deepline 0.3.294 → 0.3.296

package/dist/cli/chunk-2MZ5EQZE.mjs

@@ -0,0 +1,499 @@
+import {
+  getAuthedHttpClient,
+  openInBrowser,
+  printCommandEnvelope
+} from "./chunk-NTEZFZLE.mjs";
+import {
+  resolveBaseUrlOnly
+} from "./chunk-NPPJX3BL.mjs";
+
+// src/cli/commands/git.ts
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function renderProject(project) {
+  const root = project.rootDirectory ? ` (${project.rootDirectory})` : "";
+  const flags = [
+    project.disabled ? "unlinked" : "linked",
+    `deploys ${project.productionBranch}`,
+    project.checkOnPullRequest ? "PR checks on" : "PR checks off"
+  ].join(", ");
+  return `${project.id}  ${project.repoFullName}${root} - ${flags}`;
+}
+function renderDeployment(deployment) {
+  const fromDirectory = deployment.playProjectId === null;
+  const kind = fromDirectory ? "directory deploy" : deployment.isProduction ? "production" : deployment.trigger === "pull_request" ? `pr #${deployment.pullRequestNumber ?? "?"}` : deployment.trigger;
+  const suffix = deployment.error ? ` - ${deployment.error.slice(0, 80)}` : "";
+  const source = [
+    deployment.commitSha?.slice(0, 10),
+    deployment.ref?.replace("refs/heads/", ""),
+    fromDirectory ? deployment.repoFullName : null
+  ].filter(Boolean).join(" ") || "no git metadata";
+  return `${deployment.id}  ${source} (${kind}) - ${deployment.status}${suffix}`;
+}
+async function handleList(options) {
+  const { http } = getAuthedHttpClient();
+  const payload = await http.get(
+    `/api/v2/play-projects${options.all ? "?includeDisabled=1" : ""}`
+  );
+  printCommandEnvelope(
+    {
+      projects: payload.projects,
+      count: payload.projects.length,
+      render: {
+        sections: [
+          {
+            title: "linked repositories",
+            lines: payload.projects.length ? payload.projects.map(renderProject) : [
+              "No repositories are linked. Run `deepline git repos` to see what the GitHub installation can reach, then `deepline git link`."
+            ]
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+function describeInstallationStatus(installation) {
+  switch (installation.status) {
+    case "active":
+      return [
+        `Connected to ${installation.accountLogin} (installation ${installation.installationId}).`
+      ];
+    case "uninstalled":
+      return [
+        `The Deepline GitHub App was uninstalled from ${installation.accountLogin}${installation.uninstalledAt ? ` at ${new Date(installation.uninstalledAt).toISOString()}` : ""}.`,
+        "Deploys are paused for every linked repository. Run `deepline git connect`, then `deepline git link <owner/repo>` again for each repository; links from the old installation cannot be resumed."
+      ];
+    case "suspended":
+      return [
+        `GitHub suspended the Deepline App on ${installation.accountLogin}${installation.suspendedAt ? ` at ${new Date(installation.suspendedAt).toISOString()}` : ""}.`,
+        "Pushes are not delivered while it is suspended; unsuspend it in GitHub settings."
+      ];
+  }
+}
+async function handleStatus(options) {
+  const { http } = getAuthedHttpClient();
+  const payload = await http.get("/api/v2/github/installation");
+  const installation = payload.installation;
+  const others = (payload.installations ?? []).filter(
+    (row) => row.installationId !== installation?.installationId
+  );
+  const lines = installation ? describeInstallationStatus(installation) : [
+    "No GitHub installation is connected to this workspace. Run `deepline git connect`."
