deepline 0.1.222 → 0.1.224

package/dist/index.js

@@ -424,10 +424,10 @@ var SDK_RELEASE = {
   // 0.1.175 ships loud `deepline enrich` empty-waterfall reporting.
   // 0.1.220 deprecates SDK CLI versions below 0.1.219 and updates them
   // automatically without blocking their current command.
-  version: "0.1.222",
+  version: "0.1.224",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.222",
+    latest: "0.1.224",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.219",
     commandMinimumSupported: [
@@ -1163,29 +1163,42 @@ function normalizePlayRunLedgerTerminalSource(value) {
 // ../shared_libs/play-runtime/secret-redaction.ts
 var SECRET_REDACTION_PLACEHOLDER = "[REDACTED_SECRET]";
 var BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
-var JWT_RE = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
+var BASIC_CREDENTIAL_RE = /\bBasic\s+[A-Za-z0-9+/]{4,}={0,2}\b/g;
+var JWT_RE = /\b[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{1,}\.[A-Za-z0-9_-]{8,}\b/g;
 var PRIVATE_KEY_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
-var COMMON_SECRET_RE = /\b(?:(?:sk|pk|rk)_(?:live|test)_[A-Za-z0-9_./+=:-]{12,}|(?:pat|ghp|github_pat)_[A-Za-z0-9_./+=:-]{12,}|xox[baprs]-[A-Za-z0-9_./+=:-]{12,})\b/gi;
+var SENSITIVE_FIELD_NAME = "authorization|cookie|password|(?:client[_-]?)?secret|(?:access|refresh)[_-]?token|(?:x[_-]?)?api[_-]?key|private[_-]?key|token|credentials";
+var COMMON_SECRET_RE = /\b(?:[prs]k_(?:live|test)_|(?:pat|ghp|github_pat)_|xox[baprs]-)[A-Za-z0-9_./+=:-]{12,}\b/gi;
 var GENERIC_PREFIXED_SECRET_RE = /\b(?:key|token|secret|api[_-]?key)_[A-Za-z0-9_./+=:-]{12,}\b/gi;
-var URL_SECRET_VALUE_RE = /\b(?:sk|pk|rk|pat|ghp|github_pat|xox)[A-Za-z0-9_./+=:-]{12,}\b/i;
+var URL_SECRET_VALUE_RE = /\b(?:[spr]k|pat|ghp|github_pat|xox)[A-Za-z0-9_./+=:-]{12,}\b/i;
 var GENERIC_SECRET_ASSIGNMENT_RE = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*["']?[^"',\s]{12,}["']?/gi;
-var HIGH_ENTROPY_ASSIGNMENT_RE = /\b(?:api[_-]?key|token|secret|password|authorization|access[_-]?token|refresh[_-]?token)\b\s*[:=]\s*["']?[^"',\s]{16,}["']?/gi;
+var HIGH_ENTROPY_ASSIGNMENT_RE = /\b(?:api[_-]?key|token|secret|password|authorization|(?:access|refresh)[_-]?token)\b\s*[:=]\s*["']?[^"',\s]{16,}["']?/gi;
 var SENSITIVE_URL_PARAM_RE = /[?#&](?:\w*(?:key|token)|secret|password|authorization|credential|signature|sig)(?:=|$)/i;
+var SENSITIVE_FIELD_NAME_RE = new RegExp(
+  `(^|[._-])(?:${SENSITIVE_FIELD_NAME})$`,
+  "i"
+);
+var SERIALIZED_SECRET_FIELD_RE = new RegExp(
+  `"(${SENSITIVE_FIELD_NAME})"\\s*:\\s*(?:"[^"\\\\]*"|\\{[^{}]*\\})`,
+  "gi"
+);
 function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function isRecord(value) {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}
 function redactSecretLikeString(value) {
-  const trimmed = value.trim();
+  const serializedRedacted = value.replace(
+    SERIALIZED_SECRET_FIELD_RE,
+    `"$1":"${SECRET_REDACTION_PLACEHOLDER}"`
+  );
+  const trimmed = serializedRedacted.trim();
   if (/^https?:\/\/\S+$/i.test(trimmed)) {
     if (/^https?:\/\/[^/?#@]+@/i.test(trimmed) || SENSITIVE_URL_PARAM_RE.test(trimmed)) {
       return SECRET_REDACTION_PLACEHOLDER;
     }
-    if (!URL_SECRET_VALUE_RE.test(value)) return value;
+    if (!URL_SECRET_VALUE_RE.test(serializedRedacted)) {
+      return serializedRedacted;
+    }
   }
-  return value.replace(PRIVATE_KEY_RE, SECRET_REDACTION_PLACEHOLDER).replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`).replace(JWT_RE, SECRET_REDACTION_PLACEHOLDER).replace(COMMON_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(GENERIC_PREFIXED_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(GENERIC_SECRET_ASSIGNMENT_RE, SECRET_REDACTION_PLACEHOLDER).replace(HIGH_ENTROPY_ASSIGNMENT_RE, (match) => {
