reqon-dsl 0.3.0 → 0.4.0

package/dist/oas/mock-generator.js

@@ -13,6 +13,13 @@ export function generateMockData(schema, options = {}) {
     return generateValue(schema, ctx);
 }
 function generateValue(schema, ctx) {
+    // Depth guard: after dereferencing, a self-referential schema becomes a
+    // circular object reference (not a $ref), so the only thing that stops
+    // infinite recursion is the depth cap. Enforce it here for every path,
+    // including allOf/oneOf/anyOf below.
+    if (ctx.depth > ctx.maxDepth) {
+        return null;
+    }
     // Handle nullable - only return null if explicitly marked nullable
     // and we're past the top level (depth > 0). Use strict equality check
     // to avoid false positives from undefined/truthy coercion.
@@ -34,12 +41,14 @@ function generateValue(schema, ctx) {
     if (schema.default !== undefined) {
         return schema.default;
     }
-    // Check for allOf/oneOf/anyOf
+    // Check for allOf/oneOf/anyOf. Each recursion must increment depth so the
+    // depth cap can terminate self-referential combinator schemas.
+    const deeper = { ...ctx, depth: ctx.depth + 1 };
     if (schema.allOf && schema.allOf.length > 0) {
         // Merge all schemas
         const merged = {};
         for (const subSchema of schema.allOf) {
-            const subValue = generateValue(subSchema, ctx);
+            const subValue = generateValue(subSchema, deeper);
             if (typeof subValue === 'object' && subValue !== null) {
                 Object.assign(merged, subValue);
             }
@@ -47,10 +56,10 @@ function generateValue(schema, ctx) {
         return merged;
     }
     if (schema.oneOf && schema.oneOf.length > 0) {
-        return generateValue(schema.oneOf[0], ctx);
+        return generateValue(schema.oneOf[0], deeper);
     }
     if (schema.anyOf && schema.anyOf.length > 0) {
-        return generateValue(schema.anyOf[0], ctx);
+        return generateValue(schema.anyOf[0], deeper);
     }
     // Generate based on type
     switch (schema.type) {

package/dist/oas/validator.js

@@ -1,3 +1,32 @@
+/**
+ * Upper bound on the length of a string we will test against a `pattern`
+ * regex. Both the schema pattern and the response value are untrusted, so a
+ * pathological pattern (e.g. `(a+)+$`) over a long string can trigger
+ * catastrophic backtracking. Anything longer is rejected without running the
+ * regex, so validation always returns promptly.
+ */
+const MAX_PATTERN_INPUT_LENGTH = 10_000;
+/**
+ * Cache of compiled pattern regexes. Avoids recompiling the same (untrusted)
+ * pattern per value, and stores `null` for patterns that fail to compile so we
+ * skip them consistently.
+ */
+const patternRegexCache = new Map();
+function getPatternRegex(pattern) {
+    const cached = patternRegexCache.get(pattern);
+    if (cached !== undefined)
+        return cached;
+    let regex;
+    try {
+        regex = new RegExp(pattern);
+    }
+    catch {
+        // Invalid regex: don't crash validation, just skip the pattern check.
+        regex = null;
+    }
+    patternRegexCache.set(pattern, regex);
+    return regex;
+}
 export function validateResponse(data, schema, path = '') {
     const errors = [];
     validateValue(data, schema, path, errors);
@@ -79,15 +108,26 @@ function validateString(value, schema, path, errors) {
         });
     }
     if (schema.pattern) {
-        const regex = new RegExp(schema.pattern);
-        if (!regex.test(value)) {
+        if (value.length > MAX_PATTERN_INPUT_LENGTH) {
+            // Refuse to run an untrusted regex over an oversized string (ReDoS guard).
             errors.push({
                 path,
-                message: `String does not match pattern`,
-                expected: schema.pattern,
-                actual: value,
+                message: `String too long to validate against pattern`,
+                expected: `<= ${MAX_PATTERN_INPUT_LENGTH} chars`,
+                actual: `${value.length} chars`,
             });
         }
+        else {
+            const regex = getPatternRegex(schema.pattern);
+            if (regex && !regex.test(value)) {
+                errors.push({
+                    path,
+                    message: `String does not match pattern`,
+                    expected: schema.pattern,
+                    actual: value,
+                });
+            }
+        }
     }
 }
 function validateNumber(value, schema, path, errors) {

