deepline 0.2.73 → 0.3.0

package/dist/cli/index.js

@@ -1044,7 +1044,11 @@ var SDK_RELEASE = {
   // 0.2.0 makes Dataset Handles uniformly async-only after 0.1.320 briefly
   // exposed storage-dependent synchronous access. This deliberate minor
   // release keeps lazy paging semantics independent of row residency.
-  version: "0.2.73",
+  // 0.3.0 introduces raw-v2: complete scrubbed provider responses are
+  // available at toolResponse.rawV2 while toolResponse.raw and all declared
+  // getters keep their established compatibility behavior.
+  version: "0.3.0",
+  updateSummary: "New raw-v2 tool responses preserve complete scrubbed provider envelopes at toolResponse.rawV2, including JSON:API included resources, links, cursors, and totals. Existing toolResponse.raw and declared getters keep working unchanged.",
   contracts: {
     api: {
       name: "sdk-http-api",
@@ -3759,12 +3763,33 @@ function normalizePlayRuntimeEnvironment(value) {
   return typeof value === "string" && PLAY_RUNTIME_ENVIRONMENTS.includes(value) ? value : null;
 }
 
+// ../shared_libs/play-runtime/tool-response-contract.ts
+var RAW_V2_TOOL_RESPONSE_CONTRACT = "raw-v2";
+function legacyRawFromToolResponseRawV2(rawV2, view, responseMeta) {
+  const legacyRaw = view === "data" && rawV2 && typeof rawV2 === "object" && !Array.isArray(rawV2) ? rawV2.data : rawV2;
+  const deeplineBilling = responseMeta?.deepline_billing;
+  if (view === "rawV2" && deeplineBilling !== void 0 && legacyRaw && typeof legacyRaw === "object" && !Array.isArray(legacyRaw)) {
+    return {
+      ...legacyRaw,
+      deepline_billing: deeplineBilling
+    };
+  }
+  return legacyRaw;
+}
+function providerMetaFromToolResponseRawV2(rawV2, view) {
+  if (view !== "data" || !rawV2 || typeof rawV2 !== "object" || Array.isArray(rawV2)) {
+    return void 0;
+  }
+  const meta = rawV2.meta;
+  return meta && typeof meta === "object" && !Array.isArray(meta) ? meta : void 0;
+}
+
 // src/client.ts
 var TERMINAL_PLAY_STATUSES = /* @__PURE__ */ new Set(["completed", "failed", "cancelled"]);
 var INCLUDE_TOOL_METADATA_HEADER = "x-deepline-include-tool-metadata";
 var EXECUTE_RESPONSE_CONTRACT_HEADER = "x-deepline-execute-response-contract";
 var EXECUTE_RESPONSE_INTENT_HEADER = "x-deepline-execute-response-intent";
-var V2_EXECUTE_RESPONSE_CONTRACT = "v2-tool-response";
+var RAW_V2_EXECUTE_RESPONSE_CONTRACT = RAW_V2_TOOL_RESPONSE_CONTRACT;
 var COMPILE_MANIFEST_RETRY_DELAYS_MS = [250, 1e3];
 var REGISTER_PLAY_ARTIFACTS_COMPILE_CONCURRENCY = 3;
 var REGISTER_PLAY_ARTIFACTS_MAX_BATCH_COUNT = 3;
@@ -3979,6 +4004,50 @@ function requireTargetBillingIdempotencyKey(value) {
 function isRecord7(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
+function materializeToolExecutionResponse(response) {
+  const toolResponse = response.toolResponse;
+  if (!toolResponse && isRecord7(response.result)) {
+    const legacyResult = response.result;
+    if (Object.prototype.hasOwnProperty.call(legacyResult, "data")) {
+      const legacyMeta = isRecord7(legacyResult.meta) ? legacyResult.meta : void 0;
+      return {
+        ...response,
+        toolResponse: {
+          raw: legacyResult.data,
+          ...legacyMeta ? { meta: legacyMeta } : {}
+        }
+      };
+    }
+  }
+  if (!toolResponse || Object.prototype.hasOwnProperty.call(toolResponse, "raw")) {
+    return response;
+  }
+  const rawV2 = toolResponse.rawV2;
+  const view = toolResponse.view;
+  const providerMeta = providerMetaFromToolResponseRawV2(
+    rawV2,
+    view ?? "rawV2"
+  );
+  const responseMeta = isRecord7(toolResponse.responseMeta) ? toolResponse.responseMeta : void 0;
+  return {
+    ...response,
+    toolResponse: {
+      ...toolResponse,
+      raw: legacyRawFromToolResponseRawV2(
+        rawV2,
+        view ?? "rawV2",
+        responseMeta
+      ),
+      ...toolResponse.meta || providerMeta || responseMeta ? {
+        meta: {
+          ...toolResponse.meta ?? {},
+          ...providerMeta ?? {},
+          ...responseMeta ?? {}
+        }
+      } : {}
+    }
+  };
+}
 function isPrebuiltPlayDescription(play) {
   return play.origin === "prebuilt" || play.ownerType === "deepline";
 }
@@ -4528,14 +4597,14 @@ var DeeplineClient = class {
    */
   async executeTool(toolId, input2, options) {
     const headers = {
-      [EXECUTE_RESPONSE_CONTRACT_HEADER]: V2_EXECUTE_RESPONSE_CONTRACT,
+      [EXECUTE_RESPONSE_CONTRACT_HEADER]: RAW_V2_EXECUTE_RESPONSE_CONTRACT,
       [TOOL_EXECUTION_ERROR_SCHEMA_HEADER]: String(
         TOOL_EXECUTION_ERROR_SCHEMA_VERSION
       ),
       ...options?.includeToolMetadata ? { [INCLUDE_TOOL_METADATA_HEADER]: "true" } : {},
       [EXECUTE_RESPONSE_INTENT_HEADER]: options?.responseIntent ?? "raw"
     };
-    return this.http.post(
+    const response = await this.http.post(
       `/api/v2/integrations/${encodeURIComponent(toolId)}/execute`,
       {
         payload: input2,
@@ -4549,6 +4618,7 @@ var DeeplineClient = class {
         toolId
       }
     );
+    return materializeToolExecutionResponse(response);
   }
   /**
    * Back-compatible alias for {@link executeTool}.
