@wenathlan/saddle 1.8.1

package/webhook/receiver.js

@@ -0,0 +1,20 @@
+/**
+ * webhook receiver validates signatures before dispatch and drops duplicate delivery ids.
+ */
+import { webhookverify } from "./signature.js";
+
+export function webhookreceiver(options = {}) {
+  if (typeof options.secret !== "string" || typeof options.handle !== "function") throw new TypeError("webhook receiver requires secret and handler");
+  const deliveries = new Set();
+  return {
+    async receive(input = {}) {
+      if (!webhookverify(input.body, input.signature, options.secret)) return { accepted: false, status: 401, reason: "invalid signature" };
+      const id = input.deliveryid ?? input.eventid;
+      if (id && deliveries.has(id)) return { accepted: false, status: 200, duplicate: true };
+      if (id) deliveries.add(id);
+      const result = await options.handle(input.event, input.body);
+      return { accepted: true, status: 202, deliveryid: id, result };
+    },
+    deliveries() { return [...deliveries]; }
+  };
+}

package/webhook/signature.js

@@ -0,0 +1,7 @@
+/**
+ * webhook signatures use hmac sha256 and keep secrets outside serialized events.
+ */
+import { constanttimeequal, hmacsha256 } from "../core/hash.js";
+
+export function webhooksig(payload, secret) { return hmacsha256(typeof payload === "string" ? payload : JSON.stringify(payload), secret); }
+export function webhookverify(payload, signature, secret) { return constanttimeequal(webhooksig(payload, secret), signature); }

package/workflow/manifest.js

@@ -0,0 +1,20 @@
+/**
+ * workflow manifests describe the same job surface for different forge runtimes.
+ */
+export const forgeprofiles = Object.freeze(["github", "forgejo", "gitea", "woodpecker", "gitlab"]);
+
+export function workflowmanifest(options = {}) {
+  if (!options.name || !options.command) throw new TypeError("workflow manifest requires name and command");
+  return {
+    name: options.name,
+    command: options.command,
+    trigger: options.trigger ?? ["manual", "dispatch"],
+    platforms: options.platforms ?? forgeprofiles,
+    environment: options.environment ?? {},
+    artifacts: options.artifacts ?? ["results/**"],
+    timeoutminutes: options.timeoutminutes ?? 30,
+    publicrunner: options.publicrunner ?? true
+  };
+}
+
+export function workflowinputs(manifest) { return { name: manifest.name, command: manifest.command, timeoutminutes: manifest.timeoutminutes, artifacts: manifest.artifacts.join(",") }; }

package/workflow/registry.js

@@ -0,0 +1,16 @@
+/**
+ * workflow registry stores generated manifests and templates for later dispatch.
+ */
+import { forgeprofiles } from "./manifest.js";
+import { forgejoworkflow, giteaworkflow, githubworkflow, gitlabworkflow, woodpeckerworkflow } from "./templates.js";
+
+export function workflowregistry() {
+  const manifests = new Map();
+  const renderers = { github: githubworkflow, forgejo: forgejoworkflow, gitea: giteaworkflow, woodpecker: woodpeckerworkflow, gitlab: gitlabworkflow };
+  return {
+    register(manifest) { manifests.set(manifest.name, manifest); return manifest; },
+    get(name) { return manifests.get(name) ?? null; },
+    render(name, forge) { if (!renderers[forge] || !forgeprofiles.includes(forge)) throw new TypeError(`unsupported forge: ${forge}`); const manifest = manifests.get(name); if (!manifest) throw new Error(`workflow not found: ${name}`); return renderers[forge](manifest); },
+    list() { return [...manifests.values()]; }
+  };
+}

