@cloud-cli/on 0.1.7 → 1.2.2

package/dist/evaluator/safe-eval.js

@@ -0,0 +1,213 @@
+import * as acorn from 'acorn';
+export const BUILTIN_HELPERS = {
+    String: (val) => String(val ?? ''),
+    Number: (val) => Number(val),
+    Boolean: (val) => Boolean(val),
+    JSON: {
+        parse: (str) => JSON.parse(str),
+        stringify: (obj) => JSON.stringify(obj, null, 2),
+    },
+};
+export class SafeExpressionEvaluator {
+    /**
+     * Deterministic Value Evaluator (Used for `env:`, `name:`, `image:`, `concurrency:`)
+     * - Native non-string types (booleans, numbers, objects) pass through untouched.
+     * - Strings WITHOUT `${` are returned as 100% literal strings (zero JS AST overhead).
+     * - Strings WITH `${` are evaluated strictly as ES Template Literals.
+     */
+    static async evaluateValue(val, context = {}) {
+        if (typeof val !== 'string') {
+            return val;
+        }
+        // 1. Literal Passthrough: String does not contain `${`
+        if (!val.includes('${')) {
+            return val;
+        }
+        // 2. Dynamic Template Interpolation: Evaluates as ES Template Literal
+        const templateExpr = `\`${val}\``;
+        return this.evaluateExpression(templateExpr, context);
+    }
+    /**
+     * Deterministic Condition Evaluator (Used for `if:`)
+     * Strictly parses code as a JavaScript expression and coerces result to boolean.
+     * Throws an explicit AST Parse Error on invalid syntax (fails fast and loud).
+     */
+    static async evaluateCondition(code, context = {}) {
+        const result = await this.evaluateExpression(code, context);
+        return Boolean(result);
+    }
+    /**
+     * Evaluates direct JS code (Used for `eval:` steps or internal expression resolution).
+     */
+    static async evaluateExpression(code, context = {}) {
+        if (!code || typeof code !== 'string') {
+            return code;
+        }
+        const trimmed = code.trim();
+        let ast;
+        try {
+            ast = acorn.parseExpressionAt(trimmed, 0, {
+                ecmaVersion: 2020,
+                allowAwaitOutsideFunction: false,
+            });
+        }
+        catch (parseErr) {
+            throw new Error(`Invalid expression syntax in '${trimmed}': ${parseErr.message}`);
+        }
+        return this.evalNodeAsync(ast, context);
+    }
+    /**
+     * Alias wrapper for backward compatibility with step runners
+     */
+    static async evaluateAsync(code, context = {}) {
+        return this.evaluateExpression(code, context);
+    }
+    /**
+     * Asynchronous AST Node Walker with Security Guards
+     */
+    static async evalNodeAsync(node, ctx) {
+        switch (node.type) {
+            // Primitive Literals: 123, "hello", true, null
+            case 'Literal':
+                return node.value;
+            // Variables / Identifiers: inputs, steps, String
+            case 'Identifier':
+                if (node.name in ctx)
+                    return ctx[node.name];
+                if (node.name in BUILTIN_HELPERS)
+                    return BUILTIN_HELPERS[node.name];
+                return undefined;
+            // Property Access: inputs.branch or secrets["TOKEN"]
+            case 'MemberExpression': {
+                const object = await this.evalNodeAsync(node.object, ctx);
+                if (object == null)
+                    return undefined;
+                const property = node.computed ? await this.evalNodeAsync(node.property, ctx) : node.property.name;
+                // SECURITY GUARD: Block Prototype Pollution Escapes
+                if (['constructor', '__proto__', 'prototype'].includes(property)) {
+                    throw new Error(`Security Guard Violation: Access to '${property}' is blocked.`);
+                }
+                return object[property];
+            }
+            // Function & Method Calls: slack_notify(...) or url.replace(...)
+            case 'CallExpression': {
+                let fn;
+                let targetObj = null;
+                if (node.callee.type === 'MemberExpression') {
+                    targetObj = await this.evalNodeAsync(node.callee.object, ctx);
+                    const prop = node.callee.computed
+                        ? await this.evalNodeAsync(node.callee.property, ctx)
+                        : node.callee.property.name;
+                    if (['constructor', '__proto__', 'prototype'].includes(prop)) {
+                        throw new Error(`Security Guard Violation: Invoking method '${prop}' is blocked.`);
+                    }
+                    if (targetObj != null && typeof targetObj[prop] === 'function') {
+                        fn = targetObj[prop];
+                    }
+                    else {