+  ];
+  for (const other of others) {
+    lines.push(
+      `Also: ${other.accountLogin} (installation ${other.installationId}) is ${other.status}.`
+    );
+  }
+  const byId = new Map(
+    (payload.installations ?? []).map((row) => [row.installationId, row])
+  );
+  const { projects } = await http.get(
+    "/api/v2/play-projects?includeDisabled=1"
+  );
+  const affected_links = projects.map((project) => {
+    const own = byId.get(project.installationId);
+    const verdict = !own ? "unknown" : own.status === "active" ? null : own.status;
+    return verdict ? {
+      id: project.id,
+      repoId: project.repoId,
+      repoFullName: project.repoFullName,
+      rootDirectory: project.rootDirectory,
+      productionBranch: project.productionBranch,
+      manifestPath: project.manifestPath,
+      checkOnPullRequest: project.checkOnPullRequest,
+      disabled: project.disabled,
+      installationId: project.installationId,
+      installationStatus: verdict
+    } : null;
+  }).filter((row) => row !== null);
+  const activeInstallations = (payload.installations ?? []).filter(
+    (row) => row.status === "active"
+  );
+  const relinkCommand = (link) => [
+    // The numeric repo id, not the name: a repository renamed while the
+    // App was gone keeps a stale name here, and `git link` accepts the id.
+    `deepline git link ${link.repoId}`,
+    // Stored values are admin-controlled text and this line is
+    // copy-pasted into a shell by whoever reads it, so every
+    // interpolated value below is quoted.
+    `--branch ${shellQuote(link.productionBranch)}`,
+    link.rootDirectory ? `--root-dir ${shellQuote(link.rootDirectory)}` : "",
+    link.manifestPath && link.manifestPath !== "deepline.json" ? `--manifest ${shellQuote(link.manifestPath)}` : "",
+    link.checkOnPullRequest ? "" : "--no-pr-checks",
+    // With several active installations no id is guessed: the reader picks.
+    activeInstallations.length > 1 ? "--installation <id>" : ""
+  ].filter(Boolean).join(" ");
+  for (const link of affected_links) {
+    const label = `${link.repoFullName}${link.rootDirectory ? ` (${link.rootDirectory})` : ""}`;
+    lines.push(
+      link.installationStatus !== "suspended" ? `Link again: ${label} \u2014 its installation ${link.installationId} is ${link.installationStatus}; run \`${relinkCommand(link)}\`${activeInstallations.length > 1 ? ` with <id> being the installation that reaches this repo: ${activeInstallations.map((row) => `${row.installationId} (${row.accountLogin})`).join(", ")}` : ""}.` : (
+        // A link disabled during the suspension stays disabled; only an
+        // enabled one picks up again on its own when GitHub unsuspends.
+        link.disabled ? `Paused and disabled: ${label} \u2014 its installation is suspended, and the link stays disabled after GitHub unsuspends it until you run \`deepline git set ${link.id} --enabled\`.` : `Paused: ${label} \u2014 its installation is suspended; pushes resume when GitHub unsuspends it.`
+      )
+    );
+  }
+  printCommandEnvelope(
+    {
+      installation,
+      installations: payload.installations ?? [],
+      affected_links,
+      render: { sections: [{ title: "github installation", lines }] }
+    },
+    { json: options.json }
+  );
+}
+async function handleRepos(options) {
+  const { http } = getAuthedHttpClient();
+  const query = options.installation ? `?installationId=${encodeURIComponent(options.installation)}` : "";
+  const payload = await http.get(`/api/v2/github/repos${query}`);
+  printCommandEnvelope(
+    {
+      installation: payload.installation,
+      repositories: payload.repositories,
+      count: payload.repositories.length,
+      render: {
+        sections: [
+          {
+            title: `repos on installation @${payload.installation.accountLogin} (${payload.installation.repositorySelection})`,
+            lines: payload.repositories.map(
+              (repo) => `${repo.repoId}  ${repo.fullName} (default: ${repo.defaultBranch}${repo.private ? ", private" : ""}${repo.fork ? ", fork" : ""})`
+            )
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+async function resolveRepoId(repo, installation) {
+  if (/^\d+$/.test(repo)) return Number(repo);
+  const { http } = getAuthedHttpClient();
+  const query = installation ? `?installationId=${encodeURIComponent(installation)}` : "";
+  const payload = await http.get(
+    `/api/v2/github/repos${query}`
+  );
+  const match = payload.repositories.find(
+    (entry) => entry.fullName.toLowerCase() === repo.toLowerCase()
+  );
+  if (!match) {
+    throw new Error(
+      `Repo "${repo}" is not accessible to the workspace's GitHub installation. Run \`deepline git repos\` to list what is.`
+    );
+  }
+  return match.repoId;
+}
+async function handleLink(repo, options) {
+  const repoId = await resolveRepoId(repo, options.installation);
+  const { http } = getAuthedHttpClient();
+  const payload = await http.post("/api/v2/play-projects", {
+    repoId,
+    ...options.installation !== void 0 ? { installationId: options.installation } : {},
+    ...options.rootDir !== void 0 ? { rootDirectory: options.rootDir } : {},
+    ...options.manifest !== void 0 ? { manifestPath: options.manifest } : {},
+    ...options.branch !== void 0 ? { productionBranch: options.branch } : {},
+    ...options.prChecks !== void 0 ? { checkOnPullRequest: options.prChecks } : {}
+  });
+  printCommandEnvelope(
+    {
+      project: payload.project,
+      render: {
+        sections: [
+          {
+            title: "linked",
+            lines: [
+              renderProject(payload.project),
+              ...(payload.warnings ?? []).map(
+                (warning) => `WARNING: ${warning}`
+              ),
+              "Pushes to the production branch now register and promote changed plays.",
+              "Anyone who can push to this repo can change what runs in this workspace."
