deepline 0.3.7 → 0.3.8

package/dist/cli/index.mjs

@@ -1033,7 +1033,7 @@ var SDK_RELEASE = {
   // 0.3.0 introduces raw-v2: complete scrubbed provider responses are
   // available at toolResponse.rawV2 while toolResponse.raw and all declared
   // getters keep their established compatibility behavior.
-  version: "0.3.7",
+  version: "0.3.8",
   updateSummary: "New raw-v2 tool responses preserve complete scrubbed provider envelopes at toolResponse.rawV2, including JSON:API included resources, links, cursors, and totals. Existing toolResponse.raw and declared getters keep working unchanged.",
   contracts: {
     api: {
@@ -2006,10 +2006,30 @@ function redactSecretLikeString(value) {
 function createSecretRedactionContext(initialValues = []) {
   const exactSecrets = /* @__PURE__ */ new Set();
   function register(value) {
-    if (value.length >= 4) exactSecrets.add(value);
+    if (value.length > 0) exactSecrets.add(value);
   }
   for (const value of initialValues) register(value);
-  function redactString2(value) {
+  function containsRegisteredSecret(value, {
+    includeEncoded = false,
+    minimumLength = 1
+  } = {}) {
+    for (const secret of exactSecrets) {
+      if (secret.length < minimumLength) continue;
+      if (value.includes(secret)) return true;
+      if (includeEncoded) {
+        try {
+          const encoded = encodeURIComponent(secret);
+          if (encoded !== secret && value.includes(encoded)) return true;
+        } catch {
+        }
+      }
+    }
+    return false;
+  }
+  function matchesRegisteredSecret(value) {
+    return exactSecrets.has(value);
+  }
+  function redactRegisteredSecrets(value) {
     let output2 = value;
     for (const secret of exactSecrets) {
       output2 = output2.replace(
@@ -2027,6 +2047,10 @@ function createSecretRedactionContext(initialValues = []) {
       } catch {
       }
     }
+    return output2;
+  }
+  function redactString2(value) {
+    const output2 = redactRegisteredSecrets(value);
     return redactSecretLikeString(output2);
   }
   function redact(value) {
@@ -2059,6 +2083,9 @@ function createSecretRedactionContext(initialValues = []) {
   }
   return {
     register,
+    containsRegisteredSecret,
+    matchesRegisteredSecret,
+    redactRegisteredSecrets,
     redactString: redactString2,
     redactKnownSecrets,
     redact
@@ -16745,8 +16772,11 @@ var PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   `  secrets?: readonly ${cloudReferenceType("bindings.secrets[]")}[];`,
   "};",
   "declare const SECRET_HANDLE_BRAND: unique symbol;",
+  "declare const SECRET_PROMISE_BRAND: unique symbol;",
   "export type SecretHandle = { readonly [SECRET_HANDLE_BRAND]: never; readonly name: string; toString(): string; toJSON(): never };",
-  "export type SecretAuth = { readonly kind: 'bearer' | 'header'; readonly secret: SecretHandle; readonly header?: string };",
+  "export type SecretPromise = Promise<string> & { readonly [SECRET_PROMISE_BRAND]: never };",
+  "export type SecretValue = SecretHandle;",
+  "export type SecretAuth = { readonly kind: 'bearer' | 'header'; readonly secret: string | SecretPromise | SecretHandle; readonly header?: string };",
   "export type SecretAuthInput = SecretAuth | readonly SecretAuth[];",
   "export type PlayInputContract<TInput> = { readonly schema: Record<string, unknown>; readonly __inputType?: TInput };",
   "export type PlayReturnObject = Record<string, unknown> & { readonly _metadata?: never };",
@@ -16797,7 +16827,7 @@ var PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   `  tool<K extends string>(key: ${cloudReferenceType("ctx.tool.key")}, toolId: K, input: ${cloudReferenceType("ctx.tool.input")}, options?: { description?: ${cloudReferenceType("ctx.tool.options.description")} }): Promise<ToolExecutionOutput<K>>;`,
   "  step<T>(id: string, run: () => T | Promise<T>, options?: RuntimeStepOptions): Promise<T>;",
   "  fetch(key: string, url: string | URL, init?: RequestInit & { headers?: HeadersInit & { 'Idempotency-Key'?: string; 'X-Idempotency-Key'?: string }; auth?: SecretAuthInput }, options?: FetchOptions): Promise<PlayFetchResponse>;",
-  "  secrets: { get(name: string): SecretHandle; bearer(secret: SecretHandle): SecretAuth; header(header: string, secret: SecretHandle): SecretAuth };",
+  "  secrets: { get(name: string): SecretPromise; bearer(secret: string | SecretPromise | SecretHandle): SecretAuth; header(header: string, secret: string | SecretPromise | SecretHandle): SecretAuth };",
   `  runPlay<TOutput = unknown>(key: string, playRef: ${cloudReferenceType("ctx.runPlay.playRef")}, input: ${cloudReferenceType("ctx.runPlay.input")}, options: PlayCallOptions): Promise<TOutput>;`,
   "  log(message: string): void;",
   `  sleep(ms: ${cloudReferenceType("ctx.sleep.ms")}): Promise<void>;`,
@@ -16938,15 +16968,118 @@ function listPlayFileExports(sourceCode) {
   return exports;
 }
 
