@pipelex/sdk 0.47.0 → 0.48.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (70) hide show
  1. package/README.md +9 -7
  2. package/dist/artifacts.d.ts +4 -3
  3. package/dist/artifacts.js +20 -14
  4. package/dist/artifacts.js.map +1 -1
  5. package/dist/cli/script.d.ts +1 -1
  6. package/dist/cli/source.d.ts +8 -7
  7. package/dist/cli/source.js +11 -5
  8. package/dist/cli/source.js.map +1 -1
  9. package/dist/client.d.ts +326 -213
  10. package/dist/client.js +829 -517
  11. package/dist/client.js.map +1 -1
  12. package/dist/codegen-check.d.ts +2 -3
  13. package/dist/codegen-check.js +2 -3
  14. package/dist/codegen-check.js.map +1 -1
  15. package/dist/errors.d.ts +5 -2
  16. package/dist/errors.js +5 -2
  17. package/dist/errors.js.map +1 -1
  18. package/dist/hooks/bundle-gather.d.ts +47 -40
  19. package/dist/hooks/bundle-gather.js +121 -219
  20. package/dist/hooks/bundle-gather.js.map +1 -1
  21. package/dist/hooks/check-core.d.ts +70 -6
  22. package/dist/hooks/check-core.js +188 -29
  23. package/dist/hooks/check-core.js.map +1 -1
  24. package/dist/hooks/claude-mthds-check.d.ts +19 -5
  25. package/dist/hooks/claude-mthds-check.js +20 -53
  26. package/dist/hooks/claude-mthds-check.js.map +1 -1
  27. package/dist/hooks/secret-guard.d.ts +38 -0
  28. package/dist/hooks/secret-guard.js +134 -0
  29. package/dist/hooks/secret-guard.js.map +1 -0
  30. package/dist/hooks/validate-stage.d.ts +29 -0
  31. package/dist/hooks/validate-stage.js +66 -0
  32. package/dist/hooks/validate-stage.js.map +1 -0
  33. package/dist/index.d.ts +3 -4
  34. package/dist/index.js +4 -3
  35. package/dist/index.js.map +1 -1
  36. package/dist/method-trees.d.ts +220 -74
  37. package/dist/method-trees.js +250 -37
  38. package/dist/method-trees.js.map +1 -1
  39. package/dist/models.d.ts +162 -59
  40. package/dist/node-host/node.d.ts +33 -0
  41. package/dist/node-host/node.js +27 -0
  42. package/dist/node-host/node.js.map +1 -0
  43. package/dist/node-host/unavailable.d.ts +8 -0
  44. package/dist/node-host/unavailable.js +8 -0
  45. package/dist/node-host/unavailable.js.map +1 -0
  46. package/dist/node-host.d.ts +53 -0
  47. package/dist/node-host.js +72 -0
  48. package/dist/node-host.js.map +1 -0
  49. package/dist/prepare-inputs.d.ts +46 -27
  50. package/dist/prepare-inputs.js +123 -42
  51. package/dist/prepare-inputs.js.map +1 -1
  52. package/dist/product-models.d.ts +14 -16
  53. package/dist/upload.d.ts +4 -9
  54. package/dist/upload.js +13 -16
  55. package/dist/upload.js.map +1 -1
  56. package/dist/version.d.ts +1 -1
  57. package/dist/version.js +1 -1
  58. package/docs/architecture.md +44 -21
  59. package/docs/cli.md +1 -1
  60. package/docs/crate-routes.md +43 -21
  61. package/docs/errors.md +5 -5
  62. package/docs/hook-bundle.md +27 -1
  63. package/docs/input-preparation.md +13 -13
  64. package/docs/method-trees.md +120 -22
  65. package/docs/run-results.md +5 -2
  66. package/package.json +8 -2
  67. package/dist/bundle-resources.d.ts +0 -62
  68. package/dist/bundle-resources.js +0 -165
  69. package/dist/bundle-resources.js.map +0 -1
  70. package/docs/bundle-resources.md +0 -107
@@ -1 +1 @@
1
- {"version":3,"file":"claude-mthds-check.js","sourceRoot":"","sources":["../../src/hooks/claude-mthds-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,aAAa,EACb,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,aAAa,EACb,kBAAkB,EAClB,uBAAuB,GAKxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,2FAA2F;AAC3F,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAInC,KAAK,UAAU,SAAS;IACtB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,aAAa,CAAC,IAAc;IACnC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;gBAChE,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+DAA+D;AAC/D,SAAS,cAAc,CAAC,QAAgB;IACtC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CACrB,QAAsB,EACtB,SAAiB;IAEjB,IAAI,UAAoB,CAAC;IACzB,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,QAAQ,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;YACjD,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,MAAM;QACR,CAAC;QACD,KAAK,OAAO;YACV,OAAO,kBAAkB,CAAC,wBAAwB,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;QAChG,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,SAAS,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;YACtD,UAAU,GAAG,SAAS;gBACpB,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;gBACnE,CAAC,CAAC,EAAE,CAAC;YACP,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,UAAU;IACvB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACnD,+BAA+B;IAC/B,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAClC,OAAO,CAAC,IAAI,GAAG,CAAC,GAAG,IAAe,EAAE,EAAE;QACpC,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;YAC7E,OAAO;QACT,CAAC;QACD,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;IAC5B,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,IAAI,GAAG,YAAY,CAAC;IAC9B,CAAC;IACD,8BAA8B;IAC9B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IAC9C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;QACjC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACnC,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAClC,6EAA6E;QAC7E,mEAAmE;QACnE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE;YACxD,eAAe,EAAE,IAAI;YACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,SAAS,EAAE,mBAAmB;SAC/B,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC7B,OAAO;gBACL,MAAM,EAAE,OAAO;gBACf,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC;oBACzD,CAAC,CAAC,MAAM,CAAC,kBAAkB;oBAC3B,CAAC,