deepline 0.1.133 → 0.1.135

package/dist/bundling-sources/apps/play-runner-workers/src/entry.ts

@@ -49,6 +49,11 @@ import {
   type GovernanceSnapshot,
   type PlayExecutionGovernor,
 } from '../../../shared_libs/play-runtime/governor/governor';
+import {
+  CTX_FETCH_EGRESS_PROVIDER,
+  CTX_FETCH_EGRESS_TOOL_ID,
+  resolveBuiltinPacing,
+} from '../../../shared_libs/play-runtime/builtin-pacing';
 import {
   CoordinatorRateStateBackend,
   type CoordinatorRatePort,
@@ -151,6 +156,7 @@ import { normalizePlayRunFailure } from '../../../shared_libs/play-runtime/run-f
 import { createSecretRedactionContext } from '../../../shared_libs/play-runtime/secret-redaction';
 import {
   assertNoSecretTaint,
+  assertSecretAuthUsesTls,
   createBearerSecretAuth,
   createHeaderSecretAuth,
   createSecretHandle,
@@ -165,6 +171,7 @@ import { safePublicFetch } from '../../../shared_libs/security/safe-fetch';
 import {
   assertPublicHttpUrl,
   isIpAddressLiteral,
+  normalizeUrlHostname,
   UnsafeOutboundUrlError,
 } from '../../../shared_libs/security/outbound-url-policy';
 import type {
@@ -475,6 +482,7 @@ async function probeHarnessOnce(
  */
 const RUNTIME_API_TIMEOUT_MS = 30_000;
 const RUNTIME_API_PLAY_RUN_TIMEOUT_MS = 75_000;
+const RUNTIME_API_EGRESS_FETCH_TIMEOUT_MS = 180_000;
 const RUNTIME_API_INTEGRATION_EXECUTE_TIMEOUT_MS = 180_000;
 const RUNTIME_API_RETRY_DELAYS_MS = [
   250, 750, 1500, 3000, 5000, 10000,
@@ -488,9 +496,11 @@ async function fetchRuntimeApi(
   const timeoutMs =
     path === '/api/v2/plays/run'
       ? RUNTIME_API_PLAY_RUN_TIMEOUT_MS
-      : /^\/api\/v2\/integrations\/[^/]+\/execute$/.test(path)
-        ? RUNTIME_API_INTEGRATION_EXECUTE_TIMEOUT_MS
-        : RUNTIME_API_TIMEOUT_MS;
+      : path === '/api/v2/plays/internal/egress-fetch'
+        ? RUNTIME_API_EGRESS_FETCH_TIMEOUT_MS
+        : /^\/api\/v2\/integrations\/[^/]+\/execute$/.test(path)
+          ? RUNTIME_API_INTEGRATION_EXECUTE_TIMEOUT_MS
+          : RUNTIME_API_TIMEOUT_MS;
   const controller = new AbortController();
   let timeout: ReturnType<typeof setTimeout> | null = null;
   const timeoutPromise = new Promise<never>((_, reject) => {
@@ -2313,6 +2323,20 @@ type WorkerFetchResponse = {
   json: unknown | null;
 };
 
+type WorkerFetchBodyDescriptor =
+  | { kind: 'none' }
+  | { kind: 'string'; value: string }
+  | { kind: 'urlSearchParams'; value: string };
+
+type RuntimeEgressFetchPayload = {
+  url: string;
+  method: string;
+  headers: Record<string, string>;
+  body: WorkerFetchBodyDescriptor;
+  redirect?: RequestInit['redirect'];
+  sensitiveHeaders: string[];
+};
+
 function normalizeFetchHeaders(
   headers: RequestInit['headers'],
 ): Record<string, string> {
@@ -2344,6 +2368,19 @@ function fetchBodyIdentity(body: RequestInit['body']): string | null {
   );
 }
 
+function fetchBodyDescriptor(
+  body: RequestInit['body'],
+): WorkerFetchBodyDescriptor {
+  if (body === undefined || body === null) return { kind: 'none' };
+  if (typeof body === 'string') return { kind: 'string', value: body };
+  if (body instanceof URLSearchParams) {
+    return { kind: 'urlSearchParams', value: body.toString() };
+  }
+  throw new Error(
+    'ctx.fetch(...) in the Workers backend only supports string or URLSearchParams request bodies for egress.',
+  );
+}
+
 function parseFetchJsonOrNull(bodyText: string): unknown | null {
   if (!bodyText.trim()) return null;
   try {
@@ -2371,7 +2408,7 @@ async function safeWorkerPublicFetch(
         !allowedOrigins.has(url.origin)
       ) {
         throw new UnsafeOutboundUrlError(
-          'workers_edge ctx.fetch requires a public IP literal target or Deepline runtime origin. Use a Deepline integration tool for other hostname URLs.',
+          'workers_edge direct fetch is reserved for public IP literals and Deepline runtime origins. Public hostnames must go through the Deepline egress endpoint with safeOutboundFetch.',
         );
       }
       return fetch(url, nextInit);
@@ -2379,6 +2416,121 @@ async function safeWorkerPublicFetch(
   });
 }
 
