@pipelex/sdk 0.47.0 → 0.48.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +9 -7
- package/dist/artifacts.d.ts +4 -3
- package/dist/artifacts.js +20 -14
- package/dist/artifacts.js.map +1 -1
- package/dist/cli/script.d.ts +1 -1
- package/dist/cli/source.d.ts +8 -7
- package/dist/cli/source.js +11 -5
- package/dist/cli/source.js.map +1 -1
- package/dist/client.d.ts +326 -213
- package/dist/client.js +829 -517
- package/dist/client.js.map +1 -1
- package/dist/codegen-check.d.ts +2 -3
- package/dist/codegen-check.js +2 -3
- package/dist/codegen-check.js.map +1 -1
- package/dist/errors.d.ts +5 -2
- package/dist/errors.js +5 -2
- package/dist/errors.js.map +1 -1
- package/dist/hooks/bundle-gather.d.ts +47 -40
- package/dist/hooks/bundle-gather.js +121 -219
- package/dist/hooks/bundle-gather.js.map +1 -1
- package/dist/hooks/check-core.d.ts +70 -6
- package/dist/hooks/check-core.js +188 -29
- package/dist/hooks/check-core.js.map +1 -1
- package/dist/hooks/claude-mthds-check.d.ts +19 -5
- package/dist/hooks/claude-mthds-check.js +20 -53
- package/dist/hooks/claude-mthds-check.js.map +1 -1
- package/dist/hooks/secret-guard.d.ts +38 -0
- package/dist/hooks/secret-guard.js +134 -0
- package/dist/hooks/secret-guard.js.map +1 -0
- package/dist/hooks/validate-stage.d.ts +29 -0
- package/dist/hooks/validate-stage.js +66 -0
- package/dist/hooks/validate-stage.js.map +1 -0
- package/dist/index.d.ts +3 -4
- package/dist/index.js +4 -3
- package/dist/index.js.map +1 -1
- package/dist/method-trees.d.ts +220 -74
- package/dist/method-trees.js +250 -37
- package/dist/method-trees.js.map +1 -1
- package/dist/models.d.ts +162 -59
- package/dist/node-host/node.d.ts +33 -0
- package/dist/node-host/node.js +27 -0
- package/dist/node-host/node.js.map +1 -0
- package/dist/node-host/unavailable.d.ts +8 -0
- package/dist/node-host/unavailable.js +8 -0
- package/dist/node-host/unavailable.js.map +1 -0
- package/dist/node-host.d.ts +53 -0
- package/dist/node-host.js +72 -0
- package/dist/node-host.js.map +1 -0
- package/dist/prepare-inputs.d.ts +46 -27
- package/dist/prepare-inputs.js +123 -42
- package/dist/prepare-inputs.js.map +1 -1
- package/dist/product-models.d.ts +14 -16
- package/dist/upload.d.ts +4 -9
- package/dist/upload.js +13 -16
- package/dist/upload.js.map +1 -1
- package/dist/version.d.ts +1 -1
- package/dist/version.js +1 -1
- package/docs/architecture.md +44 -21
- package/docs/cli.md +1 -1
- package/docs/crate-routes.md +43 -21
- package/docs/errors.md +5 -5
- package/docs/hook-bundle.md +27 -1
- package/docs/input-preparation.md +13 -13
- package/docs/method-trees.md +120 -22
- package/docs/run-results.md +5 -2
- package/package.json +8 -2
- package/dist/bundle-resources.d.ts +0 -62
- package/dist/bundle-resources.js +0 -165
- package/dist/bundle-resources.js.map +0 -1
- package/docs/bundle-resources.md +0 -107
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"claude-mthds-check.js","sourceRoot":"","sources":["../../src/hooks/claude-mthds-check.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"claude-mthds-check.js","sourceRoot":"","sources":["../../src/hooks/claude-mthds-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,aAAa,EACb,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,aAAa,EACb,kBAAkB,EAClB,uBAAuB,GAIxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAIvD,KAAK,UAAU,SAAS;IACtB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,aAAa,CAAC,IAAc;IACnC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;gBAChE,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+DAA+D;AAC/D,SAAS,cAAc,CAAC,QAAgB;IACtC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CACrB,QAAsB,EACtB,SAAiB;IAEjB,IAAI,UAAoB,CAAC;IACzB,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,QAAQ,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;YACjD,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,MAAM;QACR,CAAC;QACD,KAAK,OAAO;YACV,OAAO,kBAAkB,CAAC,wBAAwB,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;QAChG,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,SAAS,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;YACtD,UAAU,GAAG,SAAS;gBACpB,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;gBACnE,CAAC,CAAC,EAAE,CAAC;YACP,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,UAAU;IACvB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACnD,+BAA+B;IAC/B,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAClC,OAAO,CAAC,IAAI,GAAG,CAAC,GAAG,IAAe,EAAE,EAAE;QACpC,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;YAC7E,OAAO;QACT,CAAC;QACD,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;IAC5B,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,IAAI,GAAG,YAAY,CAAC;IAC9B,CAAC;IACD,8BAA8B;IAC9B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6FAA6F;AAC7F,SAAS,IAAI,CAAC,OAAoB,EAAE,QAAsB;IACxD,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,OAAO,EAAE,CAAC;QACZ,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,mDAAmD;AACnD,SAAS,IAAI,CAAC,OAAe;IAC3B,aAAa,CAAC,CAAC,EAAE,gBAAgB,OAAO,IAAI,CAAC