deepline 0.3.6 → 0.3.8

package/dist/plays/bundle-play-file.mjs

@@ -2670,7 +2670,7 @@ __export(type_exports2, {
 var Type = type_exports2;
 
 // ../shared_libs/plays/authoring-contract.ts
-var PLAY_AUTHORING_CONTRACT_EDITION = 3;
+var PLAY_AUTHORING_CONTRACT_EDITION = 4;
 var PLAY_SQL_LISTENER_WHERE_OPERATORS = [
   "eq",
   "neq",
@@ -3941,8 +3941,11 @@ var PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   `  secrets?: readonly ${cloudReferenceType("bindings.secrets[]")}[];`,
   "};",
   "declare const SECRET_HANDLE_BRAND: unique symbol;",
+  "declare const SECRET_PROMISE_BRAND: unique symbol;",
   "export type SecretHandle = { readonly [SECRET_HANDLE_BRAND]: never; readonly name: string; toString(): string; toJSON(): never };",
-  "export type SecretAuth = { readonly kind: 'bearer' | 'header'; readonly secret: SecretHandle; readonly header?: string };",
+  "export type SecretPromise = Promise<string> & { readonly [SECRET_PROMISE_BRAND]: never };",
+  "export type SecretValue = SecretHandle;",
+  "export type SecretAuth = { readonly kind: 'bearer' | 'header'; readonly secret: string | SecretPromise | SecretHandle; readonly header?: string };",
   "export type SecretAuthInput = SecretAuth | readonly SecretAuth[];",
   "export type PlayInputContract<TInput> = { readonly schema: Record<string, unknown>; readonly __inputType?: TInput };",
   "export type PlayReturnObject = Record<string, unknown> & { readonly _metadata?: never };",
@@ -3993,7 +3996,7 @@ var PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   `  tool<K extends string>(key: ${cloudReferenceType("ctx.tool.key")}, toolId: K, input: ${cloudReferenceType("ctx.tool.input")}, options?: { description?: ${cloudReferenceType("ctx.tool.options.description")} }): Promise<ToolExecutionOutput<K>>;`,
   "  step<T>(id: string, run: () => T | Promise<T>, options?: RuntimeStepOptions): Promise<T>;",
   "  fetch(key: string, url: string | URL, init?: RequestInit & { headers?: HeadersInit & { 'Idempotency-Key'?: string; 'X-Idempotency-Key'?: string }; auth?: SecretAuthInput }, options?: FetchOptions): Promise<PlayFetchResponse>;",
-  "  secrets: { get(name: string): SecretHandle; bearer(secret: SecretHandle): SecretAuth; header(header: string, secret: SecretHandle): SecretAuth };",
+  "  secrets: { get(name: string): SecretPromise; bearer(secret: string | SecretPromise | SecretHandle): SecretAuth; header(header: string, secret: string | SecretPromise | SecretHandle): SecretAuth };",
   `  runPlay<TOutput = unknown>(key: string, playRef: ${cloudReferenceType("ctx.runPlay.playRef")}, input: ${cloudReferenceType("ctx.runPlay.input")}, options: PlayCallOptions): Promise<TOutput>;`,
   "  log(message: string): void;",
   `  sleep(ms: ${cloudReferenceType("ctx.sleep.ms")}): Promise<void>;`,
@@ -4192,11 +4195,9 @@ var PLAY_DOCFLOW_ARMS = [
   "else"
 ];
 var FLOW_START = /^\s*(?:flowchart|graph)\s+(LR|RL|TB|TD|BT)\s*$/i;
-var PUT = /^\s*\/\/\s*put\s+(.+)$/;
 var MERMAID_NODE = /^\s*\/\/\s*@mermaid-node\s+([A-Za-z][\w-]*)(?:\s+(.*))?$/;
 var ATTRIBUTE = /([A-Za-z][\w-]*)\s*:\s*"([^"\n]*)"/y;
