@notionhq/workers 0.8.0 → 0.8.1

package/dist/alpha/workflow.d.ts

@@ -22,7 +22,7 @@ export type WorkflowConfiguration<TTriggers extends readonly [WorkflowTrigger, .
      * Each trigger defines a specific event or condition that causes the workflow to run.
      */
     triggers: TTriggers;
-    handler: (event: WorkflowEventForTriggers<TTriggers>, context: CapabilityContext) => Promise<void> | void;
+    handler: (event: WorkflowEventForTriggers<TTriggers>, context: WorkflowContext) => Promise<void> | void;
 };
 /**
  * A workflow capability as returned by {@link createWorkflow}.
@@ -60,11 +60,39 @@ export type Workflow<TTriggers extends readonly [WorkflowTrigger, ...WorkflowTri
  *   title: "Send Welcome Email",
  *   description: "Sends a welcome email when a new page is added",
  *   triggers: [triggers.notionPageCreated()],
- *   handler: async (event) => {
+ *   handler: async (event, context) => {
  *     console.log(event.page);
+ *     await context.step("Process page", async ({ id }) => {
+ *       console.log(`Running step ${id}`);
+ *       return processPage(event.page);
+ *     });
  *   },
  * });
  * ```
  */
 export declare function createWorkflow<const TTriggers extends readonly [WorkflowTrigger, ...WorkflowTrigger[]]>(configuration: WorkflowConfiguration<TTriggers>): Workflow<TTriggers>;
+/** Context passed to a workflow step. */
+export type StepContext = {
+    /** An identifier for this invocation of the step. May be used as an idempotency key. */
+    id: string;
+};
+/** Context passed to a workflow handler. */
+export type WorkflowContext = CapabilityContext & {
+    /**
+     * Run an observable unit of work within the workflow.
+     *
+     * The callback may be synchronous or asynchronous, but `step` always returns
+     * a promise. Its return value must be JSON-serializable so it can be included
+     * in the success event written to stdout.
+     *
+     * @example
+     * ```ts
+     * const page = await context.step("Fetch page", async ({ id }) => {
+     *   console.log(`Running step ${id}`);
+     *   return context.notion.pages.retrieve({ page_id: pageId });
+     * });
+     * ```
+     */
+    step: <T>(name: string, fn: (context: StepContext) => T | Promise<T>) => Promise<T>;
+};
 //# sourceMappingURL=workflow.d.ts.map

package/dist/alpha/workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../src/alpha/workflow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAItD,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,gBAAgB,CAAC,CAAC;AAErE,MAAM,MAAM,uBAAuB,CAAC,CAAC,SAAS,eAAe,IAAI,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAE7F,MAAM,MAAM,wBAAwB,CAAC,CAAC,SAAS,SAAS,eAAe,EAAE,IACxE,uBAAuB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAEpC;;GAEG;AACH,MAAM,MAAM,qBAAqB,CAChC,SAAS,SAAS,SAAS,CAAC,eAAe,EAAE,GAAG,eAAe,EAAE,CAAC,IAC/D;IACH;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;;;OAIG;IACH,QAAQ,EAAE,SAAS,CAAC;IAEpB,OAAO,EAAE,CACR,KAAK,EAAE,wBAAwB,CAAC,SAAS,CAAC,EAC1C,OAAO,EAAE,iBAAiB,KACtB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,CACnB,SAAS,SAAS,SAAS,CAAC,eAAe,EAAE,GAAG,eAAe,EAAE,CAAC,GAAG,SAAS;IAC7E,eAAe;IACf,GAAG,eAAe,EAAE;CACpB,IACE;IACH,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE;QACP,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,SAAS,CAAC;KACpB,CAAC;IACF,OAAO,EAAE,CACR,KAAK,EAAE,wBAAwB,CAAC,SAAS,CAAC,EAC1C,OAAO,CAAC,EAAE,cAAc,KACpB,OAAO,CAAC;QAAE,MAAM,EAAE,SAAS,CAAA;KAAE,GAAG,SAAS,CAAC,CAAC;CAChD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,cAAc,CAC7B,KAAK,CAAC,SAAS,SAAS,SAAS,CAAC,eAAe,EAAE,GAAG,eAAe,EAAE,CAAC,EACvE,aAAa,EAAE,qBAAqB,CAAC,SAAS,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC,CAuCtE"}