CAAC,EAAE;aACP,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC9B,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE;gBACzF,gBAAgB,EAAE,MAAM,CAAC,iBAAiB;aAC3C,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC,+BAA+B;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACnC,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,SAAS,IAAI,CAAC,OAAoB,EAAE,QAAsB;IACxD,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,OAAO,EAAE,CAAC;QACZ,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,mDAAmD;AACnD,SAAS,IAAI,CAAC,OAAe;IAC3B,aAAa,CAAC,CAAC,EAAE,gBAAgB,OAAO,IAAI,CAAC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CAAC,MAAuB,EAAE,QAAgB;IACnE,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,kEAAkE;IAC7F,CAAC;IAED,uBAAuB;IACvB,MAAM,SAAS,GAAc;QAC3B,MAAM,EAAE,aAAa;QACrB,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,WAAW;KACnD,CAAC;IACF,MAAM,WAAW,GAAG,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACzD,IAAI,WAAW,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAChC,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,mEAAmE;IACnE,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;YACtB,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,CAAC,2BAA2B,OAAO,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,yBAAyB;IACzB,OAAO,mBAAmB,CAAC,QAAQ,EAAE,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,cAAc,CAAC,QAAQ,EAAE,MAAM,SAAS,EAAE,CAAC,CAAC;IAE3E,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,wFAAwF;QACxF,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,QAAQ,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED,IAAI,EAAE;KACH,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IACtB,kEAAkE;IAClE,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,CAAC,2BAA2B,OAAO,EAAE,CAAC,CAAC;AAC7C,CAAC,CAAC;KACD,OAAO,CAAC,GAAG,EAAE;IACZ,0EAA0E;IAC1E,sEAAsE;IACtE,6BAA6B;IAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
1
+ {"version":3,"file":"claude-mthds-check.js","sourceRoot":"","sources":["../../src/hooks/claude-mthds-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,aAAa,EACb,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,aAAa,EACb,kBAAkB,EAClB,uBAAuB,GAIxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAIvD,KAAK,UAAU,SAAS;IACtB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,aAAa,CAAC,IAAc;IACnC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;gBAChE,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+DAA+D;AAC/D,SAAS,cAAc,CAAC,QAAgB;IACtC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CACrB,QAAsB,EACtB,SAAiB;IAEjB,IAAI,UAAoB,CAAC;IACzB,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,QAAQ,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;YACjD,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,MAAM;QACR,CAAC;QACD,KAAK,OAAO;YACV,OAAO,kBAAkB,CAAC,wBAAwB,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,cAAc,CAAC,CAAC;QAChG,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,SAAS,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;YACtD,UAAU,GAAG,SAAS;gBACpB,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;gBACnE,CAAC,CAAC,EAAE,CAAC;YACP,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,UAAU;IACvB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACnD,+BAA+B;IAC/B,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAClC,OAAO,CAAC,IAAI,GAAG,CAAC,GAAG,IAAe,EAAE,EAAE;QACpC,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;YAC7E,OAAO;QACT,CAAC;QACD,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;IAC5B,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,IAAI,GAAG,YAAY,CAAC;IAC9B,CAAC;IACD,8BAA8B;IAC9B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6FAA6F;AAC7F,SAAS,IAAI,CAAC,OAAoB,EAAE,QAAsB;IACxD,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,OAAO,EAAE,CAAC;QACZ,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,mDAAmD;AACnD,SAAS,IAAI,CAAC,OAAe;IAC3B,aAAa,CAAC,CAAC,EAAE,gBAAgB,OAAO,IAAI,CAAC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CAAC,MAAuB,EAAE,QAAgB;IACnE,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,kEAAkE;IAC7F,CAAC;IAED,uBAAuB;IACvB,MAAM,SAAS,GAAc;QAC3B,MAAM,EAAE,aAAa;QACrB,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,WAAW;KACnD,CAAC;IACF,MAAM,WAAW,GAAG,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACzD,IAAI,WAAW,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAChC,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,mEAAmE;IACnE,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;YACtB,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,CAAC,2BAA2B,OAAO,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,yBAAyB;IACzB,OAAO,mBAAmB,CAAC,QAAQ,EAAE,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,cAAc,CAAC,QAAQ,EAAE,MAAM,SAAS,EAAE,CAAC,CAAC;IAE3E,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,wFAAwF;QACxF,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,QAAQ,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED,IAAI,EAAE;KACH,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IACtB,kEAAkE;IAClE,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,CAAC,2BAA2B,OAAO,EAAE,CAAC,CAAC;AAC7C,CAAC,CAAC;KACD,OAAO,CAAC,GAAG,EAAE;IACZ,0EAA0E;IAC1E,sEAAsE;IACtE,6BAA6B;IAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
@@ -0,0 +1,38 @@
1
+ /**
2
+ * The hook's secret guard: before the validate stage sends a method's tree, it finds each file
3
+ * whose NAME is a known secret file, or whose TEXT holds a well-known key format, in whatever
4
+ * encoding the file is written, so that file never leaves the machine.