-// ../shared_libs/plays/docflow.ts
-var MERMAID_NODE_ATTRIBUTES = ["label", "type", "in", "out", "arm"];
-var LEGACY_DOCFLOW_ATTRIBUTES = ["id", ...MERMAID_NODE_ATTRIBUTES];
-
 // ../shared_libs/plays/secret-guardrails.ts
 var SECRET_ENV_PATTERN = /\bprocess(?:\.env|\[['"]env['"]\])(?:\.|\[['"])([A-Z0-9_]*(?:API[_-]?KEY|TOKEN|SECRET|PASSWORD|PRIVATE[_-]?KEY|ACCESS[_-]?KEY)[A-Z0-9_]*)(?:['"]\])?/g;
 var PRIVATE_KEY_PATTERN = /-----BEGIN (?:RSA |EC |OPENSSH |PGP )?PRIVATE KEY-----/;
 var BEARER_LITERAL_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/i;
 var ASSIGNMENT_SECRET_LITERAL_PATTERN = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*['"][^'"]{12,}['"]/i;
+var SECRET_AUTH_LITERAL_FINDING = "literal credential passed to ctx.secrets auth helper";
+function skipQuoted(source, start) {
+  const quote = source[start];
+  let index = start + 1;
+  while (index < source.length) {
+    if (source[index] === "\\") {
+      index += 2;
+    } else if (source[index] === quote) {
+      return index + 1;
+    } else {
+      index += 1;
+    }
+  }
+  return source.length;
+}
+function skipTrivia(source, start) {
+  let index = start;
+  while (index < source.length) {
+    if (/\s/.test(source[index])) {
+      index += 1;
+    } else if (source.startsWith("//", index)) {
+      index = source.indexOf("\n", index + 2);
+      if (index === -1) return source.length;
+    } else if (source.startsWith("/*", index)) {
+      index = source.indexOf("*/", index + 2);
+      if (index === -1) return source.length;
+      index += 2;
+    } else {
+      return index;
+    }
+  }
+  return index;
+}
+function consumeIdentifier(source, start, expected) {
+  return source.startsWith(expected, start) && !/[A-Za-z0-9_$]/.test(source[start - 1] ?? "") && !/[A-Za-z0-9_$]/.test(source[start + expected.length] ?? "") ? start + expected.length : void 0;
+}
+function consumeMember(source, start, expected) {
+  let index = skipTrivia(source, start);
+  if (source[index] === ".") {
+    return consumeIdentifier(source, skipTrivia(source, index + 1), expected);
+  }
+  if (source[index] !== "[") return void 0;
+  index = skipTrivia(source, index + 1);
+  if (source[index] !== "'" && source[index] !== '"') return void 0;
+  const end = skipQuoted(source, index);
+  if (source.slice(index + 1, end - 1) !== expected) return void 0;
+  index = skipTrivia(source, end);
+  return source[index] === "]" ? index + 1 : void 0;
+}
+function skipExpression(source, start) {
+  let index = start;
+  let depth = 0;
+  while (index < source.length) {
+    const char = source[index];
+    if (char === "'" || char === '"' || char === "`") {
+      index = skipQuoted(source, index);
+      continue;
+    }
+    if (source.startsWith("//", index) || source.startsWith("/*", index)) {
+      index = skipTrivia(source, index);
+      continue;
+    }
+    if (char === "(" || char === "[" || char === "{") {
+      depth += 1;
+    } else if (char === ")" || char === "]" || char === "}") {
+      if (depth === 0) return index;
+      depth -= 1;
+    } else if (char === "," && depth === 0) {
+      return index;
+    }
+    index += 1;
+  }
+  return index;
+}
+function isDirectStringLiteral(source, start) {
+  const quote = source[start];
+  if (quote !== "'" && quote !== '"' && quote !== "`") return false;
+  const end = skipQuoted(source, start);
+  return quote !== "`" || !source.slice(start, end).includes("${");
+}
+function hasLiteralSecretAuthCredential(source) {
+  for (let index = 0; index < source.length; index += 1) {
+    const char = source[index];
+    if (char === "'" || char === '"' || char === "`") {
+      index = skipQuoted(source, index) - 1;
+      continue;
+    }
+    if (source.startsWith("//", index) || source.startsWith("/*", index)) {
+      index = skipTrivia(source, index) - 1;
+      continue;
+    }
+    const afterCtx = consumeIdentifier(source, index, "ctx");
+    if (!afterCtx) continue;
+    const afterSecrets = consumeMember(source, afterCtx, "secrets");
+    if (!afterSecrets) continue;
+    const afterHeader = consumeMember(source, afterSecrets, "header");
+    const helper = afterHeader ? "header" : "bearer";
+    const afterHelper = afterHeader ?? consumeMember(source, afterSecrets, "bearer");
+    if (!afterHelper) continue;
+    const afterOpen = skipTrivia(source, afterHelper);
+    if (source[afterOpen] !== "(") continue;
+    const firstArgument = skipTrivia(source, afterOpen + 1);
+    const credential = helper === "header" ? skipTrivia(source, skipExpression(source, firstArgument) + 1) : firstArgument;
+    if (isDirectStringLiteral(source, credential)) return true;
+  }
+  return false;
+}
 function collectInlineSecretFindings(sourceCode) {
   const findings = [];
   for (const match of sourceCode.matchAll(SECRET_ENV_PATTERN)) {
@@ -16958,6 +17091,9 @@ function collectInlineSecretFindings(sourceCode) {
   if (ASSIGNMENT_SECRET_LITERAL_PATTERN.test(sourceCode)) {
     findings.push("secret-looking assignment literal");
   }
+  if (hasLiteralSecretAuthCredential(sourceCode)) {
+    findings.push(SECRET_AUTH_LITERAL_FINDING);
+  }
   return [...new Set(findings)];
 }
 
@@ -25314,6 +25450,14 @@ Concepts:
   bundle local .play.ts files for development workflows.
   Running a local file does not make it live; use publish or set-live for that.
 
