@xfey/tenso 0.1.130

package/node_modules/@tutti/shared/dist/utils/path-policy/index.js

@@ -0,0 +1,92 @@
+const WINDOWS_ABSOLUTE_PATH_PATTERN = /^[A-Za-z]:[\\/]/u;
+const SECRET_FILE_NAMES = new Set([
+    ".env",
+    ".npmrc",
+    ".pypirc",
+    ".netrc",
+    ".ssh",
+    "credentials.json",
+    "credential.json",
+    "secrets.json",
+    "secret.json",
+    "id_rsa",
+    "id_dsa",
+    "id_ecdsa",
+    "id_ed25519",
+]);
+const SECRET_FILE_EXTENSIONS = [".pem", ".key", ".p12", ".pfx", ".kdbx"];
+function isAbsolutePath(path) {
+    return (path.startsWith("/") ||
+        path.startsWith("\\\\") ||
+        path.startsWith("//") ||
+        WINDOWS_ABSOLUTE_PATH_PATTERN.test(path));
+}
+function isSecretLikeSegment(segment) {
+    const lower = segment.toLowerCase();
+    return (SECRET_FILE_NAMES.has(lower) ||
+        lower.startsWith(".env.") ||
+        SECRET_FILE_EXTENSIONS.some((extension) => lower.endsWith(extension)));
+}
+function hasControlCharacter(value) {
+    for (let index = 0; index < value.length; index += 1) {
+        const code = value.charCodeAt(index);
+        if (code <= 31 || code === 127) {
+            return true;
+        }
+    }
+    return false;
+}
+export function classifyRepositoryPathMetadata(path) {
+    if (hasControlCharacter(path)) {
+        return { kind: "rejected", reason_code: "control_character" };
+    }
+    if (path === "" || path === ".") {
+        return { kind: "allowed", normalized_path: "", path_kind: "root" };
+    }
+    if (isAbsolutePath(path)) {
+        return { kind: "rejected", reason_code: "absolute_path" };
+    }
+    const segments = [];
+    for (const segment of path.replaceAll("\\", "/").split("/")) {
+        if (segment === "" || segment === ".") {
+            continue;
+        }
+        if (segment === "..") {
+            return { kind: "rejected", reason_code: "parent_traversal" };
+        }
+        const lower = segment.toLowerCase();
+        if (lower === ".git") {
+            return { kind: "rejected", reason_code: "git_path" };
+        }
+        if (lower === ".tutti") {
+            return { kind: "rejected", reason_code: "private_tutti_path" };
+        }
+        segments.push(segment);
+    }
+    const normalizedPath = segments.join("/");
+    return {
+        kind: "allowed",
+        normalized_path: normalizedPath,
+        path_kind: normalizedPath === "" ? "root" : "project_relative",
+    };
+}
+export function classifyViewerPath(path) {
+    if (hasControlCharacter(path)) {
+        return { kind: "rejected", reason_code: "control_character" };
+    }
+    const classification = classifyRepositoryPathMetadata(path.trim());
+    if (classification.kind === "rejected") {
+        return classification;
+    }
+    if (classification.normalized_path.split("/").some(isSecretLikeSegment)) {
+        return {
+            kind: "rejected",
+            reason_code: "secret_like_path",
+        };
+    }
+    return classification;
+}
+export function isViewerPathAllowed(path) {
+    return classifyViewerPath(path).kind === "allowed";
+}
+//# sourceMappingURL=index.js.map

package/node_modules/@tutti/shared/dist/utils/redaction/index.d.ts

@@ -0,0 +1,20 @@
+export declare const REDACTION_LABELS: {
+    readonly providerApiKey: "[REDACTED:provider_api_key]";
+    readonly bearerToken: "[REDACTED:bearer_token]";
+    readonly cookie: "[REDACTED:cookie]";
