deepline 0.3.167 → 0.3.169

package/README.md

@@ -41,7 +41,7 @@ with project-local skills automatically.
 Paste this into Claude Code, Codex, or another coding agent:
 
 ```text
-Install the official Deepline CLI globally from npm (package: deepline) by following https://code.deepline.com/INSTALL.md.
+Install and set up the official Deepline CLI globally from npm (package: deepline) by following https://code.deepline.com/INSTALL.md.
 ```
 
 Once setup is complete, tell your agent what you want to do:

package/dist/bundling-sources/sdk/src/release.ts

@@ -200,7 +200,7 @@ export const SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: '0.3.167',
+  version: '0.3.169',
   updateSummary:
     'Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.',
   packageCapabilities: {

package/dist/bundling-sources/shared_libs/monitors/package.json

@@ -73,6 +73,8 @@
     "./provider-monitor-errors.js": "./provider-monitor-errors.ts",
     "./provider-monitor-identity-claims": "./provider-monitor-identity-claims.ts",
     "./provider-monitor-identity-claims.js": "./provider-monitor-identity-claims.ts",
+    "./provider-monitor-conflicts": "./provider-monitor-conflicts.ts",
+    "./provider-monitor-conflicts.js": "./provider-monitor-conflicts.ts",
     "./provider-monitor-legacy-aliases": "./provider-monitor-legacy-aliases.ts",
     "./provider-monitor-legacy-aliases.js": "./provider-monitor-legacy-aliases.ts",
     "./provider-monitor-priority-execution": "./provider-monitor-priority-execution.ts",

package/dist/bundling-sources/shared_libs/monitors/provider-monitor-capability.ts

@@ -197,10 +197,17 @@ export type ProviderMonitorCapabilityDefinition = {
    */
   upstreamCollision?: {
     identityKeyFields: readonly string[];
+    /**
+     * Different effective payload configurations may hold separate Deepline
+     * claims inside one provider identity scope. This does not override an
+     * upstream 409 if the provider itself enforces a broader uniqueness rule.
+     */
+    allowDistinctConfigurations?: boolean;
     /**
      * This provider can create an updated resource for the same Deepline
      * monitor key before the prior upstream resource is deprovisioned. This
-     * never permits a second key to occupy the same identity in one org.
+     * never permits a second key to occupy the same exact configuration in
+     * one org.
      */
     supportsSameIdentityReplacement?: boolean;
   };
@@ -444,7 +451,7 @@ export function defineProviderMonitorCapability(input: {
       },
       identity: {
         semantics: input.upstreamCollision
-          ? `One monitor identity uses ${input.upstreamCollision.identityKeyFields.join(', ')}.`
+          ? `The provider resource scope uses ${input.upstreamCollision.identityKeyFields.join(', ')}.${input.upstreamCollision.allowDistinctConfigurations ? ' Different effective payload configurations in that scope may be separate monitor resources; exact duplicates still conflict.' : ''}`
           : 'This monitor uses the provider capability identity declared by Deepline.',
         update:
           'Use monitors update for a patch or deploy for a complete desired definition.',

