deepline 0.2.73 → 0.2.74

package/dist/bundling-sources/sdk/src/play.ts

@@ -149,6 +149,7 @@ import type {
   PlayLooseObject,
   PlayReturnObject as PlayAuthoringReturnObject,
   PlaySecretAuth,
+  PlaySecretAuthInput,
   PlaySecretAwareRequestInit,
   PlaySecretHandle,
   PlaySqlQuery,
@@ -249,6 +250,7 @@ export type SqlListenerEvent<T extends object = Record<string, unknown>> =
 export type SqlQuery = PlaySqlQuery;
 export type SecretHandle = PlaySecretHandle;
 export type SecretAuth = PlaySecretAuth;
+export type SecretAuthInput = PlaySecretAuthInput;
 export type SecretAwareRequestInit = PlaySecretAwareRequestInit;
 export type LoosePlayObject = PlayLooseObject;
 

package/dist/bundling-sources/sdk/src/release.ts

@@ -183,7 +183,7 @@ export const SDK_RELEASE = {
   // 0.2.0 makes Dataset Handles uniformly async-only after 0.1.320 briefly
   // exposed storage-dependent synchronous access. This deliberate minor
   // release keeps lazy paging semantics independent of row residency.
-  version: '0.2.73',
+  version: '0.2.74',
   contracts: {
     api: {
       name: 'sdk-http-api',

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -255,10 +255,12 @@ import {
   createBearerSecretAuth,
   createHeaderSecretAuth,
   createSecretHandle,
-  isSecretAuth,
+  isSecretAuthInput,
+  secretAuthEntries,
   secretAuthHeaderMarkers,
   valueContainsSecret,
   type SecretAuth,
+  type SecretAuthInput,
   type SecretAwareRequestInit,
   type SecretHandle,
 } from './secret-capability';
@@ -2676,7 +2678,15 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     }
   }
 
-  private async resolveSecretAuth(auth: SecretAuth | undefined) {
+  private async resolveSecretAuth(auth: SecretAuthInput | undefined) {
+    const headers: Record<string, string> = {};
+    for (const entry of secretAuthEntries(auth)) {
+      Object.assign(headers, await this.resolveSingleSecretAuth(entry));
+    }
+    return headers;
+  }
+
+  private async resolveSingleSecretAuth(auth: SecretAuth) {
     if (!auth) return {};
     let value: string | null = null;
     if (this.#options.resolveSecret) {
@@ -9648,7 +9658,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         'ctx.fetch does not allow raw secret headers. Use ctx.secrets.bearer(...) or ctx.secrets.header(...).',
       );
     }
-    if (init.auth !== undefined && !isSecretAuth(init.auth)) {
+    if (init.auth !== undefined && !isSecretAuthInput(init.auth)) {
       throw new Error('ctx.fetch auth must come from ctx.secrets.');
     }
     // Secret handles are deliberately resolved at the last possible moment, so

package/dist/bundling-sources/shared_libs/play-runtime/secret-capability.ts

@@ -30,8 +30,10 @@ export type SecretAuth = PlaySecretAuth &
       }
   );
 
+export type SecretAuthInput = SecretAuth | readonly SecretAuth[];
+
 export type SecretAwareRequestInit = PlaySecretAwareRequestInit & {
-  auth?: SecretAuth;
+  auth?: SecretAuthInput;
 };
 
 function isRecord(value: unknown): value is Record<string | symbol, unknown> {
@@ -46,6 +48,22 @@ export function isSecretAuth(value: unknown): value is SecretAuth {
   return isRecord(value) && value[SECRET_AUTH_BRAND] === true;
 }
 
+export function isSecretAuthInput(value: unknown): value is SecretAuthInput {
+  return (
+    isSecretAuth(value) ||
+    (Array.isArray(value) &&
+      value.length > 0 &&
+      value.every((entry) => isSecretAuth(entry)))
+  );
+}
+
+export function secretAuthEntries(
+  auth: SecretAuthInput | undefined,
+): readonly SecretAuth[] {
+  if (!auth) return [];
+  return isSecretAuth(auth) ? [auth] : auth;
+}
+
 export function valueContainsSecret(value: unknown): boolean {
   const pending: unknown[] = [value];
   const seen = new WeakSet<object>();
@@ -107,17 +125,24 @@ export function createHeaderSecretAuth(
 }
 
