deepline 0.1.240 → 0.1.241

package/dist/bundling-sources/sdk/src/release.ts

@@ -110,10 +110,13 @@ export const SDK_RELEASE = {
   // silently materializing them as unmatched results.
   // 0.1.220 deprecates SDK CLI versions below 0.1.219 and updates them
   // automatically without blocking their current command.
-  version: '0.1.240',
-  apiContract: '2026-06-dataset-handle-results-hard-cutover',
+  // 0.1.241 hard-cuts published and launched plays to immutable cjs_node20
+  // artifacts. Older clients can submit esm_workers artifacts that the Absurd
+  // runtime intentionally no longer compiles at publish or launch time.
+  version: '0.1.241',
+  apiContract: '2026-07-immutable-cjs-play-artifacts-hard-cutover',
   supportPolicy: {
-    latest: '0.1.240',
+    latest: '0.1.241',
     minimumSupported: '0.1.53',
     deprecatedBelow: '0.1.219',
     commandMinimumSupported: [

package/dist/bundling-sources/shared_libs/plays/artifact-kind-guard.ts

@@ -42,12 +42,18 @@ export function bundledCodeHasCloudflareSchemeImport(
 export class PlayArtifactKindMismatchError extends Error {
   readonly expectedKind: PlayArtifactKind;
   readonly actualKind: PlayArtifactKind;
-  readonly reason: 'kind_mismatch' | 'cloudflare_scheme_import';
+  readonly reason:
+    | 'kind_mismatch'
+    | 'code_format_mismatch'
+    | 'cloudflare_scheme_import';
 
   constructor(input: {
     expectedKind: PlayArtifactKind;
     actualKind: PlayArtifactKind;
-    reason: 'kind_mismatch' | 'cloudflare_scheme_import';
+    reason:
+      | 'kind_mismatch'
+      | 'code_format_mismatch'
+      | 'cloudflare_scheme_import';
     message: string;
   }) {
     super(input.message);
@@ -96,6 +102,19 @@ export function assertNodeRunnableArtifact(input: {
     });
   }
 
+  if (artifact.codeFormat !== 'cjs_module') {
+    throw new PlayArtifactKindMismatchError({
+      expectedKind,
+      actualKind,
+      reason: 'code_format_mismatch',
+      message:
+        `Node runner (${context}) received a "${actualKind}" play artifact ` +
+        `with codeFormat "${artifact.codeFormat}" but requires "cjs_module". ` +
+        `The artifact metadata is inconsistent; rebuild it for the node runner ` +
+        `before launch.`,
+    });
+  }
+
   if (bundledCodeHasCloudflareSchemeImport(artifact.bundledCode)) {
     throw new PlayArtifactKindMismatchError({
       expectedKind,

package/dist/bundling-sources/shared_libs/plays/bundling/index.ts

@@ -440,6 +440,17 @@ function findSourceImportReferences(
   );
 }
 
+/**
+ * Reports local runtime edges using the same parser that drives graph analysis.
+ * Migration code uses this to distinguish truly single-file source from stored
+ * graph metadata without maintaining a second import parser.
+ */
+export function countLocalRuntimeImportReferences(sourceCode: string): number {
+  return findSourceImportReferences(sourceCode).filter((reference) =>
+    isLocalSpecifier(reference.specifier),
+  ).length;
+}
+
 function findMatchingBrace(source: string, openIndex: number): number {
   const structuralSource = maskSourceForStructure(source);
   let depth = 0;

package/dist/bundling-sources/shared_libs/plays/secret-guardrails.ts

@@ -6,6 +6,10 @@ const BEARER_LITERAL_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/i;
 const ASSIGNMENT_SECRET_LITERAL_PATTERN =
   /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*['"][^'"]{12,}['"]/i;
 const HIGH_ENTROPY_LITERAL_PATTERN = /['"]([A-Za-z0-9+/=_-]{32,})['"]/g;
+const UUID_IDENTIFIER_PATTERN =
+  /^((?:[A-Za-z0-9]+[-_])*)?([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
+const SECRET_LABEL_PATTERN =
+  /(?:^|[-_])(?:api|auth|access|secret|token|key|password|credential|bearer|sk|pk|live)(?:[-_]|$)/i;
 
 function shannonEntropy(value: string): number {
   const counts = new Map<string, number>();
@@ -16,6 +20,13 @@ function shannonEntropy(value: string): number {
   }, 0);
 }
 