+            ]
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+async function handleGet(id, options) {
+  const { http } = getAuthedHttpClient();
+  const payload = await http.get(
+    `/api/v2/play-projects/${encodeURIComponent(id)}`
+  );
+  printCommandEnvelope(
+    {
+      project: payload.project,
+      render: {
+        sections: [
+          {
+            title: "linked repository",
+            lines: [renderProject(payload.project)]
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+async function handleSet(id, options) {
+  const { http } = getAuthedHttpClient();
+  const payload = await http.patch(
+    `/api/v2/play-projects/${encodeURIComponent(id)}`,
+    {
+      ...options.branch !== void 0 ? { productionBranch: options.branch } : {},
+      ...options.rootDir !== void 0 ? { rootDirectory: options.rootDir } : {},
+      ...options.manifest !== void 0 ? { manifestPath: options.manifest } : {},
+      ...options.prChecks !== void 0 ? { checkOnPullRequest: options.prChecks } : {},
+      ...options.disabled !== void 0 ? { disabled: options.disabled } : {}
+    }
+  );
+  printCommandEnvelope(
+    {
+      project: payload.project,
+      render: {
+        sections: [
+          { title: "updated", lines: [renderProject(payload.project)] }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+async function handleUnlink(id, options) {
+  const { http } = getAuthedHttpClient();
+  await http.delete(`/api/v2/play-projects/${encodeURIComponent(id)}`);
+  printCommandEnvelope(
+    {
+      ok: true,
+      id,
+      render: {
+        sections: [
+          {
+            title: "unlinked",
+            lines: [
+              `Repository link ${id} removed. Deployments stop immediately and in-flight deploy credentials die; live plays keep running.`,
+              "Plays this repository deployed are released: they keep their live version, stop showing it as their source, and are no longer marked drifted from it."
+            ]
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+async function handleConnect(options) {
+  const baseUrl = resolveBaseUrlOnly();
+  const connectUrl = `${baseUrl.replace(/\/$/, "")}/api/v2/github/connect`;
+  const opened = openInBrowser(connectUrl);
+  printCommandEnvelope(
+    {
+      connectUrl,
+      browser: opened,
+      render: {
+        sections: [
+          {
+            title: "connect GitHub",
+            lines: [
+              "Git deploys is in beta and requires workspace enablement. Contact the Deepline team to request enablement if interested.",
+              opened === "opened" ? `Opened ${connectUrl} in your browser.` : `Open ${connectUrl} in your browser.`,
+              "Sign in as a workspace admin if prompted, approve the GitHub",
+              "installation, then return here and run `deepline git repos`."