 var MERMAID_NODE_ATTRIBUTES = ["label", "type", "in", "out", "arm"];
-var LEGACY_DOCFLOW_ATTRIBUTES = ["id", ...MERMAID_NODE_ATTRIBUTES];
 var MERMAID_NODE_ID = /^[A-Za-z][\w-]*/;
 var SKETCH_CLASS = /^\s*class\s+([A-Za-z][\w-]*(?:\s*,\s*[A-Za-z][\w-]*)*)\s+sketch\s*;?\s*$/;
 var MERMAID_NODE_SHAPES = [
@@ -4216,7 +4217,6 @@ var MERMAID_NODE_SHAPES = [
 ];
 var SUBGRAPH_OPEN = /^\s*subgraph\s+([A-Za-z][\w-]*)\s*(?:\[(.*)\])?\s*$/i;
 var SUBGRAPH_END = /^\s*end\s*$/i;
-var DOCFLOW_EDGE_CONNECTOR = /^\s*-->(?:\|([^|]+)\|)?/;
 var MERMAID_EDGE_CONNECTOR = /^\s*(?:-->|-\.->|==>|---)(?:\|([^|]+)\|)?/;
 var DOCFLOW_PATH = /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*$/;
 var IDENTIFIER = /[A-Za-z_$][\w$]*/g;
@@ -4235,9 +4235,9 @@ var JS_WORDS = /* @__PURE__ */ new Set([
   "undefined",
   "var"
 ]);
-function parseAttributes(source, input) {
+function parseAttributes(source, line, errors) {
   const attributes = {};
-  const validAttributes = input.annotation === "@mermaid-node" ? MERMAID_NODE_ATTRIBUTES : LEGACY_DOCFLOW_ATTRIBUTES;
+  const validAttributes = MERMAID_NODE_ATTRIBUTES;
   let cursor = 0;
   while (cursor < source.length) {
     cursor += /^\s*/.exec(source.slice(cursor))?.[0].length ?? 0;
@@ -4246,21 +4246,21 @@ function parseAttributes(source, input) {
     const match = ATTRIBUTE.exec(source);
     if (!match) {
       const fragment = source.slice(cursor).split(/\s+/)[0] ?? source.slice(cursor);
-      input.errors.push(
-        `Docflow annotation on line ${input.line} has malformed attribute ${JSON.stringify(fragment)}. Use key:"value" pairs. Valid attributes: ${validAttributes.map((name2) => `"${name2}"`).join(", ")}.`
+      errors.push(
+        `Docflow \`// @mermaid-node\` annotation on line ${line} has malformed attribute ${JSON.stringify(fragment)}. Use key:"value" pairs. Valid attributes: ${validAttributes.map((name2) => `"${name2}"`).join(", ")}.`
       );
       return null;
     }
     const name = match[1];
     if (!validAttributes.includes(name)) {
-      input.errors.push(
-        `Docflow annotation on line ${input.line} has unknown attribute "${name}". Valid attributes: ${validAttributes.map((option) => `"${option}"`).join(", ")}.`
+      errors.push(
+        `Docflow \`// @mermaid-node\` annotation on line ${line} has unknown attribute "${name}". Valid attributes: ${validAttributes.map((option) => `"${option}"`).join(", ")}.`
       );
       return null;
     }
     if (Object.prototype.hasOwnProperty.call(attributes, name)) {
-      input.errors.push(
-        `Docflow annotation on line ${input.line} repeats attribute "${name}". Write each attribute once.`
+      errors.push(
+        `Docflow \`// @mermaid-node\` annotation on line ${line} repeats attribute "${name}". Write each attribute once.`
       );
       return null;
     }
@@ -4349,7 +4349,7 @@ function parseShapedMermaidNodes(fragment) {
   }
   return nodes;
 }
-function parseEdgeChain(line, syntax) {
+function parseEdgeChain(line) {
   let remaining = line;
   const first = parseMermaidNodeAtStart(remaining);
   if (!first) return null;
@@ -4357,7 +4357,7 @@ function parseEdgeChain(line, syntax) {
