deepline 0.3.294 → 0.3.296

package/dist/cli/secrets-UOEVR73Q.js

@@ -0,0 +1,400 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+
+var _chunk2C3AVPTYjs = require('./chunk-2C3AVPTY.js');
+require('./chunk-LA46MMTL.js');
+
+
+
+var _chunk7D6QG5KFjs = require('./chunk-7D6QG5KF.js');
+require('./chunk-6HPEDBSJ.js');
+require('./chunk-XNYIZMNQ.js');
+require('./chunk-LIKFCE7Z.js');
+require('./chunk-6A3TJUWC.js');
+require('./chunk-7P5AA3SN.js');
+require('./chunk-OG64RBAC.js');
+require('./chunk-COGTRVWW.js');
+
+// src/cli/commands/secrets.ts
+var _process = require('process');
+var _promises = require('fs/promises');
+var hiddenInputBuffer = "";
+function normalizeSecretName(value) {
+  const normalized = value.trim().toUpperCase();
+  if (!/^[A-Z][A-Z0-9_]{1,63}$/.test(normalized)) {
+    throw new Error(
+      "Secret names must be 2-64 characters and use uppercase letters, numbers, and underscores."
+    );
+  }
+  return normalized;
+}
+function normalizePlaySelector(value) {
+  const normalized = _optionalChain([value, 'optionalAccess', _ => _.trim, 'call', _2 => _2()]);
+  if (value !== void 0 && !normalized) {
+    throw new Error("--play requires a bare Play name.");
+  }
+  if (!normalized) return void 0;
+  if (normalized.includes("/")) {
+    throw new Error(
+      "--play expects the bare Play name, not an org-qualified name."
+    );
+  }
+  return normalized;
+}
+function resolveSecretWriteScope(options) {
+  const playName = normalizePlaySelector(options.play);
+  if (options.scope && options.scope !== "org" && options.scope !== "play") {
+    throw new Error("--scope must be either org or play.");
+  }
+  const scope = options.scope === void 0 ? playName ? "play" : "org" : options.scope;
+  if (scope === "play" && !playName) {
+    throw new Error("--play <name> is required when --scope play is used.");
+  }
+  if (scope === "org" && playName) {
+    throw new Error("--play can only be used with --scope play.");
+  }
+  return scope === "play" ? { scope, playName } : { scope };
+}
+function renderSecret(secret) {
+  const scope = secret.scope === "play" && secret.playName ? `play:${secret.playName}` : secret.scope;
+  const added = new Date(secret.createdAt).toISOString();
+  const updated = new Date(secret.updatedAt).toISOString();
+  const lastUsed = secret.lastUsedAt ? `, last used ${new Date(secret.lastUsedAt).toISOString()}` : ", never used";
+  const note = secret.note ? `, note ${JSON.stringify(secret.note)}` : "";
+  return `${secret.name} (${scope}) - ${secret.status}${secret.hasValue ? ", set" : ", empty"}${note}, added ${added}${updated !== added ? `, updated ${updated}` : ""}${lastUsed}`;
+}
+async function readHiddenLine(prompt, streams = {}) {
+  const inputStream = _nullishCoalesce(streams.input, () => ( _process.stdin));
+  const outputStream = _nullishCoalesce(streams.output, () => ( _process.stdout));
+  if (!inputStream.isTTY || !outputStream.isTTY) {
+    throw new Error(
+      "Secret values must be entered from an interactive TTY. Do not pipe, pass, or script secret values."
