@cloud-cli/on 1.14.0 → 1.15.1

package/README.md

@@ -25,7 +25,7 @@ Designed with a strict **security-first boundary**, native **JavaScript AST eval
 
 ```text
 my-project/
-├── runner.config.mjs        # (Optional) Engine configuration
+├── runner.config.mjs        # Optional plugin/advanced configuration
 └── package.json
 
 ```
@@ -263,6 +263,7 @@ Within `${...}`, `if:`, and `eval:` contexts, the following object scopes are ex
 - **`env`**: Merged environment variables from global config and workflow definitions.
 - **`secrets`**: Unmasked job-scoped values from encrypted central secret storage.
 - **`steps`**: Execution statuses and outputs from previous steps in the workflow (`steps.<id>.status`, `steps.<id>.outputs`).
+- **`files`**: Workspace-bound file helpers for `if:` and `eval:` expressions: `files.exists('Dockerfile')`, `files.readFile('package.json')`, and `files.join('dist', 'artifact')`. Paths outside the job `workingDir` are rejected.
 - **`BUILTIN_HELPERS`**: JS utilities including `String`, `Number`, `Boolean`, and `JSON.parse` / `JSON.stringify`.
 
 ---
@@ -276,15 +277,22 @@ The Ingress Gateway listens for incoming HTTP requests and serves the live web U
 | Method     | Endpoint           | Description                                                                            |
 | ---------- | ------------------ | -------------------------------------------------------------------------------------- |
 | **`POST`** | `/webhooks/github` | Webhook endpoint for GitHub events. Applies GitHub filters and evaluates `on.github.if`. |
-| **`GET`**  | `/runs`            | **Dashboard:** Live dark-mode monitoring page listing recent jobs and worker health.   |
+| **`GET`**  | `/runs`            | **Dashboard:** Public live dark-mode monitoring page listing recent jobs.   |
 | **`GET`**  | `/api/jobs?afterId=<id>&beforeId=<id>&limit=<n>` | Dashboard jobs with exclusive lower and upper ID cursors and a limit from 1 to 500 (default 50). |
-| **`GET`**  | `/runs/:jobId`     | **Job Report:** Interactive HTML trace view with step timings and terminal log output. |
+| **`GET`**  | `/runs/:jobId`     | **Job Report:** Authenticated interactive trace with step timings and terminal log output. |
+| **`GET`**  | `/workflows`       | Authenticated workflow list and encrypted secret management UI. |
+| **`GET`**  | `/workflows/new`, `/workflows/:id` | Authenticated YAML workflow editor. |
+| **`POST`** | `/api/workflows/validate` | Authenticated YAML validation without persistence. |
+| **`GET`, `PUT`, `DELETE`** | `/api/workflows/:id` | Authenticated revisioned workflow read, draft save, and deletion. |
+| **`POST`** | `/api/workflows/:id/publish` | Authenticated publication of the latest draft revision. |
+| **`GET`, `PUT`, `DELETE`** | `/api/secrets`, `/api/secrets/:name` | Authenticated encrypted secret-name and write-only value management. |
 
 ### Dashboard Features
 
 - **Real-time Auto-Refresh:** `/runs` automatically refreshes job queue statuses (`PENDING`, `RUNNING`, `SUCCESS`, `FAILED`, `CANCELLED`).
 - **ANSI Terminal Rendering:** Uses `ansi_up` to render bash colors, bold highlights, and console outputs accurately in step log boxes.
 - **Payload Inspection:** View JSON inputs received from webhooks for easy debugging.
+- **Workflow Management:** Use the authenticated `/workflows` pages to create, validate, publish, edit, and delete DB-authored workflow revisions.
 
 ---
 
@@ -297,7 +305,7 @@ The Ingress Gateway listens for incoming HTTP requests and serves the live web U
 3. **Payload Size Guard:**
    The Ingress server enforces a strict 5MB payload limit to prevent Out-Of-Memory (OOM) denial-of-service attacks.
 4. **Single-operator API authentication:**
-   Workflow validation, publishing, secret management, and job details require `RUNNER_ADMIN_SECRET` over HTTPS.
+   Workflow validation, publishing, secret management, and job details require `RUNNER_ADMIN_SECRET` over HTTPS. Workers use the separate `RUNNER_WORKER_SECRET` only for lifecycle events and secrets of jobs they have claimed.
 
