@superglue/cli 1.1.32 → 1.1.33

package/skills/superglue/references/http.md

@@ -68,8 +68,15 @@ Some APIs (e.g. Salesforce) use SOAP XML login where credentials are embedded in
 
 `<<systemId_password>><<systemId_security_token>>` resolves to the password and token concatenated — no separator needed. This works in URL, headers, and body fields.
 
-Headers starting with `x-` are treated as custom headers.
-Modern APIs expect auth in headers, not query parameters, unless docs explicitly say otherwise.
+### Parsing XML responses
+
+XML responses (SOAP and other XML APIs) are auto-parsed to an object on `sourceData.stepId.data`. The parser has quirks you MUST account for in transforms and stopConditions — probe the real response with a small page before writing selectors:
+
+- **Every tag name is UPPERCASED.** `<response><record>` becomes `RESPONSE.RECORD`, regardless of the source casing. Always select uppercase keys.
+- **Single vs multiple children collapse.** One child element parses to an object; multiple with the same tag parse to an array. Normalize before mapping: `const rows = Array.isArray(x) ? x : (x ? [x] : [])`.
+- **Element attributes become keys on the element object** (also uppercased). `<data count="2" total="127">` gives `DATA.COUNT` and `DATA.TOTAL` alongside the child records.
+- **Text with attributes goes to `_TEXT`.** An element with both attributes and text content stores the text under a `_TEXT` key. Empty elements (`<field></field>`) become `{}`.
+- **Numbers and booleans are strings.** Everything is a string; wrap with `Number(...)` where you need arithmetic.
 
 ## HTTP Runtime Details
 
@@ -143,11 +150,15 @@ Multipart restrictions:
 
 All HTTP responses are read as raw bytes, then classified by byte-level detection (see `file-handling.md` for the full detection logic).
 
-- **Binary types** (PDF, Excel, DOCX, ZIP, GZIP): treated as files, parsed content also populates `data`. Later steps can reference via `file::<stepId>.raw/base64/extracted`.
+- **File responses**: formats classified as files by `file-handling.md` are stored as files, and parsed content populates `data` when extraction is available. Later steps can reference them via `file::<stepId>.raw/base64/extracted`.
 - **`application/octet-stream`**: always treated as a file.
 - **Responses over 25 MB**: treated as files as a safety fallback.
 - **RAW + `Content-Disposition: attachment`**: treated as a file.
-- **Structured/text responses** (JSON, XML, CSV, YAML, HTML, text under size limit): parsed inline to `data` only.
+- **Inline responses**: formats classified as structured or plain text by `file-handling.md` populate `data` without producing a stored file unless another file rule applies.
+
+### XML Response Casing
+
+XML responses are parsed into a JSON tree with ALL tag names normalized to UPPERCASE — the parsed keys will not match the raw document's casing. This applies identically to `sg system call` and to request steps in tools. A raw `fetch()` inside a transform step is the exception: it returns the original document with its real casing (often lowercase envelope tags with uppercase field tags). Never write string-level XML parsing logic in a transform from memory of what `sg system call` showed — capture a raw probe first (e.g. return `{ rawXml: xml.slice(0, 1500) }`), and guard against self-closing empty containers (`<data/>` has no closing tag) and repeated sibling result blocks.
 