@@ -16604,6 +16674,7 @@ var PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   "declare const SECRET_HANDLE_BRAND: unique symbol;",
   "export type SecretHandle = { readonly [SECRET_HANDLE_BRAND]: never; readonly name: string; toString(): string; toJSON(): never };",
   "export type SecretAuth = { readonly kind: 'bearer' | 'header'; readonly secret: SecretHandle; readonly header?: string };",
+  "export type SecretAuthInput = SecretAuth | readonly SecretAuth[];",
   "export type PlayInputContract<TInput> = { readonly schema: Record<string, unknown>; readonly __inputType?: TInput };",
   "export type PlayReturnObject = Record<string, unknown> & { readonly _metadata?: never };",
   "export type CsvRenameMap = Record<string, string | readonly string[]>;",
@@ -16652,7 +16723,7 @@ var PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   `  customerDb: { query<TRow extends Record<string, unknown> = Record<string, unknown>>(statement: SqlQuery, options?: { maxRows?: ${cloudReferenceType("ctx.customerDb.query.options.maxRows")}; timeoutMs?: ${cloudReferenceType("ctx.customerDb.query.options.timeoutMs")} }): Promise<TRow[]> };`,
   `  tool<K extends string>(key: ${cloudReferenceType("ctx.tool.key")}, toolId: K, input: ${cloudReferenceType("ctx.tool.input")}, options?: { description?: ${cloudReferenceType("ctx.tool.options.description")} }): Promise<ToolExecutionOutput<K>>;`,
   "  step<T>(id: string, run: () => T | Promise<T>, options?: RuntimeStepOptions): Promise<T>;",
-  "  fetch(key: string, url: string | URL, init?: RequestInit & { headers?: HeadersInit & { 'Idempotency-Key'?: string; 'X-Idempotency-Key'?: string }; auth?: SecretAuth }, options?: FetchOptions): Promise<PlayFetchResponse>;",
+  "  fetch(key: string, url: string | URL, init?: RequestInit & { headers?: HeadersInit & { 'Idempotency-Key'?: string; 'X-Idempotency-Key'?: string }; auth?: SecretAuthInput }, options?: FetchOptions): Promise<PlayFetchResponse>;",
   "  secrets: { get(name: string): SecretHandle; bearer(secret: SecretHandle): SecretAuth; header(header: string, secret: SecretHandle): SecretAuth };",
   `  runPlay<TOutput = unknown>(key: string, playRef: ${cloudReferenceType("ctx.runPlay.playRef")}, input: ${cloudReferenceType("ctx.runPlay.input")}, options: PlayCallOptions): Promise<TOutput>;`,
   "  log(message: string): void;",
@@ -40753,9 +40824,7 @@ function shouldSkipSelfUpdate() {
 function parseSemver(version) {
   const trimmed = version?.trim();
   if (!trimmed) return null;
-  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/.exec(
-    trimmed
-  );
+  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/.exec(trimmed);
   if (!match) return null;
   return {
     major: Number(match[1]),
@@ -40846,7 +40915,12 @@ async function maybeAutoUpdateAndRelaunch(response) {
     );
     return false;
   }
-  process.stderr.write("Deepline SDK/CLI updated; rerunning command.\n");
+  const updateSummary = response.update_summary ? `
+What changed in ${response.update_summary.version}: ${response.update_summary.summary}` : "";
+  process.stderr.write(
+    `Deepline SDK/CLI updated; rerunning command.${updateSummary}
+`
+  );
   const exitCode = await relaunchCurrentCommand(plan);
   process.exit(exitCode);
   return true;

package/dist/cli/index.mjs

@@ -1030,7 +1030,11 @@ var SDK_RELEASE = {
   // 0.2.0 makes Dataset Handles uniformly async-only after 0.1.320 briefly
   // exposed storage-dependent synchronous access. This deliberate minor
   // release keeps lazy paging semantics independent of row residency.
