reqon-dsl 0.3.0 → 0.4.0

package/README.md

@@ -73,9 +73,9 @@ reqon sync-invoices.vague --dry-run
 ### Programmatic
 
 ```typescript
-import { parse, execute } from 'reqon';
+import { execute } from 'reqon';
 
-const program = parse(`
+const source = `
   mission Test {
     source API { auth: bearer, base: "https://api.example.com" }
     store items: memory("items")
@@ -85,7 +85,7 @@ const program = parse(`
     }
     run Fetch
   }
-`);
+`;
 
 const result = await execute(source, {
   auth: { API: { type: 'bearer', token: 'your-token' } }
@@ -213,6 +213,26 @@ mission DurablePipeline {
 }
 ```
 
+#### Durability guarantees
+
+Run a mission as a **durable execution** (`executionLog:`) and an append-only
+event log lets an interrupted run — crash, deploy, `kill -9` — resume exactly
+where it left off:
+
+- **Delivery**: at-least-once (a step is never silently dropped).
+- **Effects**: exactly-once where the API honours idempotency keys (mutating
+  fetches carry a stable `Idempotency-Key`), otherwise at-least-once + keyed
+  store dedup. Exactly-once on replay via recorded effect identity.
+- **Resume across restart**: replay + fold; effects already applied are skipped.
+- **Backends**: in-memory (tests), file (dev), `SqliteExecutionLog`
+  (transactional, fsync-backed) for single-process self-hosting, and
+  `PostgresExecutionLog` for multi-node.
+
+These guarantees are proven by a crash-injection suite that kills the run at
+every event boundary and asserts no lost record and no duplicated effect
+(`npm run test:crash`). See **[DURABILITY.md](./DURABILITY.md)** for the full
+statement and the guarantee → test map.
+
 ## OpenAPI Integration
 
 Reqon can consume OpenAPI specs directly, eliminating the need for handwritten SDK code:

package/dist/ast/nodes.d.ts

@@ -197,6 +197,12 @@ export interface FetchStep {
     until?: Expression;
     retry?: RetryConfig;
     since?: SinceConfig;
+    /**
+     * Resumable backfill: persist per-page progress to the execution log so a
+     * large paginated fetch survives a restart/deploy and continues from the last
+     * page. Requires durable mode (an executionLog). Only meaningful with paginate.
+     */
+    backfill?: boolean;
 }
 export interface SinceConfig {
     /** How to resolve the "since" timestamp */
@@ -229,6 +235,8 @@ export interface RetryConfig {
     backoff: 'exponential' | 'linear' | 'constant';
     initialDelay: number;
     maxDelay?: number;
+    /** Per-attempt request timeout in ms; aborts a request that hangs */
+    timeout?: number;
 }
 export interface ForStep {
     type: 'ForStep';

package/dist/auth/circuit-breaker.d.ts

@@ -99,6 +99,7 @@ export declare class CircuitBreaker {
      * Get current status for a source/endpoint
      */
     getStatus(source: string, endpoint?: string): CircuitBreakerStatus;
+    private statusFromEntry;
     /**
      * Force reset a circuit to closed state
      */
@@ -107,8 +108,18 @@ export declare class CircuitBreaker {
      * Get all circuit statuses
      */
     getAllStatuses(): Map<string, CircuitBreakerStatus>;
+    /**
+     * Evict stale closed circuits to bound memory. Open and half-open circuits
+     * are always retained (they carry active backoff/recovery state).
+     *
+     * @param maxAgeMs Remove closed entries with no activity for this long.
+     * @returns Number of entries evicted.
+     */
+    evictStale(maxAgeMs?: number): number;
     private getKey;
     private createEntry;
+    /** Read-only lookup. Never inserts — used by status/probe-check paths. */
+    private getEntry;
     private getOrCreateEntry;
     private pruneOldFailures;
     private transitionTo;

