deepline 0.3.294 → 0.3.295

package/dist/cli/chunk-3KC45UVF.js

@@ -0,0 +1,150 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } }// ../plays/secret-guardrails.ts
+var SECRET_ENV_PATTERN = /\bprocess(?:\.env|\[['"]env['"]\])(?:\.|\[['"])([A-Z0-9_]*(?:API[_-]?KEY|TOKEN|SECRET|PASSWORD|PRIVATE[_-]?KEY|ACCESS[_-]?KEY)[A-Z0-9_]*)(?:['"]\])?/g;
+var PRIVATE_KEY_PATTERN = /-----BEGIN (?:RSA |EC |OPENSSH |PGP )?PRIVATE KEY-----/;
+var BEARER_LITERAL_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/i;
+var ASSIGNMENT_SECRET_LITERAL_PATTERN = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*['"][^'"]{12,}['"]/i;
+var SECRET_AUTH_LITERAL_FINDING = "literal credential passed to ctx.secrets auth helper";
+function skipQuoted(source, start) {
+  const quote = source[start];
+  let index = start + 1;
+  while (index < source.length) {
+    if (source[index] === "\\") {
+      index += 2;
+    } else if (source[index] === quote) {
+      return index + 1;
+    } else {
+      index += 1;
+    }
+  }
+  return source.length;
+}
+function skipTrivia(source, start) {
+  let index = start;
+  while (index < source.length) {
+    if (/\s/.test(source[index])) {
+      index += 1;
+    } else if (source.startsWith("//", index)) {
+      index = source.indexOf("\n", index + 2);
+      if (index === -1) return source.length;
+    } else if (source.startsWith("/*", index)) {
+      index = source.indexOf("*/", index + 2);
+      if (index === -1) return source.length;
+      index += 2;
+    } else {
+      return index;
+    }
+  }
+  return index;
+}
+function consumeIdentifier(source, start, expected) {
+  return source.startsWith(expected, start) && !/[A-Za-z0-9_$]/.test(_nullishCoalesce(source[start - 1], () => ( ""))) && !/[A-Za-z0-9_$]/.test(_nullishCoalesce(source[start + expected.length], () => ( ""))) ? start + expected.length : void 0;
+}
+function consumeMember(source, start, expected) {
+  let index = skipTrivia(source, start);
+  if (source[index] === ".") {
+    return consumeIdentifier(source, skipTrivia(source, index + 1), expected);
+  }
+  if (source[index] !== "[") return void 0;
+  index = skipTrivia(source, index + 1);
+  if (source[index] !== "'" && source[index] !== '"') return void 0;
+  const end = skipQuoted(source, index);
+  if (source.slice(index + 1, end - 1) !== expected) return void 0;
+  index = skipTrivia(source, end);
+  return source[index] === "]" ? index + 1 : void 0;
+}
+function skipExpression(source, start) {
+  let index = start;
+  let depth = 0;
+  while (index < source.length) {
+    const char = source[index];
+    if (char === "'" || char === '"' || char === "`") {
+      index = skipQuoted(source, index);
+      continue;
+    }
+    if (source.startsWith("//", index) || source.startsWith("/*", index)) {
+      index = skipTrivia(source, index);
+      continue;
+    }
+    if (char === "(" || char === "[" || char === "{") {
+      depth += 1;
+    } else if (char === ")" || char === "]" || char === "}") {
+      if (depth === 0) return index;
+      depth -= 1;
+    } else if (char === "," && depth === 0) {
+      return index;
+    }
+    index += 1;
+  }
+  return index;
+}
+function isDirectStringLiteral(source, start) {
+  const quote = source[start];
+  if (quote !== "'" && quote !== '"' && quote !== "`") return false;
+  const end = skipQuoted(source, start);
+  return quote !== "`" || !source.slice(start, end).includes("${");
+}
+function hasLiteralSecretAuthCredential(source) {
+  for (let index = 0; index < source.length; index += 1) {
+    const char = source[index];
+    if (char === "'" || char === '"' || char === "`") {
+      index = skipQuoted(source, index) - 1;
+      continue;
+    }
+    if (source.startsWith("//", index) || source.startsWith("/*", index)) {
+      index = skipTrivia(source, index) - 1;
+      continue;
+    }
+    const afterCtx = consumeIdentifier(source, index, "ctx");
+    if (!afterCtx) continue;
+    const afterSecrets = consumeMember(source, afterCtx, "secrets");
+    if (!afterSecrets) continue;
+    const afterHeader = consumeMember(source, afterSecrets, "header");
+    const helper = afterHeader ? "header" : "bearer";
+    const afterHelper = _nullishCoalesce(afterHeader, () => ( consumeMember(source, afterSecrets, "bearer")));
+    if (!afterHelper) continue;
+    const afterOpen = skipTrivia(source, afterHelper);
+    if (source[afterOpen] !== "(") continue;
+    const firstArgument = skipTrivia(source, afterOpen + 1);
+    const credential = helper === "header" ? skipTrivia(source, skipExpression(source, firstArgument) + 1) : firstArgument;
+    if (isDirectStringLiteral(source, credential)) return true;
+  }
+  return false;
+}
+function collectInlineSecretFindings(sourceCode) {
+  const findings = [];
+  for (const match of sourceCode.matchAll(SECRET_ENV_PATTERN)) {
+    findings.push(`process.env.${match[1]}`);
+  }
+  if (PRIVATE_KEY_PATTERN.test(sourceCode)) findings.push("private key block");
+  if (BEARER_LITERAL_PATTERN.test(sourceCode))
+    findings.push("bearer token literal");
+  if (ASSIGNMENT_SECRET_LITERAL_PATTERN.test(sourceCode)) {
+    findings.push("secret-looking assignment literal");
+  }
+  if (hasLiteralSecretAuthCredential(sourceCode)) {
+    findings.push(SECRET_AUTH_LITERAL_FINDING);
+  }
+  return [...new Set(findings)];
+}
+function validatePlaySourceHasNoInlineSecrets(input) {
+  const findings = collectInlineSecretFindings(input.sourceCode);
+  if (!findings.length) return;
+  throw new Error(
+    [
+      `Play source ${input.filePath} appears to contain inline secret material: ${[
+        ...new Set(findings)
+      ].join(", ")}.`,
+      `Author secrets in the dashboard, declare them in the Play's top-level secrets option, and read them at runtime with await ctx.secrets.get("NAME").`
+    ].join(" ")
+  );
+}
+function validatePlaySourceFilesHaveNoInlineSecrets(sourceFiles) {
+  for (const [filePath, sourceCode] of Object.entries(sourceFiles)) {
+    validatePlaySourceHasNoInlineSecrets({ filePath, sourceCode });
+  }
+}
+
+
+
+
+exports.collectInlineSecretFindings = collectInlineSecretFindings; exports.validatePlaySourceFilesHaveNoInlineSecrets = validatePlaySourceFilesHaveNoInlineSecrets;