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CAAC,MAAuB,EAAE,QAAgB;IACnE,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,kEAAkE;IAC7F,CAAC;IAED,uBAAuB;IACvB,MAAM,SAAS,GAAc;QAC3B,MAAM,EAAE,aAAa;QACrB,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,WAAW;KACnD,CAAC;IACF,MAAM,WAAW,GAAG,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACzD,IAAI,WAAW,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAChC,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,mEAAmE;IACnE,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;YACtB,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,CAAC,2BAA2B,OAAO,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,yBAAyB;IACzB,OAAO,mBAAmB,CAAC,QAAQ,EAAE,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,cAAc,CAAC,QAAQ,EAAE,MAAM,SAAS,EAAE,CAAC,CAAC;IAE3E,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,wFAAwF;QACxF,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,QAAQ,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED,IAAI,EAAE;KACH,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IACtB,kEAAkE;IAClE,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,CAAC,2BAA2B,OAAO,EAAE,CAAC,CAAC;AAC7C,CAAC,CAAC;KACD,OAAO,CAAC,GAAG,EAAE;IACZ,0EAA0E;IAC1E,sEAAsE;IACtE,6BAA6B;IAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
|
|
@@ -0,0 +1,38 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* The hook's secret guard: before the validate stage sends a method's tree, it finds each file
|
|
3
|
+
* whose NAME is a known secret file, or whose TEXT holds a well-known key format, in whatever
|
|
4
|
+
* encoding the file is written, so that file never leaves the machine.
|
|
5
|
+
*
|
|
6
|
+
* The rule is the workshop's, pipelex-mcp's `src/capabilities/secret-guard.ts`, with the
|
|
7
|
+
* refinements this copy is ahead on until the workshop takes them up (L-261022-b4770f): an SSH key
|
|
8
|
+
* is found by its default name only when the name is exactly that, and a PEM private key block
|
|
9
|
+
* only when a key's body follows its header. Every other rule is the workshop's, and changes with
|
|
10
|
+
* it. The membership rule already keeps the commonest secret files out by construction,
|
|
11
|
+
* since `.env`, `.ssh/`, `.aws/` and every other dotfile start with a dot. What it cannot keep
|
|
12
|
+
* out is a key file under an ordinary name, or a key pasted into an ordinary file, a Python
|
|
13
|
+
* module being the usual home of one, which is why the guard reads text and not names alone.
|
|
14
|
+
* It is a tripwire for the well-known shapes, never a promise that a tree holds no secret: a
|
|
15
|
+
* password in prose, a scanned contract or a payslip goes through it.
|
|
16
|
+
*
|
|
17
|
+
* A finding names the file and what matched, and **never the matched text**, since the hook's
|
|
18
|
+
* output is shown to a model and may be logged.
|
|
19
|
+
*
|
|
20
|
+
* Pure: it reads the bytes it is handed and nothing else.
|
|
21
|
+
*/
|
|
22
|
+
/** One file the guard finds, and why, in words that quote nothing of the file. */
|
|
23
|
+
export interface SecretFinding {
|
|
24
|
+
/** The file's tree path. */
|
|
25
|
+
path: string;
|
|
26
|
+
/** What it is, or what it holds: "it holds a private key block (PEM)". */
|
|
27
|
+
reason: string;
|
|
28
|
+
}
|
|
29
|
+
/**
|
|
30
|
+
* The files of a tree the guard finds, in the order given. A file whose name is a secret file's
|
|
31
|
+
* is found on the name alone, unless its rule's `unless` says its bytes are something else; every
|
|
32
|
+
* other file, text in any encoding or binary, is searched for every key format in the texts
|
|
33
|
+
* {@link searchableTexts} reads from its bytes.
|
|
34
|
+
*/
|
|
35
|
+
export declare function secretFindings(files: Iterable<{
|
|
36
|
+
path: string;
|
|
37
|
+
bytes: Uint8Array;
|
|
38
|
+
}>): SecretFinding[];
|
|
@@ -0,0 +1,134 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* The hook's secret guard: before the validate stage sends a method's tree, it finds each file
|
|
3
|
+
* whose NAME is a known secret file, or whose TEXT holds a well-known key format, in whatever
|
|
4
|
+
* encoding the file is written, so that file never leaves the machine.
|
|
5
|
+
*
|
|
6
|
+
* The rule is the workshop's, pipelex-mcp's `src/capabilities/secret-guard.ts`, with the
|
|
7
|
+
* refinements this copy is ahead on until the workshop takes them up (L-261022-b4770f): an SSH key
|
|
8
|
+
* is found by its default name only when the name is exactly that, and a PEM private key block
|
|
9
|
+
* only when a key's body follows its header. Every other rule is the workshop's, and changes with
|
|
10
|
+
* it. The membership rule already keeps the commonest secret files out by construction,
|
|
11
|
+
* since `.env`, `.ssh/`, `.aws/` and every other dotfile start with a dot. What it cannot keep
|
|
12
|
+
* out is a key file under an ordinary name, or a key pasted into an ordinary file, a Python
|
|
13
|
+
* module being the usual home of one, which is why the guard reads text and not names alone.