package/dist/auth/circuit-breaker.js

@@ -67,7 +67,12 @@ export class CircuitBreaker {
      * Check if a request can proceed (throws if circuit is open)
      */
     canProceed(source, endpoint) {
-        const entry = this.getOrCreateEntry(source, endpoint);
+        // Read-only: an unknown key is implicitly closed and must not be inserted
+        // (otherwise every probed endpoint leaks an entry forever).
+        const entry = this.getEntry(source, endpoint);
+        if (!entry) {
+            return true;
+        }
         const now = Date.now();
         if (entry.state === 'closed') {
             return true;
@@ -75,13 +80,20 @@ export class CircuitBreaker {
         if (entry.state === 'open') {
             const timeSinceOpen = now - (entry.openedAt ?? now);
             if (timeSinceOpen >= entry.config.resetTimeout) {
-                // Transition to half-open
+                // Transition to half-open and let this single caller be the probe.
                 this.transitionTo(entry, 'half_open', source, endpoint);
+                entry.probeInFlight = true;
                 return true;
             }
             return false;
         }
-        // Half-open: allow the request through for testing
+        // Half-open: allow exactly one probe at a time. Every other request is
+        // denied until the in-flight probe resolves (success closes the circuit or
+        // advances the count; failure re-opens it), preventing a recovery stampede.
+        if (entry.probeInFlight) {
+            return false;
+        }
+        entry.probeInFlight = true;
         return true;
     }
     /**
@@ -89,9 +101,11 @@ export class CircuitBreaker {
      */
     ensureCanProceed(source, endpoint) {
         if (!this.canProceed(source, endpoint)) {
-            const entry = this.getOrCreateEntry(source, endpoint);
+            // canProceed only returns false for an existing open/half-open entry.
+            const entry = this.getEntry(source, endpoint);
+            const config = entry?.config ?? this.defaultConfig;
             const now = Date.now();
-            const nextAttemptIn = entry.config.resetTimeout - (now - (entry.openedAt ?? now));
+            const nextAttemptIn = config.resetTimeout - (now - (entry?.openedAt ?? now));
             this.callbacks.onRejected?.({
                 source,
                 endpoint,
@@ -104,13 +118,23 @@ export class CircuitBreaker {
      * Record a successful request
      */
     recordSuccess(source, endpoint) {
-        const entry = this.getOrCreateEntry(source, endpoint);
+        // Read-only lookup: a success on an untracked (implicitly closed) endpoint
+        // has nothing to record, so don't allocate an entry for it.
+        const entry = this.getEntry(source, endpoint);
+        if (!entry) {
+            return;
+        }
+        entry.lastActivity = Date.now();
         if (entry.state === 'half_open') {
             entry.successes++;
             if (entry.successes >= entry.config.successThreshold) {
                 // Recovery successful, close the circuit
                 this.transitionTo(entry, 'closed', source, endpoint);
             }
+            else {
+                // Probe succeeded but more are needed; release the slot for the next.
+                entry.probeInFlight = false;
+            }
         }
         else if (entry.state === 'closed') {
             // Clear old failures from window
@@ -121,15 +145,19 @@ export class CircuitBreaker {
      * Record a failed request
      */
     recordFailure(source, endpoint, statusCode, isNetworkError = false) {
-        const entry = this.getOrCreateEntry(source, endpoint);
-        const config = entry.config;
+        // Resolve config without forcing an entry — ignored failures (e.g. a 404)
+        // must not allocate a permanent circuit for an otherwise-untracked endpoint.
+        const existing = this.getEntry(source, endpoint);
+        const config = existing?.config ?? this.getEntry(source)?.config ?? this.defaultConfig;
         // Check if this failure type should be counted
         const isFailureStatus = statusCode !== undefined && config.failureStatusCodes.includes(statusCode);
         const shouldCount = isFailureStatus || (isNetworkError && config.countNetworkErrors);
