@cloud-cli/on 1.2.2 → 1.2.4

package/dist/parser/include-resolver.d.ts

@@ -0,0 +1,9 @@
+export declare class WorkflowIncludeResolver {
+    private baseDir;
+    private maxDepth;
+    constructor(baseDir: string, maxDepth?: number);
+    /**
+     * Recursively loads and merges YAML workflows while guarding against cycles.
+     */
+    resolve(filePath: string, visited?: Set<string>, depth?: number): any;
+}

package/dist/parser/matrix-expander.d.ts

@@ -0,0 +1,5 @@
+import { ParsedWorkflow } from '../types';
+/**
+ * Expands a workflow definition containing a `strategy.matrix` into dynamic single-instance workflow jobs.
+ */
+export declare function expandMatrix(workflow: ParsedWorkflow): ParsedWorkflow[];

package/dist/parser/yaml-loader.d.ts

@@ -0,0 +1,6 @@
+import { WorkflowIncludeResolver } from './include-resolver.js';
+import { WorkflowDefinition } from '../types.js';
+export declare class YamlLoader {
+    static from(path: string): Promise<WorkflowDefinition[]>;
+    static loadFile(path: string, resolver: WorkflowIncludeResolver): WorkflowDefinition[];
+}

package/dist/plugins/github-status.plugin.d.ts

@@ -0,0 +1,7 @@
+import { WorkflowPlugin, WorkflowContext } from '../types.js';
+export declare class GitHubStatusPlugin implements WorkflowPlugin {
+    name: string;
+    onWorkflowStart(wf: WorkflowContext): Promise<void>;
+    onWorkflowFinish(wf: WorkflowContext, status: 'success' | 'failed'): Promise<void>;
+    private updateStatus;
+}

package/dist/plugins/manager.d.ts

@@ -0,0 +1,7 @@
+import { WorkflowPlugin, WorkflowContext } from '../types.js';
+export declare class PluginManager {
+    private plugins;
+    register(plugin: WorkflowPlugin): void;
+    triggerWorkflowStart(wf: WorkflowContext): Promise<void>;
+    triggerWorkflowFinish(wf: WorkflowContext, status: 'success' | 'failed'): Promise<void>;
+}

package/dist/queue.d.ts

@@ -0,0 +1,38 @@
+import { WorkflowExecutionReport, JobPayload, JobRecord, JobStatus } from './types.js';
+export declare class QueueManager {
+    private workerId;
+    constructor(workerId: string);
+    init(): Promise<void>;
+    /**
+     * Enqueues a new job into the database.
+     * Includes simple GitHub-style concurrency cancellation.
+     */
+    enqueue(workflowId: string, payload: JobPayload, concurrencyKey?: string): Promise<any>;
+    /**
+     * ATOMICALY claims the oldest pending job.
+     * Requires SQLite >= 3.35 for the RETURNING clause.
+     */
+    claimNextJob(): Promise<JobRecord | null>;
+    /**
+     * Marks a job as completed or failed
+     */
+    finishJob(jobId: string | number, status: JobStatus): Promise<void>;
+    /**
+     * Checks if the current job has been marked for cancellation by another event
+     */
+    isCancelled(jobId: number): Promise<boolean>;
+    clearStaleJobs(): Promise<any>;
+    createTables(): Promise<any>;
+    /**
+     * Save complete execution report JSON to DB
+     */
+    saveReport(jobId: string | number, report: WorkflowExecutionReport): Promise<void>;
+    /**
+     * Fetch job details + report by ID
+     */
+    getJob(jobId: string | number): Promise<any>;
+    /**
+     * List recent jobs for dashboard status monitoring
+     */
+    listJobs(limit?: number): Promise<any[]>;
+}

package/dist/reporters/html.reporter.d.ts

@@ -0,0 +1,14 @@
+import { Reporter, WorkflowExecutionReport } from '../types.js';
+export declare class HtmlReporter implements Reporter {
+    name: string;
+    private outputDir;
+    private ansiUp;
+    constructor(options: {
+        outputDir: string;
+    });
+    report(execReport: WorkflowExecutionReport): Promise<void>;
+    /**
+     * Render standalone HTML template using Tailwind CSS via CDN
+     */
+    generateHtml(execReport: WorkflowExecutionReport): string;
+}

