deepline 0.3.7 → 0.3.9

package/dist/bundling-sources/shared_libs/play-runtime/secret-redaction.ts

@@ -75,6 +75,13 @@ export function redactSecretLikeString(value: string): string {
 
 export type SecretRedactionContext = {
   register(value: string): void;
+  containsRegisteredSecret(
+    value: string,
+    options?: { includeEncoded?: boolean; minimumLength?: number },
+  ): boolean;
+  matchesRegisteredSecret(value: string): boolean;
+  /** Redacts only values registered by the secret resolver, preserving safe diagnostics. */
+  redactRegisteredSecrets(value: string): string;
   redactString(value: string): string;
   redactKnownSecrets<T>(value: T): T;
   redact<T>(value: T): T;
@@ -86,12 +93,39 @@ export function createSecretRedactionContext(
   const exactSecrets = new Set<string>();
 
   function register(value: string): void {
-    if (value.length >= 4) exactSecrets.add(value);
+    if (value.length > 0) exactSecrets.add(value);
   }
 
   for (const value of initialValues) register(value);
 
-  function redactString(value: string): string {
+  function containsRegisteredSecret(
+    value: string,
+    {
+      includeEncoded = false,
+      minimumLength = 1,
+    }: { includeEncoded?: boolean; minimumLength?: number } = {},
+  ): boolean {
+    for (const secret of exactSecrets) {
+      if (secret.length < minimumLength) continue;
+      if (value.includes(secret)) return true;
+      if (includeEncoded) {
+        try {
+          const encoded = encodeURIComponent(secret);
+          if (encoded !== secret && value.includes(encoded)) return true;
+        } catch {
+          // Malformed surrogate pairs cannot be encoded. The raw comparison is
+          // still safe and handles every other secret value.
+        }
+      }
+    }
+    return false;
+  }
+
+  function matchesRegisteredSecret(value: string): boolean {
+    return exactSecrets.has(value);
+  }
+
+  function redactRegisteredSecrets(value: string): string {
     let output = value;
     for (const secret of exactSecrets) {
       output = output.replace(
@@ -111,6 +145,11 @@ export function createSecretRedactionContext(
         // redaction above still applies in that rare case.
       }
     }
+    return output;
+  }
+
+  function redactString(value: string): string {
+    const output = redactRegisteredSecrets(value);
     return redactSecretLikeString(output);
   }
 
@@ -148,6 +187,9 @@ export function createSecretRedactionContext(
 
   return {
     register,
+    containsRegisteredSecret,
+    matchesRegisteredSecret,
+    redactRegisteredSecrets,
     redactString,
     redactKnownSecrets,
     redact,

package/dist/bundling-sources/shared_libs/plays/authoring-contract.ts

@@ -7,9 +7,9 @@ import type { ToolExecutionErrorSchemaVersion } from '../tool-execution-error';
 import type { PlayDataset, PlayDatasetInput, PlayDatasetRow } from './dataset';
 
 export const LEGACY_PLAY_AUTHORING_CONTRACT_EDITION = 1 as const;
-export const PLAY_AUTHORING_CONTRACT_EDITION = 3 as const;
+export const PLAY_AUTHORING_CONTRACT_EDITION = 4 as const;
 export const PLAY_AUTHORING_INPUT_SCHEMA_SNAPSHOT_EDITION = 3 as const;
-export const SUPPORTED_PLAY_AUTHORING_CONTRACT_EDITIONS = [1, 2, 3] as const;
+export const SUPPORTED_PLAY_AUTHORING_CONTRACT_EDITIONS = [1, 2, 3, 4] as const;
 
 export type PlayAuthoringContractEdition =
   (typeof SUPPORTED_PLAY_AUTHORING_CONTRACT_EDITIONS)[number];
@@ -41,6 +41,14 @@ export const PLAY_AUTHORING_CONTRACT_CHANGELOG = [
     newWritesEnd: '2026-08-19',
     readerRemoval: null,
   },
+  {
+    edition: 4,
+    changed:
+      'ctx.secrets.get(name) resolves an allowed secret to a plaintext string for ordinary Play code. Editions 1–3 retain opaque secret handles.',
+    compatibilityOwner: 'Plays Runtime',
+    newWritesEnd: null,
+    readerRemoval: null,
+  },
 ] as const;
 