         if (!shouldCount) {
             return;
         }
+        const entry = existing ?? this.getOrCreateEntry(source, endpoint);
         const now = Date.now();
+        entry.lastActivity = now;
         if (entry.state === 'half_open') {
             // Any failure in half-open immediately re-opens circuit
             this.transitionTo(entry, 'open', source, endpoint, 'Failure during recovery attempt');
@@ -151,8 +179,14 @@ export class CircuitBreaker {
      * Get current status for a source/endpoint
      */
     getStatus(source, endpoint) {
-        const entry = this.getOrCreateEntry(source, endpoint);
-        const now = Date.now();
+        // Read-only: querying an unknown circuit must not create one.
+        const entry = this.getEntry(source, endpoint);
+        if (!entry) {
+            return { state: 'closed', failures: 0, successes: 0, isOpen: false };
+        }
+        return this.statusFromEntry(entry);
+    }
+    statusFromEntry(entry) {
         let nextAttemptTime;
         if (entry.state === 'open' && entry.openedAt) {
             const nextAttemptMs = entry.openedAt + entry.config.resetTimeout;
@@ -181,6 +215,8 @@ export class CircuitBreaker {
             entry.failureTimestamps = [];
             entry.lastFailureTime = undefined;
             entry.openedAt = undefined;
+            entry.probeInFlight = false;
+            entry.lastActivity = Date.now();
             if (previousState !== 'closed') {
                 this.callbacks.onClose?.({
                     source,
@@ -198,12 +234,37 @@ export class CircuitBreaker {
      */
     getAllStatuses() {
         const result = new Map();
+        // Build the status from each entry directly. Splitting the key on ':' would
+        // corrupt URL-shaped keys (e.g. `https://x` → source `https`), and routing
+        // back through getStatus is needless. We never mutate `circuits` here.
         for (const [key, entry] of this.circuits) {
-            const [source, endpoint] = key.split(':');
-            result.set(key, this.getStatus(source, endpoint === '' ? undefined : endpoint));
+            result.set(key, this.statusFromEntry(entry));
         }
         return result;
     }
+    /**
+     * Evict stale closed circuits to bound memory. Open and half-open circuits
+     * are always retained (they carry active backoff/recovery state).
+     *
+     * @param maxAgeMs Remove closed entries with no activity for this long.
+     * @returns Number of entries evicted.
+     */
+    evictStale(maxAgeMs = this.defaultConfig.failureWindow) {
+        const cutoff = Date.now() - maxAgeMs;
+        let evicted = 0;
+        // Collect first, then delete — never mutate the map mid-iteration.
+        const toDelete = [];
+        for (const [key, entry] of this.circuits) {
+            if (entry.state === 'closed' && entry.lastActivity < cutoff) {
+                toDelete.push(key);
+            }
+        }
+        for (const key of toDelete) {
+            this.circuits.delete(key);
+            evicted++;
+        }
+        return evicted;
+    }
     getKey(source, endpoint) {
         return endpoint ? `${source}:${endpoint}` : source;
     }
@@ -213,9 +274,15 @@ export class CircuitBreaker {
             failures: 0,
             successes: 0,
             failureTimestamps: [],
+            probeInFlight: false,
+            lastActivity: Date.now(),
             config,
         };
     }
+    /** Read-only lookup. Never inserts — used by status/probe-check paths. */
+    getEntry(source, endpoint) {
+        return this.circuits.get(this.getKey(source, endpoint));
+    }
     getOrCreateEntry(source, endpoint) {
         const key = this.getKey(source, endpoint);
         let entry = this.circuits.get(key);
@@ -237,6 +304,10 @@ export class CircuitBreaker {
     transitionTo(entry, newState, source, endpoint, reason) {
         const previousState = entry.state;
         entry.state = newState;
+        entry.lastActivity = Date.now();
+        // Any state change clears the half-open probe slot; canProceed re-claims it
+        // when it admits the next probe.
+        entry.probeInFlight = false;
         const event = {
             source,
             endpoint,