+    );
+  }
+  outputStream.write(prompt);
+  const previousRawMode = inputStream.isRaw;
+  const wasPaused = typeof inputStream.isPaused === "function" ? inputStream.isPaused() : false;
+  if (typeof inputStream.setRawMode === "function") {
+    inputStream.setRawMode(true);
+  }
+  let value = "";
+  inputStream.resume();
+  return await new Promise((resolve, reject) => {
+    let settled = false;
+    const cleanup = () => {
+      inputStream.off("data", onData);
+      inputStream.off("end", onEnd);
+      inputStream.off("error", onError);
+      if (typeof inputStream.setRawMode === "function") {
+        inputStream.setRawMode(previousRawMode);
+      }
+      if (wasPaused || inputStream === _process.stdin) {
+        inputStream.pause();
+      }
+    };
+    const finish = (line) => {
+      if (settled) return;
+      settled = true;
+      outputStream.write("\n");
+      cleanup();
+      resolve(line);
+    };
+    const fail = (error) => {
+      if (settled) return;
+      settled = true;
+      outputStream.write("\n");
+      cleanup();
+      reject(error);
+    };
+    const processText = (text) => {
+      for (let index = 0; index < text.length; index++) {
+        const char = text[index];
+        const code = char.charCodeAt(0);
+        if (char === "\r" || char === "\n") {
+          hiddenInputBuffer = text.slice(index + 1);
+          finish(value);
+          return;
+        }
+        if (code === 3) {
+          fail(new Error("Secret input cancelled."));
+          return;
+        }
+        if (code === 8 || code === 127) {
+          value = value.slice(0, -1);
+          continue;
+        }
+        if (code >= 32) {
+          value += char;
+        }
+      }
+      hiddenInputBuffer = "";
+    };
+    const onData = (chunk) => {
+      processText(chunk.toString());
+    };
+    const onEnd = () => fail(new Error("Secret input ended before a value was entered."));
+    const onError = (error) => fail(error);
+    inputStream.on("data", onData);
+    inputStream.once("end", onEnd);
+    inputStream.once("error", onError);
+    if (hiddenInputBuffer) {
+      const buffered = hiddenInputBuffer;
+      hiddenInputBuffer = "";
+      processText(buffered);
+    }
+  });
+}
+async function readSecretValue() {
+  const first = await readHiddenLine("Secret value: ");
+  if (!first) throw new Error("Secret value is required.");
+  const second = await readHiddenLine("Confirm secret value: ");
+  if (first !== second) {
+    throw new Error("Secret values did not match.");
+  }
+  return first;
+}
+function trimOneTerminalNewline(value) {
+  return value.endsWith("\r\n") ? value.slice(0, -2) : value.endsWith("\n") ? value.slice(0, -1) : value;
+}
+async function readSecretValueFromOptions(options) {
+  const sources = [
+    options.valueStdin ? "--value-stdin" : null,
+    options.fromEnv ? "--from-env" : null,
+    options.fromFile ? "--from-file" : null
+  ].filter((source) => Boolean(source));
+  if (sources.length > 1) {
+    throw new Error(
+      "Use exactly one secret source: --value-stdin, --from-env, or --from-file."
+    );
+  }
+  if (sources.length === 0) return readSecretValue();
+  let value;
+  if (options.valueStdin) {
+    if (_process.stdin.isTTY) {
+      throw new Error(
+        "--value-stdin requires piped stdin. Omit it to use the hidden interactive prompt."
+      );
+    }
+    const chunks = [];
+    for await (const chunk of _process.stdin) {
+      chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    }
+    value = trimOneTerminalNewline(Buffer.concat(chunks).toString("utf8"));
+  } else if (options.fromEnv) {
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(options.fromEnv)) {
+      throw new Error("--from-env must name a valid environment variable.");
+    }
+    const envValue = process.env[options.fromEnv];
+    if (envValue === void 0) {
+      throw new Error(`Environment variable ${options.fromEnv} is not set.`);
+    }
+    value = envValue;
+  } else {
+    value = trimOneTerminalNewline(await _promises.readFile.call(void 0, options.fromFile, "utf8"));
+  }
+  if (!value) throw new Error("Secret value is required.");
+  return value;
+}
+function preventShellHistoryLeak(forbidden) {
+  if (forbidden.length > 0) {
+    throw new Error(
+      "Do not pass secret values as command arguments. Run `deepline secrets set NAME` and enter the value at the hidden prompt."
+    );
+  }
+}
+async function handleList(options) {
+  const client = new (0, _chunk2C3AVPTYjs.DeeplineClient)();
+  const secrets = await client.listSecrets();
+  _chunk7D6QG5KFjs.printCommandEnvelope.call(void 0, 
+    {
+      secrets,
+      count: secrets.length,
+      render: {
+        sections: [
+          {
+            title: "secrets",
+            lines: secrets.length ? secrets.map(renderSecret) : ["No play secrets are configured."]