+Authoring:
+  Use normal TypeScript interpolation for human-facing strings:
+    const readyMessage = \`Put \${input.title} through to send-ready.\`;
+  An authored diagram is optional. Docflow parses only an explicit
+  /** @mermaid ... */ block and its // @mermaid-node annotations; ordinary
+  prose comments are never Docflow syntax. When Docflow is enabled, plays check
+  gives missing diagrams a non-blocking visualization warning.
+
 Common commands:
   deepline plays search email --json
   deepline plays describe prebuilt/person-linkedin-to-email --json

package/dist/{compiler-manifest-CdgJeOr2.d.mts → compiler-manifest-YIjoJo8y.d.mts}

@@ -101,13 +101,13 @@ type PlayDocflow = {
     nodes: PlayDocflowNode[];
     edges: PlayDocflowEdge[];
     bindings: PlayDocflowBinding[];
-    /** Authoring syntax used by the source file. Absent on older persisted graphs. */
-    syntax?: 'docflow' | 'mermaid';
+    /** Authoring syntax used by the source file. */
+    syntax?: 'mermaid';
     /** Normalized Mermaid text, ready to pass directly to a Mermaid renderer. */
     mermaidSource?: string;
     /**
-     * Mermaid `subgraph` loop regions. Optional so older persisted graphs stay
-     * valid. Only populated for the Mermaid syntax; legacy `docflow` has none.
+     * Mermaid `subgraph` loop regions. Optional for persisted graphs that have
+     * no authored regions.
      */
     subgraphs?: PlayDocflowSubgraph[];
     /** Mermaid directives accepted by the parser but not applied by React Flow. */
@@ -1017,7 +1017,7 @@ declare function isProviderUnavailable(error: unknown): error is ProviderUnavail
 /** @deprecated Use isProviderUnavailable. */
 declare const isProviderWaterfallUnavailableError: typeof isProviderUnavailable;
 
-declare const SUPPORTED_PLAY_AUTHORING_CONTRACT_EDITIONS: readonly [1, 2, 3];
+declare const SUPPORTED_PLAY_AUTHORING_CONTRACT_EDITIONS: readonly [1, 2, 3, 4];
 type PlayAuthoringContractEdition = (typeof SUPPORTED_PLAY_AUTHORING_CONTRACT_EDITIONS)[number];
 type PlaySqlListenerOperation = 'INSERT' | 'UPDATE' | 'DELETE';
 type PlayStandardWebhookHeaderFamily = 'standard' | 'svix';
@@ -1146,8 +1146,10 @@ type PlaySqlQuery = {
     readonly values: readonly unknown[];
 };
 declare const PLAY_SECRET_HANDLE_BRAND: unique symbol;
+declare const PLAY_SECRET_PROMISE_BRAND: unique symbol;
 /**
- * An opaque reference to a workspace secret, returned by `ctx.secrets.get`. The handle never carries the value into play code: it stringifies to `[secret:NAME]` and throws on `JSON.stringify`, so a secret cannot reach a play variable, a log line, a dataset cell, or a replay artifact even by accident. Only the runtime resolves it, at the moment it attaches the request header.
+ * An opaque reference to a workspace secret used by legacy authoring-contract
+ * editions. New Plays receive plaintext strings from `ctx.secrets.get`.
  *
  * @sdkReference runtime 176 SecretHandle
  */
@@ -1160,6 +1162,12 @@ type PlaySecretHandle = {
     /** Always throws. A secret handle is deliberately not serializable. */
     toJSON(): never;
 };
+/** A secret-reading promise returned only by `ctx.secrets.get`. */
+type PlaySecretPromise = Promise<string> & {
+    readonly [PLAY_SECRET_PROMISE_BRAND]: never;
+};
+/** An opaque legacy secret handle retained for earlier Play artifacts. */
+type PlaySecretValue = PlaySecretHandle;
 /**
  * One resolved authentication scheme, built by `ctx.secrets.bearer` or `ctx.secrets.header` and attached to a request through `init.auth`.
  *
@@ -1168,8 +1176,8 @@ type PlaySecretHandle = {
 type PlaySecretAuth = {
     /** `bearer` sends `Authorization: Bearer <value>`; `header` sends a named header. */
     readonly kind: 'bearer' | 'header';
-    /** The handle whose value the runtime attaches. */
-    readonly secret: PlaySecretHandle;
+    /** The value whose bytes the runtime attaches. */
+    readonly secret: string | PlaySecretPromise | PlaySecretValue;
     /** Header name, set only when `kind` is `header`. */
     readonly header?: string;
 };
@@ -1181,10 +1189,10 @@ type PlaySecretAuthInput = PlaySecretAuth | readonly PlaySecretAuth[];
  * @sdkReference runtime 174 SecretAwareRequestInit
  */
 type PlaySecretAwareRequestInit = Omit<RequestInit, 'headers'> & {
-    /** Ordinary request headers, recorded in the durable receipt. Never interpolate a secret value here — use `auth`. */
+    /** Ordinary request headers, recorded in the durable receipt with any resolved Play secret value redacted. Prefer `auth` for credentials: it enforces HTTPS and keeps the auth header out of the receipt. */
     headers?: HeadersInit;
     /**
-     * One or more secret-backed authentication headers for this request. Pass a single `ctx.secrets` auth for the common case, or an array when an API requires multiple credentialed headers — for example, Supabase with both `apikey` and `Authorization`. Every secret is resolved only while the request is attached, never stored in the durable receipt. Each auth entry must target a distinct header.
+     * One or more credentialed headers for this request. Pass a single `ctx.secrets` auth for the common case, or an array when an API requires multiple credentialed headers — for example, Supabase with both `apikey` and `Authorization`. Auth-helper requests require HTTPS and omit the credential from the durable receipt. Each auth entry must target a distinct header.
      */
     auth?: PlaySecretAuthInput;
 };
@@ -1453,23 +1461,26 @@ interface PlayAuthoringRuntimeContext {
     fetch(key: string, url: string | URL, init?: PlaySecretAwareRequestInit, options?: PlayAuthoringFetchOptions): Promise<PlayAuthoringFetchResponse>;
     secrets: {
         /**
-         * Reference a workspace secret by name without reading its value. This is the only supported way to authenticate an outbound request from a Play: `process.env.X` is rejected at check time because an env read puts the raw value in a play variable, where it can reach a log line or a replay artifact. A handle cannot — pass it to `bearer` or `header` and the runtime resolves it only while attaching the header. Names are uppercased; manage stored values with `deepline secrets set` / `deepline secrets list`.
+         * Read an allowed workspace secret inside the running Play; do not log or return it. Declare uppercase names in top-level `secrets`.
          *
          * @sdkReference runtime 171 ctx.secrets.get(name)
          */
-        get(name: string): PlaySecretHandle;
+        get(name: string): PlaySecretPromise;
         /**
-         * Send the secret as `Authorization: Bearer <value>`.
+         * Send a credential as `Authorization: Bearer <value>`. Await `get` first;
+         * its direct promise remains accepted for source compatibility, while other
+         * promises are rejected.
          *
          * @sdkReference runtime 172 ctx.secrets.bearer(secret)
          */
-        bearer(secret: PlaySecretHandle): PlaySecretAuth;
+        bearer(secret: string | PlaySecretPromise | PlaySecretHandle): PlaySecretAuth;
         /**
-         * Send the secret as a named header, for APIs that do not use bearer tokens — `x-api-key`, `apikey`, `private-token`, and similar.
+         * Send a credential as a named header, for APIs that do not use bearer
+         * tokens — `x-api-key`, `apikey`, `private-token`, and similar.
          *
          * @sdkReference runtime 173 ctx.secrets.header(header, secret)
          */
-        header(header: string, secret: PlaySecretHandle): PlaySecretAuth;
+        header(header: string, secret: string | PlaySecretPromise | PlaySecretHandle): PlaySecretAuth;
     };
     /**
      * Compose another Play inline under a stable call key.