 export function secretAuthHeaderMarkers(
-  auth: SecretAuth | undefined,
+  auth: SecretAuthInput | undefined,
 ): Record<string, string> {
-  if (!auth) return {};
-  if (auth.kind === 'bearer') {
-    return { authorization: `[secret:${auth.secret.name}]` };
+  const markers: Record<string, string> = {};
+  for (const entry of secretAuthEntries(auth)) {
+    const header =
+      entry.kind === 'bearer' ? 'authorization' : entry.header.toLowerCase();
+    if (markers[header] !== undefined) {
+      throw new Error(
+        `ctx.fetch cannot attach more than one secret to the ${header} header.`,
+      );
+    }
+    markers[header] = `[secret:${entry.secret.name}]`;
   }
-  return { [auth.header.toLowerCase()]: `[secret:${auth.secret.name}]` };
+  return markers;
 }
 
 export function assertSecretAuthUsesTls(
-  auth: SecretAuth | undefined,
+  auth: SecretAuthInput | undefined,
   input: string | URL,
   sink: string,
 ): void {

package/dist/bundling-sources/shared_libs/plays/authoring-contract.ts

@@ -410,6 +410,8 @@ export type PlaySecretAuth = {
   /** Header name, set only when `kind` is `header`. */
   readonly header?: string;
 };
+/** One or more resolved authentication schemes for an outbound request. */
+export type PlaySecretAuthInput = PlaySecretAuth | readonly PlaySecretAuth[];
 /**
  * The `init` accepted by `ctx.fetch`. Same shape as `RequestInit` plus `auth`.
  *
@@ -419,9 +421,9 @@ export type PlaySecretAwareRequestInit = Omit<RequestInit, 'headers'> & {
   /** Ordinary request headers, recorded in the durable receipt. Never interpolate a secret value here — use `auth`. */
   headers?: HeadersInit;
   /**
-   * The single authenticated header for this request. One value, not a list: exactly one `ctx.secrets` auth attaches per `ctx.fetch`. An API wanting two credentialed headers at once — Supabase with both `apikey` and `Authorization` — cannot express both. Put the must-stay-secret credential in `auth`; pass a genuinely non-secret second value in `headers`. If both are secret, the request needs a server-side proxy holding one of them.
+   * One or more secret-backed authentication headers for this request. Pass a single `ctx.secrets` auth for the common case, or an array when an API requires multiple credentialed headers — for example, Supabase with both `apikey` and `Authorization`. Every secret is resolved only while the request is attached, never stored in the durable receipt. Each auth entry must target a distinct header.
    */
-  auth?: PlaySecretAuth;
+  auth?: PlaySecretAuthInput;
 };
 export type PlayLooseObject = { [key: string]: PlayLooseObject };
 
@@ -2464,6 +2466,7 @@ export const PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   'declare const SECRET_HANDLE_BRAND: unique symbol;',
   'export type SecretHandle = { readonly [SECRET_HANDLE_BRAND]: never; readonly name: string; toString(): string; toJSON(): never };',
   "export type SecretAuth = { readonly kind: 'bearer' | 'header'; readonly secret: SecretHandle; readonly header?: string };",
+  'export type SecretAuthInput = SecretAuth | readonly SecretAuth[];',
   'export type PlayInputContract<TInput> = { readonly schema: Record<string, unknown>; readonly __inputType?: TInput };',
   'export type PlayReturnObject = Record<string, unknown> & { readonly _metadata?: never };',
   'export type CsvRenameMap = Record<string, string | readonly string[]>;',
@@ -2512,7 +2515,7 @@ export const PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   `  customerDb: { query<TRow extends Record<string, unknown> = Record<string, unknown>>(statement: SqlQuery, options?: { maxRows?: ${cloudReferenceType('ctx.customerDb.query.options.maxRows')}; timeoutMs?: ${cloudReferenceType('ctx.customerDb.query.options.timeoutMs')} }): Promise<TRow[]> };`,
   `  tool<K extends string>(key: ${cloudReferenceType('ctx.tool.key')}, toolId: K, input: ${cloudReferenceType('ctx.tool.input')}, options?: { description?: ${cloudReferenceType('ctx.tool.options.description')} }): Promise<ToolExecutionOutput<K>>;`,
   '  step<T>(id: string, run: () => T | Promise<T>, options?: RuntimeStepOptions): Promise<T>;',
-  "  fetch(key: string, url: string | URL, init?: RequestInit & { headers?: HeadersInit & { 'Idempotency-Key'?: string; 'X-Idempotency-Key'?: string }; auth?: SecretAuth }, options?: FetchOptions): Promise<PlayFetchResponse>;",
+  "  fetch(key: string, url: string | URL, init?: RequestInit & { headers?: HeadersInit & { 'Idempotency-Key'?: string; 'X-Idempotency-Key'?: string }; auth?: SecretAuthInput }, options?: FetchOptions): Promise<PlayFetchResponse>;",
   '  secrets: { get(name: string): SecretHandle; bearer(secret: SecretHandle): SecretAuth; header(header: string, secret: SecretHandle): SecretAuth };',
   `  runPlay<TOutput = unknown>(key: string, playRef: ${cloudReferenceType('ctx.runPlay.playRef')}, input: ${cloudReferenceType('ctx.runPlay.input')}, options: PlayCallOptions): Promise<TOutput>;`,
   '  log(message: string): void;',