package/dist/bundling-sources/shared_libs/monitors/provider-monitor-conflicts.ts

@@ -0,0 +1,85 @@
+import {
+  providerMonitorUpstreamIdentityClaimKey,
+  providerMonitorUpstreamIdentitySignature,
+} from './provider-monitor-upstream-identity';
+
+export type ProviderMonitorConflictIdentity = {
+  tool: string;
+  /** Exact effective configuration key stored in providerMonitorIdentityClaims. */
+  identityKey: string;
+  /** Broad provider-declared scope; this is also the legacy claim key. */
+  scopeKey: string;
+  /** Safe, customer-facing description of the provider-declared scope. */
+  identity: Record<string, string | null>;
+};
+
+/**
+ * Builds the one canonical conflict identity used by scalar Monitors, Fleets,
+ * and Batches. Same scope + same configuration conflicts; same scope with a
+ * distinct supported configuration gets its own indexed claim.
+ */
+export function providerMonitorConflictIdentity(input: {
+  tool: string;
+  payload: Record<string, unknown> | null | undefined;
+}): ProviderMonitorConflictIdentity | null {
+  const signature = providerMonitorUpstreamIdentitySignature(
+    input.tool,
+    input.payload,
+  );
+  if (!signature) return null;
+  const identity = Object.fromEntries(
+    Object.entries(signature.key).sort(([left], [right]) =>
+      left.localeCompare(right),
+    ),
+  );
+  const scopeKey = JSON.stringify(identity);
+  return {
+    tool: signature.tool,
+    identityKey:
+      providerMonitorUpstreamIdentityClaimKey(input.tool, input.payload) ??
+      scopeKey,
+    scopeKey,
+    identity,
+  };
+}
+
+/** Exact same effective configuration, regardless of monitor key or owner. */
+export function sameProviderMonitorConflictIdentity(
+  left: ProviderMonitorConflictIdentity | null | undefined,
+  right: ProviderMonitorConflictIdentity | null | undefined,
+) {
+  return Boolean(
+    left &&
+    right &&
+    left.tool === right.tool &&
+    left.identityKey === right.identityKey,
+  );
+}
+
+/** Same provider resource scope, even when filter/configuration differs. */
+export function sameProviderMonitorConflictScope(
+  left: ProviderMonitorConflictIdentity | null | undefined,
+  right: ProviderMonitorConflictIdentity | null | undefined,
+) {
+  return Boolean(
+    left &&
+    right &&
+    left.tool === right.tool &&
+    left.scopeKey === right.scopeKey,
+  );
+}
+
+/**
+ * Whether the definitions are valid separate variants under the capability's
+ * declared policy. Providers can still reject the second create; their 409 is
+ * handled as an upstream conflict, not mistaken for a Deepline duplicate.
+ */
+export function providerMonitorDefinitionsAreDistinctConfigurations(
+  left: ProviderMonitorConflictIdentity | null | undefined,
+  right: ProviderMonitorConflictIdentity | null | undefined,
+) {
+  return Boolean(
+    sameProviderMonitorConflictScope(left, right) &&
+    !sameProviderMonitorConflictIdentity(left, right),
+  );
+}

package/dist/bundling-sources/shared_libs/monitors/provider-monitor-identity-claims.ts

@@ -10,14 +10,14 @@ import {
 import { MAX_PRIORITY_MONITORS_PER_ORG } from '@deepline/monitors/provider-monitor-priority-execution';
 import { internal } from '@deepline/convex-client/function-references';
 import { getRequiredInternalConvexClient } from '@deepline/convex-client/internal-client';
-import {
-  providerMonitorUpstreamIdentitySignature,
-  type ProviderMonitorUpstreamIdentitySignature,
-} from '@deepline/monitors/provider-monitor-upstream-identity';
+import { providerMonitorConflictIdentity } from '@deepline/monitors/provider-monitor-conflicts';
 
 export type ProviderMonitorIdentityClaim = {
   tool: string;
+  /** Exact effective configuration identity, used by the indexed claim. */
   identityKey: string;
+  /** Provider-declared broad identity scope; legacy claims used this key. */
+  scopeKey: string;
   identity: Record<string, string | null>;
 };
 
@@ -31,13 +31,19 @@ type OrgAuthContext = { orgId: string };
  */
 export type ProviderMonitorIdentityClaimReference = Pick<
   ProviderMonitorIdentityClaim,
-  'tool' | 'identityKey'
+  'tool' | 'identityKey' | 'scopeKey'
 >;
 
 export function providerMonitorIdentityClaimReference(
   claim: ProviderMonitorIdentityClaim | null | undefined,
 ): ProviderMonitorIdentityClaimReference | null {
-  return claim ? { tool: claim.tool, identityKey: claim.identityKey } : null;
+  return claim
+    ? {
+        tool: claim.tool,
+        identityKey: claim.identityKey,
+        scopeKey: claim.scopeKey,
+      }
+    : null;
 }
 
 export type ProviderMonitorIdentityReservation =
@@ -146,19 +152,6 @@ export function normalizeProviderMonitorLifecycleReservation(input: {
   };
 }
 
-function claimFromSignature(
-  signature: ProviderMonitorUpstreamIdentitySignature,
-): ProviderMonitorIdentityClaim {
-  const identity = Object.fromEntries(
-    Object.entries(signature.key).sort(([a], [b]) => a.localeCompare(b)),
-  );
-  return {
-    tool: signature.tool,
-    identityKey: JSON.stringify(identity),
-    identity,
-  };
-}
-
 export function providerMonitorIdentityClaim(input: {
   tool: string;
   payload: Record<string, unknown> | null | undefined;
@@ -166,11 +159,7 @@ export function providerMonitorIdentityClaim(input: {
   // Claims protect provider resources, including legacy rows whose public
   // capability id was later retired. The Convex-safe identity contract owns
   // those aliases; the live capability registry intentionally does not.
-  const signature = providerMonitorUpstreamIdentitySignature(
-    input.tool,
-    input.payload,
-  );
-  return signature ? claimFromSignature(signature) : null;
+  return providerMonitorConflictIdentity(input);
 }
 
