deepline 0.1.222 → 0.1.224

package/dist/bundling-sources/shared_libs/observability/tracing.ts

@@ -0,0 +1,93 @@
+import {
+  SpanKind,
+  SpanStatusCode,
+  trace,
+  type Attributes,
+  type Span,
+} from '@opentelemetry/api';
+
+type PrimitiveAttribute = string | number | boolean | null | undefined;
+
+type TraceAttributes = Record<string, PrimitiveAttribute>;
+
+function normalizeAttributes(
+  attributes: TraceAttributes | undefined,
+): Attributes | undefined {
+  if (!attributes) {
+    return undefined;
+  }
+
+  const normalized: Attributes = {};
+  for (const [key, value] of Object.entries(attributes)) {
+    if (value === undefined || value === null) {
+      continue;
+    }
+    if (
+      typeof value === 'string' ||
+      typeof value === 'number' ||
+      typeof value === 'boolean'
+    ) {
+      normalized[key] = value;
+    }
+  }
+  return Object.keys(normalized).length > 0 ? normalized : undefined;
+}
+
+function recordError(span: Span, error: unknown): void {
+  if (error instanceof Error) {
+    span.recordException(error);
+    span.setStatus({
+      code: SpanStatusCode.ERROR,
+      message: error.message,
+    });
+    return;
+  }
+
+  const message = String(error);
+  span.recordException({ name: 'Error', message });
+  span.setStatus({
+    code: SpanStatusCode.ERROR,
+    message,
+  });
+}
+
+export async function withActiveSpan<T>(
+  name: string,
+  options: {
+    tracer?: string;
+    kind?: SpanKind;
+    attributes?: TraceAttributes;
+  },
+  fn: (span: Span) => Promise<T> | T,
+): Promise<T> {
+  const tracer = trace.getTracer(options.tracer ?? 'deepline');
+  return await tracer.startActiveSpan(
+    name,
+    {
+      kind: options.kind,
+      attributes: normalizeAttributes(options.attributes),
+    },
+    async (span) => {
+      try {
+        const result = await fn(span);
+        span.setStatus({ code: SpanStatusCode.OK });
+        return result;
+      } catch (error) {
+        recordError(span, error);
+        throw error;
+      } finally {
+        span.end();
+      }
+    },
+  );
+}
+
+export function setSpanAttributes(
+  span: Span,
+  attributes: TraceAttributes,
+): void {
+  const normalized = normalizeAttributes(attributes);
+  if (normalized) {
+    span.setAttributes(normalized);
+  }
+}