+{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../src/alpha/workflow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAItD,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,gBAAgB,CAAC,CAAC;AAErE,MAAM,MAAM,uBAAuB,CAAC,CAAC,SAAS,eAAe,IAAI,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAE7F,MAAM,MAAM,wBAAwB,CAAC,CAAC,SAAS,SAAS,eAAe,EAAE,IACxE,uBAAuB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAEpC;;GAEG;AACH,MAAM,MAAM,qBAAqB,CAChC,SAAS,SAAS,SAAS,CAAC,eAAe,EAAE,GAAG,eAAe,EAAE,CAAC,IAC/D;IACH;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;;;OAIG;IACH,QAAQ,EAAE,SAAS,CAAC;IAEpB,OAAO,EAAE,CACR,KAAK,EAAE,wBAAwB,CAAC,SAAS,CAAC,EAC1C,OAAO,EAAE,eAAe,KACpB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC1B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,CACnB,SAAS,SAAS,SAAS,CAAC,eAAe,EAAE,GAAG,eAAe,EAAE,CAAC,GAAG,SAAS;IAC7E,eAAe;IACf,GAAG,eAAe,EAAE;CACpB,IACE;IACH,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE;QACP,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,SAAS,CAAC;KACpB,CAAC;IACF,OAAO,EAAE,CACR,KAAK,EAAE,wBAAwB,CAAC,SAAS,CAAC,EAC1C,OAAO,CAAC,EAAE,cAAc,KACpB,OAAO,CAAC;QAAE,MAAM,EAAE,SAAS,CAAA;KAAE,GAAG,SAAS,CAAC,CAAC;CAChD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,cAAc,CAC7B,KAAK,CAAC,SAAS,SAAS,SAAS,CAAC,eAAe,EAAE,GAAG,eAAe,EAAE,CAAC,EACvE,aAAa,EAAE,qBAAqB,CAAC,SAAS,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC,CA0CtE;AAED,yCAAyC;AACzC,MAAM,MAAM,WAAW,GAAG;IACzB,wFAAwF;IACxF,EAAE,EAAE,MAAM,CAAC;CACX,CAAC;AAEF,4CAA4C;AAC5C,MAAM,MAAM,eAAe,GAAG,iBAAiB,GAAG;IACjD;;;;;;;;;;;;;;OAcG;IACH,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;CACpF,CAAC"}

package/dist/alpha/workflow.js

@@ -11,7 +11,10 @@ function createWorkflow(configuration) {
     },
     async handler(event, options) {
       try {
-        const capabilityContext = createCapabilityContext("workflow");
+        const capabilityContext = {
+          ...createCapabilityContext("workflow"),
+          step
+        };
         await configuration.handler(event, capabilityContext);
         if (options?.concreteOutput) {
           return { status: "success" };
@@ -34,6 +37,53 @@ function createWorkflow(configuration) {
     }
   };
 }
+function generateUuidV7() {
+  const bytes = crypto.getRandomValues(new Uint8Array(16));
+  let timestamp = Date.now();
+  for (let index = 5; index >= 0; index--) {
+    bytes[index] = timestamp % 256;
+    timestamp = Math.floor(timestamp / 256);
+  }
+  bytes[6] = bytes[6] & 15 | 112;
+  bytes[8] = bytes[8] & 63 | 128;
+  const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+function writeStepEvent(event, value) {
+  const tag = `__notion_step_${event}__`;
+  process.stdout.write(`
+<${tag}>${JSON.stringify(value)}</${tag}>
+`);
+}
+async function step(name, fn) {
+  const context = { id: generateUuidV7() };
+  const event = { id: context.id, name };
+  writeStepEvent("started", event);
+  try {
+    const value = await fn(context);
+    writeStepEvent("success", { ...event, value });
+    writeStepEvent("completed", {
+      ...event,
+      type: "success"
+    });
+    return value;
+  } catch (err) {
+    const error = new ExecutionError(err);
+    writeStepEvent("failure", {
+      ...event,
+      error: {
+        name: error.name,
+        message: error.message,
+        trace: error.stack
+      }
+    });
+    writeStepEvent("completed", {
+      ...event,
+      type: "failure"
+    });
+    throw err;
+  }
+}
 export {
   createWorkflow
 };

package/dist/credential.d.ts

@@ -0,0 +1,26 @@
+/**
+ * A symbolic marker for the declared credential value. It is safe to include
+ * in Worker source and manifests because it never contains the stored secret.
+ */
+export declare const CREDENTIAL_VALUE = "{{credential}}";
+export type CredentialKey = string;
+/** A Vercel-compatible collection of headers to add or replace. */
+export type CredentialHeaderTransform = {
+    readonly headers: Readonly<Record<string, string>>;
+};
+/**
+ * Limits credential injection to a domain. This does not grant or deny general
+ * network egress; the sandbox's egress policy remains a separate concern.