-  version: "0.2.73",
+  // 0.3.0 introduces raw-v2: complete scrubbed provider responses are
+  // available at toolResponse.rawV2 while toolResponse.raw and all declared
+  // getters keep their established compatibility behavior.
+  version: "0.3.0",
+  updateSummary: "New raw-v2 tool responses preserve complete scrubbed provider envelopes at toolResponse.rawV2, including JSON:API included resources, links, cursors, and totals. Existing toolResponse.raw and declared getters keep working unchanged.",
   contracts: {
     api: {
       name: "sdk-http-api",
@@ -3745,12 +3749,33 @@ function normalizePlayRuntimeEnvironment(value) {
   return typeof value === "string" && PLAY_RUNTIME_ENVIRONMENTS.includes(value) ? value : null;
 }
 
+// ../shared_libs/play-runtime/tool-response-contract.ts
+var RAW_V2_TOOL_RESPONSE_CONTRACT = "raw-v2";
+function legacyRawFromToolResponseRawV2(rawV2, view, responseMeta) {
+  const legacyRaw = view === "data" && rawV2 && typeof rawV2 === "object" && !Array.isArray(rawV2) ? rawV2.data : rawV2;
+  const deeplineBilling = responseMeta?.deepline_billing;
+  if (view === "rawV2" && deeplineBilling !== void 0 && legacyRaw && typeof legacyRaw === "object" && !Array.isArray(legacyRaw)) {
+    return {
+      ...legacyRaw,
+      deepline_billing: deeplineBilling
+    };
+  }
+  return legacyRaw;
+}
+function providerMetaFromToolResponseRawV2(rawV2, view) {
+  if (view !== "data" || !rawV2 || typeof rawV2 !== "object" || Array.isArray(rawV2)) {
+    return void 0;
+  }
+  const meta = rawV2.meta;
+  return meta && typeof meta === "object" && !Array.isArray(meta) ? meta : void 0;
+}
+
 // src/client.ts
 var TERMINAL_PLAY_STATUSES = /* @__PURE__ */ new Set(["completed", "failed", "cancelled"]);
 var INCLUDE_TOOL_METADATA_HEADER = "x-deepline-include-tool-metadata";
 var EXECUTE_RESPONSE_CONTRACT_HEADER = "x-deepline-execute-response-contract";
 var EXECUTE_RESPONSE_INTENT_HEADER = "x-deepline-execute-response-intent";
-var V2_EXECUTE_RESPONSE_CONTRACT = "v2-tool-response";
+var RAW_V2_EXECUTE_RESPONSE_CONTRACT = RAW_V2_TOOL_RESPONSE_CONTRACT;
 var COMPILE_MANIFEST_RETRY_DELAYS_MS = [250, 1e3];
 var REGISTER_PLAY_ARTIFACTS_COMPILE_CONCURRENCY = 3;
 var REGISTER_PLAY_ARTIFACTS_MAX_BATCH_COUNT = 3;
@@ -3965,6 +3990,50 @@ function requireTargetBillingIdempotencyKey(value) {
 function isRecord7(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
+function materializeToolExecutionResponse(response) {
+  const toolResponse = response.toolResponse;
+  if (!toolResponse && isRecord7(response.result)) {
+    const legacyResult = response.result;
+    if (Object.prototype.hasOwnProperty.call(legacyResult, "data")) {
+      const legacyMeta = isRecord7(legacyResult.meta) ? legacyResult.meta : void 0;
+      return {
+        ...response,
+        toolResponse: {
+          raw: legacyResult.data,
+          ...legacyMeta ? { meta: legacyMeta } : {}
+        }
+      };
+    }
+  }
+  if (!toolResponse || Object.prototype.hasOwnProperty.call(toolResponse, "raw")) {
+    return response;
+  }
+  const rawV2 = toolResponse.rawV2;
+  const view = toolResponse.view;
+  const providerMeta = providerMetaFromToolResponseRawV2(
+    rawV2,
+    view ?? "rawV2"
+  );
+  const responseMeta = isRecord7(toolResponse.responseMeta) ? toolResponse.responseMeta : void 0;
+  return {
+    ...response,
+    toolResponse: {
+      ...toolResponse,
+      raw: legacyRawFromToolResponseRawV2(
+        rawV2,
+        view ?? "rawV2",
+        responseMeta
+      ),
+      ...toolResponse.meta || providerMeta || responseMeta ? {
+        meta: {
+          ...toolResponse.meta ?? {},
+          ...providerMeta ?? {},
+          ...responseMeta ?? {}
+        }
+      } : {}
+    }
+  };
+}
 function isPrebuiltPlayDescription(play) {
   return play.origin === "prebuilt" || play.ownerType === "deepline";
 }
@@ -4514,14 +4583,14 @@ var DeeplineClient = class {
    */
   async executeTool(toolId, input2, options) {
     const headers = {
-      [EXECUTE_RESPONSE_CONTRACT_HEADER]: V2_EXECUTE_RESPONSE_CONTRACT,
+      [EXECUTE_RESPONSE_CONTRACT_HEADER]: RAW_V2_EXECUTE_RESPONSE_CONTRACT,
       [TOOL_EXECUTION_ERROR_SCHEMA_HEADER]: String(
         TOOL_EXECUTION_ERROR_SCHEMA_VERSION
       ),
       ...options?.includeToolMetadata ? { [INCLUDE_TOOL_METADATA_HEADER]: "true" } : {},
       [EXECUTE_RESPONSE_INTENT_HEADER]: options?.responseIntent ?? "raw"
     };
-    return this.http.post(
+    const response = await this.http.post(
       `/api/v2/integrations/${encodeURIComponent(toolId)}/execute`,
       {
         payload: input2,
@@ -4535,6 +4604,7 @@ var DeeplineClient = class {
         toolId
       }
     );
+    return materializeToolExecutionResponse(response);
   }
   /**
    * Back-compatible alias for {@link executeTool}.