   const labels = [];
   remaining = remaining.slice(first.length);
   while (remaining.trim()) {
-    const connector = (syntax === "mermaid" ? MERMAID_EDGE_CONNECTOR : DOCFLOW_EDGE_CONNECTOR).exec(remaining);
+    const connector = MERMAID_EDGE_CONNECTOR.exec(remaining);
     if (!connector) return null;
     remaining = remaining.slice(connector[0].length);
     const next = parseMermaidNodeAtStart(remaining);
@@ -4423,7 +4423,6 @@ function inferBindingIo(statement) {
   };
 }
 var MERMAID_BLOCK = /\/\*\*\s*@mermaid(?:\s|\r?\n)([\s\S]*?)\*\//g;
-var LEGACY_BLOCK = /\/\*\*\s*@docflow(?:\s|\r?\n)([\s\S]*?)\*\//;
 var BLOCK_EXPORT_HEADER = /^[A-Za-z_$][\w$-]*$/;
 function cleanBlockBody(raw) {
   return raw.split(/\r?\n/).map((line) => /^\s*\*/.test(line) ? line.replace(/^\s*\* ?/, "") : line).join("\n").trim();
@@ -4440,10 +4439,9 @@ function splitBlockExportHeader(body) {
   };
 }
 function blockLabel(block) {
-  const tag = block.syntax === "mermaid" ? "@mermaid" : "@docflow";
-  return block.authoredExportName ? `${tag} ${block.authoredExportName}` : tag;
+  return block.authoredExportName ? `@mermaid ${block.authoredExportName}` : "@mermaid";
 }
-function parseDocflowBlockGraph(mermaidSource, syntax, errors) {
+function parseDocflowBlockGraph(mermaidSource, errors) {
   const docLines = mermaidSource.split(/\r?\n/).filter((line) => line.trim() && !line.trim().startsWith("%%"));
   const direction = FLOW_START.exec(docLines[0] ?? "")?.[1]?.toUpperCase();
   if (!direction) {
@@ -4459,11 +4457,9 @@ function parseDocflowBlockGraph(mermaidSource, syntax, errors) {
   const sketchIds = /* @__PURE__ */ new Set();
   const subgraphStack = [];
   const subgraphIds = /* @__PURE__ */ new Set();
-  if (syntax === "mermaid") {
-    for (const line of docLines.slice(1)) {
-      const opened = SUBGRAPH_OPEN.exec(line);
-      if (opened) subgraphIds.add(opened[1]);
-    }
+  for (const line of docLines.slice(1)) {
+    const opened = SUBGRAPH_OPEN.exec(line);
+    if (opened) subgraphIds.add(opened[1]);
   }
   const declaredIds = /* @__PURE__ */ new Set();
   const addNodes = (fragment, line) => {
@@ -4505,34 +4501,32 @@ function parseDocflowBlockGraph(mermaidSource, syntax, errors) {
     return sawDeclaration;
   };
   for (const line of docLines.slice(1)) {
-    if (syntax === "mermaid") {
-      const opened = SUBGRAPH_OPEN.exec(line);
-      if (opened) {
-        const id = opened[1];
-        const rawLabel = opened[2]?.trim() ?? "";
-        const label = rawLabel.length >= 2 && (rawLabel.startsWith('"') && rawLabel.endsWith('"') || rawLabel.startsWith("'") && rawLabel.endsWith("'")) ? rawLabel.slice(1, -1) : rawLabel;
-        const subgraph = {
-          id,
-          label: label || id,
-          memberIds: []
-        };
-        subgraphs.set(id, subgraph);
-        subgraphStack.push(subgraph);
-        continue;
-      }
-      if (SUBGRAPH_END.test(line)) {
-        if (subgraphStack.length === 0) {
-          errors.push(
-            "Docflow has an `end` with no open `subgraph` above it. Every `end` closes exactly one `subgraph`."