 /**
@@ -230,6 +219,7 @@ export async function getProviderMonitorIdentityOwner(input: {
       orgId: input.auth.orgId,
       tool: input.claim.tool,
       identityKey: input.claim.identityKey,
+      scopeKey: input.claim.scopeKey,
     },
   );
 }
@@ -455,6 +445,7 @@ export async function beginProviderMonitorIdentityReservation(input: {
       orgId: input.auth.orgId,
       tool: claim.tool,
       identityKey: claim.identityKey,
+      scopeKey: claim.scopeKey,
       monitorKey: input.monitorKey,
       operationId,
       ...(input.reclaimSelfProvisioning
@@ -491,6 +482,7 @@ async function mutateClaim(
       orgId: input.auth.orgId,
       tool: input.claim.tool,
       identityKey: input.claim.identityKey,
+      ...(action === 'release' ? { scopeKey: input.claim.scopeKey } : {}),
       monitorKey: input.monitorKey,
       ...(input.operationId ? { operationId: input.operationId } : {}),
     },

package/dist/bundling-sources/shared_libs/monitors/provider-monitor-upstream-identity.ts

@@ -22,20 +22,34 @@ type ProviderMonitorUpstreamIdentityField = {
   runtimePayloadAliases?: readonly string[];
 };
 
+type ProviderMonitorUpstreamIdentityDefinition = {
+  fields: readonly ProviderMonitorUpstreamIdentityField[];
+  /**
+   * Let distinct effective configurations reserve separate provider monitor
+   * claims inside one broad identity scope. The upstream provider can still
+   * reject a second resource with 409; this only prevents Deepline from
+   * treating different authored filters as an exact duplicate.
+   */
+  allowDistinctConfigurations?: boolean;
+};
+
 const PROVIDER_MONITOR_UPSTREAM_IDENTITY_FIELDS = {
-  'deepline_native.company_radar': [{ name: 'radar_type' }, { name: 'domain' }],
-  'deepline_native.contact_radar': [
-    { name: 'radar_type' },
-    { name: 'profile_url' },
-  ],
-  'deepline_native.industry_radar': [
-    { name: 'radar_type' },
-    { name: 'industry', runtimePayloadAliases: ['keyword'] },
-  ],
-} as const satisfies Record<
-  string,
-  readonly ProviderMonitorUpstreamIdentityField[]
->;
+  'deepline_native.company_radar': {
+    fields: [{ name: 'radar_type' }, { name: 'domain' }],
+    allowDistinctConfigurations: true,
+  },
+  'deepline_native.contact_radar': {
+    fields: [{ name: 'radar_type' }, { name: 'profile_url' }],
+    allowDistinctConfigurations: true,
+  },
+  'deepline_native.industry_radar': {
+    fields: [
+      { name: 'radar_type' },
+      { name: 'industry', runtimePayloadAliases: ['keyword'] },
+    ],
+    allowDistinctConfigurations: true,
+  },
+} as const satisfies Record<string, ProviderMonitorUpstreamIdentityDefinition>;
 
 function canonicalMonitorTool(tool: string) {
   // Public TamRadar ids existed before the deepline_native hard cutover. Keep
@@ -82,7 +96,18 @@ export function providerMonitorUpstreamIdentityFields(tool: string) {
   const canonical = canonicalMonitorTool(tool);
   return PROVIDER_MONITOR_UPSTREAM_IDENTITY_FIELDS[
     canonical as keyof typeof PROVIDER_MONITOR_UPSTREAM_IDENTITY_FIELDS
-  ]?.map((field) => field.name);
+  ]?.fields.map((field) => field.name);
+}
+
+export function providerMonitorUpstreamIdentityAllowsDistinctConfigurations(
+  tool: string,
+) {
+  const canonical = canonicalMonitorTool(tool);
+  return (
+    PROVIDER_MONITOR_UPSTREAM_IDENTITY_FIELDS[
+      canonical as keyof typeof PROVIDER_MONITOR_UPSTREAM_IDENTITY_FIELDS
+    ]?.allowDistinctConfigurations ?? false
+  );
 }
 