+    readonly joinToken: "[REDACTED:join_token]";
+    readonly runtimeToken: "[REDACTED:runtime_token]";
+    readonly hostSecret: "[REDACTED:host_secret]";
+    readonly localPath: "[REDACTED:local_path]";
+};
+export declare const REDACTION_FIXTURES: readonly ["sk-proj-example-secret", "Authorization: Bearer example-token", "Cookie: tutti_session=example-session", "Cookie: tutti_preview_session=example-preview-session", "Cookie: tutti_feishu_session=example-feishu-session", "https://opaque.preview.tenso.work/__tutti_preview_bootstrap#token=example-preview-token", "http://127.0.0.1:4370/join/example-join-token", "http://127.0.0.1:4370/api/v1/join/example-join-token/accept", "http://127.0.0.1:4371/setup?token=example-runtime-token", "host_connection_token=example-host-token", "host_registration_secret=example-host-secret", "TUTTI_FEISHU_APP_SECRET=example-feishu-app-secret", "authorization_code=example-feishu-authorization-code", "app_access_token=example-feishu-app-token", "user_access_token=example-feishu-user-token", "refresh_token=example-feishu-refresh-token", "/Users/example/.tutti/auth.json", "/Users/example/project/.git/config", "/Users/example/.tutti/projects/proj_123/runs/act_123", "OPENAI_API_KEY=example"];
+export declare function redactText(value: string): string;
+export declare function redactValue(value: unknown): unknown;
+export type RedactedError = {
+    name: string;
+    message: string;
+    stack?: string;
+};
+export declare function redactError(error: unknown): unknown;
+export declare function redactAndTruncateText(value: string, maxLength: number): string;
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@tutti/shared/dist/utils/redaction/index.js

@@ -0,0 +1,200 @@
+export const REDACTION_LABELS = {
+    providerApiKey: "[REDACTED:provider_api_key]",
+    bearerToken: "[REDACTED:bearer_token]",
+    cookie: "[REDACTED:cookie]",
+    joinToken: "[REDACTED:join_token]",
+    runtimeToken: "[REDACTED:runtime_token]",
+    hostSecret: "[REDACTED:host_secret]",
+    localPath: "[REDACTED:local_path]",
+};
+export const REDACTION_FIXTURES = [
+    "sk-proj-example-secret",
+    "Authorization: Bearer example-token",
+    "Cookie: tutti_session=example-session",
+    "Cookie: tutti_preview_session=example-preview-session",
+    "Cookie: tutti_feishu_session=example-feishu-session",
+    "https://opaque.preview.tenso.work/__tutti_preview_bootstrap#token=example-preview-token",
+    "http://127.0.0.1:4370/join/example-join-token",
+    "http://127.0.0.1:4370/api/v1/join/example-join-token/accept",
+    "http://127.0.0.1:4371/setup?token=example-runtime-token",
+    "host_connection_token=example-host-token",
+    "host_registration_secret=example-host-secret",
+    "TUTTI_FEISHU_APP_SECRET=example-feishu-app-secret",
+    "authorization_code=example-feishu-authorization-code",
+    "app_access_token=example-feishu-app-token",
+    "user_access_token=example-feishu-user-token",
+    "refresh_token=example-feishu-refresh-token",
+    "/Users/example/.tutti/auth.json",
+    "/Users/example/project/.git/config",
+    "/Users/example/.tutti/projects/proj_123/runs/act_123",
+    "OPENAI_API_KEY=example",
+];
+const TEXT_REDACTION_RULES = [
+    {
+        pattern: /\bOPENAI_API_KEY\s*=\s*[^\s"'`]+/giu,
+        replacement: `OPENAI_API_KEY=${REDACTION_LABELS.providerApiKey}`,
+    },
+    {
+        pattern: /\bAuthorization:\s*Bearer\s+[^\s,;"'`]+/giu,