+function isDeeplineControlledWorkerFetchHost(hostname: string): boolean {
+  const normalized = normalizeUrlHostname(hostname);
+  return (
+    normalized === 'deepline.com' ||
+    normalized.endsWith('.deepline.com') ||
+    normalized === 'deeplinedeveloper.com' ||
+    normalized.endsWith('.deeplinedeveloper.com')
+  );
+}
+
+function shouldUseRuntimeEgressFetch(
+  input: string | URL,
+  allowedOrigins: Iterable<string>,
+): boolean {
+  const url = assertPublicHttpUrl(input);
+  const allowedOriginSet = new Set(allowedOrigins);
+  if (allowedOriginSet.has(url.origin)) return false;
+  if (isIpAddressLiteral(url.hostname)) return false;
+  if (isDeeplineControlledWorkerFetchHost(url.hostname)) {
+    throw new UnsafeOutboundUrlError(
+      'ctx.fetch cannot call a non-runtime Deepline-owned origin from workers_edge. Use the run runtime origin or a Deepline integration tool.',
+    );
+  }
+  return true;
+}
+
+function shouldPaceWorkerEgressFetch(
+  input: string | URL,
+  allowedOrigins: Iterable<string>,
+): boolean {
+  const url = assertPublicHttpUrl(input);
+  return !new Set(allowedOrigins).has(url.origin);
+}
+
+function isWorkerFetchResponse(value: unknown): value is WorkerFetchResponse {
+  if (!isRecord(value)) return false;
+  return (
+    typeof value.ok === 'boolean' &&
+    typeof value.status === 'number' &&
+    typeof value.statusText === 'string' &&
+    typeof value.url === 'string' &&
+    isRecord(value.headers) &&
+    Object.values(value.headers).every((entry) => typeof entry === 'string') &&
+    typeof value.bodyText === 'string' &&
+    'json' in value
+  );
+}
+
+async function postRuntimeEgressFetch(
+  req: RunRequest,
+  payload: RuntimeEgressFetchPayload,
+  onProviderBackpressure?: (retryAfterMs: number) => void,
+  onRetryAttempt?: () => void,
+): Promise<WorkerFetchResponse> {
+  let lastError: Error | null = null;
+  for (
+    let attempt = 1;
+    attempt <= WORKER_TOOL_RATE_LIMIT_MAX_ATTEMPTS;
+    attempt += 1
+  ) {
+    const response = await fetchRuntimeApi(
+      req.baseUrl,
+      '/api/v2/plays/internal/egress-fetch',
+      {
+        method: 'POST',
+        headers: {
+          authorization: `Bearer ${req.executorToken}`,
+          'content-type': 'application/json',
+        },
+        body: JSON.stringify(payload),
+      },
+    );
+    const bodyText = await response.text();
+    let parsed: unknown = null;
+    try {
+      parsed = bodyText.trim() ? JSON.parse(bodyText) : null;
+    } catch {
+      parsed = null;
+    }
+    if (response.ok) {
+      if (!isWorkerFetchResponse(parsed)) {
+        throw new Error(
+          'ctx.fetch egress returned an invalid response payload.',
+        );
+      }
+      return parsed;
+    }
+
+    const message =
+      isRecord(parsed) && typeof parsed.error === 'string'
+        ? parsed.error
+        : bodyText || `HTTP ${response.status}`;
+    lastError = new Error(`ctx.fetch egress failed: ${message}`);
+    if (response.status !== 429) {
+      throw lastError;
+    }
+
+    const retryAfterSeconds = Number(response.headers.get('retry-after'));
+    const retryAfterMs =
+      Number.isFinite(retryAfterSeconds) && retryAfterSeconds > 0
+        ? Math.ceil(retryAfterSeconds * 1000)
+        : 1_000;
+    onProviderBackpressure?.(retryAfterMs);
+    if (attempt >= WORKER_TOOL_RATE_LIMIT_MAX_ATTEMPTS) {
+      throw lastError;
+    }
+    onRetryAttempt?.();
+    await sleepWorkerMs(
+      Math.min(5_000, Math.max(retryAfterMs, attempt * 1000)),
+    );
+  }
+
+  throw lastError ?? new Error('ctx.fetch egress failed before execution.');
+}
+
 function normalizeAllowedWorkerFetchOrigin(rawUrl: string): string | null {
   try {
     return assertPublicHttpUrl(rawUrl).origin;
@@ -3172,6 +3324,8 @@ function createWorkerPacingResolver(req: RunRequest): WorkerPacingResolver {
   return (toolId: string) => {
     const normalized = String(toolId || '').trim();
     if (!normalized) return Promise.resolve(null);
+    const builtin = resolveBuiltinPacing(normalized);
+    if (builtin) return Promise.resolve(builtin);
     const cached = cache.get(normalized);
     if (cached) return cached;
     const promise = (async () => {
@@ -5378,6 +5532,11 @@ function createMinimalWorkerCtx(
       if (init.auth !== undefined && !isSecretAuth(init.auth)) {
         throw new Error('ctx.fetch auth must come from ctx.secrets.');
       }
+      // Keep the boundary unmistakable: customer code may intentionally attach a
+      // customer-owned secret to an outbound auth header, but Deepline must never
+      // send that secret over plaintext HTTP. Non-secret arbitrary HTTP egress can