5
+ *
6
+ * The rule is the workshop's, pipelex-mcp's `src/capabilities/secret-guard.ts`, with the
7
+ * refinements this copy is ahead on until the workshop takes them up (L-261022-b4770f): an SSH key
8
+ * is found by its default name only when the name is exactly that, and a PEM private key block
9
+ * only when a key's body follows its header. Every other rule is the workshop's, and changes with
10
+ * it. The membership rule already keeps the commonest secret files out by construction,
11
+ * since `.env`, `.ssh/`, `.aws/` and every other dotfile start with a dot. What it cannot keep
12
+ * out is a key file under an ordinary name, or a key pasted into an ordinary file, a Python
13
+ * module being the usual home of one, which is why the guard reads text and not names alone.
14
+ * It is a tripwire for the well-known shapes, never a promise that a tree holds no secret: a
15
+ * password in prose, a scanned contract or a payslip goes through it.
16
+ *
17
+ * A finding names the file and what matched, and **never the matched text**, since the hook's
18
+ * output is shown to a model and may be logged.
19
+ *
20
+ * Pure: it reads the bytes it is handed and nothing else.
21
+ */
22
+ /** One file the guard finds, and why, in words that quote nothing of the file. */
23
+ export interface SecretFinding {
24
+ /** The file's tree path. */
25
+ path: string;
26
+ /** What it is, or what it holds: "it holds a private key block (PEM)". */
27
+ reason: string;
28
+ }
29
+ /**
30
+ * The files of a tree the guard finds, in the order given. A file whose name is a secret file's
31
+ * is found on the name alone, unless its rule's `unless` says its bytes are something else; every
32
+ * other file, text in any encoding or binary, is searched for every key format in the texts
33
+ * {@link searchableTexts} reads from its bytes.
34
+ */
35
+ export declare function secretFindings(files: Iterable<{
36
+ path: string;
37
+ bytes: Uint8Array;
38
+ }>): SecretFinding[];
@@ -0,0 +1,134 @@
1
+ /**
2
+ * The hook's secret guard: before the validate stage sends a method's tree, it finds each file
3
+ * whose NAME is a known secret file, or whose TEXT holds a well-known key format, in whatever
4
+ * encoding the file is written, so that file never leaves the machine.
5
+ *
6
+ * The rule is the workshop's, pipelex-mcp's `src/capabilities/secret-guard.ts`, with the
7
+ * refinements this copy is ahead on until the workshop takes them up (L-261022-b4770f): an SSH key
8
+ * is found by its default name only when the name is exactly that, and a PEM private key block
9
+ * only when a key's body follows its header. Every other rule is the workshop's, and changes with
10
+ * it. The membership rule already keeps the commonest secret files out by construction,
11
+ * since `.env`, `.ssh/`, `.aws/` and every other dotfile start with a dot. What it cannot keep
12
+ * out is a key file under an ordinary name, or a key pasted into an ordinary file, a Python
13
+ * module being the usual home of one, which is why the guard reads text and not names alone.
14
+ * It is a tripwire for the well-known shapes, never a promise that a tree holds no secret: a
15
+ * password in prose, a scanned contract or a payslip goes through it.
16
+ *
17
+ * A finding names the file and what matched, and **never the matched text**, since the hook's
18
+ * output is shown to a model and may be logged.
19
+ *
20
+ * Pure: it reads the bytes it is handed and nothing else.
21
+ */
22
+ /** Whether the bytes open with a zip archive's local file header, `PK\x03\x04`. */
23
+ function isZipArchive(bytes) {
24
+ return bytes[0] === 0x50 && bytes[1] === 0x4b && bytes[2] === 0x03 && bytes[3] === 0x04;
25
+ }
26
+ /**
27
+ * Secret file names, matched on the last segment of a tree path, ignoring case: key and
28
+ * certificate stores, SSH private keys under their default names, and the credential exports of
29
+ * the cloud consoles. A rule with `unless` lets a file of that name go when its bytes show it is
30
+ * something else.
31
+ *
32
+ * `.pem` is no name rule: a `.pem` file is as often a certificate, which is public, and a private
33
+ * key in one is a PEM block, which the text search finds. A `.key` file is a Keynote deck as
34
+ * often as a key, and a deck is a zip archive, so only a `.key` file that is no zip is found by
35
+ * name, which still catches a DER key, binary and holding no PEM block.
36
+ *
37
+ * An SSH key's default name is matched whole, with the `_sk` of a hardware-backed key, so its
38
+ * `.pub` half, which is public, and a file merely starting with the name, such as
39
+ * `id_rsa_utils.py`, go. Nothing is lost: every SSH private key is PEM-armoured, which the text
40
+ * search finds under any name.
41
+ */
42
+ const SECRET_NAMES = [
43
+ {
44
+ pattern: /\.key$/i,
45
+ reason: "a key file (.key), and is no zip archive as a Keynote deck is",
46
+ unless: isZipArchive,
47
+ },
48
+ { pattern: /\.(p12|pfx|jks|keystore)$/i, reason: "a certificate or key store" },
49
+ { pattern: /\.ppk$/i, reason: "a PuTTY private key" },
50
+ { pattern: /\.kdbx$/i, reason: "a KeePass password database" },
51
+ {
52
+ pattern: /^id_(?:rsa|dsa|ecdsa|ed25519)(?:_sk)?$/i,
53
+ reason: "an SSH key under its default name",
54
+ },
55
+ { pattern: /^credentials(\.json)?$/i, reason: "a credentials file" },
56
+ { pattern: /^client_secret.*\.json$/i, reason: "an OAuth client secret export" },
57
+ ];
58
+ /**
59
+ * Well-known key formats, matched in a file's text. Each is a prefix a provider puts on its keys
60
+ * so that scanners can find them, with enough of the key's body after it that prose mentioning
61
+ * the prefix does not match.