 export function providerMonitorUpstreamIdentitySignature(
@@ -93,7 +118,7 @@ export function providerMonitorUpstreamIdentitySignature(
   const fields =
     PROVIDER_MONITOR_UPSTREAM_IDENTITY_FIELDS[
       canonical as keyof typeof PROVIDER_MONITOR_UPSTREAM_IDENTITY_FIELDS
-    ];
+    ]?.fields;
   if (!fields?.length) return null;
   const key: Record<string, ProviderMonitorUpstreamIdentityValue> = {};
   for (const field of fields) {
@@ -110,3 +135,42 @@ export function providerMonitorUpstreamIdentitySignature(
   }
   return { tool: canonical, key };
 }
+
+/**
+ * Exact claim identity used by the Convex conflict index. The provider's
+ * declared scope remains visible in `scopeKey`; providers that allow
+ * configuration variants add every non-scope payload field to the claim key.
+ * Keeping the old scope JSON as the prefix lets readers recognize claims
+ * created before this distinction was introduced.
+ */
+export function providerMonitorUpstreamIdentityClaimKey(
+  tool: string,
+  payload: Record<string, unknown> | null | undefined,
+) {
+  const signature = providerMonitorUpstreamIdentitySignature(tool, payload);
+  if (!signature) return null;
+  const scopeKey = stableJson(signature.key);
+  if (!providerMonitorUpstreamIdentityAllowsDistinctConfigurations(tool)) {
+    return scopeKey;
+  }
+
+  const definition =
+    PROVIDER_MONITOR_UPSTREAM_IDENTITY_FIELDS[
+      signature.tool as keyof typeof PROVIDER_MONITOR_UPSTREAM_IDENTITY_FIELDS
+    ];
+  const scopeAndAliases = new Set<string>(
+    definition.fields.flatMap((field) => [
+      field.name,
+      ...('runtimePayloadAliases' in field
+        ? (field.runtimePayloadAliases ?? [])
+        : []),
+    ]),
+  );
+  const configuration = Object.fromEntries(
+    Object.entries(payload ?? {}).filter(
+      ([field]) => !scopeAndAliases.has(field),
+    ),
+  );
+  if (Object.keys(configuration).length === 0) return scopeKey;
+  return `${scopeKey}#configuration=${stableJson(configuration)}`;
+}

package/dist/bundling-sources/shared_libs/play-runtime/secret-redaction.ts

@@ -7,6 +7,40 @@ const BASIC_CREDENTIAL_RE = /\bBasic\s+[A-Za-z0-9+/]{4,}={0,2}\b/g;
 // segments are far smaller; 16 KiB per segment still leaves ample headroom.
 const JWT_RE =
   /\b[A-Za-z0-9_-]{8,16384}\.[A-Za-z0-9_-]{1,16384}\.[A-Za-z0-9_-]{8,16384}\b/g;
+const EMAIL_LOCAL_CHAR_RE = /[A-Za-z0-9.!#$%&'*+/=?^_`{|}~-]/;
+const EMAIL_DOMAIN_RE =
+  /^[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?\.[A-Za-z]{2,63}\b/;
+
+/** A JWT-shaped substring inside an email address is contact data, not a token. */
+function isEmailLocalPart(value: string, start: number, end: number): boolean {
+  let localStart = start;
+  while (localStart > 0 && EMAIL_LOCAL_CHAR_RE.test(value[localStart - 1]!)) {
+    localStart -= 1;
+  }
+  let localEnd = end;
+  while (
+    localEnd < value.length &&
+    EMAIL_LOCAL_CHAR_RE.test(value[localEnd]!)
+  ) {
+    localEnd += 1;
+  }
+  return (
+    localStart < localEnd &&
+    localEnd - localStart <= 64 &&
+    value[localEnd] === '@' &&
+    EMAIL_DOMAIN_RE.test(value.slice(localEnd + 1))
+  );
+}
+
+function redactTokenUnlessEmail(
+  match: string,
+  offset: number,
+  source: string,
+): string {
+  return isEmailLocalPart(source, offset, offset + match.length)
+    ? match
+    : SECRET_REDACTION_PLACEHOLDER;
+}
 const PRIVATE_KEY_RE =
   /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
 const SENSITIVE_FIELD_NAME =
@@ -133,9 +167,9 @@ export function redactSecretLikeString(value: string): string {
     .replace(PRIVATE_KEY_RE, SECRET_REDACTION_PLACEHOLDER)
     .replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`)
     .replace(BASIC_CREDENTIAL_RE, `Basic ${SECRET_REDACTION_PLACEHOLDER}`)
-    .replace(JWT_RE, SECRET_REDACTION_PLACEHOLDER)
-    .replace(COMMON_SECRET_RE, SECRET_REDACTION_PLACEHOLDER)
-    .replace(GENERIC_PREFIXED_SECRET_RE, SECRET_REDACTION_PLACEHOLDER)
+    .replace(JWT_RE, redactTokenUnlessEmail)
+    .replace(COMMON_SECRET_RE, redactTokenUnlessEmail)
+    .replace(GENERIC_PREFIXED_SECRET_RE, redactTokenUnlessEmail)
     .replace(GENERIC_SECRET_ASSIGNMENT_RE, SECRET_REDACTION_PLACEHOLDER)
     .replace(HIGH_ENTROPY_ASSIGNMENT_RE, (match) => {
       const separator = match.includes('=') ? '=' : ':';