package/dist/bundling-sources/shared_libs/observability/worker-telemetry.ts

@@ -0,0 +1,119 @@
+export type TelemetryScalar = string | number | boolean | null | undefined;
+export type TelemetryFields = Readonly<Record<string, unknown>>;
+
+type TelemetryContext = {
+  orgId?: string | null;
+  playName?: string | null;
+  requestId?: string | null;
+  runId?: string | null;
+};
+
+export type TelemetryEvent = {
+  telemetrySchemaVersion: 1;
+  timestamp: string;
+  service: string;
+  component: string | null;
+  event: string;
+  tag: string;
+  telemetryKind: 'log';
+  telemetryLevel: 'info' | 'warn' | 'error';
+  errorType?: string;
+  errorMessage?: string;
+} & TelemetryContext &
+  Record<string, TelemetryScalar>;
+
+type TelemetryAdapter = { emit(event: TelemetryEvent): void | Promise<void> };
+type TelemetryOptions = { tag?: string };
+type WorkerTelemetryInput = {
+  service: string;
+  component?: string;
+  context?: TelemetryContext;
+  adapter?: TelemetryAdapter;
+};
+
+type WorkerTelemetry = {
+  child(input: {
+    component?: string;
+    context?: TelemetryContext;
+  }): WorkerTelemetry;
+  info(
+    event: string,
+    fields?: TelemetryFields,
+    options?: TelemetryOptions,
+  ): Promise<void>;
+  warn(
+    event: string,
+    fields?: TelemetryFields,
+    options?: TelemetryOptions,
+  ): Promise<void>;
+  error(
+    event: string,
+    error?: unknown,
+    fields?: TelemetryFields,
+    options?: TelemetryOptions,
+  ): Promise<void>;
+};
+
+/**
+ * Small, Worker-safe implementation of the canonical telemetry envelope.
+ * It intentionally omits server-only recursive normalization and adapters so
+ * it can remain in the size-capped dynamic play bundle.
+ */
+export function createWorkerTelemetry(
+  input: WorkerTelemetryInput,
+): WorkerTelemetry {
+  const service = input.service.trim();
+  const component = input.component?.trim() || null;
+  const context = input.context ?? {};
+  const adapter = input.adapter ?? {
+    emit: (event: TelemetryEvent) =>
+      console[event.telemetryLevel](JSON.stringify(event)),
+  };
+
+  async function emit(
+    level: TelemetryEvent['telemetryLevel'],
+    event: string,
+    fields?: TelemetryFields,
+    options?: TelemetryOptions,
+    error?: unknown,
+  ): Promise<void> {
+    try {
+      await adapter.emit({
+        telemetrySchemaVersion: 1,
+        timestamp: new Date().toISOString(),
+        service,
+        component,
+        event,
+        tag: options?.tag?.trim() || `[${event}]`,
+        ...context,
+        ...(fields as Record<string, TelemetryScalar>),
+        telemetryKind: 'log',
+        telemetryLevel: level,
+        ...(error == null
+          ? {}
+          : {
+              errorType: error instanceof Error ? error.name : 'Error',
+              errorMessage:
+                error instanceof Error ? error.message : String(error),
+            }),
+      });
+    } catch {
+      // Never make workflow execution depend on telemetry delivery.
+    }
+  }
+
+  return {
+    child(child) {
+      return createWorkerTelemetry({
+        service,
+        component: child.component ?? component ?? undefined,
+        context: { ...context, ...child.context },
+        adapter,
+      });
+    },
+    info: (event, fields, options) => emit('info', event, fields, options),
+    warn: (event, fields, options) => emit('warn', event, fields, options),
+    error: (event, error, fields, options) =>
+      emit('error', event, fields, options, error),
+  };
+}

package/dist/bundling-sources/shared_libs/play-runtime/secret-redaction.ts

@@ -1,37 +1,47 @@
 export const SECRET_REDACTION_PLACEHOLDER = '[REDACTED_SECRET]';
 