package/dist/observability/events.d.ts

@@ -16,7 +16,12 @@ export interface ObservabilityEvent<T = unknown> {
     mission: string;
     /** ISO timestamp */
     timestamp: string;
-    /** Duration in milliseconds (for completed events) */
+    /**
+     * Duration in milliseconds of the operation this event reports, when the
+     * payload carries one. Not set by the emitter itself: a generic "time since
+     * the previous event of any type" value was misleading, so operation timing
+     * now lives in the typed payloads instead.
+     */
     duration?: number;
     /** Event-specific payload */
     payload: T;
@@ -227,7 +232,6 @@ export declare class ObservabilityEmitter implements EventEmitter {
     private handlers;
     private allHandlers;
     private startTime;
-    private lastEventTime;
     constructor(executionId: string, mission: string);
     emit<T>(type: EventType, payload: T): void;
     on<T>(type: EventType, handler: EventHandler<T>): () => void;

package/dist/observability/events.js

@@ -13,24 +13,19 @@ export class ObservabilityEmitter {
     handlers = new Map();
     allHandlers = new Set();
     startTime;
-    lastEventTime;
     constructor(executionId, mission) {
         this.executionId = executionId;
         this.mission = mission;
         this.startTime = Date.now();
-        this.lastEventTime = this.startTime;
     }
     emit(type, payload) {
-        const now = Date.now();
         const event = {
             type,
             executionId: this.executionId,
             mission: this.mission,
             timestamp: new Date().toISOString(),
-            duration: now - this.lastEventTime,
             payload,
         };
-        this.lastEventTime = now;
         // Notify specific handlers
         const typeHandlers = this.handlers.get(type);
         if (typeHandlers) {

package/dist/observability/logger.js

@@ -7,6 +7,8 @@
  * - Multiple output formats
  * - Integration with event emitter
  */
+import { randomBytes } from 'node:crypto';
+import { redactSecrets } from '../utils/redact.js';
 // ============================================================================
 // Span Implementation
 // ============================================================================
@@ -41,7 +43,13 @@ class SpanImpl {
     }
 }
 function generateSpanId() {
-    return Math.random().toString(36).substring(2, 10);
+    // CSPRNG-backed, 16 hex chars. Never all-zero (the OTel "invalid" sentinel).
+    for (let attempt = 0; attempt < 8; attempt++) {
+        const hex = randomBytes(8).toString('hex');
+        if (!/^0+$/.test(hex))
+            return hex;
+    }
+    return '1'.padEnd(16, '0');
 }
 // ============================================================================
 // Logger Implementation
@@ -73,7 +81,7 @@ class StructuredLoggerImpl {
             level,
             message,
             timestamp: new Date().toISOString(),
-            context: { ...this.context, ...context },
+            context: redactSecrets({ ...this.context, ...context }),
         };
         for (const output of this.outputs) {
             try {
@@ -116,7 +124,7 @@ class StructuredLoggerImpl {
             level: 'debug',
             message: `span:end`,
             timestamp: new Date().toISOString(),
-            context: { ...this.context, spanName: name, ...spanContext },
+            context: redactSecrets({ ...this.context, spanName: name, ...spanContext }),
             spanId,
             parentSpanId,
             duration,
@@ -154,13 +162,9 @@ export class ConsoleOutput {
         const prefix = `[${this.prefix}]`;
         const levelStr = entry.level.toUpperCase().padEnd(5);
         // Format context as key=value pairs
-        const contextStr = Object.keys(entry.context).length > 0
-            ? ` ${formatContext(entry.context)}`
-            : '';
+        const contextStr = Object.keys(entry.context).length > 0 ? ` ${formatContext(entry.context)}` : '';
         // Format duration if present
-        const durationStr = entry.duration !== undefined
-            ? ` (${entry.duration}ms)`
-            : '';
+        const durationStr = entry.duration !== undefined ? ` (${entry.duration}ms)` : '';
         const message = `${prefix} ${levelStr} ${entry.message}${contextStr}${durationStr}`;
         switch (entry.level) {
             case 'debug':
@@ -218,7 +222,10 @@ export class EventOutput {
         // Map log entries to appropriate event types based on context
         // This allows logs to flow into the event system
         if (entry.context.eventType) {
-            this.emitter.emit(entry.context.eventType, { ...entry.context, message: entry.message });
+            this.emitter.emit(entry.context.eventType, {
+                ...entry.context,
+                message: entry.message,
+            });
         }
     }
 }

