deepline 0.1.134 → 0.1.136

package/dist/bundling-sources/apps/play-runner-workers/src/entry.ts

@@ -156,6 +156,7 @@ import { normalizePlayRunFailure } from '../../../shared_libs/play-runtime/run-f
 import { createSecretRedactionContext } from '../../../shared_libs/play-runtime/secret-redaction';
 import {
   assertNoSecretTaint,
+  assertSecretAuthUsesTls,
   createBearerSecretAuth,
   createHeaderSecretAuth,
   createSecretHandle,
@@ -5531,6 +5532,11 @@ function createMinimalWorkerCtx(
       if (init.auth !== undefined && !isSecretAuth(init.auth)) {
         throw new Error('ctx.fetch auth must come from ctx.secrets.');
       }
+      // Keep the boundary unmistakable: customer code may intentionally attach a
+      // customer-owned secret to an outbound auth header, but Deepline must never
+      // send that secret over plaintext HTTP. Non-secret arbitrary HTTP egress can
+      // still use the generic_http lane; secret-bearing ctx.fetch requires TLS.
+      assertSecretAuthUsesTls(init.auth, input, 'ctx.fetch');
       const url = input.toString();
       const method = (init.method ?? 'GET').toUpperCase();
       const secretHeaderMarkers = secretAuthHeaderMarkers(init.auth);

package/dist/bundling-sources/sdk/src/play.ts

@@ -172,7 +172,9 @@ export type PlayBindings = {
    * Customer-authored play secrets this play is allowed to use at runtime.
    * Values are never bundled or exposed by the SDK; access them with
    * `ctx.secrets.get("NAME")` and approved helpers such as
-   * `ctx.secrets.bearer(handle)`.
+   * `ctx.secrets.bearer(handle)`. Secret-authenticated `ctx.fetch` calls
+   * require an https:// URL so customer secrets never leave Deepline over
+   * plaintext HTTP.
    */
   secrets?: readonly string[];
 };
@@ -817,6 +819,7 @@ export interface DeeplinePlayRuntimeContext {
    * is recorded under `key` so workflow replay sees the same value. Prefer
    * `ctx.tools.execute(...)` for Deepline-managed provider APIs because tools
    * handle auth, retries, rate limits, extraction metadata, and spend tracking.
+   * If `init.auth` comes from `ctx.secrets`, `url` must be https://.
    *
    * @param key - Checkpoint id.
    * @param url - URL to fetch.

package/dist/bundling-sources/sdk/src/release.ts

@@ -101,10 +101,10 @@ export const SDK_RELEASE = {
   // 0.1.108 ships explicit dataset column/tool recompute policy and removes
   // the SDK enrich generator's one-second stale policy.
   // 0.1.110 ships authored V2 prebuilts and required top-level play descriptions.
-  version: '0.1.134',
+  version: '0.1.136',
   apiContract: '2026-06-dataset-column-cell-stale-hard-cutover',
   supportPolicy: {
-    latest: '0.1.134',
+    latest: '0.1.136',
     minimumSupported: '0.1.53',
     deprecatedBelow: '0.1.53',
     commandMinimumSupported: [

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -99,6 +99,7 @@ import {
 } from './secret-redaction';
 import {
   assertNoSecretTaint,
+  assertSecretAuthUsesTls,
   createBearerSecretAuth,
   createHeaderSecretAuth,
   createSecretHandle,
@@ -4092,6 +4093,11 @@ export class PlayContextImpl {
     if (init.auth !== undefined && !isSecretAuth(init.auth)) {
       throw new Error('ctx.fetch auth must come from ctx.secrets.');
     }
+    // Secret handles are deliberately resolved at the last possible moment, so
+    // plaintext never lands in durable keys, receipts, map rows, or generic tool
+    // payloads. The one place a customer secret is allowed to leave Deepline is
+    // the requested auth header, and that transport must be TLS.
+    assertSecretAuthUsesTls(init.auth, input, 'ctx.fetch');
     const secretHeaderMarkers = secretAuthHeaderMarkers(init.auth);
 
     return this.executeWithRuntimeReceipt<PlayFetchResponse>(

package/dist/bundling-sources/shared_libs/play-runtime/secret-capability.ts

@@ -94,6 +94,19 @@ export function secretAuthHeaderMarkers(
   return { [auth.header.toLowerCase()]: `[secret:${auth.secret.name}]` };
 }
 