+        replacement: `Authorization: Bearer ${REDACTION_LABELS.bearerToken}`,
+    },
+    {
+        pattern: /\bBearer\s+[A-Za-z0-9._~+/-]+=*/gu,
+        replacement: `Bearer ${REDACTION_LABELS.bearerToken}`,
+    },
+    {
+        pattern: /\bCookie:\s*[^\n\r]+/giu,
+        replacement: `Cookie: ${REDACTION_LABELS.cookie}`,
+    },
+    {
+        pattern: /\btutti_session\s*=\s*[^;\s,]+/giu,
+        replacement: `tutti_session=${REDACTION_LABELS.cookie}`,
+    },
+    {
+        pattern: /\btutti_preview_session\s*=\s*[^;\s,]+/giu,
+        replacement: `tutti_preview_session=${REDACTION_LABELS.cookie}`,
+    },
+    {
+        pattern: /\btutti_feishu_session\s*=\s*[^;\s,]+/giu,
+        replacement: `tutti_feishu_session=${REDACTION_LABELS.cookie}`,
+    },
+    {
+        pattern: /(https?:\/\/[^\s"'`]+\/__tutti_preview_bootstrap)#token=[A-Za-z0-9._~+/%=-]+/giu,
+        replacement: `$1#token=${REDACTION_LABELS.bearerToken}`,
+    },
+    {
+        pattern: /(^|[\s"'`])\/__tutti_preview_bootstrap#token=[A-Za-z0-9._~+/%=-]+/giu,
+        replacement: `$1/__tutti_preview_bootstrap#token=${REDACTION_LABELS.bearerToken}`,
+    },
+    {
+        pattern: /https?:\/\/[^\s"'`]+\/api\/v1\/join\/[A-Za-z0-9._~+/-]+\/accept/giu,
+        replacement: `https://[REDACTED:host]/api/v1/join/${REDACTION_LABELS.joinToken}/accept`,
+    },
+    {
+        pattern: /https?:\/\/[^\s"'`]+\/join\/[A-Za-z0-9._~+/-]+/giu,
+        replacement: `https://[REDACTED:host]/join/${REDACTION_LABELS.joinToken}`,
+    },
+    {
+        pattern: /(^|[\s"'`])\/api\/v1\/join\/[A-Za-z0-9._~+/-]+\/accept/giu,
+        replacement: `$1/api/v1/join/${REDACTION_LABELS.joinToken}/accept`,
+    },
+    {
+        pattern: /(^|[\s"'`])\/join\/[A-Za-z0-9._~+/-]+/giu,
+        replacement: `$1/join/${REDACTION_LABELS.joinToken}`,
+    },
+    {
+        pattern: /(https?:\/\/[^\s"'`]+\/setup)\?token=[A-Za-z0-9._~+/-]+/giu,
+        replacement: `$1?token=${REDACTION_LABELS.runtimeToken}`,
+    },
+    {
+        pattern: /(^|[\s"'`])\/setup\?token=[A-Za-z0-9._~+/-]+/giu,
+        replacement: `$1/setup?token=${REDACTION_LABELS.runtimeToken}`,
+    },
+    {
+        pattern: /\bhost_connection_token\s*=\s*[^\s"'`&]+/giu,
+        replacement: `host_connection_token=${REDACTION_LABELS.hostSecret}`,
+    },
+    {
+        pattern: /\bhost_registration_secret\s*=\s*[^\s"'`&]+/giu,
+        replacement: `host_registration_secret=${REDACTION_LABELS.hostSecret}`,
+    },
+    {
+        pattern: /\bTUTTI_FEISHU_APP_SECRET\s*=\s*[^\s"'`&]+/giu,
+        replacement: `TUTTI_FEISHU_APP_SECRET=${REDACTION_LABELS.hostSecret}`,
+    },
+    {
+        pattern: /\b(authorization_code|app_access_token|user_access_token|refresh_token)\s*=\s*[^\s"'`&,]+/giu,
+        replacement: `$1=${REDACTION_LABELS.bearerToken}`,
+    },
+    {
+        pattern: /\bsk-(?:proj-)?[A-Za-z0-9_-]{8,}\b/gu,
+        replacement: REDACTION_LABELS.providerApiKey,
+    },
+    {
+        pattern: /(^|[\s"'=:(])((?:\/Users\/|\/home\/|\/private\/var\/folders\/|\/var\/folders\/)[^\s"',)]+)/gu,
+        replacement: `$1${REDACTION_LABELS.localPath}`,
+    },
+];
+function replacementForSensitiveKey(key) {
+    const normalized = key.toLowerCase();
+    if (normalized.endsWith("_ref") || normalized.endsWith("_id")) {
+        return undefined;
+    }
+    if (normalized === "authorization" || normalized.includes("bearer")) {
+        return REDACTION_LABELS.bearerToken;