+      // still use the generic_http lane; secret-bearing ctx.fetch requires TLS.
+      assertSecretAuthUsesTls(init.auth, input, 'ctx.fetch');
       const url = input.toString();
       const method = (init.method ?? 'GET').toUpperCase();
       const secretHeaderMarkers = secretAuthHeaderMarkers(init.auth);
@@ -5406,26 +5565,77 @@ function createMinimalWorkerCtx(
           ...normalizeFetchHeaders(init.headers),
           ...secretHeaders,
         };
-        const fetchInit = { ...init, headers };
-        delete fetchInit.auth;
-        const response = await safeWorkerPublicFetch(url, fetchInit, {
-          allowedOrigins: getAllowedWorkerFetchOrigins(req),
-          sensitiveHeaders: Object.keys(secretHeaderMarkers),
-        });
-        assertNotAborted(abortSignal);
-        const bodyText = await response.text();
-        const redactedBodyText = secretRedactor.redactString(bodyText);
-        return {
-          ok: response.ok,
-          status: response.status,
-          statusText: response.statusText,
-          url: response.url,
-          headers: secretRedactor.redact(
-            Object.fromEntries(response.headers.entries()),
-          ) as Record<string, string>,
-          bodyText: redactedBodyText,
-          json: secretRedactor.redact(parseFetchJsonOrNull(bodyText)),
-        };
+        const allowedOrigins = getAllowedWorkerFetchOrigins(req);
+        const useRuntimeEgressFetch = shouldUseRuntimeEgressFetch(
+          url,
+          allowedOrigins,
+        );
+        const egressSlot = shouldPaceWorkerEgressFetch(url, allowedOrigins)
+          ? await governor.acquireToolSlot(CTX_FETCH_EGRESS_TOOL_ID, {
+              signal: abortSignal,
+            })
+          : null;
+        try {
+          if (useRuntimeEgressFetch) {
+            // Customer-authored plays are allowed to call arbitrary public HTTP(S)
+            // endpoints. The thing we must not do is let an isolate perform DNS
+            // resolution for attacker-controlled hostnames and then trust only
+            // pre-fetch URL validation: the original pentest issue was exactly
+            // redirect/DNS-rebinding SSRF into private metadata or Deepline
+            // runtime addresses. Cloudflare Worker fetch does not expose a
+            // connect-time DNS validation hook, so arbitrary hostnames go through
+            // the Deepline Node egress broker, which uses safeOutboundFetch for
+            // every connection and redirect.
+            //
+            // The egressSlot is acquired before the broker call: ctx.fetch and
+            // generic_http_request share the same generic_http pacing bucket, so
+            // switching syntax cannot bypass arbitrary-HTTP egress limits.
+            // Direct Worker fetch below is still limited to runtime origins and
+            // IP literals; public IP literals also consume this slot because
+            // they are customer egress.
+            const egressResponse = await postRuntimeEgressFetch(
+              req,
+              {
+                url,
+                method,
+                headers,
+                body: fetchBodyDescriptor(init.body),
+                redirect: init.redirect,
+                sensitiveHeaders: Object.keys(secretHeaderMarkers),
+              },
+              (retryAfterMs) =>
+                governor.reportProviderBackpressure({
+                  provider: CTX_FETCH_EGRESS_PROVIDER,
+                  retryAfterMs,
+                }),
+              () => governor.chargeBudget('retry'),
+            );
+            assertNotAborted(abortSignal);
+            return secretRedactor.redact(egressResponse);
+          }
+          const fetchInit = { ...init, headers };
+          delete fetchInit.auth;
+          const response = await safeWorkerPublicFetch(url, fetchInit, {
+            allowedOrigins,
+            sensitiveHeaders: Object.keys(secretHeaderMarkers),
+          });
+          assertNotAborted(abortSignal);
+          const bodyText = await response.text();
+          const redactedBodyText = secretRedactor.redactString(bodyText);
+          return {
+            ok: response.ok,
+            status: response.status,
+            statusText: response.statusText,
+            url: response.url,
+            headers: secretRedactor.redact(
+              Object.fromEntries(response.headers.entries()),
+            ) as Record<string, string>,
+            bodyText: redactedBodyText,
+            json: secretRedactor.redact(parseFetchJsonOrNull(bodyText)),
+          };
+        } finally {
+          egressSlot?.release();
+        }
       });
     },
     secrets: {

