deepline 0.3.87 → 0.3.88

package/dist/bundling-sources/shared_libs/monitors/tracking-provider-guidance.ts

@@ -1,73 +0,0 @@
-import type { ProviderMonitorPostDeployGuidance } from '@deepline/monitors/provider-monitor-capability';
-
-// Client-safe provider setup metadata. Provider monitor definitions reference
-// these exact objects, while the integrations dialog reads them directly.
-export const VECTOR_POST_DEPLOY_GUIDANCE = {
-  title: 'Connect Vector to this monitor',
-  steps: [
-    'In Vector, open the segment named in this monitor setup.',
-    'Add a webhook endpoint using {{callback_url}}, then select contact.visited.',
-    'Enable the webhook action on the segment and send a Vector test event.',
-  ],
-  event_type: 'contact.visited',
-  documentation: [
-    {
-      label: 'Vector SiteID action integration guide',
-      url: 'https://learn.vector.co/articles/2260541690-building-an-action-integration-for-siteid',
-    },
-  ],
-  payload_example: {
-    type: 'contact.visited',
-    externalId: 'contact_123',
-    companyDomain: 'example.com',
-  },
-} as const satisfies ProviderMonitorPostDeployGuidance;
-
-export const RB2B_POST_DEPLOY_GUIDANCE = {
-  title: 'Connect RB2B to this monitor',
-  steps: [
-    'In RB2B, open Integrations and choose Webhook.',
-    'Paste {{callback_url}} as the single webhook URL and save.',
-    "Use RB2B's Send a Test Event action to verify the connection.",
-  ],
-  documentation: [
-    {
-      label: 'RB2B webhook setup guide',
-      url: 'https://support.rb2b.com/en/articles/8976614-setup-guide-webhook',
-    },
-  ],
-  payload_example: {
-    'LinkedIn URL': 'https://www.linkedin.com/in/example',
-    Website: 'https://example.com',
-  },
-} as const satisfies ProviderMonitorPostDeployGuidance;
-
-export const SNITCHER_POST_DEPLOY_GUIDANCE = {
-  title: 'Install Deepline Analytics',
-  steps: [
-    'Create the tracker code in Deepline, then paste it in your site’s document head.',
-    'Confirm cookie consent before persistent tracking when your privacy policy requires it.',
-  ],
-  documentation: [
-    {
-      label: 'Deepline Analytics setup guide',
-      url: 'https://docs.snitcher.com/powered-by-snitcher/radar/installation',
-    },
-  ],
-  payload_example: {
-    session_uuid: '00000000-0000-4000-8000-000000000001',
-    start_time: '2026-01-01T00:00:00.000Z',
-    last_activity: '2026-01-01T00:01:00.000Z',
-    engagement_time: 60,
-    user_properties: { $uuid: 'deepline-test-visitor' },
-    events: [
-      { event_name: '$pageview', created_at: '2026-01-01T00:00:00.000Z' },
-    ],
-  },
-} as const satisfies ProviderMonitorPostDeployGuidance;
-
-export const TRACKING_PROVIDER_POST_DEPLOY_GUIDANCE = {
-  vector: VECTOR_POST_DEPLOY_GUIDANCE,
-  rb2b: RB2B_POST_DEPLOY_GUIDANCE,
-  snitcher: SNITCHER_POST_DEPLOY_GUIDANCE,
-} as const;

package/dist/bundling-sources/shared_libs/monitors/tracking-provider-integrations.ts