 ### Error Detection
 

package/skills/superglue/references/mongodb.md

@@ -11,7 +11,7 @@
 }
 ```
 
-Configure the connection URL based on which credentials are stored in the system — use `sg system find` to check `storedCredentials` and reference them accordingly.
+Configure the connection URL based on the selected credential's secrets — use `sg system find` to inspect the available secret names and reference them accordingly.
 
 `method`, `headers`, `queryParams`, and `pagination` are HTTP-only fields — omit them for MongoDB steps.
 
@@ -130,7 +130,7 @@ Default retries come from server config. On final failure, the error includes th
 When a MongoDB step fails:
 
 1. **Read the error message** — superglue includes the operation name in the error. Check for unknown operations, missing required fields (`filter`, `update`, `pipeline`), or malformed Extended JSON.
-2. **Verify connection credentials** — use `sg system find` to confirm `storedCredentials` keys match the placeholders in your URL. Test with a `listCollections` operation via `sg system call`.
+2. **Verify connection secrets** — use `sg system find` to confirm the stored secret names match the placeholders in your URL. Test with a `listCollections` operation via `sg system call`.
 3. **Check auth source** — "Authentication failed" usually means a missing or wrong `authSource`. Root users authenticate against `admin`.
 4. **Check connectivity** — connection refused or server-selection timeouts mean the host is unreachable, the SRV record can't resolve, or an IP allowlist (Atlas) is blocking you. `mongodb+srv://` requires outbound DNS.
 5. **Check the operation shape** — read operations (`find`, `countDocuments`, `distinct`) never mutate; write operations require their specific fields. `aggregate` is read-only unless its pipeline contains a `$out` or `$merge` stage, which writes results back to a collection. Confirm `filter`/`update`/`pipeline` are objects/arrays, not strings.

package/skills/superglue/references/mssql.md

@@ -13,7 +13,7 @@
 }
 ```
 
-Configure the connection URL based on which credentials are stored in the system — use `sg system find` to check `storedCredentials` and reference them accordingly.
+Configure the connection URL based on the selected credential's secrets — use `sg system find` to inspect the available secret names and reference them accordingly.
 
 `method`, `headers`, `queryParams`, and `pagination` are HTTP-only fields — omit them for database steps.
 
@@ -93,46 +93,46 @@ mssql://<<my_db_user>>:<<my_db_password>>@<<my_db_host>>:<<my_db_port>>/<<my_db_
 
 ### Windows Authentication (NTLM)
 
-For on-prem SQL Servers that only accept Windows domain logins (no SQL auth), store these credential keys on the system:
+For on-prem SQL Servers that only accept Windows domain logins (no SQL auth), add secrets with these names to the credential:
 
-| Credential Key | Required | Notes                                                 |
-| -------------- | -------- | ----------------------------------------------------- |
-| `authType`     | yes      | `ntlm`                                                |
-| `domain`       | yes      | Windows domain (e.g. `CORP`)                          |
-| `user`         | yes      | Windows username (also accepts `username`, or in URL) |
-| `password`     | yes      | Windows password (or in URL)                          |
+| Secret Name | Required | Notes                                                 |
+| ----------- | -------- | ----------------------------------------------------- |
+| `authType`  | yes      | `ntlm`                                                |
+| `domain`    | yes      | Windows domain (e.g. `CORP`)                          |
+| `user`      | yes      | Windows username (also accepts `username`, or in URL) |
+| `password`  | yes      | Windows password (or in URL)                          |
 
 ```
 URL:  mssql://<<sys_user>>:<<sys_password>>@<<sys_host>>:<<sys_port>>/<<sys_database>>
-Credentials: { authType: "ntlm", domain, user, password, host, port, database }
+Secrets: { authType: "ntlm", domain, user, password, host, port, database }
 ```
 
 Alternatively, pass the domain as a `?domain=CORP` query parameter on the URL — any URL with a `domain` set authenticates via NTLM. Kerberos-only environments are not supported; ask the DBA to permit NTLM or create a SQL login.
 
 ### Azure Active Directory Authentication
 
-For Azure AD auth, store the following credential keys on the system alongside the standard connection fields:
+For Azure AD auth, add secrets with the following names to the credential alongside the standard connection fields:
 
 **Entra ID User + Password** — authenticates as an Azure AD user. Requires an Azure app registration.
 
-| Credential Key | Required | Notes                                                  |
-| -------------- | -------- | ------------------------------------------------------ |
-| `authType`     | yes      | `azure-active-directory-password`                      |
-| `clientId`     | yes      | Application (client) ID from Azure app registration    |
-| `tenantId`     | no       | Directory (tenant) ID                                  |
-| `user`         | yes      | Azure AD username (also accepts `username`, or in URL) |
-| `password`     | yes      | Azure AD password (or in URL)                          |
+| Secret Name | Required | Notes                                                  |
+| ----------- | -------- | ------------------------------------------------------ |
+| `authType`  | yes      | `azure-active-directory-password`                      |
+| `clientId`  | yes      | Application (client) ID from Azure app registration    |
+| `tenantId`  | no       | Directory (tenant) ID                                  |
+| `user`      | yes      | Azure AD username (also accepts `username`, or in URL) |
+| `password`  | yes      | Azure AD password (or in URL)                          |
 