+    }
+    if (normalized === "openai_api_key" || normalized.endsWith("api_key")) {
+        return REDACTION_LABELS.providerApiKey;
+    }
+    if (normalized === "cookie" || normalized.includes("session_cookie")) {
+        return REDACTION_LABELS.cookie;
+    }
+    if (normalized.includes("join_token")) {
+        return REDACTION_LABELS.joinToken;
+    }
+    if (normalized.includes("host_connection_token") ||
+        normalized.includes("host_registration_secret") ||
+        normalized.includes("host_secret")) {
+        return REDACTION_LABELS.hostSecret;
+    }
+    if (normalized.endsWith("_token") || normalized === "token") {
+        return REDACTION_LABELS.bearerToken;
+    }
+    if (normalized.includes("secret")) {
+        return REDACTION_LABELS.hostSecret;
+    }
+    return undefined;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+export function redactText(value) {
+    let redacted = value;
+    for (const rule of TEXT_REDACTION_RULES) {
+        redacted = redacted.replace(rule.pattern, rule.replacement);
+    }
+    return redacted;
+}
+export function redactValue(value) {
+    if (typeof value === "string") {
+        return redactText(value);
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => redactValue(item));
+    }
+    if (isRecord(value)) {
+        const redacted = {};
+        for (const [key, nested] of Object.entries(value)) {
+            redacted[key] = replacementForSensitiveKey(key) ?? redactValue(nested);
+        }
+        return redacted;
+    }
+    return value;
+}
+export function redactError(error) {
+    if (error instanceof Error) {
+        const redacted = {
+            name: error.name,
+            message: redactText(error.message),
+        };
+        if (error.stack !== undefined) {
+            redacted.stack = redactText(error.stack);
+        }
+        return redacted;
+    }
+    return redactValue(error);
+}
+export function redactAndTruncateText(value, maxLength) {
+    if (!Number.isInteger(maxLength) || maxLength < 0) {
+        throw new RangeError("maxLength must be a non-negative integer");
+    }
+    const redacted = redactText(value);
+    if (redacted.length <= maxLength) {
+        return redacted;
+    }
+    if (maxLength <= 3) {
+        return ".".repeat(maxLength);
+    }
+    return `${redacted.slice(0, maxLength - 3)}...`;
+}
+//# sourceMappingURL=index.js.map

package/node_modules/@tutti/shared/package.json

@@ -0,0 +1,63 @@
+{
+  "name": "@tutti/shared",
+  "version": "0.0.0",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "development": "./dist/index.js",
+      "import": "./dist/index.js"
+    },
+    "./domain": {
+      "types": "./dist/domain/index.d.ts",
+      "development": "./dist/domain/index.js",
+      "import": "./dist/domain/index.js"
+    },
+    "./ids": {
+      "types": "./dist/ids/index.d.ts",
+      "development": "./dist/ids/index.js",
+      "import": "./dist/ids/index.js"
+    },
+    "./schemas/api": {
+      "types": "./dist/schemas/api/index.d.ts",
+      "development": "./dist/schemas/api/index.js",
+      "import": "./dist/schemas/api/index.js"
+    },
+    "./schemas/domain": {
+      "types": "./dist/schemas/domain/index.d.ts",
+      "development": "./dist/schemas/domain/index.js",
+      "import": "./dist/schemas/domain/index.js"
+    },
+    "./schemas/internal": {
+      "types": "./dist/schemas/internal/index.d.ts",