+ */
+export type CredentialNetworkRule = {
+    readonly domain: string;
+    readonly transform: readonly CredentialHeaderTransform[];
+};
+export type CredentialConfiguration = {
+    /** Destinations and header templates where the credential may be injected. */
+    readonly network: readonly CredentialNetworkRule[];
+};
+export type CredentialDeclaration = CredentialConfiguration & {
+    readonly key: CredentialKey;
+};
+//# sourceMappingURL=credential.d.ts.map

package/dist/credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential.d.ts","sourceRoot":"","sources":["../src/credential.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,eAAO,MAAM,gBAAgB,mBAAmB,CAAC;AAkBjD,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC;AAEnC,mEAAmE;AACnE,MAAM,MAAM,yBAAyB,GAAG;IACvC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACnD,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,yBAAyB,EAAE,CAAC;CACzD,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACrC,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAC;CACnD,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG,uBAAuB,GAAG;IAC7D,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;CAC5B,CAAC"}

package/dist/credential.js

@@ -0,0 +1,176 @@
+const CREDENTIAL_VALUE = "{{credential}}";
+const MAX_CREDENTIALS = 100;
+const MAX_CREDENTIAL_DECLARATIONS_BYTES = 256 * 1024;
+const MAX_NETWORK_RULES_PER_CREDENTIAL = 20;
+const MAX_TRANSFORMS_PER_NETWORK_RULE = 20;
+const MAX_HEADERS_PER_NETWORK_RULE = 20;
+const MAX_DOMAIN_LENGTH = 253;
+const MAX_HEADER_NAME_LENGTH = 256;
+const MAX_HEADER_TEMPLATE_BYTES = 8 * 1024;
+const ALLOWED_NOTION_CREDENTIAL_KEYS = /* @__PURE__ */ new Set(["NOTION_API_TOKEN", "NOTION_API_BASE_URL"]);
+const CREDENTIAL_DOMAIN_PATTERN = /^(?:\*\.)?(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+function createCredentialDeclaration(key, config) {
+  validateCredentialKey(key);
+  if (config.network.length === 0) {
+    throw new Error(`Credential "${key}" must declare at least one network rule`);
+  }
+  if (config.network.length > MAX_NETWORK_RULES_PER_CREDENTIAL) {
+    throw new Error(
+      `Credential "${key}" cannot declare more than ${MAX_NETWORK_RULES_PER_CREDENTIAL} domains`
+    );
+  }
+  const domains = /* @__PURE__ */ new Set();
+  const network = config.network.map((rule) => {
+    const domain = normalizeDomain(rule.domain);
+    if (domains.has(domain)) {
+      throw new Error(`Credential "${key}" declares domain "${domain}" more than once`);
+    }
+    domains.add(domain);
+    if (rule.transform.length === 0 || rule.transform.length > MAX_TRANSFORMS_PER_NETWORK_RULE) {
+      throw new Error(
+        `Credential "${key}" must declare 1-${MAX_TRANSFORMS_PER_NETWORK_RULE} transforms for domain "${domain}"`
+      );
+    }
+    const headerNames = /* @__PURE__ */ new Set();
+    return {
+      domain,
+      transform: rule.transform.map((transform) => {
+        const headers = normalizeHeaders({
+          credentialKey: key,
+          domain,
+          headers: transform.headers
+        });
+        for (const headerName of Object.keys(headers)) {
+          const normalizedHeaderName = headerName.toLowerCase();
+          if (headerNames.has(normalizedHeaderName)) {
+            throw new Error(
+              `Credential "${key}" declares header "${headerName}" more than once for domain "${domain}"`
+            );
+          }
+          headerNames.add(normalizedHeaderName);
+          if (headerNames.size > MAX_HEADERS_PER_NETWORK_RULE) {
+            throw new Error(
+              `Credential "${key}" cannot inject more than ${MAX_HEADERS_PER_NETWORK_RULE} headers for domain "${domain}"`
+            );
+          }
+        }
+        return { headers };
+      })
+    };
+  });
+  return {
+    key,
+    network
+  };
+}
+function validateCredentialDeclarationConflicts(existingDeclarations, declaration) {
+  for (const existing of existingDeclarations) {
+    for (const rule of declaration.network) {
+      for (const existingRule of existing.network) {
+        if (!credentialDomainsOverlap(rule.domain, existingRule.domain)) {
+          continue;
+        }
+        const existingHeaders = new Set(
+          existingRule.transform.flatMap(
+            (transform) => Object.keys(transform.headers).map((name) => name.toLowerCase())
+          )
+        );
+        for (const transform of rule.transform) {
+          for (const headerName of Object.keys(transform.headers)) {
+            if (existingHeaders.has(headerName.toLowerCase())) {
+              throw new Error(
+                `Credential "${declaration.key}" conflicts with credential "${existing.key}" for header "${headerName}" on overlapping domains "${rule.domain}" and "${existingRule.domain}"`
+              );
+            }
+          }
+        }
+      }
+    }
+  }
+}
+function validateCredentialKey(key) {
+  if (!/^[A-Za-z][A-Za-z0-9_]{0,63}$/.test(key)) {
+    throw new Error(
+      `Credential key "${key}" must start with a letter, contain only letters, numbers, or underscores, and be at most 64 characters`
