deepline 0.2.19 → 0.2.20

package/dist/bundling-sources/sdk/src/release.ts

@@ -160,7 +160,7 @@ export const SDK_RELEASE = {
   // 0.2.0 makes Dataset Handles uniformly async-only after 0.1.320 briefly
   // exposed storage-dependent synchronous access. This deliberate minor
   // release keeps lazy paging semantics independent of row residency.
-  version: '0.2.19',
+  version: '0.2.20',
   contracts: {
     api: {
       name: 'sdk-http-api',

package/dist/bundling-sources/shared_libs/plays/secret-guardrails.ts

@@ -5,34 +5,6 @@ const PRIVATE_KEY_PATTERN =
 const BEARER_LITERAL_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/i;
 const ASSIGNMENT_SECRET_LITERAL_PATTERN =
   /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*['"][^'"]{12,}['"]/i;
-const HIGH_ENTROPY_LITERAL_PATTERN = /['"]([A-Za-z0-9+/=_-]{32,})['"]/g;
-const UUID_IDENTIFIER_PATTERN =
-  /^((?:[A-Za-z0-9]+[-_])*)?([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
-const BOOTSTRAP_RESOURCE_IDENTIFIER_PATTERN =
-  /^bootstrap-[0-9a-f]{32}(?:\/[a-z0-9][a-z0-9_-]{0,127})?$/i;
-const SECRET_LABEL_PATTERN =
-  /(?:^|[-_])(?:api|auth|access|secret|token|key|password|credential|bearer|sk|pk|live)(?:[-_]|$)/i;
-
-function shannonEntropy(value: string): number {
-  const counts = new Map<string, number>();
-  for (const char of value) counts.set(char, (counts.get(char) ?? 0) + 1);
-  return [...counts.values()].reduce((entropy, count) => {
-    const p = count / value.length;
-    return entropy - p * Math.log2(p);
-  }, 0);
-}
-
-function isNonSecretUuidIdentifier(value: string): boolean {
-  const match = UUID_IDENTIFIER_PATTERN.exec(value);
-  if (!match) return false;
-  const label = match[1] ?? '';
-  return !SECRET_LABEL_PATTERN.test(label);
-}
-
-function isNonSecretBootstrapResourceIdentifier(value: string): boolean {
-  return BOOTSTRAP_RESOURCE_IDENTIFIER_PATTERN.test(value);
-}
-
 /**
  * Returns the inline-secret findings in a string (empty if none). The throwing
  * validator below and the workflows→plays migration validator both call this so
@@ -50,20 +22,6 @@ export function collectInlineSecretFindings(sourceCode: string): string[] {
   if (ASSIGNMENT_SECRET_LITERAL_PATTERN.test(sourceCode)) {
     findings.push('secret-looking assignment literal');
   }
-  for (const match of sourceCode.matchAll(HIGH_ENTROPY_LITERAL_PATTERN)) {
-    const literal = match[1] ?? '';
-    // UUID-bearing resource names are structured identifiers, not opaque
-    // credentials. Keep secret-looking labels on the conservative path.
-    if (isNonSecretUuidIdentifier(literal)) continue;
-    // Named CI orgs use a deterministic public `bootstrap-<sha256-prefix>`
-    // slug. It is an address, not a credential, and owner-qualified ctx.runPlay
-    // references must embed it as a literal for static child resolution.
-    if (isNonSecretBootstrapResourceIdentifier(literal)) continue;
-    if (literal.length >= 40 && shannonEntropy(literal) >= 4.2) {
-      findings.push('high-entropy string literal');
-      break;
-    }
-  }
   return [...new Set(findings)];
 }
 