+            ]
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+async function handleDeploymentsList(options) {
+  const { http } = getAuthedHttpClient();
+  const query = new URLSearchParams();
+  if (options.repo) query.set("projectId", options.repo);
+  if (options.limit) query.set("limit", options.limit);
+  const suffix = query.size > 0 ? `?${query.toString()}` : "";
+  const payload = await http.get(
+    `/api/v2/deployments${suffix}`
+  );
+  printCommandEnvelope(
+    {
+      deployments: payload.deployments,
+      count: payload.deployments.length,
+      render: {
+        sections: [
+          {
+            title: "deployments",
+            lines: payload.deployments.length ? payload.deployments.map(renderDeployment) : [
+              "No deployments yet. Push to a linked repository, or run `deepline plays deploy`."
+            ]
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+function renderDeploymentPlayLines(results) {
+  const plays = results?.plays;
+  if (!Array.isArray(plays)) return [];
+  return plays.flatMap((play) => {
+    const version = play.version === void 0 ? "" : play.previousVersion === void 0 ? ` v${play.version}` : ` v${play.previousVersion} -> v${play.version}`;
+    const file = play.file ? ` (${play.file})` : "";
+    const sdkUpdated = play.sdkUpdated ? " (SDK updated)" : "";
+    return [
+      `${play.name ?? "?"}${file} - ${play.status ?? "?"}${version}${sdkUpdated}`,
+      ...play.error ? [`  error: ${play.error}`] : [],
+      ...play.warning ? [`  warning: ${play.warning}`] : []
+    ];
+  });
+}
+function renderDeploymentMonitorLines(results) {
+  const monitors = results?.monitors;
+  if (!Array.isArray(monitors)) return [];
+  return monitors.flatMap((monitor) => [
+    `${monitor.key ?? "?"}${monitor.file ? ` (${monitor.file})` : ""} - ${monitor.status ?? "?"}`,
+    ...monitor.jobId ? [`  job: ${monitor.jobId}`] : [],
+    ...monitor.credits != null ? [`  Deepline credits: ${monitor.credits}`] : [],
+    ...monitor.error ? [`  error: ${monitor.error}`] : [],
+    ...monitor.warning ? [`  warning: ${monitor.warning}`] : []
+  ]);
+}
+async function handleDeploymentGet(id, options) {
+  const { http } = getAuthedHttpClient();
+  const payload = await http.get(`/api/v2/deployments/${encodeURIComponent(id)}`);
+  const playLines = renderDeploymentPlayLines(payload.deployment.results);
+  const monitorLines = renderDeploymentMonitorLines(payload.deployment.results);
+  const repository = payload.project?.repoFullName ?? payload.deployment.repoFullName;
+  printCommandEnvelope(
+    {
+      deployment: payload.deployment,
+      project: payload.project,
+      render: {
+        sections: [
+          {
+            title: `deployment ${payload.deployment.id}${repository ? ` (${repository})` : ""}`,
+            lines: [renderDeployment(payload.deployment)]
+          },
+          ...playLines.length ? [{ title: "plays", lines: playLines }] : [],
+          ...monitorLines.length ? [{ title: "monitors", lines: monitorLines }] : []
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+async function handleDeploymentCancel(id, options) {
+  const { http } = getAuthedHttpClient();
+  const payload = await http.post(`/api/v2/deployments/${encodeURIComponent(id)}/cancel`, {});
+  printCommandEnvelope(
+    {
+      cancelled: payload.cancelled,
+      deployment: payload.deployment,
+      render: {
+        sections: [
+          {
+            title: payload.cancelled ? "cancelled" : "already cancelled",
+            lines: [
+              payload.deployment ? renderDeployment(payload.deployment) : `Deployment ${id} cancelled.`,
+              "The build stops at its next step and nothing from it goes live."
+            ]
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+function registerGitCommands(program) {
+  const git = program.command("git").alias("projects").description(
+    "Git deploys (beta): link repositories and deploy plays on push."
+  ).addHelpText(
+    "after",
+    `
+Git deploys is in beta and requires workspace enablement.
+If it is not enabled for your workspace, contact the Deepline team to request
+enablement.