@@ -16657,6 +16727,7 @@ var PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   "declare const SECRET_HANDLE_BRAND: unique symbol;",
   "export type SecretHandle = { readonly [SECRET_HANDLE_BRAND]: never; readonly name: string; toString(): string; toJSON(): never };",
   "export type SecretAuth = { readonly kind: 'bearer' | 'header'; readonly secret: SecretHandle; readonly header?: string };",
+  "export type SecretAuthInput = SecretAuth | readonly SecretAuth[];",
   "export type PlayInputContract<TInput> = { readonly schema: Record<string, unknown>; readonly __inputType?: TInput };",
   "export type PlayReturnObject = Record<string, unknown> & { readonly _metadata?: never };",
   "export type CsvRenameMap = Record<string, string | readonly string[]>;",
@@ -16705,7 +16776,7 @@ var PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   `  customerDb: { query<TRow extends Record<string, unknown> = Record<string, unknown>>(statement: SqlQuery, options?: { maxRows?: ${cloudReferenceType("ctx.customerDb.query.options.maxRows")}; timeoutMs?: ${cloudReferenceType("ctx.customerDb.query.options.timeoutMs")} }): Promise<TRow[]> };`,
   `  tool<K extends string>(key: ${cloudReferenceType("ctx.tool.key")}, toolId: K, input: ${cloudReferenceType("ctx.tool.input")}, options?: { description?: ${cloudReferenceType("ctx.tool.options.description")} }): Promise<ToolExecutionOutput<K>>;`,
   "  step<T>(id: string, run: () => T | Promise<T>, options?: RuntimeStepOptions): Promise<T>;",
-  "  fetch(key: string, url: string | URL, init?: RequestInit & { headers?: HeadersInit & { 'Idempotency-Key'?: string; 'X-Idempotency-Key'?: string }; auth?: SecretAuth }, options?: FetchOptions): Promise<PlayFetchResponse>;",
+  "  fetch(key: string, url: string | URL, init?: RequestInit & { headers?: HeadersInit & { 'Idempotency-Key'?: string; 'X-Idempotency-Key'?: string }; auth?: SecretAuthInput }, options?: FetchOptions): Promise<PlayFetchResponse>;",
   "  secrets: { get(name: string): SecretHandle; bearer(secret: SecretHandle): SecretAuth; header(header: string, secret: SecretHandle): SecretAuth };",
   `  runPlay<TOutput = unknown>(key: string, playRef: ${cloudReferenceType("ctx.runPlay.playRef")}, input: ${cloudReferenceType("ctx.runPlay.input")}, options: PlayCallOptions): Promise<TOutput>;`,
   "  log(message: string): void;",
@@ -40849,9 +40920,7 @@ function shouldSkipSelfUpdate() {
 function parseSemver(version) {
   const trimmed = version?.trim();
   if (!trimmed) return null;
-  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/.exec(
-    trimmed
-  );
+  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/.exec(trimmed);
   if (!match) return null;
   return {
     major: Number(match[1]),
@@ -40942,7 +41011,12 @@ async function maybeAutoUpdateAndRelaunch(response) {
     );
     return false;
   }
-  process.stderr.write("Deepline SDK/CLI updated; rerunning command.\n");
+  const updateSummary = response.update_summary ? `
+What changed in ${response.update_summary.version}: ${response.update_summary.summary}` : "";
+  process.stderr.write(
+    `Deepline SDK/CLI updated; rerunning command.${updateSummary}
+`
+  );
   const exitCode = await relaunchCurrentCommand(plan);
   process.exit(exitCode);
   return true;

package/dist/{compiler-manifest-DFBtSjB2.d.mts → compiler-manifest-BX85pKXW.d.mts}

@@ -724,6 +724,10 @@ type ToolResultListAccessor<T = Record<string, unknown>, TKey extends string = s
 };
 type ToolResponseEnvelope<TData = unknown, TMeta = Record<string, unknown>> = {
     raw: TData;
+    /** Complete parsed and scrubbed provider response, materialized from raw-v2. */
+    rawV2?: unknown;
+    /** Durable descriptor for deriving the legacy raw view from `rawV2`. */
+    view?: 'data' | 'rawV2';
     meta?: TMeta;
 };
 type ToolExecuteResultBase<TResult = unknown, TMeta = Record<string, unknown>> = {
@@ -765,8 +769,9 @@ type ToolExecuteResultAccessors<TExtracted extends Record<string, unknown> = Par
  * Canonical result returned by Deepline tool execution.
