deepline 0.2.49 → 0.2.50

package/dist/bundling-sources/shared_libs/plays/user-code-safety.ts

@@ -0,0 +1,61 @@
+// Compile-time safety gate for user-authored play code (enrich `extract_js`,
+// `run_if_js`, and `run_javascript` step `code`).
+//
+// Plays replay deterministically under Worker Loader, and the step code runs
+// with provider data in scope. So user code may NOT be non-deterministic
+// (Math.random, Date.now, ...) — replay would diverge — and may NOT reach out
+// of the sandbox (fetch, require, process, ...). We reject those at compile
+// time with a clear, named error (fail loud, per the repo non-negotiables).
+//
+// This is a fast static scan, not a security boundary on its own: the play
+// runtime is the real boundary (it executes step code in an isolate that does
+// not expose these globals). The scan exists to fail authoring early with a
+// readable message instead of producing a play that silently misbehaves at run
+// time. The `(?<!\.)` guards keep it from flagging harmless property access on
+// user objects (e.g. `row.process_date`, `data.fetch`).
+
+type ForbiddenRule = { readonly pattern: RegExp; readonly reason: string };
+
+const FORBIDDEN: readonly ForbiddenRule[] = [
+  // Non-deterministic — breaks replay.
+  { pattern: /\bMath\s*\.\s*random\b/, reason: 'Math.random()' },
+  { pattern: /\bDate\s*\.\s*now\b/, reason: 'Date.now()' },
+  { pattern: /\bnew\s+Date\s*\(\s*\)/, reason: 'new Date() with no argument' },
+  { pattern: /\bperformance\s*\.\s*now\b/, reason: 'performance.now()' },
+  {
+    pattern: /\bcrypto\s*\.\s*(?:randomUUID|getRandomValues)\b/,
+    reason: 'crypto random',
+  },
+  // Sandbox escape / I/O.
+  { pattern: /(?<!\.)\bfetch\s*\(/, reason: 'fetch()' },
+  { pattern: /(?<!\.)\bimport\s*\(/, reason: 'dynamic import()' },
+  { pattern: /(?<!\.)\brequire\s*\(/, reason: 'require()' },
+  { pattern: /(?<!\.)\beval\s*\(/, reason: 'eval()' },
+  {
+    pattern: /(?<!\.)\bnew\s+Function\b|(?<!\.)\bFunction\s*\(/,
+    reason: 'the Function constructor',
+  },
+  { pattern: /(?<!\.)\bprocess\b/, reason: 'process' },
+  { pattern: /(?<!\.)\bglobalThis\b/, reason: 'globalThis' },
+  { pattern: /(?<!\.)\b(?:window|self)\b/, reason: 'window/self' },
+  { pattern: /(?<!\.)\bXMLHttpRequest\b/, reason: 'XMLHttpRequest' },
+  { pattern: /(?<!\.)\bWebAssembly\b/, reason: 'WebAssembly' },
+];
+
+/**
+ * Throw if `code` references a forbidden (non-deterministic or sandbox-escaping)
+ * construct. `label` describes where the code came from for the error message,
+ * e.g. `extract_js for "email"` or `run_javascript step "enrich"`.
+ */
+export function assertUserCodeIsSafe(code: string, label: string): void {
+  if (typeof code !== 'string' || !code.trim()) return;
+  for (const { pattern, reason } of FORBIDDEN) {
+    if (pattern.test(code)) {
+      throw new Error(
+        `${label} uses ${reason}, which is not allowed in play code: it ` +
+          `breaks deterministic replay or escapes the sandbox. Remove it and ` +
+          `compute the value from the row/result instead.`,
+      );
+    }
+  }
+}

package/dist/cli/index.js

@@ -1044,7 +1044,7 @@ var SDK_RELEASE = {
   // 0.2.0 makes Dataset Handles uniformly async-only after 0.1.320 briefly
   // exposed storage-dependent synchronous access. This deliberate minor
   // release keeps lazy paging semantics independent of row residency.
-  version: "0.2.49",
+  version: "0.2.50",
   contracts: {
     api: {
       name: "sdk-http-api",
@@ -24663,7 +24663,7 @@ function getterFromLegacyExtractJs(extractJs, fallbackAlias) {
   return null;
 }
 