package/dist/cli/index.js

@@ -1044,7 +1044,7 @@ var SDK_RELEASE = {
   // 0.2.0 makes Dataset Handles uniformly async-only after 0.1.320 briefly
   // exposed storage-dependent synchronous access. This deliberate minor
   // release keeps lazy paging semantics independent of row residency.
-  version: "0.2.73",
+  version: "0.2.74",
   contracts: {
     api: {
       name: "sdk-http-api",
@@ -16604,6 +16604,7 @@ var PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   "declare const SECRET_HANDLE_BRAND: unique symbol;",
   "export type SecretHandle = { readonly [SECRET_HANDLE_BRAND]: never; readonly name: string; toString(): string; toJSON(): never };",
   "export type SecretAuth = { readonly kind: 'bearer' | 'header'; readonly secret: SecretHandle; readonly header?: string };",
+  "export type SecretAuthInput = SecretAuth | readonly SecretAuth[];",
   "export type PlayInputContract<TInput> = { readonly schema: Record<string, unknown>; readonly __inputType?: TInput };",
   "export type PlayReturnObject = Record<string, unknown> & { readonly _metadata?: never };",
   "export type CsvRenameMap = Record<string, string | readonly string[]>;",
@@ -16652,7 +16653,7 @@ var PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   `  customerDb: { query<TRow extends Record<string, unknown> = Record<string, unknown>>(statement: SqlQuery, options?: { maxRows?: ${cloudReferenceType("ctx.customerDb.query.options.maxRows")}; timeoutMs?: ${cloudReferenceType("ctx.customerDb.query.options.timeoutMs")} }): Promise<TRow[]> };`,
   `  tool<K extends string>(key: ${cloudReferenceType("ctx.tool.key")}, toolId: K, input: ${cloudReferenceType("ctx.tool.input")}, options?: { description?: ${cloudReferenceType("ctx.tool.options.description")} }): Promise<ToolExecutionOutput<K>>;`,
   "  step<T>(id: string, run: () => T | Promise<T>, options?: RuntimeStepOptions): Promise<T>;",
-  "  fetch(key: string, url: string | URL, init?: RequestInit & { headers?: HeadersInit & { 'Idempotency-Key'?: string; 'X-Idempotency-Key'?: string }; auth?: SecretAuth }, options?: FetchOptions): Promise<PlayFetchResponse>;",
+  "  fetch(key: string, url: string | URL, init?: RequestInit & { headers?: HeadersInit & { 'Idempotency-Key'?: string; 'X-Idempotency-Key'?: string }; auth?: SecretAuthInput }, options?: FetchOptions): Promise<PlayFetchResponse>;",
   "  secrets: { get(name: string): SecretHandle; bearer(secret: SecretHandle): SecretAuth; header(header: string, secret: SecretHandle): SecretAuth };",
   `  runPlay<TOutput = unknown>(key: string, playRef: ${cloudReferenceType("ctx.runPlay.playRef")}, input: ${cloudReferenceType("ctx.runPlay.input")}, options: PlayCallOptions): Promise<TOutput>;`,
   "  log(message: string): void;",

