@multiplier-labs/stepflow 0.3.1 → 0.3.3

package/src/events/webhook.ts

@@ -5,15 +5,9 @@
  * Supports multiple webhooks with optional filtering by event type.
  */
 
-import { promises as dns } from "node:dns";
-import type {
-  EventTransport,
-  EventCallback,
-  Unsubscribe,
-  WorkflowEvent,
-  WorkflowEventType,
-} from "./types";
-import type { Logger } from "../core/types";
+import { promises as dns } from 'node:dns';
+import type { EventTransport, EventCallback, Unsubscribe, WorkflowEvent, WorkflowEventType } from './types';
+import type { Logger } from '../core/types';
 
 /**
  * Webhook endpoint configuration.
@@ -85,7 +79,7 @@ export interface WebhookEventTransportConfig {
   maxConcurrentRequests?: number;
 
   /** Logger for webhook transport errors (default: console-based) */
-  logger?: import("../core/types").Logger;
+  logger?: import('../core/types').Logger;
 }
 
 /**
@@ -97,7 +91,7 @@ export interface WebhookPayload {
    * The `Date` is converted to a string before delivery so that JSON consumers
    * receive a portable, timezone-aware representation without needing Date parsing.
    */
-  event: Omit<WorkflowEvent, "timestamp"> & { timestamp: string };
+  event: Omit<WorkflowEvent, 'timestamp'> & { timestamp: string };
   /** ISO 8601 timestamp of when this payload was delivered. */
   deliveredAt: string;
   /** ID of the webhook endpoint that received this delivery. */
@@ -155,15 +149,20 @@ export class WebhookEventTransport implements EventTransport {
     this.allowInsecureUrls = config.allowInsecureUrls ?? false;
     this.maxPayloadBytes = config.maxPayloadBytes ?? 1_048_576; // 1 MB
     this.maxConcurrentRequests = config.maxConcurrentRequests ?? 50;
+    if (this.maxConcurrentRequests <= 0) {
+      throw new Error('maxConcurrentRequests must be greater than 0');
+    }
     this.logger = config.logger ?? {
       debug() {},
       info() {},
       warn() {},
-      error(message: string, ...args: unknown[]) {
-        console.error(message, ...args);
-      },
+      error(message: string, ...args: unknown[]) { console.error(message, ...args); },
     };
 
+    if (this.allowInsecureUrls) {
+      this.logger.warn('WebhookEventTransport: allowInsecureUrls is enabled. Webhook payloads will be sent over HTTP. Do not use this setting in production.');
+    }
+
     // Register initial endpoints (validates URLs)
     if (config.endpoints) {
       for (const endpoint of config.endpoints) {
@@ -217,7 +216,7 @@ export class WebhookEventTransport implements EventTransport {
         try {
           callback(event);
         } catch (error) {
-          this.logger.error("Event callback error:", error);
+          this.logger.error('Event callback error:', error);
         }
       }
     }
@@ -226,7 +225,7 @@ export class WebhookEventTransport implements EventTransport {
       try {
         callback(event);
       } catch (error) {
-        this.logger.error("Event callback error:", error);
+        this.logger.error('Event callback error:', error);
       }
     }
 
@@ -238,7 +237,7 @@ export class WebhookEventTransport implements EventTransport {
       this.enqueueRequest(() =>
         this.sendWebhook(endpoint, event).catch((error) => {
           this.logger.error(`Webhook ${endpoint.id} failed:`, error);
-        }),
+        })
       );
     }
   }
@@ -284,10 +283,7 @@ export class WebhookEventTransport implements EventTransport {
   /**
    * Check if an event matches an endpoint's filters.
    */
-  private matchesFilter(
-    event: WorkflowEvent,
-    endpoint: WebhookEndpoint,
-  ): boolean {
+  private matchesFilter(event: WorkflowEvent, endpoint: WebhookEndpoint): boolean {
     // Check event type filter
     if (endpoint.eventTypes && endpoint.eventTypes.length > 0) {
       if (!endpoint.eventTypes.includes(event.eventType)) {
@@ -308,10 +304,7 @@ export class WebhookEventTransport implements EventTransport {
   /**
    * Send a webhook with retry support.
    */
-  private async sendWebhook(
-    endpoint: WebhookEndpoint,
-    event: WorkflowEvent,
-  ): Promise<void> {
+  private async sendWebhook(endpoint: WebhookEndpoint, event: WorkflowEvent): Promise<void> {
     const timeout = endpoint.timeout ?? this.defaultTimeout;
     const maxRetries = endpoint.retries ?? this.defaultRetries;
 