package/dist/cli/chunk-3XX5TEA4.js

@@ -0,0 +1,15 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }// ../plays/enrich-compat-adapter.ts
+var ENRICH_COMPAT_DEFAULT_PLAY_NAME = "deepline-enrich-v1-compat";
+var ENRICH_COMPAT_DEFAULT_MAP_NAME = "deepline_enrich_rows";
+var ENRICH_COMMAND_DEPRECATION_MESSAGE = "The `deepline enrich` command is deprecated. Deepline Plays gives much better results. Run `deepline plays --help` to get started. If you still need the legacy command, submit feedback explaining why.";
+function buildEnrichCompatibilityPlan(options = {}) {
+  return {
+    playName: _optionalChain([options, 'access', _ => _.playName, 'optionalAccess', _2 => _2.trim, 'call', _3 => _3()]) || ENRICH_COMPAT_DEFAULT_PLAY_NAME,
+    mapName: _optionalChain([options, 'access', _4 => _4.mapName, 'optionalAccess', _5 => _5.trim, 'call', _6 => _6()]) || ENRICH_COMPAT_DEFAULT_MAP_NAME
+  };
+}
+
+
+
+
+exports.ENRICH_COMMAND_DEPRECATION_MESSAGE = ENRICH_COMMAND_DEPRECATION_MESSAGE; exports.buildEnrichCompatibilityPlan = buildEnrichCompatibilityPlan;