  *
  * The top-level object is Deepline-owned execution metadata and semantic
- * extraction state. Raw tool/provider data lives under `toolResponse.raw`;
- * response metadata lives under `toolResponse.meta`. Semantic single-value
+ * extraction state. The canonical provider response lives under
+ * `toolResponse.rawV2`; `toolResponse.raw` remains the legacy compatibility
+ * projection. Response metadata lives under `toolResponse.meta`. Semantic single-value
  * getters live under `extractedValues.<name>.get()`, and list getters live
  * under `extractedLists.<name>.get()`.
  *
@@ -1162,6 +1167,8 @@ type PlaySecretAuth = {
     /** Header name, set only when `kind` is `header`. */
     readonly header?: string;
 };
+/** One or more resolved authentication schemes for an outbound request. */
+type PlaySecretAuthInput = PlaySecretAuth | readonly PlaySecretAuth[];
 /**
  * The `init` accepted by `ctx.fetch`. Same shape as `RequestInit` plus `auth`.
  *
@@ -1171,9 +1178,9 @@ type PlaySecretAwareRequestInit = Omit<RequestInit, 'headers'> & {
     /** Ordinary request headers, recorded in the durable receipt. Never interpolate a secret value here — use `auth`. */
     headers?: HeadersInit;
     /**
-     * The single authenticated header for this request. One value, not a list: exactly one `ctx.secrets` auth attaches per `ctx.fetch`. An API wanting two credentialed headers at once — Supabase with both `apikey` and `Authorization` — cannot express both. Put the must-stay-secret credential in `auth`; pass a genuinely non-secret second value in `headers`. If both are secret, the request needs a server-side proxy holding one of them.
+     * One or more secret-backed authentication headers for this request. Pass a single `ctx.secrets` auth for the common case, or an array when an API requires multiple credentialed headers — for example, Supabase with both `apikey` and `Authorization`. Every secret is resolved only while the request is attached, never stored in the durable receipt. Each auth entry must target a distinct header.
      */
-    auth?: PlaySecretAuth;
+    auth?: PlaySecretAuthInput;
 };
 type PlayLooseObject = {
     [key: string]: PlayLooseObject;

package/dist/{compiler-manifest-DFBtSjB2.d.ts → compiler-manifest-BX85pKXW.d.ts}

@@ -724,6 +724,10 @@ type ToolResultListAccessor<T = Record<string, unknown>, TKey extends string = s
 };
 type ToolResponseEnvelope<TData = unknown, TMeta = Record<string, unknown>> = {
     raw: TData;
+    /** Complete parsed and scrubbed provider response, materialized from raw-v2. */
+    rawV2?: unknown;
+    /** Durable descriptor for deriving the legacy raw view from `rawV2`. */
+    view?: 'data' | 'rawV2';
     meta?: TMeta;
 };
 type ToolExecuteResultBase<TResult = unknown, TMeta = Record<string, unknown>> = {
@@ -765,8 +769,9 @@ type ToolExecuteResultAccessors<TExtracted extends Record<string, unknown> = Par
  * Canonical result returned by Deepline tool execution.
  *
  * The top-level object is Deepline-owned execution metadata and semantic
- * extraction state. Raw tool/provider data lives under `toolResponse.raw`;
- * response metadata lives under `toolResponse.meta`. Semantic single-value
+ * extraction state. The canonical provider response lives under
+ * `toolResponse.rawV2`; `toolResponse.raw` remains the legacy compatibility
+ * projection. Response metadata lives under `toolResponse.meta`. Semantic single-value
  * getters live under `extractedValues.<name>.get()`, and list getters live
  * under `extractedLists.<name>.get()`.
  *
@@ -1162,6 +1167,8 @@ type PlaySecretAuth = {
     /** Header name, set only when `kind` is `header`. */
     readonly header?: string;
 };
+/** One or more resolved authentication schemes for an outbound request. */
+type PlaySecretAuthInput = PlaySecretAuth | readonly PlaySecretAuth[];
 /**
  * The `init` accepted by `ctx.fetch`. Same shape as `RequestInit` plus `auth`.
  *
@@ -1171,9 +1178,9 @@ type PlaySecretAwareRequestInit = Omit<RequestInit, 'headers'> & {
     /** Ordinary request headers, recorded in the durable receipt. Never interpolate a secret value here — use `auth`. */
     headers?: HeadersInit;
     /**
-     * The single authenticated header for this request. One value, not a list: exactly one `ctx.secrets` auth attaches per `ctx.fetch`. An API wanting two credentialed headers at once — Supabase with both `apikey` and `Authorization` — cannot express both. Put the must-stay-secret credential in `auth`; pass a genuinely non-secret second value in `headers`. If both are secret, the request needs a server-side proxy holding one of them.