@@ -329,19 +322,19 @@ export class WebhookEventTransport implements EventTransport {
     // Enforce payload size limit to prevent excessive memory use and network abuse
     if (body.length > this.maxPayloadBytes) {
       throw new Error(
-        `Webhook payload exceeds maximum size (${body.length} bytes > ${this.maxPayloadBytes} bytes)`,
+        `Webhook payload exceeds maximum size (${body.length} bytes > ${this.maxPayloadBytes} bytes)`
       );
     }
 
     const headers: Record<string, string> = {
-      "Content-Type": "application/json",
+      'Content-Type': 'application/json',
       ...endpoint.headers,
     };
 
     // Sign payload if secret is provided
     if (endpoint.secret) {
       const signature = await this.signPayload(body, endpoint.secret);
-      headers["X-Webhook-Signature"] = signature;
+      headers['X-Webhook-Signature'] = signature;
     }
 
     // Resolve hostname and validate the resolved IP is not private/reserved (SSRF protection).
@@ -357,7 +350,7 @@ export class WebhookEventTransport implements EventTransport {
         const timeoutId = setTimeout(() => controller.abort(), timeout);
 
         const response = await this.fetchFn(endpoint.url, {
-          method: "POST",
+          method: 'POST',
           headers,
           body,
           signal: controller.signal,
@@ -369,9 +362,7 @@ export class WebhookEventTransport implements EventTransport {
           return; // Success
         }
 
-        lastError = new Error(
-          `Webhook returned ${response.status}: ${response.statusText}`,
-        );
+        lastError = new Error(`Webhook returned ${response.status}: ${response.statusText}`);
       } catch (error) {
         lastError = error instanceof Error ? error : new Error(String(error));
       }
@@ -395,18 +386,16 @@ export class WebhookEventTransport implements EventTransport {
     const data = encoder.encode(payload);
 
     const key = await crypto.subtle.importKey(
-      "raw",
+      'raw',
       keyData,
-      { name: "HMAC", hash: "SHA-256" },
+      { name: 'HMAC', hash: 'SHA-256' },
       false,
-      ["sign"],
+      ['sign']
     );
 
-    const signature = await crypto.subtle.sign("HMAC", key, data);
+    const signature = await crypto.subtle.sign('HMAC', key, data);
     const hashArray = Array.from(new Uint8Array(signature));
-    const hashHex = hashArray
-      .map((b) => b.toString(16).padStart(2, "0"))
-      .join("");
+    const hashHex = hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
 
     return `sha256=${hashHex}`;
   }
@@ -415,7 +404,7 @@ export class WebhookEventTransport implements EventTransport {
    * Sleep helper.
    */
   private sleep(ms: number): Promise<void> {
-    return new Promise((resolve) => setTimeout(resolve, ms));
+    return new Promise(resolve => setTimeout(resolve, ms));
   }
 
   /**
@@ -435,19 +424,14 @@ export class WebhookEventTransport implements EventTransport {
       const { address } = await dns.lookup(hostname);
       if (isBlockedIp(address)) {
         throw new Error(
-          `Webhook URL hostname "${hostname}" resolves to blocked IP ${address}`,
+          `Webhook URL hostname "${hostname}" resolves to blocked IP ${address}`
         );
       }
     } catch (error) {
-      if (
-        error instanceof Error &&
-        error.message.includes("resolves to blocked IP")
-      ) {
+      if (error instanceof Error && error.message.includes('resolves to blocked IP')) {
         throw error;
       }
-      throw new Error(
-        `Failed to resolve webhook URL hostname "${hostname}": ${error}`,
-      );
+      throw new Error(`Failed to resolve webhook URL hostname "${hostname}": ${error}`);
     }
   }
 