+                        throw new Error(`Property '${prop}' is not a callable function on target object.`);
+                    }
+                }
+                else if (node.callee.type === 'Identifier') {
+                    const fnName = node.callee.name;
+                    fn = ctx[fnName] ?? BUILTIN_HELPERS[fnName];
+                    if (!fn || typeof fn !== 'function') {
+                        throw new Error(`Unknown function helper '${fnName}'.`);
+                    }
+                }
+                if (!fn) {
+                    throw new Error('Invalid function invocation target.');
+                }
+                const args = await Promise.all(node.arguments.map((arg) => this.evalNodeAsync(arg, ctx)));
+                return await fn.apply(targetObj, args);
+            }
+            // Binary Operators: a === b, x + y, p > q
+            case 'BinaryExpression': {
+                const left = await this.evalNodeAsync(node.left, ctx);
+                const right = await this.evalNodeAsync(node.right, ctx);
+                switch (node.operator) {
+                    case '===':
+                    case '==':
+                        return left == right;
+                    case '!==':
+                    case '!=':
+                        return left != right;
+                    case '>':
+                        return left > right;
+                    case '<':
+                        return left < right;
+                    case '>=':
+                        return left >= right;
+                    case '<=':
+                        return left <= right;
+                    case '+':
+                        return left + right;
+                    case '-':
+                        return left - right;
+                    case '*':
+                        return left * right;
+                    case '/':
+                        return left / right;
+                    default:
+                        throw new Error(`Unsupported binary operator: ${node.operator}`);
+                }
+            }
+            // Logical Operators: a && b, x || y
+            case 'LogicalExpression': {
+                const left = await this.evalNodeAsync(node.left, ctx);
+                if (node.operator === '&&') {
+                    return left ? await this.evalNodeAsync(node.right, ctx) : left;
+                }
+                if (node.operator === '||') {
+                    return left ? left : await this.evalNodeAsync(node.right, ctx);
+                }
+                throw new Error(`Unsupported logical operator: ${node.operator}`);
+            }
+            // Unary Operators: !x, -y
+            case 'UnaryExpression': {
+                const argument = await this.evalNodeAsync(node.argument, ctx);
+                if (node.operator === '!')
+                    return !argument;
+                if (node.operator === '-')
+                    return -argument;
+                if (node.operator === '+')
+                    return +argument;
+                throw new Error(`Unsupported unary operator: ${node.operator}`);
+            }
+            // Template Strings: `node:${matrix.version}-alpine`
+            case 'TemplateLiteral': {
+                const quasis = node.quasis.map((q) => q.value.cooked);
+                const expressions = await Promise.all(node.expressions.map((e) => this.evalNodeAsync(e, ctx)));
+                let result = '';
+                for (let i = 0; i < quasis.length; i++) {
+                    result += quasis[i];
+                    if (i < expressions.length) {
+                        result += expressions[i] ?? '';
+                    }
+                }
+                return result;
+            }
+            // Array Literals: [1, 2, "three"]
+            case 'ArrayExpression': {
+                return Promise.all(node.elements.map((elem) => this.evalNodeAsync(elem, ctx)));
+            }
+            // Object Literals: { a: 1, b: "hello" }
+            case 'ObjectExpression': {
+                const obj = {};
+                for (const prop of node.properties) {
+                    if (prop.type === 'Property') {
+                        const key = prop.key.type === 'Identifier' ? prop.key.name : await this.evalNodeAsync(prop.key, ctx);
+                        obj[key] = await this.evalNodeAsync(prop.value, ctx);
+                    }
+                }
+                return obj;
+            }
+            // Optional Chaining: inputs?.repo
+            case 'ChainExpression': {
+                return this.evalNodeAsync(node.expression, ctx);
+            }
+            default:
+                throw new Error(`Security Guard Violation: AST Node type '${node.type}' is disallowed.`);
+        }
+    }
+}