package/dist/auth/credentials.d.ts

@@ -33,12 +33,17 @@ export interface LoadEnvResult {
  */
 export declare function loadEnv(options?: CredentialsConfig): LoadEnvResult;
 /**
- * Resolve environment variable references in a string
+ * Resolve environment variable references in a string.
  *
  * Supports:
  * - $VAR_NAME
  * - ${VAR_NAME}
  * - ${VAR_NAME:-default}
+ *
+ * A reference with no value and no default is treated as *required* and throws,
+ * rather than silently resolving to '' (which previously let requests go out
+ * with an empty Authorization header). Use the `${VAR:-}` form to opt a
+ * reference into being optional with an empty fallback.
  */
 export declare function resolveEnvString(value: string): string;
 /**

package/dist/auth/credentials.js

@@ -55,12 +55,17 @@ export function loadEnv(options = {}) {
     };
 }
 /**
- * Resolve environment variable references in a string
+ * Resolve environment variable references in a string.
  *
  * Supports:
  * - $VAR_NAME
  * - ${VAR_NAME}
  * - ${VAR_NAME:-default}
+ *
+ * A reference with no value and no default is treated as *required* and throws,
+ * rather than silently resolving to '' (which previously let requests go out
+ * with an empty Authorization header). Use the `${VAR:-}` form to opt a
+ * reference into being optional with an empty fallback.
  */
 export function resolveEnvString(value) {
     // Pattern for ${VAR:-default} or ${VAR}
@@ -75,15 +80,18 @@ export function resolveEnvString(value) {
             return envValue;
         }
         if (defaultValue !== undefined) {
+            // Includes the empty-default escape hatch `${VAR:-}`.
             return defaultValue;
         }
-        // Return empty string if no value and no default
-        return '';
+        throw new Error(`unresolved required credential ${varName}`);
     });
     // Then resolve $VAR patterns (only if not already resolved)
     result = result.replace(simplePattern, (_match, varName) => {
         const envValue = process.env[varName];
-        return envValue !== undefined ? envValue : '';
+        if (envValue !== undefined) {
+            return envValue;
+        }
+        throw new Error(`unresolved required credential ${varName}`);
     });
     return result;
 }

package/dist/auth/oauth2-provider.js

@@ -60,10 +60,16 @@ export class OAuth2AuthProvider {
             body,
         });
         if (!response.ok) {
-            const error = await response.text();
-            throw new Error(`Token refresh failed: ${response.status} ${error}`);
+            // Do not include the response body: token endpoints can echo the
+            // submitted client secret / refresh token in error responses.
+            throw new Error(`Token refresh failed: ${response.status} ${response.statusText}`);
         }
         const data = (await response.json());
+        // A 2xx with no access_token would otherwise propagate as `Bearer undefined`
+        // on every subsequent request. Fail loudly instead.
+        if (!data.access_token) {
+            throw new Error(`Token refresh for connection "${this.connectionId}" returned no access_token`);
+        }
         const newTokens = {
             accessToken: data.access_token,
             refreshToken: data.refresh_token ?? tokens.refreshToken, // Keep old if not rotated
@@ -80,7 +86,11 @@ export class OAuth2AuthProvider {
     }
     shouldRefresh(tokens) {
         if (!tokens.expiresAt) {
-            return false; // No expiry info, assume valid
+            // No expiry metadata: we cannot know when the token lapses, so we treat it
+            // as still valid and let a downstream 401 trigger an explicit
+            // refreshToken() call. Proactively refreshing here would burn the refresh
+            // token (and break non-expiring tokens) on every single request.
+            return false;
         }
         const now = Date.now();
         const expiresAt = tokens.expiresAt.getTime();

package/dist/auth/rate-limiter.d.ts

@@ -32,7 +32,14 @@ export declare class AdaptiveRateLimiter implements RateLimiter {
         maxStaleAgeMs?: number;
     });
     /**
-     * Clean up stale entries from the state map to prevent memory leaks
+     * Clean up stale entries from the state map to prevent memory leaks.
+     *
+     * Eviction is driven by `lastRequestAt`, not `resetAt`. Most of the leak came
+     * from keys whose API sends no reset header: `resetAt` is never set, so the
+     * old reset-passed condition could never fire and those keys lived forever.
+     * Now any key idle longer than the stale threshold is evicted regardless of
+     * `resetAt`, except while an active `retryAfter` backoff is still pending
+     * (that state must survive so we keep honouring the 429).
      */
     private cleanup;
     /**

