deepline 0.2.19 → 0.2.21

package/dist/bundling-sources/sdk/src/release.ts

@@ -160,7 +160,7 @@ export const SDK_RELEASE = {
   // 0.2.0 makes Dataset Handles uniformly async-only after 0.1.320 briefly
   // exposed storage-dependent synchronous access. This deliberate minor
   // release keeps lazy paging semantics independent of row residency.
-  version: '0.2.19',
+  version: '0.2.21',
   contracts: {
     api: {
       name: 'sdk-http-api',

package/dist/bundling-sources/shared_libs/plays/secret-guardrails.ts

@@ -5,34 +5,6 @@ const PRIVATE_KEY_PATTERN =
 const BEARER_LITERAL_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/i;
 const ASSIGNMENT_SECRET_LITERAL_PATTERN =
   /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*['"][^'"]{12,}['"]/i;
-const HIGH_ENTROPY_LITERAL_PATTERN = /['"]([A-Za-z0-9+/=_-]{32,})['"]/g;
-const UUID_IDENTIFIER_PATTERN =
-  /^((?:[A-Za-z0-9]+[-_])*)?([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
-const BOOTSTRAP_RESOURCE_IDENTIFIER_PATTERN =
-  /^bootstrap-[0-9a-f]{32}(?:\/[a-z0-9][a-z0-9_-]{0,127})?$/i;
-const SECRET_LABEL_PATTERN =
-  /(?:^|[-_])(?:api|auth|access|secret|token|key|password|credential|bearer|sk|pk|live)(?:[-_]|$)/i;
-
-function shannonEntropy(value: string): number {
-  const counts = new Map<string, number>();
-  for (const char of value) counts.set(char, (counts.get(char) ?? 0) + 1);
-  return [...counts.values()].reduce((entropy, count) => {
-    const p = count / value.length;
-    return entropy - p * Math.log2(p);
-  }, 0);
-}
-
-function isNonSecretUuidIdentifier(value: string): boolean {
-  const match = UUID_IDENTIFIER_PATTERN.exec(value);
-  if (!match) return false;
-  const label = match[1] ?? '';
-  return !SECRET_LABEL_PATTERN.test(label);
-}
-
-function isNonSecretBootstrapResourceIdentifier(value: string): boolean {
-  return BOOTSTRAP_RESOURCE_IDENTIFIER_PATTERN.test(value);
-}
-
 /**
  * Returns the inline-secret findings in a string (empty if none). The throwing
  * validator below and the workflows→plays migration validator both call this so
@@ -50,20 +22,6 @@ export function collectInlineSecretFindings(sourceCode: string): string[] {
   if (ASSIGNMENT_SECRET_LITERAL_PATTERN.test(sourceCode)) {
     findings.push('secret-looking assignment literal');
   }
-  for (const match of sourceCode.matchAll(HIGH_ENTROPY_LITERAL_PATTERN)) {
-    const literal = match[1] ?? '';
-    // UUID-bearing resource names are structured identifiers, not opaque
-    // credentials. Keep secret-looking labels on the conservative path.
-    if (isNonSecretUuidIdentifier(literal)) continue;
-    // Named CI orgs use a deterministic public `bootstrap-<sha256-prefix>`
-    // slug. It is an address, not a credential, and owner-qualified ctx.runPlay
-    // references must embed it as a literal for static child resolution.
-    if (isNonSecretBootstrapResourceIdentifier(literal)) continue;
-    if (literal.length >= 40 && shannonEntropy(literal) >= 4.2) {
-      findings.push('high-entropy string literal');
-      break;
-    }
-  }
   return [...new Set(findings)];
 }