 export const PLAY_AUTHORING_CONTRACT_ISSUE_CODES = [
@@ -75,6 +83,7 @@ export const PLAY_AUTHORING_CONTRACT_ISSUE_CODES = [
   'tool_response_raw_access',
   'check_error',
   'docflow_compile_error',
+  'docflow_visualization_missing',
   'docflow_binding_drift',
   'docflow_branch_labels_required',
   'docflow_branch_requires_decision',
@@ -391,8 +400,10 @@ export type PlaySqlQuery = {
 };
 
 declare const PLAY_SECRET_HANDLE_BRAND: unique symbol;
+declare const PLAY_SECRET_PROMISE_BRAND: unique symbol;
 /**
- * An opaque reference to a workspace secret, returned by `ctx.secrets.get`. The handle never carries the value into play code: it stringifies to `[secret:NAME]` and throws on `JSON.stringify`, so a secret cannot reach a play variable, a log line, a dataset cell, or a replay artifact even by accident. Only the runtime resolves it, at the moment it attaches the request header.
+ * An opaque reference to a workspace secret used by legacy authoring-contract
+ * editions. New Plays receive plaintext strings from `ctx.secrets.get`.
  *
  * @sdkReference runtime 176 SecretHandle
  */
@@ -405,6 +416,12 @@ export type PlaySecretHandle = {
   /** Always throws. A secret handle is deliberately not serializable. */
   toJSON(): never;
 };
+/** A secret-reading promise returned only by `ctx.secrets.get`. */
+export type PlaySecretPromise = Promise<string> & {
+  readonly [PLAY_SECRET_PROMISE_BRAND]: never;
+};
+/** An opaque legacy secret handle retained for earlier Play artifacts. */
+export type PlaySecretValue = PlaySecretHandle;
 /**
  * One resolved authentication scheme, built by `ctx.secrets.bearer` or `ctx.secrets.header` and attached to a request through `init.auth`.
  *
@@ -413,8 +430,8 @@ export type PlaySecretHandle = {
 export type PlaySecretAuth = {
   /** `bearer` sends `Authorization: Bearer <value>`; `header` sends a named header. */
   readonly kind: 'bearer' | 'header';
-  /** The handle whose value the runtime attaches. */
-  readonly secret: PlaySecretHandle;
+  /** The value whose bytes the runtime attaches. */
+  readonly secret: string | PlaySecretPromise | PlaySecretValue;
   /** Header name, set only when `kind` is `header`. */
   readonly header?: string;
 };
@@ -426,10 +443,10 @@ export type PlaySecretAuthInput = PlaySecretAuth | readonly PlaySecretAuth[];
  * @sdkReference runtime 174 SecretAwareRequestInit
  */
 export type PlaySecretAwareRequestInit = Omit<RequestInit, 'headers'> & {
-  /** Ordinary request headers, recorded in the durable receipt. Never interpolate a secret value here — use `auth`. */
+  /** Ordinary request headers, recorded in the durable receipt with any resolved Play secret value redacted. Prefer `auth` for credentials: it enforces HTTPS and keeps the auth header out of the receipt. */
   headers?: HeadersInit;
   /**
-   * One or more secret-backed authentication headers for this request. Pass a single `ctx.secrets` auth for the common case, or an array when an API requires multiple credentialed headers — for example, Supabase with both `apikey` and `Authorization`. Every secret is resolved only while the request is attached, never stored in the durable receipt. Each auth entry must target a distinct header.
+   * One or more credentialed headers for this request. Pass a single `ctx.secrets` auth for the common case, or an array when an API requires multiple credentialed headers — for example, Supabase with both `apikey` and `Authorization`. Auth-helper requests require HTTPS and omit the credential from the durable receipt. Each auth entry must target a distinct header.
    */
   auth?: PlaySecretAuthInput;
 };
@@ -998,23 +1015,31 @@ export interface PlayAuthoringRuntimeContext {
 