-// src/cli/enrich-compat-adapter.ts
+// ../shared_libs/plays/enrich-compat-adapter.ts
 var ENRICH_COMPAT_DEFAULT_PLAY_NAME = "deepline-enrich-v1-compat";
 var ENRICH_COMPAT_DEFAULT_MAP_NAME = "deepline_enrich_rows";
 function buildEnrichCompatibilityPlan(options = {}) {
@@ -24673,7 +24673,7 @@ function buildEnrichCompatibilityPlan(options = {}) {
   };
 }
 
-// src/cli/user-code-safety.ts
+// ../shared_libs/plays/user-code-safety.ts
 var FORBIDDEN = [
   // Non-deterministic — breaks replay.
   { pattern: /\bMath\s*\.\s*random\b/, reason: "Math.random()" },
@@ -24710,7 +24710,7 @@ function assertUserCodeIsSafe(code, label) {
   }
 }
 
-// src/cli/enrich-play-compiler.ts
+// ../shared_libs/plays/enrich-play-compiler.ts
 function isWaterfall(command) {
   return "with_waterfall" in command;
 }
@@ -25141,7 +25141,9 @@ function compileEnrichConfigToPlaySource(config, options = {}) {
   const generatedAliases = collectGeneratedAliases(config.commands);
   const runOptionsSource = options.failFast ? `{ key: (row, index) => __dlEnrichRowKey(row, index + rowStart), onRowError: 'fail' as const }` : `{ key: (row, index) => __dlEnrichRowKey(row, index + rowStart) }`;
   const playOptionsSource = [
-    `description: ${stringLiteral("Read a CSV file, run the configured Deepline enrich commands, and return enriched rows.")}`,
+    `description: ${stringLiteral(
+      "Read a CSV file, run the configured Deepline enrich commands, and return enriched rows."
+    )}`,
     ...options.maxCreditsPerRun === void 0 ? [] : [`billing: { maxCreditsPerRun: ${String(options.maxCreditsPerRun)} }`]
   ].join(", ");
   const body = [

package/dist/cli/index.mjs

@@ -1030,7 +1030,7 @@ var SDK_RELEASE = {
   // 0.2.0 makes Dataset Handles uniformly async-only after 0.1.320 briefly
   // exposed storage-dependent synchronous access. This deliberate minor
   // release keeps lazy paging semantics independent of row residency.
-  version: "0.2.49",
+  version: "0.2.50",
   contracts: {
     api: {
       name: "sdk-http-api",
@@ -12313,7 +12313,9 @@ import {
   extname,
   isAbsolute as isAbsolute3,
   join as join7,
-  resolve as resolve8
+  relative as relative2,
+  resolve as resolve8,
+  sep
 } from "path";
 import { builtinModules } from "module";
 import { Parser } from "acorn";
@@ -24707,7 +24709,7 @@ function getterFromLegacyExtractJs(extractJs, fallbackAlias) {
   return null;
 }
 
-// src/cli/enrich-compat-adapter.ts
+// ../shared_libs/plays/enrich-compat-adapter.ts
 var ENRICH_COMPAT_DEFAULT_PLAY_NAME = "deepline-enrich-v1-compat";
 var ENRICH_COMPAT_DEFAULT_MAP_NAME = "deepline_enrich_rows";
 function buildEnrichCompatibilityPlan(options = {}) {
@@ -24717,7 +24719,7 @@ function buildEnrichCompatibilityPlan(options = {}) {
   };
 }
 
-// src/cli/user-code-safety.ts
+// ../shared_libs/plays/user-code-safety.ts
 var FORBIDDEN = [
   // Non-deterministic — breaks replay.
   { pattern: /\bMath\s*\.\s*random\b/, reason: "Math.random()" },
@@ -24754,7 +24756,7 @@ function assertUserCodeIsSafe(code, label) {
   }
 }
 