+    );
+  }
+  const normalizedKey = key.toUpperCase();
+  if (normalizedKey.startsWith("NOTION_") && !ALLOWED_NOTION_CREDENTIAL_KEYS.has(normalizedKey)) {
+    throw new Error(`Credential key "${key}" uses the reserved NOTION_ prefix`);
+  }
+}
+function normalizeDomain(value) {
+  const domain = value.trim().toLowerCase().replace(/\.$/, "");
+  if (domain.length > MAX_DOMAIN_LENGTH || !CREDENTIAL_DOMAIN_PATTERN.test(domain)) {
+    throw new Error(
+      `Credential network domain "${value}" must be an exact hostname or a leading wildcard such as "*.example.com"`
+    );
+  }
+  return domain;
+}
+function credentialDomainsOverlap(first, second) {
+  if (first === second) {
+    return true;
+  }
+  const firstBase = first.startsWith("*.") ? first.slice(2) : void 0;
+  const secondBase = second.startsWith("*.") ? second.slice(2) : void 0;
+  if (firstBase === void 0 && secondBase === void 0) {
+    return false;
+  }
+  if (firstBase !== void 0 && secondBase === void 0) {
+    return second.endsWith(`.${firstBase}`);
+  }
+  if (firstBase === void 0 && secondBase !== void 0) {
+    return first.endsWith(`.${secondBase}`);
+  }
+  return firstBase !== void 0 && secondBase !== void 0 && (firstBase.endsWith(`.${secondBase}`) || secondBase.endsWith(`.${firstBase}`));
+}
+function normalizeHeaders(args) {
+  const entries = Object.entries(args.headers);
+  if (entries.length === 0) {
+    throw new Error(
+      `Credential "${args.credentialKey}" has an empty header transform for domain "${args.domain}"`
+    );
+  }
+  return Object.fromEntries(
+    entries.map(([name, template]) => {
+      if (name.length > MAX_HEADER_NAME_LENGTH || !/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(name)) {
+        throw new Error(`Invalid credential header name "${name}"`);
+      }
+      if (typeof template !== "string") {
+        throw new Error(`Credential header "${name}" must use a string template`);
+      }
+      validateHeaderTemplate(name, template);
+      return [name, template];
+    })
+  );
+}
+function validateHeaderTemplate(name, template) {
+  if (hasControlCharacters(template)) {
+    throw new Error(`Credential header "${name}" template cannot contain control characters`);
+  }
+  const markerCount = template.split(CREDENTIAL_VALUE).length - 1;
+  if (markerCount !== 1) {
+    throw new Error(
+      `Credential header "${name}" template must contain CREDENTIAL_VALUE exactly once`
+    );
+  }
+  if (new TextEncoder().encode(template).byteLength > MAX_HEADER_TEMPLATE_BYTES) {
+    throw new Error(
+      `Credential header "${name}" template must be at most ${MAX_HEADER_TEMPLATE_BYTES} bytes`
+    );
+  }
+}
+function hasControlCharacters(value) {
+  return Array.from(value).some((character) => {
+    const codePoint = character.codePointAt(0);
+    return codePoint !== void 0 && (codePoint <= 31 || codePoint === 127);
+  });
+}
+export {
+  CREDENTIAL_VALUE,
+  MAX_CREDENTIALS,
+  MAX_CREDENTIAL_DECLARATIONS_BYTES,
+  createCredentialDeclaration,
+  validateCredentialDeclarationConflicts
+};

package/dist/credential.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=credential.test.d.ts.map

package/dist/credential.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential.test.d.ts","sourceRoot":"","sources":["../src/credential.test.ts"],"names":[],"mappings":""}

package/dist/index.d.ts

@@ -9,6 +9,8 @@ export type { ToolCapability, ToolConfiguration, ToolHints } from "./capabilitie
 export type { WebhookCapability, WebhookConfiguration, WebhookEvent, } from "./capabilities/webhook.js";
 export { WebhookVerificationError } from "./capabilities/webhook.js";
 export type { WorkflowCapability, WorkflowConfiguration, WorkflowEvent, WorkflowEventForTrigger, WorkflowEventForTriggers, } from "./capabilities/workflow.js";
+export type { CredentialConfiguration, CredentialDeclaration, CredentialHeaderTransform, CredentialKey, CredentialNetworkRule, } from "./credential.js";
+export { CREDENTIAL_VALUE } from "./credential.js";
 export { RateLimitError } from "./error.js";
 export type { AnyJSONSchema, JSONSchema } from "./json-schema.js";
 export type { Infer, SchemaBuilder } from "./schema-builder.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACX,qBAAqB,EACrB,2BAA2B,EAC3B,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,GAC7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AACnF,YAAY,EACX,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,EAC1B,eAAe,EACf,uBAAuB,EACvB,wBAAwB,EACxB,4BAA4B,GAC5B,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACX,oBAAoB,EACpB,uBAAuB,EACvB,eAAe,EACf,kBAAkB,GAClB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnE,YAAY,EACX,+BAA+B,EAC/B,eAAe,EACf,kBAAkB,EAClB,6BAA6B,GAC7B,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACX,cAAc,EACd,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,QAAQ,GACR,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAC3F,YAAY,EACX,iBAAiB,EACjB,oBAAoB,EACpB,YAAY,GACZ,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,YAAY,EACX,kBAAkB,EAClB,qBAAqB,EACrB,aAAa,EACb,uBAAuB,EACvB,wBAAwB,GACxB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAClE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAC;AACnD,YAAY,EACX,KAAK,EACL,IAAI,EACJ,UAAU,EACV,SAAS,EACT,YAAY,EACZ,WAAW,EACX,UAAU,EACV,QAAQ,GACR,MAAM,YAAY,CAAC;AACpB,YAAY,EACX,cAAc,EACd,cAAc,EACd,qBAAqB,EACrB,WAAW,EACX,gBAAgB,EAChB,WAAW,EACX,cAAc,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACX,qBAAqB,EACrB,2BAA2B,EAC3B,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,GAC7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AACnF,YAAY,EACX,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,EAC1B,eAAe,EACf,uBAAuB,EACvB,wBAAwB,EACxB,4BAA4B,GAC5B,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACX,oBAAoB,EACpB,uBAAuB,EACvB,eAAe,EACf,kBAAkB,GAClB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnE,YAAY,EACX,+BAA+B,EAC/B,eAAe,EACf,kBAAkB,EAClB,6BAA6B,GAC7B,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACX,cAAc,EACd,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,QAAQ,GACR,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAC3F,YAAY,EACX,iBAAiB,EACjB,oBAAoB,EACpB,YAAY,GACZ,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,YAAY,EACX,kBAAkB,EAClB,qBAAqB,EACrB,aAAa,EACb,uBAAuB,EACvB,wBAAwB,GACxB,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACX,uBAAuB,EACvB,qBAAqB,EACrB,yBAAyB,EACzB,aAAa,EACb,qBAAqB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAClE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,qBAAqB,CAAC;AACnD,YAAY,EACX,KAAK,EACL,IAAI,EACJ,UAAU,EACV,SAAS,EACT,YAAY,EACZ,WAAW,EACX,UAAU,EACV,QAAQ,GACR,MAAM,YAAY,CAAC;AACpB,YAAY,EACX,cAAc,EACd,cAAc,EACd,qBAAqB,EACrB,WAAW,EACX,gBAAgB,EAChB,WAAW,EACX,cAAc,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -1,9 +1,11 @@
 import { emojiIcon, imageCover, imageIcon, notionIcon, place } from "./builder.js";
 import { WebhookVerificationError } from "./capabilities/webhook.js";
+import { CREDENTIAL_VALUE } from "./credential.js";
 import { RateLimitError } from "./error.js";
 import { getSchema, j } from "./schema-builder.js";
 import { Worker } from "./worker.js";
 export {
+  CREDENTIAL_VALUE,
   RateLimitError,
   WebhookVerificationError,
   Worker,

package/dist/worker.d.ts

@@ -8,6 +8,7 @@ import type { ToolCapability, ToolConfiguration } from "./capabilities/tool.js";
 import type { WebhookCapability, WebhookConfiguration, WebhookEvent } from "./capabilities/webhook.js";
 import { WebhookVerificationError } from "./capabilities/webhook.js";
 import type { WorkflowCapability, WorkflowConfiguration, WorkflowEvent } from "./capabilities/workflow.js";
+import type { CredentialConfiguration, CredentialDeclaration, CredentialKey } from "./credential.js";
 import type { PacerDeclaration } from "./pacer_internal.js";
 import type { Schema } from "./schema.js";
 import type { WorkflowTrigger } from "./triggers.generated.js";
@@ -105,12 +106,18 @@ type CapabilityManifestEntry = Pick<Capability, "_tag" | "key" | "config">;
  */
 export type WorkerManifest = {
     readonly sdkVersion: string;
+    readonly credentials: readonly CredentialDeclaration[];
     readonly databases: readonly RegisteredDatabase[];
     readonly pacers: readonly PacerDeclaration[];
     readonly capabilities: readonly CapabilityManifestEntry[];
 };
 export declare class Worker {
     #private;
+    /**
+     * Declare a credential that is injected into matching outbound HTTPS
+     * requests without exposing its value to Worker code.
+     */
+    credential(key: CredentialKey, config: CredentialConfiguration): void;
     database<PK extends string, S extends Schema<PK>>(key: string, config: DatabaseConfig<PK, S>): DatabaseHandle<PK, S>;
     /**
      * Register a pacer for rate-limiting requests to an external API.

package/dist/worker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,MAAM,gCAAgC,CAAC;AAExC,OAAO,KAAK,EACX,oBAAoB,EACpB,uBAAuB,EACvB,eAAe,EACf,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,KAAK,EACX,qBAAqB,EACrB,wBAAwB,EACxB,MAAM,gCAAgC,CAAC;AAExC,OAAO,KAAK,EACX,+BAA+B,EAC/B,eAAe,EACf,kBAAkB,EAClB,6BAA6B,EAC7B,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAEhF,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAEhF,OAAO,KAAK,EACX,iBAAiB,EACjB,oBAAoB,EACpB,YAAY,EACZ,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAA2B,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC9F,OAAO,KAAK,EACX,kBAAkB,EAClB,qBAAqB,EACrB,aAAa,EACb,MAAM,4BAA4B,CAAC;AAEpC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAG5D,YAAY,EACX,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,iBAAiB,EACjB,+BAA+B,EAC/B,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,6BAA6B,EAC7B,oBAAoB,EACpB,YAAY,EACZ,qBAAqB,EACrB,aAAa,GACb,CAAC;AACF,OAAO,EAAE,wBAAwB,EAAE,CAAC;AAMpC,KAAK,UAAU,GACZ,cAAc,GACd,qBAAqB,GACrB,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,GACxB,oBAAoB,GACpB,kBAAkB,GAClB,eAAe,GACf,iBAAiB,GACjB,qBAAqB,CAAC;AAEzB,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;AAqChD;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC,SAAS,MAAM,CAAC,EAAE,CAAC,IAAI;IAC5E,