   secrets: {
     /**
-     * Reference a workspace secret by name without reading its value. This is the only supported way to authenticate an outbound request from a Play: `process.env.X` is rejected at check time because an env read puts the raw value in a play variable, where it can reach a log line or a replay artifact. A handle cannot — pass it to `bearer` or `header` and the runtime resolves it only while attaching the header. Names are uppercased; manage stored values with `deepline secrets set` / `deepline secrets list`.
+     * Read an allowed workspace secret inside the running Play; do not log or return it. Declare uppercase names in top-level `secrets`.
      *
      * @sdkReference runtime 171 ctx.secrets.get(name)
      */
-    get(name: string): PlaySecretHandle;
+    get(name: string): PlaySecretPromise;
     /**
-     * Send the secret as `Authorization: Bearer <value>`.
+     * Send a credential as `Authorization: Bearer <value>`. Await `get` first;
+     * its direct promise remains accepted for source compatibility, while other
+     * promises are rejected.
      *
      * @sdkReference runtime 172 ctx.secrets.bearer(secret)
      */
-    bearer(secret: PlaySecretHandle): PlaySecretAuth;
+    bearer(
+      secret: string | PlaySecretPromise | PlaySecretHandle,
+    ): PlaySecretAuth;
     /**
-     * Send the secret as a named header, for APIs that do not use bearer tokens — `x-api-key`, `apikey`, `private-token`, and similar.
+     * Send a credential as a named header, for APIs that do not use bearer
+     * tokens — `x-api-key`, `apikey`, `private-token`, and similar.
      *
      * @sdkReference runtime 173 ctx.secrets.header(header, secret)
      */
-    header(header: string, secret: PlaySecretHandle): PlaySecretAuth;
+    header(
+      header: string,
+      secret: string | PlaySecretPromise | PlaySecretHandle,
+    ): PlaySecretAuth;
   };
 
   /**
@@ -2473,8 +2498,11 @@ export const PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   `  secrets?: readonly ${cloudReferenceType('bindings.secrets[]')}[];`,
   '};',
   'declare const SECRET_HANDLE_BRAND: unique symbol;',
+  'declare const SECRET_PROMISE_BRAND: unique symbol;',
   'export type SecretHandle = { readonly [SECRET_HANDLE_BRAND]: never; readonly name: string; toString(): string; toJSON(): never };',
-  "export type SecretAuth = { readonly kind: 'bearer' | 'header'; readonly secret: SecretHandle; readonly header?: string };",
+  'export type SecretPromise = Promise<string> & { readonly [SECRET_PROMISE_BRAND]: never };',
+  'export type SecretValue = SecretHandle;',
+  "export type SecretAuth = { readonly kind: 'bearer' | 'header'; readonly secret: string | SecretPromise | SecretHandle; readonly header?: string };",
   'export type SecretAuthInput = SecretAuth | readonly SecretAuth[];',
   'export type PlayInputContract<TInput> = { readonly schema: Record<string, unknown>; readonly __inputType?: TInput };',
   'export type PlayReturnObject = Record<string, unknown> & { readonly _metadata?: never };',
@@ -2525,7 +2553,7 @@ export const PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   `  tool<K extends string>(key: ${cloudReferenceType('ctx.tool.key')}, toolId: K, input: ${cloudReferenceType('ctx.tool.input')}, options?: { description?: ${cloudReferenceType('ctx.tool.options.description')} }): Promise<ToolExecutionOutput<K>>;`,
   '  step<T>(id: string, run: () => T | Promise<T>, options?: RuntimeStepOptions): Promise<T>;',
   "  fetch(key: string, url: string | URL, init?: RequestInit & { headers?: HeadersInit & { 'Idempotency-Key'?: string; 'X-Idempotency-Key'?: string }; auth?: SecretAuthInput }, options?: FetchOptions): Promise<PlayFetchResponse>;",
-  '  secrets: { get(name: string): SecretHandle; bearer(secret: SecretHandle): SecretAuth; header(header: string, secret: SecretHandle): SecretAuth };',
+  '  secrets: { get(name: string): SecretPromise; bearer(secret: string | SecretPromise | SecretHandle): SecretAuth; header(header: string, secret: string | SecretPromise | SecretHandle): SecretAuth };',
   `  runPlay<TOutput = unknown>(key: string, playRef: ${cloudReferenceType('ctx.runPlay.playRef')}, input: ${cloudReferenceType('ctx.runPlay.input')}, options: PlayCallOptions): Promise<TOutput>;`,
   '  log(message: string): void;',
   `  sleep(ms: ${cloudReferenceType('ctx.sleep.ms')}): Promise<void>;`,