package/dist/{compiler-manifest-CdgJeOr2.d.ts → compiler-manifest-YIjoJo8y.d.ts}

@@ -101,13 +101,13 @@ type PlayDocflow = {
     nodes: PlayDocflowNode[];
     edges: PlayDocflowEdge[];
     bindings: PlayDocflowBinding[];
-    /** Authoring syntax used by the source file. Absent on older persisted graphs. */
-    syntax?: 'docflow' | 'mermaid';
+    /** Authoring syntax used by the source file. */
+    syntax?: 'mermaid';
     /** Normalized Mermaid text, ready to pass directly to a Mermaid renderer. */
     mermaidSource?: string;
     /**
-     * Mermaid `subgraph` loop regions. Optional so older persisted graphs stay
-     * valid. Only populated for the Mermaid syntax; legacy `docflow` has none.
+     * Mermaid `subgraph` loop regions. Optional for persisted graphs that have
+     * no authored regions.
      */
     subgraphs?: PlayDocflowSubgraph[];
     /** Mermaid directives accepted by the parser but not applied by React Flow. */
@@ -1017,7 +1017,7 @@ declare function isProviderUnavailable(error: unknown): error is ProviderUnavail
 /** @deprecated Use isProviderUnavailable. */
 declare const isProviderWaterfallUnavailableError: typeof isProviderUnavailable;
 
