deepline 0.3.90 → 0.3.91

package/dist/bundling-sources/shared_libs/plays/standard-webhooks.ts

@@ -0,0 +1,117 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import type { PlayStandardWebhookHeaderFamily } from './/authoring-contract';
+
+export const DEFAULT_STANDARD_WEBHOOK_TOLERANCE_SECONDS = 300;
+
+export type StandardWebhookVerificationFailure =
+  | 'missing_headers'
+  | 'invalid_event_id'
+  | 'invalid_timestamp'
+  | 'timestamp_out_of_tolerance'
+  | 'invalid_signature'
+  | 'invalid_secret';
+
+export type StandardWebhookVerification =
+  | { ok: true; eventId: string; timestamp: number }
+  | { ok: false; reason: StandardWebhookVerificationFailure };
+
+function headerNames(headerFamily: PlayStandardWebhookHeaderFamily) {
+  return headerFamily === 'svix'
+    ? {
+        id: 'svix-id',
+        timestamp: 'svix-timestamp',
+        signature: 'svix-signature',
+      }
+    : {
+        id: 'webhook-id',
+        timestamp: 'webhook-timestamp',
+        signature: 'webhook-signature',
+      };
+}
+
+function normalizedHeaders(headers: Record<string, string>) {
+  return Object.fromEntries(
+    Object.entries(headers).map(([name, value]) => [name.toLowerCase(), value]),
+  );
+}
+
+/** Standard Webhooks symmetric secrets are base64; providers commonly prefix them with `whsec_`. */
+function decodeSigningSecret(value: string): Buffer | null {
+  const serialized = value.trim();
+  const encoded = serialized.startsWith('whsec_')
+    ? serialized.slice('whsec_'.length)
+    : serialized;
+  if (!encoded || !/^[A-Za-z0-9+/]+={0,2}$/.test(encoded)) return null;
+  const unpadded = encoded.replace(/=+$/, '');
+  if (unpadded.length % 4 === 1) return null;
+  const decoded = Buffer.from(encoded, 'base64');
+  return decoded.length > 0 &&
+    decoded.toString('base64').replace(/=+$/, '') === unpadded
+    ? decoded
+    : null;
+}
+
+function signatureMatches(expected: Buffer, supplied: string): boolean {
+  const candidates = supplied.trim().split(/\s+/);
+  for (const candidate of candidates) {
+    const [version, encoded, ...extra] = candidate.split(',');
+    if (version !== 'v1' || !encoded || extra.length > 0) continue;
+    if (!/^[A-Za-z0-9+/]+={0,2}$/.test(encoded)) continue;
+    const actual = Buffer.from(encoded, 'base64');
+    if (actual.length !== expected.length) continue;
+    if (timingSafeEqual(expected, actual)) return true;
+  }
+  return false;
+}
+
+/**
+ * Verifies the Standard Webhooks v1 symmetric scheme against the unmodified
+ * request body. Call this before admitting any Play Run.
+ */
+export function verifyStandardWebhook(input: {
+  headers: Record<string, string>;
+  rawBody: string;
+  signingSecrets: readonly string[];
+  headerFamily: PlayStandardWebhookHeaderFamily;
+  toleranceSeconds?: number;
+  now?: Date;
+}): StandardWebhookVerification {
+  const names = headerNames(input.headerFamily);
+  const headers = normalizedHeaders(input.headers);
+  const eventId = headers[names.id]?.trim();
+  const timestampHeader = headers[names.timestamp]?.trim();
+  const signature = headers[names.signature];
+  if (!eventId || !timestampHeader || !signature) {
+    return { ok: false, reason: 'missing_headers' };
+  }
+  // A full stop is the signed-content delimiter, so the ID must be unambiguous.