package/dist/bundling-sources/shared_libs/plays/docflow.ts

@@ -128,13 +128,13 @@ export type PlayDocflow = {
   nodes: PlayDocflowNode[];
   edges: PlayDocflowEdge[];
   bindings: PlayDocflowBinding[];
-  /** Authoring syntax used by the source file. Absent on older persisted graphs. */
-  syntax?: 'docflow' | 'mermaid';
+  /** Authoring syntax used by the source file. */
+  syntax?: 'mermaid';
   /** Normalized Mermaid text, ready to pass directly to a Mermaid renderer. */
   mermaidSource?: string;
   /**
-   * Mermaid `subgraph` loop regions. Optional so older persisted graphs stay
-   * valid. Only populated for the Mermaid syntax; legacy `docflow` has none.
+   * Mermaid `subgraph` loop regions. Optional for persisted graphs that have
+   * no authored regions.
    */
   subgraphs?: PlayDocflowSubgraph[];
   /** Mermaid directives accepted by the parser but not applied by React Flow. */
@@ -232,11 +232,9 @@ export function docflowLabelCountFragment(label: string): string | null {
 }
 
 const FLOW_START = /^\s*(?:flowchart|graph)\s+(LR|RL|TB|TD|BT)\s*$/i;
-const PUT = /^\s*\/\/\s*put\s+(.+)$/;
 const MERMAID_NODE = /^\s*\/\/\s*@mermaid-node\s+([A-Za-z][\w-]*)(?:\s+(.*))?$/;
 const ATTRIBUTE = /([A-Za-z][\w-]*)\s*:\s*"([^"\n]*)"/y;
 const MERMAID_NODE_ATTRIBUTES = ['label', 'type', 'in', 'out', 'arm'] as const;
-const LEGACY_DOCFLOW_ATTRIBUTES = ['id', ...MERMAID_NODE_ATTRIBUTES] as const;
 const MERMAID_NODE_ID = /^[A-Za-z][\w-]*/;
 /**
  * `class a,b,c sketch` — the author declaring that no statement runs these boxes.
@@ -292,7 +290,6 @@ const MERMAID_NODE_SHAPES = [
 // label bracket is optional; when present the quotes are stripped by the caller.
 const SUBGRAPH_OPEN = /^\s*subgraph\s+([A-Za-z][\w-]*)\s*(?:\[(.*)\])?\s*$/i;
 const SUBGRAPH_END = /^\s*end\s*$/i;
-const DOCFLOW_EDGE_CONNECTOR = /^\s*-->(?:\|([^|]+)\|)?/;
 const MERMAID_EDGE_CONNECTOR = /^\s*(?:-->|-\.->|==>|---)(?:\|([^|]+)\|)?/;
 const DOCFLOW_PATH = /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*$/;
 const IDENTIFIER = /[A-Za-z_$][\w$]*/g;
@@ -314,17 +311,11 @@ const JS_WORDS = new Set([
 
 function parseAttributes(
   source: string,
-  input: {
-    line: number;
-    annotation: '@mermaid-node' | 'put';
-    errors: string[];
-  },
+  line: number,
+  errors: string[],
 ): Record<string, string> | null {
   const attributes: Record<string, string> = {};
-  const validAttributes =
-    input.annotation === '@mermaid-node'
-      ? MERMAID_NODE_ATTRIBUTES
-      : LEGACY_DOCFLOW_ATTRIBUTES;
+  const validAttributes = MERMAID_NODE_ATTRIBUTES;
   let cursor = 0;
   while (cursor < source.length) {
     cursor += /^\s*/.exec(source.slice(cursor))?.[0].length ?? 0;
@@ -334,21 +325,21 @@ function parseAttributes(
     if (!match) {
       const fragment =
         source.slice(cursor).split(/\s+/)[0] ?? source.slice(cursor);
-      input.errors.push(
-        `Docflow annotation on line ${input.line} has malformed attribute ${JSON.stringify(fragment)}. Use key:"value" pairs. Valid attributes: ${validAttributes.map((name) => `"${name}"`).join(', ')}.`,
+      errors.push(
+        `Docflow \`// @mermaid-node\` annotation on line ${line} has malformed attribute ${JSON.stringify(fragment)}. Use key:"value" pairs. Valid attributes: ${validAttributes.map((name) => `"${name}"`).join(', ')}.`,
       );
       return null;
     }
     const name = match[1]!;
     if (!(validAttributes as readonly string[]).includes(name)) {
-      input.errors.push(
-        `Docflow annotation on line ${input.line} has unknown attribute "${name}". Valid attributes: ${validAttributes.map((option) => `"${option}"`).join(', ')}.`,
+      errors.push(
+        `Docflow \`// @mermaid-node\` annotation on line ${line} has unknown attribute "${name}". Valid attributes: ${validAttributes.map((option) => `"${option}"`).join(', ')}.`,
       );
       return null;
     }
     if (Object.prototype.hasOwnProperty.call(attributes, name)) {
-      input.errors.push(
-        `Docflow annotation on line ${input.line} repeats attribute "${name}". Write each attribute once.`,
+      errors.push(
+        `Docflow \`// @mermaid-node\` annotation on line ${line} repeats attribute "${name}". Write each attribute once.`,
       );
       return null;
     }
@@ -508,7 +499,6 @@ function parseShapedMermaidNodes(fragment: string): ParsedMermaidNode[] {
 