package/dist/bundling-sources/sdk/src/play.ts

@@ -172,7 +172,9 @@ export type PlayBindings = {
    * Customer-authored play secrets this play is allowed to use at runtime.
    * Values are never bundled or exposed by the SDK; access them with
    * `ctx.secrets.get("NAME")` and approved helpers such as
-   * `ctx.secrets.bearer(handle)`.
+   * `ctx.secrets.bearer(handle)`. Secret-authenticated `ctx.fetch` calls
+   * require an https:// URL so customer secrets never leave Deepline over
+   * plaintext HTTP.
    */
   secrets?: readonly string[];
 };
@@ -817,6 +819,7 @@ export interface DeeplinePlayRuntimeContext {
    * is recorded under `key` so workflow replay sees the same value. Prefer
    * `ctx.tools.execute(...)` for Deepline-managed provider APIs because tools
    * handle auth, retries, rate limits, extraction metadata, and spend tracking.
+   * If `init.auth` comes from `ctx.secrets`, `url` must be https://.
    *
    * @param key - Checkpoint id.
    * @param url - URL to fetch.

package/dist/bundling-sources/sdk/src/release.ts

@@ -101,10 +101,10 @@ export const SDK_RELEASE = {
   // 0.1.108 ships explicit dataset column/tool recompute policy and removes
   // the SDK enrich generator's one-second stale policy.
   // 0.1.110 ships authored V2 prebuilts and required top-level play descriptions.
-  version: '0.1.133',
+  version: '0.1.135',
   apiContract: '2026-06-dataset-column-cell-stale-hard-cutover',
   supportPolicy: {
-    latest: '0.1.133',
+    latest: '0.1.135',
     minimumSupported: '0.1.53',
     deprecatedBelow: '0.1.53',
     commandMinimumSupported: [

package/dist/bundling-sources/shared_libs/play-runtime/builtin-pacing.ts

@@ -0,0 +1,48 @@
+import type { PacingRule } from './governor/rate-state-backend';
+
+export interface BuiltinPacingPolicy {
+  readonly provider: string;
+  readonly rules: readonly PacingRule[];
+}
+
+/**
+ * Shared arbitrary-HTTP egress lane.
+ *
+ * Deepline exposes a first-class `generic_http_request` integration tool, and
+ * play authors also have the more ergonomic `ctx.fetch(...)` primitive. Those
+ * are two user-facing spellings of the same risk: customer-controlled outbound
+ * HTTP to arbitrary public endpoints.
+ *
+ * Do not create a separate `ctx.fetch` provider bucket. Both surfaces must pace
+ * through the existing `generic_http` provider identity so a play cannot bypass
+ * generic HTTP limits by switching syntax.
+ */
+export const GENERIC_HTTP_REQUEST_TOOL_ID = 'generic_http_request';
+export const GENERIC_HTTP_PROVIDER = 'generic_http';
+export const GENERIC_HTTP_PROVIDER_SHARED_RULE_ID =
+  'generic_http:provider_shared';
+export const GENERIC_HTTP_PROVIDER_SHARED_REQUESTS_PER_SECOND = 25;
+
+export const CTX_FETCH_EGRESS_TOOL_ID = GENERIC_HTTP_REQUEST_TOOL_ID;
+export const CTX_FETCH_EGRESS_PROVIDER = GENERIC_HTTP_PROVIDER;
+export const CTX_FETCH_EGRESS_PACING_RULE = {
+  ruleId: GENERIC_HTTP_PROVIDER_SHARED_RULE_ID,
+  requestsPerWindow: GENERIC_HTTP_PROVIDER_SHARED_REQUESTS_PER_SECOND,
+  windowMs: 1000,
+  maxConcurrency: null,
+} satisfies PacingRule;
+
+export const CTX_FETCH_EGRESS_PACING = {
+  provider: CTX_FETCH_EGRESS_PROVIDER,
+  rules: [CTX_FETCH_EGRESS_PACING_RULE],
+} satisfies BuiltinPacingPolicy;
+
+export function resolveBuiltinPacing(
+  toolId: string,
+): { provider: string; rules: PacingRule[] } | null {
+  if (toolId !== CTX_FETCH_EGRESS_TOOL_ID) return null;
+  return {
+    provider: CTX_FETCH_EGRESS_PACING.provider,
+    rules: [...CTX_FETCH_EGRESS_PACING.rules],
+  };
+}

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -35,6 +35,10 @@ import {
   type PacingResolver,
   type PlayExecutionGovernor,
 } from './governor/governor';
+import {
+  CTX_FETCH_EGRESS_TOOL_ID,
+  resolveBuiltinPacing,
+} from './builtin-pacing';
 import { InMemoryRateStateBackend } from './governor/in-memory-rate-state-backend';
 import type { PacingRule } from './governor/rate-state-backend';
 import {
@@ -95,6 +99,7 @@ import {
 } from './secret-redaction';
 import {
   assertNoSecretTaint,
+  assertSecretAuthUsesTls,
   createBearerSecretAuth,
   createHeaderSecretAuth,
   createSecretHandle,
@@ -642,6 +647,8 @@ function createPacingResolver(
   getToolQueueHints: ContextOptions['getToolQueueHints'],
 ): PacingResolver {
   return async (toolId: string) => {
+    const builtin = resolveBuiltinPacing(toolId);
+    if (builtin) return builtin;
     const hints = getToolQueueHints ? await getToolQueueHints(toolId) : [];
     if (hints.length === 0) {
       return null;
@@ -4086,6 +4093,11 @@ export class PlayContextImpl {
     if (init.auth !== undefined && !isSecretAuth(init.auth)) {
       throw new Error('ctx.fetch auth must come from ctx.secrets.');
     }
+    // Secret handles are deliberately resolved at the last possible moment, so
+    // plaintext never lands in durable keys, receipts, map rows, or generic tool
+    // payloads. The one place a customer secret is allowed to leave Deepline is
+    // the requested auth header, and that transport must be TLS.
+    assertSecretAuthUsesTls(init.auth, input, 'ctx.fetch');
     const secretHeaderMarkers = secretAuthHeaderMarkers(init.auth);
 
     return this.executeWithRuntimeReceipt<PlayFetchResponse>(
@@ -4147,71 +4159,89 @@ export class PlayContextImpl {
             }
           }
 