+     * One or more secret-backed authentication headers for this request. Pass a single `ctx.secrets` auth for the common case, or an array when an API requires multiple credentialed headers — for example, Supabase with both `apikey` and `Authorization`. Every secret is resolved only while the request is attached, never stored in the durable receipt. Each auth entry must target a distinct header.
      */
-    auth?: PlaySecretAuth;
+    auth?: PlaySecretAuthInput;
 };
 type PlayLooseObject = {
     [key: string]: PlayLooseObject;

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { e as PlayRuntimeBackendId, c as PlayCompilerManifest, D as DeeplineError, f as ToolExecutionError, g as ToolExecutionErrorOptions, h as PlayAuthoringColumnMap, i as PlayAuthoringColumnResolver, j as PlayAuthoringRuntimeContext, k as PlayAuthoringConditionalStepResolver, l as PlayAuthoringCsvInput, m as PlayAuthoringCsvOptions, n as PlayAuthoringDatasetBuilder, o as PlayAuthoringDatasetColumnDefinition, p as PlayAuthoringDatasetColumnRunInput, q as ToolExecuteResult, r as PlayAuthoringReferenceLike, s as PlayReturnObject$1, t as PlayAuthoringDefineConfig, u as PlayAuthoringDefinedPlay, v as PlayAuthoringFetchOptions, w as PlayAuthoringFileInput, x as PlayAuthoringBindings, y as PlayAuthoringCallExecution, z as PlayAuthoringCallOptions, A as PlayAuthoringFetchResponse, B as PlayAuthoringInputContract, C as PlayAuthoringStepProgramStep, E as PlayAuthoringRuntimeStepOptions, F as PlaySqlListenerDeclaration, G as PlaySqlListenerEvent, H as PlaySqlListenerOperation, I as PlaySqlQuery, J as PlayAuthoringStepOptions, K as PlayAuthoringStepProgram, L as PlayAuthoringStepProgramResolver, M as PlayAuthoringStepResolver, N as PlayToolExecutionRequest, O as PlayAuthoringStepProgramOptions } from './compiler-manifest-DFBtSjB2.mjs';
-export { Q as DEEPLINE_EXTRACTOR_TARGETS, R as DEEPLINE_EXTRACTOR_TARGET_DEFINITIONS, S as DeeplineEmailStatusGetterValue, U as DeeplineExtractorTarget, V as DeeplineGetterValue, W as DeeplineGetterValueMap, X as JOB_CHANGE_STATUS_VALUES, Y as JobChangeStatus, Z as PHONE_STATUS_VALUES, _ as PhoneStatus, $ as PlayDataset, a0 as PlayDatasetInput, a1 as PreviousCell, a2 as ProviderTransientError, a3 as ProviderTransientErrorCategory, a4 as ProviderUnavailableError, a5 as ProviderUnavailableReason, a6 as ToolExecutionErrorCategory, a7 as ToolExecutionErrorOrigin, a8 as ToolExecutionFailureV1, a9 as ToolExecutionNetworkKind, aa as ToolExecutionNetworkScope, ab as getProviderUnavailableReason, ac as isDeeplineExtractorTarget, ad as isProviderUnavailable, ae as isProviderWaterfallUnavailableError } from './compiler-manifest-DFBtSjB2.mjs';
+import { e as PlayRuntimeBackendId, c as PlayCompilerManifest, D as DeeplineError, f as ToolExecutionError, g as ToolExecutionErrorOptions, h as PlayAuthoringColumnMap, i as PlayAuthoringColumnResolver, j as PlayAuthoringRuntimeContext, k as PlayAuthoringConditionalStepResolver, l as PlayAuthoringCsvInput, m as PlayAuthoringCsvOptions, n as PlayAuthoringDatasetBuilder, o as PlayAuthoringDatasetColumnDefinition, p as PlayAuthoringDatasetColumnRunInput, q as ToolExecuteResult, r as PlayAuthoringReferenceLike, s as PlayReturnObject$1, t as PlayAuthoringDefineConfig, u as PlayAuthoringDefinedPlay, v as PlayAuthoringFetchOptions, w as PlayAuthoringFileInput, x as PlayAuthoringBindings, y as PlayAuthoringCallExecution, z as PlayAuthoringCallOptions, A as PlayAuthoringFetchResponse, B as PlayAuthoringInputContract, C as PlayAuthoringStepProgramStep, E as PlayAuthoringRuntimeStepOptions, F as PlaySqlListenerDeclaration, G as PlaySqlListenerEvent, H as PlaySqlListenerOperation, I as PlaySqlQuery, J as PlayAuthoringStepOptions, K as PlayAuthoringStepProgram, L as PlayAuthoringStepProgramResolver, M as PlayAuthoringStepResolver, N as PlayToolExecutionRequest, O as PlayAuthoringStepProgramOptions } from './compiler-manifest-BX85pKXW.mjs';