 function parseEdgeChain(
   line: string,
-  syntax: 'docflow' | 'mermaid',
 ): { nodes: ParsedEdgeNode[]; labels: Array<string | undefined> } | null {
   let remaining = line;
   const first = parseMermaidNodeAtStart(remaining);
@@ -517,9 +507,7 @@ function parseEdgeChain(
   const labels: Array<string | undefined> = [];
   remaining = remaining.slice(first.length);
   while (remaining.trim()) {
-    const connector = (
-      syntax === 'mermaid' ? MERMAID_EDGE_CONNECTOR : DOCFLOW_EDGE_CONNECTOR
-    ).exec(remaining);
+    const connector = MERMAID_EDGE_CONNECTOR.exec(remaining);
     if (!connector) return null;
     remaining = remaining.slice(connector[0].length);
     const next = parseMermaidNodeAtStart(remaining);
@@ -630,7 +618,6 @@ function levenshtein(left: string, right: string): number {
 }
 
 const MERMAID_BLOCK = /\/\*\*\s*@mermaid(?:\s|\r?\n)([\s\S]*?)\*\//g;
-const LEGACY_BLOCK = /\/\*\*\s*@docflow(?:\s|\r?\n)([\s\S]*?)\*\//;
 /**
  * What a block header may name: an export name, or the play's own kebab-case
  * name. Hyphens are in the set for the second — `@mermaid name-to-linkedin-url-
@@ -702,12 +689,10 @@ type ParsedDocflowBlock = ParsedDocflowBlockGraph & {
 };
 
 /** How a block is named in a diagnostic. */
-function blockLabel(block: {
-  authoredExportName: string | null;
-  syntax: string;
-}): string {
-  const tag = block.syntax === 'mermaid' ? '@mermaid' : '@docflow';
-  return block.authoredExportName ? `${tag} ${block.authoredExportName}` : tag;
+function blockLabel(block: { authoredExportName: string | null }): string {
+  return block.authoredExportName
+    ? `@mermaid ${block.authoredExportName}`
+    : '@mermaid';
 }
 