+export function assertSecretAuthUsesTls(
+  auth: SecretAuth | undefined,
+  input: string | URL,
+  sink: string,
+): void {
+  if (!auth) return;
+  const url = input instanceof URL ? input : new URL(input);
+  if (url.protocol === 'https:') return;
+  throw new Error(
+    `${sink} with ctx.secrets auth requires an https:// URL. Customer secrets may only leave Deepline over TLS.`,
+  );
+}
+
 export function assertNoSecretTaint(value: unknown, sink: string): void {
   if (valueContainsSecret(value)) {
     throw new Error(

package/dist/cli/index.js

@@ -413,10 +413,10 @@ var SDK_RELEASE = {
   // 0.1.108 ships explicit dataset column/tool recompute policy and removes
   // the SDK enrich generator's one-second stale policy.
   // 0.1.110 ships authored V2 prebuilts and required top-level play descriptions.
-  version: "0.1.134",
+  version: "0.1.136",
   apiContract: "2026-06-dataset-column-cell-stale-hard-cutover",
   supportPolicy: {
-    latest: "0.1.134",
+    latest: "0.1.136",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [
@@ -15978,6 +15978,15 @@ function helperSource() {
     `  };`,
     `}`,
     ``,
+    `function __dlBlankPayloadValue(value: unknown): boolean {`,
+    `  return value === null || value === undefined || (typeof value === 'string' && value.trim() === '');`,
+    `}`,
+    ``,
+    `function __dlShouldSkipEmptyPayload(tool: string, payload: Record<string, unknown>): boolean {`,
+    `  if (tool === 'leadmagic_email_validation') return __dlBlankPayloadValue(payload.email);`,
+    `  return false;`,
+    `}`,
+    ``,
     `function __dlAliasCandidates(alias: string): string[] {`,
     `  const aliases: string[] = [];`,
     `  for (const candidate of [alias, alias.replace(/-/g, '_'), alias.replace(/_/g, '-')]) {`,
@@ -16004,6 +16013,7 @@ function helperSource() {
     `    if (!shouldRun) return null;`,
     `  }`,
     `  const payload = __dlRuntimePayload(input.tool, __dlTemplate(input.payload, input.row) as Record<string, unknown>, input.row);`,
+    `  if (__dlShouldSkipEmptyPayload(input.tool, payload)) return null;`,
     `  let result: unknown;`,
     `  try {`,
     `    result = await input.stepCtx.tools.execute({`,

package/dist/cli/index.mjs

@@ -390,10 +390,10 @@ var SDK_RELEASE = {
   // 0.1.108 ships explicit dataset column/tool recompute policy and removes
   // the SDK enrich generator's one-second stale policy.
   // 0.1.110 ships authored V2 prebuilts and required top-level play descriptions.
-  version: "0.1.134",
+  version: "0.1.136",
   apiContract: "2026-06-dataset-column-cell-stale-hard-cutover",
   supportPolicy: {
-    latest: "0.1.134",
+    latest: "0.1.136",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [
@@ -15987,6 +15987,15 @@ function helperSource() {
     `  };`,
     `}`,
     ``,
+    `function __dlBlankPayloadValue(value: unknown): boolean {`,
+    `  return value === null || value === undefined || (typeof value === 'string' && value.trim() === '');`,
+    `}`,
+    ``,
+    `function __dlShouldSkipEmptyPayload(tool: string, payload: Record<string, unknown>): boolean {`,
+    `  if (tool === 'leadmagic_email_validation') return __dlBlankPayloadValue(payload.email);`,
+    `  return false;`,
+    `}`,
+    ``,
     `function __dlAliasCandidates(alias: string): string[] {`,
     `  const aliases: string[] = [];`,
     `  for (const candidate of [alias, alias.replace(/-/g, '_'), alias.replace(/_/g, '-')]) {`,
@@ -16013,6 +16022,7 @@ function helperSource() {
     `    if (!shouldRun) return null;`,
     `  }`,
     `  const payload = __dlRuntimePayload(input.tool, __dlTemplate(input.payload, input.row) as Record<string, unknown>, input.row);`,
+    `  if (__dlShouldSkipEmptyPayload(input.tool, payload)) return null;`,
     `  let result: unknown;`,
     `  try {`,
     `    result = await input.stepCtx.tools.execute({`,