+  if (eventId.includes('.')) return { ok: false, reason: 'invalid_event_id' };
+  if (!/^\d+$/.test(timestampHeader)) {
+    return { ok: false, reason: 'invalid_timestamp' };
+  }
+  const timestamp = Number(timestampHeader);
+  if (!Number.isSafeInteger(timestamp)) {
+    return { ok: false, reason: 'invalid_timestamp' };
+  }
+  const toleranceSeconds =
+    input.toleranceSeconds ?? DEFAULT_STANDARD_WEBHOOK_TOLERANCE_SECONDS;
+  const nowSeconds = Math.floor((input.now?.getTime() ?? Date.now()) / 1000);
+  if (Math.abs(nowSeconds - timestamp) > toleranceSeconds) {
+    return { ok: false, reason: 'timestamp_out_of_tolerance' };
+  }
+
+  const signedContent = `${eventId}.${timestampHeader}.${input.rawBody}`;
+  let usableSecret = false;
+  for (const secret of input.signingSecrets) {
+    const key = decodeSigningSecret(secret);
+    if (!key) continue;
+    usableSecret = true;
+    const expected = createHmac('sha256', key).update(signedContent).digest();
+    if (signatureMatches(expected, signature)) {
+      return { ok: true, eventId, timestamp };
+    }
+  }
+  return usableSecret
+    ? { ok: false, reason: 'invalid_signature' }
+    : { ok: false, reason: 'invalid_secret' };
+}

package/dist/bundling-sources/shared_libs/plays/status-result.ts

@@ -0,0 +1,388 @@
+import {
+  isSerializedPlayDataset,
+  trimSerializedPlayDatasetPreview,
+} from './/dataset';
+
+const PLAY_STATUS_PREVIEW_LIMIT = 10;
+
+export type PlayRunProgressExecution = {
+  scope: 'batch';
+  total: number;
+  executed: number;
+  reused: number;
+  skipped: number;
+  pending: number;
+  failed: number;
+  retried?: number;
+  degraded?: boolean;
+  duplicates?: {
+    exact?: number;
+    semantic?: number;
+    rejected?: number;
+  };
+};
+
+export type PlayRunProgressExecutionLocation = PlayRunProgressExecution & {
+  path: string;
+  tableNamespace?: string;
+  datasetKind?: string;
+};
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value && typeof value === 'object' && !Array.isArray(value));
+}
+
+function finiteNumber(value: unknown): number | null {
+  return typeof value === 'number' && Number.isFinite(value) ? value : null;
+}
+
+function isDatasetEnvelope(value: Record<string, unknown>): boolean {
+  return (
+    value.kind === 'dataset' &&
+    typeof value.datasetKind === 'string' &&
+    typeof value.count === 'number' &&
+    Array.isArray(value.preview)
+  );
+}
+
+function normalizeProgressExecution(
+  value: unknown,
+): PlayRunProgressExecution | null {
+  if (!isRecord(value)) {
+    return null;
+  }
+  const total = finiteNumber(value.total);
+  const executed = finiteNumber(value.executed);
+  const reused = finiteNumber(value.reused);
+  const skipped = finiteNumber(value.skipped);
+  const pending = finiteNumber(value.pending);
+  const failed = finiteNumber(value.failed);
+  if (
+    total === null ||
+    executed === null ||
+    reused === null ||
+    skipped === null ||
+    pending === null ||
+    failed === null
+  ) {
+    return null;
+  }
+
+  const duplicates = isRecord(value.duplicates)
+    ? {
+        ...(finiteNumber(value.duplicates.exact) !== null
+          ? { exact: finiteNumber(value.duplicates.exact) as number }
+          : {}),
+        ...(finiteNumber(value.duplicates.semantic) !== null
+          ? { semantic: finiteNumber(value.duplicates.semantic) as number }
+          : {}),
+        ...(finiteNumber(value.duplicates.rejected) !== null
+          ? { rejected: finiteNumber(value.duplicates.rejected) as number }
+          : {}),
+      }
+    : null;
+
+  return {
+    scope: 'batch',
+    total,
+    executed,
+    reused,
+    skipped,
+    pending,
+    failed,
+    ...(finiteNumber(value.retried) !== null
+      ? { retried: finiteNumber(value.retried) as number }
+      : {}),
+    ...(typeof value.degraded === 'boolean'
+      ? { degraded: value.degraded }
+      : {}),
+    ...(duplicates && Object.keys(duplicates).length > 0 ? { duplicates } : {}),
+  };
+}
+
+function normalizeMapStepProgressExecution(
+  value: unknown,
+): PlayRunProgressExecution | null {
+  if (!isRecord(value)) {
+    return null;
+  }
+  const total = finiteNumber(value.total);
+  const executed = finiteNumber(value.executed);
+  const reused = finiteNumber(value.reused);
+  const failed = finiteNumber(value.failed);
+  if (
+    total === null ||
+    executed === null ||
+    reused === null ||
+    failed === null
+  ) {
+    return null;
+  }
+  const skipped = finiteNumber(value.skipped) ?? 0;
+  const pending =
+    finiteNumber(value.pending) ??