package/dist/observability/otel.d.ts

@@ -79,6 +79,13 @@ export declare class OTelEventAdapter {
     private spanBuilder;
     private spanStack;
     private eventToSpan;
+    /**
+     * Pending fetch spans keyed by source+path. Fetch start/complete events
+     * don't carry a correlation id, so we queue the open span ids per endpoint
+     * (FIFO) instead of a single shared `fetch:current` slot. This keeps
+     * concurrent/paginated fetches from overwriting and leaking each other.
+     */
+    private pendingFetchSpans;
     constructor(traceId?: string);
     /**
      * Process an observability event and update spans
@@ -90,6 +97,7 @@ export declare class OTelEventAdapter {
     private endStageSpan;
     private startStepSpan;
     private endStepSpan;
+    private fetchKey;
     private startFetchSpan;
     private endFetchSpan;
     private addEventToCurrentSpan;

package/dist/observability/otel.js

@@ -7,6 +7,7 @@
  * This is a lightweight implementation that doesn't require the full OTel SDK.
  * For production use, consider using the official @opentelemetry packages.
  */
+import { randomBytes } from 'node:crypto';
 // ============================================================================
 // Trace Context Management
 // ============================================================================
@@ -22,12 +23,21 @@ export function generateTraceId() {
 export function generateSpanId() {
     return randomHex(16);
 }
+/**
+ * Generate `length` random hex characters using a CSPRNG. OTel trace/span IDs
+ * must be unpredictable and must never be all-zero (the all-zero ID is the
+ * "invalid" sentinel in the spec), so we regenerate in the vanishingly
+ * unlikely event of an all-zero draw.
+ */
 function randomHex(length) {
-    let result = '';
-    for (let i = 0; i < length; i++) {
-        result += Math.floor(Math.random() * 16).toString(16);
+    const byteLength = Math.ceil(length / 2);
+    for (let attempt = 0; attempt < 8; attempt++) {
+        const hex = randomBytes(byteLength).toString('hex').slice(0, length);
+        if (!/^0+$/.test(hex))
+            return hex;
     }
-    return result;
+    // Fallback (practically unreachable): force a non-zero leading nibble.
+    return '1'.padEnd(length, '0');
 }
 // ============================================================================
 // OpenTelemetry Span Builder
@@ -112,6 +122,13 @@ export class OTelEventAdapter {
     spanBuilder;
     spanStack = [];
     eventToSpan = new Map();
+    /**
+     * Pending fetch spans keyed by source+path. Fetch start/complete events
+     * don't carry a correlation id, so we queue the open span ids per endpoint
+     * (FIFO) instead of a single shared `fetch:current` slot. This keeps
+     * concurrent/paginated fetches from overwriting and leaking each other.
+     */
+    pendingFetchSpans = new Map();
     constructor(traceId) {
         this.spanBuilder = new SpanBuilder(traceId);
     }
@@ -119,7 +136,7 @@ export class OTelEventAdapter {
      * Process an observability event and update spans
      */
     processEvent(event) {
-        const { type, payload } = event;
+        const { type } = event;
         // Map event types to span operations
         switch (type) {
             case 'mission.start':
@@ -173,6 +190,7 @@ export class OTelEventAdapter {
                 error: payload.error,
             });
             this.spanStack.pop();
+            this.eventToSpan.delete('mission');
         }
     }
     startStageSpan(event) {
@@ -198,6 +216,7 @@ export class OTelEventAdapter {
                 error: payload.error,
             });
             this.spanStack.pop();
+            this.eventToSpan.delete(`stage:${payload.stageIndex}`);
         }
     }
     startStepSpan(event) {
@@ -217,15 +236,20 @@ export class OTelEventAdapter {
     }
     endStepSpan(event) {
         const payload = event.payload;
-        const spanId = this.eventToSpan.get(`step:${payload.actionName}:${payload.stepIndex}`);
+        const key = `step:${payload.actionName}:${payload.stepIndex}`;
+        const spanId = this.eventToSpan.get(key);
         if (spanId) {
             this.spanBuilder.endSpan(spanId, {
                 status: payload.success ? 'OK' : 'ERROR',
                 error: payload.error,
             });
             this.spanStack.pop();
+            this.eventToSpan.delete(key);
         }
     }
+    fetchKey(source, path) {
+        return `${source ?? ''}${path ?? ''}`;
+    }
     startFetchSpan(event) {
         const payload = event.payload;
         const parentSpanId = this.spanStack[this.spanStack.length - 1];
@@ -238,18 +262,29 @@ export class OTelEventAdapter {
                 'reqon.source': payload.source,
             },
         });
-        this.eventToSpan.set('fetch:current', spanId);
+        const key = this.fetchKey(payload.source, payload.path);
+        const queue = this.pendingFetchSpans.get(key);
+        if (queue) {
+            queue.push(spanId);
+        }
+        else {
+            this.pendingFetchSpans.set(key, [spanId]);
+        }
     }
     endFetchSpan(event) {
-        const spanId = this.eventToSpan.get('fetch:current');
+        const payload = event.payload;
+        const key = this.fetchKey(payload.source, payload.path);
+        const queue = this.pendingFetchSpans.get(key);
+        const spanId = queue?.shift();
+        if (queue && queue.length === 0) {
+            this.pendingFetchSpans.delete(key);
+        }
         if (spanId) {
-            const payload = event.payload;
             this.spanBuilder.endSpan(spanId, {
                 status: payload.error ? 'ERROR' : 'OK',
                 error: payload.error,
                 attributes: payload.statusCode ? { 'http.status_code': payload.statusCode } : undefined,
             });
-            this.eventToSpan.delete('fetch:current');
         }
     }
     addEventToCurrentSpan(event) {