+  return serializedRedacted.replace(PRIVATE_KEY_RE, SECRET_REDACTION_PLACEHOLDER).replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`).replace(BASIC_CREDENTIAL_RE, `Basic ${SECRET_REDACTION_PLACEHOLDER}`).replace(JWT_RE, SECRET_REDACTION_PLACEHOLDER).replace(COMMON_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(GENERIC_PREFIXED_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(GENERIC_SECRET_ASSIGNMENT_RE, SECRET_REDACTION_PLACEHOLDER).replace(HIGH_ENTROPY_ASSIGNMENT_RE, (match) => {
     const separator = match.includes("=") ? "=" : ":";
     const [key] = match.split(separator, 1);
     return `${key.trim()}${separator}${SECRET_REDACTION_PLACEHOLDER}`;
@@ -1220,9 +1233,12 @@ function createSecretRedactionContext(initialValues = []) {
   function redact(value) {
     if (typeof value === "string") return redactString(value);
     if (Array.isArray(value)) return value.map((entry) => redact(entry));
-    if (isRecord(value)) {
+    if (value && typeof value === "object") {
       return Object.fromEntries(
-        Object.entries(value).map(([key, entry]) => [key, redact(entry)])
+        Object.entries(value).map(([key, entry]) => [
+          key,
+          SENSITIVE_FIELD_NAME_RE.test(key) ? SECRET_REDACTION_PLACEHOLDER : redact(entry)
+        ])
       );
     }
     return value;
@@ -1246,7 +1262,7 @@ var ledgerIngressRedactor = createSecretRedactionContext();
 
 // ../shared_libs/play-runtime/run-ledger.ts
 var LOG_TAIL_LIMIT = 100;
-function isRecord2(value) {
+function isRecord(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 function finiteNumber(value) {
@@ -1339,21 +1355,21 @@ function createEmptyPlayRunLedgerSnapshot(input) {
   };
 }
 function normalizePlayRunLedgerSnapshot(value, fallback) {
-  if (!isRecord2(value)) {
+  if (!isRecord(value)) {
     return createEmptyPlayRunLedgerSnapshot(fallback);
   }
   const orderedStepIds = Array.isArray(value.orderedStepIds) ? value.orderedStepIds.filter(
     (entry) => typeof entry === "string" && Boolean(entry.trim())
   ) : [];
-  const rawSteps = isRecord2(value.stepsById) ? value.stepsById : {};
+  const rawSteps = isRecord(value.stepsById) ? value.stepsById : {};
   const stepsById = {};
   for (const [stepId, rawStep] of Object.entries(rawSteps)) {
-    if (!stepId.trim() || !isRecord2(rawStep)) continue;
+    if (!stepId.trim() || !isRecord(rawStep)) continue;
     const rawStatus = normalizeStepStatus(rawStep.status);
     if (!rawStatus) continue;
     const completedAt = finiteNumber(rawStep.completedAt);
     const status = rawStatus === "running" && completedAt !== null ? "completed" : rawStatus;
-    const rawProgress = isRecord2(rawStep.progress) ? rawStep.progress : null;
+    const rawProgress = isRecord(rawStep.progress) ? rawStep.progress : null;
     stepsById[stepId] = {
       stepId,
       label: optionalString(rawStep.label),
@@ -1368,10 +1384,10 @@ function normalizePlayRunLedgerSnapshot(value, fallback) {
       progress: rawProgress ? normalizeStepProgress(rawProgress) : null
     };
   }
-  const rawDatasets = isRecord2(value.datasetsById) ? value.datasetsById : {};
+  const rawDatasets = isRecord(value.datasetsById) ? value.datasetsById : {};
   const datasetsById = {};
   for (const [datasetId, rawDataset] of Object.entries(rawDatasets)) {
-    if (!datasetId.trim() || !isRecord2(rawDataset)) continue;
+    if (!datasetId.trim() || !isRecord(rawDataset)) continue;
     const phase = rawDataset.phase === "available" || rawDataset.phase === "failed" ? rawDataset.phase : "registered";
     datasetsById[datasetId] = {
       datasetId,
@@ -1502,18 +1518,18 @@ function normalizePlayRunLiveStatus(value) {
 function isTerminalPlayRunLiveStatus(status) {
   return isTerminalPlayRunLifecycleStatus(status);
 }
-function isRecord3(value) {
+function isRecord2(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 function finiteNumber2(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : null;