 ## systemd Deployment
 
@@ -315,6 +323,23 @@ Workers now resolve the immutable revision when they claim a job. A workflow can
 
 This MVP intentionally supports one trusted operator. Before sharing the UI or exposing it beyond a private deployment, add individual accounts and roles, secure browser sessions and CSRF protection, audit logs, worker enrollment credentials, secret key rotation, encrypted systemd credentials, rate limiting, and database high availability.
 
+## Planned Runner Rollouts
+
+Package-managed workers currently update on a staggered daily timer. Before enabling automatic promotion of newly released runner versions, implement a controlled canary rollout:
+
+1. Publish a new immutable npm version and resolve the exact version behind the candidate tag.
+2. Install that exact version on one designated canary worker, never a moving tag during the rollout.
+3. Stage releases in versioned directories and atomically switch a `current` symlink only after installation and a local smoke check succeed.
+4. Drain the canary with `SIGUSR1`, restart it, and retain prior release directories for rollback.
+5. Require the canary to report a heartbeat containing its worker ID, running version, health state, and last-seen time.
+6. Run a dedicated `runner-health` workflow with `tags: [canary]` to verify queue claiming, revision lookup, job-scoped secret retrieval, and the execution driver.
+7. Record rollout state durably: candidate version, canary worker, status, promotion time, and failure reason.
+8. Promote only a healthy candidate with `npm dist-tag add @cloud-cli/on@<version> stable`.
+9. Configure normal daily worker updates to install `@cloud-cli/on@stable`, with a rollout concurrency limit of one worker.
+10. On failed installation, restart, heartbeat, or health check, mark the candidate rejected, leave `stable` unchanged, and roll the canary back to its prior version.
+
+SSE should notify workers that an update is available, but the control-plane database must remain the authoritative rollout state so disconnected workers converge safely after reconnecting.
+
 ## Development
 
 ```bash

package/dist/debug.d.ts

@@ -0,0 +1,2 @@
+export declare function debug(...args: any[]): void;
+//# sourceMappingURL=debug.d.ts.map

package/dist/debug.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"debug.d.ts","sourceRoot":"","sources":["../src/debug.ts"],"names":[],"mappings":"AAEA,wBAAgB,KAAK,CAAC,GAAG,IAAI,OAAA,QAE5B"}

package/dist/drivers/standard-process.driver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"standard-process.driver.d.ts","sourceRoot":"","sources":["../../src/drivers/standard-process.driver.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,mBAAmB,EAAc,MAAM,aAAa,CAAC;AAE5F,qBAAa,qBAAsB,YAAW,eAAe;IAC3D,IAAI,SAAsB;IAEpB,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAIrC,OAAO,CAAC,GAAG,EAAE,WAAW,GAAG,mBAAmB;IAyI9C;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAuBlB,OAAO,CAAC,IAAI,EAAE,MAAM;CAG3B"}
+{"version":3,"file":"standard-process.driver.d.ts","sourceRoot":"","sources":["../../src/drivers/standard-process.driver.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,mBAAmB,EAAc,MAAM,aAAa,CAAC;AAG5F,qBAAa,qBAAsB,YAAW,eAAe;IAC3D,IAAI,SAAsB;IAEpB,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAIrC,OAAO,CAAC,GAAG,EAAE,WAAW,GAAG,mBAAmB;IAuI9C;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAuBlB,OAAO,CAAC,IAAI,EAAE,MAAM;CAG3B"}

package/dist/drivers/systemd.driver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"systemd.driver.d.ts","sourceRoot":"","sources":["../../src/drivers/systemd.driver.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,mBAAmB,EAAc,MAAM,aAAa,CAAC;AAI5F,qBAAa,aAAc,YAAW,eAAe;IACnD,IAAI,SAAa;IAEX,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAQrC,OAAO,CAAC,GAAG,EAAE,WAAW,GAAG,mBAAmB;IA0JxC,OAAO,CAAC,IAAI,EAAE,MAAM;CAS3B"}
+{"version":3,"file":"systemd.driver.d.ts","sourceRoot":"","sources":["../../src/drivers/systemd.driver.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,mBAAmB,EAAc,MAAM,aAAa,CAAC;AAK5F,qBAAa,aAAc,YAAW,eAAe;IACnD,IAAI,SAAa;IAEX,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAQrC,OAAO,CAAC,GAAG,EAAE,WAAW,GAAG,mBAAmB;IAwJxC,OAAO,CAAC,IAAI,EAAE,MAAM;CAS3B"}