package/dist/parser/action-parser.js

@@ -115,7 +115,7 @@ export class ActionParser extends FetchParser {
         this.consume(TokenType.LBRACE, "Expected '{'");
         const mappings = [];
         while (!this.check(TokenType.RBRACE) && !this.isAtEnd()) {
-            const field = this.consumeIdentifier('Expected field name').value;
+            const field = this.consumeName('Expected field name').value;
             this.consume(TokenType.COLON, "Expected ':'");
             const expression = this.parseExpression();
             mappings.push({ field, expression });
@@ -202,7 +202,7 @@ export class ActionParser extends FetchParser {
         this.consume(TokenType.LBRACE, "Expected '{'");
         const mappings = [];
         while (!this.check(TokenType.RBRACE) && !this.isAtEnd()) {
-            const field = this.consumeIdentifier('Expected field name').value;
+            const field = this.consumeName('Expected field name').value;
             this.consume(TokenType.COLON, "Expected ':'");
             const expression = this.parseExpression();
             mappings.push({ field, expression });

package/dist/parser/base.d.ts

@@ -21,6 +21,13 @@ export declare class ReqonParserBase {
      * This is needed because 'get', 'post', etc. are valid variable/store names.
      */
     protected consumeIdentifier(message: string): Token;
+    /**
+     * Consume a token in name/property position (after a dot, a map/transform field
+     * name, or the type name after `is`). Any reserved keyword's text is a valid name
+     * here because the position is unambiguous, so accept any non-EOF token and return
+     * it by value.
+     */
+    protected consumeName(message: string): Token;
     /**
      * Check if current token is an identifier (including HTTP methods as identifiers)
      */