+function isNonSecretUuidIdentifier(value: string): boolean {
+  const match = UUID_IDENTIFIER_PATTERN.exec(value);
+  if (!match) return false;
+  const label = match[1] ?? '';
+  return !SECRET_LABEL_PATTERN.test(label);
+}
+
 /**
  * Returns the inline-secret findings in a string (empty if none). The throwing
  * validator below and the workflows→plays migration validator both call this so
@@ -35,6 +46,9 @@ export function collectInlineSecretFindings(sourceCode: string): string[] {
   }
   for (const match of sourceCode.matchAll(HIGH_ENTROPY_LITERAL_PATTERN)) {
     const literal = match[1] ?? '';
+    // UUID-bearing resource names are structured identifiers, not opaque
+    // credentials. Keep secret-looking labels on the conservative path.
+    if (isNonSecretUuidIdentifier(literal)) continue;
     if (literal.length >= 40 && shannonEntropy(literal) >= 4.2) {
       findings.push('high-entropy string literal');
       break;

package/dist/bundling-sources/shared_libs/plays/source-metadata.ts

@@ -0,0 +1,239 @@
+import ts from 'typescript';
+
+type SourceMetadata = {
+  name: string | null;
+  description: string | null;
+};
+
+type SourceContext = {
+  declarations: Map<string, ts.Expression>;
+  namedExports: Map<string, string>;
+  defaultExport: ts.Expression | null;
+};
+
+function unwrap(expression: ts.Expression | null): ts.Expression | null {
+  let current = expression;
+  while (current) {
+    if (
+      ts.isAsExpression(current) ||
+      ts.isSatisfiesExpression(current) ||
+      ts.isTypeAssertionExpression(current) ||
+      ts.isNonNullExpression(current) ||
+      ts.isParenthesizedExpression(current)
+    ) {
+      current = current.expression;
+      continue;
+    }
+    break;
+  }
+  return current;
+}
+
+function buildContext(sourceFile: ts.SourceFile): SourceContext {
+  const declarations = new Map<string, ts.Expression>();
+  const namedExports = new Map<string, string>();
+  let defaultExport: ts.Expression | null = null;
+
+  for (const statement of sourceFile.statements) {
+    if (ts.isVariableStatement(statement)) {
+      const exported = statement.modifiers?.some(
+        (modifier) => modifier.kind === ts.SyntaxKind.ExportKeyword,
+      );
+      const immutable = Boolean(
+        statement.declarationList.flags & ts.NodeFlags.Const,
+      );
+      for (const declaration of statement.declarationList.declarations) {
+        if (!ts.isIdentifier(declaration.name) || !declaration.initializer)
+          continue;
+        if (immutable) {
+          declarations.set(declaration.name.text, declaration.initializer);
+        }
+        if (exported) {
+          namedExports.set(declaration.name.text, declaration.name.text);
+        }
+      }
+      continue;
+    }
+    if (ts.isExportAssignment(statement) && !statement.isExportEquals) {
+      defaultExport = statement.expression;
+      continue;
+    }
+    if (!ts.isExportDeclaration(statement) || !statement.exportClause) {
+      continue;
+    }
+    if (ts.isNamedExports(statement.exportClause)) {
+      for (const element of statement.exportClause.elements) {
+        namedExports.set(
+          element.name.text,
+          element.propertyName?.text ?? element.name.text,
+        );
+      }
+    }
+  }
+  return { declarations, namedExports, defaultExport };
+}
+
+function resolveExpression(
+  expression: ts.Expression | null,
+  context: SourceContext,
+  seen = new Set<string>(),
+): ts.Expression | null {
+  const unwrapped = unwrap(expression);
+  if (!unwrapped || !ts.isIdentifier(unwrapped)) return unwrapped;
+  if (seen.has(unwrapped.text)) return null;
+  seen.add(unwrapped.text);
+  return resolveExpression(
+    context.declarations.get(unwrapped.text) ?? null,
+    context,
+    seen,
+  );
+}
+
+function staticString(
+  expression: ts.Expression | undefined,
+  context: SourceContext,
+  seen = new Set<string>(),
+  trimResult = true,
+): string | null {
+  const resolved = unwrap(expression ?? null);
+  if (
+    resolved &&
+    (ts.isStringLiteral(resolved) ||
+      ts.isNoSubstitutionTemplateLiteral(resolved))
+  ) {