+
+Examples:
+  deepline git connect
+  deepline git status
+  deepline git repos
+  deepline git link acme/growth --branch main
+  deepline git list
+  deepline git set <id> --branch release
+  deepline git unlink <id>
+  deepline git deployments --repo <id>
+  deepline git cancel <deployment-id>
+
+After linking, push committed Play changes to the configured production branch:
+  git push origin main
+
+Guide: https://deepline.com/docs/sdk-v2/git-deploys
+`
+  );
+  git.command("connect").description("Connect a GitHub installation (browser step).").option("--json", "Emit JSON output").action(async (options) => handleConnect(options));
+  git.command("status").description(
+    "Show the workspace's GitHub installation and whether it is still usable."
+  ).option("--json", "Emit JSON output").action(async (options) => handleStatus(options));
+  git.command("repos").description("List repos the workspace's GitHub installation can reach.").option(
+    "--installation <id>",
+    "GitHub installation id (required when several are connected)"
+  ).option("--json", "Emit JSON output").action(
+    async (options) => handleRepos(options)
+  );
+  git.command("list").description("List linked repositories.").option("--all", "Include unlinked repositories").option("--json", "Emit JSON output").action(
+    async (options) => handleList(options)
+  );
+  git.command("link").description("Link a repository to this workspace for deploy-on-push.").argument("<repo>", "Repo full name (owner/name) or numeric repo id").option("--root-dir <path>", "Base path inside the repo for this link").option("--branch <name>", "Production branch (default: repo default)").option(
+    "--manifest <file>",
+    "Manifest file name under the base path (default: deepline.json)"
+  ).option(
+    "--installation <id>",
+    "GitHub installation id (required when several are connected)"
+  ).option("--no-pr-checks", "Skip Check Runs on pull requests").option("--json", "Emit JSON output").action(
+    async (repo, options) => handleLink(repo, options)
+  );
+  git.command("get").description("Show one linked repository.").argument("<id>", "Repository link id").option("--json", "Emit JSON output").action(async (id, options) => handleGet(id, options));
+  git.command("set").description("Update a linked repository.").argument("<id>", "Repository link id").option("--branch <name>", "Production branch").option("--root-dir <path>", "Base path inside the repo for this link").option(
+    "--manifest <file>",
+    "Manifest file name under the base path (default: deepline.json)"
+  ).option("--pr-checks", "Enable Check Runs on pull requests").option("--no-pr-checks", "Disable Check Runs on pull requests").option("--disabled", "Pause deployments for this link").option("--enabled", "Resume deployments for this link").option("--json", "Emit JSON output").action(
+    async (id, options) => handleSet(id, {
+      ...options,
+      disabled: options.enabled === true ? false : options.disabled === true ? true : void 0
+    })
+  );
+  git.command("unlink").description(
+    "Unlink a repository (live plays keep running, and are released from it)."
+  ).argument("<id>", "Repository link id").option("--json", "Emit JSON output").action(
+    async (id, options) => handleUnlink(id, options)
+  );
+  git.command("deployments").description("Deployment history; pass an id for one deployment.").argument("[id]", "Deployment id (omit to list)").option("--repo <id>", "Filter to one repository link").option("--limit <n>", "Max rows (default 50)").option("--json", "Emit JSON output").action(
+    async (id, options) => id ? handleDeploymentGet(id, options) : handleDeploymentsList(options)
+  );
+  git.command("cancel").description(
+    "Cancel a queued or running deployment before its plays go live (admin)."