-declare const SUPPORTED_PLAY_AUTHORING_CONTRACT_EDITIONS: readonly [1, 2, 3];
+declare const SUPPORTED_PLAY_AUTHORING_CONTRACT_EDITIONS: readonly [1, 2, 3, 4];
 type PlayAuthoringContractEdition = (typeof SUPPORTED_PLAY_AUTHORING_CONTRACT_EDITIONS)[number];
 type PlaySqlListenerOperation = 'INSERT' | 'UPDATE' | 'DELETE';
 type PlayStandardWebhookHeaderFamily = 'standard' | 'svix';
@@ -1146,8 +1146,10 @@ type PlaySqlQuery = {
     readonly values: readonly unknown[];
 };
 declare const PLAY_SECRET_HANDLE_BRAND: unique symbol;
+declare const PLAY_SECRET_PROMISE_BRAND: unique symbol;
 /**
- * An opaque reference to a workspace secret, returned by `ctx.secrets.get`. The handle never carries the value into play code: it stringifies to `[secret:NAME]` and throws on `JSON.stringify`, so a secret cannot reach a play variable, a log line, a dataset cell, or a replay artifact even by accident. Only the runtime resolves it, at the moment it attaches the request header.
+ * An opaque reference to a workspace secret used by legacy authoring-contract
+ * editions. New Plays receive plaintext strings from `ctx.secrets.get`.
  *
  * @sdkReference runtime 176 SecretHandle
  */
@@ -1160,6 +1162,12 @@ type PlaySecretHandle = {
     /** Always throws. A secret handle is deliberately not serializable. */
     toJSON(): never;
 };
+/** A secret-reading promise returned only by `ctx.secrets.get`. */
+type PlaySecretPromise = Promise<string> & {
+    readonly [PLAY_SECRET_PROMISE_BRAND]: never;
+};
+/** An opaque legacy secret handle retained for earlier Play artifacts. */
+type PlaySecretValue = PlaySecretHandle;
 /**
  * One resolved authentication scheme, built by `ctx.secrets.bearer` or `ctx.secrets.header` and attached to a request through `init.auth`.
  *
@@ -1168,8 +1176,8 @@ type PlaySecretHandle = {
 type PlaySecretAuth = {
     /** `bearer` sends `Authorization: Bearer <value>`; `header` sends a named header. */
     readonly kind: 'bearer' | 'header';
-    /** The handle whose value the runtime attaches. */
-    readonly secret: PlaySecretHandle;
+    /** The value whose bytes the runtime attaches. */
+    readonly secret: string | PlaySecretPromise | PlaySecretValue;
     /** Header name, set only when `kind` is `header`. */
     readonly header?: string;
 };
@@ -1181,10 +1189,10 @@ type PlaySecretAuthInput = PlaySecretAuth | readonly PlaySecretAuth[];
  * @sdkReference runtime 174 SecretAwareRequestInit
  */
 type PlaySecretAwareRequestInit = Omit<RequestInit, 'headers'> & {
-    /** Ordinary request headers, recorded in the durable receipt. Never interpolate a secret value here — use `auth`. */
+    /** Ordinary request headers, recorded in the durable receipt with any resolved Play secret value redacted. Prefer `auth` for credentials: it enforces HTTPS and keeps the auth header out of the receipt. */
     headers?: HeadersInit;
     /**
-     * One or more secret-backed authentication headers for this request. Pass a single `ctx.secrets` auth for the common case, or an array when an API requires multiple credentialed headers — for example, Supabase with both `apikey` and `Authorization`. Every secret is resolved only while the request is attached, never stored in the durable receipt. Each auth entry must target a distinct header.
+     * One or more credentialed headers for this request. Pass a single `ctx.secrets` auth for the common case, or an array when an API requires multiple credentialed headers — for example, Supabase with both `apikey` and `Authorization`. Auth-helper requests require HTTPS and omit the credential from the durable receipt. Each auth entry must target a distinct header.
      */
     auth?: PlaySecretAuthInput;
 };
@@ -1453,23 +1461,26 @@ interface PlayAuthoringRuntimeContext {
     fetch(key: string, url: string | URL, init?: PlaySecretAwareRequestInit, options?: PlayAuthoringFetchOptions): Promise<PlayAuthoringFetchResponse>;
     secrets: {
         /**
-         * Reference a workspace secret by name without reading its value. This is the only supported way to authenticate an outbound request from a Play: `process.env.X` is rejected at check time because an env read puts the raw value in a play variable, where it can reach a log line or a replay artifact. A handle cannot — pass it to `bearer` or `header` and the runtime resolves it only while attaching the header. Names are uppercased; manage stored values with `deepline secrets set` / `deepline secrets list`.
+         * Read an allowed workspace secret inside the running Play; do not log or return it. Declare uppercase names in top-level `secrets`.
          *
          * @sdkReference runtime 171 ctx.secrets.get(name)
          */
-        get(name: string): PlaySecretHandle;
+        get(name: string): PlaySecretPromise;
         /**
-         * Send the secret as `Authorization: Bearer <value>`.
+         * Send a credential as `Authorization: Bearer <value>`. Await `get` first;
+         * its direct promise remains accepted for source compatibility, while other
+         * promises are rejected.
          *
          * @sdkReference runtime 172 ctx.secrets.bearer(secret)
          */
-        bearer(secret: PlaySecretHandle): PlaySecretAuth;
+        bearer(secret: string | PlaySecretPromise | PlaySecretHandle): PlaySecretAuth;
         /**
-         * Send the secret as a named header, for APIs that do not use bearer tokens — `x-api-key`, `apikey`, `private-token`, and similar.
+         * Send a credential as a named header, for APIs that do not use bearer
+         * tokens — `x-api-key`, `apikey`, `private-token`, and similar.
          *
          * @sdkReference runtime 173 ctx.secrets.header(header, secret)
          */
-        header(header: string, secret: PlaySecretHandle): PlaySecretAuth;
+        header(header: string, secret: string | PlaySecretPromise | PlaySecretHandle): PlaySecretAuth;
     };
     /**
      * Compose another Play inline under a stable call key.

