deepline 0.3.293 → 0.3.295

package/dist/cli/chunk-GVUJJJ5G.mjs

@@ -0,0 +1,76 @@
+// ../plays/artifact-types.ts
+var PLAY_ARTIFACT_KINDS = {
+  cjsNode20: "cjs_node20"
+};
+
+// ../play-runtime/backend.ts
+var PLAY_RUNTIME_BACKENDS = {
+  localProcess: "local_process",
+  daytona: "daytona",
+  modal: "modal"
+};
+var PLAY_BACKEND_DESCRIPTORS = {
+  [PLAY_RUNTIME_BACKENDS.localProcess]: {
+    id: PLAY_RUNTIME_BACKENDS.localProcess,
+    artifactKind: PLAY_ARTIFACT_KINDS.cjsNode20,
+    label: "Local node subprocess"
+  },
+  [PLAY_RUNTIME_BACKENDS.daytona]: {
+    id: PLAY_RUNTIME_BACKENDS.daytona,
+    artifactKind: PLAY_ARTIFACT_KINDS.cjsNode20,
+    label: "Daytona sandbox"
+  },
+  [PLAY_RUNTIME_BACKENDS.modal]: {
+    id: PLAY_RUNTIME_BACKENDS.modal,
+    artifactKind: PLAY_ARTIFACT_KINDS.cjsNode20,
+    label: "Modal sandbox"
+  }
+};
+
+// ../plays/tool-response-contract.ts
+var RAW_V2_TOOL_RESPONSE_CONTRACT = "raw-v2";
+var RAW_V2_TOOL_RESPONSE_RECEIPT_REVISION = "raw-v2-receipt-v1";
+var TOOL_RESPONSE_RECEIPT_REVISION_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9._-]{0,63})$/;
+var InvalidToolResponseReceiptRevisionError = class extends Error {
+  constructor(value) {
+    super(
+      `Tool response receipt revision must be a non-empty static identifier (letters, numbers, '.', '_', or '-'); received ${String(value)}.`
+    );
+    this.name = "InvalidToolResponseReceiptRevisionError";
+  }
+};
+function normalizeToolResponseReceiptRevision(value) {
+  if (value == null) return void 0;
+  if (typeof value === "string" && TOOL_RESPONSE_RECEIPT_REVISION_PATTERN.test(value)) {
+    return value;
+  }
+  throw new InvalidToolResponseReceiptRevisionError(value);
+}
+function legacyRawFromToolResponseRawV2(rawV2, view, responseMeta) {
+  const legacyRaw = view === "data" && rawV2 && typeof rawV2 === "object" && !Array.isArray(rawV2) ? rawV2.data : rawV2;
+  const deeplineBilling = responseMeta?.deepline_billing;
+  if (view === "rawV2" && deeplineBilling !== void 0 && legacyRaw && typeof legacyRaw === "object" && !Array.isArray(legacyRaw)) {
+    return {
+      ...legacyRaw,
+      deepline_billing: deeplineBilling
+    };
+  }
+  return legacyRaw;
+}
+function providerMetaFromToolResponseRawV2(rawV2, view) {
+  if (view !== "data" || !rawV2 || typeof rawV2 !== "object" || Array.isArray(rawV2)) {
+    return void 0;
+  }
+  const meta = rawV2.meta;
+  return meta && typeof meta === "object" && !Array.isArray(meta) ? meta : void 0;
+}
+
+export {
+  RAW_V2_TOOL_RESPONSE_CONTRACT,
+  RAW_V2_TOOL_RESPONSE_RECEIPT_REVISION,
+  normalizeToolResponseReceiptRevision,
+  legacyRawFromToolResponseRawV2,
+  providerMetaFromToolResponseRawV2,
+  PLAY_ARTIFACT_KINDS,
+  PLAY_RUNTIME_BACKENDS
+};