+    if (!resolved.text.trim()) return null;
+    return trimResult ? resolved.text.trim() : resolved.text;
+  }
+  if (
+    resolved &&
+    ts.isBinaryExpression(resolved) &&
+    resolved.operatorToken.kind === ts.SyntaxKind.PlusToken
+  ) {
+    const left = staticString(resolved.left, context, new Set(seen), false);
+    const right = staticString(resolved.right, context, new Set(seen), false);
+    const value = left !== null && right !== null ? `${left}${right}` : null;
+    if (!value?.trim()) return null;
+    return trimResult ? value.trim() : value;
+  }
+  if (!resolved || !ts.isIdentifier(resolved) || seen.has(resolved.text)) {
+    return null;
+  }
+  seen.add(resolved.text);
+  return staticString(
+    context.declarations.get(resolved.text),
+    context,
+    seen,
+    trimResult,
+  );
+}
+
+function propertyName(name: ts.PropertyName): string | null {
+  return ts.isIdentifier(name) ||
+    ts.isStringLiteral(name) ||
+    ts.isNumericLiteral(name)
+    ? name.text
+    : null;
+}
+
+function objectStringProperty(
+  expression: ts.Expression | undefined,
+  key: string,
+  context: SourceContext,
+): string | null {
+  const resolved = resolveExpression(expression ?? null, context);
+  if (!resolved || !ts.isObjectLiteralExpression(resolved)) return null;
+  for (const property of resolved.properties) {
+    if (
+      ts.isPropertyAssignment(property) &&
+      propertyName(property.name) === key
+    ) {
+      return staticString(property.initializer, context);
+    }
+    if (
+      ts.isShorthandPropertyAssignment(property) &&
+      property.name.text === key
+    ) {
+      return staticString(property.name, context);
+    }
+  }
+  return null;
+}
+
+function isDefinePlayCall(call: ts.CallExpression): boolean {
+  const callee = unwrap(call.expression);
+  if (callee && ts.isIdentifier(callee)) {
+    return callee.text === 'definePlay' || callee.text === 'defineWorkflow';
+  }
+  return Boolean(
+    callee &&
+    ts.isPropertyAccessExpression(callee) &&
+    (callee.name.text === 'definePlay' ||
+      callee.name.text === 'defineWorkflow'),
+  );
+}
+
+function metadataFromExpression(
+  expression: ts.Expression | null,
+  context: SourceContext,
+): SourceMetadata | null {
+  const resolved = resolveExpression(expression, context);
+  if (
+    !resolved ||
+    !ts.isCallExpression(resolved) ||
+    !isDefinePlayCall(resolved)
+  ) {
+    return null;
+  }
+  const [first] = resolved.arguments;
+  const name =
+    objectStringProperty(first, 'id', context) ?? staticString(first, context);
+  let description = objectStringProperty(first, 'description', context);
+  for (
+    let index = resolved.arguments.length - 1;
+    !description && index >= 2;
+    index -= 1
+  ) {
+    description = objectStringProperty(
+      resolved.arguments[index],
+      'description',
+      context,
+    );
+  }
+  return name || description ? { name, description } : null;
+}
+
+function extractMetadata(sourceCode: string, exportName: string | null) {
+  const sourceFile = ts.createSourceFile(
+    'play.ts',
+    sourceCode,
+    ts.ScriptTarget.Latest,
+    true,
+    ts.ScriptKind.TS,
+  );
+  const context = buildContext(sourceFile);
+  const exportedExpression = exportName
+    ? exportName === 'default'
+      ? context.defaultExport
+      : (context.declarations.get(
+          context.namedExports.get(exportName) ?? exportName,
+        ) ?? null)
+    : context.defaultExport;
+  const exported = metadataFromExpression(exportedExpression, context);
+  if (exported || exportName) return exported;
+  for (const expression of context.declarations.values()) {
+    const metadata = metadataFromExpression(expression, context);
+    if (metadata) return metadata;
+  }
+  return null;
+}
+
+export function extractDefinedPlayName(sourceCode: string): string | null {
+  return extractMetadata(sourceCode, null)?.name ?? null;
+}
+
+export function extractDefinedPlayDescriptionForExport(
+  sourceCode: string,
+  exportName: string,
+): string | null {
+  return extractMetadata(sourceCode, exportName)?.description ?? null;
+}