+          // ctx.fetch is arbitrary customer-directed egress. Pace it through
+          // the same generic_http_request lane as the explicit Generic HTTP
+          // integration tool so switching syntax cannot bypass per-org limits.
+          const egressSlot = await this.governor.acquireToolSlot(
+            CTX_FETCH_EGRESS_TOOL_ID,
+          );
           let response: Response | null = null;
-          const canRetryTransport = ['GET', 'HEAD', 'OPTIONS'].includes(method);
-          const { safePublicFetch } = await loadSafeFetch();
-          for (
-            let attempt = 1;
-            attempt <= FETCH_TRANSPORT_MAX_ATTEMPTS;
-            attempt += 1
-          ) {
-            try {
-              response = await safePublicFetch(url, fetchInit, {
-                fetchImpl: this.#options.fetchImpl,
-                sensitiveHeaders: Object.keys(secretHeaderMarkers),
-              });
-              break;
-            } catch (error) {
-              if (isUnsafeOutboundUrlError(error)) {
-                throw error;
-              }
-              const message =
-                error instanceof Error ? error.message : String(error);
-              if (canRetryTransport && attempt < FETCH_TRANSPORT_MAX_ATTEMPTS) {
-                this.log(
-                  `ctx.fetch(${method} ${url}) transport failed on attempt ${attempt}/${FETCH_TRANSPORT_MAX_ATTEMPTS}; retrying: ${message}`,
-                );
-                await new Promise((resolve) =>
-                  setTimeout(resolve, FETCH_TRANSPORT_RETRY_DELAY_MS * attempt),
+          try {
+            const canRetryTransport = ['GET', 'HEAD', 'OPTIONS'].includes(
+              method,
+            );
+            const { safePublicFetch } = await loadSafeFetch();
+            for (
+              let attempt = 1;
+              attempt <= FETCH_TRANSPORT_MAX_ATTEMPTS;
+              attempt += 1
+            ) {
+              try {
+                response = await safePublicFetch(url, fetchInit, {
+                  fetchImpl: this.#options.fetchImpl,
+                  sensitiveHeaders: Object.keys(secretHeaderMarkers),
+                });
+                break;
+              } catch (error) {
+                if (isUnsafeOutboundUrlError(error)) {
+                  throw error;
+                }
+                const message =
+                  error instanceof Error ? error.message : String(error);
+                if (
+                  canRetryTransport &&
+                  attempt < FETCH_TRANSPORT_MAX_ATTEMPTS
+                ) {
+                  this.log(
+                    `ctx.fetch(${method} ${url}) transport failed on attempt ${attempt}/${FETCH_TRANSPORT_MAX_ATTEMPTS}; retrying: ${message}`,
+                  );
+                  await new Promise((resolve) =>
+                    setTimeout(
+                      resolve,
+                      FETCH_TRANSPORT_RETRY_DELAY_MS * attempt,
+                    ),
+                  );
+                  continue;
+                }
+                throw new Error(
+                  `ctx.fetch(${method} ${url}) failed on attempt ${attempt}/${FETCH_TRANSPORT_MAX_ATTEMPTS}: ${message}`,
                 );
-                continue;
               }
+            }
+            if (!response) {
               throw new Error(
-                `ctx.fetch(${method} ${url}) failed on attempt ${attempt}/${FETCH_TRANSPORT_MAX_ATTEMPTS}: ${message}`,
+                `ctx.fetch(${method} ${url}) failed before receiving a response.`,
               );
             }
-          }
-          if (!response) {
-            throw new Error(
-              `ctx.fetch(${method} ${url}) failed before receiving a response.`,
-            );
-          }
-          const bodyText = await response.text();
-          const redactedBodyText = this.secretRedactor.redactString(bodyText);
-          const output: PlayFetchResponse = {
-            ok: response.ok,
-            status: response.status,
-            statusText: response.statusText,
-            url: response.url,
-            headers: this.secretRedactor.redact(
-              Object.fromEntries(response.headers.entries()),
-            ) as Record<string, string>,
-            bodyText: redactedBodyText,
-            json: this.secretRedactor.redact(parseJsonOrNull(bodyText)),
-          };
+            const bodyText = await response.text();
+            const redactedBodyText = this.secretRedactor.redactString(bodyText);
+            const output: PlayFetchResponse = {
+              ok: response.ok,
+              status: response.status,
+              statusText: response.statusText,
+              url: response.url,
+              headers: this.secretRedactor.redact(
+                Object.fromEntries(response.headers.entries()),
+              ) as Record<string, string>,
+              bodyText: redactedBodyText,
+              json: this.secretRedactor.redact(parseJsonOrNull(bodyText)),
+            };
 
-          this.checkpoint.resolvedBoundaries = {
-            ...(this.checkpoint.resolvedBoundaries ?? {}),
-            [boundaryId]: {
-              kind: 'fetch',
-              url,
-              method,
-              output,
-              completedAt: Date.now(),
-            },
-          };
-          this.#options.onBatchComplete?.(this.checkpoint);
-          return output;
+            this.checkpoint.resolvedBoundaries = {
+              ...(this.checkpoint.resolvedBoundaries ?? {}),
+              [boundaryId]: {
+                kind: 'fetch',
+                url,
+                method,
+                output,
+                completedAt: Date.now(),
+              },
+            };
+            this.#options.onBatchComplete?.(this.checkpoint);
+            return output;
+          } finally {
+            egressSlot.release();
+          }
         },
         markSkipped: (output) => {
           this.log(

package/dist/bundling-sources/shared_libs/play-runtime/secret-capability.ts

@@ -94,6 +94,19 @@ export function secretAuthHeaderMarkers(
   return { [auth.header.toLowerCase()]: `[secret:${auth.secret.name}]` };
 }
 
+export function assertSecretAuthUsesTls(
+  auth: SecretAuth | undefined,
+  input: string | URL,
+  sink: string,
+): void {
+  if (!auth) return;
+  const url = input instanceof URL ? input : new URL(input);
+  if (url.protocol === 'https:') return;
+  throw new Error(
+    `${sink} with ctx.secrets auth requires an https:// URL. Customer secrets may only leave Deepline over TLS.`,
+  );
+}
+
 export function assertNoSecretTaint(value: unknown, sink: string): void {
   if (valueContainsSecret(value)) {
     throw new Error(

package/dist/bundling-sources/shared_libs/security/safe-outbound-fetch.ts

@@ -15,6 +15,7 @@ type NodeSafeFetchOptions = {
   maxRedirects?: number;
   maxResponseBytes?: number;
   sensitiveHeaders?: Iterable<string>;
+  validateUrl?: (url: URL) => void;
 };
 
 type PreparedBody = {
@@ -24,6 +25,24 @@ type PreparedBody = {
 
 export { UnsafeOutboundUrlError };
 