@@ -1,81 +0,0 @@
-import { TRACKING_PROVIDER_POST_DEPLOY_GUIDANCE } from '@deepline/monitors/tracking-provider-guidance';
-import {
-  ANALYTICS_INTEGRATION_SLUG,
-  ANALYTICS_PUBLIC_TOOL,
-} from '@/lib/analytics/public';
-
-export const TRACKING_PROVIDER_INTEGRATIONS = {
-  vector: {
-    provider: 'vector',
-    displayName: 'Vector',
-    tool: 'vector.visitor_events',
-    monitorKey: 'vector-high-intent-visitors',
-  },
-  rb2b: {
-    provider: 'rb2b',
-    displayName: 'RB2B',
-    tool: 'rb2b.visitor_events',
-    monitorKey: 'rb2b-website-visitors',
-  },
-  [ANALYTICS_INTEGRATION_SLUG]: {
-    provider: 'snitcher',
-    displayName: 'Deepline Analytics',
-    // Used only by the server-side monitor adapter to resolve upstream wiring.
-    tool: 'snitcher.website_sessions',
-    publicTool: ANALYTICS_PUBLIC_TOOL,
-    monitorKey: 'snitcher-website-sessions',
-  },
-} as const;
-
-export type TrackingProviderIntegration =
-  (typeof TRACKING_PROVIDER_INTEGRATIONS)[keyof typeof TRACKING_PROVIDER_INTEGRATIONS] & {
-    docsUrl: string;
-    docsLabel: string;
-  };
-
-export function getTrackingProviderIntegration(
-  provider: string,
-): TrackingProviderIntegration | null {
-  const integration =
-    TRACKING_PROVIDER_INTEGRATIONS[
-      provider as keyof typeof TRACKING_PROVIDER_INTEGRATIONS
-    ];
-  if (!integration) return null;
-  const docs =
-    TRACKING_PROVIDER_POST_DEPLOY_GUIDANCE[
-      integration.provider as keyof typeof TRACKING_PROVIDER_POST_DEPLOY_GUIDANCE
-    ]?.documentation[0];
-  if (!docs) return null;
-  return { ...integration, docsUrl: docs.url, docsLabel: docs.label };
-}
-
-export function trackingProviderWebhookSetup(
-  provider: string,
-  webhookEndpoint: string,
-): {
-  webhook_endpoint: string;
-  event_type?: 'contact.visited';
-  instructions: string[];
-} | null {
-  const integration = getTrackingProviderIntegration(
-    provider === 'snitcher' ? ANALYTICS_INTEGRATION_SLUG : provider,
-  );
-  const guidance = integration
-    ? TRACKING_PROVIDER_POST_DEPLOY_GUIDANCE[
-        integration.provider as keyof typeof TRACKING_PROVIDER_POST_DEPLOY_GUIDANCE
-      ]
-    : null;
-  if (!guidance) return null;
-  return {
-    webhook_endpoint: webhookEndpoint,
-    ...('event_type' in guidance && guidance.event_type === 'contact.visited'
-      ? { event_type: guidance.event_type }
-      : {}),
-    // The dialog shows the URL in a dedicated copy target, so retain its
-    // compact `webhook_endpoint` wording while deriving every step from the
-    // same metadata used by CLI/API guidance.
-    instructions: guidance.steps.map((step) =>
-      step.replaceAll('{{callback_url}}', 'webhook_endpoint'),
-    ),
-  };
-}

package/dist/bundling-sources/shared_libs/monitors/tsconfig.json

@@ -1,10 +0,0 @@
-{
-  "extends": "../../tsconfig.json",
-  "compilerOptions": {
-    "incremental": false,
-    "noEmit": true,
-    "types": ["node"]
-  },
-  "include": ["./**/*.ts"],
-  "exclude": ["node_modules"]
-}

package/dist/bundling-sources/shared_libs/security/header-safe-env.ts

@@ -1,28 +0,0 @@
-/**
- * Guards for env-derived secrets that are sent as HTTP header values.
- *
- * fetch() validates header values and may echo invalid raw values in its
- * error. Validate secrets before constructing headers so failures identify
- * the environment variable without leaking its contents.
- */
-
-const HEADER_UNSAFE_CHAR_PATTERN = /[^\t\u0020-\u007e\u0080-\u00ff]/;
-
-export function isHeaderSafeValue(value: string): boolean {
-  return !HEADER_UNSAFE_CHAR_PATTERN.test(value);
-}
-
-export function assertHeaderSafeEnvValue(input: {
-  envVar: string;
-  value: string;
-}): string {
-  if (!isHeaderSafeValue(input.value)) {
-    throw new Error(
-      `Environment variable ${input.envVar} contains a character that is invalid in an HTTP header value ` +
-        `(typically an embedded newline from a multi-line paste). ` +
-        `Re-set ${input.envVar} as a single-line value. ` +
-        `The raw value is not echoed to avoid leaking a secret.`,
-    );
-  }
-  return input.value;
-}

