoding);
+        // Use timing-safe comparison
+        const sigBuffer = Buffer.from(signature);
+        const expectedBuffer = Buffer.from(expectedSignature);
+        if (sigBuffer.length !== expectedBuffer.length) {
+            return { valid: false, error: "Signature length mismatch" };
+        }
+        const valid = (0, crypto_1.timingSafeEqual)(sigBuffer, expectedBuffer);
+        return { valid, error: valid ? undefined : "Signature mismatch" };
+    }
+    catch (error) {
+        return {
+            valid: false,
+            error: error instanceof Error ? error.message : "Verification failed",
+        };
+    }
+}
+/**
+ * Verify Stripe webhook signature
+ * Format: t=timestamp,v1=signature
+ */
+function verifyStripeSignature(payload, signatureHeader, secret, tolerance = 300 // 5 minutes
+) {
+    try {
+        const parts = signatureHeader.split(",").reduce((acc, part) => {
+            const [key, value] = part.split("=");
+            acc[key] = value;
+            return acc;
+        }, {});
+        const timestamp = parts["t"];
+        const signature = parts["v1"];
+        if (!timestamp || !signature) {
+            return { valid: false, error: "Missing timestamp or signature" };
+        }
+        // Check timestamp tolerance
+        const now = Math.floor(Date.now() / 1000);
+        const diff = now - parseInt(timestamp, 10);
+        if (Math.abs(diff) > tolerance) {
+            return { valid: false, error: "Timestamp outside tolerance" };
+        }
+        // Compute expected signature
+        const signedPayload = `${timestamp}.${payload}`;
+        const hmac = (0, crypto_1.createHmac)("sha256", secret);
+        hmac.update(signedPayload);
+        const expectedSignature = hmac.digest("hex");
+        const sigBuffer = Buffer.from(signature);
+        const expectedBuffer = Buffer.from(expectedSignature);
+        if (sigBuffer.length !== expectedBuffer.length) {
+            return { valid: false, error: "Signature length mismatch" };
+        }
+        const valid = (0, crypto_1.timingSafeEqual)(sigBuffer, expectedBuffer);
+        return { valid, error: valid ? undefined : "Signature mismatch" };
+    }
+    catch (error) {
+        return {
+            valid: false,
+            error: error instanceof Error ? error.message : "Stripe verification failed",
+        };
+    }
+}
+/**
+ * Verify GitHub webhook signature
+ * Header: X-Hub-Signature-256
+ * Format: sha256=signature
+ */
+function verifyGitHubSignature(payload, signatureHeader, secret) {
+    try {
+        if (!signatureHeader.startsWith("sha256=")) {
+            return { valid: false, error: "Invalid signature format" };
+        }
+        const signature = signatureHeader.substring(7);
+        const hmac = (0, crypto_1.createHmac)("sha256", secret);
+        hmac.update(payload);
+        const expectedSignature = hmac.digest("hex");
+        const sigBuffer = Buffer.from(signature);
+        const expectedBuffer = Buffer.from(expectedSignature);
+        if (sigBuffer.length !== expectedBuffer.length) {
+            return { valid: false, error: "Signature length mismatch" };
+        }
+        const valid = (0, crypto_1.timingSafeEqual)(sigBuffer, expectedBuffer);
+        return { valid, error: valid ? undefined : "Signature mismatch" };
+    }
+    catch (error) {
+        return {
+            valid: false,
+            error: error instanceof Error ? error.message : "GitHub verification failed",
+        };
+    }
+}
+//# sourceMappingURL=verifier.js.map

package/dist/webhook/verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../src/webhook/verifier.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AAYH,kDA4BC;AAMD,sDAmDC;AAOD,sDA8BC;AApID,mCAAqD;AAOrD;;GAEG;AACH,SAAgB,mBAAmB,CAC/B,OAAe,EACf,SAAiB,EACjB,MAAc,EACd,YAAoB,QAAQ,EAC5B,WAA6B,KAAK;IAElC,IAAI,CAAC;QACD,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrB,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEhD,6BAA6B;QAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAEtD,IAAI,SAAS,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,EAAE,CAAC;YAC7C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;QAChE,CAAC;QAED,MAAM,KAAK,GAAG,IAAA,wBAAe,EAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACzD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO;YACH,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB;SACxE,CAAC;IACN,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAgB,qBAAqB,CACjC,OAAe,EACf,eAAuB,EACvB,MAAc,EACd,YAAoB,GAAG,CAAC,YAAY;;IAEpC,IAAI,CAAC;QACD,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAC3C,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;YACV,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACrC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACjB,OAAO,GAAG,CAAC;QACf,CAAC,EACD,EAA4B,CAC/B,CAAC;QAEF,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAE9B,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;YAC3B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;QACrE,CAAC;QAED,4BAA4B;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,GAAG,GAAG,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,SAAS,EAAE,CAAC;YAC7B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;QAClE,CAAC;QAED,6BAA6B;QAC7B,MAAM,aAAa,GAAG,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC3B,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE7C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAEtD,IAAI,SAAS,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,EAAE,CAAC;YAC7C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;QAChE,CAAC;QAED,MAAM,KAAK,GAAG,IAAA,wBAAe,EAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACzD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO;YACH,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B;SAC/E,CAAC;IACN,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAgB,qBAAqB,CACjC,OAAe,EACf,eAAuB,EACvB,MAAc;IAEd,IAAI,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;QAC/D,CAAC;QAED,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrB,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE7C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAEtD,IAAI,SAAS,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,EAAE,CAAC;YAC7C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;QAChE,CAAC;QAED,MAAM,KAAK,GAAG,IAAA,wBAAe,EAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACzD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO;YACH,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B;SAC/E,CAAC;IACN,CAAC;AACL,CAAC"}