62
+ *
63
+ * A PEM private key block is its header followed by a run of Base64 as long as a key's body
64
+ * lines, where a key's body sits: directly on the header's line, as in a key flattened onto one
65
+ * line, or at the start of a line within a short span after the header, the line break written as
66
+ * a real one or as the `\n` of a key escaped into JSON, its indentation allowed, the span holding
67
+ * the `Proc-Type` and `DEK-Info` headers of an encrypted legacy key. A header named in prose, such
68
+ * as a prompt telling a model what a key looks like, has no such run there, even when a long path
69
+ * or link follows it in the sentence, so it goes.
70
+ */
71
+ const KEY_FORMATS = [
72
+ {
73
+ pattern: /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----(?:[ \t]*|[\s\S]{0,200}?(?:\n|\\n)[ \t]*)[A-Za-z0-9+/]{40,}/,
74
+ reason: "a private key block (PEM)",
75
+ },
76
+ { pattern: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/, reason: "an AWS access key id" },
77
+ { pattern: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/, reason: "a GitHub token" },
78
+ { pattern: /\bgithub_pat_[A-Za-z0-9_]{22,}/, reason: "a GitHub fine-grained token" },
79
+ { pattern: /\bglpat-[A-Za-z0-9_-]{20,}/, reason: "a GitLab token" },
80
+ { pattern: /\bxox[abprs]-[A-Za-z0-9-]{10,}/, reason: "a Slack token" },
81
+ { pattern: /\b(?:sk|rk)_live_[A-Za-z0-9]{16,}/, reason: "a Stripe live key" },
82
+ { pattern: /\bAIza[0-9A-Za-z_-]{35}/, reason: "a Google API key" },
83
+ { pattern: /\bsk-ant-[A-Za-z0-9_-]{20,}/, reason: "an Anthropic API key" },
84
+ {
85
+ pattern: /\bsk-(?:proj|svcacct|admin)-[A-Za-z0-9_-]{20,}/,
86
+ reason: "an OpenAI API key",
87
+ },
88
+ { pattern: /\bsk-[A-Za-z0-9]{32,}\b/, reason: "an OpenAI-style secret key" },
89
+ { pattern: /\bhf_[A-Za-z0-9]{30,}\b/, reason: "a Hugging Face token" },
90
+ { pattern: /\bnpm_[A-Za-z0-9]{36}\b/, reason: "an npm token" },
91
+ { pattern: /\bplx_sk_[A-Za-z0-9_-]{16,}/, reason: "a Pipelex API key" },
92
+ ];
93
+ /**
94
+ * Bytes read one character per byte. The WHATWG `latin1` decoder is windows-1252, which maps
95
+ * every byte to exactly one character and every ASCII byte to itself, and every key format is
96
+ * ASCII matched with ASCII word boundaries, so it finds what Node's Latin-1 decoding, the
97
+ * workshop's, finds, without reaching for `Buffer`.
98
+ */
99
+ const ONE_CHARACTER_PER_BYTE = new TextDecoder("latin1");
100
+ /**
101
+ * The texts a file's bytes are searched in. Every key format is ASCII, so the bytes are read one
102
+ * character per byte, which keeps every ASCII run of them whatever the file's encoding: UTF-8,
103
+ * Latin-1, cp1252, or a binary file with a key inside it. A file holding NUL bytes is searched
104
+ * once more with them removed, which is how an ASCII key reads in UTF-16, with or without its
105
+ * byte order mark, and in UTF-32.
106
+ */
107
+ function searchableTexts(bytes) {
108
+ const text = ONE_CHARACTER_PER_BYTE.decode(bytes);
109
+ return text.includes("\0") ? [text, text.replaceAll("\0", "")] : [text];
110
+ }
111
+ /**
112
+ * The files of a tree the guard finds, in the order given. A file whose name is a secret file's
113
+ * is found on the name alone, unless its rule's `unless` says its bytes are something else; every
114
+ * other file, text in any encoding or binary, is searched for every key format in the texts
115
+ * {@link searchableTexts} reads from its bytes.