package/dist/cli/index.mjs

@@ -1030,7 +1030,7 @@ var SDK_RELEASE = {
   // 0.2.0 makes Dataset Handles uniformly async-only after 0.1.320 briefly
   // exposed storage-dependent synchronous access. This deliberate minor
   // release keeps lazy paging semantics independent of row residency.
-  version: "0.2.73",
+  version: "0.2.74",
   contracts: {
     api: {
       name: "sdk-http-api",
@@ -16657,6 +16657,7 @@ var PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   "declare const SECRET_HANDLE_BRAND: unique symbol;",
   "export type SecretHandle = { readonly [SECRET_HANDLE_BRAND]: never; readonly name: string; toString(): string; toJSON(): never };",
   "export type SecretAuth = { readonly kind: 'bearer' | 'header'; readonly secret: SecretHandle; readonly header?: string };",
+  "export type SecretAuthInput = SecretAuth | readonly SecretAuth[];",
   "export type PlayInputContract<TInput> = { readonly schema: Record<string, unknown>; readonly __inputType?: TInput };",
   "export type PlayReturnObject = Record<string, unknown> & { readonly _metadata?: never };",
   "export type CsvRenameMap = Record<string, string | readonly string[]>;",
@@ -16705,7 +16706,7 @@ var PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   `  customerDb: { query<TRow extends Record<string, unknown> = Record<string, unknown>>(statement: SqlQuery, options?: { maxRows?: ${cloudReferenceType("ctx.customerDb.query.options.maxRows")}; timeoutMs?: ${cloudReferenceType("ctx.customerDb.query.options.timeoutMs")} }): Promise<TRow[]> };`,
   `  tool<K extends string>(key: ${cloudReferenceType("ctx.tool.key")}, toolId: K, input: ${cloudReferenceType("ctx.tool.input")}, options?: { description?: ${cloudReferenceType("ctx.tool.options.description")} }): Promise<ToolExecutionOutput<K>>;`,
   "  step<T>(id: string, run: () => T | Promise<T>, options?: RuntimeStepOptions): Promise<T>;",
-  "  fetch(key: string, url: string | URL, init?: RequestInit & { headers?: HeadersInit & { 'Idempotency-Key'?: string; 'X-Idempotency-Key'?: string }; auth?: SecretAuth }, options?: FetchOptions): Promise<PlayFetchResponse>;",
+  "  fetch(key: string, url: string | URL, init?: RequestInit & { headers?: HeadersInit & { 'Idempotency-Key'?: string; 'X-Idempotency-Key'?: string }; auth?: SecretAuthInput }, options?: FetchOptions): Promise<PlayFetchResponse>;",
   "  secrets: { get(name: string): SecretHandle; bearer(secret: SecretHandle): SecretAuth; header(header: string, secret: SecretHandle): SecretAuth };",
   `  runPlay<TOutput = unknown>(key: string, playRef: ${cloudReferenceType("ctx.runPlay.playRef")}, input: ${cloudReferenceType("ctx.runPlay.input")}, options: PlayCallOptions): Promise<TOutput>;`,
   "  log(message: string): void;",

package/dist/{compiler-manifest-DFBtSjB2.d.mts → compiler-manifest-DFuz9-0_.d.mts}

@@ -1162,6 +1162,8 @@ type PlaySecretAuth = {
     /** Header name, set only when `kind` is `header`. */
     readonly header?: string;
 };
+/** One or more resolved authentication schemes for an outbound request. */
+type PlaySecretAuthInput = PlaySecretAuth | readonly PlaySecretAuth[];
 /**
  * The `init` accepted by `ctx.fetch`. Same shape as `RequestInit` plus `auth`.
  *
@@ -1171,9 +1173,9 @@ type PlaySecretAwareRequestInit = Omit<RequestInit, 'headers'> & {
     /** Ordinary request headers, recorded in the durable receipt. Never interpolate a secret value here — use `auth`. */
     headers?: HeadersInit;
     /**
-     * The single authenticated header for this request. One value, not a list: exactly one `ctx.secrets` auth attaches per `ctx.fetch`. An API wanting two credentialed headers at once — Supabase with both `apikey` and `Authorization` — cannot express both. Put the must-stay-secret credential in `auth`; pass a genuinely non-secret second value in `headers`. If both are secret, the request needs a server-side proxy holding one of them.
+     * One or more secret-backed authentication headers for this request. Pass a single `ctx.secrets` auth for the common case, or an array when an API requires multiple credentialed headers — for example, Supabase with both `apikey` and `Authorization`. Every secret is resolved only while the request is attached, never stored in the durable receipt. Each auth entry must target a distinct header.
      */
-    auth?: PlaySecretAuth;
+    auth?: PlaySecretAuthInput;
 };
 type PlayLooseObject = {
     [key: string]: PlayLooseObject;

