deepline 0.3.281 → 0.3.282

package/dist/bundling-sources/sdk/src/release.ts

@@ -200,7 +200,7 @@ export const SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: '0.3.281',
+  version: '0.3.282',
   updateSummary:
     'Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.',
   packageCapabilities: {

package/dist/bundling-sources/shared_libs/observability/redaction.ts

@@ -59,19 +59,27 @@ function redactStructuredValue(
 }
 
 function redactPlainTelemetryText(value: string): string {
-  return value
-    .replace(PRIVATE_KEY_PATTERN, '[REDACTED]')
-    .replace(POSTGRES_CREDENTIAL_PATTERN, '$1[REDACTED]@')
-    .replace(AUTHORIZATION_CREDENTIAL_PATTERN, '$1$2$3 [REDACTED]')
-    .replace(BEARER_CREDENTIAL_PATTERN, 'Bearer [REDACTED]')
-    .replace(BASIC_CREDENTIAL_PATTERN, 'Basic [REDACTED]')
-    .replace(JWT_PATTERN, '[REDACTED_JWT]')
-    .replace(
-      JSON_SECRET_PATTERN,
-      (_match, keyQuote, key, separator, valueQuote) =>
-        `${keyQuote}${key}${keyQuote}${separator}${valueQuote}[REDACTED]${valueQuote}`,
-    )
-    .replace(INLINE_SECRET_PATTERN, '$1$2[REDACTED]');
+  return (
+    value
+      // Scoped to the provider host: `key` elsewhere remains an identifier.
+      .replace(
+        /https?:\/\/(?:api|bulkapi)\.millionverifier\.com(?=[:/?#]|$)[^\s"'<>]*/gi,
+        (url) =>
+          url.replace(/([?&](?:api|key)=)[^&#\s"'<>]*/gi, '$1[REDACTED]'),
+      )
+      .replace(PRIVATE_KEY_PATTERN, '[REDACTED]')
+      .replace(POSTGRES_CREDENTIAL_PATTERN, '$1[REDACTED]@')
+      .replace(AUTHORIZATION_CREDENTIAL_PATTERN, '$1$2$3 [REDACTED]')
+      .replace(BEARER_CREDENTIAL_PATTERN, 'Bearer [REDACTED]')
+      .replace(BASIC_CREDENTIAL_PATTERN, 'Basic [REDACTED]')
+      .replace(JWT_PATTERN, '[REDACTED_JWT]')
+      .replace(
+        JSON_SECRET_PATTERN,
+        (_match, keyQuote, key, separator, valueQuote) =>
+          `${keyQuote}${key}${keyQuote}${separator}${valueQuote}[REDACTED]${valueQuote}`,
+      )
+      .replace(INLINE_SECRET_PATTERN, '$1$2[REDACTED]')
+  );
 }
 
 /**

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -20567,10 +20567,13 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 logProvider429RetryPhase('retry_sleep_completed');
                 if (
                   !usesDurableInvocationFence &&
-                  failure.backpressureDelayMs !== null
+                  (failure.backpressureDelayMs !== null ||
+                    (failure.reason === 'rate_limit' &&
+                      failure.knownNotDispatched))
                 ) {
                   // A classified provider rejection has no completed value to
-                  // charge. The next physical attempt needs a new reservation;
+                  // charge. A credential guard refusal also releases its charge
+                  // before replying. The next attempt needs a new reservation;
                   // durable result and provider-operation keys stay unchanged.
                   deeplineRequestId = `ctx-tool-${stableDigest(`${executionRequestNonce}:provider-rate-limit-retry:${invocationAttempt}`).slice(0, 32)}`;
                 }

package/dist/bundling-sources/shared_libs/play-runtime/tool-execute-retry-policy.ts

@@ -242,6 +242,25 @@ function isConcurrencyBackpressureResponse(input: {
   );
 }
 