package/dist/bundling-sources/shared_libs/security/secret-redaction.ts

@@ -1,267 +0,0 @@
-const REDACTED_VALUE = '[REDACTED]';
-
-type SecretRedactionOptions = {
-  redactHighEntropy?: boolean;
-};
-
-const SENSITIVE_KEY_PATTERNS = [
-  /^api[-_]?key$/i,
-  /^x[-_]?api[-_]?key$/i,
-  /secret/i,
-  /token/i,
-  /password/i,
-  /authorization/i,
-  /cookie/i,
-  /credential/i,
-  /private/i,
-];
-
-const SAFE_IDENTIFIER_KEYS = new Set([
-  'artifactHash',
-  'artifactHashes',
-  'artifact_hash',
-  'artifact_hashes',
-  'graphHash',
-  'graph_hash',
-  'hash',
-  'idempotencyKey',
-  'idempotency_key',
-  'key',
-  'session',
-  'sessionId',
-  'session_id',
-  'sessionIds',
-  'session_ids',
-  'promptId',
-  'prompt_id',
-  'requestId',
-  'request_id',
-  'upload_id',
-  // Durable-call runtime identity fields. These are non-secret
-  // `ctx:<org>:call:tool:<tool>:<hash>` receipt/idempotency keys (and their
-  // `:force:<lease>` / `:ordered:<hash>` variants) surfaced on tool-result
-  // `_metadata.execution` and echoed provider idempotency metadata.
-  // Explicit-secret patterns below still redact real secrets that ever appear
-  // under these keys.
-  'receiptKey',
-  'receipt_key',
-  'attachedToReceiptKey',
-  'attached_to_receipt_key',
-  'durableCallReceiptKey',
-  'durable_call_receipt_key',
-  'providerIdempotencyKey',
-  'provider_idempotency_key',
-  'cacheKey',
-  'cache_key',
-  // Non-secret run-output identifiers.
-  'targetTable',
-  'target_table',
-  'tableNamespace',
-  'table_namespace',
-  'queryId',
-  'query_id',
-  'queryIds',
-  'query_ids',
-  'snowflakeQueryId',
-  'snowflake_query_id',
-  'snowflakeQueryIds',
-  'snowflake_query_ids',
-]);
-
-const EXPLICIT_SECRET_VALUE_PATTERNS = [
-  /\bnapi_[a-z0-9]{20,}\b/i,
-  /\bgh[opsu]_[A-Za-z0-9_]{20,}\b/,
-  /\bwhsec_[a-z0-9]+\b/i,
-  /\bsk-proj-[A-Za-z0-9_-]{20,}\b/,
-  /\bxox[baprs]-[A-Za-z0-9-]{20,}\b/i,
-  /\b(sk|rk)_(live|test)_[a-z0-9]+\b/i,
-  /\bpostgres(?:ql)?:\/\/[^\s'"]+/i,
-  /\bhttps?:\/\/[^/\s'"]+:[^@\s'"]+@[^/\s'"]+/i,
-];
-
-const HIGH_ENTROPY_VALUE_PATTERN = /\b[A-Za-z0-9+/=_-]{32,}\b/g;
-// A public hostname can legitimately contain a generated label longer than the
-// high-entropy threshold (for example, a per-run probe hostname). Preserve the
-// complete hostname after known secret formats have already been checked.
-const PUBLIC_DNS_NAME_PATTERN =
-  /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}\.?$/i;
-const SENSITIVE_URL_PARAM_KEY_PATTERN =
-  /(?:api[-_]?key|x[-_]?api[-_]?key|token|access[-_]?token|refresh[-_]?token|secret|password|authorization|credential|signature|sig)/i;
-const BEARER_SECRET_PATTERN = /\b(Bearer)\s+[A-Za-z0-9._~+/=-]{8,}/gi;
-const ASSIGNMENT_SECRET_PATTERN =
-  /\b(access[-_]?token|refresh[-_]?token|token|x[-_\s]?api[-_\s]?key|api[-_\s]?key|apikey|password|secret|session)\b(\s*[:=]\s*)[^\s'",;)}\]]+/gi;
-const AUTH_ASSIGNMENT_SECRET_PATTERN =
-  /\b(auth(?:orization)?)\b(\s*[:=]\s*)(?!Bearer\b)(?:[A-Za-z]+\s+)?[^\s'",;)}\]]+/gi;
-const SENSITIVE_URL_PARAM_VALUE_PATTERN =
-  /([?&#](?:api[-_]?key|x[-_]?api[-_]?key|token|access[-_]?token|refresh[-_]?token|secret|password|authorization|credential|signature|sig)=)[^&#\s'"]+/gi;
-
-function inspectStandalonePublicHttpUrl(
-  value: string,
-): 'safe' | 'sensitive' | null {
-  const trimmed = value.trim();
-  if (!trimmed || /\s/.test(trimmed)) {
-    return null;
-  }
-
-  let url: URL;
-  try {
-    url = new URL(trimmed);
-  } catch {
-    return null;
-  }
-
-  if (url.protocol !== 'http:' && url.protocol !== 'https:') {
-    return null;
-  }
-  if (url.username || url.password) {
-    return 'sensitive';
-  }
-
-  for (const key of url.searchParams.keys()) {
-    if (SENSITIVE_URL_PARAM_KEY_PATTERN.test(key)) {
-      return 'sensitive';
-    }
-  }
-  if (url.hash && SENSITIVE_URL_PARAM_KEY_PATTERN.test(url.hash)) {
-    return 'sensitive';
-  }
-  return 'safe';
-}
-
-function shouldRedactKey(key: string) {
-  if (SAFE_IDENTIFIER_KEYS.has(key)) {
-    return false;
-  }
-  return SENSITIVE_KEY_PATTERNS.some((pattern) => pattern.test(key));
-}
-
-function maybeRedactString(value: string, options: SecretRedactionOptions) {