package/dist/parser/base.js

@@ -66,6 +66,17 @@ export class ReqonParserBase {
         }
         throw this.error(message);
     }
+    /**
+     * Consume a token in name/property position (after a dot, a map/transform field
+     * name, or the type name after `is`). Any reserved keyword's text is a valid name
+     * here because the position is unambiguous, so accept any non-EOF token and return
+     * it by value.
+     */
+    consumeName(message) {
+        if (this.isAtEnd())
+            throw this.error(message);
+        return this.advance();
+    }
     /**
      * Check if current token is an identifier (including HTTP methods as identifiers)
      */

package/dist/parser/expressions.d.ts

@@ -14,6 +14,7 @@ export interface ObjectProperty {
     value: Expression;
 }
 export declare class ReqonExpressionParser extends ReqonParserBase {
+    private expressionDepth;
     parseExpression(): Expression;
     parseLogicalExpression(): Expression;
     private parseTernary;

package/dist/parser/expressions.js

@@ -1,9 +1,22 @@
 import { TokenType } from 'vague-lang';
 import { ReqonTokenType } from '../lexer/tokens.js';
 import { ReqonParserBase } from './base.js';
+// Guards unbounded recursive descent from blowing the JS stack on deeply nested
+// input, surfacing a structured ParseError instead of a raw V8 RangeError.
+const MAX_EXPRESSION_DEPTH = 200;
 export class ReqonExpressionParser extends ReqonParserBase {
+    expressionDepth = 0;
     parseExpression() {
-        return this.parseTernary();
+        if (++this.expressionDepth > MAX_EXPRESSION_DEPTH) {
+            this.expressionDepth--;
+            throw this.error('Expression nesting too deep (maximum depth 200 exceeded)');
+        }
+        try {
+            return this.parseTernary();
+        }
+        finally {
+            this.expressionDepth--;
+        }
     }
     parseLogicalExpression() {
         return this.parseOr();
@@ -118,7 +131,7 @@ export class ReqonExpressionParser extends ReqonParserBase {
         // Check for 'is' type checking: expr is array, expr is string, etc.
         if (this.check(ReqonTokenType.IS)) {
             this.advance(); // consume 'is'
-            const typeCheck = this.consume(TokenType.IDENTIFIER, "Expected type name after 'is'").value;
+            const typeCheck = this.consumeName("Expected type name after 'is'").value;
             return { type: 'IsExpression', operand: left, typeCheck };
         }
         return left;
@@ -180,7 +193,7 @@ export class ReqonExpressionParser extends ReqonParserBase {
                 }
             }
             else if (this.match(TokenType.DOT)) {
-                const name = this.consume(TokenType.IDENTIFIER, 'Expected property name').value;
+                const name = this.consumeName('Expected property name').value;
                 if (expr.type === 'Identifier') {
                     expr = { type: 'QualifiedName', parts: [expr.name, name] };
                 }
@@ -251,7 +264,7 @@ export class ReqonExpressionParser extends ReqonParserBase {
         }
         // .field shorthand
         if (this.match(TokenType.DOT)) {
-            const name = this.consumeIdentifier("Expected field name after '.'").value;
+            const name = this.consumeName("Expected field name after '.'").value;
             return { type: 'Identifier', name };
         }
         throw this.error(`Unexpected token: ${this.peek().value}`);