 }
 function extractTerminalRunLogTail(result) {
-  if (!isRecord3(result) || !isRecord3(result._metadata)) {
+  if (!isRecord2(result) || !isRecord2(result._metadata)) {
     return null;
   }
   const runLogTail = result._metadata.runLogTail;
-  if (!isRecord3(runLogTail) || !Array.isArray(runLogTail.tail)) {
+  if (!isRecord2(runLogTail) || !Array.isArray(runLogTail.tail)) {
     return null;
   }
   const logTail = runLogTail.tail.filter(
@@ -2250,7 +2266,7 @@ function resolveToolExecuteTimeoutMs(toolId) {
 }
 var RUNS_FAILED_LOG_LIMIT = 20;
 var RUN_LOGS_PAGE_LIMIT = 1e3;
-function isRecord4(value) {
+function isRecord3(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 function isPrebuiltPlayDescription(play) {
@@ -2407,7 +2423,7 @@ function updatePlayLiveStatusState(state, event) {
   }
   const runId = typeof payload.runId === "string" && payload.runId ? payload.runId : isPlayRunPackage(payload) ? payload.run.id : state.runId;
   const status = normalizeLiveStatus(payload.status) ?? (isPlayRunPackage(payload) ? normalizeLiveStatus(payload.run.status) : null) ?? state.status;
-  const progressPayload = isRecord4(payload.progress) ? payload.progress : {};
+  const progressPayload = isRecord3(payload.progress) ? payload.progress : {};
   if (event.type === "play.run.final_status" && state.logs.length === 0 && state.lastLogSeq === 0) {
     const payloadLogs = readStringArray(payload.logs);
     const progressLogs = readStringArray(progressPayload.logs);
@@ -2522,9 +2538,9 @@ var DeeplineClient = class {
     return fields.length > 0 ? { fields } : schema;
   }
   schemaMetadata(schema, key) {
-    if (!isRecord4(schema)) return null;
+    if (!isRecord3(schema)) return null;
     const value = schema[key];
-    return isRecord4(value) ? value : null;
+    return isRecord3(value) ? value : null;
   }
   playRunCommand(play, options) {
     const target = play.reference || play.name;
@@ -2573,7 +2589,7 @@ var DeeplineClient = class {
       aliases,
       inputSchema: options?.compact ? this.compactSchema(play.inputSchema) : play.inputSchema ?? null,
       outputSchema: options?.compact ? this.compactSchema(play.outputSchema) : play.outputSchema ?? null,
-      staticPipeline: isRecord4(play.staticPipeline) ? play.staticPipeline : isRecord4(play.currentRevision?.staticPipeline) ? play.currentRevision.staticPipeline : isRecord4(play.liveRevision?.staticPipeline) ? play.liveRevision.staticPipeline : null,
+      staticPipeline: isRecord3(play.staticPipeline) ? play.staticPipeline : isRecord3(play.currentRevision?.staticPipeline) ? play.currentRevision.staticPipeline : isRecord3(play.liveRevision?.staticPipeline) ? play.liveRevision.staticPipeline : null,
       ...csvInput ? { csvInput } : {},
       ...rowOutputSchema ? { rowOutputSchema } : {},
       runCommand,
@@ -5038,7 +5054,7 @@ var TARGET_FALLBACK_KEYS = {
   status: [/^email_status$/i, /^status$/i],
   email_status: [/^email_status$/i, /^status$/i]
 };
-function isRecord5(value) {
+function isRecord4(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function toV2RawToolOutputPath(path) {
@@ -5098,7 +5114,7 @@ function valuesAtSegments(current, segments, path = []) {
     if (!Array.isArray(current)) return [];
     return valuesAtSegments(current[segment], rest, [...path, segment]);
   }
-  if (!isRecord5(current)) return [];
+  if (!isRecord4(current)) return [];
   const directMatches = valuesAtSegments(current[segment], rest, [
     ...path,
     segment
@@ -5128,7 +5144,7 @@ function getValuesAtPath(root, path) {
   return valuesAtSegments(root, parsePath(path)).map((entry) => entry.value);
 }
 function toResultEnvelope(value) {
-  if (isRecord5(value) && "data" in value) {
+  if (isRecord4(value) && "data" in value) {
     const envelope = { data: value.data };