 const BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
-const JWT_RE =
-  /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
+const BASIC_CREDENTIAL_RE = /\bBasic\s+[A-Za-z0-9+/]{4,}={0,2}\b/g;
+const JWT_RE = /\b[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{1,}\.[A-Za-z0-9_-]{8,}\b/g;
 const PRIVATE_KEY_RE =
   /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
+const SENSITIVE_FIELD_NAME =
+  'authorization|cookie|password|(?:client[_-]?)?secret|(?:access|refresh)[_-]?token|(?:x[_-]?)?api[_-]?key|private[_-]?key|token|credentials';
 // Only redact self-identifying credential prefixes here. Generic words such as
 // `key`, `token`, and `secret` are common in harmless play/run slugs (for
 // example `absurd-key-rotation-check`) and need an assignment context before
 // they are sensitive; HIGH_ENTROPY_ASSIGNMENT_RE handles that case below.
 const COMMON_SECRET_RE =
-  /\b(?:(?:sk|pk|rk)_(?:live|test)_[A-Za-z0-9_./+=:-]{12,}|(?:pat|ghp|github_pat)_[A-Za-z0-9_./+=:-]{12,}|xox[baprs]-[A-Za-z0-9_./+=:-]{12,})\b/gi;
+  /\b(?:[prs]k_(?:live|test)_|(?:pat|ghp|github_pat)_|xox[baprs]-)[A-Za-z0-9_./+=:-]{12,}\b/gi;
 const GENERIC_PREFIXED_SECRET_RE =
   /\b(?:key|token|secret|api[_-]?key)_[A-Za-z0-9_./+=:-]{12,}\b/gi;
 const URL_SECRET_VALUE_RE =
-  /\b(?:sk|pk|rk|pat|ghp|github_pat|xox)[A-Za-z0-9_./+=:-]{12,}\b/i;
+  /\b(?:[spr]k|pat|ghp|github_pat|xox)[A-Za-z0-9_./+=:-]{12,}\b/i;
 const GENERIC_SECRET_ASSIGNMENT_RE =
   /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*["']?[^"',\s]{12,}["']?/gi;
 const HIGH_ENTROPY_ASSIGNMENT_RE =
-  /\b(?:api[_-]?key|token|secret|password|authorization|access[_-]?token|refresh[_-]?token)\b\s*[:=]\s*["']?[^"',\s]{16,}["']?/gi;
+  /\b(?:api[_-]?key|token|secret|password|authorization|(?:access|refresh)[_-]?token)\b\s*[:=]\s*["']?[^"',\s]{16,}["']?/gi;
 const SENSITIVE_URL_PARAM_RE =
   /[?#&](?:\w*(?:key|token)|secret|password|authorization|credential|signature|sig)(?:=|$)/i;
+const SENSITIVE_FIELD_NAME_RE = new RegExp(
+  `(^|[._-])(?:${SENSITIVE_FIELD_NAME})$`,
+  'i',
+);
+const SERIALIZED_SECRET_FIELD_RE = new RegExp(
+  `"(${SENSITIVE_FIELD_NAME})"\\s*:\\s*(?:"[^"\\\\]*"|\\{[^{}]*\\})`,
+  'gi',
+);
 
 function escapeRegExp(value: string): string {
   return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
-}
-
 export function redactSecretLikeString(value: string): string {
-  const trimmed = value.trim();
+  const serializedRedacted = value.replace(
+    SERIALIZED_SECRET_FIELD_RE,
+    `"$1":"${SECRET_REDACTION_PLACEHOLDER}"`,
+  );
+  const trimmed = serializedRedacted.trim();
   if (/^https?:\/\/\S+$/i.test(trimmed)) {
     if (
       /^https?:\/\/[^/?#@]+@/i.test(trimmed) ||
@@ -39,12 +49,15 @@ export function redactSecretLikeString(value: string): string {
     ) {
       return SECRET_REDACTION_PLACEHOLDER;
     }
-    if (!URL_SECRET_VALUE_RE.test(value)) return value;
+    if (!URL_SECRET_VALUE_RE.test(serializedRedacted)) {
+      return serializedRedacted;
+    }
   }
 
-  return value
+  return serializedRedacted
     .replace(PRIVATE_KEY_RE, SECRET_REDACTION_PLACEHOLDER)
     .replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`)
+    .replace(BASIC_CREDENTIAL_RE, `Basic ${SECRET_REDACTION_PLACEHOLDER}`)
     .replace(JWT_RE, SECRET_REDACTION_PLACEHOLDER)
     .replace(COMMON_SECRET_RE, SECRET_REDACTION_PLACEHOLDER)
     .replace(GENERIC_PREFIXED_SECRET_RE, SECRET_REDACTION_PLACEHOLDER)
@@ -99,9 +112,14 @@ export function createSecretRedactionContext(
   function redact<T>(value: T): T {
     if (typeof value === 'string') return redactString(value) as T;
     if (Array.isArray(value)) return value.map((entry) => redact(entry)) as T;
-    if (isRecord(value)) {
+    if (value && typeof value === 'object') {
       return Object.fromEntries(
-        Object.entries(value).map(([key, entry]) => [key, redact(entry)]),
+        Object.entries(value).map(([key, entry]) => [
+          key,
+          SENSITIVE_FIELD_NAME_RE.test(key)
+            ? SECRET_REDACTION_PLACEHOLDER
+            : redact(entry),
+        ]),
       ) as T;
     }
     return value;