@@ -465,24 +449,20 @@ export class WebhookEventTransport implements EventTransport {
     }
 
     // Scheme check
-    if (!this.allowInsecureUrls && parsed.protocol !== "https:") {
+    if (!this.allowInsecureUrls && parsed.protocol !== 'https:') {
       throw new Error(
-        `Webhook URL must use HTTPS (got ${parsed.protocol}). Set allowInsecureUrls for development.`,
+        `Webhook URL must use HTTPS (got ${parsed.protocol}). Set allowInsecureUrls for development.`
       );
     }
 
-    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
-      throw new Error(
-        `Webhook URL must use HTTP(S) scheme (got ${parsed.protocol})`,
-      );
+    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+      throw new Error(`Webhook URL must use HTTP(S) scheme (got ${parsed.protocol})`);
     }
 
     // Block dangerous hostnames
     const hostname = parsed.hostname.toLowerCase();
     if (isBlockedHost(hostname)) {
-      throw new Error(
-        `Webhook URL hostname is blocked (private/reserved): ${hostname}`,
-      );
+      throw new Error(`Webhook URL hostname is blocked (private/reserved): ${hostname}`);
     }
   }
 
@@ -513,29 +493,22 @@ export class WebhookEventTransport implements EventTransport {
  */
 function isBlockedHost(hostname: string): boolean {
   // Loopback (Node's URL parser wraps IPv6 in brackets, e.g. "[::1]")
-  if (
-    hostname === "localhost" ||
-    hostname === "127.0.0.1" ||
-    hostname === "::1" ||
-    hostname === "[::1]"
-  ) {
+  if (hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1' || hostname === '[::1]') {
     return true;
   }
 
   // Block all IPv6 address literals (wrapped in brackets by URL parser)
-  if (hostname.startsWith("[")) {
+  if (hostname.startsWith('[')) {
     return true;
   }
 
   // Cloud metadata endpoint
-  if (hostname === "169.254.169.254") {
+  if (hostname === '169.254.169.254') {
     return true;
   }
 
   // Check for IP addresses in private/reserved ranges
-  const ipv4Match = hostname.match(
-    /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/,
-  );
+  const ipv4Match = hostname.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
   if (ipv4Match) {
     const [, a, b] = ipv4Match.map(Number);
     // 10.0.0.0/8
@@ -553,7 +526,7 @@ function isBlockedHost(hostname: string): boolean {
   }
 
   // IPv6 link-local (fe80::)
-  if (hostname.startsWith("fe80:") || hostname.startsWith("[fe80:")) {
+  if (hostname.startsWith('fe80:') || hostname.startsWith('[fe80:')) {
     return true;
   }
 
@@ -583,9 +556,9 @@ function isBlockedIp(ip: string): boolean {
   }
 
   // IPv6 loopback
-  if (ip === "::1") return true;
+  if (ip === '::1') return true;
   // IPv6 link-local
-  if (ip.startsWith("fe80:")) return true;
+  if (ip.startsWith('fe80:')) return true;
 
   return false;
 }

package/src/index.ts

@@ -73,14 +73,14 @@ export {
   type WorkflowStep,
   type WorkflowHooks,
   type WorkflowDefinition,
-} from "./core/types";
+} from './core/types';
 
 export {
   // Main Engine
   WorkflowEngine,
   type WorkflowEngineConfig,
   type StartRunOptions,
-} from "./core/engine";
+} from './core/engine';
 
