@walkeros/mcp 4.2.1 → 4.2.2-next-1782892388850

package/dist/index.js

@@ -1040,7 +1040,7 @@ function registerDeployTool(server, client) {
 import { z as z5 } from "zod";
 import { mcpResult as mcpResult5, mcpError as mcpError5 } from "@walkeros/core";
 var TITLE5 = "Secret Management";
-var DESCRIPTION5 = "Manage a flow\u2019s secrets (the $env.<NAME> values its steps reference at deploy/run time). Actions: list (metadata only), set (create), update (rotate value), delete. Secrets are write-mostly: values are encrypted at rest and are NEVER returned, listed, or echoed. Reference a secret from a flow step as $env.<NAME>.";
+var DESCRIPTION5 = "Manage a flow\u2019s managed secrets (the $secret.<NAME> values its steps reference at deploy/run time). Actions: list (metadata only), set (create), update (rotate value), delete. Secrets are write-mostly: values are encrypted at rest and are NEVER returned, listed, or echoed. Reference a secret from a flow step as $secret.<NAME>. Credentials, tokens, and private keys must use $secret, not $env: the deploy pipeline only injects values referenced as $secret.<NAME> into the server runner. Server flows only.";
 var inputSchema5 = {
   action: z5.enum(["list", "set", "update", "delete"]).describe("Secret management action to perform"),
   projectId: z5.string().optional().describe(
@@ -1053,7 +1053,7 @@ var inputSchema5 = {
     /^[A-Z_][A-Z0-9_]*$/,
     "Secret name must be uppercase letters, digits, and underscores, starting with a letter or underscore."
   ).optional().describe(
-    "Secret name (UPPER_SNAKE_CASE). Required for set. Referenced in flows as $env.<NAME>."
+    "Secret name (UPPER_SNAKE_CASE). Required for set. Referenced in flows as $secret.<NAME>."
   ),
   value: z5.string().min(1).max(65536).optional().describe(
     "Secret value (1-65536 chars). Required for set and update. Write-only: never returned or logged."
@@ -1100,7 +1100,7 @@ async function secretManageHandlerBody(client, input) {
         });
         return mcpResult5(data, {
           next: [
-            "Reference a listed secret from a flow step as $env.<NAME>.",
+            "Reference a listed secret from a flow step as $secret.<NAME>.",
             'Use action "set" to add a secret or "update" to rotate one.'
           ]
         });
@@ -1116,7 +1116,7 @@ async function secretManageHandlerBody(client, input) {
           value
         });
         return mcpResult5(created, {
-          next: [`Reference it in this flow as $env.${name}.`]
+          next: [`Reference it in this flow as $secret.${name}.`]
         });
       }
       case "update": {
@@ -1217,7 +1217,7 @@ async function feedbackHandlerBody(client, input) {
     const isAnonymous = explicitAnonymous ?? anonymous ?? true;
     await client.submitFeedback(text, {
       anonymous: isAnonymous,
-      version: "4.2.1"
+      version: "4.2.2-next-1782892388850"
     });
     return mcpResult6({ ok: true });
   } catch (error) {
@@ -1955,7 +1955,7 @@ var NPM_SEARCH_URL = "https://registry.npmjs.org/-/v1/search";
 var JSDELIVR_BASE = "https://cdn.jsdelivr.net/npm";
 var WALKEROS_JSON_PATH = "dist/walkerOS.json";
 var CACHE_TTL = 5 * 60 * 1e3;
-var CLIENT_HEADER = "walkeros-mcp/4.2.1";
+var CLIENT_HEADER = "walkeros-mcp/4.2.2-next-1782892388850";
 function getPackageBaseUrl() {
   return process.env.WALKEROS_APP_URL || void 0;
 }
@@ -16227,13 +16227,13 @@ function registerReferenceResources(server) {
               patterns: {
                 "$var.name": "Variable reference. Whole-string preserves native type (object, array, scalar). Inline interpolation requires a scalar. Reusable fragments (mapping templates, matcher lists, consent objects) live in the variables block and are referenced by name.",
                 "$var.name.deep.path": "Deep-path access into a structured variable. Walks nested keys/indices. Whole-string preserves type at the leaf; inline still requires a scalar leaf.",
-                "$env.NAME": "Environment variable. $env.GA_ID reads process.env.GA_ID.",
+                "$env.NAME": "Environment variable, resolved at bundle/deploy time. $env.GA_ID reads process.env.GA_ID. Use for non-secret config (IDs, hostnames, regions), never for credentials.",
                 "$env.NAME:default": "Environment variable with fallback. $env.GA_ID:G-DEFAULT (the `:` is the literal default separator).",
                 "$contract.name": "Contract reference. Links to a named contract for validation.",
                 "$contract.name.path": "Nested contract access. $contract.ecommerce.product.",
                 "$code:(expr)": "Inline JavaScript. $code:(event) => event.data.price * 100 (the `:` carries the raw-code payload).",
                 "$store.storeId": "Store injection in env values. Wires runtime store access.",
-                "$secret.NAME": "Secret injection. Resolved server-side at deploy/runtime."
+                "$secret.NAME": "Managed secret injection (created via the secret manager). The deploy pipeline detects $secret.NAME references and injects the secret value into the server runner\u2019s environment at runtime. Use for credentials, tokens, and private keys. Server flows only; $env does NOT inject managed secrets."
               },
               cascade: {
                 priority: [
@@ -16556,7 +16556,7 @@ Every component in a flow is a **step**: sources capture events, transformers pr
 