|
|
14
|
+
* It is a tripwire for the well-known shapes, never a promise that a tree holds no secret: a
|
|
15
|
+
* password in prose, a scanned contract or a payslip goes through it.
|
|
16
|
+
*
|
|
17
|
+
* A finding names the file and what matched, and **never the matched text**, since the hook's
|
|
18
|
+
* output is shown to a model and may be logged.
|
|
19
|
+
*
|
|
20
|
+
* Pure: it reads the bytes it is handed and nothing else.
|
|
21
|
+
*/
|
|
22
|
+
/** Whether the bytes open with a zip archive's local file header, `PK\x03\x04`. */
|
|
23
|
+
function isZipArchive(bytes) {
|
|
24
|
+
return bytes[0] === 0x50 && bytes[1] === 0x4b && bytes[2] === 0x03 && bytes[3] === 0x04;
|
|
25
|
+
}
|
|
26
|
+
/**
|
|
27
|
+
* Secret file names, matched on the last segment of a tree path, ignoring case: key and
|
|
28
|
+
* certificate stores, SSH private keys under their default names, and the credential exports of
|
|
29
|
+
* the cloud consoles. A rule with `unless` lets a file of that name go when its bytes show it is
|
|
30
|
+
* something else.
|
|
31
|
+
*
|
|
32
|
+
* `.pem` is no name rule: a `.pem` file is as often a certificate, which is public, and a private
|
|
33
|
+
* key in one is a PEM block, which the text search finds. A `.key` file is a Keynote deck as
|
|
34
|
+
* often as a key, and a deck is a zip archive, so only a `.key` file that is no zip is found by
|
|
35
|
+
* name, which still catches a DER key, binary and holding no PEM block.
|
|
36
|
+
*
|
|
37
|
+
* An SSH key's default name is matched whole, with the `_sk` of a hardware-backed key, so its
|
|
38
|
+
* `.pub` half, which is public, and a file merely starting with the name, such as
|
|
39
|
+
* `id_rsa_utils.py`, go. Nothing is lost: every SSH private key is PEM-armoured, which the text
|
|
40
|
+
* search finds under any name.
|
|
41
|
+
*/
|
|
42
|
+
const SECRET_NAMES = [
|
|
43
|
+
{
|
|
44
|
+
pattern: /\.key$/i,
|
|
45
|
+
reason: "a key file (.key), and is no zip archive as a Keynote deck is",
|
|
46
|
+
unless: isZipArchive,
|
|
47
|
+
},
|
|
48
|
+
{ pattern: /\.(p12|pfx|jks|keystore)$/i, reason: "a certificate or key store" },
|
|
49
|
+
{ pattern: /\.ppk$/i, reason: "a PuTTY private key" },
|
|
50
|
+
{ pattern: /\.kdbx$/i, reason: "a KeePass password database" },
|
|
51
|
+
{
|
|
52
|
+
pattern: /^id_(?:rsa|dsa|ecdsa|ed25519)(?:_sk)?$/i,
|
|
53
|
+
reason: "an SSH key under its default name",
|
|
54
|
+
},
|
|
55
|
+
{ pattern: /^credentials(\.json)?$/i, reason: "a credentials file" },
|
|
56
|
+
{ pattern: /^client_secret.*\.json$/i, reason: "an OAuth client secret export" },
|
|
57
|
+
];
|
|
58
|
+
/**
|
|
59
|
+
* Well-known key formats, matched in a file's text. Each is a prefix a provider puts on its keys
|
|
60
|
+
* so that scanners can find them, with enough of the key's body after it that prose mentioning
|
|
61
|
+
* the prefix does not match.
|
|
62
|
+
*
|
|
63
|
+
* A PEM private key block is its header followed by a run of Base64 as long as a key's body
|
|
64
|
+
* lines, where a key's body sits: directly on the header's line, as in a key flattened onto one
|
|
65
|
+
* line, or at the start of a line within a short span after the header, the line break written as
|
|
66
|
+
* a real one or as the `\n` of a key escaped into JSON, its indentation allowed, the span holding
|
|
67
|
+
* the `Proc-Type` and `DEK-Info` headers of an encrypted legacy key. A header named in prose, such
|
|
68
|
+
* as a prompt telling a model what a key looks like, has no such run there, even when a long path
|
|
69
|
+
* or link follows it in the sentence, so it goes.