-`user` and `password` can be stored as credentials or embedded in the URL — values resolved into the URL take precedence; stored credentials only fill gaps the URL omits.
+`user` and `password` can be stored as secrets or embedded in the URL — values resolved into the URL take precedence; stored secrets only fill gaps the URL omits.
 
 ```
 URL:  mssql://<<sys_user>>:<<sys_password>>@myserver.database.windows.net:1433/mydb
-Credentials: { authType, clientId, tenantId, user, password, host, port, database }
+Secrets: { authType, clientId, tenantId, user, password, host, port, database }
 ```
 
 **Service Principal** — authenticates as an Azure AD application. No user/password needed in the URL.
 
-| Credential Key | Required | Notes                                             |
+| Secret Name    | Required | Notes                                             |
 | -------------- | -------- | ------------------------------------------------- |
 | `authType`     | yes      | `azure-active-directory-service-principal-secret` |
 | `clientId`     | yes      | Application (client) ID                           |
@@ -141,7 +141,7 @@ Credentials: { authType, clientId, tenantId, user, password, host, port, databas
 
 ```
 URL:  mssql://myserver.database.windows.net:1433/mydb
-Credentials: { authType, clientId, clientSecret, tenantId, host, port, database }
+Secrets: { authType, clientId, clientSecret, tenantId, host, port, database }
 ```
 
 The runtime authenticates entirely via the service principal credentials — no user or password is needed in the URL.
@@ -245,7 +245,7 @@ Default retries from server config. On final failure, error includes query text
 When an MSSQL step fails and the cause is not obvious:
 
 1. **Read the error message** — superglue includes the query text and params in the error. Check for syntax errors, missing columns, or type mismatches.
-2. **Verify connection credentials** — use `sg system find` to confirm `storedCredentials` keys match the placeholders in your URL. Test connectivity with a simple `SELECT 1` via `sg system call`.
+2. **Verify connection secrets** — use `sg system find` to confirm the stored secret names match the placeholders in your URL. Test connectivity with a simple `SELECT 1` via `sg system call`.
 3. **Check database-side access** — connection refused or permission denied errors typically mean the database user lacks access. Verify with the user that the credentials have the required grants.
 4. **Check Azure-specific issues** — if connecting to Azure SQL:
    - Confirm the client IP is allowed in the Azure SQL firewall rules

package/skills/superglue/references/odbc.md

@@ -11,7 +11,7 @@
 }
 ```
 
-Configure the connection URL based on which credentials are stored in the system — use `sg system find` to check `storedCredentials` and reference them accordingly.
+Configure the connection URL based on the selected credential's secrets — use `sg system find` to inspect the available secret names and reference them accordingly.
 
 `method`, `headers`, `queryParams`, and `pagination` are HTTP-only fields — omit them for database steps.
 
@@ -185,7 +185,7 @@ For other ODBC-backed databases, look up the database/driver-specific error code
 When an ODBC step fails and the cause is not obvious:
 
 1. **Read the error message** — superglue includes a truncated query preview in the error. Check for syntax errors, missing columns, or type mismatches.
-2. **Verify connection credentials** — use `sg system find` to confirm `storedCredentials` keys match the placeholders in your URL. Test connectivity with a simple `SELECT 1` via `sg system call`.
+2. **Verify connection secrets** — use `sg system find` to confirm the stored secret names match the placeholders in your URL. Test connectivity with a simple `SELECT 1` via `sg system call`.
 3. **Check database-side access** — connection refused or permission denied errors typically mean the database user lacks access. Verify with the user that the credentials have the required grants.
 4. **Check driver availability** — if the error mentions "driver not found", the `DRIVER` query parameter does not match any registered driver in `/etc/odbcinst.ini`. Verify the driver name is correct and the driver is installed in the Docker image.
 5. **Test the query directly** — use `sg system call` with a simplified version of the query to isolate whether the issue is the query itself, the parameters, or the connection.

package/skills/superglue/references/postgres.md

@@ -11,7 +11,7 @@
 }
 ```
 
-Configure the connection URL based on which credentials are stored in the system — use `sg system find` to check `storedCredentials` and reference them accordingly.
+Configure the connection URL based on the selected credential's secrets — use `sg system find` to inspect the available secret names and reference them accordingly.
 