package/dist/reporters/json-file.reporter.d.ts

@@ -0,0 +1,9 @@
+import { Reporter, WorkflowExecutionReport } from '../types.js';
+export declare class JsonFileReporter implements Reporter {
+    name: string;
+    private outputDir;
+    constructor(options: {
+        outputDir: string;
+    });
+    report(execReport: WorkflowExecutionReport): Promise<void>;
+}

package/dist/reporters/slack.reporter.d.ts

@@ -0,0 +1,15 @@
+import { Reporter, WorkflowExecutionReport } from '../types.js';
+export declare class SlackReporter implements Reporter {
+    readonly name = "slack";
+    private webhookUrl;
+    private token;
+    private channel;
+    private notifyOn;
+    constructor(options: {
+        webhookUrl: string;
+        token: string;
+        channel: string;
+        notifyOn?: ('success' | 'failed')[];
+    });
+    report(execReport: WorkflowExecutionReport): Promise<void>;
+}

package/dist/safe-eval.d.ts

@@ -0,0 +1,28 @@
+export declare const BUILTIN_HELPERS: Record<string, any>;
+export declare class SafeExpressionEvaluator {
+    /**
+     * Deterministic Value Evaluator (Used for `env:`, `name:`, `image:`, `concurrency:`)
+     * - Native non-string types (booleans, numbers, objects) pass through untouched.
+     * - Strings WITHOUT `${` are returned as 100% literal strings (zero JS AST overhead).
+     * - Strings WITH `${` are evaluated strictly as ES Template Literals.
+     */
+    static evaluateValue(val: any, context?: Record<string, any>): Promise<any>;
+    /**
+     * Deterministic Condition Evaluator (Used for `if:`)
+     * Strictly parses code as a JavaScript expression and coerces result to boolean.
+     * Throws an explicit AST Parse Error on invalid syntax (fails fast and loud).
+     */
+    static evaluateCondition(code: string, context?: Record<string, any>): Promise<boolean>;
+    /**
+     * Evaluates direct JS code (Used for `eval:` steps or internal expression resolution).
+     */
+    static evaluateExpression(code: string, context?: Record<string, any>): Promise<any>;
+    /**
+     * Alias wrapper for backward compatibility with step runners
+     */
+    static evaluateAsync(code: string, context?: Record<string, any>): Promise<any>;
+    /**
+     * Asynchronous AST Node Walker with Security Guards
+     */
+    private static evalNodeAsync;
+}

package/dist/secrets.d.ts

@@ -0,0 +1,15 @@
+export declare class SecretStore {
+    private envFilePath?;
+    private secrets;
+    /**
+     * Initialize secrets from host environment or a specified .env file
+     */
+    constructor(envFilePath?: string | undefined);
+    reload(): void;
+    get(key: string): string | undefined;
+    getAll(): Record<string, string>;
+    /**
+     * Returns a list of secret values to be redacted from logs
+     */
+    getSecretValuesForRedaction(): string[];
+}

package/dist/server/preprocessors/github.d.ts

@@ -0,0 +1,5 @@
+import type { PreprocessedWebhook, WebhookPreprocessor } from '../../types.js';
+export declare class GitHubPreprocessor implements WebhookPreprocessor {
+    name: string;
+    parse(headers: Record<string, string>, rawBodyBuffer: Buffer, secret?: string): PreprocessedWebhook;
+}