package/dist/cli/index.js

@@ -3051,7 +3051,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.167",
+  version: "0.3.169",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1
@@ -4415,6 +4415,22 @@ var SECRET_REDACTION_PLACEHOLDER = "[REDACTED_SECRET]";
 var BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
 var BASIC_CREDENTIAL_RE = /\bBasic\s+[A-Za-z0-9+/]{4,}={0,2}\b/g;
 var JWT_RE = /\b[A-Za-z0-9_-]{8,16384}\.[A-Za-z0-9_-]{1,16384}\.[A-Za-z0-9_-]{8,16384}\b/g;
+var EMAIL_LOCAL_CHAR_RE = /[A-Za-z0-9.!#$%&'*+/=?^_`{|}~-]/;
+var EMAIL_DOMAIN_RE = /^[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?\.[A-Za-z]{2,63}\b/;
+function isEmailLocalPart(value, start, end) {
+  let localStart = start;
+  while (localStart > 0 && EMAIL_LOCAL_CHAR_RE.test(value[localStart - 1])) {
+    localStart -= 1;
+  }
+  let localEnd = end;
+  while (localEnd < value.length && EMAIL_LOCAL_CHAR_RE.test(value[localEnd])) {
+    localEnd += 1;
+  }
+  return localStart < localEnd && localEnd - localStart <= 64 && value[localEnd] === "@" && EMAIL_DOMAIN_RE.test(value.slice(localEnd + 1));
+}
+function redactTokenUnlessEmail(match, offset, source) {
+  return isEmailLocalPart(source, offset, offset + match.length) ? match : SECRET_REDACTION_PLACEHOLDER;
+}
 var PRIVATE_KEY_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
 var SENSITIVE_FIELD_NAME = "authorization|cookie|password|(?:client[_-]?)?secret|(?:access|refresh)[_-]?token|(?:x[_-]?)?api[_-]?key|private[_-]?key|token|credentials";
 var COMMON_SECRET_RE = /\b(?:[prs]k_(?:live|test)_|(?:pat|ghp|github_pat)_|xox[baprs]-)[A-Za-z0-9_./+=:-]{12,}\b/gi;
@@ -4498,7 +4514,7 @@ function redactSecretLikeString(value) {
       return serializedRedacted;
     }
   }
-  return serializedRedacted.replace(PRIVATE_KEY_RE, SECRET_REDACTION_PLACEHOLDER).replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`).replace(BASIC_CREDENTIAL_RE, `Basic ${SECRET_REDACTION_PLACEHOLDER}`).replace(JWT_RE, SECRET_REDACTION_PLACEHOLDER).replace(COMMON_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(GENERIC_PREFIXED_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(GENERIC_SECRET_ASSIGNMENT_RE, SECRET_REDACTION_PLACEHOLDER).replace(HIGH_ENTROPY_ASSIGNMENT_RE, (match) => {
+  return serializedRedacted.replace(PRIVATE_KEY_RE, SECRET_REDACTION_PLACEHOLDER).replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`).replace(BASIC_CREDENTIAL_RE, `Basic ${SECRET_REDACTION_PLACEHOLDER}`).replace(JWT_RE, redactTokenUnlessEmail).replace(COMMON_SECRET_RE, redactTokenUnlessEmail).replace(GENERIC_PREFIXED_SECRET_RE, redactTokenUnlessEmail).replace(GENERIC_SECRET_ASSIGNMENT_RE, SECRET_REDACTION_PLACEHOLDER).replace(HIGH_ENTROPY_ASSIGNMENT_RE, (match) => {
     const separator = match.includes("=") ? "=" : ":";
     const [key] = match.split(separator, 1);
     return `${key.trim()}${separator}${SECRET_REDACTION_PLACEHOLDER}`;