+const NULL_BODY_STATUS_CODES = new Set([204, 205, 304]);
+const TRANSPORT_OWNED_REQUEST_HEADERS = new Set([
+  'connection',
+  'content-length',
+  'host',
+  'keep-alive',
+  'proxy-authenticate',
+  'proxy-authorization',
+  'te',
+  'trailer',
+  'transfer-encoding',
+  'upgrade',
+  'forwarded',
+  'x-forwarded-for',
+  'x-forwarded-host',
+  'x-forwarded-proto',
+]);
+
 function cloneHeaders(headers: RequestInit['headers']): Headers {
   return new Headers(headers);
 }
@@ -32,14 +51,34 @@ function deleteHeader(headers: Headers, name: string) {
   if (headers.has(name)) headers.delete(name);
 }
 
+function removeTransportOwnedHeaders(headers: Headers): void {
+  for (const header of TRANSPORT_OWNED_REQUEST_HEADERS) {
+    deleteHeader(headers, header);
+  }
+}
+
+function withContentLength(
+  body: Buffer | string | undefined,
+  headers: Headers,
+): PreparedBody {
+  removeTransportOwnedHeaders(headers);
+  if (body !== undefined) {
+    headers.set(
+      'content-length',
+      String(typeof body === 'string' ? Buffer.byteLength(body) : body.length),
+    );
+  }
+  return { body, headers };
+}
+
 async function prepareBody(init: RequestInit): Promise<PreparedBody> {
   const headers = cloneHeaders(init.headers);
   const body = init.body;
   if (body === undefined || body === null) {
-    return { body: undefined, headers };
+    return withContentLength(undefined, headers);
   }
   if (typeof body === 'string') {
-    return { body, headers };
+    return withContentLength(body, headers);
   }
   if (body instanceof URLSearchParams) {
     if (!headers.has('content-type')) {
@@ -48,19 +87,19 @@ async function prepareBody(init: RequestInit): Promise<PreparedBody> {
         'application/x-www-form-urlencoded;charset=UTF-8',
       );
     }
-    return { body: body.toString(), headers };
+    return withContentLength(body.toString(), headers);
   }
   if (body instanceof ArrayBuffer) {
-    return { body: Buffer.from(body), headers };
+    return withContentLength(Buffer.from(body), headers);
   }
   if (ArrayBuffer.isView(body)) {
-    return {
-      body: Buffer.from(body.buffer, body.byteOffset, body.byteLength),
+    return withContentLength(
+      Buffer.from(body.buffer, body.byteOffset, body.byteLength),
       headers,
-    };
+    );
   }
   if (typeof Blob !== 'undefined' && body instanceof Blob) {
-    return { body: Buffer.from(await body.arrayBuffer()), headers };
+    return withContentLength(Buffer.from(await body.arrayBuffer()), headers);
   }
 
   throw new TypeError(
@@ -80,6 +119,10 @@ function validateResolvedAddress(address: string) {
   }
 }
 
+function responseMustNotHaveBody(method: string, status: number): boolean {
+  return method === 'HEAD' || NULL_BODY_STATUS_CODES.has(status);
+}
+
 const safeLookup: LookupFunction = (hostname, options, callback) => {
   const lookupOptions: dns.LookupAllOptions = {
     all: true,
@@ -129,27 +172,29 @@ function createRequest(
 ): Promise<Response> {
   return new Promise((resolve, reject) => {
     const transport = url.protocol === 'https:' ? https : http;
+    const method = String(init.method ?? 'GET').toUpperCase();
     const request = transport.request(
       url,
       {
-        method: init.method ?? 'GET',
+        method,
         headers: headersToRecord(prepared.headers),
         agent: false,
         lookup: safeLookup,
         signal: init.signal ?? undefined,
       },
       (response) => {
+        const status = response.statusCode ?? 0;
+        const noBodyResponse = responseMustNotHaveBody(method, status);
         const contentLength = Number(response.headers['content-length']);
         if (
+          !noBodyResponse &&
           maxResponseBytes !== undefined &&
           Number.isFinite(contentLength) &&
           contentLength > maxResponseBytes
         ) {
           response.resume();
           reject(
-            new Error(
-              `Response body exceeds ${maxResponseBytes} byte limit.`,
-            ),
+            new Error(`Response body exceeds ${maxResponseBytes} byte limit.`),
           );
           return;
         }
@@ -170,16 +215,21 @@ function createRequest(
             );
             return;
           }
-          chunks.push(buffer);
+          if (!noBodyResponse) {
+            chunks.push(buffer);
+          }
         });
         response.on('error', reject);
         response.on('end', () => {
           resolve(
-            new Response(Buffer.concat(chunks), {
-              status: response.statusCode ?? 0,
-              statusText: response.statusMessage,
-              headers: response.headers as HeadersInit,
-            }),
+            new Response(
+              noBodyResponse ? null : Buffer.concat(chunks),
+              {
+                status,
+                statusText: response.statusMessage,
+                headers: response.headers as HeadersInit,
+              },
+            ),
           );
         });
       },
@@ -241,6 +291,7 @@ export async function safeOutboundFetch(
   const maxRedirects = options.maxRedirects ?? 10;
   const maxResponseBytes = options.maxResponseBytes;
   const sensitiveHeaders = options.sensitiveHeaders ?? [];
+  const validateUrl = options.validateUrl;
   let currentUrl = assertPublicHttpUrl(input);
   let currentInit: RequestInit = { ...init, redirect: 'manual' };
 