-          );
-        }
-        subgraphStack.pop();
-        continue;
+    const opened = SUBGRAPH_OPEN.exec(line);
+    if (opened) {
+      const id = opened[1];
+      const rawLabel = opened[2]?.trim() ?? "";
+      const label = rawLabel.length >= 2 && (rawLabel.startsWith('"') && rawLabel.endsWith('"') || rawLabel.startsWith("'") && rawLabel.endsWith("'")) ? rawLabel.slice(1, -1) : rawLabel;
+      const subgraph = {
+        id,
+        label: label || id,
+        memberIds: []
+      };
+      subgraphs.set(id, subgraph);
+      subgraphStack.push(subgraph);
+      continue;
+    }
+    if (SUBGRAPH_END.test(line)) {
+      if (subgraphStack.length === 0) {
+        errors.push(
+          "Docflow has an `end` with no open `subgraph` above it. Every `end` closes exactly one `subgraph`."
+        );
       }
+      subgraphStack.pop();
+      continue;
     }
     let declaredOnThisLine = false;
     const isDirective = /^\s*(?:direction|classDef|class|style|linkStyle|click)\b/i.test(line);
-    if (syntax === "mermaid" && isDirective) {
+    if (isDirective) {
       const sketch = SKETCH_CLASS.exec(line);
       if (sketch) {
         for (const id of sketch[1].split(",")) {
@@ -4543,21 +4537,19 @@ function parseDocflowBlockGraph(mermaidSource, syntax, errors) {
         ignoredDirectives.push(line.trim());
       }
     }
-    if (syntax === "mermaid" && !isDirective) {
+    if (!isDirective) {
       declaredOnThisLine = addNodes(line, line);
     }
-    const chain = parseEdgeChain(line, syntax);
+    const chain = parseEdgeChain(line);
     if (!chain) {
-      if (syntax === "docflow") {
-        errors.push(`Unsupported docflow line: ${line.trim()}`);
-      } else if (!isDirective && !declaredOnThisLine) {
+      if (!isDirective && !declaredOnThisLine) {
         errors.push(
           `Docflow line is not an edge, a node declaration, or a directive this parser understands: ${line.trim()}`
         );
       }
       continue;
     }
-    if (syntax === "docflow") addNodes(line, line);
+    addNodes(line, line);
     for (const node of chain.nodes) {
       if (subgraphIds.has(node.id)) continue;
       const existing = nodes.get(node.id);
@@ -4616,24 +4608,18 @@ function materializeDocflow(block) {
 }
 function parsePlayDocflowFile(sourceCode) {
   const errors = [];
-  const rejectedNodeIds = /* @__PURE__ */ new Set();
-  const bindings = parseDocflowBindings(sourceCode, errors, rejectedNodeIds);
   const rawBlocks = [];
   MERMAID_BLOCK.lastIndex = 0;
   for (const match of sourceCode.matchAll(MERMAID_BLOCK)) {
     rawBlocks.push({ syntax: "mermaid", body: cleanBlockBody(match[1]) });
   }
-  if (rawBlocks.length === 0) {
-    const legacy = LEGACY_BLOCK.exec(sourceCode);
-    if (legacy) {
-      rawBlocks.push({ syntax: "docflow", body: cleanBlockBody(legacy[1]) });
-    }
-  }
-  if (rawBlocks.length === 0) return { blocks: [], bindings, errors };
+  if (rawBlocks.length === 0) return { blocks: [], bindings: [], errors };
+  const rejectedNodeIds = /* @__PURE__ */ new Set();
+  const bindings = parseDocflowBindings(sourceCode, errors, rejectedNodeIds);
   const parsedBlocks = [];
   for (const raw of rawBlocks) {
     const { exportName, diagram } = splitBlockExportHeader(raw.body);
-    const graph = parseDocflowBlockGraph(diagram, raw.syntax, errors);
+    const graph = parseDocflowBlockGraph(diagram, errors);
     if (!graph) continue;
     parsedBlocks.push({
       ...graph,
@@ -4853,7 +4839,7 @@ function attachBindingsToBlocks(sourceCode, blocks, bindings, errors, rejectedNo
       if (node.sketch || node.kind === "conceptual" || bound.has(node.id) || rejectedNodeIds.has(node.id))
         continue;
       errors.push(