package/dist/cli/index.mjs

@@ -3046,7 +3046,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.167",
+  version: "0.3.169",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1
@@ -4410,6 +4410,22 @@ var SECRET_REDACTION_PLACEHOLDER = "[REDACTED_SECRET]";
 var BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
 var BASIC_CREDENTIAL_RE = /\bBasic\s+[A-Za-z0-9+/]{4,}={0,2}\b/g;
 var JWT_RE = /\b[A-Za-z0-9_-]{8,16384}\.[A-Za-z0-9_-]{1,16384}\.[A-Za-z0-9_-]{8,16384}\b/g;
+var EMAIL_LOCAL_CHAR_RE = /[A-Za-z0-9.!#$%&'*+/=?^_`{|}~-]/;
+var EMAIL_DOMAIN_RE = /^[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?\.[A-Za-z]{2,63}\b/;
+function isEmailLocalPart(value, start, end) {
+  let localStart = start;
+  while (localStart > 0 && EMAIL_LOCAL_CHAR_RE.test(value[localStart - 1])) {
+    localStart -= 1;
+  }
+  let localEnd = end;
+  while (localEnd < value.length && EMAIL_LOCAL_CHAR_RE.test(value[localEnd])) {
+    localEnd += 1;
+  }
+  return localStart < localEnd && localEnd - localStart <= 64 && value[localEnd] === "@" && EMAIL_DOMAIN_RE.test(value.slice(localEnd + 1));
+}
+function redactTokenUnlessEmail(match, offset, source) {
+  return isEmailLocalPart(source, offset, offset + match.length) ? match : SECRET_REDACTION_PLACEHOLDER;
+}
 var PRIVATE_KEY_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
 var SENSITIVE_FIELD_NAME = "authorization|cookie|password|(?:client[_-]?)?secret|(?:access|refresh)[_-]?token|(?:x[_-]?)?api[_-]?key|private[_-]?key|token|credentials";
 var COMMON_SECRET_RE = /\b(?:[prs]k_(?:live|test)_|(?:pat|ghp|github_pat)_|xox[baprs]-)[A-Za-z0-9_./+=:-]{12,}\b/gi;
@@ -4493,7 +4509,7 @@ function redactSecretLikeString(value) {
       return serializedRedacted;
     }
   }
-  return serializedRedacted.replace(PRIVATE_KEY_RE, SECRET_REDACTION_PLACEHOLDER).replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`).replace(BASIC_CREDENTIAL_RE, `Basic ${SECRET_REDACTION_PLACEHOLDER}`).replace(JWT_RE, SECRET_REDACTION_PLACEHOLDER).replace(COMMON_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(GENERIC_PREFIXED_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(GENERIC_SECRET_ASSIGNMENT_RE, SECRET_REDACTION_PLACEHOLDER).replace(HIGH_ENTROPY_ASSIGNMENT_RE, (match) => {
+  return serializedRedacted.replace(PRIVATE_KEY_RE, SECRET_REDACTION_PLACEHOLDER).replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`).replace(BASIC_CREDENTIAL_RE, `Basic ${SECRET_REDACTION_PLACEHOLDER}`).replace(JWT_RE, redactTokenUnlessEmail).replace(COMMON_SECRET_RE, redactTokenUnlessEmail).replace(GENERIC_PREFIXED_SECRET_RE, redactTokenUnlessEmail).replace(GENERIC_SECRET_ASSIGNMENT_RE, SECRET_REDACTION_PLACEHOLDER).replace(HIGH_ENTROPY_ASSIGNMENT_RE, (match) => {
     const separator = match.includes("=") ? "=" : ":";
     const [key] = match.split(separator, 1);
     return `${key.trim()}${separator}${SECRET_REDACTION_PLACEHOLDER}`;