+      "development": "./dist/schemas/internal/index.js",
+      "import": "./dist/schemas/internal/index.js"
+    },
+    "./utils": {
+      "types": "./dist/utils/index.d.ts",
+      "development": "./dist/utils/index.js",
+      "import": "./dist/utils/index.js"
+    },
+    "./utils/command-idempotency": {
+      "types": "./dist/utils/command-idempotency/index.d.ts",
+      "development": "./dist/utils/command-idempotency/index.js",
+      "import": "./dist/utils/command-idempotency/index.js"
+    },
+    "./utils/path-policy": {
+      "types": "./dist/utils/path-policy/index.d.ts",
+      "development": "./dist/utils/path-policy/index.js",
+      "import": "./dist/utils/path-policy/index.js"
+    },
+    "./utils/redaction": {
+      "types": "./dist/utils/redaction/index.d.ts",
+      "development": "./dist/utils/redaction/index.js",
+      "import": "./dist/utils/redaction/index.js"
+    }
+  },
+  "dependencies": {
+    "@sinclair/typebox": "^0.34.49",
+    "ulid": "^3.0.2"
+  }
+}

package/node_modules/ulid/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2017 Alizain Feerasta
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/node_modules/ulid/README.md

@@ -0,0 +1,176 @@
+<h1 align="center">
+	<br>
+	<br>
+	<img width="360" src="logo.png" alt="ulid">
+	<br>
+	<br>
+	<br>
+</h1>
+
+# Universally Unique Lexicographically Sortable Identifier
+
+[![Tests](https://github.com/ulid/javascript/actions/workflows/test.yml/badge.svg)](https://github.com/ulid/javascript/actions/workflows/test.yml)
+[![codecov](https://codecov.io/gh/ulid/javascript/branch/master/graph/badge.svg)](https://codecov.io/gh/ulid/javascript)
+[![npm](https://img.shields.io/npm/dm/ulid.svg)](https://www.npmjs.com/package/ulid) [![npm](https://img.shields.io/npm/dy/ulid)](https://www.npmjs.com/package/ulid)
+
+ULIDs are unique, sortable identifiers that work much in the same way as UUIDs, though with some improvements:
+
+ * Lexicographically sortable
+ * Canonically encoded as a 26 character string, as opposed to the 36 character UUID
+ * Uses Crockford's base32 for better efficiency and readability (5 bits per character)
+ * Monotonic sort order (correctly detects and handles the same millisecond)
+
+ULIDs also provide:
+
+ * 128-bit compatibility with UUID
+ * 1.21e+24 unique IDs per millisecond
+ * Case insensitivity
+ * No special characters (URL safe)
+
+UUID can be suboptimal for many uses-cases because:
+
+- It isn't the most character efficient way of encoding 128 bits of randomness
+- UUID v1/v2 is impractical in many environments, as it requires access to a unique, stable MAC address
+- UUID v3/v5 requires a unique seed and produces randomly distributed IDs, which can cause fragmentation in many data structures
+- UUID v4 provides no other information than randomness which can cause fragmentation in many data structures
+
+## Installation
+
+Install using NPM:
+
+```shell
+npm install ulid --save
+```
+
+### Compatibility
+
+ULID supports the following environments:
+
+| Version   | NodeJS    | Browsers      | React-Native  | Web Workers   | Edge Functions    |
+|-----------|-----------|---------------|---------------|---------------|-------------------|
+| v3        | v18+      | Yes           | Yes           | Yes           | ?                 |
+| v2        | v16+      | Yes           | No            | No            | No                |
+
+Additionally, both ESM and CommonJS entrypoints are provided.