package/dist/index.d.mts

@@ -2788,7 +2788,9 @@ type PlayBindings = {
      * Customer-authored play secrets this play is allowed to use at runtime.
      * Values are never bundled or exposed by the SDK; access them with
      * `ctx.secrets.get("NAME")` and approved helpers such as
-     * `ctx.secrets.bearer(handle)`.
+     * `ctx.secrets.bearer(handle)`. Secret-authenticated `ctx.fetch` calls
+     * require an https:// URL so customer secrets never leave Deepline over
+     * plaintext HTTP.
      */
     secrets?: readonly string[];
 };
@@ -3288,6 +3290,7 @@ interface DeeplinePlayRuntimeContext {
      * is recorded under `key` so workflow replay sees the same value. Prefer
      * `ctx.tools.execute(...)` for Deepline-managed provider APIs because tools
      * handle auth, retries, rate limits, extraction metadata, and spend tracking.
+     * If `init.auth` comes from `ctx.secrets`, `url` must be https://.
      *
      * @param key - Checkpoint id.
      * @param url - URL to fetch.

package/dist/index.d.ts

@@ -2788,7 +2788,9 @@ type PlayBindings = {
      * Customer-authored play secrets this play is allowed to use at runtime.
      * Values are never bundled or exposed by the SDK; access them with
      * `ctx.secrets.get("NAME")` and approved helpers such as
-     * `ctx.secrets.bearer(handle)`.
+     * `ctx.secrets.bearer(handle)`. Secret-authenticated `ctx.fetch` calls
+     * require an https:// URL so customer secrets never leave Deepline over
+     * plaintext HTTP.
      */
     secrets?: readonly string[];
 };
@@ -3288,6 +3290,7 @@ interface DeeplinePlayRuntimeContext {
      * is recorded under `key` so workflow replay sees the same value. Prefer
      * `ctx.tools.execute(...)` for Deepline-managed provider APIs because tools
      * handle auth, retries, rate limits, extraction metadata, and spend tracking.
+     * If `init.auth` comes from `ctx.secrets`, `url` must be https://.
      *
      * @param key - Checkpoint id.
      * @param url - URL to fetch.

package/dist/index.js

@@ -284,10 +284,10 @@ var SDK_RELEASE = {
   // 0.1.108 ships explicit dataset column/tool recompute policy and removes
   // the SDK enrich generator's one-second stale policy.
   // 0.1.110 ships authored V2 prebuilts and required top-level play descriptions.
-  version: "0.1.134",
+  version: "0.1.136",
   apiContract: "2026-06-dataset-column-cell-stale-hard-cutover",
   supportPolicy: {
-    latest: "0.1.134",
+    latest: "0.1.136",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [

package/dist/index.mjs

@@ -206,10 +206,10 @@ var SDK_RELEASE = {
   // 0.1.108 ships explicit dataset column/tool recompute policy and removes
   // the SDK enrich generator's one-second stale policy.
   // 0.1.110 ships authored V2 prebuilts and required top-level play descriptions.
-  version: "0.1.134",
+  version: "0.1.136",
   apiContract: "2026-06-dataset-column-cell-stale-hard-cutover",
   supportPolicy: {
-    latest: "0.1.134",
+    latest: "0.1.136",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.1.134",
+  "version": "0.1.136",
   "description": "Deepline SDK + CLI — B2B data enrichment powered by durable cloud execution",
   "license": "MIT",
   "repository": {