package/dist/server/server.d.ts

@@ -0,0 +1,32 @@
+import { WebhookPreprocessor, WebhookServerOptions } from '../types.js';
+export declare class WebhookServer {
+    private server;
+    private preprocessors;
+    private workflows;
+    private queue;
+    private secrets;
+    private adminToken;
+    static withPort(options: WebhookServerOptions & {
+        port: number;
+    }): Promise<void>;
+    constructor(options: WebhookServerOptions);
+    registerPreprocessor(preprocessor: WebhookPreprocessor): void;
+    private handleRequest;
+    /**
+     * Processes incoming HTTP webhooks
+     */
+    private handleWebhook;
+    /**
+     * Handles Zero-Downtime Secret Reload
+     */
+    private handleSecretReload;
+    /**
+     * Serves the Server Health & Jobs Dashboard
+     */
+    private renderDashboard;
+    /**
+     * Serves single job HTML report
+     */
+    private renderRunDetails;
+    listen(port: number): Promise<void>;
+}

package/dist/types.d.ts

@@ -0,0 +1,181 @@
+import { QueueManager } from './queue.js';
+import { SecretStore } from './secrets.js';
+export interface StepContext {
+    jobId: string;
+    stepId: string;
+    workspacePath: string;
+    command: string;
+    env?: Record<string, string>;
+    image?: string;
+    timeoutMs?: number;
+}
+export interface StepResult {
+    exitCode: number;
+    durationMs: number;
+    error?: Error;
+}
+export interface StepExecutionHandle {
+    /**
+     * Promise that resolves when step completes or fails
+     */
+    done: Promise<StepResult>;
+    /**
+     * Safely kills the step process tree
+     */
+    cancel(): Promise<void>;
+    /**
+     * Path to where logs are being written on disk
+     */
+    logFilePath: string;
+}
+export interface ExecutionDriver {
+    name: string;
+    /**
+     * Validates if host can run this driver (e.g., systemd is present)
+     */
+    isSupported(): Promise<boolean>;
+    /**
+     * Executes a step context
+     */
+    execute(ctx: StepContext): Promise<StepExecutionHandle>;
+}
+export interface PreprocessedWebhook {
+    isValid: boolean;
+    inputs: Record<string, any>;
+}
+export interface WebhookPreprocessor {
+    name: string;
+    parse(headers: Record<string, string>, rawBodyBuffer: Buffer, secret?: string): PreprocessedWebhook;
+}
+export interface WorkflowStep {
+    id?: string;
+    name?: string;
+    run?: string;
+    eval?: string;
+    dispatch?: string;
+    image?: string;
+    timeoutMs?: number;
+    env?: Record<string, string>;
+}
+export interface WorkflowDefinition {
+    id: string;
+    name: string;
+    on: {
+        provider: string;
+        if?: string;
+    };
+    concurrency?: {
+        group: string;
+        cancelInProgress?: boolean;
+    };
+    steps: WorkflowStep[];
+}
+export interface WebhookServerOptions {
+    queue: QueueManager;
+    secrets: SecretStore;
+    adminToken: string;
+    workflows: WorkflowDefinition[];
+}
+export type JobStatus = 'pending' | 'running' | 'success' | 'failed' | 'cancelling' | 'cancelled';
+export interface JobRecord {
+    id: number;
+    workflow_id: string;
+    concurrency_key: string | null;
+    status: JobStatus;
+    worker_id: string | null;
+    payload: string;
+    created_at: string;
+}
+export type WorkflowInputs = Record<string, any>;
+export interface JobPayload {
+    workflowId: string;