package/dist/cli/chunk-H7HIDGZ7.mjs

@@ -0,0 +1,150 @@
+// ../plays/secret-guardrails.ts
+var SECRET_ENV_PATTERN = /\bprocess(?:\.env|\[['"]env['"]\])(?:\.|\[['"])([A-Z0-9_]*(?:API[_-]?KEY|TOKEN|SECRET|PASSWORD|PRIVATE[_-]?KEY|ACCESS[_-]?KEY)[A-Z0-9_]*)(?:['"]\])?/g;
+var PRIVATE_KEY_PATTERN = /-----BEGIN (?:RSA |EC |OPENSSH |PGP )?PRIVATE KEY-----/;
+var BEARER_LITERAL_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/i;
+var ASSIGNMENT_SECRET_LITERAL_PATTERN = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*['"][^'"]{12,}['"]/i;
+var SECRET_AUTH_LITERAL_FINDING = "literal credential passed to ctx.secrets auth helper";
+function skipQuoted(source, start) {
+  const quote = source[start];
+  let index = start + 1;
+  while (index < source.length) {
+    if (source[index] === "\\") {
+      index += 2;
+    } else if (source[index] === quote) {
+      return index + 1;
+    } else {
+      index += 1;
+    }
+  }
+  return source.length;
+}
+function skipTrivia(source, start) {
+  let index = start;
+  while (index < source.length) {
+    if (/\s/.test(source[index])) {
+      index += 1;
+    } else if (source.startsWith("//", index)) {
+      index = source.indexOf("\n", index + 2);
+      if (index === -1) return source.length;
+    } else if (source.startsWith("/*", index)) {
+      index = source.indexOf("*/", index + 2);
+      if (index === -1) return source.length;
+      index += 2;
+    } else {
+      return index;
+    }
+  }
+  return index;
+}
+function consumeIdentifier(source, start, expected) {
+  return source.startsWith(expected, start) && !/[A-Za-z0-9_$]/.test(source[start - 1] ?? "") && !/[A-Za-z0-9_$]/.test(source[start + expected.length] ?? "") ? start + expected.length : void 0;
+}
+function consumeMember(source, start, expected) {
+  let index = skipTrivia(source, start);
+  if (source[index] === ".") {
+    return consumeIdentifier(source, skipTrivia(source, index + 1), expected);
+  }
+  if (source[index] !== "[") return void 0;
+  index = skipTrivia(source, index + 1);
+  if (source[index] !== "'" && source[index] !== '"') return void 0;
+  const end = skipQuoted(source, index);
+  if (source.slice(index + 1, end - 1) !== expected) return void 0;
+  index = skipTrivia(source, end);
+  return source[index] === "]" ? index + 1 : void 0;
+}
+function skipExpression(source, start) {
+  let index = start;
+  let depth = 0;
+  while (index < source.length) {
+    const char = source[index];
+    if (char === "'" || char === '"' || char === "`") {
+      index = skipQuoted(source, index);
+      continue;
+    }
+    if (source.startsWith("//", index) || source.startsWith("/*", index)) {
+      index = skipTrivia(source, index);
+      continue;
+    }
+    if (char === "(" || char === "[" || char === "{") {
+      depth += 1;
+    } else if (char === ")" || char === "]" || char === "}") {
+      if (depth === 0) return index;
+      depth -= 1;
+    } else if (char === "," && depth === 0) {
+      return index;
+    }
+    index += 1;
+  }
+  return index;
+}
+function isDirectStringLiteral(source, start) {
+  const quote = source[start];
+  if (quote !== "'" && quote !== '"' && quote !== "`") return false;
+  const end = skipQuoted(source, start);
+  return quote !== "`" || !source.slice(start, end).includes("${");
+}
+function hasLiteralSecretAuthCredential(source) {
+  for (let index = 0; index < source.length; index += 1) {
+    const char = source[index];
+    if (char === "'" || char === '"' || char === "`") {
+      index = skipQuoted(source, index) - 1;
+      continue;
+    }
+    if (source.startsWith("//", index) || source.startsWith("/*", index)) {
+      index = skipTrivia(source, index) - 1;
+      continue;
+    }
+    const afterCtx = consumeIdentifier(source, index, "ctx");
+    if (!afterCtx) continue;
+    const afterSecrets = consumeMember(source, afterCtx, "secrets");
+    if (!afterSecrets) continue;
+    const afterHeader = consumeMember(source, afterSecrets, "header");
+    const helper = afterHeader ? "header" : "bearer";
+    const afterHelper = afterHeader ?? consumeMember(source, afterSecrets, "bearer");
+    if (!afterHelper) continue;
+    const afterOpen = skipTrivia(source, afterHelper);
+    if (source[afterOpen] !== "(") continue;
+    const firstArgument = skipTrivia(source, afterOpen + 1);
+    const credential = helper === "header" ? skipTrivia(source, skipExpression(source, firstArgument) + 1) : firstArgument;
+    if (isDirectStringLiteral(source, credential)) return true;
+  }
+  return false;
+}
+function collectInlineSecretFindings(sourceCode) {
+  const findings = [];
+  for (const match of sourceCode.matchAll(SECRET_ENV_PATTERN)) {
+    findings.push(`process.env.${match[1]}`);
+  }
+  if (PRIVATE_KEY_PATTERN.test(sourceCode)) findings.push("private key block");
+  if (BEARER_LITERAL_PATTERN.test(sourceCode))
+    findings.push("bearer token literal");
+  if (ASSIGNMENT_SECRET_LITERAL_PATTERN.test(sourceCode)) {
+    findings.push("secret-looking assignment literal");
+  }
+  if (hasLiteralSecretAuthCredential(sourceCode)) {
+    findings.push(SECRET_AUTH_LITERAL_FINDING);
+  }
+  return [...new Set(findings)];
+}
+function validatePlaySourceHasNoInlineSecrets(input) {
+  const findings = collectInlineSecretFindings(input.sourceCode);
+  if (!findings.length) return;
+  throw new Error(
+    [
+      `Play source ${input.filePath} appears to contain inline secret material: ${[
+        ...new Set(findings)
+      ].join(", ")}.`,
+      `Author secrets in the dashboard, declare them in the Play's top-level secrets option, and read them at runtime with await ctx.secrets.get("NAME").`
+    ].join(" ")
+  );
+}
+function validatePlaySourceFilesHaveNoInlineSecrets(sourceFiles) {
+  for (const [filePath, sourceCode] of Object.entries(sourceFiles)) {
+    validatePlaySourceHasNoInlineSecrets({ filePath, sourceCode });
+  }
+}
+
+export {
+  collectInlineSecretFindings,
+  validatePlaySourceFilesHaveNoInlineSecrets
+};