116
+ */
117
+ export function secretFindings(files) {
118
+ const findings = [];
119
+ for (const file of files) {
120
+ const name = file.path.slice(file.path.lastIndexOf("/") + 1);
121
+ const byName = SECRET_NAMES.find((rule) => rule.pattern.test(name) && rule.unless?.(file.bytes) !== true);
122
+ if (byName !== undefined) {
123
+ findings.push({ path: file.path, reason: `it is named like ${byName.reason}` });
124
+ continue;
125
+ }
126
+ const texts = searchableTexts(file.bytes);
127
+ const held = KEY_FORMATS.filter((format) => texts.some((text) => format.pattern.test(text))).map((format) => format.reason);
128
+ if (held.length > 0) {
129
+ findings.push({ path: file.path, reason: `it holds ${[...new Set(held)].join(" and ")}` });
130
+ }
131
+ }
132
+ return findings;
133
+ }
134
+ //# sourceMappingURL=secret-guard.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"secret-guard.js","sourceRoot":"","sources":["../../src/hooks/secret-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAUH,mFAAmF;AACnF,SAAS,YAAY,CAAC,KAAiB;IACrC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;AAC1F,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,YAAY,GAIZ;IACJ;QACE,OAAO,EAAE,SAAS;QAClB,MAAM,EAAE,+DAA+D;QACvE,MAAM,EAAE,YAAY;KACrB;IACD,EAAE,OAAO,EAAE,4BAA4B,EAAE,MAAM,EAAE,4BAA4B,EAAE;IAC/E,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE;IACrD,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,6BAA6B,EAAE;IAC9D;QACE,OAAO,EAAE,yCAAyC;QAClD,MAAM,EAAE,mCAAmC;KAC5C;IACD,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,oBAAoB,EAAE;IACpE,EAAE,OAAO,EAAE,0BAA0B,EAAE,MAAM,EAAE,+BAA+B,EAAE;CACjF,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,GAAmD;IAClE;QACE,OAAO,EACL,kHAAkH;QACpH,MAAM,EAAE,2BAA2B;KACpC;IACD,EAAE,OAAO,EAAE,+BAA+B,EAAE,MAAM,EAAE,sBAAsB,EAAE;IAC5E,EAAE,OAAO,EAAE,gCAAgC,EAAE,MAAM,EAAE,gBAAgB,EAAE;IACvE,EAAE,OAAO,EAAE,gCAAgC,EAAE,MAAM,EAAE,6BAA6B,EAAE;IACpF,EAAE,OAAO,EAAE,4BAA4B,EAAE,MAAM,EAAE,gBAAgB,EAAE;IACnE,EAAE,OAAO,EAAE,gCAAgC,EAAE,MAAM,EAAE,eAAe,EAAE;IACtE,EAAE,OAAO,EAAE,mCAAmC,EAAE,MAAM,EAAE,mBAAmB,EAAE;IAC7E,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,kBAAkB,EAAE;IAClE,EAAE,OAAO,EAAE,6BAA6B,EAAE,MAAM,EAAE,sBAAsB,EAAE;IAC1E;QACE,OAAO,EAAE,gDAAgD;QACzD,MAAM,EAAE,mBAAmB;KAC5B;IACD,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,4BAA4B,EAAE;IAC5E,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,sBAAsB,EAAE;IACtE,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,cAAc,EAAE;IAC9D,EAAE,OAAO,EAAE,6BAA6B,EAAE,MAAM,EAAE,mBAAmB,EAAE;CACxE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC;AAEzD;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,KAAiB;IACxC,MAAM,IAAI,GAAG,sBAAsB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAoD;IAEpD,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAC9B,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CACxE,CAAC;QACF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,oBAAoB,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAChF,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CACzC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAChD,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}
@@ -0,0 +1,29 @@
1
+ /**
2
+ * The `.mthds` post-edit hook's networked stage: the edited file's method tree validated through
3
+ * the SDK (`POST /v1/validate`, `allow_signatures: true`), held to one deadline over the whole
4
+ * stage, so the hook never outlasts its harness's patience whatever the network does.
5
+ */
6
+ import type { PipelexApiClient } from "../client.js";
7
+ import type { ValidateStage } from "./check-core.js";
8
+ /**
9
+ * The deadline over the whole validate stage, well under the hook's overall timeout: the version
10
+ * handshake, the blob route, the uploads of the files the API lacks (a tree up to the gatherer's
11
+ * caps, 12 MiB) and the validation itself all run under it.
12
+ */
13
+ export declare const VALIDATE_TIMEOUT_MS = 10000;
14
+ /** What the stage may be handed instead of what it builds from the environment. */
15
+ export interface ValidateStageOptions {
16
+ /** The client to validate through; by default the hook's, given a `PIPELEX_API_KEY`. */
17
+ readonly client?: Pick<PipelexApiClient, "validate">;
18
+ /** The stage's deadline, `VALIDATE_TIMEOUT_MS` by default. */
19
+ readonly timeoutMs?: number;
20
+ }
21
+ /**
22
+ * Run the networked validate stage on `filePath`. Every no-verdict condition maps to
23
+ * `unavailable` — no API key, a tree the gatherer cannot list whole, the deadline running out, any
24
+ * failure of the client — so a machine consumer branches on the structured verdict, never on
25
+ * transport, and the lint and format verdicts the hook already applied stand. A bundle or the
26
+ * manifest that looks like a secret is `refused`, with nothing sent, and a verdict names the files
27
+ * of the tree the gatherer kept home as `withheld`.
28
+ */
29
+ export declare function runValidateStage(filePath: string, options?: ValidateStageOptions): Promise<ValidateStage>;
@@ -0,0 +1,66 @@
1
+ /**
2
+ * The `.mthds` post-edit hook's networked stage: the edited file's method tree validated through
3
+ * the SDK (`POST /v1/validate`, `allow_signatures: true`), held to one deadline over the whole
4
+ * stage, so the hook never outlasts its harness's patience whatever the network does.
5
+ */
6
+ import { gatherMethodTree } from "./bundle-gather.js";
7
+ import { createHookClient } from "./validate-client.js";
8
+ /**
9
+ * The deadline over the whole validate stage, well under the hook's overall timeout: the version
10
+ * handshake, the blob route, the uploads of the files the API lacks (a tree up to the gatherer's
11
+ * caps, 12 MiB) and the validation itself all run under it.