package/dist/index.js

@@ -0,0 +1,145 @@
+#!/usr/bin/env node
+import { parseArgs } from 'node:util';
+import path from 'node:path';
+import fs, { statSync } from 'node:fs';
+import { QueueManager } from './queue/dispatcher.js';
+import { SecretStore } from './secrets/store.js';
+import { WebhookServer } from './ingress/server.js';
+import { WorkflowIncludeResolver } from './parser/include-resolver.js';
+import { expandMatrix } from './parser/matrix-expander.js';
+import { startWorkers } from './worker.js';
+import { YamlLoader } from './parser/yaml-loader.js';
+import { resolveConfig } from './config.js';
+const { values, positionals } = parseArgs({
+    allowPositionals: true,
+    options: {
+        config: { type: 'string', short: 'c', default: process.env.RUNNER_CONFIG_PATH || './runner.config.mjs' },
+        database: { type: 'string', short: 'd', default: process.env.RUNNER_DATABASE_URL },
+        workflows: { type: 'string', short: 'w', default: process.env.RUNNER_WORKFLOWS_PATH || '.on/' },
+        port: { type: 'string', short: 'p', default: String(process.env.PORT || '11235') },
+        workers: { type: 'string', short: 'k', default: process.env.RUNNER_WORKERS || '5' },
+        help: { type: 'boolean', short: 'h' },
+    },
+});
+function printHelp() {
+    console.log(`
+🏃 Runner CLI 🏃
+
+Usage:
+  npx -y @cloud-cli/on <command> [options]
+  pnpm dlx -y @cloud-cli/on <command> [options]
+
+Commands:
+  start           Runs both Webhook Ingress Server and Workers (Default)
+  start-server    Runs Webhook Ingress Server only (API Gateway mode)
+  start-workers   Runs Worker Polling loops only (Scalable Worker mode)
+  validate        Parses and validates workflow YAML files without running
+
+Options:
+  -c, --config     Path to runner.config.mjs (default: ./runner.config.mjs, env: RUNNER_CONFIG_PATH)
+  -d, --database   SQLite Database URL (env: RUNNER_DATABASE_URL)
+  -w, --workflows  Path to where your workflows are defined (default: .on/, env: RUNNER_WORKFLOWS_PATH)
+  -p, --port       Port for Webhook Ingress Server (default: 11235, env: PORT)
+  -k, --workers    Number of worker thread loops to spawn (default: 5, env: RUNNER_WORKERS)
+  -h, --help       Show this help message
+  `);
+}
+if (values.help) {
+    printHelp();
+    process.exit(0);
+}
+async function loadConfig() {
+    const cliOverrides = {
+        port: Number(values.port),
+        sqliteUrl: values.database,
+        workflowsDir: values.workflows,
+        workersCount: values.workers ? Number(values.workers) : undefined,
+    };
+    let userFileConfig = {};
+    const configPath = path.resolve(values.config);
+    if (fs.existsSync(configPath) && statSync(configPath).isFile()) {
+        userFileConfig = (await import(configPath)).default || {};
+    }
+    // Merge CLI flags over file config over defaults
+    const finalConfig = resolveConfig({
+        ...userFileConfig,
+        ...cliOverrides,
+    });
+    if (!fs.existsSync(finalConfig.workflowsDir)) {
+        console.warn(`⚠️ Warning: Workflows directory '${finalConfig.workflowsDir}' not found.`);
+        return null;
+    }
+    return finalConfig;
+}
+function onValidate(config) {
+    console.log('🔍 Validating Workflows in:', config.workflowsDir);
+    const resolver = new WorkflowIncludeResolver(config.workflowsDir);
+    const files = fs.readdirSync(config.workflowsDir).filter((f) => f.endsWith('.yml') || f.endsWith('.yaml'));
+    for (const file of files) {
+        const resolved = resolver.resolve(file);
+        const expanded = expandMatrix(resolved);
+        console.log(`  ✅ ${file} -> Valid! (${expanded.length} job matrix variant(s) generated)`);
+    }
+}
+async function onServe(config, workflows) {
+    const { queue, secrets } = await init();
+    WebhookServer.withPort({
+        queue,
+        secrets,
+        adminToken: config.adminToken,
+        workflows,
+        port: config.port,
+    });
+}
+async function onWorkers(config) {
+    const { queue, secrets } = await init();
+    startWorkers(config.workersCount, queue, secrets, config);
+}
+async function init() {
+    const secrets = new SecretStore('./.env');
+    const queue = new QueueManager('cli-node');
+    await queue.init();
+    return { secrets, queue };
+}
+async function main() {
+    const command = positionals[0] || 'start';
+    const config = await loadConfig();
+    if (!config) {
+        process.exit(1);
+    }
+    switch (command) {
+        case 'validate': {
+            onValidate(config);
+            break;
+        }
+        case 'start-server': {
+            console.log('🌐 Starting Ingress Gateway...');
+            onServe(config, []);
+            break;
+        }
+        case 'start-workers': {
+            console.log(`⚙️ Starting ${config.workersCount} Worker Loop(s)...`);
+            onWorkers(config);
+            break;
+        }
+        case 'start': {
+            console.log('🚀 Starting Full Runner Engine (Ingress + Workers)...');
+            const workflows = YamlLoader.from(config.workflowsDir);
+            onServe(config, workflows);
+            onWorkers(config);
+            break;
+        }
+        default:
+            console.error(`❌ Unknown command: '${command}'`);
+            printHelp();
+            process.exit(1);
+    }
+}
+const cleanupAndExit = async (signal) => {
+    console.log(`\n🛑 Received ${signal}. Gracefully shutting down workers...`);
+    // Cancel active jobs / close DB connections here
+    process.exit(0);
+};
+process.on('SIGINT', () => cleanupAndExit('SIGINT'));
+process.on('SIGTERM', () => cleanupAndExit('SIGTERM'));
+main().catch(console.error);