+function isCredentialDispatchRefusalResponse(input: {
+  status: number;
+  bodyText: string;
+  executionFenced?: boolean;
+}): boolean {
+  // Fenced gateway attempts have their own qualified redelivery contract.
+  // This exemption is only for the ordinary execute route's released charge.
+  if (input.status !== 429 || input.executionFenced === true) return false;
+  const body = parseJsonObject(input.bodyText);
+  return (
+    body?.code === 'RATE_LIMIT' &&
+    body.failure_origin === 'deepline_rate_limit' &&
+    body.error_category === 'rate_limit' &&
+    body.rate_limit_bucket_scope === 'credential_shared' &&
+    body.rate_limit_kind === 'requests_per_second' &&
+    body.provider_request_dispatched === false
+  );
+}
+
 function isRuntimeSchedulerCapacityResponse(input: {
   status: number;
   bodyText: string;
@@ -573,6 +592,7 @@ export function classifyToolExecuteHttpFailure(input: {
   const concurrencyBackpressure = isConcurrencyBackpressureResponse(input);
   const runtimeSchedulerCapacity = isRuntimeSchedulerCapacityResponse(input);
   const providerPacingWait = isProviderPacingWaitResponse(input);
+  const credentialDispatchRefusal = isCredentialDispatchRefusalResponse(input);
   const edgeGatewayFailure = isEdgeGatewayFailureResponse(input);
   const executionFenced = input.executionFenced === true;
   const explicitRetryable = readExplicitToolHttpRetryability(input);
@@ -747,11 +767,12 @@ export function classifyToolExecuteHttpFailure(input: {
       retryDecision.reason !== 'concurrency_backpressure' &&
       retryDecision.reason !== 'runtime_scheduler_capacity' &&
       retryDecision.reason !== 'provider_pacing_wait',
-    // Scheduler capacity and the relay's explicit concurrency shed both occur
-    // before a provider request is dispatched. Carry that proof in the shared
-    // classification so the retry boundary can safely pace either response
-    // without asking a non-idempotent provider call to be replayed.
+    // Only explicit pre-dispatch refusals permit automatic replay of an
+    // operation that does not declare ordinary transient retry safety.
     knownNotDispatched:
-      runtimeSchedulerCapacity || concurrencyBackpressure || providerPacingWait,
+      runtimeSchedulerCapacity ||
+      concurrencyBackpressure ||
+      providerPacingWait ||
+      credentialDispatchRefusal,
   };
 }

package/dist/bundling-sources/shared_libs/security/secret-redaction.ts

@@ -370,6 +370,12 @@ function isPublicResultSafeTokenKey(
 }
 
 function maybeRedactString(value: string, options: SecretRedactionOptions) {
+  // These names are credentials only on MillionVerifier URLs. Keep unrelated
+  // object identifiers named `key` and other providers' query fields intact.
+  value = value.replace(
+    /https?:\/\/(?:api|bulkapi)\.millionverifier\.com(?=[:/?#]|$)[^\s"'<>]*/gi,
+    (url) => url.replace(/([?&](?:api|key)=)[^&#\s"'<>]*/gi, '$1[REDACTED]'),
+  );
   if (hasExplicitSecretValue(value, options)) {
     return REDACTED_VALUE;
   }

package/dist/cli/index.js

@@ -3515,7 +3515,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.281",
+  version: "0.3.282",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/cli/index.mjs

@@ -3510,7 +3510,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.281",
+  version: "0.3.282",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/index.js

@@ -1328,7 +1328,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.281",
+  version: "0.3.282",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/index.mjs

@@ -1232,7 +1232,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.281",
+  version: "0.3.282",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/release.d.mts

@@ -149,7 +149,7 @@ type SdkRelease = {
     supportPolicy: SdkSupportPolicy;
 };
 declare const SDK_RELEASE: {
-    readonly version: "0.3.281";
+    readonly version: "0.3.282";
     readonly updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.";
     readonly packageCapabilities: {
         readonly updatePreferences: 1;

package/dist/release.d.ts

@@ -149,7 +149,7 @@ type SdkRelease = {
     supportPolicy: SdkSupportPolicy;
 };
 declare const SDK_RELEASE: {
-    readonly version: "0.3.281";
+    readonly version: "0.3.282";
     readonly updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.";
     readonly packageCapabilities: {
         readonly updatePreferences: 1;

package/dist/release.js

@@ -74,7 +74,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.281",
+  version: "0.3.282",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/release.mjs

@@ -48,7 +48,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.281",
+  version: "0.3.282",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.3.281",
+  "version": "0.3.282",
   "description": "GTM data CLI and TypeScript SDK for coding agents",
   "license": "MIT",
   "homepage": "https://code.deepline.com",