-        block.syntax === "docflow" ? `Docflow node "${node.id}" has no code binding; mark it type:"conceptual" or bind it.` : `Docflow box "${node.id}" in \`${blockLabel(block)}\` points at nothing, so the canvas can only draw it and say nothing about it. Either put \`// @mermaid-node ${node.id}\` above the statement it runs, or \u2014 if this play has no such statement, because the work happens in another module or inside a loop \u2014 add it to a \`class ${node.id} sketch\` line in the block to declare it a sketch.`
+        `Docflow box "${node.id}" in \`${blockLabel(block)}\` points at nothing, so the canvas can only draw it and say nothing about it. Either put \`// @mermaid-node ${node.id}\` above the statement it runs, or \u2014 if this play has no such statement, because the work happens in another module or inside a loop \u2014 add it to a \`class ${node.id} sketch\` line in the block to declare it a sketch.`
       );
     }
   }
@@ -4869,20 +4855,15 @@ function parseDocflowBindings(sourceCode, errors, rejectedNodeIds) {
   const lines = sourceCode.split(/\r?\n/);
   const bindings = [];
   for (let index = 0; index < lines.length; index += 1) {
-    PUT.lastIndex = 0;
     MERMAID_NODE.lastIndex = 0;
-    const legacyMatch = PUT.exec(lines[index]);
-    const mermaidMatch = MERMAID_NODE.exec(lines[index]);
-    if (!legacyMatch && !mermaidMatch) continue;
-    const annotatedId = mermaidMatch?.[1]?.trim();
+    const mermaidMatch = MERMAID_NODE.exec(lines[index]) ?? null;
+    if (!mermaidMatch) continue;
+    const annotatedId = mermaidMatch[1]?.trim();
     if (annotatedId) rejectedNodeIds.add(annotatedId);
     const attributes = parseAttributes(
-      mermaidMatch ? mermaidMatch[2] ?? "" : legacyMatch[1],
-      {
-        line: index + 1,
-        annotation: mermaidMatch ? "@mermaid-node" : "put",
-        errors
-      }
+      mermaidMatch[2] ?? "",
+      index + 1,
+      errors
     );
     if (!attributes) continue;
     const id = (annotatedId ?? attributes.id)?.trim();
@@ -5210,6 +5191,113 @@ var SECRET_ENV_PATTERN = /\bprocess(?:\.env|\[['"]env['"]\])(?:\.|\[['"])([A-Z0-
 var PRIVATE_KEY_PATTERN = /-----BEGIN (?:RSA |EC |OPENSSH |PGP )?PRIVATE KEY-----/;
 var BEARER_LITERAL_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/i;
 var ASSIGNMENT_SECRET_LITERAL_PATTERN = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*['"][^'"]{12,}['"]/i;
+var SECRET_AUTH_LITERAL_FINDING = "literal credential passed to ctx.secrets auth helper";
+function skipQuoted(source, start) {
+  const quote = source[start];
+  let index = start + 1;
+  while (index < source.length) {
+    if (source[index] === "\\") {
+      index += 2;
+    } else if (source[index] === quote) {
+      return index + 1;
+    } else {
+      index += 1;
+    }
+  }
+  return source.length;
+}
+function skipTrivia(source, start) {
+  let index = start;
+  while (index < source.length) {
+    if (/\s/.test(source[index])) {
+      index += 1;
+    } else if (source.startsWith("//", index)) {
+      index = source.indexOf("\n", index + 2);
+      if (index === -1) return source.length;
+    } else if (source.startsWith("/*", index)) {
+      index = source.indexOf("*/", index + 2);
+      if (index === -1) return source.length;
+      index += 2;
+    } else {
+      return index;
+    }
+  }
+  return index;
+}
+function consumeIdentifier(source, start, expected) {
+  return source.startsWith(expected, start) && !/[A-Za-z0-9_$]/.test(source[start - 1] ?? "") && !/[A-Za-z0-9_$]/.test(source[start + expected.length] ?? "") ? start + expected.length : void 0;
+}
+function consumeMember(source, start, expected) {
+  let index = skipTrivia(source, start);
+  if (source[index] === ".") {
+    return consumeIdentifier(source, skipTrivia(source, index + 1), expected);
+  }
+  if (source[index] !== "[") return void 0;