package/dist/{compiler-manifest-DFBtSjB2.d.ts → compiler-manifest-DFuz9-0_.d.ts}

@@ -1162,6 +1162,8 @@ type PlaySecretAuth = {
     /** Header name, set only when `kind` is `header`. */
     readonly header?: string;
 };
+/** One or more resolved authentication schemes for an outbound request. */
+type PlaySecretAuthInput = PlaySecretAuth | readonly PlaySecretAuth[];
 /**
  * The `init` accepted by `ctx.fetch`. Same shape as `RequestInit` plus `auth`.
  *
@@ -1171,9 +1173,9 @@ type PlaySecretAwareRequestInit = Omit<RequestInit, 'headers'> & {
     /** Ordinary request headers, recorded in the durable receipt. Never interpolate a secret value here — use `auth`. */
     headers?: HeadersInit;
     /**
-     * The single authenticated header for this request. One value, not a list: exactly one `ctx.secrets` auth attaches per `ctx.fetch`. An API wanting two credentialed headers at once — Supabase with both `apikey` and `Authorization` — cannot express both. Put the must-stay-secret credential in `auth`; pass a genuinely non-secret second value in `headers`. If both are secret, the request needs a server-side proxy holding one of them.
+     * One or more secret-backed authentication headers for this request. Pass a single `ctx.secrets` auth for the common case, or an array when an API requires multiple credentialed headers — for example, Supabase with both `apikey` and `Authorization`. Every secret is resolved only while the request is attached, never stored in the durable receipt. Each auth entry must target a distinct header.
      */
-    auth?: PlaySecretAuth;
+    auth?: PlaySecretAuthInput;
 };
 type PlayLooseObject = {
     [key: string]: PlayLooseObject;

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { e as PlayRuntimeBackendId, c as PlayCompilerManifest, D as DeeplineError, f as ToolExecutionError, g as ToolExecutionErrorOptions, h as PlayAuthoringColumnMap, i as PlayAuthoringColumnResolver, j as PlayAuthoringRuntimeContext, k as PlayAuthoringConditionalStepResolver, l as PlayAuthoringCsvInput, m as PlayAuthoringCsvOptions, n as PlayAuthoringDatasetBuilder, o as PlayAuthoringDatasetColumnDefinition, p as PlayAuthoringDatasetColumnRunInput, q as ToolExecuteResult, r as PlayAuthoringReferenceLike, s as PlayReturnObject$1, t as PlayAuthoringDefineConfig, u as PlayAuthoringDefinedPlay, v as PlayAuthoringFetchOptions, w as PlayAuthoringFileInput, x as PlayAuthoringBindings, y as PlayAuthoringCallExecution, z as PlayAuthoringCallOptions, A as PlayAuthoringFetchResponse, B as PlayAuthoringInputContract, C as PlayAuthoringStepProgramStep, E as PlayAuthoringRuntimeStepOptions, F as PlaySqlListenerDeclaration, G as PlaySqlListenerEvent, H as PlaySqlListenerOperation, I as PlaySqlQuery, J as PlayAuthoringStepOptions, K as PlayAuthoringStepProgram, L as PlayAuthoringStepProgramResolver, M as PlayAuthoringStepResolver, N as PlayToolExecutionRequest, O as PlayAuthoringStepProgramOptions } from './compiler-manifest-DFBtSjB2.mjs';