package/dist/cli/index.js

@@ -627,10 +627,13 @@ var SDK_RELEASE = {
   // silently materializing them as unmatched results.
   // 0.1.220 deprecates SDK CLI versions below 0.1.219 and updates them
   // automatically without blocking their current command.
-  version: "0.1.240",
-  apiContract: "2026-06-dataset-handle-results-hard-cutover",
+  // 0.1.241 hard-cuts published and launched plays to immutable cjs_node20
+  // artifacts. Older clients can submit esm_workers artifacts that the Absurd
+  // runtime intentionally no longer compiles at publish or launch time.
+  version: "0.1.241",
+  apiContract: "2026-07-immutable-cjs-play-artifacts-hard-cutover",
   supportPolicy: {
-    latest: "0.1.240",
+    latest: "0.1.241",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.219",
     commandMinimumSupported: [
@@ -28040,6 +28043,8 @@ var PRIVATE_KEY_PATTERN = /-----BEGIN (?:RSA |EC |OPENSSH |PGP )?PRIVATE KEY----
 var BEARER_LITERAL_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/i;
 var ASSIGNMENT_SECRET_LITERAL_PATTERN = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*['"][^'"]{12,}['"]/i;
 var HIGH_ENTROPY_LITERAL_PATTERN = /['"]([A-Za-z0-9+/=_-]{32,})['"]/g;
+var UUID_IDENTIFIER_PATTERN = /^((?:[A-Za-z0-9]+[-_])*)?([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
+var SECRET_LABEL_PATTERN = /(?:^|[-_])(?:api|auth|access|secret|token|key|password|credential|bearer|sk|pk|live)(?:[-_]|$)/i;
 function shannonEntropy(value) {
   const counts = /* @__PURE__ */ new Map();
   for (const char of value) counts.set(char, (counts.get(char) ?? 0) + 1);
@@ -28048,6 +28053,12 @@ function shannonEntropy(value) {
     return entropy - p * Math.log2(p);
   }, 0);
 }
+function isNonSecretUuidIdentifier(value) {
+  const match = UUID_IDENTIFIER_PATTERN.exec(value);
+  if (!match) return false;
+  const label = match[1] ?? "";
+  return !SECRET_LABEL_PATTERN.test(label);
+}
 function collectInlineSecretFindings(sourceCode) {
   const findings = [];
   for (const match of sourceCode.matchAll(SECRET_ENV_PATTERN)) {
@@ -28061,6 +28072,7 @@ function collectInlineSecretFindings(sourceCode) {
   }
   for (const match of sourceCode.matchAll(HIGH_ENTROPY_LITERAL_PATTERN)) {
     const literal = match[1] ?? "";
+    if (isNonSecretUuidIdentifier(literal)) continue;
     if (literal.length >= 40 && shannonEntropy(literal) >= 4.2) {
       findings.push("high-entropy string literal");
       break;

package/dist/cli/index.mjs

@@ -612,10 +612,13 @@ var SDK_RELEASE = {
   // silently materializing them as unmatched results.
   // 0.1.220 deprecates SDK CLI versions below 0.1.219 and updates them
   // automatically without blocking their current command.
-  version: "0.1.240",
-  apiContract: "2026-06-dataset-handle-results-hard-cutover",
+  // 0.1.241 hard-cuts published and launched plays to immutable cjs_node20
+  // artifacts. Older clients can submit esm_workers artifacts that the Absurd
+  // runtime intentionally no longer compiles at publish or launch time.
+  version: "0.1.241",
+  apiContract: "2026-07-immutable-cjs-play-artifacts-hard-cutover",
   supportPolicy: {
-    latest: "0.1.240",
+    latest: "0.1.241",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.219",
     commandMinimumSupported: [
@@ -28088,6 +28091,8 @@ var PRIVATE_KEY_PATTERN = /-----BEGIN (?:RSA |EC |OPENSSH |PGP )?PRIVATE KEY----
 var BEARER_LITERAL_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/i;
 var ASSIGNMENT_SECRET_LITERAL_PATTERN = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*['"][^'"]{12,}['"]/i;
 var HIGH_ENTROPY_LITERAL_PATTERN = /['"]([A-Za-z0-9+/=_-]{32,})['"]/g;
+var UUID_IDENTIFIER_PATTERN = /^((?:[A-Za-z0-9]+[-_])*)?([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
+var SECRET_LABEL_PATTERN = /(?:^|[-_])(?:api|auth|access|secret|token|key|password|credential|bearer|sk|pk|live)(?:[-_]|$)/i;
 function shannonEntropy(value) {
   const counts = /* @__PURE__ */ new Map();
   for (const char of value) counts.set(char, (counts.get(char) ?? 0) + 1);
@@ -28096,6 +28101,12 @@ function shannonEntropy(value) {
     return entropy - p * Math.log2(p);
   }, 0);
 }
+function isNonSecretUuidIdentifier(value) {
+  const match = UUID_IDENTIFIER_PATTERN.exec(value);
+  if (!match) return false;
+  const label = match[1] ?? "";
+  return !SECRET_LABEL_PATTERN.test(label);
+}
 function collectInlineSecretFindings(sourceCode) {
   const findings = [];
   for (const match of sourceCode.matchAll(SECRET_ENV_PATTERN)) {
@@ -28109,6 +28120,7 @@ function collectInlineSecretFindings(sourceCode) {
   }
   for (const match of sourceCode.matchAll(HIGH_ENTROPY_LITERAL_PATTERN)) {
     const literal = match[1] ?? "";
+    if (isNonSecretUuidIdentifier(literal)) continue;
     if (literal.length >= 40 && shannonEntropy(literal) >= 4.2) {
       findings.push("high-entropy string literal");
       break;