package/dist/index.js

@@ -864,7 +864,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.167",
+  version: "0.3.169",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1
@@ -2185,6 +2185,22 @@ var SECRET_REDACTION_PLACEHOLDER = "[REDACTED_SECRET]";
 var BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
 var BASIC_CREDENTIAL_RE = /\bBasic\s+[A-Za-z0-9+/]{4,}={0,2}\b/g;
 var JWT_RE = /\b[A-Za-z0-9_-]{8,16384}\.[A-Za-z0-9_-]{1,16384}\.[A-Za-z0-9_-]{8,16384}\b/g;
+var EMAIL_LOCAL_CHAR_RE = /[A-Za-z0-9.!#$%&'*+/=?^_`{|}~-]/;
+var EMAIL_DOMAIN_RE = /^[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?\.[A-Za-z]{2,63}\b/;
+function isEmailLocalPart(value, start, end) {
+  let localStart = start;
+  while (localStart > 0 && EMAIL_LOCAL_CHAR_RE.test(value[localStart - 1])) {
+    localStart -= 1;
+  }
+  let localEnd = end;
+  while (localEnd < value.length && EMAIL_LOCAL_CHAR_RE.test(value[localEnd])) {
+    localEnd += 1;
+  }
+  return localStart < localEnd && localEnd - localStart <= 64 && value[localEnd] === "@" && EMAIL_DOMAIN_RE.test(value.slice(localEnd + 1));
+}
+function redactTokenUnlessEmail(match, offset, source) {
+  return isEmailLocalPart(source, offset, offset + match.length) ? match : SECRET_REDACTION_PLACEHOLDER;
+}
 var PRIVATE_KEY_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
 var SENSITIVE_FIELD_NAME = "authorization|cookie|password|(?:client[_-]?)?secret|(?:access|refresh)[_-]?token|(?:x[_-]?)?api[_-]?key|private[_-]?key|token|credentials";
 var COMMON_SECRET_RE = /\b(?:[prs]k_(?:live|test)_|(?:pat|ghp|github_pat)_|xox[baprs]-)[A-Za-z0-9_./+=:-]{12,}\b/gi;
@@ -2268,7 +2284,7 @@ function redactSecretLikeString(value) {
       return serializedRedacted;
     }
   }
-  return serializedRedacted.replace(PRIVATE_KEY_RE, SECRET_REDACTION_PLACEHOLDER).replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`).replace(BASIC_CREDENTIAL_RE, `Basic ${SECRET_REDACTION_PLACEHOLDER}`).replace(JWT_RE, SECRET_REDACTION_PLACEHOLDER).replace(COMMON_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(GENERIC_PREFIXED_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(GENERIC_SECRET_ASSIGNMENT_RE, SECRET_REDACTION_PLACEHOLDER).replace(HIGH_ENTROPY_ASSIGNMENT_RE, (match) => {
+  return serializedRedacted.replace(PRIVATE_KEY_RE, SECRET_REDACTION_PLACEHOLDER).replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`).replace(BASIC_CREDENTIAL_RE, `Basic ${SECRET_REDACTION_PLACEHOLDER}`).replace(JWT_RE, redactTokenUnlessEmail).replace(COMMON_SECRET_RE, redactTokenUnlessEmail).replace(GENERIC_PREFIXED_SECRET_RE, redactTokenUnlessEmail).replace(GENERIC_SECRET_ASSIGNMENT_RE, SECRET_REDACTION_PLACEHOLDER).replace(HIGH_ENTROPY_ASSIGNMENT_RE, (match) => {
     const separator = match.includes("=") ? "=" : ":";
     const [key] = match.split(separator, 1);
     return `${key.trim()}${separator}${SECRET_REDACTION_PLACEHOLDER}`;