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;OAKG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,kBAAkB,EAAE,EAAE,CAAC;IACvB;;;OAGG;IACH,MAAM,EAAE,CAAC,CAAC;CACV,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC,SAAS,MAAM,CAAC,EAAE,CAAC,IAAI,qBAAqB,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAEnG;;;GAGG;AACH,MAAM,MAAM,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC,SAAS,MAAM,CAAC,EAAE,CAAC,IAAI;IACrE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;CACvC,CAAC;AAEF,sEAAsE;AACtE,KAAK,kBAAkB,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AAEjE;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG;IACzB,uDAAuD;IACvD,eAAe,EAAE,MAAM,CAAC;IACxB,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACtB,CAAC;AAGF,YAAY,EAAE,gBAAgB,EAAE,CAAC;AAEjC,wEAAwE;AACxE,KAAK,uBAAuB,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC,CAAC;AAE3E;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAClD,QAAQ,CAAC,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC7C,QAAQ,CAAC,YAAY,EAAE,SAAS,uBAAuB,EAAE,CAAC;CAC1D,CAAC;AA0BF,qBAAa,MAAM;;IAKlB,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC,SAAS,MAAM,CAAC,EAAE,CAAC,EAC/C,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC,GAC3B,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;IAOxB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,WAAW;IAUpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiDG;IACH,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC,SAAS,MAAM,CAAC,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,EAC9D,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,iBAAiB,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,GACvC,cAAc;IAWjB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoDG;IACH,WAAW,CAAC,CAAC,SAAS,oBAAoB,EAAE,OAAO,GAAG,OAAO,EAC5D,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,wBAAwB,CAAC,CAAC,EAAE,OAAO,CAAC,GAC1C,qBAAqB;IAWxB;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,IAAI,CAAC,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,SAAS,GAAG,SAAS,EACxD,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,GAC7B,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC;IAOvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,GAAG,oBAAoB;IAO9E;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,QAAQ,CAAC,KAAK,CAAC,SAAS,SAAS,SAAS,CAAC,eAAe,EAAE,GAAG,eAAe,EAAE,CAAC,EAChF,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,qBAAqB,CAAC,SAAS,CAAC,GACtC,kBAAkB,CAAC,SAAS,CAAC;IAOhC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,iBAAiB;IAOrE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,eAAe;IAO/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqCG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAwB,GAAG,qBAAqB;IAOjF;;OAEG;IACH,IAAI,YAAY,IAAI,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC,EAAE,CAMhE;IAED,IAAI,QAAQ,IAAI,cAAc,CAO7B;IAED;;;;;;;OAOG;IACG,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,OAAO,CAAC;CAsCxF"}
+{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,MAAM,gCAAgC,CAAC;AAExC,OAAO,KAAK,EACX,oBAAoB,EACpB,uBAAuB,EACvB,eAAe,EACf,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,KAAK,EACX,qBAAqB,EACrB,wBAAwB,EACxB,MAAM,gCAAgC,CAAC;AAExC,OAAO,KAAK,EACX,+BAA+B,EAC/B,eAAe,EACf,kBAAkB,EAClB,6BAA6B,EAC7B,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAEhF,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAEhF,OAAO,KAAK,EACX,iBAAiB,EACjB,oBAAoB,EACpB,YAAY,EACZ,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAA2B,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC9F,OAAO,KAAK,EACX,kBAAkB,EAClB,qBAAqB,EACrB,aAAa,EACb,MAAM,4BAA4B,CAAC;AAEpC,OAAO,KAAK,EACX,uBAAuB,EACvB,qBAAqB,EACrB,aAAa,EACb,MAAM,iBAAiB,CAAC;AAOzB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAG5D,YAAY,EACX,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,iBAAiB,EACjB,+BAA+B,EAC/B,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,6BAA6B,EAC7B,oBAAoB,EACpB,YAAY,EACZ,qBAAqB,EACrB,aAAa,GACb,CAAC;AACF,OAAO,EAAE,wBAAwB,EAAE,CAAC;AAMpC,KAAK,UAAU,GACZ,cAAc,GACd,qBAAqB,GACrB,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,GACxB,oBAAoB,GACpB,kBAAkB,GAClB,eAAe,GACf,iBAAiB,GACjB,qBAAqB,CAAC;AAEzB,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;AAqChD;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC,SAAS,MAAM,CAAC,EAAE,CAAC,IAAI;IAC5E,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;OAKG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,kBAAkB,EAAE,EAAE,CAAC;IACvB;;;OAGG;IACH,MAAM,EAAE,CAAC,CAAC;CACV,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC,SAAS,MAAM,CAAC,EAAE,CAAC,IAAI,qBAAqB,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAEnG;;;GAGG;AACH,MAAM,MAAM,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC,SAAS,MAAM,CAAC,EAAE,CAAC,IAAI;IACrE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;CACvC,CAAC;AAEF,sEAAsE;AACtE,KAAK,kBAAkB,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AAEjE;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG;IACzB,uDAAuD;IACvD,eAAe,EAAE,MAAM,CAAC;IACxB,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACtB,CAAC;AAGF,YAAY,EAAE,gBAAgB,EAAE,CAAC;AAEjC,wEAAwE;AACxE,KAAK,uBAAuB,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC,CAAC;AAE3E;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACvD,QAAQ,CAAC,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAClD,QAAQ,CAAC,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC7C,QAAQ,CAAC,YAAY,EAAE,SAAS,uBAAuB,EAAE,CAAC;CAC1D,CAAC;AA0BF,qBAAa,MAAM;;IAMlB;;;OAGG;IACH,UAAU,CAAC,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,uBAAuB,GAAG,IAAI;IAmBrE,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC,SAAS,MAAM,CAAC,EAAE,CAAC,EAC/C,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC,GAC3B,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;IAOxB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,WAAW;IAUpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiDG;IACH,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC,SAAS,MAAM,CAAC,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,EAC9D,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,iBAAiB,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,GACvC,cAAc;IAWjB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoDG;IACH,WAAW,CAAC,CAAC,SAAS,oBAAoB,EAAE,OAAO,GAAG,OAAO,EAC5D,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,wBAAwB,CAAC,CAAC,EAAE,OAAO,CAAC,GAC1C,qBAAqB;IAWxB;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,IAAI,CAAC,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,SAAS,GAAG,SAAS,EACxD,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,GAC7B,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC;IAOvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,GAAG,oBAAoB;IAO9E;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,QAAQ,CAAC,KAAK,CAAC,SAAS,SAAS,SAAS,CAAC,eAAe,EAAE,GAAG,eAAe,EAAE,CAAC,EAChF,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,qBAAqB,CAAC,SAAS,CAAC,GACtC,kBAAkB,CAAC,SAAS,CAAC;IAOhC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,iBAAiB;IAOrE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,eAAe;IAO/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqCG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAwB,GAAG,qBAAqB;IAOjF;;OAEG;IACH,IAAI,YAAY,IAAI,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC,EAAE,CAMhE;IAED,IAAI,QAAQ,IAAI,cAAc,CAQ7B;IAED;;;;;;;OAOG;IACG,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,OAAO,CAAC;CA2CxF"}

package/dist/worker.js

@@ -6,6 +6,12 @@ import { createSyncCapability } from "./capabilities/sync.js";
 import { createToolCapability } from "./capabilities/tool.js";
 import { createWebhookCapability, WebhookVerificationError } from "./capabilities/webhook.js";
 import { createWorkflowCapability } from "./capabilities/workflow.js";
+import {
+  createCredentialDeclaration,
+  MAX_CREDENTIAL_DECLARATIONS_BYTES,
+  MAX_CREDENTIALS,
+  validateCredentialDeclarationConflicts
+} from "./credential.js";
 import { pacerWait } from "./pacer_internal.js";
 import { createRequire } from "node:module";
 const SDK_VERSION = (() => {
@@ -18,8 +24,28 @@ const SDK_VERSION = (() => {
 })();
 class Worker {
   #capabilities = /* @__PURE__ */ new Map();
+  #credentials = /* @__PURE__ */ new Map();
   #databases = /* @__PURE__ */ new Map();
   #pacers = /* @__PURE__ */ new Map();
+  /**
+   * Declare a credential that is injected into matching outbound HTTPS
+   * requests without exposing its value to Worker code.
+   */
+  credential(key, config) {
+    this.#validateUniqueKey(key);
+    if (this.#credentials.size >= MAX_CREDENTIALS) {
+      throw new Error(`Worker cannot declare more than ${MAX_CREDENTIALS} credentials`);
+    }
+    const declaration = createCredentialDeclaration(key, config);
+    validateCredentialDeclarationConflicts(this.#credentials.values(), declaration);
+    const declarations = [...this.#credentials.values(), declaration];
+    if (new TextEncoder().encode(JSON.stringify(declarations)).byteLength > MAX_CREDENTIAL_DECLARATIONS_BYTES) {
+      throw new Error(
+        `Worker credential declarations must be at most ${MAX_CREDENTIAL_DECLARATIONS_BYTES} bytes`
+      );
+    }
+    this.#credentials.set(key, declaration);
+  }
   database(key, config) {
     this.#validateUniqueKey(key);
     const database = { key, config };
@@ -423,6 +449,7 @@ class Worker {
   get manifest() {
     return {
       sdkVersion: SDK_VERSION,
+      credentials: Array.from(this.#credentials.values()),
       databases: Array.from(this.#databases.values()),
       pacers: Array.from(this.#pacers.values()),
       capabilities: this.capabilities
@@ -460,7 +487,7 @@ class Worker {
     if (!key || typeof key !== "string") {
       throw new Error("Capability key must be a non-empty string");
     }
-    if (this.#capabilities.has(key) || this.#databases.has(key) || this.#pacers.has(key)) {
+    if (this.#capabilities.has(key) || this.#credentials.has(key) || this.#databases.has(key) || this.#pacers.has(key)) {
       throw new Error(`Worker item with key "${key}" already registered`);
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@notionhq/workers",
-	"version": "0.8.0",
+	"version": "0.8.1",