package/dist/parser/fetch-parser.js

@@ -80,6 +80,7 @@ export class FetchParser extends ScheduleParser {
         let until;
         let retry;
         let since;
+        let backfill;
         if (this.match(TokenType.LBRACE)) {
             while (!this.check(TokenType.RBRACE) && !this.isAtEnd()) {
                 const key = this.parseFetchOptionKey();
@@ -103,6 +104,12 @@ export class FetchParser extends ScheduleParser {
                     case 'since':
                         since = this.parseSinceConfig();
                         break;
+                    case 'backfill':
+                        backfill = this.match(TokenType.TRUE);
+                        if (!backfill) {
+                            this.consume(TokenType.FALSE, "Expected 'true' or 'false'");
+                        }
+                        break;
                     default:
                         throw this.error(`Unknown fetch option: ${key}`);
                 }
@@ -110,7 +117,7 @@ export class FetchParser extends ScheduleParser {
             }
             this.consume(TokenType.RBRACE, "Expected '}'");
         }
-        return { source, body, headers, paginate, until, retry, since };
+        return { source, body, headers, paginate, until, retry, since, backfill };
     }
     /**
      * Parse a fetch option key, handling keyword tokens that can appear as keys
@@ -243,6 +250,7 @@ export class FetchParser extends ScheduleParser {
         let backoff = 'exponential';
         let initialDelay = 1000;
         let maxDelay;
+        let timeout;
         while (!this.check(TokenType.RBRACE) && !this.isAtEnd()) {
             const key = this.consume(TokenType.IDENTIFIER, 'Expected retry option').value;
             this.consume(TokenType.COLON, "Expected ':'");
@@ -260,10 +268,13 @@ export class FetchParser extends ScheduleParser {
                 case 'maxDelay':
                     maxDelay = parseInt(this.consume(TokenType.NUMBER, 'Expected number').value, 10);
                     break;
+                case 'timeout':
+                    timeout = parseInt(this.consume(TokenType.NUMBER, 'Expected number').value, 10);
+                    break;
             }
             this.match(TokenType.COMMA);
         }
         this.consume(TokenType.RBRACE, "Expected '}'");
-        return { maxAttempts, backoff, initialDelay, maxDelay };
+        return { maxAttempts, backoff, initialDelay, maxDelay, timeout };
     }
 }

package/dist/pause/index.d.ts

@@ -10,5 +10,6 @@ export type { PauseState, PauseResumeTriggerState, PauseCheckpoint } from './sta
 export { generatePauseId, parseDuration, formatDuration, createPauseState, isPauseExpired, getRemainingTime, getPauseSummary, } from './state.js';
 export type { PauseStore } from './store.js';
 export { FilePauseStore, MemoryPauseStore } from './store.js';
+export { LogBackedPauseStore } from './log-store.js';
 export type { PauseManagerConfig, CreatePauseOptions, PauseStatus } from './manager.js';
 export { PauseManager, createPauseManager } from './manager.js';

package/dist/pause/index.js

@@ -8,4 +8,5 @@
  */
 export { generatePauseId, parseDuration, formatDuration, createPauseState, isPauseExpired, getRemainingTime, getPauseSummary, } from './state.js';
 export { FilePauseStore, MemoryPauseStore } from './store.js';
+export { LogBackedPauseStore } from './log-store.js';
 export { PauseManager, createPauseManager } from './manager.js';

package/dist/pause/log-store.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Log-backed pause store: resource-free long pauses as a view over the
+ * execution log.
+ *
+ * In durable mode the execution log holds the full pause record — a
+ * `pause.created` event carries the pause state (deadline, resume triggers,
+ * captured checkpoint), and `pause.resumed` records how and when it ended. A
+ * paused run, and the timer or webhook it waits on, are therefore reconstructable
+ * from the log alone, with no separate pause file. This adapter folds those
+ * events back into {@link PauseState}.
+ */
+import type { ExecutionLogStore } from '../execution-log/index.js';
+import type { PauseStore } from './store.js';
+import type { PauseState } from './state.js';
+export declare class LogBackedPauseStore implements PauseStore {
+    private log;
+    constructor(log: ExecutionLogStore);
+    save(pause: PauseState): Promise<void>;
+    update(id: string, updates: Partial<PauseState>): Promise<void>;
+    load(id: string): Promise<PauseState | null>;
+    loadByExecution(executionId: string): Promise<PauseState | null>;
+    listActive(): Promise<PauseState[]>;
+    listByMission(mission: string): Promise<PauseState[]>;
+    findExpired(): Promise<PauseState[]>;
+    /** Append-only: deletion is a no-op (history is retained in the log). */
+    delete(): Promise<void>;
+    private allPauses;
+    /**
+     * Fold pause events into the latest state per pause id. A `pause.created`
+     * seeds the state; later `pause.resumed` events apply the terminal status.
+     */
+    private foldPauses;
+}