12
+ */
13
+ export const VALIDATE_TIMEOUT_MS = 10_000;
14
+ /**
15
+ * Run the networked validate stage on `filePath`. Every no-verdict condition maps to
16
+ * `unavailable` — no API key, a tree the gatherer cannot list whole, the deadline running out, any
17
+ * failure of the client — so a machine consumer branches on the structured verdict, never on
18
+ * transport, and the lint and format verdicts the hook already applied stand. A bundle or the
19
+ * manifest that looks like a secret is `refused`, with nothing sent, and a verdict names the files
20
+ * of the tree the gatherer kept home as `withheld`.
21
+ */
22
+ export async function runValidateStage(filePath, options = {}) {
23
+ if (options.client === undefined && !process.env.PIPELEX_API_KEY) {
24
+ return { status: "unavailable" };
25
+ }
26
+ // One deadline over the whole stage: the signal reaches every request and upload the
27
+ // validation makes, each stopped in flight once it fires, so nothing keeps running after the
28
+ // hook has given up on it.
29
+ const deadline = AbortSignal.timeout(options.timeoutMs ?? VALIDATE_TIMEOUT_MS);
30
+ try {
31
+ // Inside the try: a gather that throws fails this stage open, as any other no-verdict
32
+ // condition does, rather than rejecting the hook and losing the other files' outcomes.
33
+ const gathered = await gatherMethodTree(filePath);
34
+ if (!gathered.ok) {
35
+ return gathered.reason === "secret"
36
+ ? { status: "refused", root: gathered.root, withheld: gathered.withheld }
37
+ : { status: "unavailable" };
38
+ }
39
+ const withheld = gathered.withheld;
40
+ const client = options.client ?? createHookClient();
41
+ const result = await client.validate({ tree: gathered.tree }, true, { signal: deadline });
42
+ if (result.is_valid === true) {
43
+ return {
44
+ status: "valid",
45
+ pendingSignatures: Array.isArray(result.pending_signatures)
46
+ ? result.pending_signatures
47
+ : [],
48
+ withheld,
49
+ };
50
+ }
51
+ if (result.is_valid === false) {
52
+ return {
53
+ status: "invalid",
54
+ message: result.message,
55
+ validationErrors: Array.isArray(result.validation_errors) ? result.validation_errors : [],
56
+ renderedMarkdown: result.rendered_markdown,
57
+ withheld,
58
+ };
59
+ }
60
+ return { status: "unavailable" }; // no discriminant — no verdict
61
+ }
62
+ catch {
63
+ return { status: "unavailable" };
64
+ }
65
+ }
66
+ //# sourceMappingURL=validate-stage.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"validate-stage.js","sourceRoot":"","sources":["../../src/hooks/validate-stage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAU1C;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,UAAgC,EAAE;IAElC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;QACjE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACnC,CAAC;IACD,qFAAqF;IACrF,6FAA6F;IAC7F,2BAA2B;IAC3B,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,mBAAmB,CAAC,CAAC;IAC/E,IAAI,CAAC;QACH,sFAAsF;QACtF,uFAAuF;QACvF,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ;gBACjC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;gBACzE,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QAChC,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;QACnC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,gBAAgB,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC1F,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC7B,OAAO;gBACL,MAAM,EAAE,OAAO;gBACf,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC;oBACzD,CAAC,CAAC,MAAM,CAAC,kBAAkB;oBAC3B,CAAC,CAAC,EAAE;gBACN,QAAQ;aACT,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC9B,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE;gBACzF,gBAAgB,EAAE,MAAM,CAAC,iBAAiB;gBAC1C,QAAQ;aACT,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC,+BAA+B;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACnC,CAAC;AACH,CAAC"}
package/dist/index.d.ts CHANGED
@@ -12,10 +12,9 @@ export * from "mthds/protocol";
12
12
  export { PipelexApiClient, DEFAULT_API_BASE_URL, isGatewayCutOff } from "./client.js";
13
13
  export { buildUserAgent, validateAppInfo, MAX_USER_AGENT_LENGTH } from "./user-agent.js";
14
14
  export type { AppInfo, RuntimeInfo } from "./user-agent.js";
15
- export type { MthdsFile, PipelexApiRunExtensions, PipelexHostedRunExtensions, PipelexRunOptions, PipelexStartOptions, PipelexStartRequestOptions, ValidateMethodSelector, ValidateFilesOptions, ValidateOptions, PipelexApiClientOptions, } from "./client.js";
16
- export type { BundleResourceBytes, BundleResources } from "./bundle-resources.js";
15
+ export type { PipelexApiRunExtensions, PipelexHostedRunExtensions, PipelexRunOptions, PipelexStartOptions, PipelexStartRequestOptions, PipelexValidateSource, ValidateMethodSelector, ValidateOptions, PipelexApiClientOptions, } from "./client.js";
17
16
  export { INLINE_TREE_MAX_BYTES } from "./method-trees.js";
18
- export type { BlobRef, MethodTreeLimits, MethodTreeSource, MethodTreeSourceFile, MissingBlob, MissingBlobsRequest, MissingBlobsResult, UploadTarget, } from "./method-trees.js";
17
+ export type { MethodTreeForms, MethodTreeLimits } from "./method-trees.js";
19
18