+  ).argument("<id>", "Deployment id").option("--json", "Emit JSON output").action(
+    async (id, options) => handleDeploymentCancel(id, options)
+  );
+  const deployments = program.command("deployments", { hidden: true });
+  deployments.command("list").option("--project <id>", "Filter to one repository link").option("--limit <n>", "Max rows (default 50)").option("--json", "Emit JSON output").action(
+    async (options) => handleDeploymentsList({ ...options, repo: options.project })
+  );
+  deployments.command("get").argument("<id>", "Deployment id").option("--json", "Emit JSON output").action(
+    async (id, options) => handleDeploymentGet(id, options)
+  );
+}
+
+export {
+  renderDeployment,
+  handleDeploymentsList,
+  renderDeploymentPlayLines,
+  renderDeploymentMonitorLines,
+  handleDeploymentGet,
+  registerGitCommands
+};

package/dist/cli/chunk-3KC45UVF.js

@@ -0,0 +1,150 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } }// ../plays/secret-guardrails.ts
+var SECRET_ENV_PATTERN = /\bprocess(?:\.env|\[['"]env['"]\])(?:\.|\[['"])([A-Z0-9_]*(?:API[_-]?KEY|TOKEN|SECRET|PASSWORD|PRIVATE[_-]?KEY|ACCESS[_-]?KEY)[A-Z0-9_]*)(?:['"]\])?/g;
+var PRIVATE_KEY_PATTERN = /-----BEGIN (?:RSA |EC |OPENSSH |PGP )?PRIVATE KEY-----/;
+var BEARER_LITERAL_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/i;
+var ASSIGNMENT_SECRET_LITERAL_PATTERN = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*['"][^'"]{12,}['"]/i;
+var SECRET_AUTH_LITERAL_FINDING = "literal credential passed to ctx.secrets auth helper";
+function skipQuoted(source, start) {
+  const quote = source[start];
+  let index = start + 1;
+  while (index < source.length) {
+    if (source[index] === "\\") {
+      index += 2;
+    } else if (source[index] === quote) {
+      return index + 1;
+    } else {
+      index += 1;
+    }
+  }
+  return source.length;
+}
+function skipTrivia(source, start) {
+  let index = start;
+  while (index < source.length) {
+    if (/\s/.test(source[index])) {
+      index += 1;
+    } else if (source.startsWith("//", index)) {
+      index = source.indexOf("\n", index + 2);
+      if (index === -1) return source.length;
+    } else if (source.startsWith("/*", index)) {
+      index = source.indexOf("*/", index + 2);
+      if (index === -1) return source.length;
+      index += 2;
+    } else {
+      return index;
+    }
+  }
+  return index;
+}
+function consumeIdentifier(source, start, expected) {
+  return source.startsWith(expected, start) && !/[A-Za-z0-9_$]/.test(_nullishCoalesce(source[start - 1], () => ( ""))) && !/[A-Za-z0-9_$]/.test(_nullishCoalesce(source[start + expected.length], () => ( ""))) ? start + expected.length : void 0;
+}
+function consumeMember(source, start, expected) {
+  let index = skipTrivia(source, start);
+  if (source[index] === ".") {
+    return consumeIdentifier(source, skipTrivia(source, index + 1), expected);
+  }
+  if (source[index] !== "[") return void 0;
+  index = skipTrivia(source, index + 1);
+  if (source[index] !== "'" && source[index] !== '"') return void 0;
+  const end = skipQuoted(source, index);
+  if (source.slice(index + 1, end - 1) !== expected) return void 0;
+  index = skipTrivia(source, end);
+  return source[index] === "]" ? index + 1 : void 0;
+}
+function skipExpression(source, start) {
+  let index = start;
+  let depth = 0;
+  while (index < source.length) {
+    const char = source[index];
+    if (char === "'" || char === '"' || char === "`") {
+      index = skipQuoted(source, index);
+      continue;
+    }
+    if (source.startsWith("//", index) || source.startsWith("/*", index)) {
+      index = skipTrivia(source, index);
+      continue;
+    }
+    if (char === "(" || char === "[" || char === "{") {
+      depth += 1;
+    } else if (char === ")" || char === "]" || char === "}") {
+      if (depth === 0) return index;
+      depth -= 1;
+    } else if (char === "," && depth === 0) {
+      return index;
+    }
+    index += 1;
+  }
+  return index;
+}
+function isDirectStringLiteral(source, start) {