package/workflow/templates.js

@@ -0,0 +1,18 @@
+/**
+ * workflow templates use explicit environment names and keep provider secrets external.
+ */
+import { workflowinputs } from "./manifest.js";
+
+export function githubworkflow(manifest) {
+  const input = workflowinputs(manifest);
+  return `name: ${manifest.name}\non:\n  workflow_dispatch:\n    inputs:\n      jobid:\n        required: true\n        type: string\n      command:\n        required: true\n        type: string\n        default: ${manifest.command}\n  repository_dispatch:\n    types: [saddle-job]\npermissions:\n  contents: read\njobs:\n  process:\n    runs-on: ubuntu-latest\n    timeout-minutes: ${input.timeoutminutes}\n    steps:\n      - uses: actions/checkout@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 22\n      - run: npm ci\n      - run: \${{ github.event.inputs.command || '${manifest.command}' }}\n        env:\n          SBOT_JOB_ID: \${{ github.event.inputs.jobid || github.event.client_payload.jobid }}\n      - uses: actions/upload-artifact@v4\n        with:\n          name: saddle-results\n          path: ${manifest.artifacts.join("\n            ")}\n          if-no-files-found: ignore\n`;
+}
+
+export function forgejoworkflow(manifest) { return genericworkflow(manifest, "forgejo"); }
+export function giteaworkflow(manifest) { return genericworkflow(manifest, "gitea"); }
+export function woodpeckerworkflow(manifest) { return `when:\n  - event: push\n  - event: manual\nsteps:\n  process:\n    image: node:22\n    commands:\n      - npm ci\n      - ${manifest.command}\n`;
+}
+export function gitlabworkflow(manifest) { return `stages:\n  - process\nprocess:\n  stage: process\n  image: node:22\n  script:\n    - npm ci\n    - ${manifest.command}\n  artifacts:\n    when: always\n    paths:\n${manifest.artifacts.map((item) => `      - ${item}`).join("\n")}\n`; }
+
+function genericworkflow(manifest, name) { return `name: ${manifest.name}\non:\n  workflow_dispatch:\njobs:\n  process:\n    runs-on: ubuntu-latest\n    timeout-minutes: ${manifest.timeoutminutes}\n    steps:\n      - uses: actions/checkout@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 22\n      - run: npm ci\n      - run: ${manifest.command}\n`;
+}

package/workflow/triggers.js

@@ -0,0 +1,31 @@
+/**
+ * workflow triggers normalize manual, event, schedule and retry starts without binding a forge.
+ */
+
+export const triggernames = Object.freeze(["manual", "dispatch", "webhook", "schedule", "retry", "heartbeat"]);
+
+/** Validates and normalizes a trigger declaration. */
+export function workflowtriggers(value = ["manual"]) {
+  const list = Array.isArray(value) ? value : [value];
+  if (list.length === 0 || list.some((name) => !triggernames.includes(name))) throw new TypeError("workflow trigger is unsupported");
+  return [...new Set(list)];
+}
+
+/** Matches a workflow trigger against an incoming event without executing it. */
+export function triggermatch(manifest, event = {}) {
+  const triggers = workflowtriggers(manifest?.trigger);
+  const type = String(event.type ?? "manual");
+  if (!triggers.includes(type)) return { matched: false, type, reason: "trigger-not-declared" };
+  if (type === "schedule" && event.at !== undefined && Number(event.at) > Date.now()) return { matched: false, type, reason: "not-due" };
+  return { matched: true, type, requestid: event.requestid ?? `${manifest.name}/${type}/${event.id ?? Date.now()}` };
+}
+
+/** Keeps trigger declarations and produces deterministic matching results. */
+export function triggerregistry() {
+  const values = new Map();
+  function register(manifest) { if (!manifest?.name) throw new TypeError("trigger manifest requires name"); const normalized = { ...manifest, trigger: workflowtriggers(manifest.trigger) }; values.set(normalized.name, normalized); return normalized; }
+  function get(name) { return values.get(name); }
+  function match(name, event) { const manifest = get(name); if (!manifest) throw new Error(`workflow not found: ${name}`); return triggermatch(manifest, event); }
+  function list() { return [...values.values()].map((manifest) => ({ ...manifest, trigger: [...manifest.trigger] })); }
+  return { register, get, match, list };
+}