+    Math.max(0, total - executed - reused - skipped - failed);
+  const duplicates = isRecord(value.duplicates)
+    ? {
+        ...(finiteNumber(value.duplicates.exact) !== null
+          ? { exact: finiteNumber(value.duplicates.exact) as number }
+          : {}),
+        ...(finiteNumber(value.duplicates.semantic) !== null
+          ? { semantic: finiteNumber(value.duplicates.semantic) as number }
+          : {}),
+        ...(finiteNumber(value.duplicates.rejected) !== null
+          ? { rejected: finiteNumber(value.duplicates.rejected) as number }
+          : {}),
+      }
+    : null;
+
+  return {
+    scope: 'batch',
+    total,
+    executed,
+    reused,
+    skipped,
+    pending,
+    failed,
+    ...(finiteNumber(value.retried) !== null
+      ? { retried: finiteNumber(value.retried) as number }
+      : {}),
+    ...(typeof value.degraded === 'boolean'
+      ? { degraded: value.degraded }
+      : {}),
+    ...(duplicates && Object.keys(duplicates).length > 0 ? { duplicates } : {}),
+  };
+}
+
+export function extractRunPackageProgressExecution(
+  value: unknown,
+): PlayRunProgressExecution | null {
+  const record = isRecord(value) ? value : null;
+  const steps = Array.isArray(record?.steps) ? record.steps : [];
+  for (const step of steps) {
+    if (!isRecord(step) || step.kind !== 'dataset') {
+      continue;
+    }
+    const progress = normalizeMapStepProgressExecution(step.progress);
+    if (progress) {
+      return progress;
+    }
+  }
+  return null;
+}
+
+export function extractRunProgressExecution(
+  value: unknown,
+): PlayRunProgressExecution | null {
+  const walk = (
+    candidate: unknown,
+    depth: number,
+  ): PlayRunProgressExecution | null => {
+    if (depth > 8 || candidate == null) {
+      return null;
+    }
+    if (Array.isArray(candidate)) {
+      for (const item of candidate) {
+        const found = walk(item, depth + 1);
+        if (found) return found;
+      }
+      return null;
+    }
+    if (!isRecord(candidate)) {
+      return null;
+    }
+    const metadata = isRecord(candidate._metadata) ? candidate._metadata : null;
+    const fromDataset = isDatasetEnvelope(candidate)
+      ? normalizeProgressExecution(metadata?.workProgress)
+      : null;
+    if (fromDataset) {
+      return fromDataset;
+    }
+    const fromMetadata = normalizeProgressExecution(metadata?.workProgress);
+    if (fromMetadata) {
+      return fromMetadata;
+    }
+    for (const [key, child] of Object.entries(candidate)) {
+      if (key === 'preview') continue;
+      const found = walk(child, depth + 1);
+      if (found) return found;
+    }
+    return null;
+  };
+  return walk(value, 0);
+}
+
+export function collectRunProgressExecutions(
+  value: unknown,
+): PlayRunProgressExecutionLocation[] {
+  const found: PlayRunProgressExecutionLocation[] = [];
+  const seen = new Set<string>();
+  const push = (
+    execution: PlayRunProgressExecution | null,
+    candidate: Record<string, unknown>,
+    path: string,
+  ) => {
+    if (!execution) {
+      return;
+    }
+    const tableNamespace =
+      typeof candidate.tableNamespace === 'string' &&
+      candidate.tableNamespace.trim()
+        ? candidate.tableNamespace.trim()
+        : undefined;
+    const datasetKind =
+      typeof candidate.datasetKind === 'string' && candidate.datasetKind.trim()
+        ? candidate.datasetKind.trim()
+        : undefined;
+    const key = [path, tableNamespace ?? '', datasetKind ?? ''].join('\u0000');
+    if (seen.has(key)) {
+      return;
+    }
+    seen.add(key);
+    found.push({
+      ...execution,
+      path,
+      ...(tableNamespace ? { tableNamespace } : {}),
+      ...(datasetKind ? { datasetKind } : {}),
+    });
+  };
+
+  const walk = (candidate: unknown, path: string, depth: number) => {
+    if (depth > 8 || candidate == null) {