package/dist/websocket/server.d.ts

@@ -0,0 +1,74 @@
+import { ServerWebSocket } from "bun";
+import { AuthResolver } from "../auth/resolver.js";
+import { AuthContext } from "../auth/interfaces.js";
+import { ExecutionEngine } from "../engine/runner.js";
+export interface WebSocketData {
+    authContext?: AuthContext;
+    sessionId?: string;
+    subscriptions: Map<string, {
+        name: string;
+        args: any;
+    }>;
+    lastSeen?: number;
+    msgWindowStart?: number;
+    msgCount?: number;
+    heartbeatTimer?: ReturnType<typeof setInterval>;
+    subscribedToLogs?: boolean;
+    isSubscribedToAdminEvents?: boolean;
+    /**
+     * Best-effort request metadata for auth resolution.
+     * Note: Bun's ServerWebSocket does not reliably expose the original upgrade Request,
+     * so these are populated from the client's connect message.
+     */
+    requestHeaders?: Record<string, string>;
+    requestCookies?: Record<string, string>;
+}
+import type { IDatabaseClient } from "../db/interfaces.js";
+export declare class ArchlastWebSocketHandler {
+    private authResolver;
+    private engine;
+    private db;
+    private querySubscribers;
+    private functionToQueryIds;
+    private revalidationQueue;
+    private revalidationTimer;
+    private connectedClients;
+    private adminConnections;
+    constructor(authResolver: AuthResolver, engine: ExecutionEngine, db: IDatabaseClient);
+    open(ws: ServerWebSocket<WebSocketData>): Promise<void>;
+    message(ws: ServerWebSocket<WebSocketData>, message: string | Buffer | object): Promise<void>;
+    close(ws: ServerWebSocket<WebSocketData>, code: number, reason: string): Promise<void>;
+    /**
+     * Broadcast a log entry to all subscribed clients.
+     * Called from IPC poller when logs arrive from any process.
+     */
+    broadcastLog(log: any): void;
+    /**
+     * Hash args to create a canonical function key
+     */
+    private hashArgs;
+    revalidateQueries(affectedQueryIds: Set<string>): Promise<void>;
+    broadcastAdminEvent(type: string, payload: any): void;
+    private bufferRevalidation;
+    private flushRevalidation;
+    /**
+     * Get introspection data for monitoring dashboard
+     */
+    getIntrospection(): {
+        activeConnections: number;
+        openConnections: number;
+        totalSubscriptions: number;
+        sessions: {
+            sessionId: string;
+            userId: string | null;
+            lastSeen: number;
+            subscriptionCount: number;
+            subscriptions: {
+                queryId: string;
+                name: string;
+                args: any;
+            }[];
+        }[];
+    };
+}
+//# sourceMappingURL=server.d.ts.map

package/dist/websocket/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/websocket/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,KAAK,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAoC,MAAM,uBAAuB,CAAC;AAEtF,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAWtD,MAAM,WAAW,aAAa;IAC1B,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,GAAG,CAAA;KAAE,CAAC,CAAC;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC;IAEhD,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B,yBAAyB,CAAC,EAAE,OAAO,CAAC;IAEpC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C;AAED,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAS3D,qBAAa,wBAAwB;IACjC,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,EAAE,CAAkB;IAY5B,OAAO,CAAC,gBAAgB,CAA0D;IAKlF,OAAO,CAAC,kBAAkB,CAAuC;IAEjE,OAAO,CAAC,iBAAiB,CAA0B;IACnD,OAAO,CAAC,iBAAiB,CAA8C;IAGvE,OAAO,CAAC,gBAAgB,CAAkD;IAG1E,OAAO,CAAC,gBAAgB,CAAkD;gBAE9D,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,EAAE,eAAe;IAM9E,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC,aAAa,CAAC;IAuBvC,OAAO,CAAC,EAAE,EAAE,eAAe,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM;IAiZ7E,KAAK,CAAC,EAAE,EAAE,eAAe,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAsD5E;;;OAGG;IACI,YAAY,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI;IAanC;;OAEG;IACH,OAAO,CAAC,QAAQ;IAgBH,iBAAiB,CAAC,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC;IAIrD,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,IAAI;IAmB5D,OAAO,CAAC,kBAAkB;YA8BZ,iBAAiB;IAqI/B;;OAEG;IACI,gBAAgB;;;;;;;;;;;;;;;;CA0B1B"}