 `method`, `headers`, `queryParams`, and `pagination` are HTTP-only fields — omit them for database steps.
 
@@ -148,7 +148,7 @@ Default retries from server config. On final failure, error includes query text
 When a PostgreSQL step fails and the cause is not obvious:
 
 1. **Read the error message** — superglue includes the query text and params in the error. Check for syntax errors, missing columns, or type mismatches.
-2. **Verify connection credentials** — use `sg system find` to confirm `storedCredentials` keys match the placeholders in your URL. Test connectivity with a simple `SELECT 1` via `sg system call`.
+2. **Verify connection secrets** — use `sg system find` to confirm the stored secret names match the placeholders in your URL. Test connectivity with a simple `SELECT 1` via `sg system call`.
 3. **Check database-side access** — connection refused or permission denied errors typically mean the database user lacks access to the database, schema, or table. Verify with the user that the credentials have the required grants.
 4. **Test the query directly** — use `sg system call` with a simplified version of the query to isolate whether the issue is the query itself, the parameters, or the connection.
 5. **Check for SSL/TLS issues** — if the error mentions SSL or handshake failure, check the SSL / TLS section above. For non-localhost servers that don't support SSL, add `?sslmode=disable` to the URL. For servers that require SSL, add `?sslmode=require`.

package/skills/superglue/references/redis.md

@@ -11,7 +11,7 @@
 }
 ```
 
-Configure the connection URL based on which credentials are stored in the system — use `sg system find` to check `storedCredentials` and reference them accordingly.
+Configure the connection URL based on the selected credential's secrets — use `sg system find` to inspect the available secret names and reference them accordingly.
 
 `method`, `headers`, `queryParams`, and `pagination` are HTTP-only fields — omit them for Redis steps.
 
@@ -133,7 +133,7 @@ Default retries from server config. On final failure, error includes command and
 When a Redis step fails:
 
 1. **Read the error message** — superglue includes the command and args in the error. Check for unknown commands, wrong argument counts, or type errors (e.g. running a list command on a string key).
-2. **Verify connection credentials** — use `sg system find` to confirm `storedCredentials` keys match the placeholders in your URL. Test with a simple `PING` command via `sg system call`.
+2. **Verify connection secrets** — use `sg system find` to confirm the stored secret names match the placeholders in your URL. Test with a simple `PING` command via `sg system call`.
 3. **Check connectivity and access** — connection refused errors typically mean the Redis server is unreachable or requires TLS (`rediss://`). AUTH errors mean the password is wrong or the user lacks access.
 4. **Check key types** — Redis commands are type-specific. Running `GET` on a hash key or `HGETALL` on a string key returns a `WRONGTYPE` error. Use `TYPE` command via `sg system call` to check a key's type before building.
 5. **Verify TLS requirements** — if the error mentions connection reset or handshake failure, try switching between `redis://` and `rediss://`.

package/skills/superglue/references/sftp-smb.md

@@ -13,7 +13,7 @@ FTP, SFTP, and SMB share an identical operation interface. Only the URL protocol
 }
 ```
 
-Configure the connection URL based on which credentials are stored in the system — use `sg system find` to check `storedCredentials` and reference them accordingly.
+Configure the connection URL based on the selected credential's secrets — use `sg system find` to inspect the available secret names and reference them accordingly.
 
 `method`, `headers`, `queryParams`, and `pagination` are HTTP-only fields — omit them for file server steps.
 