 /**
@@ -717,7 +702,6 @@ function blockLabel(block: {
  */
 function parseDocflowBlockGraph(
   mermaidSource: string,
-  syntax: NonNullable<PlayDocflow['syntax']>,
   errors: string[],
 ): ParsedDocflowBlockGraph | null {
   const docLines = mermaidSource
@@ -746,11 +730,9 @@ function parseDocflowBlockGraph(
   const sketchIds = new Set<string>();
   const subgraphStack: PlayDocflowSubgraph[] = [];
   const subgraphIds = new Set<string>();
-  if (syntax === 'mermaid') {
-    for (const line of docLines.slice(1)) {
-      const opened = SUBGRAPH_OPEN.exec(line);
-      if (opened) subgraphIds.add(opened[1]!);
-    }
+  for (const line of docLines.slice(1)) {
+    const opened = SUBGRAPH_OPEN.exec(line);
+    if (opened) subgraphIds.add(opened[1]!);
   }
   // Ids that were DECLARED with a shape somewhere, as opposed to merely named
   // as an edge endpoint. A node nothing ever declares reaches the canvas
@@ -805,40 +787,38 @@ function parseDocflowBlockGraph(
     return sawDeclaration;
   };
   for (const line of docLines.slice(1)) {
-    if (syntax === 'mermaid') {
-      const opened = SUBGRAPH_OPEN.exec(line);
-      if (opened) {
-        const id = opened[1]!;
-        const rawLabel = opened[2]?.trim() ?? '';
-        const label =
-          rawLabel.length >= 2 &&
-          ((rawLabel.startsWith('"') && rawLabel.endsWith('"')) ||
-            (rawLabel.startsWith("'") && rawLabel.endsWith("'")))
-            ? rawLabel.slice(1, -1)
-            : rawLabel;
-        const subgraph: PlayDocflowSubgraph = {
-          id,
-          label: label || id,
-          memberIds: [],
-        };
-        subgraphs.set(id, subgraph);
-        subgraphStack.push(subgraph);
-        continue;
-      }
-      if (SUBGRAPH_END.test(line)) {
-        if (subgraphStack.length === 0) {
-          errors.push(
-            'Docflow has an `end` with no open `subgraph` above it. Every `end` closes exactly one `subgraph`.',
-          );
-        }
-        subgraphStack.pop();
-        continue;
+    const opened = SUBGRAPH_OPEN.exec(line);
+    if (opened) {
+      const id = opened[1]!;
+      const rawLabel = opened[2]?.trim() ?? '';
+      const label =
+        rawLabel.length >= 2 &&
+        ((rawLabel.startsWith('"') && rawLabel.endsWith('"')) ||
+          (rawLabel.startsWith("'") && rawLabel.endsWith("'")))
+          ? rawLabel.slice(1, -1)
+          : rawLabel;
+      const subgraph: PlayDocflowSubgraph = {
+        id,
+        label: label || id,
+        memberIds: [],
+      };
+      subgraphs.set(id, subgraph);
+      subgraphStack.push(subgraph);
+      continue;
+    }
+    if (SUBGRAPH_END.test(line)) {
+      if (subgraphStack.length === 0) {
+        errors.push(
+          'Docflow has an `end` with no open `subgraph` above it. Every `end` closes exactly one `subgraph`.',
+        );
       }
+      subgraphStack.pop();
+      continue;
     }
     let declaredOnThisLine = false;
     const isDirective =
       /^\s*(?:direction|classDef|class|style|linkStyle|click)\b/i.test(line);
-    if (syntax === 'mermaid' && isDirective) {
+    if (isDirective) {
       const sketch = SKETCH_CLASS.exec(line);
       if (sketch) {
         for (const id of sketch[1]!.split(',')) {
@@ -849,14 +829,12 @@ function parseDocflowBlockGraph(
         ignoredDirectives.push(line.trim());
       }
     }
-    if (syntax === 'mermaid' && !isDirective) {
+    if (!isDirective) {
       declaredOnThisLine = addNodes(line, line);
     }
-    const chain = parseEdgeChain(line, syntax);
+    const chain = parseEdgeChain(line);
     if (!chain) {
-      if (syntax === 'docflow') {
-        errors.push(`Unsupported docflow line: ${line.trim()}`);
-      } else if (!isDirective && !declaredOnThisLine) {
+      if (!isDirective && !declaredOnThisLine) {
         // Mermaid the parser could not consume at all: no edge, no node
         // declaration, not a directive it knowingly ignores. It used to be
         // skipped in silence, so a typo'd arrow or a stray token simply removed
@@ -867,7 +845,7 @@ function parseDocflowBlockGraph(
       }
       continue;
     }
-    if (syntax === 'docflow') addNodes(line, line);
+    addNodes(line, line);
     for (const node of chain.nodes) {
       // An edge endpoint may name a subgraph id; keep the edge but do not
       // materialize a regular node for the region.
@@ -953,12 +931,6 @@ export function parsePlayDocflowFile(
   sourceCode: string,
 ): PlayDocflowFileParseResult {
   const errors: string[] = [];
-  // Ids whose annotation was written but refused. They are NOT unbound boxes:
-  // the author already has one actionable error about them, and telling them to
-  // "bind it" on the next line is telling them to do what they just did.
-  const rejectedNodeIds = new Set<string>();
-  const bindings = parseDocflowBindings(sourceCode, errors, rejectedNodeIds);
-
   const rawBlocks: Array<{
     syntax: NonNullable<PlayDocflow['syntax']>;
     body: string;
@@ -967,18 +939,18 @@ export function parsePlayDocflowFile(
   for (const match of sourceCode.matchAll(MERMAID_BLOCK)) {
     rawBlocks.push({ syntax: 'mermaid', body: cleanBlockBody(match[1]!) });
   }
-  if (rawBlocks.length === 0) {
-    const legacy = LEGACY_BLOCK.exec(sourceCode);
-    if (legacy) {
-      rawBlocks.push({ syntax: 'docflow', body: cleanBlockBody(legacy[1]!) });
-    }
-  }
-  if (rawBlocks.length === 0) return { blocks: [], bindings, errors };
+  if (rawBlocks.length === 0) return { blocks: [], bindings: [], errors };
+
+  // Ids whose annotation was written but refused. They are NOT unbound boxes:
+  // the author already has one actionable error about them, and telling them to
+  // "bind it" on the next line is telling them to do what they just did.
+  const rejectedNodeIds = new Set<string>();
+  const bindings = parseDocflowBindings(sourceCode, errors, rejectedNodeIds);
 