|
|
70
|
+
*/
|
|
71
|
+
const KEY_FORMATS = [
|
|
72
|
+
{
|
|
73
|
+
pattern: /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----(?:[ \t]*|[\s\S]{0,200}?(?:\n|\\n)[ \t]*)[A-Za-z0-9+/]{40,}/,
|
|
74
|
+
reason: "a private key block (PEM)",
|
|
75
|
+
},
|
|
76
|
+
{ pattern: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/, reason: "an AWS access key id" },
|
|
77
|
+
{ pattern: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/, reason: "a GitHub token" },
|
|
78
|
+
{ pattern: /\bgithub_pat_[A-Za-z0-9_]{22,}/, reason: "a GitHub fine-grained token" },
|
|
79
|
+
{ pattern: /\bglpat-[A-Za-z0-9_-]{20,}/, reason: "a GitLab token" },
|
|
80
|
+
{ pattern: /\bxox[abprs]-[A-Za-z0-9-]{10,}/, reason: "a Slack token" },
|
|
81
|
+
{ pattern: /\b(?:sk|rk)_live_[A-Za-z0-9]{16,}/, reason: "a Stripe live key" },
|
|
82
|
+
{ pattern: /\bAIza[0-9A-Za-z_-]{35}/, reason: "a Google API key" },
|
|
83
|
+
{ pattern: /\bsk-ant-[A-Za-z0-9_-]{20,}/, reason: "an Anthropic API key" },
|
|
84
|
+
{
|
|
85
|
+
pattern: /\bsk-(?:proj|svcacct|admin)-[A-Za-z0-9_-]{20,}/,
|
|
86
|
+
reason: "an OpenAI API key",
|
|
87
|
+
},
|
|
88
|
+
{ pattern: /\bsk-[A-Za-z0-9]{32,}\b/, reason: "an OpenAI-style secret key" },
|
|
89
|
+
{ pattern: /\bhf_[A-Za-z0-9]{30,}\b/, reason: "a Hugging Face token" },
|
|
90
|
+
{ pattern: /\bnpm_[A-Za-z0-9]{36}\b/, reason: "an npm token" },
|
|
91
|
+
{ pattern: /\bplx_sk_[A-Za-z0-9_-]{16,}/, reason: "a Pipelex API key" },
|
|
92
|
+
];
|
|
93
|
+
/**
|
|
94
|
+
* Bytes read one character per byte. The WHATWG `latin1` decoder is windows-1252, which maps
|
|
95
|
+
* every byte to exactly one character and every ASCII byte to itself, and every key format is
|
|
96
|
+
* ASCII matched with ASCII word boundaries, so it finds what Node's Latin-1 decoding, the
|
|
97
|
+
* workshop's, finds, without reaching for `Buffer`.
|
|
98
|
+
*/
|
|
99
|
+
const ONE_CHARACTER_PER_BYTE = new TextDecoder("latin1");
|
|
100
|
+
/**
|
|
101
|
+
* The texts a file's bytes are searched in. Every key format is ASCII, so the bytes are read one
|
|
102
|
+
* character per byte, which keeps every ASCII run of them whatever the file's encoding: UTF-8,
|
|
103
|
+
* Latin-1, cp1252, or a binary file with a key inside it. A file holding NUL bytes is searched
|
|
104
|
+
* once more with them removed, which is how an ASCII key reads in UTF-16, with or without its
|
|
105
|
+
* byte order mark, and in UTF-32.
|
|
106
|
+
*/
|
|
107
|
+
function searchableTexts(bytes) {
|
|
108
|
+
const text = ONE_CHARACTER_PER_BYTE.decode(bytes);
|
|
109
|
+
return text.includes("\0") ? [text, text.replaceAll("\0", "")] : [text];
|
|
110
|
+
}
|
|
111
|
+
/**
|
|
112
|
+
* The files of a tree the guard finds, in the order given. A file whose name is a secret file's
|
|
113
|
+
* is found on the name alone, unless its rule's `unless` says its bytes are something else; every
|
|
114
|
+
* other file, text in any encoding or binary, is searched for every key format in the texts
|
|
115
|
+
* {@link searchableTexts} reads from its bytes.
