flowmarkup:
  title: Secrets Management
  version: 1
  description: "SECRET scope patterns: bearer auth, structured credentials, exec env injection, sub-flow grants."

  requires:
    SECRET: [api_token, db_creds, github_token]
    REQUEST: ["api.example.com"]
    EXEC: [git]
    SUBFLOWS: true

  do:
    # Bearer auth — single-value secret
  - request:
      _label_: Fetch users with bearer token
      url: https://api.example.com/users
      method: GET
      auth:
        bearer: =SECRET.api_token
      timeout: 30s
      result:
        users: =RESULT.body

    # Basic auth — structured secret with named fields
  - request:
      _label_: Query database API
      url: https://api.example.com/db/query
      method: POST
      auth:
        basic:
          username: =SECRET.db_creds.username
          password: =SECRET.db_creds.password
      body:
        json:
          query: "'SELECT * FROM orders WHERE status = ''pending'''"
      timeout: 30s
      result:
        pending_orders: =RESULT.body

    # Exec with secret env injection — secrets go in env, NEVER in args
  - exec:
      _label_: Clone private repo
      command: git
      args: [clone, --depth, '1', https://github.com/org/repo.git]
      env:
        GIT_TOKEN: =SECRET.github_token
        GIT_ASKPASS: echo
      timeout: 5m

    # Sub-flow with selective secret grant — only stated secrets are visible
  - run:
      _label_: Analyze with limited secrets
      flow: processing/analyze.flowmarkup.yaml
      cap:
        SECRET: [api_token]
        REQUEST: ["api.example.com"]
      params:
        data: =pending_orders
      timeout: 60s
      result:
        analysis: =RESULT.output

  - log: "Done. Users: {{users.size()}}, Orders: {{pending_orders.size()}}"