package/dist/index.js

@@ -426,10 +426,13 @@ var SDK_RELEASE = {
   // silently materializing them as unmatched results.
   // 0.1.220 deprecates SDK CLI versions below 0.1.219 and updates them
   // automatically without blocking their current command.
-  version: "0.1.240",
-  apiContract: "2026-06-dataset-handle-results-hard-cutover",
+  // 0.1.241 hard-cuts published and launched plays to immutable cjs_node20
+  // artifacts. Older clients can submit esm_workers artifacts that the Absurd
+  // runtime intentionally no longer compiles at publish or launch time.
+  version: "0.1.241",
+  apiContract: "2026-07-immutable-cjs-play-artifacts-hard-cutover",
   supportPolicy: {
-    latest: "0.1.240",
+    latest: "0.1.241",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.219",
     commandMinimumSupported: [

package/dist/index.mjs

@@ -356,10 +356,13 @@ var SDK_RELEASE = {
   // silently materializing them as unmatched results.
   // 0.1.220 deprecates SDK CLI versions below 0.1.219 and updates them
   // automatically without blocking their current command.
-  version: "0.1.240",
-  apiContract: "2026-06-dataset-handle-results-hard-cutover",
+  // 0.1.241 hard-cuts published and launched plays to immutable cjs_node20
+  // artifacts. Older clients can submit esm_workers artifacts that the Absurd
+  // runtime intentionally no longer compiles at publish or launch time.
+  version: "0.1.241",
+  apiContract: "2026-07-immutable-cjs-play-artifacts-hard-cutover",
   supportPolicy: {
-    latest: "0.1.240",
+    latest: "0.1.241",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.219",
     commandMinimumSupported: [

package/dist/plays/bundle-play-file.mjs

@@ -80,6 +80,8 @@ var PRIVATE_KEY_PATTERN = /-----BEGIN (?:RSA |EC |OPENSSH |PGP )?PRIVATE KEY----
 var BEARER_LITERAL_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/i;
 var ASSIGNMENT_SECRET_LITERAL_PATTERN = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*['"][^'"]{12,}['"]/i;
 var HIGH_ENTROPY_LITERAL_PATTERN = /['"]([A-Za-z0-9+/=_-]{32,})['"]/g;
+var UUID_IDENTIFIER_PATTERN = /^((?:[A-Za-z0-9]+[-_])*)?([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
+var SECRET_LABEL_PATTERN = /(?:^|[-_])(?:api|auth|access|secret|token|key|password|credential|bearer|sk|pk|live)(?:[-_]|$)/i;
 function shannonEntropy(value) {
   const counts = /* @__PURE__ */ new Map();
   for (const char of value) counts.set(char, (counts.get(char) ?? 0) + 1);
@@ -88,6 +90,12 @@ function shannonEntropy(value) {
     return entropy - p * Math.log2(p);
   }, 0);
 }
+function isNonSecretUuidIdentifier(value) {
+  const match = UUID_IDENTIFIER_PATTERN.exec(value);
+  if (!match) return false;
+  const label = match[1] ?? "";
+  return !SECRET_LABEL_PATTERN.test(label);
+}
 function collectInlineSecretFindings(sourceCode) {
   const findings = [];
   for (const match of sourceCode.matchAll(SECRET_ENV_PATTERN)) {
@@ -101,6 +109,7 @@ function collectInlineSecretFindings(sourceCode) {
   }
   for (const match of sourceCode.matchAll(HIGH_ENTROPY_LITERAL_PATTERN)) {
     const literal = match[1] ?? "";
+    if (isNonSecretUuidIdentifier(literal)) continue;
     if (literal.length >= 40 && shannonEntropy(literal) >= 4.2) {
       findings.push("high-entropy string literal");
       break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.1.240",
+  "version": "0.1.241",
   "description": "Deepline SDK + CLI — B2B data enrichment powered by durable cloud execution",
   "license": "MIT",
   "repository": {
@@ -62,6 +62,6 @@
     "typescript": "^5.9.3"
   },
   "deepline": {
-    "apiContract": "2026-06-dataset-handle-results-hard-cutover"
+    "apiContract": "2026-07-immutable-cjs-play-artifacts-hard-cutover"
   }
 }