-  if (EXPLICIT_SECRET_VALUE_PATTERNS.some((pattern) => pattern.test(value))) {
-    return REDACTED_VALUE;
-  }
-  const publicHttpUrl = inspectStandalonePublicHttpUrl(value);
-  if (publicHttpUrl === 'sensitive') {
-    return REDACTED_VALUE;
-  }
-  if (publicHttpUrl === 'safe') {
-    return value;
-  }
-  if (PUBLIC_DNS_NAME_PATTERN.test(value.trim())) {
-    return value;
-  }
-  const redacted = value
-    .replace(BEARER_SECRET_PATTERN, `$1 ${REDACTED_VALUE}`)
-    .replace(AUTH_ASSIGNMENT_SECRET_PATTERN, `$1$2${REDACTED_VALUE}`)
-    .replace(ASSIGNMENT_SECRET_PATTERN, `$1$2${REDACTED_VALUE}`)
-    .replace(SENSITIVE_URL_PARAM_VALUE_PATTERN, `$1${REDACTED_VALUE}`);
-  return options.redactHighEntropy === false
-    ? redacted
-    : redacted.replace(HIGH_ENTROPY_VALUE_PATTERN, REDACTED_VALUE);
-}
-
-export function redactSecretsInValue<T>(
-  value: T,
-  parentKey?: string,
-  options: SecretRedactionOptions = {},
-): T {
-  if (typeof value === 'string') {
-    if (EXPLICIT_SECRET_VALUE_PATTERNS.some((pattern) => pattern.test(value))) {
-      return REDACTED_VALUE as T;
-    }
-    if (parentKey && SAFE_IDENTIFIER_KEYS.has(parentKey)) {
-      return value as T;
-    }
-    if (parentKey && shouldRedactKey(parentKey)) {
-      return REDACTED_VALUE as T;
-    }
-    return maybeRedactString(value, options) as T;
-  }
-
-  if (!value || typeof value !== 'object') return value;
-
-  type Container = unknown[] | Record<string, unknown>;
-  const root: Container = Array.isArray(value) ? [] : {};
-  const pending: Array<{
-    source: Container;
-    target: Container;
-    parentKey?: string;
-  }> = [{ source: value as Container, target: root, parentKey }];
-
-  const redactNestedValue = (
-    item: unknown,
-    itemParentKey: string | undefined,
-  ): unknown => {
-    if (typeof item !== 'string') return item;
-    if (EXPLICIT_SECRET_VALUE_PATTERNS.some((pattern) => pattern.test(item))) {
-      return REDACTED_VALUE;
-    }
-    if (itemParentKey && SAFE_IDENTIFIER_KEYS.has(itemParentKey)) return item;
-    if (itemParentKey && shouldRedactKey(itemParentKey)) return REDACTED_VALUE;
-    return maybeRedactString(item, options);
-  };
-
-  while (pending.length > 0) {
-    const current = pending.pop();
-    if (!current) break;
-    const sourceIsArray = Array.isArray(current.source);
-    for (const [key, item] of Object.entries(current.source)) {
-      const itemParentKey = sourceIsArray ? current.parentKey : key;
-      if (!sourceIsArray && shouldRedactKey(key)) {
-        (current.target as Record<string, unknown>)[key] = REDACTED_VALUE;
-        continue;
-      }
-      if (item && typeof item === 'object') {
-        const nestedTarget: Container = Array.isArray(item) ? [] : {};
-        (current.target as Record<string, unknown>)[key] = nestedTarget;
-        pending.push({
-          source: item as Container,
-          target: nestedTarget,
-          parentKey: itemParentKey,
-        });
-        continue;
-      }
-      (current.target as Record<string, unknown>)[key] = redactNestedValue(
-        item,
-        itemParentKey,
-      );
-    }
-  }
-
-  return root as T;
-}
-
-/**
- * Redaction for customer-authored inputs and outputs. Preserve arbitrary
- * identifiers while still removing explicit credential formats, sensitive
- * keys, authorization values, and credential-bearing URLs.
- */
-export function redactSecretsInCustomerValue<T>(
-  value: T,
-  parentKey?: string,
-): T {
-  return redactSecretsInValue(value, parentKey, { redactHighEntropy: false });
-}
-
-export function redactSecretsInJsonText(
-  text: string,
-  options: SecretRedactionOptions = {},
-) {
-  try {
-    const parsed = JSON.parse(text) as unknown;
-    return JSON.stringify(
-      redactSecretsInValue(parsed, undefined, options),
-      null,
-      2,
-    );
-  } catch {
-    let redacted = text;
-    for (const pattern of EXPLICIT_SECRET_VALUE_PATTERNS) {
-      redacted = redacted.replace(pattern, REDACTED_VALUE);
-    }
-    return maybeRedactString(redacted, options);
-  }
-}
-
-export function redactSecretsInCustomerJsonText(text: string) {
-  return redactSecretsInJsonText(text, { redactHighEntropy: false });
-}