@kitman-sh/sdk 0.10.74 → 0.10.75

package/dist/build/index.js

@@ -4,7 +4,7 @@ import {
   KitDigest,
   AgentDeclaration,
   KitDeclarations
-} from "../chunk-stw541tr.js";
+} from "../chunk-08qcgk73.js";
 import {
   digestSha256,
   digestSha512,
@@ -13,7 +13,7 @@ import {
   RunnerRpcProtocolVersion,
   describeFlag2,
   Described2
-} from "../chunk-w2f4s9v2.js";
+} from "../chunk-epczfxnt.js";
 
 // packages/core/src/json.ts
 import * as Schema from "effect/Schema";

package/dist/{chunk-stw541tr.js → chunk-08qcgk73.js}

@@ -3707,6 +3707,11 @@ var SecretName2 = Schema25.String.check(Schema25.isPattern(new RegExp("^[A-Za-z_
 var SecretScope = Schema25.Union([Schema25.Literal("workspace"), Schema25.Literal("team")]);
 var SecretHost = Schema25.String.check(Schema25.isPattern(new RegExp("^(\\*\\.)?[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*(?::[0-9]{1,5})?$", "u")), Schema25.isMaxLength(260));
 var SecretHosts = Schema25.Array(SecretHost).check(Schema25.isMaxLength(32));
+var referencePattern = /secret:\/\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+/;
+var placeholderMarker = "kitmanref";
+var tokenCharacter = "[A-Za-z0-9._~+/-]";
+var placeholderPattern = new RegExp(`(?<!${tokenCharacter})(?:proxy-ep=[A-Za-z0-9.-]+;)?${tokenCharacter}*${placeholderMarker}((?:[0-9a-f]{2})+)`);
+var anyReference = new RegExp(`${referencePattern.source}|${placeholderPattern.source}`, "g");
 var SecretSummary = Schema25.Struct({
   name: SecretName2,
   scope: SecretScope,

package/dist/{chunk-w2f4s9v2.js → chunk-epczfxnt.js}

@@ -33,7 +33,7 @@ import {
   executeLoop2,
   LoopCheckError2,
   checkLoop2
-} from "./chunk-stw541tr.js";
+} from "./chunk-08qcgk73.js";
 // packages/core/src/agent-environment.ts
 import * as Schema from "effect/Schema";
 var AgentEnvironmentPolicy = Schema.Union([Schema.Literal("recommended"), Schema.Literal("required")]);

package/dist/loop/index.js

@@ -174,7 +174,7 @@ import {
   syncBase2,
   Continuing2,
   continuingBrief2
-} from "../chunk-stw541tr.js";
+} from "../chunk-08qcgk73.js";
 export {
   AlertTaskActivity2 as AlertTaskActivity,
   AlertTaskRequest2 as AlertTaskRequest,

package/dist/program/index.js

@@ -1,5 +1,5 @@
 // @bun
-import"../chunk-stw541tr.js";
+import"../chunk-08qcgk73.js";
 import {
   JournalWriteFailed2,
   refusedStep2,
@@ -17,7 +17,7 @@ import {
   networkGuard2,
   carriedKits2,
   runKit2
-} from "../chunk-w2f4s9v2.js";
+} from "../chunk-epczfxnt.js";
 export {
   Described2 as Described,
   JournalWriteFailed2 as JournalWriteFailed,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kitman-sh/sdk",
-  "version": "0.10.74",
+  "version": "0.10.75",
   "type": "module",
   "license": "UNLICENSED",
   "exports": {

package/types/packages/core/src/secret.d.ts

@@ -11,9 +11,15 @@ export declare const SecretHosts: Schema.$Array<Schema.String>;
  * the reference, and only to the Secret's hosts.
  */
 export declare const secretReference: (owner: string, name: string) => string;
-/** `text` with each reference in it replaced by `swap`'s answer for it. */
+/**
+ * `token` with its secret part replaced by `reference`, keeping what a Harness parses: a JWT's header and claims, a
+ * Copilot token's endpoint, or a prefix such as `sk-ant-oat01-`. The proxy swaps the whole placeholder for the value, as
+ * it does a reference.
+ */
+export declare const secretPlaceholder: (token: string, reference: string) => string;
+/** `text` with each reference or placeholder in it replaced by `swap`'s answer for its reference. */
 export declare const replaceSecretReferences: (text: string, swap: (reference: string) => string) => string;
-/** The references in `text`, each once. */
+/** The references in `text`, held plainly or in placeholders, each once. */
 export declare const secretReferencesIn: (text: string) => string[];
 /** A Secret as anyone may see it: never its value. */
 export declare const SecretSummary: Schema.Struct<{