+    steps: WorkflowStep[];
+    inputs: WorkflowInputs;
+}
+export interface MatrixStrategy {
+    matrix?: Record<string, (string | number | boolean)[]>;
+    'max-parallel'?: number;
+}
+export interface ParsedWorkflow {
+    id?: string;
+    name: string;
+    strategy?: MatrixStrategy;
+    env?: Record<string, string>;
+    steps: WorkflowStep[];
+    [key: string]: any;
+}
+export interface IngressContext {
+    provider: string;
+    headers: Record<string, string>;
+    body: any;
+    rawBuffer: Buffer;
+}
+export interface WorkflowContext {
+    jobId: string;
+    workflowName: string;
+    inputs: WorkflowInputs;
+    env: Record<string, string>;
+}
+export interface WorkflowPlugin {
+    name: string;
+    /** Verify HMAC or signatures */
+    onAuthenticate?: (ctx: IngressContext) => Promise<boolean> | boolean;
+    /** Convert raw body/headers into normalized inputs */
+    onTransform?: (ctx: IngressContext) => Promise<Record<string, any>> | Record<string, any>;
+    /** Final gatekeeper check (return false to drop job before enqueueing) */
+    onFilter?: (inputs: Record<string, any>, ctx: IngressContext) => Promise<boolean> | boolean;
+    /** Runs before any steps execute (e.g. notify Slack, update GitHub status to "Pending") */
+    onWorkflowStart?: (wf: WorkflowContext) => Promise<void>;
+    /** Runs right before a step executes (e.g. inject dynamic secrets, prepare workspace) */
+    onStepBefore?: (step: StepContext, wf: WorkflowContext) => Promise<void>;
+    /** Runs after a step finishes (e.g. parse outputs, stream step metrics) */
+    onStepAfter?: (step: StepContext, result: StepResult, wf: WorkflowContext) => Promise<void>;
+    /** Runs when workflow succeeds or fails (e.g. update GitHub status to "Success/Failure", wipe layers) */
+    onWorkflowFinish?: (wf: WorkflowContext, status: 'success' | 'failed', error?: Error) => Promise<void>;
+}
+export interface StepReport {
+    id: string;
+    name: string;
+    status: 'success' | 'failed' | 'skipped' | 'cancelled';
+    durationMs: number;
+    exitCode: number;
+    error?: string;
+    outputs: Record<string, any>;
+    logFilePath: string;
+}
+export interface WorkflowExecutionReport {
+    jobId: string;
+    workflowName: string;
+    status: 'success' | 'failed' | 'cancelled';
+    durationMs: number;
+    startedAt: string;
+    finishedAt: string;
+    inputs: Record<string, any>;
+    environment: Record<string, string>;
+    steps: StepReport[];
+    artifacts: string[];
+    rerunToken: string;
+}
+export interface Reporter {
+    name: string;
+    report(execReport: WorkflowExecutionReport): Promise<void>;
+}
+export interface RunnerConfig {
+    /** Ingress HTTP Gateway Port */
+    port: number;
+    /** Admin Secret for API / webhook operations */
+    adminToken: string;
+    /** SQLite Database connection URL / path */
+    database: string;
+    /** Directory where workflow YAML files live */
+    workflows: string;
+    /** Number of concurrent worker loops to spawn */
+    workers: number;
+    /** Storage path for job workspaces and step logs */
+    storagePath: string;
+    /** Global environment variables injected into all step runs */
+    env: Record<string, string>;
+    /** Registered reporter plugins (JSON, Slack, HTML, etc.) */
+    reporters: Reporter[];
+}
+export type UserRunnerConfig = Partial<RunnerConfig>;