+
+## Usage
+
+To quickly generate a ULID, you can simply import the `ulid` function:
+
+```typescript
+import { ulid } from "ulid";
+
+ulid(); // "01ARZ3NDEKTSV4RRFFQ69G5FAV"
+```
+
+### Seed Time
+
+You can also input a seed time which will consistently give you the same string for the time component. This is useful for migrating to ulid.
+
+```typescript
+ulid(1469918176385) // "01ARYZ6S41TSV4RRFFQ69G5FAV"
+```
+
+### Monotonic ULIDs
+
+To generate monotonically increasing ULIDs, create a monotonic counter with `monotonicFactory`.
+
+> Note that the same seed time is being passed in for this example to demonstrate its behaviour when generating multiple ULIDs within the same millisecond
+
+```typescript
+import { monotonicFactory } from "ulid";
+
+const ulid = monotonicFactory();
+
+// Strict ordering for the same timestamp, by incrementing the least-significant random bit by 1
+ulid(150000); // "000XAL6S41ACTAV9WEVGEMMVR8"
+ulid(150000); // "000XAL6S41ACTAV9WEVGEMMVR9"
+ulid(150000); // "000XAL6S41ACTAV9WEVGEMMVRA"
+ulid(150000); // "000XAL6S41ACTAV9WEVGEMMVRB"
+ulid(150000); // "000XAL6S41ACTAV9WEVGEMMVRC"
+
+// Even if a lower timestamp is passed (or generated), it will preserve sort order
+ulid(100000); // "000XAL6S41ACTAV9WEVGEMMVRD"
+```
+
+### Pseudo-Random Number Generators
+
+`ulid` automatically detects a suitable (cryptographically-secure) PRNG. In the browser it will use `crypto.getRandomValues` and on NodeJS it will use `crypto.randomBytes`.
+
+#### Using `Math.random` (insecure)
+
+By default, `ulid` will not use `Math.random` to generate random values. You can bypass this limitation by overriding the PRNG:
+
+```typescript
+const ulid = monotonicFactory(() => Math.random());
+
+ulid(); // "01BXAVRG61YJ5YSBRM51702F6M"
+```
+
+### Validity
+
+You can verify if a value is a valid ULID by using `isValid`:
+
+```typescript
+import { isValid } from "ulid";
+
+isValid("01ARYZ6S41TSV4RRFFQ69G5FAV"); // true
+isValid("01ARYZ6S41TSV4RRFFQ69G5FA"); // false
+```
+
+### ULID Time
+
+You can encode and decode ULID timestamps by using `encodeTime` and `decodeTime` respectively:
+
+```typescript
+import { decodeTime } from "ulid";
+
+decodeTime("01ARYZ6S41TSV4RRFFQ69G5FAV"); // 1469918176385
+```
+
+Note that while `decodeTime` works on full ULIDs, `encodeTime` encodes only the _time portion_ of ULIDs:
+
+```typescript
+import { encodeTime } from "ulid";
+
+encodeTime(1469918176385); // "01ARYZ6S41"
+```
+
+### Tests
+
+Install dependencies using `npm install` first, and then simply run `npm test` to run the test suite.
+
+### CLI
+
+`ulid` can be used on the command line, either via global install:
+
+```shell
+npm install -g ulid
+ulid
+```
+
+Or via `npx`:
+
+```shell
+npx ulid
+```
+
+You can also generate multiple IDs at the same time:
+
+```shell
+ulid --count 15
+```
+
+## Specification
+
+You can find the full specification, as well as information regarding implementations in other languages, over at [ulid/spec](https://github.com/ulid/spec).
+
+## Performance
+
+You can test `ulid`'s performance by running `npm run bench`:
+
+```
+Simple ulid x 56,782 ops/sec ±2.50% (86 runs sampled)
+ulid with timestamp x 58,574 ops/sec ±1.80% (87 runs sampled)
+Done!
+```