|
|
116
|
+
*/
|
|
117
|
+
export function secretFindings(files) {
|
|
118
|
+
const findings = [];
|
|
119
|
+
for (const file of files) {
|
|
120
|
+
const name = file.path.slice(file.path.lastIndexOf("/") + 1);
|
|
121
|
+
const byName = SECRET_NAMES.find((rule) => rule.pattern.test(name) && rule.unless?.(file.bytes) !== true);
|
|
122
|
+
if (byName !== undefined) {
|
|
123
|
+
findings.push({ path: file.path, reason: `it is named like ${byName.reason}` });
|
|
124
|
+
continue;
|
|
125
|
+
}
|
|
126
|
+
const texts = searchableTexts(file.bytes);
|
|
127
|
+
const held = KEY_FORMATS.filter((format) => texts.some((text) => format.pattern.test(text))).map((format) => format.reason);
|
|
128
|
+
if (held.length > 0) {
|
|
129
|
+
findings.push({ path: file.path, reason: `it holds ${[...new Set(held)].join(" and ")}` });
|
|
130
|
+
}
|
|
131
|
+
}
|
|
132
|
+
return findings;
|
|
133
|
+
}
|
|
134
|
+
//# sourceMappingURL=secret-guard.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"secret-guard.js","sourceRoot":"","sources":["../../src/hooks/secret-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAUH,mFAAmF;AACnF,SAAS,YAAY,CAAC,KAAiB;IACrC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;AAC1F,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,YAAY,GAIZ;IACJ;QACE,OAAO,EAAE,SAAS;QAClB,MAAM,EAAE,+DAA+D;QACvE,MAAM,EAAE,YAAY;KACrB;IACD,EAAE,OAAO,EAAE,4BAA4B,EAAE,MAAM,EAAE,4BAA4B,EAAE;IAC/E,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE;IACrD,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,6BAA6B,EAAE;IAC9D;QACE,OAAO,EAAE,yCAAyC;QAClD,MAAM,EAAE,mCAAmC;KAC5C;IACD,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,oBAAoB,EAAE;IACpE,EAAE,OAAO,EAAE,0BAA0B,EAAE,MAAM,EAAE,+BAA+B,EAAE;CACjF,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,GAAmD;IAClE;QACE,OAAO,EACL,kHAAkH;QACpH,MAAM,EAAE,2BAA2B;KACpC;IACD,EAAE,OAAO,EAAE,+BAA+B,EAAE,MAAM,EAAE,sBAAsB,EAAE;IAC5E,EAAE,OAAO,EAAE,gCAAgC,EAAE,MAAM,EAAE,gBAAgB,EAAE;IACvE,EAAE,OAAO,EAAE,gCAAgC,EAAE,MAAM,EAAE,6BAA6B,EAAE;IACpF,EAAE,OAAO,EAAE,4BAA4B,EAAE,MAAM,EAAE,gBAAgB,EAAE;IACnE,EAAE,OAAO,EAAE,gCAAgC,EAAE,MAAM,EAAE,eAAe,EAAE;IACtE,EAAE,OAAO,EAAE,mCAAmC,EAAE,MAAM,EAAE,mBAAmB,EAAE;IAC7E,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,kBAAkB,EAAE;IAClE,EAAE,OAAO,EAAE,6BAA6B,EAAE,MAAM,EAAE,sBAAsB,EAAE;IAC1E;QACE,OAAO,EAAE,gDAAgD;QACzD,MAAM,EAAE,mBAAmB;KAC5B;IACD,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,4BAA4B,EAAE;IAC5E,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,sBAAsB,EAAE;IACtE,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,cAAc,EAAE;IAC9D,EAAE,OAAO,EAAE,6BAA6B,EAAE,MAAM,EAAE,mBAAmB,EAAE;CACxE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC;AAEzD;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,KAAiB;IACxC,MAAM,IAAI,GAAG,sBAAsB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAoD;IAEpD,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAC9B,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CACxE,CAAC;QACF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,oBAAoB,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAChF,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CACzC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAChD,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}
|
|
@@ -0,0 +1,29 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* The `.mthds` post-edit hook's networked stage: the edited file's method tree validated through
|
|
3
|
+
* the SDK (`POST /v1/validate`, `allow_signatures: true`), held to one deadline over the whole
|
|
4
|
+
* stage, so the hook never outlasts its harness's patience whatever the network does.
|
|
5
|
+
*/
|
|
6
|
+
import type { PipelexApiClient } from "../client.js";
|
|
7
|
+
import type { ValidateStage } from "./check-core.js";
|
|
8
|
+
/**
|
|
9
|
+
* The deadline over the whole validate stage, well under the hook's overall timeout: the version
|
|
10
|
+
* handshake, the blob route, the uploads of the files the API lacks (a tree up to the gatherer's
|
|
11
|
+
* caps, 12 MiB) and the validation itself all run under it.
|
|
12
|
+
*/
|
|
13
|
+
export declare const VALIDATE_TIMEOUT_MS = 10000;
|
|
14
|
+
/** What the stage may be handed instead of what it builds from the environment. */
|
|
15
|
+
export interface ValidateStageOptions {
|
|
16
|
+
/** The client to validate through; by default the hook's, given a `PIPELEX_API_KEY`. */
|
|
17
|
+
readonly client?: Pick<PipelexApiClient, "validate">;
|
|
18
|
+
/** The stage's deadline, `VALIDATE_TIMEOUT_MS` by default. */
|
|
19
|
+
readonly timeoutMs?: number;
|
|
20
|
+
}
|
|
21
|
+
/**
|
|
22
|
+
* Run the networked validate stage on `filePath`. Every no-verdict condition maps to
|
|
23
|
+
* `unavailable` — no API key, a tree the gatherer cannot list whole, the deadline running out, any
|
|
24
|
+
* failure of the client — so a machine consumer branches on the structured verdict, never on
|
|
25
|
+
* transport, and the lint and format verdicts the hook already applied stand. A bundle or the
|
|
26
|
+
* manifest that looks like a secret is `refused`, with nothing sent, and a verdict names the files
|
|
27
|
+
* of the tree the gatherer kept home as `withheld`.
|
|
28
|
+
*/
|
|
29
|
+
export declare function runValidateStage(filePath: string, options?: ValidateStageOptions): Promise<ValidateStage>;
|
|
@@ -0,0 +1,66 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* The `.mthds` post-edit hook's networked stage: the edited file's method tree validated through
|
|
3
|
+
* the SDK (`POST /v1/validate`, `allow_signatures: true`), held to one deadline over the whole
|
|
4
|
+
* stage, so the hook never outlasts its harness's patience whatever the network does.