package/dist/auth/rate-limiter.js

@@ -52,7 +52,14 @@ export class AdaptiveRateLimiter {
         this.maxStaleAgeMs = options.maxStaleAgeMs ?? RATE_LIMIT_DEFAULTS.MAX_STALE_AGE_MS;
     }
     /**
-     * Clean up stale entries from the state map to prevent memory leaks
+     * Clean up stale entries from the state map to prevent memory leaks.
+     *
+     * Eviction is driven by `lastRequestAt`, not `resetAt`. Most of the leak came
+     * from keys whose API sends no reset header: `resetAt` is never set, so the
+     * old reset-passed condition could never fire and those keys lived forever.
+     * Now any key idle longer than the stale threshold is evicted regardless of
+     * `resetAt`, except while an active `retryAfter` backoff is still pending
+     * (that state must survive so we keep honouring the 429).
      */
     cleanup() {
         const now = Date.now();
@@ -65,13 +72,14 @@ export class AdaptiveRateLimiter {
         const nowDate = new Date(now);
         const staleThreshold = new Date(now - this.maxStaleAgeMs);
         for (const [key, state] of this.state) {
-            // Remove if:
-            // 1. Reset time has passed AND no recent requests
-            // 2. Last request is older than max stale age
-            const isResetPassed = state.resetAt && state.resetAt < nowDate;
-            const isRetryPassed = !state.retryAfter || state.retryAfter < nowDate;
-            const isStale = state.lastRequestAt && state.lastRequestAt < staleThreshold;
-            if ((isResetPassed && isRetryPassed && isStale) || (!state.lastRequestAt && isResetPassed)) {
+            // A pending retry-after backoff must never be evicted out from under us.
+            const isRetryPending = state.retryAfter !== undefined && state.retryAfter >= nowDate;
+            if (isRetryPending)
+                continue;
+            // Stale if the last request is older than the threshold, or if no request
+            // was ever recorded for this key.
+            const isStale = !state.lastRequestAt || state.lastRequestAt < staleThreshold;
+            if (isStale) {
                 this.state.delete(key);
             }
         }
@@ -251,7 +259,16 @@ export class AdaptiveRateLimiter {
         }
         state.lastRequestAt = now;
         this.state.set(key, state);
-        // Periodically clean up stale entries (every N responses)
+        // Trigger a stale-entry sweep every N responses. The sweep itself is rate-
+        // limited by CLEANUP_INTERVAL_MS / MAX_ENTRIES_BEFORE_CLEANUP inside
+        // cleanup(), so this counter only decides how often we *consider* sweeping.
+        //
+        // TODO: this limiter is purely reactive — it learns limits from response
+        // headers after the fact. Add proactive in-flight token accounting (track
+        // tokens consumed by requests that have been issued but not yet returned a
+        // response) so concurrent callers can't collectively blow past the limit
+        // between header updates. That is a larger redesign; the eviction leak fix
+        // above is independent of it.
         this.responsesSinceCleanup++;
         if (this.responsesSinceCleanup >= RATE_LIMIT_DEFAULTS.CLEANUP_CHECK_INTERVAL) {
             this.responsesSinceCleanup = 0;
@@ -266,7 +283,10 @@ export class AdaptiveRateLimiter {
             return { isLimited: false };
         }
         const isLimited = (state.retryAfter && state.retryAfter > now) ||
-            (state.remaining !== undefined && state.remaining <= 0 && state.resetAt && state.resetAt > now);
+            (state.remaining !== undefined &&
+                state.remaining <= 0 &&
+                state.resetAt &&
+                state.resetAt > now);
         let resetInSeconds;
         if (isLimited && state.resetAt) {
             resetInSeconds = Math.ceil((state.resetAt.getTime() - now.getTime()) / 1000);