package/dist/cli/index.js

@@ -1044,7 +1044,7 @@ var SDK_RELEASE = {
   // 0.2.0 makes Dataset Handles uniformly async-only after 0.1.320 briefly
   // exposed storage-dependent synchronous access. This deliberate minor
   // release keeps lazy paging semantics independent of row residency.
-  version: "0.2.19",
+  version: "0.2.20",
   contracts: {
     api: {
       name: "sdk-http-api",
@@ -6479,6 +6479,10 @@ function collectLocalEnvInfo() {
 function readCsvRows(csvPath) {
   const raw = (0, import_node_fs4.readFileSync)((0, import_node_path4.resolve)(csvPath), "utf-8");
   return (0, import_sync.parse)(raw, {
+    // `csv-parse` otherwise treats a BOM before an opening quote as a field
+    // value, then rejects the quote as invalid. A UTF-8 BOM is a valid file
+    // prefix and must not become part of the first column name either.
+    bom: true,
     columns: true,
     skip_empty_lines: true
   });
@@ -15923,27 +15927,6 @@ var SECRET_ENV_PATTERN = /\bprocess(?:\.env|\[['"]env['"]\])(?:\.|\[['"])([A-Z0-
 var PRIVATE_KEY_PATTERN = /-----BEGIN (?:RSA |EC |OPENSSH |PGP )?PRIVATE KEY-----/;
 var BEARER_LITERAL_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/i;
 var ASSIGNMENT_SECRET_LITERAL_PATTERN = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*['"][^'"]{12,}['"]/i;
-var HIGH_ENTROPY_LITERAL_PATTERN = /['"]([A-Za-z0-9+/=_-]{32,})['"]/g;
-var UUID_IDENTIFIER_PATTERN = /^((?:[A-Za-z0-9]+[-_])*)?([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
-var BOOTSTRAP_RESOURCE_IDENTIFIER_PATTERN = /^bootstrap-[0-9a-f]{32}(?:\/[a-z0-9][a-z0-9_-]{0,127})?$/i;
-var SECRET_LABEL_PATTERN = /(?:^|[-_])(?:api|auth|access|secret|token|key|password|credential|bearer|sk|pk|live)(?:[-_]|$)/i;
-function shannonEntropy(value) {
-  const counts = /* @__PURE__ */ new Map();
-  for (const char of value) counts.set(char, (counts.get(char) ?? 0) + 1);
-  return [...counts.values()].reduce((entropy, count) => {
-    const p = count / value.length;
-    return entropy - p * Math.log2(p);
-  }, 0);
-}
-function isNonSecretUuidIdentifier(value) {
-  const match = UUID_IDENTIFIER_PATTERN.exec(value);
-  if (!match) return false;
-  const label = match[1] ?? "";
-  return !SECRET_LABEL_PATTERN.test(label);
-}
-function isNonSecretBootstrapResourceIdentifier(value) {
-  return BOOTSTRAP_RESOURCE_IDENTIFIER_PATTERN.test(value);
-}
 function collectInlineSecretFindings(sourceCode) {
   const findings = [];
   for (const match of sourceCode.matchAll(SECRET_ENV_PATTERN)) {
@@ -15955,15 +15938,6 @@ function collectInlineSecretFindings(sourceCode) {
   if (ASSIGNMENT_SECRET_LITERAL_PATTERN.test(sourceCode)) {
     findings.push("secret-looking assignment literal");
   }
-  for (const match of sourceCode.matchAll(HIGH_ENTROPY_LITERAL_PATTERN)) {
-    const literal = match[1] ?? "";
-    if (isNonSecretUuidIdentifier(literal)) continue;
-    if (isNonSecretBootstrapResourceIdentifier(literal)) continue;
-    if (literal.length >= 40 && shannonEntropy(literal) >= 4.2) {
-      findings.push("high-entropy string literal");
-      break;
-    }
-  }
   return [...new Set(findings)];
 }
 

package/dist/cli/index.mjs

@@ -1030,7 +1030,7 @@ var SDK_RELEASE = {
   // 0.2.0 makes Dataset Handles uniformly async-only after 0.1.320 briefly
   // exposed storage-dependent synchronous access. This deliberate minor
   // release keeps lazy paging semantics independent of row residency.
-  version: "0.2.19",
+  version: "0.2.20",
   contracts: {
     api: {
       name: "sdk-http-api",
@@ -6477,6 +6477,10 @@ function collectLocalEnvInfo() {
 function readCsvRows(csvPath) {
   const raw = readFileSync4(resolve2(csvPath), "utf-8");
   return parse(raw, {
+    // `csv-parse` otherwise treats a BOM before an opening quote as a field
+    // value, then rejects the quote as invalid. A UTF-8 BOM is a valid file
+    // prefix and must not become part of the first column name either.
+    bom: true,
     columns: true,
     skip_empty_lines: true
   });
@@ -15960,27 +15964,6 @@ var SECRET_ENV_PATTERN = /\bprocess(?:\.env|\[['"]env['"]\])(?:\.|\[['"])([A-Z0-
 var PRIVATE_KEY_PATTERN = /-----BEGIN (?:RSA |EC |OPENSSH |PGP )?PRIVATE KEY-----/;
 var BEARER_LITERAL_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/i;
 var ASSIGNMENT_SECRET_LITERAL_PATTERN = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*['"][^'"]{12,}['"]/i;
-var HIGH_ENTROPY_LITERAL_PATTERN = /['"]([A-Za-z0-9+/=_-]{32,})['"]/g;
-var UUID_IDENTIFIER_PATTERN = /^((?:[A-Za-z0-9]+[-_])*)?([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
-var BOOTSTRAP_RESOURCE_IDENTIFIER_PATTERN = /^bootstrap-[0-9a-f]{32}(?:\/[a-z0-9][a-z0-9_-]{0,127})?$/i;
-var SECRET_LABEL_PATTERN = /(?:^|[-_])(?:api|auth|access|secret|token|key|password|credential|bearer|sk|pk|live)(?:[-_]|$)/i;
-function shannonEntropy(value) {
-  const counts = /* @__PURE__ */ new Map();
-  for (const char of value) counts.set(char, (counts.get(char) ?? 0) + 1);
-  return [...counts.values()].reduce((entropy, count) => {
-    const p = count / value.length;
-    return entropy - p * Math.log2(p);
-  }, 0);
-}
-function isNonSecretUuidIdentifier(value) {
-  const match = UUID_IDENTIFIER_PATTERN.exec(value);
-  if (!match) return false;
-  const label = match[1] ?? "";
-  return !SECRET_LABEL_PATTERN.test(label);
-}
-function isNonSecretBootstrapResourceIdentifier(value) {
-  return BOOTSTRAP_RESOURCE_IDENTIFIER_PATTERN.test(value);
-}
 function collectInlineSecretFindings(sourceCode) {
   const findings = [];
   for (const match of sourceCode.matchAll(SECRET_ENV_PATTERN)) {
@@ -15992,15 +15975,6 @@ function collectInlineSecretFindings(sourceCode) {
   if (ASSIGNMENT_SECRET_LITERAL_PATTERN.test(sourceCode)) {
     findings.push("secret-looking assignment literal");
   }
-  for (const match of sourceCode.matchAll(HIGH_ENTROPY_LITERAL_PATTERN)) {
-    const literal = match[1] ?? "";
-    if (isNonSecretUuidIdentifier(literal)) continue;
-    if (isNonSecretBootstrapResourceIdentifier(literal)) continue;
-    if (literal.length >= 40 && shannonEntropy(literal) >= 4.2) {
-      findings.push("high-entropy string literal");
-      break;
-    }
-  }
   return [...new Set(findings)];
 }
 