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+async function handleCheck(nameInput, options) {
+  const name = normalizeSecretName(nameInput);
+  const client = new (0, _chunk2C3AVPTYjs.DeeplineClient)();
+  const playName = options.play === void 0 ? void 0 : normalizePlaySelector(options.play);
+  const check = playName !== void 0 ? await client.inspectSecret(name, { playName }) : null;
+  const secret = check ? check.secret : await client.checkSecret(name);
+  const ok = check ? check.ok : Boolean(secret);
+  const quotedPlay = `'${(_nullishCoalesce(options.play, () => ( "PLAY"))).replace(/'/g, `'"'"'`)}'`;
+  const scopeHint = check ? _optionalChain([secret, 'optionalAccess', _3 => _3.scope]) === "play" ? check.reason === "disabled" ? `The Play-scoped secret is disabled and no active org fallback is available. Restore it with: deepline secrets set ${name} --scope play --play ${quotedPlay}` : `The active Play-scoped secret takes precedence over the org secret.${ok ? "" : ` Restore it with: deepline secrets set ${name} --scope play --play ${quotedPlay}`}` : `No Play override.${ok ? " The org secret is available." : ` Set or rotate the org secret with: deepline secrets set ${name}`}` : `Metadata only. Verify effective scope and active version with: deepline secrets check ${name} --play <play-name>`;
+  _chunk7D6QG5KFjs.printCommandEnvelope.call(void 0, 
+    {
+      ok,
+      name,
+      secret: _nullishCoalesce(secret, () => ( null)),
+      check: check ? { playName: check.playName, reason: check.reason } : null,
+      scopeHint,
+      render: {
+        sections: [
+          {
+            title: "secret check",
+            lines: [
+              check ? `${name}: ${check.reason} for ${check.playName}${secret ? ` (${secret.scope})` : ""}` : secret ? `${name}: active metadata \u2014 ${renderSecret(secret)}` : `${name}: missing, disabled, or empty`,
+              scopeHint
+            ]
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+  if (!ok) process.exitCode = 4;
+}
+async function handleSet(nameInput, forbidden, options) {
+  preventShellHistoryLeak(forbidden);
+  const name = normalizeSecretName(nameInput);
+  const { scope, playName } = resolveSecretWriteScope(options);
+  const value = await readSecretValueFromOptions(options);
+  const { http } = _chunk7D6QG5KFjs.getAuthedHttpClient.call(void 0, );
+  const response = await http.post(
+    "/api/v2/secrets",
+    {
+      name,
+      value,
+      scope,
+      ...playName ? { playName } : {},
+      ...options.note !== void 0 ? { note: options.note } : {}
+    }
+  );
+  const secret = response.secret;
+  _chunk7D6QG5KFjs.printCommandEnvelope.call(void 0, 
+    {
+      ok: true,
+      secret,
+      render: {
+        sections: [
+          {
+            title: "secret saved",
+            lines: [
+              `${secret.name}: saved (${secret.scope}); secret value was not displayed.`,
+              renderSecret(secret)
+            ]
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+async function handleNote(secretId, noteInput, options) {
+  if (options.clear && noteInput !== void 0) {
+    throw new Error("Pass either a note or --clear, not both.");
+  }
+  if (!options.clear && noteInput === void 0) {
+    throw new Error("Provide a note or use --clear.");
+  }
+  const note = options.clear ? "" : noteInput;
+  if (options.dryRun) {
+    _chunk7D6QG5KFjs.printCommandEnvelope.call(void 0, 
+      {
+        ok: true,
+        dryRun: true,
+        secretId,
+        note,
+        render: {
+          sections: [
+            {
+              title: "secret note",
+              lines: [
+                options.clear ? `Would clear the note on secret ${secretId}.` : `Would save a note on secret ${secretId}.`
+              ]
+            }
+          ]
+        }
+      },
+      { json: options.json }
+    );
+    return;
+  }
+  const client = new (0, _chunk2C3AVPTYjs.DeeplineClient)();
+  const secret = await client.updateSecretNote(secretId, note);
+  _chunk7D6QG5KFjs.printCommandEnvelope.call(void 0, 
+    {
+      ok: true,
+      secret,
+      render: {
+        sections: [
+          {
+            title: "secret note saved",
+            lines: [
+              secret.note ? `${secret.name}: note saved.` : `${secret.name}: note cleared.`,
+              renderSecret(secret)
+            ]
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
+function registerSecretsCommands(program) {
+  const secrets = program.command("secrets").description("Manage play secrets without revealing values.").addHelpText(
+    "after",
+    `
+Notes:
+  Secret values are never accepted as command arguments. Use the hidden prompt,
+  or one explicit non-argv source: --value-stdin, --from-env NAME, or
+  --from-file PATH. Values are never printed. secrets list shows only metadata,
+  including any note you intentionally added. Supplying --play implies
+  --scope play; --play expects the bare Play name in the current workspace.