 	"description": "An SDK for building workers for the Notion Workers platform",
 	"license": "MIT",
 	"bin": {

package/src/alpha/workflow.test.ts

@@ -1,8 +1,8 @@
-import { afterEach, beforeEach, describe, expect, it, vi, type Mock } from "vitest";
+import { afterEach, beforeEach, describe, expect, expectTypeOf, it, vi, type Mock } from "vitest";
 
 import { ExecutionError } from "./error.js";
 import { triggers, type NotionPageCreatedEvent } from "./triggers.generated.js";
-import { createWorkflow } from "./workflow.js";
+import { createWorkflow, type StepContext, type WorkflowContext } from "./workflow.js";
 
 let stdoutSpy: Mock<typeof process.stdout.write>;
 
@@ -16,6 +16,128 @@ afterEach(() => {
 
 const event = { type: "notion.page.created" } as NotionPageCreatedEvent;
 
+async function createWorkflowContext(): Promise<WorkflowContext> {
+	let context: WorkflowContext | undefined;
+	const workflow = createWorkflow({
+		title: "Test workflow",
+		description: "Captures its workflow context",
+		triggers: [triggers.notionPageCreated()],
+		handler: (_event, workflowContext) => {
+			context = workflowContext;
+		},
+	});
+
+	await workflow.handler(event, { concreteOutput: true });
+
+	if (!context) {
+		throw new Error("Workflow context was not created");
+	}
+
+	return context;
+}
+
+describe("step", () => {
+	it("runs a synchronous callback and writes success events in order", async () => {
+		const { step } = await createWorkflowContext();
+		let context: StepContext | undefined;
+		const resultPromise = step("Fetch page", (stepContext) => {
+			context = stepContext;
+			return { pageId: "page-1" } as const;
+		});
+
+		expectTypeOf(resultPromise).toEqualTypeOf<Promise<{ readonly pageId: "page-1" }>>();
+		await expect(resultPromise).resolves.toEqual({ pageId: "page-1" });
+
+		expect(context).toBeDefined();
+		const id = context!.id;
+		expect(id).toMatch(/^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/);
+		expect(stdoutSpy.mock.calls.map(([output]) => output)).toEqual([
+			`\n<__notion_step_started__>{"id":"${id}","name":"Fetch page"}</__notion_step_started__>\n`,
+			`\n<__notion_step_success__>{"id":"${id}","name":"Fetch page","value":{"pageId":"page-1"}}</__notion_step_success__>\n`,
+			`\n<__notion_step_completed__>{"id":"${id}","name":"Fetch page","type":"success"}</__notion_step_completed__>\n`,
+		]);
+	});
+
+	it("embeds the invocation timestamp in the UUID v7", async () => {
+		const { step } = await createWorkflowContext();
+		const now = 1_721_234_567_890;
+		const nowSpy = vi.spyOn(Date, "now").mockReturnValue(now);
+		let id = "";
+
+		try {
+			await step("Timestamped", async (context) => {
+				id = context.id;
+			});
+		} finally {
+			nowSpy.mockRestore();
+		}
+
+		expect(Number.parseInt(id.replaceAll("-", "").slice(0, 12), 16)).toBe(now);
+	});
+
+	it("uses a distinct UUID for each invocation", async () => {
+		const { step } = await createWorkflowContext();
+		const ids: string[] = [];
+
+		await step("First", ({ id }) => {
+			ids.push(id);
+		});
+		await step("Second", ({ id }) => {
+			ids.push(id);
+		});
+
+		expect(new Set(ids).size).toBe(2);
+	});
+
+	it("writes failure events in order and rethrows the original error", async () => {
+		const { step } = await createWorkflowContext();
+		const originalError = new Error("boom");
+		let id = "";
+		const fn = vi.fn((context: StepContext) => {
+			id = context.id;
+			throw originalError;
+		});
+
+		await expect(step("Explode", fn)).rejects.toBe(originalError);
+
+		expect(fn).toHaveBeenCalledOnce();
+		expect(stdoutSpy).toHaveBeenCalledTimes(3);
+		expect(stdoutSpy.mock.calls[0]?.[0]).toBe(
+			`\n<__notion_step_started__>{"id":"${id}","name":"Explode"}</__notion_step_started__>\n`,
+		);
+		expect(stdoutSpy.mock.calls[1]?.[0]).toEqual(
+			expect.stringContaining(
+				`<__notion_step_failure__>{"id":"${id}","name":"Explode","error":{"name":"ExecutionError","message":"Error during worker execution: Error: boom","trace":`,
+			),
+		);
+		expect(stdoutSpy.mock.calls[2]?.[0]).toBe(
+			`\n<__notion_step_completed__>{"id":"${id}","name":"Explode","type":"failure"}</__notion_step_completed__>\n`,
+		);
+	});
+
+	it("writes step events under concreteOutput", async () => {
+		const workflow = createWorkflow({
+			title: "Log Pages",
+			description: "Logs created pages",
+			triggers: [triggers.notionPageCreated()],
+			handler: async (_event, context) => {
+				await context.step("Always visible", () => "done");
+			},
+		});
+
+		await workflow.handler(event, { concreteOutput: true });
+
+		expect(stdoutSpy).toHaveBeenCalledTimes(3);
+		expect(stdoutSpy.mock.calls[0]?.[0]).toEqual(
+			expect.stringContaining("<__notion_step_started__>"),
+		);
+		expect(stdoutSpy.mock.calls[1]?.[0]).toEqual(
+			expect.stringContaining("<__notion_step_success__>"),
+		);
+		expect(stdoutSpy.mock.calls[2]?.[0]).toEqual(expect.stringContaining('"type":"success"'));
+	});
+});
+
 describe("createWorkflow", () => {
 	it("is tagged and exposes triggers in config", () => {
 		const workflow = createWorkflow({