 - **Mapping** transforms events using data/map/loop/set/condition rules. Same syntax on sources and destinations. Mapping rules use NESTED entity \u2192 action keying: event name "product add" maps to \`{ "product": { "add": Rule } }\`. Wildcards: \`{ "*": { "view": Rule } }\`.
 - **Contracts** define event schemas using entity-action keying. Can generate FROM mappings or scaffold mappings FROM contracts.
-- **Variables** ($var, $env, $code, $store) enable DRY, environment-aware config. Whole-string \`$var.name\` references preserve native type (object/array/scalar); inline interpolation requires a scalar. Deep paths via \`$var.name.deep.path\`.
+- **Variables** ($var, $env, $secret, $code, $store) enable DRY, environment-aware config. \`$var.name\` is a reusable flow variable from the top-level \`variables\` block; whole-string refs preserve native type (object/array/scalar), inline interpolation requires a scalar, deep paths via \`$var.name.deep.path\`. \`$env.NAME[:default]\` is an environment variable resolved at bundle/deploy time (non-secret config only). \`$secret.NAME\` is a managed secret the deploy pipeline injects into the server runner at runtime; credentials, tokens, and private keys must use \`$secret\`, not \`$env\`.
 - **Consent** gates destinations, mapping rules, and individual fields. Privacy-first by design.
 - **Routing** wires steps via \`next\` (pre-collector) and \`before\` (post-collector). A route is a string ID, a sequence (\`["a", "b"]\`), or a RouteConfig (\`{ match?, next }\` or \`{ match?, one: [...] }\`). The \`one\` operator dispatches first-match against an ordered list of branches. Use \`many\` (instead of \`one\`) when every matching entry should run as an independent parallel flow \u2014 restricted to pre-collector positions. The optional \`match\` field is omitted to mean always-match (no wildcard literal).
 - **Pass-through steps** are transformer entries with no \`code\` and no \`package\`. The runtime synthesizes the push for them automatically. Three flavors share this shape: a \`before\` / \`next\`-only step (named hop reusable across destinations), a \`cache\`-only step (dedup, rate-limit), and a \`mapping\`-only step (declarative event-to-event transform). A pass-through must declare at least one of \`before\`, \`next\`, \`cache\`, or \`mapping\`.
@@ -16980,7 +16980,7 @@ var TOOL_DEFINITIONS = [
   {
     name: "secret_manage",
     title: "Secret Management",
-    description: "Manage a flow\u2019s secrets (the $env.<NAME> values its steps reference at deploy/run time). Actions: list (metadata only), set (create), update (rotate value), delete. Secrets are write-mostly: values are encrypted at rest and are NEVER returned, listed, or echoed.",
+    description: "Manage a flow\u2019s managed secrets (the $secret.<NAME> values its steps reference at deploy/run time). Actions: list (metadata only), set (create), update (rotate value), delete. Secrets are write-mostly: values are encrypted at rest and are NEVER returned, listed, or echoed. Reference a secret from a flow step as $secret.<NAME> (credentials, tokens, and private keys use $secret, not $env).",
     inputSchema: {
       action: z16.enum(["list", "set", "update", "delete"]),
       projectId: z16.string().optional(),