     if ("meta" in value) envelope.meta = value.meta;
     return envelope;
@@ -5181,7 +5197,7 @@ function getAtPath(root, path) {
       current = current[segment];
       continue;
     }
-    if (!isRecord5(current)) return void 0;
+    if (!isRecord4(current)) return void 0;
     current = current[segment];
   }
   return current;
@@ -5198,7 +5214,7 @@ function normalizeString(value) {
 }
 function normalizeRows(value) {
   if (!Array.isArray(value)) return null;
-  return value.map((entry) => isRecord5(entry) ? entry : { value: entry });
+  return value.map((entry) => isRecord4(entry) ? entry : { value: entry });
 }
 function findFirstTargetByPath(result, paths) {
   for (const path of paths ?? []) {
@@ -5257,7 +5273,7 @@ function findFirstTargetByKey(result, target, depth = 0, path = []) {
     }
     return null;
   }
-  if (!isRecord5(result)) return null;
+  if (!isRecord4(result)) return null;
   const patterns = TARGET_FALLBACK_KEYS[target] ?? [
     new RegExp(`^${target}$`, "i")
   ];
@@ -5317,7 +5333,7 @@ function normalizeJobChangeStatus(value) {
 function firstExperienceDate(value) {
   if (!Array.isArray(value)) return null;
   for (const entry of value) {
-    if (!isRecord5(entry)) continue;
+    if (!isRecord4(entry)) continue;
     const date = normalizeString(
       entry.start_date ?? entry.started_at ?? entry.startDate
     );
@@ -5326,10 +5342,10 @@ function firstExperienceDate(value) {
   return null;
 }
 function normalizeJobChange(value) {
-  const record = isRecord5(value) ? value : {};
-  const nested = isRecord5(record.job_change) ? record.job_change : record;
-  const output = isRecord5(nested.output) ? nested.output : nested;
-  const person = isRecord5(output.person) ? output.person : {};
+  const record = isRecord4(value) ? value : {};
+  const nested = isRecord4(record.job_change) ? record.job_change : record;
+  const output = isRecord4(nested.output) ? nested.output : nested;
+  const person = isRecord4(output.person) ? output.person : {};
   const status = normalizeJobChangeStatus(
     output.status ?? output.job_change_status ?? output.job_changed ?? output.changed
   );
@@ -5694,7 +5710,7 @@ function attachToolResultListDataset(result, input) {
     root = replaceAtPath(root, candidate, serialized.preview);
     break;
   }
-  if (isRecord5(root) && isRecord5(root.toolResponse) && Object.prototype.hasOwnProperty.call(root.toolResponse, "raw")) {
+  if (isRecord4(root) && isRecord4(root.toolResponse) && Object.prototype.hasOwnProperty.call(root.toolResponse, "raw")) {
     result.toolResponse.raw = root.toolResponse.raw;
     result.toolOutput.raw = root.toolResponse.raw;
   }
@@ -5712,7 +5728,7 @@ function replaceAtPath(root, path, replacement) {
       copy[segment] = replace(copy[segment], index + 1);
       return copy;
     }
-    if (!isRecord5(current)) return current;
+    if (!isRecord4(current)) return current;
     return {
       ...current,
       [segment]: replace(current[segment], index + 1)
@@ -6033,11 +6049,11 @@ var Deepline = class {
     return new DeeplineContext(options);
   }
 };
-function isRecord6(value) {
+function isRecord5(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function stringArrayRecord(value) {
-  if (!isRecord6(value)) return {};
+  if (!isRecord5(value)) return {};
   return Object.fromEntries(
     Object.entries(value).map(([key, paths]) => [
       key,
@@ -6049,7 +6065,7 @@ function stringArray(value) {
   return Array.isArray(value) ? value.map(String) : [];
 }
 function emailStatusExtractorConfig(value) {
-  if (!isRecord6(value)) return void 0;
+  if (!isRecord5(value)) return void 0;
   const readPaths = (key) => {
     const paths = stringArray(value[key]).map((path) => path.trim()).filter(Boolean);
     return paths.length > 0 ? paths : void 0;
@@ -6076,7 +6092,7 @@ function emailStatusExtractorConfig(value) {
