@boardwalk-labs/engine 0.1.2 → 0.1.3

package/dist/errors.js

@@ -6,7 +6,7 @@ export const ENGINE_ERROR_CODES = [
     "NOT_FOUND", // unknown workflow/run
     "CONFLICT", // duplicate name, concurrent state conflict
     "SECRET_MISSING", // declared secret has no value in this environment
-    "SECRET_UNDECLARED", // program read a secret not in meta.secrets
+    "SECRET_UNDECLARED", // program read a secret not in permissions.secrets
     "MODEL_UNRESOLVED", // agent() with no model and no configured default
     "PROVIDER_ERROR", // upstream inference provider failure
     "BUDGET_EXCEEDED", // run terminated by budget.*

package/dist/run/supervisor.d.ts

@@ -84,7 +84,7 @@ export declare class RunSupervisor {
     private resolveSecret;
     /**
      * The child's environment: the parent env plus manifest.env with whole-value
-     * `${{ secrets.NAME }}` interpolation resolved (fail-closed against meta.secrets).
+     * `${{ secrets.NAME }}` interpolation resolved (fail-closed against permissions.secrets).
      */
     private childEnv;
     private setStatus;

package/dist/run/supervisor.js

@@ -571,9 +571,9 @@ export class RunSupervisor {
         }
     }
     resolveSecret(manifest, name) {
-        const declared = (manifest.secrets ?? []).some((s) => s.name === name);
+        const declared = (manifest.permissions?.secrets ?? []).some((s) => s.name === name);
         if (!declared) {
-            throw new EngineError("SECRET_UNDECLARED", `Secret "${name}" is not declared in meta.secrets.`, `Add { name: "${name}" } to meta.secrets — secret access is fail-closed everywhere.`);
+            throw new EngineError("SECRET_UNDECLARED", `Secret "${name}" is not declared in permissions.secrets.`, `Add { name: "${name}" } to permissions.secrets — secret access is fail-closed everywhere.`);
         }
         const value = this.env.get(name) ?? process.env[name];
         if (value === undefined || value.length === 0) {
@@ -583,7 +583,7 @@ export class RunSupervisor {
     }
     /**
      * The child's environment: the parent env plus manifest.env with whole-value
-     * `${{ secrets.NAME }}` interpolation resolved (fail-closed against meta.secrets).
+     * `${{ secrets.NAME }}` interpolation resolved (fail-closed against permissions.secrets).
      */
     childEnv(manifest) {
         const out = { ...process.env };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boardwalk-labs/engine",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "The Boardwalk single-node engine: cron scheduling, run lifecycle, SQLite state, and the local run log. Powers `boardwalk dev` and the self-hosted server.",
   "license": "Apache-2.0",
   "repository": {