package/dist/index.js

@@ -763,7 +763,7 @@ var SDK_RELEASE = {
   // 0.2.0 makes Dataset Handles uniformly async-only after 0.1.320 briefly
   // exposed storage-dependent synchronous access. This deliberate minor
   // release keeps lazy paging semantics independent of row residency.
-  version: "0.2.19",
+  version: "0.2.20",
   contracts: {
     api: {
       name: "sdk-http-api",

package/dist/index.mjs

@@ -689,7 +689,7 @@ var SDK_RELEASE = {
   // 0.2.0 makes Dataset Handles uniformly async-only after 0.1.320 briefly
   // exposed storage-dependent synchronous access. This deliberate minor
   // release keeps lazy paging semantics independent of row residency.
-  version: "0.2.19",
+  version: "0.2.20",
   contracts: {
     api: {
       name: "sdk-http-api",

package/dist/plays/bundle-play-file.mjs

@@ -3921,27 +3921,6 @@ var SECRET_ENV_PATTERN = /\bprocess(?:\.env|\[['"]env['"]\])(?:\.|\[['"])([A-Z0-
 var PRIVATE_KEY_PATTERN = /-----BEGIN (?:RSA |EC |OPENSSH |PGP )?PRIVATE KEY-----/;
 var BEARER_LITERAL_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/i;
 var ASSIGNMENT_SECRET_LITERAL_PATTERN = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*['"][^'"]{12,}['"]/i;
-var HIGH_ENTROPY_LITERAL_PATTERN = /['"]([A-Za-z0-9+/=_-]{32,})['"]/g;
-var UUID_IDENTIFIER_PATTERN = /^((?:[A-Za-z0-9]+[-_])*)?([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
-var BOOTSTRAP_RESOURCE_IDENTIFIER_PATTERN = /^bootstrap-[0-9a-f]{32}(?:\/[a-z0-9][a-z0-9_-]{0,127})?$/i;
-var SECRET_LABEL_PATTERN = /(?:^|[-_])(?:api|auth|access|secret|token|key|password|credential|bearer|sk|pk|live)(?:[-_]|$)/i;
-function shannonEntropy(value) {
-  const counts = /* @__PURE__ */ new Map();
-  for (const char of value) counts.set(char, (counts.get(char) ?? 0) + 1);
-  return [...counts.values()].reduce((entropy, count) => {
-    const p = count / value.length;
-    return entropy - p * Math.log2(p);
-  }, 0);
-}
-function isNonSecretUuidIdentifier(value) {
-  const match = UUID_IDENTIFIER_PATTERN.exec(value);
-  if (!match) return false;
-  const label = match[1] ?? "";
-  return !SECRET_LABEL_PATTERN.test(label);
-}
-function isNonSecretBootstrapResourceIdentifier(value) {
-  return BOOTSTRAP_RESOURCE_IDENTIFIER_PATTERN.test(value);
-}
 function collectInlineSecretFindings(sourceCode) {
   const findings = [];
   for (const match of sourceCode.matchAll(SECRET_ENV_PATTERN)) {
@@ -3953,15 +3932,6 @@ function collectInlineSecretFindings(sourceCode) {
   if (ASSIGNMENT_SECRET_LITERAL_PATTERN.test(sourceCode)) {
     findings.push("secret-looking assignment literal");
   }
-  for (const match of sourceCode.matchAll(HIGH_ENTROPY_LITERAL_PATTERN)) {
-    const literal = match[1] ?? "";
-    if (isNonSecretUuidIdentifier(literal)) continue;
-    if (isNonSecretBootstrapResourceIdentifier(literal)) continue;
-    if (literal.length >= 40 && shannonEntropy(literal) >= 4.2) {
-      findings.push("high-entropy string literal");
-      break;
-    }
-  }
   return [...new Set(findings)];
 }
 function validatePlaySourceHasNoInlineSecrets(input) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.2.19",
+  "version": "0.2.20",
   "description": "Deepline SDK + CLI — B2B data enrichment powered by durable cloud execution",
   "license": "MIT",
   "repository": {