package/dist/ingress/preprocessors/github.js

@@ -0,0 +1,30 @@
+import crypto from 'node:crypto';
+export class GitHubPreprocessor {
+    name = 'github';
+    parse(headers, body, rawBodyBuffer, secret) {
+        // 1. HMAC Signature Verification
+        let isValid = true;
+        const signature = headers['x-hub-signature-256'];
+        if (secret && signature) {
+            const hmac = 'sha256=' + crypto.createHmac('sha256', secret).update(rawBodyBuffer).digest('hex');
+            isValid = crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(hmac));
+        }
+        // 2. Normalize GitHub Event & Headers
+        const event = headers['x-github-event'] || 'unknown';
+        const ref = body.ref || '';
+        const branch = ref.replace('refs/heads/', '').replace('refs/tags/', '');
+        return {
+            isValid,
+            event,
+            inputs: {
+                event,
+                branch,
+                clone_url: body.repository?.clone_url,
+                commit_sha: body.after || body.head_commit?.id,
+                author: body.pusher?.name || body.sender?.login,
+                action: body.action, // e.g., 'opened', 'synchronize' for PRs
+            },
+            rawBody: body,
+        };
+    }
+}

package/dist/ingress/server.js

@@ -0,0 +1,241 @@
+import http from 'node:http';
+import { URL } from 'node:url';
+import { SafeExpressionEvaluator } from '../evaluator/safe-eval.js';
+import { GitHubPreprocessor } from './preprocessors/github.js';
+import { HtmlReporter } from '../reporters/html.reporter.js';
+export class WebhookServer {
+    server;
+    preprocessors = new Map();
+    workflows = [];
+    queue;
+    secrets;
+    adminToken;
+    static withPort(options) {
+        const { port, ...o } = options;
+        return new WebhookServer(o).listen(port);
+    }
+    constructor(options) {
+        this.queue = options.queue;
+        this.secrets = options.secrets;
+        this.adminToken = options.adminToken;
+        this.workflows = options.workflows;
+        // Register built-in preprocessors
+        this.registerPreprocessor(new GitHubPreprocessor());
+        this.server = http.createServer((req, res) => this.handleRequest(req, res));
+    }
+    registerPreprocessor(preprocessor) {
+        this.preprocessors.set(preprocessor.name, preprocessor);
+    }
+    async handleRequest(req, res) {
+        const url = new URL(req.url || '/', `${req.headers['x-forwarded-proto'] || 'http'}://${req.headers['x-forwarded-host'] || req.headers.host}`);
+        if (req.method === 'GET' && (url.pathname === '/runs' || url.pathname === '/')) {
+            return this.renderDashboard(res);
+        }
+        if (req.method === 'GET' && url.pathname.startsWith('/runs/')) {
+            const jobId = url.pathname.replace('/runs/', '');
+            return this.renderRunDetails(jobId, res);
+        }
+        if (req.method === 'POST' && url.pathname === '/admin/reload-secrets') {
+            return this.handleSecretReload(req, res);
+        }
+        if (req.method === 'POST' && url.pathname.startsWith('/webhooks/')) {
+            const provider = url.pathname.replace('/webhooks/', '');
+            return this.handleWebhook(provider, req, res);
+        }
+        // Fallback 404
+        res.writeHead(404, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Endpoint not found' }));
+    }
+    /**
+     * Processes incoming HTTP webhooks
+     */
+    async handleWebhook(provider, req, res) {
+        try {
+            // 5MB
+            const MAX_PAYLOAD_SIZE = 5 * 1024 * 1024;
+            const chunks = [];
+            let receivedBytes = 0;
+            for await (const chunk of req) {
+                receivedBytes += chunk.length;
+                if (receivedBytes > MAX_PAYLOAD_SIZE) {
+                    res.writeHead(413, { 'Content-Type': 'application/json' });
+                    return res.end(JSON.stringify({ error: 'Payload size exceeds limit' }));
+                }
+                chunks.push(typeof chunk === 'string' ? Buffer.from(chunk) : chunk);
+            }
+            const rawBuffer = Buffer.concat(chunks);
+            let body = {};
+            try {
+                body = JSON.parse(rawBuffer.toString('utf-8'));
+            }
+            catch { }