+  const quote = source[start];
+  if (quote !== "'" && quote !== '"' && quote !== "`") return false;
+  const end = skipQuoted(source, start);
+  return quote !== "`" || !source.slice(start, end).includes("${");
+}
+function hasLiteralSecretAuthCredential(source) {
+  for (let index = 0; index < source.length; index += 1) {
+    const char = source[index];
+    if (char === "'" || char === '"' || char === "`") {
+      index = skipQuoted(source, index) - 1;
+      continue;
+    }
+    if (source.startsWith("//", index) || source.startsWith("/*", index)) {
+      index = skipTrivia(source, index) - 1;
+      continue;
+    }
+    const afterCtx = consumeIdentifier(source, index, "ctx");
+    if (!afterCtx) continue;
+    const afterSecrets = consumeMember(source, afterCtx, "secrets");
+    if (!afterSecrets) continue;
+    const afterHeader = consumeMember(source, afterSecrets, "header");
+    const helper = afterHeader ? "header" : "bearer";
+    const afterHelper = _nullishCoalesce(afterHeader, () => ( consumeMember(source, afterSecrets, "bearer")));
+    if (!afterHelper) continue;
+    const afterOpen = skipTrivia(source, afterHelper);
+    if (source[afterOpen] !== "(") continue;
+    const firstArgument = skipTrivia(source, afterOpen + 1);
+    const credential = helper === "header" ? skipTrivia(source, skipExpression(source, firstArgument) + 1) : firstArgument;
+    if (isDirectStringLiteral(source, credential)) return true;
+  }
+  return false;
+}
+function collectInlineSecretFindings(sourceCode) {
+  const findings = [];
+  for (const match of sourceCode.matchAll(SECRET_ENV_PATTERN)) {
+    findings.push(`process.env.${match[1]}`);
+  }
+  if (PRIVATE_KEY_PATTERN.test(sourceCode)) findings.push("private key block");
+  if (BEARER_LITERAL_PATTERN.test(sourceCode))
+    findings.push("bearer token literal");
+  if (ASSIGNMENT_SECRET_LITERAL_PATTERN.test(sourceCode)) {
+    findings.push("secret-looking assignment literal");
+  }
+  if (hasLiteralSecretAuthCredential(sourceCode)) {
+    findings.push(SECRET_AUTH_LITERAL_FINDING);
+  }
+  return [...new Set(findings)];
+}
+function validatePlaySourceHasNoInlineSecrets(input) {
+  const findings = collectInlineSecretFindings(input.sourceCode);
+  if (!findings.length) return;
+  throw new Error(
+    [
+      `Play source ${input.filePath} appears to contain inline secret material: ${[
+        ...new Set(findings)
+      ].join(", ")}.`,
+      `Author secrets in the dashboard, declare them in the Play's top-level secrets option, and read them at runtime with await ctx.secrets.get("NAME").`
+    ].join(" ")
+  );
+}
+function validatePlaySourceFilesHaveNoInlineSecrets(sourceFiles) {
+  for (const [filePath, sourceCode] of Object.entries(sourceFiles)) {
+    validatePlaySourceHasNoInlineSecrets({ filePath, sourceCode });
+  }
+}
+
+
+
+
+exports.collectInlineSecretFindings = collectInlineSecretFindings; exports.validatePlaySourceFilesHaveNoInlineSecrets = validatePlaySourceFilesHaveNoInlineSecrets;

package/dist/cli/chunk-3XX5TEA4.js

@@ -0,0 +1,15 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }// ../plays/enrich-compat-adapter.ts
+var ENRICH_COMPAT_DEFAULT_PLAY_NAME = "deepline-enrich-v1-compat";
+var ENRICH_COMPAT_DEFAULT_MAP_NAME = "deepline_enrich_rows";
+var ENRICH_COMMAND_DEPRECATION_MESSAGE = "The `deepline enrich` command is deprecated. Deepline Plays gives much better results. Run `deepline plays --help` to get started. If you still need the legacy command, submit feedback explaining why.";
+function buildEnrichCompatibilityPlan(options = {}) {
+  return {
+    playName: _optionalChain([options, 'access', _ => _.playName, 'optionalAccess', _2 => _2.trim, 'call', _3 => _3()]) || ENRICH_COMPAT_DEFAULT_PLAY_NAME,
+    mapName: _optionalChain([options, 'access', _4 => _4.mapName, 'optionalAccess', _5 => _5.trim, 'call', _6 => _6()]) || ENRICH_COMPAT_DEFAULT_MAP_NAME
+  };
+}
+
+
+
+
+exports.ENRICH_COMMAND_DEPRECATION_MESSAGE = ENRICH_COMMAND_DEPRECATION_MESSAGE; exports.buildEnrichCompatibilityPlan = buildEnrichCompatibilityPlan;