-// src/cli/enrich-play-compiler.ts
+// ../shared_libs/plays/enrich-play-compiler.ts
 function isWaterfall(command) {
   return "with_waterfall" in command;
 }
@@ -25185,7 +25187,9 @@ function compileEnrichConfigToPlaySource(config, options = {}) {
   const generatedAliases = collectGeneratedAliases(config.commands);
   const runOptionsSource = options.failFast ? `{ key: (row, index) => __dlEnrichRowKey(row, index + rowStart), onRowError: 'fail' as const }` : `{ key: (row, index) => __dlEnrichRowKey(row, index + rowStart) }`;
   const playOptionsSource = [
-    `description: ${stringLiteral("Read a CSV file, run the configured Deepline enrich commands, and return enriched rows.")}`,
+    `description: ${stringLiteral(
+      "Read a CSV file, run the configured Deepline enrich commands, and return enriched rows."
+    )}`,
     ...options.maxCreditsPerRun === void 0 ? [] : [`billing: { maxCreditsPerRun: ${String(options.maxCreditsPerRun)} }`]
   ].join(", ");
   const body = [

package/dist/index.js

@@ -763,7 +763,7 @@ var SDK_RELEASE = {
   // 0.2.0 makes Dataset Handles uniformly async-only after 0.1.320 briefly
   // exposed storage-dependent synchronous access. This deliberate minor
   // release keeps lazy paging semantics independent of row residency.
-  version: "0.2.49",
+  version: "0.2.50",
   contracts: {
     api: {
       name: "sdk-http-api",

package/dist/index.mjs

@@ -689,7 +689,7 @@ var SDK_RELEASE = {
   // 0.2.0 makes Dataset Handles uniformly async-only after 0.1.320 briefly
   // exposed storage-dependent synchronous access. This deliberate minor
   // release keeps lazy paging semantics independent of row residency.
-  version: "0.2.49",
+  version: "0.2.50",
   contracts: {
     api: {
       name: "sdk-http-api",

package/dist/install-integrity.json

@@ -191,6 +191,8 @@
     "dist/bundling-sources/shared_libs/plays/dataset-summary.ts",
     "dist/bundling-sources/shared_libs/plays/dataset.ts",
     "dist/bundling-sources/shared_libs/plays/definition.ts",
+    "dist/bundling-sources/shared_libs/plays/enrich-compat-adapter.ts",
+    "dist/bundling-sources/shared_libs/plays/enrich-play-compiler.ts",
     "dist/bundling-sources/shared_libs/plays/file-refs.ts",
     "dist/bundling-sources/shared_libs/plays/input-contract-definition.ts",
     "dist/bundling-sources/shared_libs/plays/input-contract.ts",
@@ -202,6 +204,7 @@
     "dist/bundling-sources/shared_libs/plays/static-pipeline.ts",
     "dist/bundling-sources/shared_libs/plays/tool-category-descriptions.ts",
     "dist/bundling-sources/shared_libs/plays/tool-codegen.ts",
+    "dist/bundling-sources/shared_libs/plays/user-code-safety.ts",
     "dist/bundling-sources/shared_libs/product-notifications/contract.ts",
     "dist/bundling-sources/shared_libs/runtime-env.ts",
     "dist/bundling-sources/shared_libs/security/outbound-url-policy.ts",

package/dist/plays/bundle-play-file.d.mts

@@ -65,6 +65,8 @@ type PlayLocalFileDiscoveryResult = {
 };
 type PlayBundlingAdapter = {
     projectRoot: string;
+    /** Optional root used only to make source-graph identity independent of temporary absolute paths. */
+    sourceIdentityRoot?: string;
     nodeModulesDir: string;
     cacheDir?: string;
     sdkSourceRoot: string;

package/dist/plays/bundle-play-file.d.ts

@@ -65,6 +65,8 @@ type PlayLocalFileDiscoveryResult = {
 };
 type PlayBundlingAdapter = {
     projectRoot: string;
+    /** Optional root used only to make source-graph identity independent of temporary absolute paths. */
+    sourceIdentityRoot?: string;
     nodeModulesDir: string;
     cacheDir?: string;
     sdkSourceRoot: string;