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { e as PlayRuntimeBackendId, c as PlayCompilerManifest, D as DeeplineError, f as ToolExecutionError, g as ToolExecutionErrorOptions, h as PlayAuthoringColumnMap, i as PlayAuthoringColumnResolver, j as PlayAuthoringRuntimeContext, k as PlayAuthoringConditionalStepResolver, l as PlayAuthoringCsvInput, m as PlayAuthoringCsvOptions, n as PlayAuthoringDatasetBuilder, o as PlayAuthoringDatasetColumnDefinition, p as PlayAuthoringDatasetColumnRunInput, q as ToolExecuteResult, r as PlayAuthoringReferenceLike, s as PlayReturnObject$1, t as PlayAuthoringDefineConfig, u as PlayAuthoringDefinedPlay, v as PlayAuthoringFetchOptions, w as PlayAuthoringFileInput, x as PlayAuthoringBindings, y as PlayAuthoringCallExecution, z as PlayAuthoringCallOptions, A as PlayAuthoringFetchResponse, B as PlayAuthoringInputContract, C as PlayAuthoringStepProgramStep, E as PlayAuthoringRuntimeStepOptions, F as PlaySqlListenerDeclaration, G as PlaySqlListenerEvent, H as PlaySqlListenerOperation, I as PlaySqlQuery, J as PlayAuthoringStepOptions, K as PlayAuthoringStepProgram, L as PlayAuthoringStepProgramResolver, M as PlayAuthoringStepResolver, N as PlayToolExecutionRequest, O as PlayAuthoringStepProgramOptions } from './compiler-manifest-CdgJeOr2.mjs';
-export { Q as DEEPLINE_EXTRACTOR_TARGETS, R as DEEPLINE_EXTRACTOR_TARGET_DEFINITIONS, S as DeeplineEmailStatusGetterValue, U as DeeplineExtractorTarget, V as DeeplineGetterValue, W as DeeplineGetterValueMap, X as JOB_CHANGE_STATUS_VALUES, Y as JobChangeStatus, Z as PHONE_STATUS_VALUES, _ as PhoneStatus, $ as PlayDataset, a0 as PlayDatasetInput, a1 as PreviousCell, a2 as ProviderTransientError, a3 as ProviderTransientErrorCategory, a4 as ProviderUnavailableError, a5 as ProviderUnavailableReason, a6 as ToolExecutionErrorCategory, a7 as ToolExecutionErrorOrigin, a8 as ToolExecutionFailureV1, a9 as ToolExecutionNetworkKind, aa as ToolExecutionNetworkScope, ab as getProviderUnavailableReason, ac as isDeeplineExtractorTarget, ad as isProviderUnavailable, ae as isProviderWaterfallUnavailableError } from './compiler-manifest-CdgJeOr2.mjs';
+import { e as PlayRuntimeBackendId, c as PlayCompilerManifest, D as DeeplineError, f as ToolExecutionError, g as ToolExecutionErrorOptions, h as PlayAuthoringColumnMap, i as PlayAuthoringColumnResolver, j as PlayAuthoringRuntimeContext, k as PlayAuthoringConditionalStepResolver, l as PlayAuthoringCsvInput, m as PlayAuthoringCsvOptions, n as PlayAuthoringDatasetBuilder, o as PlayAuthoringDatasetColumnDefinition, p as PlayAuthoringDatasetColumnRunInput, q as ToolExecuteResult, r as PlayAuthoringReferenceLike, s as PlayReturnObject$1, t as PlayAuthoringDefineConfig, u as PlayAuthoringDefinedPlay, v as PlayAuthoringFetchOptions, w as PlayAuthoringFileInput, x as PlayAuthoringBindings, y as PlayAuthoringCallExecution, z as PlayAuthoringCallOptions, A as PlayAuthoringFetchResponse, B as PlayAuthoringInputContract, C as PlayAuthoringStepProgramStep, E as PlayAuthoringRuntimeStepOptions, F as PlaySqlListenerDeclaration, G as PlaySqlListenerEvent, H as PlaySqlListenerOperation, I as PlaySqlQuery, J as PlayAuthoringStepOptions, K as PlayAuthoringStepProgram, L as PlayAuthoringStepProgramResolver, M as PlayAuthoringStepResolver, N as PlayToolExecutionRequest, O as PlayAuthoringStepProgramOptions } from './compiler-manifest-YIjoJo8y.mjs';
+export { Q as DEEPLINE_EXTRACTOR_TARGETS, R as DEEPLINE_EXTRACTOR_TARGET_DEFINITIONS, S as DeeplineEmailStatusGetterValue, U as DeeplineExtractorTarget, V as DeeplineGetterValue, W as DeeplineGetterValueMap, X as JOB_CHANGE_STATUS_VALUES, Y as JobChangeStatus, Z as PHONE_STATUS_VALUES, _ as PhoneStatus, $ as PlayDataset, a0 as PlayDatasetInput, a1 as PreviousCell, a2 as ProviderTransientError, a3 as ProviderTransientErrorCategory, a4 as ProviderUnavailableError, a5 as ProviderUnavailableReason, a6 as ToolExecutionErrorCategory, a7 as ToolExecutionErrorOrigin, a8 as ToolExecutionFailureV1, a9 as ToolExecutionNetworkKind, aa as ToolExecutionNetworkScope, ab as getProviderUnavailableReason, ac as isDeeplineExtractorTarget, ad as isProviderUnavailable, ae as isProviderWaterfallUnavailableError } from './compiler-manifest-YIjoJo8y.mjs';
 import '@sinclair/typebox';
 
 declare const FIXTURE_BEHAVIOR_VERSION: 1;