+            const headers = Object.fromEntries(Object.entries(req.headers).map(([k, v]) => [k.toLowerCase(), Array.isArray(v) ? v[0] : v || '']));
+            const preprocessor = this.preprocessors.get(provider);
+            const secret = this.secrets.get(`${provider.toUpperCase()}_WEBHOOK_SECRET`);
+            let isValid = true;
+            let inputs = { ...body };
+            if (preprocessor) {
+                const result = preprocessor.parse(headers, body, rawBuffer, secret);
+                isValid = result.isValid;
+                inputs = result.inputs;
+            }
+            // Reject unauthorized requests immediately
+            if (!isValid) {
+                res.writeHead(401, { 'Content-Type': 'application/json' });
+                return res.end(JSON.stringify({ error: 'Invalid HMAC signature or authentication failed' }));
+            }
+            // 3. Match Incoming Webhook to Registered Workflows
+            const triggeredJobs = [];
+            for (const workflow of this.workflows) {
+                // Match provider (e.g. 'github')
+                if (workflow.on.provider !== provider)
+                    continue;
+                // Evaluate workflow trigger condition if defined (e.g. `if: inputs.event == 'push'`)
+                if (workflow.on.if) {
+                    try {
+                        const shouldRun = SafeExpressionEvaluator.evaluateCondition(workflow.on.if, { inputs });
+                        if (!shouldRun)
+                            continue;
+                    }
+                    catch (evalErr) {
+                        console.error(`⚠️ Condition evaluation error in workflow [${workflow.id}]:`, evalErr.message);
+                        continue; // Skip this workflow without crashing server
+                    }
+                }
+                // 4. Resolve Concurrency Key (if specified)
+                let concurrencyKey;
+                if (workflow.concurrency?.group) {
+                    concurrencyKey = await SafeExpressionEvaluator.evaluateValue(workflow.concurrency.group, { inputs });
+                }
+                // 5. Enqueue Job to SQLite
+                const jobPayload = {
+                    workflowId: workflow.id,
+                    steps: workflow.steps,
+                    inputs,
+                };
+                await this.queue.enqueue(workflow.id, jobPayload, concurrencyKey);
+                triggeredJobs.push(workflow.id);
+            }
+            // 6. Respond Fast (202 Accepted)
+            res.writeHead(202, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                message: 'Webhook processed',
+                triggeredWorkflows: triggeredJobs,
+            }));
+        }
+        catch (err) {
+            console.error('❌ Webhook Ingress Error:', err);
+            res.writeHead(500, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Internal Ingress Error', details: err.message }));
+        }
+    }
+    /**
+     * Handles Zero-Downtime Secret Reload
+     */
+    async handleSecretReload(req, res) {
+        const authHeader = req.headers['authorization'];
+        if (authHeader !== `Bearer ${this.adminToken}`) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            return res.end(JSON.stringify({ error: 'Unauthorized' }));
+        }
+        // Trigger in-memory secret reload
+        this.secrets.reload();
+        console.log('🔄 SecretStore reloaded successfully without downtime!');
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ message: 'Secrets reloaded successfully' }));
+    }
+    /**
+     * Serves the Server Health & Jobs Dashboard
+     */
+    async renderDashboard(res) {
+        const jobs = await this.queue.listJobs(50);
+        const rows = jobs
+            .map((j) => {
+            const badge = j.status === 'success'
+                ? 'bg-emerald-500/10 text-emerald-400'
+                : j.status === 'failed'
+                    ? 'bg-rose-500/10 text-rose-400'
+                    : j.status === 'running'
+                        ? 'bg-indigo-500/10 text-indigo-400 animate-pulse'
+                        : 'bg-gray-500/10 text-gray-400';
+            return `
+      <tr class="border-b border-gray-800 hover:bg-gray-900/50 transition">