+  index = skipTrivia(source, index + 1);
+  if (source[index] !== "'" && source[index] !== '"') return void 0;
+  const end = skipQuoted(source, index);
+  if (source.slice(index + 1, end - 1) !== expected) return void 0;
+  index = skipTrivia(source, end);
+  return source[index] === "]" ? index + 1 : void 0;
+}
+function skipExpression(source, start) {
+  let index = start;
+  let depth = 0;
+  while (index < source.length) {
+    const char = source[index];
+    if (char === "'" || char === '"' || char === "`") {
+      index = skipQuoted(source, index);
+      continue;
+    }
+    if (source.startsWith("//", index) || source.startsWith("/*", index)) {
+      index = skipTrivia(source, index);
+      continue;
+    }
+    if (char === "(" || char === "[" || char === "{") {
+      depth += 1;
+    } else if (char === ")" || char === "]" || char === "}") {
+      if (depth === 0) return index;
+      depth -= 1;
+    } else if (char === "," && depth === 0) {
+      return index;
+    }
+    index += 1;
+  }
+  return index;
+}
+function isDirectStringLiteral(source, start) {
+  const quote = source[start];
+  if (quote !== "'" && quote !== '"' && quote !== "`") return false;
+  const end = skipQuoted(source, start);
+  return quote !== "`" || !source.slice(start, end).includes("${");
+}
+function hasLiteralSecretAuthCredential(source) {
+  for (let index = 0; index < source.length; index += 1) {
+    const char = source[index];
+    if (char === "'" || char === '"' || char === "`") {
+      index = skipQuoted(source, index) - 1;
+      continue;
+    }
+    if (source.startsWith("//", index) || source.startsWith("/*", index)) {
+      index = skipTrivia(source, index) - 1;
+      continue;
+    }
+    const afterCtx = consumeIdentifier(source, index, "ctx");
+    if (!afterCtx) continue;
+    const afterSecrets = consumeMember(source, afterCtx, "secrets");
+    if (!afterSecrets) continue;
+    const afterHeader = consumeMember(source, afterSecrets, "header");
+    const helper = afterHeader ? "header" : "bearer";
+    const afterHelper = afterHeader ?? consumeMember(source, afterSecrets, "bearer");
+    if (!afterHelper) continue;
+    const afterOpen = skipTrivia(source, afterHelper);
+    if (source[afterOpen] !== "(") continue;
+    const firstArgument = skipTrivia(source, afterOpen + 1);
+    const credential = helper === "header" ? skipTrivia(source, skipExpression(source, firstArgument) + 1) : firstArgument;
+    if (isDirectStringLiteral(source, credential)) return true;
+  }
+  return false;
+}
 function collectInlineSecretFindings(sourceCode) {
   const findings = [];
   for (const match of sourceCode.matchAll(SECRET_ENV_PATTERN)) {
@@ -5221,6 +5309,9 @@ function collectInlineSecretFindings(sourceCode) {
   if (ASSIGNMENT_SECRET_LITERAL_PATTERN.test(sourceCode)) {
     findings.push("secret-looking assignment literal");
   }
+  if (hasLiteralSecretAuthCredential(sourceCode)) {
+    findings.push(SECRET_AUTH_LITERAL_FINDING);
+  }
   return [...new Set(findings)];
 }
 function validatePlaySourceHasNoInlineSecrets(input) {
@@ -5231,7 +5322,7 @@ function validatePlaySourceHasNoInlineSecrets(input) {
       `Play source ${input.filePath} appears to contain inline secret material: ${[
         ...new Set(findings)
       ].join(", ")}.`,
-      'Author secrets in the dashboard and use ctx.secrets.get("NAME") with an approved helper such as ctx.secrets.bearer(handle).'
+      `Author secrets in the dashboard, declare them in the Play's top-level secrets option, and read them at runtime with await ctx.secrets.get("NAME").`
     ].join(" ")
   );
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "description": "GTM data CLI and TypeScript SDK for coding agents",
   "license": "MIT",
   "homepage": "https://code.deepline.com",