package/dist/index.mjs

@@ -768,7 +768,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.167",
+  version: "0.3.169",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1
@@ -2089,6 +2089,22 @@ var SECRET_REDACTION_PLACEHOLDER = "[REDACTED_SECRET]";
 var BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
 var BASIC_CREDENTIAL_RE = /\bBasic\s+[A-Za-z0-9+/]{4,}={0,2}\b/g;
 var JWT_RE = /\b[A-Za-z0-9_-]{8,16384}\.[A-Za-z0-9_-]{1,16384}\.[A-Za-z0-9_-]{8,16384}\b/g;
+var EMAIL_LOCAL_CHAR_RE = /[A-Za-z0-9.!#$%&'*+/=?^_`{|}~-]/;
+var EMAIL_DOMAIN_RE = /^[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?\.[A-Za-z]{2,63}\b/;
+function isEmailLocalPart(value, start, end) {
+  let localStart = start;
+  while (localStart > 0 && EMAIL_LOCAL_CHAR_RE.test(value[localStart - 1])) {
+    localStart -= 1;
+  }
+  let localEnd = end;
+  while (localEnd < value.length && EMAIL_LOCAL_CHAR_RE.test(value[localEnd])) {
+    localEnd += 1;
+  }
+  return localStart < localEnd && localEnd - localStart <= 64 && value[localEnd] === "@" && EMAIL_DOMAIN_RE.test(value.slice(localEnd + 1));
+}
+function redactTokenUnlessEmail(match, offset, source) {
+  return isEmailLocalPart(source, offset, offset + match.length) ? match : SECRET_REDACTION_PLACEHOLDER;
+}
 var PRIVATE_KEY_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
 var SENSITIVE_FIELD_NAME = "authorization|cookie|password|(?:client[_-]?)?secret|(?:access|refresh)[_-]?token|(?:x[_-]?)?api[_-]?key|private[_-]?key|token|credentials";
 var COMMON_SECRET_RE = /\b(?:[prs]k_(?:live|test)_|(?:pat|ghp|github_pat)_|xox[baprs]-)[A-Za-z0-9_./+=:-]{12,}\b/gi;
@@ -2172,7 +2188,7 @@ function redactSecretLikeString(value) {
       return serializedRedacted;
     }
   }
-  return serializedRedacted.replace(PRIVATE_KEY_RE, SECRET_REDACTION_PLACEHOLDER).replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`).replace(BASIC_CREDENTIAL_RE, `Basic ${SECRET_REDACTION_PLACEHOLDER}`).replace(JWT_RE, SECRET_REDACTION_PLACEHOLDER).replace(COMMON_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(GENERIC_PREFIXED_SECRET_RE, SECRET_REDACTION_PLACEHOLDER).replace(GENERIC_SECRET_ASSIGNMENT_RE, SECRET_REDACTION_PLACEHOLDER).replace(HIGH_ENTROPY_ASSIGNMENT_RE, (match) => {
+  return serializedRedacted.replace(PRIVATE_KEY_RE, SECRET_REDACTION_PLACEHOLDER).replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`).replace(BASIC_CREDENTIAL_RE, `Basic ${SECRET_REDACTION_PLACEHOLDER}`).replace(JWT_RE, redactTokenUnlessEmail).replace(COMMON_SECRET_RE, redactTokenUnlessEmail).replace(GENERIC_PREFIXED_SECRET_RE, redactTokenUnlessEmail).replace(GENERIC_SECRET_ASSIGNMENT_RE, SECRET_REDACTION_PLACEHOLDER).replace(HIGH_ENTROPY_ASSIGNMENT_RE, (match) => {
     const separator = match.includes("=") ? "=" : ":";
     const [key] = match.split(separator, 1);
     return `${key.trim()}${separator}${SECRET_REDACTION_PLACEHOLDER}`;

package/dist/install-integrity.json

@@ -64,6 +64,7 @@
     "dist/bundling-sources/shared_libs/monitors/provider-callback-verification.ts",
     "dist/bundling-sources/shared_libs/monitors/provider-monitor-batch-operation.ts",
     "dist/bundling-sources/shared_libs/monitors/provider-monitor-capability.ts",
+    "dist/bundling-sources/shared_libs/monitors/provider-monitor-conflicts.ts",
     "dist/bundling-sources/shared_libs/monitors/provider-monitor-consumer-health.ts",
     "dist/bundling-sources/shared_libs/monitors/provider-monitor-control-plane-capability.ts",
     "dist/bundling-sources/shared_libs/monitors/provider-monitor-errors.ts",

package/dist/release.d.mts

@@ -149,7 +149,7 @@ type SdkRelease = {
     supportPolicy: SdkSupportPolicy;
 };
 declare const SDK_RELEASE: {
-    readonly version: "0.3.167";
+    readonly version: "0.3.169";
     readonly updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.";
     readonly packageCapabilities: {
         readonly updatePreferences: 1;

package/dist/release.d.ts

@@ -149,7 +149,7 @@ type SdkRelease = {
     supportPolicy: SdkSupportPolicy;
 };
 declare const SDK_RELEASE: {
-    readonly version: "0.3.167";
+    readonly version: "0.3.169";
     readonly updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.";
     readonly packageCapabilities: {
         readonly updatePreferences: 1;

package/dist/release.js

@@ -74,7 +74,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.167",
+  version: "0.3.169",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/release.mjs

@@ -48,7 +48,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.167",
+  version: "0.3.169",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.3.167",
+  "version": "0.3.169",
   "description": "GTM data CLI and TypeScript SDK for coding agents",
   "license": "MIT",
   "homepage": "https://code.deepline.com",