+        <td class="py-3 px-4 font-mono text-indigo-400"><a href="/runs/${j.id}" class="hover:underline">#${j.id}</a></td>
+        <td class="py-3 px-4 font-medium text-white">${j.workflow_id}</td>
+        <td class="py-3 px-4">
+          <span class="px-2.5 py-0.5 rounded-full text-xs font-semibold ${badge}">${j.status.toUpperCase()}</span>
+        </td>
+        <td class="py-3 px-4 text-xs font-mono text-gray-400">${j.worker_id || '-'}</td>
+        <td class="py-3 px-4 text-xs text-gray-400">${j.created_at}</td>
+        <td class="py-3 px-4 text-right">
+          <a href="/runs/${j.id}" class="text-xs bg-gray-800 hover:bg-gray-700 text-gray-200 px-3 py-1 rounded border border-gray-700">View Trace →</a>
+        </td>
+      </tr>
+    `;
+        })
+            .join('');
+        const html = `<!DOCTYPE html>
+<html lang="en" class="dark">
+<head>
+  <meta charset="UTF-8">
+  <meta http-equiv="refresh" content="10"> <!-- Auto-refreshes every 10s -->
+  <title>Workflow Engine Dashboard</title>
+  <script src="https://cdn.tailwindcss.com"></script>
+</head>
+<body class="bg-gray-950 text-gray-100 min-h-screen p-6 font-sans">
+  <div class="max-w-6xl mx-auto space-y-6">
+    <div class="flex items-center justify-between border-b border-gray-800 pb-4">
+      <div>
+        <h1 class="text-2xl font-bold text-white">⚙️ Runner Engine Status</h1>
+        <p class="text-xs text-gray-400">Live SQLite Job Queue & Execution Traces</p>
+      </div>
+      <span class="text-xs font-mono bg-emerald-500/10 text-emerald-400 px-3 py-1 rounded-full border border-emerald-500/20">
+        ● System Operational
+      </span>
+    </div>
+
+    <div class="bg-gray-900 border border-gray-800 rounded-xl overflow-hidden">
+      <table class="w-full text-left text-sm">
+        <thead class="bg-gray-800/50 text-gray-400 text-xs uppercase font-mono border-b border-gray-800">
+          <tr>
+            <th class="py-3 px-4">Job ID</th>
+            <th class="py-3 px-4">Workflow</th>
+            <th class="py-3 px-4">Status</th>
+            <th class="py-3 px-4">Worker</th>
+            <th class="py-3 px-4">Created At</th>
+            <th class="py-3 px-4 text-right">Action</th>
+          </tr>
+        </thead>
+        <tbody>${rows.length ? rows : '<tr><td colspan="6" class="p-6 text-center text-gray-500">No jobs recorded yet.</td></tr>'}</tbody>
+      </table>
+    </div>
+  </div>
+</body>
+</html>`;
+        res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+        res.end(html);
+    }
+    /**
+     * Serves single job HTML report
+     */
+    async renderRunDetails(jobId, res) {
+        const job = await this.queue.getJob(jobId);
+        if (!job || !job.report) {
+            res.writeHead(404, { 'Content-Type': 'text/html; charset=utf-8' });
+            return res.end('<h1>404 - Report Not Found</h1><p>Job is still running or does not exist.</p><a href="/runs">← Back to Dashboard</a>');
+        }
+        const reportData = JSON.parse(job.report);
+        const htmlReporter = new HtmlReporter({ outputDir: '' });
+        const htmlContent = htmlReporter.generateHtml(reportData);
+        res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+        res.end(htmlContent);
+    }
+    listen(port) {
+        return new Promise((resolve) => {
+            this.server.listen(port, () => {
+                console.log(`🌐 Webhook Ingress Server running on port ${port}`);
+                resolve();
+            });
+        });
+    }
+}

package/dist/ingress/types.js

@@ -0,0 +1 @@
+export {};

package/dist/logging/redactor.js

@@ -0,0 +1,20 @@
+import { Transform } from 'node:stream';
+export class SecretRedactorStream extends Transform {
+    secretValues;
+    constructor(secretValues) {
+        super();
+        // Sort longest secrets first to prevent partial replacements
+        this.secretValues = secretValues.sort((a, b) => b.length - a.length);
+    }
+    _transform(chunk, encoding, callback) {
+        let logString = chunk.toString('utf-8');
+        // Replace all known secret values with ***
+        for (const secret of this.secretValues) {
+            if (secret) {
+                logString = logString.replaceAll(secret, '***');
+            }
+        }
+        this.push(Buffer.from(logString));
+        callback();
+    }
+}