 // ============================================================================
 // Storage
@@ -108,25 +108,25 @@ export {
   type StepflowRunsTable,
   type StepflowStepResultsTable,
   type StepflowDatabase,
-} from "./storage/types";
+} from './storage/types';
 
 export {
   // In-Memory Storage
   MemoryStorageAdapter,
-} from "./storage/memory";
+} from './storage/memory';
 
 export {
   // SQLite Storage
   SQLiteStorageAdapter,
   type SQLiteStorageConfig,
-} from "./storage/sqlite";
+} from './storage/sqlite';
 
 export {
   // PostgreSQL Storage
   PostgresStorageAdapter,
   PostgresStorageAdapter as PostgresStorage,
   type PostgresStorageConfig,
-} from "./storage/postgres";
+} from './storage/postgres';
 
 // ============================================================================
 // Events
@@ -140,12 +140,12 @@ export {
   type BuiltInEventType,
   type EventCallback,
   type Unsubscribe,
-} from "./events/types";
+} from './events/types';
 
 export {
   // In-Memory Event Transport
   MemoryEventTransport,
-} from "./events/memory";
+} from './events/memory';
 
 export {
   // Socket.IO Event Transport
@@ -154,7 +154,7 @@ export {
   type SocketIOServer,
   type SocketIOSocket,
   type SocketIOAuthorizeFn,
-} from "./events/socketio";
+} from './events/socketio';
 
 export {
   // Webhook Event Transport
@@ -162,7 +162,7 @@ export {
   type WebhookEventTransportConfig,
   type WebhookEndpoint,
   type WebhookPayload,
-} from "./events/webhook";
+} from './events/webhook';
 
 // ============================================================================
 // Scheduler
@@ -172,23 +172,23 @@ export {
   type TriggerType,
   type WorkflowSchedule,
   type Scheduler,
-} from "./scheduler/types";
+} from './scheduler/types';
 
 export {
   CronScheduler,
   type CronSchedulerConfig,
   type SchedulePersistence,
-} from "./scheduler/cron";
+} from './scheduler/cron';
 
 export {
   SQLiteSchedulePersistence,
   type SQLiteSchedulePersistenceConfig,
-} from "./scheduler/sqlite-persistence";
+} from './scheduler/sqlite-persistence';
 
 export {
   PostgresSchedulePersistence,
   type PostgresSchedulePersistenceConfig,
-} from "./scheduler/postgres-persistence";
+} from './scheduler/postgres-persistence';
 
 // ============================================================================
 // Utilities
@@ -197,7 +197,7 @@ export {
 export {
   // ID Generation
   generateId,
-} from "./utils/id";
+} from './utils/id';
 
 export {
   // Errors
@@ -210,7 +210,7 @@ export {
   WaitForRunTimeoutError,
   WorkflowCanceledError,
   WorkflowTimeoutError,
-} from "./utils/errors";
+} from './utils/errors';
 
 export {
   // Logger
@@ -219,7 +219,7 @@ export {
   createScopedLogger,
   sanitizeErrorForStorage,
   type LogLevel,
-} from "./utils/logger";
+} from './utils/logger';
 
 export {
   // Retry
@@ -228,7 +228,7 @@ export {
   sleep,
   withRetry,
   calculateRetryDelay,
-} from "./utils/retry";
+} from './utils/retry';
 
 // ============================================================================
 // Planning
@@ -267,4 +267,4 @@ export {
   type CombinedRegistry,
   RuleBasedPlanner,
   type RuleBasedPlannerConfig,
-} from "./planning";
+} from './planning';

package/src/planning/index.ts

@@ -39,7 +39,7 @@ export type {
   StepHandlerRegistry,
   RecipeQueryOptions,
   RecipeRegistry,
-} from "./types";
+} from './types';
 
 // Implementations
 export {
@@ -47,6 +47,9 @@ export {
   MemoryRecipeRegistry,
   createRegistry,
   type CombinedRegistry,
-} from "./registry";
+} from './registry';
 
-export { RuleBasedPlanner, type RuleBasedPlannerConfig } from "./planner";
+export {
+  RuleBasedPlanner,
+  type RuleBasedPlannerConfig,
+} from './planner';