|
|
5
|
+
*/
|
|
6
|
+
import { gatherMethodTree } from "./bundle-gather.js";
|
|
7
|
+
import { createHookClient } from "./validate-client.js";
|
|
8
|
+
/**
|
|
9
|
+
* The deadline over the whole validate stage, well under the hook's overall timeout: the version
|
|
10
|
+
* handshake, the blob route, the uploads of the files the API lacks (a tree up to the gatherer's
|
|
11
|
+
* caps, 12 MiB) and the validation itself all run under it.
|
|
12
|
+
*/
|
|
13
|
+
export const VALIDATE_TIMEOUT_MS = 10_000;
|
|
14
|
+
/**
|
|
15
|
+
* Run the networked validate stage on `filePath`. Every no-verdict condition maps to
|
|
16
|
+
* `unavailable` — no API key, a tree the gatherer cannot list whole, the deadline running out, any
|
|
17
|
+
* failure of the client — so a machine consumer branches on the structured verdict, never on
|
|
18
|
+
* transport, and the lint and format verdicts the hook already applied stand. A bundle or the
|
|
19
|
+
* manifest that looks like a secret is `refused`, with nothing sent, and a verdict names the files
|
|
20
|
+
* of the tree the gatherer kept home as `withheld`.
|
|
21
|
+
*/
|
|
22
|
+
export async function runValidateStage(filePath, options = {}) {
|
|
23
|
+
if (options.client === undefined && !process.env.PIPELEX_API_KEY) {
|
|
24
|
+
return { status: "unavailable" };
|
|
25
|
+
}
|
|
26
|
+
// One deadline over the whole stage: the signal reaches every request and upload the
|
|
27
|
+
// validation makes, each stopped in flight once it fires, so nothing keeps running after the
|
|
28
|
+
// hook has given up on it.
|
|
29
|
+
const deadline = AbortSignal.timeout(options.timeoutMs ?? VALIDATE_TIMEOUT_MS);
|
|
30
|
+
try {
|
|
31
|
+
// Inside the try: a gather that throws fails this stage open, as any other no-verdict
|
|
32
|
+
// condition does, rather than rejecting the hook and losing the other files' outcomes.
|
|
33
|
+
const gathered = await gatherMethodTree(filePath);
|
|
34
|
+
if (!gathered.ok) {
|
|
35
|
+
return gathered.reason === "secret"
|
|
36
|
+
? { status: "refused", root: gathered.root, withheld: gathered.withheld }
|
|
37
|
+
: { status: "unavailable" };
|
|
38
|
+
}
|
|
39
|
+
const withheld = gathered.withheld;
|
|
40
|
+
const client = options.client ?? createHookClient();
|
|
41
|
+
const result = await client.validate({ tree: gathered.tree }, true, { signal: deadline });
|
|
42
|
+
if (result.is_valid === true) {
|
|
43
|
+
return {
|
|
44
|
+
status: "valid",
|
|
45
|
+
pendingSignatures: Array.isArray(result.pending_signatures)
|
|
46
|
+
? result.pending_signatures
|
|
47
|
+
: [],
|
|
48
|
+
withheld,
|
|
49
|
+
};
|
|
50
|
+
}
|
|
51
|
+
if (result.is_valid === false) {
|
|
52
|
+
return {
|
|
53
|
+
status: "invalid",
|
|
54
|
+
message: result.message,
|
|
55
|
+
validationErrors: Array.isArray(result.validation_errors) ? result.validation_errors : [],
|
|
56
|
+
renderedMarkdown: result.rendered_markdown,
|
|
57
|
+
withheld,
|
|
58
|
+
};
|
|
59
|
+
}
|
|
60
|
+
return { status: "unavailable" }; // no discriminant — no verdict
|
|
61
|
+
}
|
|
62
|
+
catch {
|
|
63
|
+
return { status: "unavailable" };
|
|
64
|
+
}
|
|
65
|
+
}
|
|
66
|
+
//# sourceMappingURL=validate-stage.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"validate-stage.js","sourceRoot":"","sources":["../../src/hooks/validate-stage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAU1C;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,UAAgC,EAAE;IAElC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;QACjE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACnC,CAAC;IACD,qFAAqF;IACrF,6FAA6F;IAC7F,2BAA2B;IAC3B,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,mBAAmB,CAAC,CAAC;IAC/E,IAAI,CAAC;QACH,sFAAsF;QACtF,uFAAuF;QACvF,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ;gBACjC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;gBACzE,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QAChC,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;QACnC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,gBAAgB,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC1F,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC7B,OAAO;gBACL,MAAM,EAAE,OAAO;gBACf,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC;oBACzD,CAAC,CAAC,MAAM,CAAC,kBAAkB;oBAC3B,CAAC,CAAC,EAAE;gBACN,QAAQ;aACT,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC9B,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE;gBACzF,gBAAgB,EAAE,MAAM,CAAC,iBAAiB;gBAC1C,QAAQ;aACT,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC,+BAA+B;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACnC,CAAC;AACH,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -12,10 +12,9 @@ export * from "mthds/protocol";