@@ -128,7 +128,7 @@ Single operation returns the result directly. Array of operations returns an arr
 
 **FTP/FTPS:** uses `basic-ftp`. FTPS uses TLS with `rejectUnauthorized: false`. Connection timeout configurable.
 
-**SMB:** uses `@tryjsky/v9u-smb2`. Connection lifecycle: create client (with share, domain, credentials), execute operations, disconnect. Entire operation wrapped in a timeout race. For private systems via Secure Gateway, the host is `tunnelId.tunnel` (e.g. `my_tunnel.tunnel`).
+**SMB:** uses `@tryjsky/v9u-smb2`. Connection lifecycle: create client (with share, domain, credentials), execute operations, disconnect.
 
 ### Retry Behavior
 
@@ -152,10 +152,10 @@ When the user wants to **download** a file fetched via SFTP/SMB/FTP, set `output
 When a file server step fails and the cause is not obvious:
 
 1. **Read the error message** — superglue includes the operations list in the error. Check for typos in paths, missing fields, or unsupported operations.
-2. **Verify connection credentials** — use `sg system find` to confirm `storedCredentials` keys match the placeholders in your URL. Test with a simple `list` operation on the base path via `sg system call`.
+2. **Verify connection secrets** — use `sg system find` to confirm the stored secret names match the placeholders in your URL. Test with a simple `list` operation on the base path via `sg system call`.
 3. **Check path resolution** — if you get "file not found", verify the path is relative to the URL base path, not an absolute filesystem path. Use `list` on the parent directory to see what files exist.
 4. **Check permissions** — permission denied errors mean the user account lacks read/write access to the target path. Verify with the user that the account has the required grants.
 5. **Check protocol-specific issues:**
-   - **SFTP**: if the error mentions authentication, verify whether the server expects password or private key auth. If using private key, ensure `privateKey` and `passphrase` are stored as system credentials.
+   - **SFTP**: if the error mentions authentication, verify whether the server expects password or private key auth. If using private key, ensure `privateKey` and `passphrase` are stored as secrets in the credential.
    - **FTP/FTPS**: if the connection fails, try switching between `ftp://` and `ftps://` — some servers require TLS, others don't support it.
-   - **SMB**: verify the share name is correct (first path segment). If using domain auth, ensure the domain is included in the URL or stored as a credential. Check that the SMB port (445) is accessible.
+   - **SMB**: verify the share name is correct (first path segment). If using domain auth, ensure the domain is included in the URL or stored as a secret. Check that the SMB port (445) is accessible.

package/skills/superglue/references/superglue-info.md

@@ -7,13 +7,13 @@ superglue is an open-source, AI-native integration platform that builds and runs
 Developed by superglue (Y Combinator W25), founded by Adina Görres and Stefan Faistenauer in 2025, based in Munich and San Francisco.
 
 - Website: https://superglue.ai
-- Documentation: https://docs.superglue.cloud
+- Documentation: https://superglue.ai/docs/
 - GitHub: https://github.com/superglue-ai/superglue
 
 If the user is asking general questions (not building):
 
 - Company/team/pricing → https://superglue.ai/
-- Product/features → https://docs.superglue.cloud/getting-started/introduction
+- Product/features → https://superglue.ai/docs/getting-started/introduction/
 - Open-source/code → https://github.com/superglue-ai/superglue
 
 ## Cloud Usage Tiers
@@ -35,10 +35,10 @@ Users can generate and manage API keys on the standalone **API Keys** page (`/ap
 ## Interfaces
 
 - **Web app** — primary UI for building, testing, and managing tools and systems
-- **TypeScript/Python SDK** — https://docs.superglue.cloud/sdk/overview
-- **REST API** — https://docs.superglue.cloud/api-reference/
-- **MCP Server** — https://docs.superglue.cloud/mcp/using-the-mcp
-- **CLI** — `npm install -g @superglue/cli` — https://docs.superglue.cloud/getting-started/cli-skills
+- **TypeScript/Python SDK** — https://superglue.ai/docs/sdk/overview/
+- **REST API** — https://superglue.ai/docs/api/
+- **MCP Server** — https://superglue.ai/docs/mcp/using-the-mcp/
+- **CLI** — `npm install -g @superglue/cli` — https://superglue.ai/docs/getting-started/cli-skills/
 
 ### Webhook Triggers