package/dist/auth/token-store.js

@@ -103,7 +103,14 @@ export class FileTokenStore {
         for (const [key, value] of this.cache) {
             data[key] = value;
         }
-        await fs.writeFile(this.filePath, JSON.stringify(data, null, 2), 'utf-8');
+        // Owner-only (0o600): the file holds OAuth tokens and must not be
+        // world-readable. `mode` only applies on creation, so chmod an existing
+        // file too (in case it was created before this fix or under a loose umask).
+        await fs.writeFile(this.filePath, JSON.stringify(data, null, 2), {
+            encoding: 'utf-8',
+            mode: 0o600,
+        });
+        await fs.chmod(this.filePath, 0o600).catch(() => { });
     }
     async get(connectionId) {
         const map = await this.load();

package/dist/cli.d.ts

@@ -12,4 +12,14 @@
  *   - ./debug/cli-debugger.ts - interactive debugging
  * ---
  */
-export {};
+/**
+ * Load and resolve an --auth credentials file, turning low-level fs/JSON
+ * failures into clean, user-facing messages instead of raw stack traces.
+ */
+export declare function loadAuthFile(rawPath: string): Promise<Record<string, unknown>>;
+/**
+ * Print an error in a clean, user-facing form (no stack trace). ReqonErrors
+ * get their rich source-context formatting; everything else gets a one-line
+ * message.
+ */
+export declare function reportFatalError(error: unknown): void;

package/dist/cli.js

@@ -14,11 +14,57 @@
  */
 import { readFile, writeFile, mkdir } from 'node:fs/promises';
 import { resolve, dirname } from 'node:path';
+import { pathToFileURL } from 'node:url';
 import { fromPath, Scheduler, loadMission } from './index.js';
 import { ReqonError } from './errors/index.js';
 import { loadEnv, loadCredentials } from './auth/credentials.js';
 import { WebhookServer } from './webhook/index.js';
 import { ControlServer } from './control/index.js';
+/**
+ * Load and resolve an --auth credentials file, turning low-level fs/JSON
+ * failures into clean, user-facing messages instead of raw stack traces.
+ */
+export async function loadAuthFile(rawPath) {
+    const authPath = resolve(rawPath);
+    let authContent;
+    try {
+        authContent = await readFile(authPath, 'utf-8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT') {
+            throw new Error(`auth file not found: ${authPath}`);
+        }
+        if (err.code === 'EISDIR') {
+            throw new Error(`auth path is a directory, not a file: ${authPath}`);
+        }
+        throw new Error(`could not read auth file ${authPath}: ${err.message}`);
+    }
+    let rawAuth;
+    try {
+        rawAuth = JSON.parse(authContent);
+    }
+    catch {
+        throw new Error(`auth file is not valid JSON: ${authPath}`);
+    }
+    // Resolve env var references in the auth config
+    return loadCredentials(rawAuth);
+}
+/**
+ * Print an error in a clean, user-facing form (no stack trace). ReqonErrors
+ * get their rich source-context formatting; everything else gets a one-line
+ * message.
+ */
+export function reportFatalError(error) {
+    if (error instanceof ReqonError) {
+        console.error(error.format());
+    }
+    else if (error instanceof Error) {
+        console.error(`Error: ${error.message}`);
+    }
+    else {
+        console.error(`Error: ${String(error)}`);
+    }
+}
 async function main() {
     const args = process.argv.slice(2);
     if (args.length === 0 || args.includes('--help') || args.includes('-h')) {
@@ -31,6 +77,7 @@ Usage:
 Options:
   --dry-run            Run without making actual HTTP requests
   --verbose            Enable verbose logging
+  --dev                Development mode: let sql/nosql stores fall back to local JSON files
   --auth <file>        JSON file with auth credentials (supports env var interpolation)
   --env <file>         Path to .env file (default: .env in current directory)
   --output <path>      Export stores to JSON (file or directory)
@@ -77,6 +124,7 @@ Control Server:
     const filePath = args[0];
     const dryRun = args.includes('--dry-run');
     const verbose = args.includes('--verbose');
+    const devMode = args.includes('--dev');
     const daemon = args.includes('--daemon');
     const once = args.includes('--once');
     const webhookEnabled = args.includes('--webhook');
@@ -119,11 +167,7 @@ Control Server:
     let auth;
     const authIndex = args.indexOf('--auth');
     if (authIndex !== -1 && args[authIndex + 1]) {
-        const authPath = resolve(args[authIndex + 1]);
-        const authContent = await readFile(authPath, 'utf-8');
-        const rawAuth = JSON.parse(authContent);
-        // Resolve env var references in the auth config
-        auth = loadCredentials(rawAuth);
+        auth = await loadAuthFile(args[authIndex + 1]);
     }
     let outputPath;
     const outputIndex = args.indexOf('--output');
@@ -174,6 +218,7 @@ Control Server:
         const result = await fromPath(filePath, {
             dryRun,
             verbose,
+            developmentMode: devMode,
             auth: auth,
             webhookServer,
             debugController,
@@ -347,4 +392,18 @@ async function runDaemon(filePath, options) {
 function formatTime(date) {
     return date.toISOString().replace('T', ' ').substring(0, 19);
 }
-main();
+// Only auto-run when invoked directly as the CLI entry point, so the module can
+// be imported in tests without executing main() against the test runner's argv.
+const isMain = typeof process.argv[1] === 'string' && import.meta.url === pathToFileURL(process.argv[1]).href;
+if (isMain) {
+    // A rejected promise anywhere (including outside main's try/catch) should
+    // surface as a clean message and a non-zero exit, never a raw stack trace.
+    process.on('unhandledRejection', (reason) => {
+        reportFatalError(reason);
+        process.exit(1);
+    });
+    main().catch((error) => {
+        reportFatalError(error);
+        process.exit(1);
+    });
+}