+
+Examples:
+  deepline secrets list
+  deepline secrets check HUBSPOT_TOKEN
+  deepline secrets check HUBSPOT_TOKEN --play hubspot-sync
+  deepline secrets set HUBSPOT_TOKEN
+  printf %s "$HUBSPOT_TOKEN" | deepline secrets set HUBSPOT_TOKEN --value-stdin
+  deepline secrets set HUBSPOT_TOKEN --from-env HUBSPOT_TOKEN
+  deepline secrets set HUBSPOT_TOKEN --from-file ./hubspot-token.txt
+  deepline secrets set HUBSPOT_TOKEN --note "Chrome extension \u2014 Avery"
+  deepline secrets note <secret-id> "Chrome extension \u2014 Avery"
+  deepline secrets note <secret-id> --clear
+`
+  );
+  secrets.command("list").description("List secret metadata only.").option("--json", "Emit JSON output").action(async (options) => {
+    await handleList(options);
+  });
+  secrets.command("check").description(
+    "Check secret metadata, or effective availability with --play."
+  ).argument("<name>", "Secret name").option(
+    "--play <name>",
+    "Validate the effective secret for a bare Play name and active version"
+  ).option("--json", "Emit JSON output").action(async (name, options) => {
+    await handleCheck(name, options);
+  });
+  secrets.command("set").description("Set or rotate a secret without exposing its value in argv.").argument("<name>", "Secret name").argument("[forbidden...]", "Do not pass secret values here").option("--json", "Emit JSON output").option("--scope <scope>", "Secret scope: org or play; --play implies play").option("--play <name>", "Play name for play-scoped secrets").option(
+    "--note <note>",
+    "Optional non-sensitive memo (maximum 500 characters)"
+  ).option("--value-stdin", "Read the value from piped stdin").option("--from-env <name>", "Read the value from an environment variable").option("--from-file <path>", "Read the value from a file").action(
+    async (name, forbidden, options) => {
+      await handleSet(name, _nullishCoalesce(forbidden, () => ( [])), options);
+    }
+  );
+  secrets.command("note").description("Add, replace, or clear a non-sensitive note on one secret.").argument("<secret-id>", "Secret ID from `deepline secrets list --json`").argument("[note]", "Note text (maximum 500 characters)").option("--clear", "Clear the existing note").option("--dry-run", "Show the note change without saving it").option("--json", "Emit JSON output").action(
+    async (secretId, note, options) => {
+      await handleNote(secretId, note, options);
+    }
+  );
+}
+
+
+
+
+
+
+
+
+
+exports.normalizePlaySelector = normalizePlaySelector; exports.normalizeSecretName = normalizeSecretName; exports.preventShellHistoryLeak = preventShellHistoryLeak; exports.readHiddenLine = readHiddenLine; exports.readSecretValueFromOptions = readSecretValueFromOptions; exports.registerSecretsCommands = registerSecretsCommands; exports.resolveSecretWriteScope = resolveSecretWriteScope; exports.trimOneTerminalNewline = trimOneTerminalNewline;

package/dist/cli/sessions-CMKXCN5Y.js

@@ -0,0 +1,15 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+var _chunkAQRTLPHZjs = require('./chunk-AQRTLPHZ.js');
+require('./chunk-7D6QG5KF.js');
+require('./chunk-6HPEDBSJ.js');
+require('./chunk-XNYIZMNQ.js');
+require('./chunk-LIKFCE7Z.js');
+require('./chunk-7P5AA3SN.js');
+require('./chunk-OG64RBAC.js');
+require('./chunk-COGTRVWW.js');
+
+
+
+exports.registerSessionSendRenderCommands = _chunkAQRTLPHZjs.registerSessionSendRenderCommands; exports.registerSessionsCommands = _chunkAQRTLPHZjs.registerSessionsCommands;

package/dist/cli/sessions-ZIFGDZE7.mjs

@@ -0,0 +1,15 @@
+import {
+  registerSessionSendRenderCommands,
+  registerSessionsCommands
+} from "./chunk-RCUE5C5C.mjs";
+import "./chunk-NTEZFZLE.mjs";
+import "./chunk-NPPJX3BL.mjs";
+import "./chunk-DLIRSHV6.mjs";
+import "./chunk-QSIO4TX2.mjs";
+import "./chunk-NXGCO4JB.mjs";
+import "./chunk-WZYKRD7T.mjs";
+import "./chunk-KRD6H754.mjs";
+export {
+  registerSessionSendRenderCommands,
+  registerSessionsCommands
+};