     const paths = readPaths(key);
     if (paths) config[key] = paths;
   }
-  if (isRecord6(value.statusMap)) {
+  if (isRecord5(value.statusMap)) {
     config.statusMap = value.statusMap;
   }
   if (Array.isArray(value.rules)) {
@@ -6085,10 +6101,10 @@ function emailStatusExtractorConfig(value) {
   return config;
 }
 function extractorDescriptorRecord(value) {
-  if (!isRecord6(value)) return {};
+  if (!isRecord5(value)) return {};
   return Object.fromEntries(
     Object.entries(value).flatMap(([key, descriptor]) => {
-      if (!isRecord6(descriptor)) return [];
+      if (!isRecord5(descriptor)) return [];
       const paths = stringArray(descriptor.paths).map((path) => path.trim()).filter(Boolean);
       if (paths.length === 0) return [];
       const transforms = stringArray(descriptor.transforms).map((transform) => transform.trim()).filter(Boolean);
@@ -6110,7 +6126,7 @@ function extractorDescriptorRecord(value) {
 }
 function rowsFromUnknown(value) {
   if (!Array.isArray(value)) return [];
-  return value.map((row) => isRecord6(row) ? row : { value: row });
+  return value.map((row) => isRecord5(row) ? row : { value: row });
 }
 function finiteNonNegativeInteger(value) {
   if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
@@ -6132,8 +6148,8 @@ function stableHash(value) {
 }
 function attachSdkQueryResultDatasetResult(toolId, result, options) {
   if (!options || !isQueryResultDatasetTool(toolId)) return result;
-  const raw = isRecord6(result.toolResponse.raw) ? result.toolResponse.raw : null;
-  const dataset = isRecord6(raw?.dataset) ? raw.dataset : null;
+  const raw = isRecord5(result.toolResponse.raw) ? result.toolResponse.raw : null;
+  const dataset = isRecord5(raw?.dataset) ? raw.dataset : null;
   const totalRows = finiteNonNegativeInteger(dataset?.total_rows);
   const sql = typeof options.input.sql === "string" ? options.input.sql : typeof options.input.query === "string" ? options.input.query : typeof raw?.sql === "string" ? raw.sql : null;
   if (!dataset || totalRows === null || !sql) {
@@ -6163,7 +6179,7 @@ function attachSdkQueryResultDatasetResult(toolId, result, options) {
         } : {}
       }
     });
-    const pageRaw = isRecord6(response.toolResponse?.raw) ? response.toolResponse.raw : null;
+    const pageRaw = isRecord5(response.toolResponse?.raw) ? response.toolResponse.raw : null;
     return rowsFromUnknown(pageRaw?.rows);
   };
   const collectRows = async (limit) => {
@@ -6216,8 +6232,8 @@ function attachSdkQueryResultDatasetResult(toolId, result, options) {
 function toolExecutionEnvelopeToResult(fallbackToolId, response, options) {
   const raw = response.toolResponse?.raw ?? null;
   const meta = response.toolResponse?.meta;
-  const metadata = isRecord6(response._metadata) ? response._metadata.tool : null;
-  const toolMetadata = isRecord6(metadata) ? metadata : {};
+  const metadata = isRecord5(response._metadata) ? response._metadata.tool : null;
+  const toolMetadata = isRecord5(metadata) ? metadata : {};
   return attachSdkQueryResultDatasetResult(
     fallbackToolId,
     createToolExecuteResult({
@@ -6225,7 +6241,7 @@ function toolExecutionEnvelopeToResult(fallbackToolId, response, options) {
       jobId: typeof response.job_id === "string" ? response.job_id : void 0,
       result: {
         data: raw,
-        ...isRecord6(meta) ? { meta } : {}
+        ...isRecord5(meta) ? { meta } : {}
       },
       metadata: {
         toolId: typeof toolMetadata.toolId === "string" ? toolMetadata.toolId : fallbackToolId,
@@ -6241,7 +6257,7 @@ function toolExecutionEnvelopeToResult(fallbackToolId, response, options) {
         cached: false,
         source: "live"
       },
-      meta: isRecord6(response.meta) ? response.meta : void 0
+      meta: isRecord5(response.meta) ? response.meta : void 0
     }),
     options
   );