  export { parseMethodSelector } from "./method-selector.js";
20
19
  export type { ParsedMethodSelector } from "./method-selector.js";
21
20
  export { ExactJsonUnsupportedError, parseExactJson, stringifyExactJson } from "./exact-json.js";
@@ -27,7 +26,7 @@ export type { InputFormFault, PrepareInputsBase, PrepareInputsClosure, PrepareIn
27
26
  export { inputFormFault } from "./prepare-inputs.js";
28
27
  export { locateArtifacts, collectArtifacts, artifactFilename, PIPELEX_STORAGE_SCHEME, BULK_RESOLVE_MAX_URIS, DEFAULT_ARTIFACT_MAX_BYTES, DEFAULT_ARTIFACT_TIMEOUT_MS, DEFAULT_DOWNLOAD_MAX_TOTAL_BYTES, DEFAULT_DOWNLOAD_CONCURRENCY, } from "./artifacts.js";
29
28
  export type { ArtifactItemError, ArtifactLocation, ArtifactScope, BulkResolveStorageUrlsInput, BulkResolvedStorageUrls, DownloadArtifactsOptions, DownloadArtifactsRequest, DownloadArtifactsResult, DownloadedArtifact, FetchArtifactOptions, ResolvedArtifact, } from "./artifacts.js";
30
- export type { DiagnosticKind, DiagnosticRange, Diagnostic, LintResponse, FormatResponse, DictStuff, DictWorkingMemory, DictPipeOutput, DictRunResultExecute, MethodProvenance, PipelexRunResultStart, PipelexHostedToolingExtensions, DryRunStatus, ValidatedPipeEntry, LiftablePipeEntry, PipelexValidationReport, PipelexInvalidReport, PipelexValidationResult, ValidationErrorCategory, ValidationErrorItem, FixSafety, FixOpKind, TomlScalar, TomlValue, FixValue, SetKeyOp, EnsureTableOp, DeleteKeyOp, DeleteTableOp, RenameTableKeyOp, MoveKeyOp, RemapValueOp, FixOp, SuggestedFix, MthdsFileItem, CrateRequestBase, CrateInvalidReport, GeneratedArtifact, ResolveRequest, ResolveValidReport, ResolveResponse, CodegenKind, CodegenTarget, CodegenRequest, CodegenValidReport, CodegenResponse, PipeIORequest, PipeIOValidReport, PipeIOResponse, ModelCheckCategory, ModelReferenceKind, ModelReferenceResolution, ModelReferenceMatchBase, PresetMatch, AliasMatch, WaterfallMatch, HandleMatch, ModelReferenceMatch, ModelReferenceVerdictBase, PresetReferenceVerdict, AliasReferenceVerdict, WaterfallReferenceVerdict, HandleReferenceVerdict, ModelReferenceVerdict, } from "./models.js";
29
+ export type { DiagnosticKind, DiagnosticRange, Diagnostic, LintResponse, FormatResponse, DictStuff, DictWorkingMemory, DictPipeOutput, DictRunResultExecute, MethodProvenance, PipelexRunResultStart, PipelexHostedToolingExtensions, DryRunStatus, ValidatedPipeEntry, LiftablePipeEntry, TreeFileUse, TreeFileRead, PipelexValidationReport, PipelexInvalidReport, PipelexValidationResult, ValidationErrorCategory, ValidationErrorItem, FixSafety, FixOpKind, TomlScalar, TomlValue, FixValue, SetKeyOp, EnsureTableOp, DeleteKeyOp, DeleteTableOp, RenameTableKeyOp, MoveKeyOp, RemapValueOp, FixOp, SuggestedFix, CrateRequestBase, CrateRouteOptions, CrateInvalidReport, GeneratedArtifact, ResolveRequest, ResolveValidReport, ResolveResponse, CodegenKind, CodegenTarget, CodegenRequest, CodegenValidReport, CodegenResponse, PipeIORequest, PipeIOValidReport, PipeIOResponse, ModelCheckCategory, ModelReferenceKind, ModelReferenceResolution, ModelReferenceMatchBase, PresetMatch, AliasMatch, WaterfallMatch, HandleMatch, ModelReferenceMatch, ModelReferenceVerdictBase, PresetReferenceVerdict, AliasReferenceVerdict, WaterfallReferenceVerdict, HandleReferenceVerdict, ModelReferenceVerdict, } from "./models.js";
31
30
  export { runCodegenCheck, isStampableArtifactPath, STAMPABLE_ARTIFACT_SUFFIXES, CodegenLockError, } from "./codegen-check.js";
32
31
  export type { CodegenCheckInput, CodegenCheckReport, CodegenDrift, CodegenDriftCategory, CodegenTreeFile, } from "./codegen-check.js";
33
32
  export type { UserProfile, ListMethodExamplesQuery, ListMethodsQuery, ListMethodVersionsQuery, MethodData, MethodDeletionAccepted, MethodDeletionState, MethodDetail, MethodDraftInput, MethodExample, MethodExampleCreateInput, MethodExampleLatestRunInput, MethodExampleLatestRunOutcome, MethodExampleLatestRunRecorded, MethodExampleLatestRunResult, MethodExampleLatestRunStale, MethodExamplePage, MethodExampleUpdateInput, MethodPage, MethodPublished, MethodPublishInput, MethodPublishOutcome, MethodPublishRefusalReason, MethodPublishRefused, MethodPublishResult, MethodPublishUnchanged, MethodRenameInput, MethodSummary, MethodTreeInput, MethodVersion, MethodVersionPage, MethodVersionSummary, MethodWriteInput, SavedMethodFile, Membership, MembershipsResponse, OrgRole, SubscriptionResponse, PlanView, InvoiceView, CheckoutResponse, ChangePlanResponse, BillingPortalResponse, PipelexApiKey, PipelexApiKeyCreated, PipelexApiKeyList, OnboardingRole, OnboardingCurrentTool, OnboardingInputType, OnboardingHeardFrom, OnboardingSubmission, ResolvedStorageUrl, UploadInput, UploadedFile, UploadGrantInput, UploadGrant, ListRunsQuery, PipelineRun, RunDetail, RunHistoryItem, RunPage, UpdateRunInput, } from "./product-models.js";
package/dist/index.js CHANGED
@@ -19,9 +19,10 @@ export { PipelexApiClient, DEFAULT_API_BASE_URL, isGatewayCutOff } from "./clien
19
19
  // makes its own raw requests to the API sends the same value, and can check an `appInfo`
20
20
  // against the grammar and the length ceiling before constructing a client.