package/dist/worker.d.ts

@@ -0,0 +1,8 @@
+import { QueueManager } from './queue.js';
+import { SecretStore } from './secrets.js';
+import type { RunnerConfig } from './types.js';
+export declare function startWorkers(count: number, queue: QueueManager, secrets: SecretStore, config: RunnerConfig): Promise<void>[];
+/**
+ * Main worker loop: continuously polls the SQLite queue for pending jobs.
+ */
+export declare function startWorkerLoop(workerId: string, queue: QueueManager, secrets: SecretStore, config: RunnerConfig): Promise<void>;

package/package.json

@@ -1,43 +1,47 @@
 {
   "name": "@cloud-cli/on",
-  "version": "1.2.2",
+  "version": "1.2.4",
   "description": "CLI entry point for the on plugin ecosystem.",
   "type": "module",
   "packageManager": "pnpm@10.30.3",
   "license": "MIT",
   "exports": {
-    "./*": "./dist/*"
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/on.js"
+    }
   },
   "files": [
     "dist"
   ],
-  "main": "dist/index.js",
+  "main": "dist/on.js",
   "bin": {
-    "on": "dist/index.js"
+    "on": "dist/on.js"
   },
   "dependencies": {
-    "acorn": "^8.17.0",
+    "acorn": "^8.18.0",
     "ansi_up": "^6.0.6",
     "dotenv": "^17.4.2",
-    "yaml": "^2.8.2"
+    "yaml": "^2.9.0"
   },
   "scripts": {
-    "nx": "nx",
-    "build": "tsc",
+    "ci": "pnpm build && pnpm lint && pnpm test",
+    "build": "vite build && tsc --emitDeclarationOnly --declaration",
     "lint": "eslint .",
-    "test": "echo true || npm wf start",
-    "wf": "pnpm tsx src/index.ts -w tests -p 11235"
+    "test": "echo true",
+    "release": "npx --yes semantic-release@24 -b main --no-ci"
   },
   "devDependencies": {
-    "@changesets/cli": "2.30.0",
-    "@eslint/js": "10.0.1",
-    "@types/node": "^26.0.0",
-    "tsx": "^4.23.1",
-    "typescript": "^7.0.0",
-    "@typescript-eslint/eslint-plugin": "8.57.1",
-    "@typescript-eslint/parser": "8.57.1",
-    "typescript-eslint": "8.57.1",
-    "vite": "^7.3.5",
-    "vitest": "4.1.0"
+    "@changesets/cli": "^2.31.1",
+    "@eslint/js": "^10.0.1",
+    "@types/node": "^26.1.2",
+    "@typescript-eslint/eslint-plugin": "^8.66.0",
+    "@typescript-eslint/parser": "^8.66.0",
+    "eslint": "10.8.0",
+    "tsx": "^4.23.10",
+    "typescript": "^6.0.3",
+    "typescript-eslint": "^8.66.0",
+    "vite": "^8.2.1",
+    "vitest": "^4.1.10"
   }
 }

package/dist/config.js

@@ -1,15 +0,0 @@
-/**
- * Merges user config overrides with baseline defaults
- */
-export function resolveConfig(userConfig = {}) {
-    return {
-        port: userConfig.port ?? 3000,
-        adminToken: userConfig.adminToken ?? process.env.RUNNER_ADMIN_SECRET ?? '',
-        sqliteUrl: userConfig.sqliteUrl ?? process.env.DATABASE_URL ?? 'sqlite.db',
-        workflowsDir: userConfig.workflowsDir ?? '.on/',
-        workersCount: userConfig.workersCount ?? 5,
-        storagePath: userConfig.storagePath ?? process.env.RUNNER_TMP ?? '/tmp/workspaces',
-        env: userConfig.env ?? {},
-        reporters: userConfig.reporters ?? [],
-    };
-}

package/dist/db-client.js

@@ -1,38 +0,0 @@
-const baseURL = process.env.DATABASE_URL;
-let pragmas = [];
-async function query(method, statement, data, pragma = pragmas) {
-    let req;
-    let error;
-    let retries = 1;
-    let max = 3;
-    while (retries < max) {
-        try {
-            req = await fetch(new URL('/query', baseURL), {
-                method: 'POST',
-                body: JSON.stringify({
-                    s: statement,
-                    d: data,
-                    m: method,
-                    p: pragma,
-                }),
-            });
-            if (req.ok) {
-                return await req.json();
-            }
-            await new Promise((r) => setTimeout(r, retries++ * 1000));
-        }
-        catch (e) {
-            error = e;
-        }
-    }
-    throw new Error(error || (await req.text()));
-}
-export const get = query.bind(null, 'get');
-export const run = query.bind(null, 'run');
-export const all = query.bind(null, 'all');
-export function pragma(p) {
-    if (Array.isArray(p) && p.every((s) => typeof s === 'string')) {
-        pragmas = p;
-    }
-}
-export default { query, get, run, all, pragma };

package/dist/drivers/index.js

@@ -1,11 +0,0 @@
-import { SystemdDriver } from './systemd.driver.js';
-import { StandardProcessDriver } from './standard-process.driver.js';
-export async function resolveDriver() {
-    const systemd = new SystemdDriver();
-    if (await systemd.isSupported()) {
-        console.log('⚡ Selected Execution Driver: Systemd (cgroups enabled)');
-        return systemd;
-    }
-    console.log('📦 Selected Execution Driver: Standard Process (Fallback)');
-    return new StandardProcessDriver();
-}