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { e as PlayRuntimeBackendId, c as PlayCompilerManifest, D as DeeplineError, f as ToolExecutionError, g as ToolExecutionErrorOptions, h as PlayAuthoringColumnMap, i as PlayAuthoringColumnResolver, j as PlayAuthoringRuntimeContext, k as PlayAuthoringConditionalStepResolver, l as PlayAuthoringCsvInput, m as PlayAuthoringCsvOptions, n as PlayAuthoringDatasetBuilder, o as PlayAuthoringDatasetColumnDefinition, p as PlayAuthoringDatasetColumnRunInput, q as ToolExecuteResult, r as PlayAuthoringReferenceLike, s as PlayReturnObject$1, t as PlayAuthoringDefineConfig, u as PlayAuthoringDefinedPlay, v as PlayAuthoringFetchOptions, w as PlayAuthoringFileInput, x as PlayAuthoringBindings, y as PlayAuthoringCallExecution, z as PlayAuthoringCallOptions, A as PlayAuthoringFetchResponse, B as PlayAuthoringInputContract, C as PlayAuthoringStepProgramStep, E as PlayAuthoringRuntimeStepOptions, F as PlaySqlListenerDeclaration, G as PlaySqlListenerEvent, H as PlaySqlListenerOperation, I as PlaySqlQuery, J as PlayAuthoringStepOptions, K as PlayAuthoringStepProgram, L as PlayAuthoringStepProgramResolver, M as PlayAuthoringStepResolver, N as PlayToolExecutionRequest, O as PlayAuthoringStepProgramOptions } from './compiler-manifest-CdgJeOr2.js';
-export { Q as DEEPLINE_EXTRACTOR_TARGETS, R as DEEPLINE_EXTRACTOR_TARGET_DEFINITIONS, S as DeeplineEmailStatusGetterValue, U as DeeplineExtractorTarget, V as DeeplineGetterValue, W as DeeplineGetterValueMap, X as JOB_CHANGE_STATUS_VALUES, Y as JobChangeStatus, Z as PHONE_STATUS_VALUES, _ as PhoneStatus, $ as PlayDataset, a0 as PlayDatasetInput, a1 as PreviousCell, a2 as ProviderTransientError, a3 as ProviderTransientErrorCategory, a4 as ProviderUnavailableError, a5 as ProviderUnavailableReason, a6 as ToolExecutionErrorCategory, a7 as ToolExecutionErrorOrigin, a8 as ToolExecutionFailureV1, a9 as ToolExecutionNetworkKind, aa as ToolExecutionNetworkScope, ab as getProviderUnavailableReason, ac as isDeeplineExtractorTarget, ad as isProviderUnavailable, ae as isProviderWaterfallUnavailableError } from './compiler-manifest-CdgJeOr2.js';
+import { e as PlayRuntimeBackendId, c as PlayCompilerManifest, D as DeeplineError, f as ToolExecutionError, g as ToolExecutionErrorOptions, h as PlayAuthoringColumnMap, i as PlayAuthoringColumnResolver, j as PlayAuthoringRuntimeContext, k as PlayAuthoringConditionalStepResolver, l as PlayAuthoringCsvInput, m as PlayAuthoringCsvOptions, n as PlayAuthoringDatasetBuilder, o as PlayAuthoringDatasetColumnDefinition, p as PlayAuthoringDatasetColumnRunInput, q as ToolExecuteResult, r as PlayAuthoringReferenceLike, s as PlayReturnObject$1, t as PlayAuthoringDefineConfig, u as PlayAuthoringDefinedPlay, v as PlayAuthoringFetchOptions, w as PlayAuthoringFileInput, x as PlayAuthoringBindings, y as PlayAuthoringCallExecution, z as PlayAuthoringCallOptions, A as PlayAuthoringFetchResponse, B as PlayAuthoringInputContract, C as PlayAuthoringStepProgramStep, E as PlayAuthoringRuntimeStepOptions, F as PlaySqlListenerDeclaration, G as PlaySqlListenerEvent, H as PlaySqlListenerOperation, I as PlaySqlQuery, J as PlayAuthoringStepOptions, K as PlayAuthoringStepProgram, L as PlayAuthoringStepProgramResolver, M as PlayAuthoringStepResolver, N as PlayToolExecutionRequest, O as PlayAuthoringStepProgramOptions } from './compiler-manifest-YIjoJo8y.js';
+export { Q as DEEPLINE_EXTRACTOR_TARGETS, R as DEEPLINE_EXTRACTOR_TARGET_DEFINITIONS, S as DeeplineEmailStatusGetterValue, U as DeeplineExtractorTarget, V as DeeplineGetterValue, W as DeeplineGetterValueMap, X as JOB_CHANGE_STATUS_VALUES, Y as JobChangeStatus, Z as PHONE_STATUS_VALUES, _ as PhoneStatus, $ as PlayDataset, a0 as PlayDatasetInput, a1 as PreviousCell, a2 as ProviderTransientError, a3 as ProviderTransientErrorCategory, a4 as ProviderUnavailableError, a5 as ProviderUnavailableReason, a6 as ToolExecutionErrorCategory, a7 as ToolExecutionErrorOrigin, a8 as ToolExecutionFailureV1, a9 as ToolExecutionNetworkKind, aa as ToolExecutionNetworkScope, ab as getProviderUnavailableReason, ac as isDeeplineExtractorTarget, ad as isProviderUnavailable, ae as isProviderWaterfallUnavailableError } from './compiler-manifest-YIjoJo8y.js';
 import '@sinclair/typebox';
 
 declare const FIXTURE_BEHAVIOR_VERSION: 1;

package/dist/index.js

@@ -783,7 +783,7 @@ var SDK_RELEASE = {
   // 0.3.0 introduces raw-v2: complete scrubbed provider responses are
   // available at toolResponse.rawV2 while toolResponse.raw and all declared
   // getters keep their established compatibility behavior.
-  version: "0.3.7",
+  version: "0.3.8",
   updateSummary: "New raw-v2 tool responses preserve complete scrubbed provider envelopes at toolResponse.rawV2, including JSON:API included resources, links, cursors, and totals. Existing toolResponse.raw and declared getters keep working unchanged.",
   contracts: {
     api: {
@@ -1756,10 +1756,30 @@ function redactSecretLikeString(value) {
 function createSecretRedactionContext(initialValues = []) {
   const exactSecrets = /* @__PURE__ */ new Set();
   function register(value) {
-    if (value.length >= 4) exactSecrets.add(value);
+    if (value.length > 0) exactSecrets.add(value);
   }
   for (const value of initialValues) register(value);
-  function redactString2(value) {
+  function containsRegisteredSecret(value, {
+    includeEncoded = false,
+    minimumLength = 1
+  } = {}) {
+    for (const secret of exactSecrets) {
+      if (secret.length < minimumLength) continue;
+      if (value.includes(secret)) return true;
+      if (includeEncoded) {
+        try {
+          const encoded = encodeURIComponent(secret);
+          if (encoded !== secret && value.includes(encoded)) return true;
+        } catch {
+        }
+      }
+    }
+    return false;
+  }
+  function matchesRegisteredSecret(value) {
+    return exactSecrets.has(value);
+  }
+  function redactRegisteredSecrets(value) {
     let output = value;
     for (const secret of exactSecrets) {
       output = output.replace(
@@ -1777,6 +1797,10 @@ function createSecretRedactionContext(initialValues = []) {
       } catch {
       }
     }
+    return output;
+  }
+  function redactString2(value) {
+    const output = redactRegisteredSecrets(value);
     return redactSecretLikeString(output);
   }
   function redact(value) {
@@ -1809,6 +1833,9 @@ function createSecretRedactionContext(initialValues = []) {
   }
   return {
     register,
+    containsRegisteredSecret,
+    matchesRegisteredSecret,
+    redactRegisteredSecrets,
     redactString: redactString2,
     redactKnownSecrets,
     redact