@@ -250,6 +301,7 @@ export async function safeOutboundFetch(
     redirectCount += 1
   ) {
     const hostname = normalizeUrlHostname(currentUrl.hostname);
+    validateUrl?.(currentUrl);
     if (isBlockedIpAddress(hostname)) {
       throw new UnsafeOutboundUrlError(
         `Target host "${hostname}" is not allowed.`,

package/dist/cli/index.js

@@ -413,10 +413,10 @@ var SDK_RELEASE = {
   // 0.1.108 ships explicit dataset column/tool recompute policy and removes
   // the SDK enrich generator's one-second stale policy.
   // 0.1.110 ships authored V2 prebuilts and required top-level play descriptions.
-  version: "0.1.133",
+  version: "0.1.135",
   apiContract: "2026-06-dataset-column-cell-stale-hard-cutover",
   supportPolicy: {
-    latest: "0.1.133",
+    latest: "0.1.135",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [
@@ -18916,38 +18916,46 @@ function renderSecret(secret) {
   const scope = secret.scope === "play" && secret.playName ? `play:${secret.playName}` : secret.scope;
   return `${secret.name} (${scope}) - ${secret.status}${secret.hasValue ? ", set" : ", empty"}`;
 }
-async function readHiddenLine(prompt) {
-  if (!import_node_process.stdin.isTTY || !import_node_process.stdout.isTTY) {
+async function readHiddenLine(prompt, streams = {}) {
+  const inputStream = streams.input ?? import_node_process.stdin;
+  const outputStream = streams.output ?? import_node_process.stdout;
+  if (!inputStream.isTTY || !outputStream.isTTY) {
     throw new Error(
       "Secret values must be entered from an interactive TTY. Do not pipe, pass, or script secret values."
     );
   }
-  import_node_process.stdout.write(prompt);
-  const previousRawMode = import_node_process.stdin.isRaw;
-  if (typeof import_node_process.stdin.setRawMode === "function") import_node_process.stdin.setRawMode(true);
+  outputStream.write(prompt);
+  const previousRawMode = inputStream.isRaw;
+  const wasPaused = typeof inputStream.isPaused === "function" ? inputStream.isPaused() : false;
+  if (typeof inputStream.setRawMode === "function") {
+    inputStream.setRawMode(true);
+  }
   let value = "";
-  import_node_process.stdin.resume();
+  inputStream.resume();
   return await new Promise((resolve13, reject) => {
     let settled = false;
     const cleanup = () => {
-      import_node_process.stdin.off("data", onData);
-      import_node_process.stdin.off("end", onEnd);
-      import_node_process.stdin.off("error", onError);
-      if (typeof import_node_process.stdin.setRawMode === "function") {
-        import_node_process.stdin.setRawMode(previousRawMode);
+      inputStream.off("data", onData);
+      inputStream.off("end", onEnd);
+      inputStream.off("error", onError);
+      if (typeof inputStream.setRawMode === "function") {
+        inputStream.setRawMode(previousRawMode);
+      }
+      if (wasPaused) {
+        inputStream.pause();
       }
     };
     const finish = (line) => {
       if (settled) return;
       settled = true;
-      import_node_process.stdout.write("\n");
+      outputStream.write("\n");
       cleanup();
       resolve13(line);
     };
     const fail = (error) => {
       if (settled) return;
       settled = true;
-      import_node_process.stdout.write("\n");
+      outputStream.write("\n");
       cleanup();
       reject(error);
     };
@@ -18979,9 +18987,9 @@ async function readHiddenLine(prompt) {
     };
     const onEnd = () => fail(new Error("Secret input ended before a value was entered."));
     const onError = (error) => fail(error);
-    import_node_process.stdin.on("data", onData);
-    import_node_process.stdin.once("end", onEnd);
-    import_node_process.stdin.once("error", onError);
+    inputStream.on("data", onData);
+    inputStream.once("end", onEnd);
+    inputStream.once("error", onError);
     if (hiddenInputBuffer) {
       const buffered = hiddenInputBuffer;
       hiddenInputBuffer = "";