21
21
  export { buildUserAgent, validateAppInfo, MAX_USER_AGENT_LENGTH } from "./user-agent.js";
22
- // A saved method's tree: the source a save reads a tree from (the `mthds` package's `MethodTree`
23
- // is one), the limits `methodTreeLimits` reports, the blob routes a large tree travels through,
24
- // and the inline threshold below which a tree travels whole.
22
+ // A method's tree: the four forms every method-taking route takes it in, the limits
23
+ // `methodTreeLimits` reports, and the inline threshold below which a tree travels whole. The
24
+ // standard's own tree types (`MethodTreeSource`, `BlobRef`, `MissingBlobsResult` and the rest)
25
+ // come with the `mthds/protocol` re-export above.
25
26
  export { INLINE_TREE_MAX_BYTES } from "./method-trees.js";
26
27
  // A method selector (`mt_…`, `mt_…@<n>`, `mt_…@draft`) → its bare id and the version it names.
27
28
  export { parseMethodSelector } from "./method-selector.js";
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,6FAA6F;AAC7F,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,oFAAoF;AACpF,kFAAkF;AAClF,mFAAmF;AACnF,wBAAwB;AACxB,cAAc,gBAAgB,CAAC;AAE/B,wEAAwE;AACxE,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACtF,sFAAsF;AACtF,yFAAyF;AACzF,2EAA2E;AAC3E,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAgBzF,iGAAiG;AACjG,gGAAgG;AAChG,6DAA6D;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAW1D,+FAA+F;AAC/F,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,+FAA+F;AAC/F,6FAA6F;AAC7F,iGAAiG;AACjG,8FAA8F;AAC9F,iEAAiE;AACjE,OAAO,EAAE,yBAAyB,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAEhG,iGAAiG;AACjG,kFAAkF;AAClF,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAK/E,yFAAyF;AACzF,sEAAsE;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AASpD,+FAA+F;AAC/F,0EAA0E;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,uEAAuE;AACvE,wFAAwF;AACxF,0FAA0F;AAC1F,iFAAiF;AACjF,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,2BAA2B,EAC3B,gCAAgC,EAChC,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC;AAmFxB,+EAA+E;AAC/E,4EAA4E;AAC5E,iFAAiF;AACjF,0EAA0E;AAC1E,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,2BAA2B,EAC3B,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AA2E5B,wEAAwE;AACxE,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,WAAW,CAAC;AAwBnB,oFAAoF;AACpF,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAS5C,+EAA+E;AAC/E,gGAAgG;AAChG,8FAA8F;AAC9F,8EAA8E;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EACrB,yBAAyB,EACzB,2BAA2B,EAC3B,cAAc,EACd,eAAe,EACf,oBAAoB,EACpB,4BAA4B,EAC5B,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,EACrB,eAAe,EACf,kBAAkB,EAClB,gCAAgC,EAChC,yBAAyB,EACzB,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,kBAAkB,EAClB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,aAAa,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,6FAA6F;AAC7F,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,oFAAoF;AACpF,kFAAkF;AAClF,mFAAmF;AACnF,wBAAwB;AACxB,cAAc,gBAAgB,CAAC;AAE/B,wEAAwE;AACxE,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACtF,sFAAsF;AACtF,yFAAyF;AACzF,2EAA2E;AAC3E,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAczF,oFAAoF;AACpF,6FAA6F;AAC7F,+FAA+F;AAC/F,kDAAkD;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,+FAA+F;AAC/F,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,+FAA+F;AAC/F,6FAA6F;AAC7F,iGAAiG;AACjG,8FAA8F;AAC9F,iEAAiE;AACjE,OAAO,EAAE,yBAAyB,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAEhG,iGAAiG;AACjG,kFAAkF;AAClF,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAK/E,yFAAyF;AACzF,sEAAsE;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AASpD,+FAA+F;AAC/F,0EAA0E;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,uEAAuE;AACvE,wFAAwF;AACxF,0FAA0F;AAC1F,iFAAiF;AACjF,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,2BAA2B,EAC3B,gCAAgC,EAChC,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC;AAqFxB,+EAA+E;AAC/E,4EAA4E;AAC5E,iFAAiF;AACjF,0EAA0E;AAC1E,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,2BAA2B,EAC3B,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AA2E5B,wEAAwE;AACxE,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,WAAW,CAAC;AAwBnB,oFAAoF;AACpF,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAS5C,+EAA+E;AAC/E,gGAAgG;AAChG,8FAA8F;AAC9F,8EAA8E;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EACrB,yBAAyB,EACzB,2BAA2B,EAC3B,cAAc,EACd,eAAe,EACf,oBAAoB,EACpB,4BAA4B,EAC5B,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,EACrB,eAAe,EACf,kBAAkB,EAClB,gCAAgC,EAChC,yBAAyB,EACzB,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,kBAAkB,EAClB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,aAAa,CAAC"}