package/dist/plays/bundle-play-file.mjs

@@ -21,7 +21,9 @@ import {
   extname,
   isAbsolute,
   join,
-  resolve
+  relative,
+  resolve,
+  sep
 } from "path";
 import { builtinModules } from "module";
 import { Parser } from "acorn";
@@ -4060,6 +4062,15 @@ function assertValidExportName(exportName) {
 function sha256(value) {
   return createHash("sha256").update(value).digest("hex");
 }
+function sourceIdentityPath(filePath, adapter) {
+  if (!adapter.sourceIdentityRoot) return filePath;
+  const identityRoot = resolve(adapter.sourceIdentityRoot);
+  const logicalPath = relative(identityRoot, resolve(filePath));
+  if (!logicalPath || logicalPath === ".." || logicalPath.startsWith(`..${sep}`) || isAbsolute(logicalPath)) {
+    return filePath;
+  }
+  return logicalPath.split(/[\\/]+/).join("/");
+}
 function formatEsbuildMessage(message) {
   const location = message.location ? `${message.location.file}:${message.location.line}:${message.location.column}` : null;
   return location ? `${location} ${message.text}` : message.text;
@@ -4980,12 +4991,15 @@ async function analyzeSourceGraph(entryFile, adapter, exportName) {
   const sourceHash = sha256(sourceCode);
   const graphHash = sha256(
     JSON.stringify({
-      entryFile: absoluteEntryFile,
-      localFiles: [...localFiles.entries()].map(([filePath, contents]) => ({ filePath, hash: sha256(contents) })).sort((left, right) => left.filePath.localeCompare(right.filePath)),
+      entryFile: sourceIdentityPath(absoluteEntryFile, adapter),
+      localFiles: [...localFiles.entries()].map(([filePath, contents]) => ({
+        filePath: sourceIdentityPath(filePath, adapter),
+        hash: sha256(contents)
+      })).sort((left, right) => left.filePath.localeCompare(right.filePath)),
       nodeBuiltins: [...nodeBuiltins].sort(),
       packages: [...packages.entries()].map(([name, version]) => ({ name, version })).sort((left, right) => left.name.localeCompare(right.name)),
       importedPlayDependencies: [...importedPlayDependencies.values()].map((dependency) => ({
-        filePath: dependency.filePath,
+        filePath: sourceIdentityPath(dependency.filePath, adapter),
         playName: dependency.playName
       })).sort((left, right) => left.filePath.localeCompare(right.filePath))
     })
@@ -5024,6 +5038,7 @@ async function analyzeSourceGraph(entryFile, adapter, exportName) {
 }
 function artifactCachePath(graphHash, artifactKind, adapter) {
   return join(
+    /* turbopackIgnore: true */
     adapter.cacheDir ?? PLAY_ARTIFACT_CACHE_DIR,
     `${graphHash}.${artifactKind}.json`
   );
@@ -5031,7 +5046,12 @@ function artifactCachePath(graphHash, artifactKind, adapter) {
 async function readArtifactCache(graphHash, artifactKind, adapter) {
   try {
     const serialized = await readFile(
-      artifactCachePath(graphHash, artifactKind, adapter),
+      /* turbopackIgnore: true */
+      artifactCachePath(
+        graphHash,
+        artifactKind,
+        adapter
+      ),
       "utf-8"
     );
     return JSON.parse(serialized);
@@ -5041,8 +5061,13 @@ async function readArtifactCache(graphHash, artifactKind, adapter) {
 }
 async function writeArtifactCache(artifact, adapter) {
   const cacheDir = adapter.cacheDir ?? PLAY_ARTIFACT_CACHE_DIR;
-  await mkdir(cacheDir, { recursive: true });
+  await mkdir(
+    /* turbopackIgnore: true */
+    cacheDir,
+    { recursive: true }
+  );
   await writeFile(
+    /* turbopackIgnore: true */
     artifactCachePath(
       artifact.graphHash,
       artifact.artifactKind ?? PLAY_ARTIFACT_KINDS.cjsNode20,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.2.49",
+  "version": "0.2.50",
   "description": "Deepline SDK + CLI — B2B data enrichment powered by durable cloud execution",
   "license": "MIT",
   "repository": {