-export { Q as DEEPLINE_EXTRACTOR_TARGETS, R as DEEPLINE_EXTRACTOR_TARGET_DEFINITIONS, S as DeeplineEmailStatusGetterValue, U as DeeplineExtractorTarget, V as DeeplineGetterValue, W as DeeplineGetterValueMap, X as JOB_CHANGE_STATUS_VALUES, Y as JobChangeStatus, Z as PHONE_STATUS_VALUES, _ as PhoneStatus, $ as PlayDataset, a0 as PlayDatasetInput, a1 as PreviousCell, a2 as ProviderTransientError, a3 as ProviderTransientErrorCategory, a4 as ProviderUnavailableError, a5 as ProviderUnavailableReason, a6 as ToolExecutionErrorCategory, a7 as ToolExecutionErrorOrigin, a8 as ToolExecutionFailureV1, a9 as ToolExecutionNetworkKind, aa as ToolExecutionNetworkScope, ab as getProviderUnavailableReason, ac as isDeeplineExtractorTarget, ad as isProviderUnavailable, ae as isProviderWaterfallUnavailableError } from './compiler-manifest-DFBtSjB2.mjs';
+import { e as PlayRuntimeBackendId, c as PlayCompilerManifest, D as DeeplineError, f as ToolExecutionError, g as ToolExecutionErrorOptions, h as PlayAuthoringColumnMap, i as PlayAuthoringColumnResolver, j as PlayAuthoringRuntimeContext, k as PlayAuthoringConditionalStepResolver, l as PlayAuthoringCsvInput, m as PlayAuthoringCsvOptions, n as PlayAuthoringDatasetBuilder, o as PlayAuthoringDatasetColumnDefinition, p as PlayAuthoringDatasetColumnRunInput, q as ToolExecuteResult, r as PlayAuthoringReferenceLike, s as PlayReturnObject$1, t as PlayAuthoringDefineConfig, u as PlayAuthoringDefinedPlay, v as PlayAuthoringFetchOptions, w as PlayAuthoringFileInput, x as PlayAuthoringBindings, y as PlayAuthoringCallExecution, z as PlayAuthoringCallOptions, A as PlayAuthoringFetchResponse, B as PlayAuthoringInputContract, C as PlayAuthoringStepProgramStep, E as PlayAuthoringRuntimeStepOptions, F as PlaySqlListenerDeclaration, G as PlaySqlListenerEvent, H as PlaySqlListenerOperation, I as PlaySqlQuery, J as PlayAuthoringStepOptions, K as PlayAuthoringStepProgram, L as PlayAuthoringStepProgramResolver, M as PlayAuthoringStepResolver, N as PlayToolExecutionRequest, O as PlayAuthoringStepProgramOptions } from './compiler-manifest-DFuz9-0_.mjs';
+export { Q as DEEPLINE_EXTRACTOR_TARGETS, R as DEEPLINE_EXTRACTOR_TARGET_DEFINITIONS, S as DeeplineEmailStatusGetterValue, U as DeeplineExtractorTarget, V as DeeplineGetterValue, W as DeeplineGetterValueMap, X as JOB_CHANGE_STATUS_VALUES, Y as JobChangeStatus, Z as PHONE_STATUS_VALUES, _ as PhoneStatus, $ as PlayDataset, a0 as PlayDatasetInput, a1 as PreviousCell, a2 as ProviderTransientError, a3 as ProviderTransientErrorCategory, a4 as ProviderUnavailableError, a5 as ProviderUnavailableReason, a6 as ToolExecutionErrorCategory, a7 as ToolExecutionErrorOrigin, a8 as ToolExecutionFailureV1, a9 as ToolExecutionNetworkKind, aa as ToolExecutionNetworkScope, ab as getProviderUnavailableReason, ac as isDeeplineExtractorTarget, ad as isProviderUnavailable, ae as isProviderWaterfallUnavailableError } from './compiler-manifest-DFuz9-0_.mjs';
 import '@sinclair/typebox';
 