package/dist/cli/index.mjs

@@ -390,10 +390,10 @@ var SDK_RELEASE = {
   // 0.1.108 ships explicit dataset column/tool recompute policy and removes
   // the SDK enrich generator's one-second stale policy.
   // 0.1.110 ships authored V2 prebuilts and required top-level play descriptions.
-  version: "0.1.133",
+  version: "0.1.135",
   apiContract: "2026-06-dataset-column-cell-stale-hard-cutover",
   supportPolicy: {
-    latest: "0.1.133",
+    latest: "0.1.135",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [
@@ -18932,38 +18932,46 @@ function renderSecret(secret) {
   const scope = secret.scope === "play" && secret.playName ? `play:${secret.playName}` : secret.scope;
   return `${secret.name} (${scope}) - ${secret.status}${secret.hasValue ? ", set" : ", empty"}`;
 }
-async function readHiddenLine(prompt) {
-  if (!input.isTTY || !output.isTTY) {
+async function readHiddenLine(prompt, streams = {}) {
+  const inputStream = streams.input ?? input;
+  const outputStream = streams.output ?? output;
+  if (!inputStream.isTTY || !outputStream.isTTY) {
     throw new Error(
       "Secret values must be entered from an interactive TTY. Do not pipe, pass, or script secret values."
     );
   }
-  output.write(prompt);
-  const previousRawMode = input.isRaw;
-  if (typeof input.setRawMode === "function") input.setRawMode(true);
+  outputStream.write(prompt);
+  const previousRawMode = inputStream.isRaw;
+  const wasPaused = typeof inputStream.isPaused === "function" ? inputStream.isPaused() : false;
+  if (typeof inputStream.setRawMode === "function") {
+    inputStream.setRawMode(true);
+  }
   let value = "";
-  input.resume();
+  inputStream.resume();
   return await new Promise((resolve13, reject) => {
     let settled = false;
     const cleanup = () => {
-      input.off("data", onData);
-      input.off("end", onEnd);
-      input.off("error", onError);
-      if (typeof input.setRawMode === "function") {
-        input.setRawMode(previousRawMode);
+      inputStream.off("data", onData);
+      inputStream.off("end", onEnd);
+      inputStream.off("error", onError);
+      if (typeof inputStream.setRawMode === "function") {
+        inputStream.setRawMode(previousRawMode);
+      }
+      if (wasPaused) {
+        inputStream.pause();
       }
     };
     const finish = (line) => {
       if (settled) return;
       settled = true;
-      output.write("\n");
+      outputStream.write("\n");
       cleanup();
       resolve13(line);
     };
     const fail = (error) => {
       if (settled) return;
       settled = true;
-      output.write("\n");
+      outputStream.write("\n");
       cleanup();
       reject(error);
     };
@@ -18995,9 +19003,9 @@ async function readHiddenLine(prompt) {
     };
     const onEnd = () => fail(new Error("Secret input ended before a value was entered."));
     const onError = (error) => fail(error);
-    input.on("data", onData);
-    input.once("end", onEnd);
-    input.once("error", onError);
+    inputStream.on("data", onData);
+    inputStream.once("end", onEnd);
+    inputStream.once("error", onError);
     if (hiddenInputBuffer) {
       const buffered = hiddenInputBuffer;
       hiddenInputBuffer = "";

package/dist/index.d.mts

@@ -2788,7 +2788,9 @@ type PlayBindings = {
      * Customer-authored play secrets this play is allowed to use at runtime.
      * Values are never bundled or exposed by the SDK; access them with
      * `ctx.secrets.get("NAME")` and approved helpers such as
-     * `ctx.secrets.bearer(handle)`.
+     * `ctx.secrets.bearer(handle)`. Secret-authenticated `ctx.fetch` calls
+     * require an https:// URL so customer secrets never leave Deepline over
+     * plaintext HTTP.
      */
     secrets?: readonly string[];
 };
@@ -3288,6 +3290,7 @@ interface DeeplinePlayRuntimeContext {
      * is recorded under `key` so workflow replay sees the same value. Prefer
      * `ctx.tools.execute(...)` for Deepline-managed provider APIs because tools
      * handle auth, retries, rate limits, extraction metadata, and spend tracking.
+     * If `init.auth` comes from `ctx.secrets`, `url` must be https://.
      *
      * @param key - Checkpoint id.
      * @param url - URL to fetch.

package/dist/index.d.ts

@@ -2788,7 +2788,9 @@ type PlayBindings = {
      * Customer-authored play secrets this play is allowed to use at runtime.
      * Values are never bundled or exposed by the SDK; access them with
      * `ctx.secrets.get("NAME")` and approved helpers such as
-     * `ctx.secrets.bearer(handle)`.
+     * `ctx.secrets.bearer(handle)`. Secret-authenticated `ctx.fetch` calls
+     * require an https:// URL so customer secrets never leave Deepline over
+     * plaintext HTTP.
      */
     secrets?: readonly string[];
 };
@@ -3288,6 +3290,7 @@ interface DeeplinePlayRuntimeContext {
      * is recorded under `key` so workflow replay sees the same value. Prefer
      * `ctx.tools.execute(...)` for Deepline-managed provider APIs because tools
      * handle auth, retries, rate limits, extraction metadata, and spend tracking.
+     * If `init.auth` comes from `ctx.secrets`, `url` must be https://.
      *
      * @param key - Checkpoint id.
      * @param url - URL to fetch.

package/dist/index.js

@@ -284,10 +284,10 @@ var SDK_RELEASE = {
   // 0.1.108 ships explicit dataset column/tool recompute policy and removes
   // the SDK enrich generator's one-second stale policy.
   // 0.1.110 ships authored V2 prebuilts and required top-level play descriptions.
-  version: "0.1.133",
+  version: "0.1.135",
   apiContract: "2026-06-dataset-column-cell-stale-hard-cutover",
   supportPolicy: {
-    latest: "0.1.133",
+    latest: "0.1.135",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [

package/dist/index.mjs

@@ -206,10 +206,10 @@ var SDK_RELEASE = {
   // 0.1.108 ships explicit dataset column/tool recompute policy and removes
   // the SDK enrich generator's one-second stale policy.
   // 0.1.110 ships authored V2 prebuilts and required top-level play descriptions.
-  version: "0.1.133",
+  version: "0.1.135",
   apiContract: "2026-06-dataset-column-cell-stale-hard-cutover",
   supportPolicy: {
-    latest: "0.1.133",
+    latest: "0.1.135",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.1.133",
+  "version": "0.1.135",
   "description": "Deepline SDK + CLI — B2B data enrichment powered by durable cloud execution",
   "license": "MIT",
   "repository": {