+export { Q as DEEPLINE_EXTRACTOR_TARGETS, R as DEEPLINE_EXTRACTOR_TARGET_DEFINITIONS, S as DeeplineEmailStatusGetterValue, U as DeeplineExtractorTarget, V as DeeplineGetterValue, W as DeeplineGetterValueMap, X as JOB_CHANGE_STATUS_VALUES, Y as JobChangeStatus, Z as PHONE_STATUS_VALUES, _ as PhoneStatus, $ as PlayDataset, a0 as PlayDatasetInput, a1 as PreviousCell, a2 as ProviderTransientError, a3 as ProviderTransientErrorCategory, a4 as ProviderUnavailableError, a5 as ProviderUnavailableReason, a6 as ToolExecutionErrorCategory, a7 as ToolExecutionErrorOrigin, a8 as ToolExecutionFailureV1, a9 as ToolExecutionNetworkKind, aa as ToolExecutionNetworkScope, ab as getProviderUnavailableReason, ac as isDeeplineExtractorTarget, ad as isProviderUnavailable, ae as isProviderWaterfallUnavailableError } from './compiler-manifest-BX85pKXW.mjs';
 import '@sinclair/typebox';
 
 declare const FIXTURE_BEHAVIOR_VERSION: 1;
@@ -338,12 +338,19 @@ interface ToolDefinition {
                 expression?: string;
                 meaning?: string;
             };
+            canonicalToolResponse?: {
+                expression?: string;
+                meaning?: string;
+            };
             invalidGetterHint?: string;
         };
         toolExecutionResult?: {
             type?: 'ToolExecutionResult';
             toolResponse?: {
                 raw?: string;
+                rawV2?: string;
+                view?: string;
+                responseMeta?: string;
                 meta?: string;
             };
             meta?: string;
@@ -1948,7 +1955,8 @@ type ExecuteToolRawOptions = {
 /**
  * Standard provider/tool execution envelope returned by low-level SDK calls.
  *
- * `toolResponse.raw` contains the provider result. `extractedValues` and
+ * `toolResponse.rawV2` contains the complete scrubbed provider response;
+ * `toolResponse.raw` is derived locally as the legacy provider-result projection. `extractedValues` and
  * `extractedLists` contain Deepline-normalized getters when the tool exposes
  * them. Billing fields are Deepline-facing and must not expose provider spend.
  */
@@ -1958,7 +1966,10 @@ type ToolExecution<TData = unknown, TMeta = Record<string, unknown>> = {
     meta?: Record<string, unknown>;
     toolResponse: {
         raw: TData;
+        rawV2?: unknown;
+        view?: 'data' | 'rawV2';
         meta?: TMeta;
+        responseMeta?: TMeta;
     };
     extractedLists?: Record<string, unknown>;
     extractedValues?: Record<string, unknown>;

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { e as PlayRuntimeBackendId, c as PlayCompilerManifest, D as DeeplineError, f as ToolExecutionError, g as ToolExecutionErrorOptions, h as PlayAuthoringColumnMap, i as PlayAuthoringColumnResolver, j as PlayAuthoringRuntimeContext, k as PlayAuthoringConditionalStepResolver, l as PlayAuthoringCsvInput, m as PlayAuthoringCsvOptions, n as PlayAuthoringDatasetBuilder, o as PlayAuthoringDatasetColumnDefinition, p as PlayAuthoringDatasetColumnRunInput, q as ToolExecuteResult, r as PlayAuthoringReferenceLike, s as PlayReturnObject$1, t as PlayAuthoringDefineConfig, u as PlayAuthoringDefinedPlay, v as PlayAuthoringFetchOptions, w as PlayAuthoringFileInput, x as PlayAuthoringBindings, y as PlayAuthoringCallExecution, z as PlayAuthoringCallOptions, A as PlayAuthoringFetchResponse, B as PlayAuthoringInputContract, C as PlayAuthoringStepProgramStep, E as PlayAuthoringRuntimeStepOptions, F as PlaySqlListenerDeclaration, G as PlaySqlListenerEvent, H as PlaySqlListenerOperation, I as PlaySqlQuery, J as PlayAuthoringStepOptions, K as PlayAuthoringStepProgram, L as PlayAuthoringStepProgramResolver, M as PlayAuthoringStepResolver, N as PlayToolExecutionRequest, O as PlayAuthoringStepProgramOptions } from './compiler-manifest-DFBtSjB2.js';
-export { Q as DEEPLINE_EXTRACTOR_TARGETS, R as DEEPLINE_EXTRACTOR_TARGET_DEFINITIONS, S as DeeplineEmailStatusGetterValue, U as DeeplineExtractorTarget, V as DeeplineGetterValue, W as DeeplineGetterValueMap, X as JOB_CHANGE_STATUS_VALUES, Y as JobChangeStatus, Z as PHONE_STATUS_VALUES, _ as PhoneStatus, $ as PlayDataset, a0 as PlayDatasetInput, a1 as PreviousCell, a2 as ProviderTransientError, a3 as ProviderTransientErrorCategory, a4 as ProviderUnavailableError, a5 as ProviderUnavailableReason, a6 as ToolExecutionErrorCategory, a7 as ToolExecutionErrorOrigin, a8 as ToolExecutionFailureV1, a9 as ToolExecutionNetworkKind, aa as ToolExecutionNetworkScope, ab as getProviderUnavailableReason, ac as isDeeplineExtractorTarget, ad as isProviderUnavailable, ae as isProviderWaterfallUnavailableError } from './compiler-manifest-DFBtSjB2.js';