package/dist/config/constants.d.ts

@@ -17,6 +17,8 @@ export declare const HTTP_RETRY_DEFAULTS: {
     readonly MAX_DELAY_MS: 30000;
     /** Backoff strategy: 'exponential', 'linear', or 'constant' */
     readonly BACKOFF: "exponential";
+    /** Per-attempt request timeout in milliseconds (aborts a hung request) */
+    readonly TIMEOUT_MS: 30000;
 };
 /**
  * Default HTTP headers
@@ -69,12 +71,16 @@ export declare const CIRCUIT_BREAKER_DEFAULTS: {
 export declare const WEBHOOK_DEFAULTS: {
     /** Default port for webhook server */
     readonly PORT: 3000;
-    /** Default host binding */
-    readonly HOST: "0.0.0.0";
+    /** Default host binding — loopback only; opt into 0.0.0.0 explicitly. */
+    readonly HOST: "127.0.0.1";
     /** Default timeout for wait steps (5 minutes in ms) */
     readonly DEFAULT_TIMEOUT_MS: 300000;
     /** Cleanup interval for expired registrations (1 minute in ms) */
     readonly CLEANUP_INTERVAL_MS: 60000;
+    /** Maximum accepted request body size in bytes (1 MiB) */
+    readonly MAX_BODY_BYTES: number;
+    /** Idle socket timeout in ms; drops slow-drip connections */
+    readonly SOCKET_TIMEOUT_MS: 30000;
 };
 /**
  * Default store configuration
@@ -100,8 +106,13 @@ export declare const SCHEDULER_DEFAULTS: {
  * Default execution configuration
  */
 export declare const EXECUTION_DEFAULTS: {
-    /** Whether development mode is enabled by default (uses file stores) */
-    readonly DEVELOPMENT_MODE: true;
+    /**
+     * Whether development mode is enabled by default. When true, sql/nosql
+     * stores fall back to local JSON files; default false so a mission that
+     * declares `store sql`/`nosql` errors loudly instead of silently writing
+     * to disk.
+     */
+    readonly DEVELOPMENT_MODE: false;
     /** Whether to persist execution state by default */
     readonly PERSIST_STATE: false;
 };