package/dist/index.mjs

@@ -706,7 +706,7 @@ var SDK_RELEASE = {
   // 0.3.0 introduces raw-v2: complete scrubbed provider responses are
   // available at toolResponse.rawV2 while toolResponse.raw and all declared
   // getters keep their established compatibility behavior.
-  version: "0.3.7",
+  version: "0.3.8",
   updateSummary: "New raw-v2 tool responses preserve complete scrubbed provider envelopes at toolResponse.rawV2, including JSON:API included resources, links, cursors, and totals. Existing toolResponse.raw and declared getters keep working unchanged.",
   contracts: {
     api: {
@@ -1679,10 +1679,30 @@ function redactSecretLikeString(value) {
 function createSecretRedactionContext(initialValues = []) {
   const exactSecrets = /* @__PURE__ */ new Set();
   function register(value) {
-    if (value.length >= 4) exactSecrets.add(value);
+    if (value.length > 0) exactSecrets.add(value);
   }
   for (const value of initialValues) register(value);
-  function redactString2(value) {
+  function containsRegisteredSecret(value, {
+    includeEncoded = false,
+    minimumLength = 1
+  } = {}) {
+    for (const secret of exactSecrets) {
+      if (secret.length < minimumLength) continue;
+      if (value.includes(secret)) return true;
+      if (includeEncoded) {
+        try {
+          const encoded = encodeURIComponent(secret);
+          if (encoded !== secret && value.includes(encoded)) return true;
+        } catch {
+        }
+      }
+    }
+    return false;
+  }
+  function matchesRegisteredSecret(value) {
+    return exactSecrets.has(value);
+  }
+  function redactRegisteredSecrets(value) {
     let output = value;
     for (const secret of exactSecrets) {
       output = output.replace(
@@ -1700,6 +1720,10 @@ function createSecretRedactionContext(initialValues = []) {
       } catch {
       }
     }
+    return output;
+  }
+  function redactString2(value) {
+    const output = redactRegisteredSecrets(value);
     return redactSecretLikeString(output);
   }
   function redact(value) {
@@ -1732,6 +1756,9 @@ function createSecretRedactionContext(initialValues = []) {
   }
   return {
     register,
+    containsRegisteredSecret,
+    matchesRegisteredSecret,
+    redactRegisteredSecrets,
     redactString: redactString2,
     redactKnownSecrets,
     redact

package/dist/install-integrity.json

@@ -226,8 +226,8 @@
     "dist/cli/index.d.ts",
     "dist/cli/index.js",
     "dist/cli/index.mjs",
-    "dist/compiler-manifest-CdgJeOr2.d.mts",
-    "dist/compiler-manifest-CdgJeOr2.d.ts",
+    "dist/compiler-manifest-YIjoJo8y.d.mts",
+    "dist/compiler-manifest-YIjoJo8y.d.ts",
     "dist/helpers.d.mts",
     "dist/helpers.d.ts",
     "dist/helpers.js",

package/dist/plays/bundle-play-file.d.mts

@@ -1,5 +1,5 @@
-import { T as ToolExecutionErrorSchemaVersion, P as PlayAuthoringContractEdition, a as PlayArtifactKind$1, b as PlaySandboxRuntimeDeclaration, c as PlayCompilerManifest } from '../compiler-manifest-CdgJeOr2.mjs';
-export { d as PLAY_ARTIFACT_KINDS } from '../compiler-manifest-CdgJeOr2.mjs';
+import { T as ToolExecutionErrorSchemaVersion, P as PlayAuthoringContractEdition, a as PlayArtifactKind$1, b as PlaySandboxRuntimeDeclaration, c as PlayCompilerManifest } from '../compiler-manifest-YIjoJo8y.mjs';
+export { d as PLAY_ARTIFACT_KINDS } from '../compiler-manifest-YIjoJo8y.mjs';
 import '@sinclair/typebox';
 
 /**

package/dist/plays/bundle-play-file.d.ts

@@ -1,5 +1,5 @@
-import { T as ToolExecutionErrorSchemaVersion, P as PlayAuthoringContractEdition, a as PlayArtifactKind$1, b as PlaySandboxRuntimeDeclaration, c as PlayCompilerManifest } from '../compiler-manifest-CdgJeOr2.js';
-export { d as PLAY_ARTIFACT_KINDS } from '../compiler-manifest-CdgJeOr2.js';
+import { T as ToolExecutionErrorSchemaVersion, P as PlayAuthoringContractEdition, a as PlayArtifactKind$1, b as PlaySandboxRuntimeDeclaration, c as PlayCompilerManifest } from '../compiler-manifest-YIjoJo8y.js';
+export { d as PLAY_ARTIFACT_KINDS } from '../compiler-manifest-YIjoJo8y.js';
 import '@sinclair/typebox';
 
 /**