 declare const FIXTURE_BEHAVIOR_VERSION: 1;

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { e as PlayRuntimeBackendId, c as PlayCompilerManifest, D as DeeplineError, f as ToolExecutionError, g as ToolExecutionErrorOptions, h as PlayAuthoringColumnMap, i as PlayAuthoringColumnResolver, j as PlayAuthoringRuntimeContext, k as PlayAuthoringConditionalStepResolver, l as PlayAuthoringCsvInput, m as PlayAuthoringCsvOptions, n as PlayAuthoringDatasetBuilder, o as PlayAuthoringDatasetColumnDefinition, p as PlayAuthoringDatasetColumnRunInput, q as ToolExecuteResult, r as PlayAuthoringReferenceLike, s as PlayReturnObject$1, t as PlayAuthoringDefineConfig, u as PlayAuthoringDefinedPlay, v as PlayAuthoringFetchOptions, w as PlayAuthoringFileInput, x as PlayAuthoringBindings, y as PlayAuthoringCallExecution, z as PlayAuthoringCallOptions, A as PlayAuthoringFetchResponse, B as PlayAuthoringInputContract, C as PlayAuthoringStepProgramStep, E as PlayAuthoringRuntimeStepOptions, F as PlaySqlListenerDeclaration, G as PlaySqlListenerEvent, H as PlaySqlListenerOperation, I as PlaySqlQuery, J as PlayAuthoringStepOptions, K as PlayAuthoringStepProgram, L as PlayAuthoringStepProgramResolver, M as PlayAuthoringStepResolver, N as PlayToolExecutionRequest, O as PlayAuthoringStepProgramOptions } from './compiler-manifest-DFBtSjB2.js';
-export { Q as DEEPLINE_EXTRACTOR_TARGETS, R as DEEPLINE_EXTRACTOR_TARGET_DEFINITIONS, S as DeeplineEmailStatusGetterValue, U as DeeplineExtractorTarget, V as DeeplineGetterValue, W as DeeplineGetterValueMap, X as JOB_CHANGE_STATUS_VALUES, Y as JobChangeStatus, Z as PHONE_STATUS_VALUES, _ as PhoneStatus, $ as PlayDataset, a0 as PlayDatasetInput, a1 as PreviousCell, a2 as ProviderTransientError, a3 as ProviderTransientErrorCategory, a4 as ProviderUnavailableError, a5 as ProviderUnavailableReason, a6 as ToolExecutionErrorCategory, a7 as ToolExecutionErrorOrigin, a8 as ToolExecutionFailureV1, a9 as ToolExecutionNetworkKind, aa as ToolExecutionNetworkScope, ab as getProviderUnavailableReason, ac as isDeeplineExtractorTarget, ad as isProviderUnavailable, ae as isProviderWaterfallUnavailableError } from './compiler-manifest-DFBtSjB2.js';
+import { e as PlayRuntimeBackendId, c as PlayCompilerManifest, D as DeeplineError, f as ToolExecutionError, g as ToolExecutionErrorOptions, h as PlayAuthoringColumnMap, i as PlayAuthoringColumnResolver, j as PlayAuthoringRuntimeContext, k as PlayAuthoringConditionalStepResolver, l as PlayAuthoringCsvInput, m as PlayAuthoringCsvOptions, n as PlayAuthoringDatasetBuilder, o as PlayAuthoringDatasetColumnDefinition, p as PlayAuthoringDatasetColumnRunInput, q as ToolExecuteResult, r as PlayAuthoringReferenceLike, s as PlayReturnObject$1, t as PlayAuthoringDefineConfig, u as PlayAuthoringDefinedPlay, v as PlayAuthoringFetchOptions, w as PlayAuthoringFileInput, x as PlayAuthoringBindings, y as PlayAuthoringCallExecution, z as PlayAuthoringCallOptions, A as PlayAuthoringFetchResponse, B as PlayAuthoringInputContract, C as PlayAuthoringStepProgramStep, E as PlayAuthoringRuntimeStepOptions, F as PlaySqlListenerDeclaration, G as PlaySqlListenerEvent, H as PlaySqlListenerOperation, I as PlaySqlQuery, J as PlayAuthoringStepOptions, K as PlayAuthoringStepProgram, L as PlayAuthoringStepProgramResolver, M as PlayAuthoringStepResolver, N as PlayToolExecutionRequest, O as PlayAuthoringStepProgramOptions } from './compiler-manifest-DFuz9-0_.js';
+export { Q as DEEPLINE_EXTRACTOR_TARGETS, R as DEEPLINE_EXTRACTOR_TARGET_DEFINITIONS, S as DeeplineEmailStatusGetterValue, U as DeeplineExtractorTarget, V as DeeplineGetterValue, W as DeeplineGetterValueMap, X as JOB_CHANGE_STATUS_VALUES, Y as JobChangeStatus, Z as PHONE_STATUS_VALUES, _ as PhoneStatus, $ as PlayDataset, a0 as PlayDatasetInput, a1 as PreviousCell, a2 as ProviderTransientError, a3 as ProviderTransientErrorCategory, a4 as ProviderUnavailableError, a5 as ProviderUnavailableReason, a6 as ToolExecutionErrorCategory, a7 as ToolExecutionErrorOrigin, a8 as ToolExecutionFailureV1, a9 as ToolExecutionNetworkKind, aa as ToolExecutionNetworkScope, ab as getProviderUnavailableReason, ac as isDeeplineExtractorTarget, ad as isProviderUnavailable, ae as isProviderWaterfallUnavailableError } from './compiler-manifest-DFuz9-0_.js';
 import '@sinclair/typebox';
 
 declare const FIXTURE_BEHAVIOR_VERSION: 1;

package/dist/index.js

@@ -780,7 +780,7 @@ var SDK_RELEASE = {
   // 0.2.0 makes Dataset Handles uniformly async-only after 0.1.320 briefly
   // exposed storage-dependent synchronous access. This deliberate minor
   // release keeps lazy paging semantics independent of row residency.
-  version: "0.2.73",
+  version: "0.2.74",
   contracts: {
     api: {
       name: "sdk-http-api",

package/dist/index.mjs

@@ -703,7 +703,7 @@ var SDK_RELEASE = {
   // 0.2.0 makes Dataset Handles uniformly async-only after 0.1.320 briefly
   // exposed storage-dependent synchronous access. This deliberate minor
   // release keeps lazy paging semantics independent of row residency.
-  version: "0.2.73",
+  version: "0.2.74",
   contracts: {
     api: {
       name: "sdk-http-api",

package/dist/install-integrity.json

@@ -225,8 +225,8 @@
     "dist/cli/index.d.ts",
     "dist/cli/index.js",
     "dist/cli/index.mjs",
-    "dist/compiler-manifest-DFBtSjB2.d.mts",
-    "dist/compiler-manifest-DFBtSjB2.d.ts",
+    "dist/compiler-manifest-DFuz9-0_.d.mts",
+    "dist/compiler-manifest-DFuz9-0_.d.ts",
     "dist/helpers.d.mts",
     "dist/helpers.d.ts",
     "dist/helpers.js",