|
|
|
12
12
|
export { PipelexApiClient, DEFAULT_API_BASE_URL, isGatewayCutOff } from "./client.js";
|
|
13
13
|
export { buildUserAgent, validateAppInfo, MAX_USER_AGENT_LENGTH } from "./user-agent.js";
|
|
14
14
|
export type { AppInfo, RuntimeInfo } from "./user-agent.js";
|
|
15
|
-
export type {
|
|
16
|
-
export type { BundleResourceBytes, BundleResources } from "./bundle-resources.js";
|
|
15
|
+
export type { PipelexApiRunExtensions, PipelexHostedRunExtensions, PipelexRunOptions, PipelexStartOptions, PipelexStartRequestOptions, PipelexValidateSource, ValidateMethodSelector, ValidateOptions, PipelexApiClientOptions, } from "./client.js";
|
|
17
16
|
export { INLINE_TREE_MAX_BYTES } from "./method-trees.js";
|
|
18
|
-
export type {
|
|
17
|
+
export type { MethodTreeForms, MethodTreeLimits } from "./method-trees.js";
|
|
19
18
|
export { parseMethodSelector } from "./method-selector.js";
|
|
20
19
|
export type { ParsedMethodSelector } from "./method-selector.js";
|
|
21
20
|
export { ExactJsonUnsupportedError, parseExactJson, stringifyExactJson } from "./exact-json.js";
|
|
@@ -27,7 +26,7 @@ export type { InputFormFault, PrepareInputsBase, PrepareInputsClosure, PrepareIn
|
|
|
27
26
|
export { inputFormFault } from "./prepare-inputs.js";
|
|
28
27
|
export { locateArtifacts, collectArtifacts, artifactFilename, PIPELEX_STORAGE_SCHEME, BULK_RESOLVE_MAX_URIS, DEFAULT_ARTIFACT_MAX_BYTES, DEFAULT_ARTIFACT_TIMEOUT_MS, DEFAULT_DOWNLOAD_MAX_TOTAL_BYTES, DEFAULT_DOWNLOAD_CONCURRENCY, } from "./artifacts.js";
|
|
29
28
|
export type { ArtifactItemError, ArtifactLocation, ArtifactScope, BulkResolveStorageUrlsInput, BulkResolvedStorageUrls, DownloadArtifactsOptions, DownloadArtifactsRequest, DownloadArtifactsResult, DownloadedArtifact, FetchArtifactOptions, ResolvedArtifact, } from "./artifacts.js";
|
|
30
|
-
export type { DiagnosticKind, DiagnosticRange, Diagnostic, LintResponse, FormatResponse, DictStuff, DictWorkingMemory, DictPipeOutput, DictRunResultExecute, MethodProvenance, PipelexRunResultStart, PipelexHostedToolingExtensions, DryRunStatus, ValidatedPipeEntry, LiftablePipeEntry, PipelexValidationReport, PipelexInvalidReport, PipelexValidationResult, ValidationErrorCategory, ValidationErrorItem, FixSafety, FixOpKind, TomlScalar, TomlValue, FixValue, SetKeyOp, EnsureTableOp, DeleteKeyOp, DeleteTableOp, RenameTableKeyOp, MoveKeyOp, RemapValueOp, FixOp, SuggestedFix,
|
|
29
|
+
export type { DiagnosticKind, DiagnosticRange, Diagnostic, LintResponse, FormatResponse, DictStuff, DictWorkingMemory, DictPipeOutput, DictRunResultExecute, MethodProvenance, PipelexRunResultStart, PipelexHostedToolingExtensions, DryRunStatus, ValidatedPipeEntry, LiftablePipeEntry, TreeFileUse, TreeFileRead, PipelexValidationReport, PipelexInvalidReport, PipelexValidationResult, ValidationErrorCategory, ValidationErrorItem, FixSafety, FixOpKind, TomlScalar, TomlValue, FixValue, SetKeyOp, EnsureTableOp, DeleteKeyOp, DeleteTableOp, RenameTableKeyOp, MoveKeyOp, RemapValueOp, FixOp, SuggestedFix, CrateRequestBase, CrateRouteOptions, CrateInvalidReport, GeneratedArtifact, ResolveRequest, ResolveValidReport, ResolveResponse, CodegenKind, CodegenTarget, CodegenRequest, CodegenValidReport, CodegenResponse, PipeIORequest, PipeIOValidReport, PipeIOResponse, ModelCheckCategory, ModelReferenceKind, ModelReferenceResolution, ModelReferenceMatchBase, PresetMatch, AliasMatch, WaterfallMatch, HandleMatch, ModelReferenceMatch, ModelReferenceVerdictBase, PresetReferenceVerdict, AliasReferenceVerdict, WaterfallReferenceVerdict, HandleReferenceVerdict, ModelReferenceVerdict, } from "./models.js";
|
|
31
30
|
export { runCodegenCheck, isStampableArtifactPath, STAMPABLE_ARTIFACT_SUFFIXES, CodegenLockError, } from "./codegen-check.js";
|
|
32
31
|
export type { CodegenCheckInput, CodegenCheckReport, CodegenDrift, CodegenDriftCategory, CodegenTreeFile, } from "./codegen-check.js";
|
|
33
32
|