   const parsedBlocks: ParsedDocflowBlock[] = [];
   for (const raw of rawBlocks) {
     const { exportName, diagram } = splitBlockExportHeader(raw.body);
-    const graph = parseDocflowBlockGraph(diagram, raw.syntax, errors);
+    const graph = parseDocflowBlockGraph(diagram, errors);
     if (!graph) continue;
     parsedBlocks.push({
       ...graph,
@@ -1324,10 +1296,8 @@ function attachBindingsToBlocks(
       )
         continue;
       errors.push(
-        block.syntax === 'docflow'
-          ? `Docflow node "${node.id}" has no code binding; mark it type:"conceptual" or bind it.`
-          : `Docflow box "${node.id}" in \`${blockLabel(block)}\` points at nothing, so the canvas can only draw it and say nothing about it. ` +
-              `Either put \`// @mermaid-node ${node.id}\` above the statement it runs, or — if this play has no such statement, because the work happens in another module or inside a loop — add it to a \`class ${node.id} sketch\` line in the block to declare it a sketch.`,
+        `Docflow box "${node.id}" in \`${blockLabel(block)}\` points at nothing, so the canvas can only draw it and say nothing about it. ` +
+          `Either put \`// @mermaid-node ${node.id}\` above the statement it runs, or — if this play has no such statement, because the work happens in another module or inside a loop — add it to a \`class ${node.id} sketch\` line in the block to declare it a sketch.`,
       );
     }
   }
@@ -1389,23 +1359,18 @@ function parseDocflowBindings(
   const bindings: PlayDocflowBinding[] = [];
 
   for (let index = 0; index < lines.length; index += 1) {
-    PUT.lastIndex = 0;
     MERMAID_NODE.lastIndex = 0;
-    const legacyMatch = PUT.exec(lines[index]!);
-    const mermaidMatch = MERMAID_NODE.exec(lines[index]!);
-    if (!legacyMatch && !mermaidMatch) continue;
+    const mermaidMatch = MERMAID_NODE.exec(lines[index]!) ?? null;
+    if (!mermaidMatch) continue;
     // Whatever this annotation names, the author has now written it down. Every
     // `continue` below is a rejection, and a rejected id must not come back as
     // an unbound box — see `rejectedNodeIds` in `parsePlayDocflowFile`.
-    const annotatedId = mermaidMatch?.[1]?.trim();
+    const annotatedId = mermaidMatch[1]?.trim();
     if (annotatedId) rejectedNodeIds.add(annotatedId);
     const attributes = parseAttributes(
-      mermaidMatch ? (mermaidMatch[2] ?? '') : legacyMatch![1]!,
-      {
-        line: index + 1,
-        annotation: mermaidMatch ? '@mermaid-node' : 'put',
-        errors,
-      },
+      mermaidMatch[2] ?? '',
+      index + 1,
+      errors,
     );
     if (!attributes) continue;
     const id = (annotatedId ?? attributes.id)?.trim();