package/dist/plays/bundle-play-file.d.mts

@@ -1,5 +1,5 @@
-import { T as ToolExecutionErrorSchemaVersion, P as PlayAuthoringContractEdition, a as PlayArtifactKind$1, b as PlaySandboxRuntimeDeclaration, c as PlayCompilerManifest } from '../compiler-manifest-DFBtSjB2.mjs';
-export { d as PLAY_ARTIFACT_KINDS } from '../compiler-manifest-DFBtSjB2.mjs';
+import { T as ToolExecutionErrorSchemaVersion, P as PlayAuthoringContractEdition, a as PlayArtifactKind$1, b as PlaySandboxRuntimeDeclaration, c as PlayCompilerManifest } from '../compiler-manifest-DFuz9-0_.mjs';
+export { d as PLAY_ARTIFACT_KINDS } from '../compiler-manifest-DFuz9-0_.mjs';
 import '@sinclair/typebox';
 
 type PlayPackageImport = {

package/dist/plays/bundle-play-file.d.ts

@@ -1,5 +1,5 @@
-import { T as ToolExecutionErrorSchemaVersion, P as PlayAuthoringContractEdition, a as PlayArtifactKind$1, b as PlaySandboxRuntimeDeclaration, c as PlayCompilerManifest } from '../compiler-manifest-DFBtSjB2.js';
-export { d as PLAY_ARTIFACT_KINDS } from '../compiler-manifest-DFBtSjB2.js';
+import { T as ToolExecutionErrorSchemaVersion, P as PlayAuthoringContractEdition, a as PlayArtifactKind$1, b as PlaySandboxRuntimeDeclaration, c as PlayCompilerManifest } from '../compiler-manifest-DFuz9-0_.js';
+export { d as PLAY_ARTIFACT_KINDS } from '../compiler-manifest-DFuz9-0_.js';
 import '@sinclair/typebox';
 
 type PlayPackageImport = {

package/dist/plays/bundle-play-file.mjs

@@ -3942,6 +3942,7 @@ var PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   "declare const SECRET_HANDLE_BRAND: unique symbol;",
   "export type SecretHandle = { readonly [SECRET_HANDLE_BRAND]: never; readonly name: string; toString(): string; toJSON(): never };",
   "export type SecretAuth = { readonly kind: 'bearer' | 'header'; readonly secret: SecretHandle; readonly header?: string };",
+  "export type SecretAuthInput = SecretAuth | readonly SecretAuth[];",
   "export type PlayInputContract<TInput> = { readonly schema: Record<string, unknown>; readonly __inputType?: TInput };",
   "export type PlayReturnObject = Record<string, unknown> & { readonly _metadata?: never };",
   "export type CsvRenameMap = Record<string, string | readonly string[]>;",
@@ -3990,7 +3991,7 @@ var PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   `  customerDb: { query<TRow extends Record<string, unknown> = Record<string, unknown>>(statement: SqlQuery, options?: { maxRows?: ${cloudReferenceType("ctx.customerDb.query.options.maxRows")}; timeoutMs?: ${cloudReferenceType("ctx.customerDb.query.options.timeoutMs")} }): Promise<TRow[]> };`,
   `  tool<K extends string>(key: ${cloudReferenceType("ctx.tool.key")}, toolId: K, input: ${cloudReferenceType("ctx.tool.input")}, options?: { description?: ${cloudReferenceType("ctx.tool.options.description")} }): Promise<ToolExecutionOutput<K>>;`,
   "  step<T>(id: string, run: () => T | Promise<T>, options?: RuntimeStepOptions): Promise<T>;",
-  "  fetch(key: string, url: string | URL, init?: RequestInit & { headers?: HeadersInit & { 'Idempotency-Key'?: string; 'X-Idempotency-Key'?: string }; auth?: SecretAuth }, options?: FetchOptions): Promise<PlayFetchResponse>;",
+  "  fetch(key: string, url: string | URL, init?: RequestInit & { headers?: HeadersInit & { 'Idempotency-Key'?: string; 'X-Idempotency-Key'?: string }; auth?: SecretAuthInput }, options?: FetchOptions): Promise<PlayFetchResponse>;",
   "  secrets: { get(name: string): SecretHandle; bearer(secret: SecretHandle): SecretAuth; header(header: string, secret: SecretHandle): SecretAuth };",
   `  runPlay<TOutput = unknown>(key: string, playRef: ${cloudReferenceType("ctx.runPlay.playRef")}, input: ${cloudReferenceType("ctx.runPlay.input")}, options: PlayCallOptions): Promise<TOutput>;`,
   "  log(message: string): void;",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.2.73",
+  "version": "0.2.74",
   "description": "GTM data CLI and TypeScript SDK for coding agents",
   "license": "MIT",
   "homepage": "https://code.deepline.com",