export type { UserProfile, ListMethodExamplesQuery, ListMethodsQuery, ListMethodVersionsQuery, MethodData, MethodDeletionAccepted, MethodDeletionState, MethodDetail, MethodDraftInput, MethodExample, MethodExampleCreateInput, MethodExampleLatestRunInput, MethodExampleLatestRunOutcome, MethodExampleLatestRunRecorded, MethodExampleLatestRunResult, MethodExampleLatestRunStale, MethodExamplePage, MethodExampleUpdateInput, MethodPage, MethodPublished, MethodPublishInput, MethodPublishOutcome, MethodPublishRefusalReason, MethodPublishRefused, MethodPublishResult, MethodPublishUnchanged, MethodRenameInput, MethodSummary, MethodTreeInput, MethodVersion, MethodVersionPage, MethodVersionSummary, MethodWriteInput, SavedMethodFile, Membership, MembershipsResponse, OrgRole, SubscriptionResponse, PlanView, InvoiceView, CheckoutResponse, ChangePlanResponse, BillingPortalResponse, PipelexApiKey, PipelexApiKeyCreated, PipelexApiKeyList, OnboardingRole, OnboardingCurrentTool, OnboardingInputType, OnboardingHeardFrom, OnboardingSubmission, ResolvedStorageUrl, UploadInput, UploadedFile, UploadGrantInput, UploadGrant, ListRunsQuery, PipelineRun, RunDetail, RunHistoryItem, RunPage, UpdateRunInput, } from "./product-models.js";
|
package/dist/index.js
CHANGED
|
@@ -19,9 +19,10 @@ export { PipelexApiClient, DEFAULT_API_BASE_URL, isGatewayCutOff } from "./clien
|
|
|
19
19
|
// makes its own raw requests to the API sends the same value, and can check an `appInfo`
|
|
20
20
|
// against the grammar and the length ceiling before constructing a client.
|
|
21
21
|
export { buildUserAgent, validateAppInfo, MAX_USER_AGENT_LENGTH } from "./user-agent.js";
|
|
22
|
-
// A
|
|
23
|
-
//
|
|
24
|
-
//
|
|
22
|
+
// A method's tree: the four forms every method-taking route takes it in, the limits
|
|
23
|
+
// `methodTreeLimits` reports, and the inline threshold below which a tree travels whole. The
|
|
24
|
+
// standard's own tree types (`MethodTreeSource`, `BlobRef`, `MissingBlobsResult` and the rest)
|
|
25
|
+
// come with the `mthds/protocol` re-export above.
|
|
25
26
|
export { INLINE_TREE_MAX_BYTES } from "./method-trees.js";
|
|
26
27
|
// A method selector (`mt_…`, `mt_…@<n>`, `mt_…@draft`) → its bare id and the version it names.
|
|
27
28
|
export { parseMethodSelector } from "./method-selector.js";
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,6FAA6F;AAC7F,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,oFAAoF;AACpF,kFAAkF;AAClF,mFAAmF;AACnF,wBAAwB;AACxB,cAAc,gBAAgB,CAAC;AAE/B,wEAAwE;AACxE,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACtF,sFAAsF;AACtF,yFAAyF;AACzF,2EAA2E;AAC3E,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,6FAA6F;AAC7F,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,oFAAoF;AACpF,kFAAkF;AAClF,mFAAmF;AACnF,wBAAwB;AACxB,cAAc,gBAAgB,CAAC;AAE/B,wEAAwE;AACxE,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACtF,sFAAsF;AACtF,yFAAyF;AACzF,2EAA2E;AAC3E,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAczF,oFAAoF;AACpF,6FAA6F;AAC7F,+FAA+F;AAC/F,kDAAkD;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,+FAA+F;AAC/F,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,+FAA+F;AAC/F,6FAA6F;AAC7F,iGAAiG;AACjG,8FAA8F;AAC9F,iEAAiE;AACjE,OAAO,EAAE,yBAAyB,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAEhG,iGAAiG;AACjG,kFAAkF;AAClF,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAK/E,yFAAyF;AACzF,sEAAsE;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AASpD,+FAA+F;AAC/F,0EAA0E;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,uEAAuE;AACvE,wFAAwF;AACxF,0FAA0F;AAC1F,iFAAiF;AACjF,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,2BAA2B,EAC3B,gCAAgC,EAChC,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC;AAqFxB,+EAA+E;AAC/E,4EAA4E;AAC5E,iFAAiF;AACjF,0EAA0E;AAC1E,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,2BAA2B,EAC3B,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AA2E5B,wEAAwE;AACxE,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,WAAW,CAAC;AAwBnB,oFAAoF;AACpF,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAS5C,+EAA+E;AAC/E,gGAAgG;AAChG,8FAA8F;AAC9F,8EAA8E;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EACrB,yBAAyB,EACzB,2BAA2B,EAC3B,cAAc,EACd,eAAe,EACf,oBAAoB,EACpB,4BAA4B,EAC5B,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,EACrB,eAAe,EACf,kBAAkB,EAClB,gCAAgC,EAChC,yBAAyB,EACzB,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,kBAAkB,EAClB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,aAAa,CAAC"}
|