+import { e as PlayRuntimeBackendId, c as PlayCompilerManifest, D as DeeplineError, f as ToolExecutionError, g as ToolExecutionErrorOptions, h as PlayAuthoringColumnMap, i as PlayAuthoringColumnResolver, j as PlayAuthoringRuntimeContext, k as PlayAuthoringConditionalStepResolver, l as PlayAuthoringCsvInput, m as PlayAuthoringCsvOptions, n as PlayAuthoringDatasetBuilder, o as PlayAuthoringDatasetColumnDefinition, p as PlayAuthoringDatasetColumnRunInput, q as ToolExecuteResult, r as PlayAuthoringReferenceLike, s as PlayReturnObject$1, t as PlayAuthoringDefineConfig, u as PlayAuthoringDefinedPlay, v as PlayAuthoringFetchOptions, w as PlayAuthoringFileInput, x as PlayAuthoringBindings, y as PlayAuthoringCallExecution, z as PlayAuthoringCallOptions, A as PlayAuthoringFetchResponse, B as PlayAuthoringInputContract, C as PlayAuthoringStepProgramStep, E as PlayAuthoringRuntimeStepOptions, F as PlaySqlListenerDeclaration, G as PlaySqlListenerEvent, H as PlaySqlListenerOperation, I as PlaySqlQuery, J as PlayAuthoringStepOptions, K as PlayAuthoringStepProgram, L as PlayAuthoringStepProgramResolver, M as PlayAuthoringStepResolver, N as PlayToolExecutionRequest, O as PlayAuthoringStepProgramOptions } from './compiler-manifest-BX85pKXW.js';
+export { Q as DEEPLINE_EXTRACTOR_TARGETS, R as DEEPLINE_EXTRACTOR_TARGET_DEFINITIONS, S as DeeplineEmailStatusGetterValue, U as DeeplineExtractorTarget, V as DeeplineGetterValue, W as DeeplineGetterValueMap, X as JOB_CHANGE_STATUS_VALUES, Y as JobChangeStatus, Z as PHONE_STATUS_VALUES, _ as PhoneStatus, $ as PlayDataset, a0 as PlayDatasetInput, a1 as PreviousCell, a2 as ProviderTransientError, a3 as ProviderTransientErrorCategory, a4 as ProviderUnavailableError, a5 as ProviderUnavailableReason, a6 as ToolExecutionErrorCategory, a7 as ToolExecutionErrorOrigin, a8 as ToolExecutionFailureV1, a9 as ToolExecutionNetworkKind, aa as ToolExecutionNetworkScope, ab as getProviderUnavailableReason, ac as isDeeplineExtractorTarget, ad as isProviderUnavailable, ae as isProviderWaterfallUnavailableError } from './compiler-manifest-BX85pKXW.js';
 import '@sinclair/typebox';
 
 declare const FIXTURE_BEHAVIOR_VERSION: 1;
@@ -338,12 +338,19 @@ interface ToolDefinition {
                 expression?: string;
                 meaning?: string;
             };
+            canonicalToolResponse?: {
+                expression?: string;
+                meaning?: string;
+            };
             invalidGetterHint?: string;
         };
         toolExecutionResult?: {
             type?: 'ToolExecutionResult';
             toolResponse?: {
                 raw?: string;
+                rawV2?: string;
+                view?: string;
+                responseMeta?: string;
                 meta?: string;
             };
             meta?: string;
@@ -1948,7 +1955,8 @@ type ExecuteToolRawOptions = {
 /**
  * Standard provider/tool execution envelope returned by low-level SDK calls.
  *
- * `toolResponse.raw` contains the provider result. `extractedValues` and
+ * `toolResponse.rawV2` contains the complete scrubbed provider response;
+ * `toolResponse.raw` is derived locally as the legacy provider-result projection. `extractedValues` and
  * `extractedLists` contain Deepline-normalized getters when the tool exposes
  * them. Billing fields are Deepline-facing and must not expose provider spend.
  */
@@ -1958,7 +1966,10 @@ type ToolExecution<TData = unknown, TMeta = Record<string, unknown>> = {
     meta?: Record<string, unknown>;
     toolResponse: {
         raw: TData;
+        rawV2?: unknown;
+        view?: 'data' | 'rawV2';
         meta?: TMeta;
+        responseMeta?: TMeta;
     };
     extractedLists?: Record<string, unknown>;
     extractedValues?: Record<string, unknown>;