+      return;
+    }
+    if (Array.isArray(candidate)) {
+      candidate.forEach((item, index) =>
+        walk(item, `${path}[${index}]`, depth + 1),
+      );
+      return;
+    }
+    if (!isRecord(candidate)) {
+      return;
+    }
+
+    const metadata = isRecord(candidate._metadata) ? candidate._metadata : null;
+    push(normalizeProgressExecution(metadata?.workProgress), candidate, path);
+
+    for (const [key, child] of Object.entries(candidate)) {
+      if (key === 'preview') continue;
+      walk(child, path ? `${path}.${key}` : key, depth + 1);
+    }
+  };
+
+  walk(value, 'result', 0);
+  return found;
+}
+
+export function stripRunProgressExecution(value: unknown): unknown {
+  if (Array.isArray(value)) {
+    return value.map(stripRunProgressExecution);
+  }
+  if (!isRecord(value)) {
+    return value;
+  }
+  const out: Record<string, unknown> = {};
+  const datasetEnvelope = isDatasetEnvelope(value);
+  for (const [key, child] of Object.entries(value)) {
+    if (key === '_metadata' && isRecord(child)) {
+      const metadata: Record<string, unknown> = {};
+      for (const [metadataKey, metadataValue] of Object.entries(child)) {
+        if (metadataKey === 'workProgress') {
+          continue;
+        }
+        metadata[metadataKey] = stripRunProgressExecution(metadataValue);
+      }
+      if (Object.keys(metadata).length > 0) {
+        out[key] = metadata;
+      }
+      continue;
+    }
+    out[key] = stripRunProgressExecution(child);
+  }
+  return out;
+}
+
+export function mergeRunProgressExecution(
+  progress: Record<string, unknown>,
+  execution: PlayRunProgressExecution | null,
+): Record<string, unknown> {
+  if (!execution) {
+    return progress;
+  }
+  return {
+    ...progress,
+    total: execution.total,
+    executed: execution.executed,
+    reused: execution.reused,
+    skipped: execution.skipped,
+    pending: execution.pending,
+    failed: execution.failed,
+    ...(execution.retried !== undefined ? { retried: execution.retried } : {}),
+    ...(execution.degraded !== undefined
+      ? { degraded: execution.degraded }
+      : {}),
+    ...(execution.duplicates ? { duplicates: execution.duplicates } : {}),
+  };
+}
+
+export function normalizePlayResult(
+  value: unknown,
+): Record<string, unknown> | null {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    return null;
+  }
+
+  const result = { ...(value as Record<string, unknown>) };
+  if (
+    result.contract &&
+    typeof result.contract === 'object' &&
+    !Array.isArray(result.contract)
+  ) {
+    const contract = {
+      ...(result.contract as Record<string, unknown>),
+    };
+    delete contract.sourceCode;
+    result.contract = contract;
+  }
+  if (isSerializedPlayDataset(result.rows)) {
+    result.rows = trimSerializedPlayDatasetPreview(
+      result.rows,
+      PLAY_STATUS_PREVIEW_LIMIT,
+    );
+  }
+  if (isSerializedPlayDataset(result.results)) {
+    result.results = trimSerializedPlayDatasetPreview(
+      result.results,
+      PLAY_STATUS_PREVIEW_LIMIT,
+    );
+  }
+  if (isSerializedPlayDataset(result.leads)) {
+    result.leads = trimSerializedPlayDatasetPreview(
+      result.leads,
+      PLAY_STATUS_PREVIEW_LIMIT,
+    );
+  }
+  if (
+    result.output &&
+    typeof result.output === 'object' &&
+    !Array.isArray(result.output)
+  ) {
+    const output = {
+      ...(result.output as Record<string, unknown>),
+    };
+    if (isSerializedPlayDataset(output.rows)) {
+      output.rows = trimSerializedPlayDatasetPreview(
+        output.rows,
+        PLAY_STATUS_PREVIEW_LIMIT,
+      );
+    }
+    if (isSerializedPlayDataset(output.results)) {
+      output.results = trimSerializedPlayDatasetPreview(
+        output.results,
+        PLAY_STATUS_PREVIEW_LIMIT,
+      );
+    }
+    result.output = output;
+  }
+  return result;
+}