deepline 0.3.283 → 0.3.284

package/dist/bundling-sources/sdk/src/release.ts

@@ -200,7 +200,7 @@ export const SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: '0.3.283',
+  version: '0.3.284',
   updateSummary:
     'Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.',
   packageCapabilities: {

package/dist/bundling-sources/shared_libs/security/secret-redaction.ts

@@ -6,6 +6,7 @@ type SecretRedactionOptions = {
   keyPolicy?: 'strict' | 'public-result';
   /** Replace sample cursor values with a non-capability-bearing placeholder. */
   placeholderContinuationValues?: boolean;
+  redactJsonStrings?: boolean;
 };
 
 const SENSITIVE_KEY_PATTERNS = [
@@ -399,12 +400,83 @@ function maybeRedactString(value: string, options: SecretRedactionOptions) {
     : redacted.replace(HIGH_ENTROPY_VALUE_PATTERN, REDACTED_VALUE);
 }
 
+function parseJsonContainerText(value: unknown): unknown {
+  if (typeof value !== 'string') return value;
+  const trimmed = value.trim();
+  if (!trimmed.startsWith('{') && !trimmed.startsWith('[')) return value;
+  try {
+    return JSON.parse(value);
+  } catch {
+    return value;
+  }
+}
+
+function jsonStringContainsSecrets(
+  value: string,
+  options: SecretRedactionOptions,
+  parentKey?: string,
+  path: readonly string[] = [],
+): boolean {
+  // Inspect parsed values, but never reserialize SQL text and round its numeric literals.
+  const parsed = parseJsonContainerText(value);
+  if (!parsed || typeof parsed !== 'object') return false;
+  const pending = [
+    {
+      value: parsed,
+      parentKey,
+      path: [...path],
+    },
+  ];
+  const textOptions = { ...options, redactJsonStrings: false };
+  while (pending.length > 0) {
+    const current = pending.pop()!;
+    const sourceIsArray = Array.isArray(current.value);
+    for (const [key, rawItem] of Object.entries(current.value)) {
+      const item = parseJsonContainerText(rawItem);
+      const parentKey = sourceIsArray ? current.parentKey : key;
+      if (
+        !sourceIsArray &&
+        options.keyPolicy === 'public-result' &&
+        isPublicResultSafeTokenKey(key, current.path, item) &&
+        (!item || typeof item !== 'object')
+      ) {
+        if (
+          typeof item === 'string' &&
+          maybeRedactString(item, textOptions) !== item
+        )
+          return true;
+        continue;
+      }
+      if (!sourceIsArray && shouldRedactKey(key)) return true;
+      if (item && typeof item === 'object') {
+        pending.push({
+          value: item,
+          parentKey,
+          path: sourceIsArray ? current.path : [...current.path, key],
+        });
+      } else if (
+        typeof item === 'string' &&
+        redactSecretsInValue(item, parentKey, textOptions) !== item
+      ) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+
 export function redactSecretsInValue<T>(
   value: T,
   parentKey?: string,
   options: SecretRedactionOptions = {},
 ): T {
   if (typeof value === 'string') {
+    if (
+      options.redactJsonStrings &&
+      jsonStringContainsSecrets(value, options, parentKey)
+    ) {
+      return REDACTED_VALUE as T;
+    }
     if (hasExplicitSecretValue(value, options)) {
       return REDACTED_VALUE as T;
     }
@@ -447,8 +519,15 @@ export function redactSecretsInValue<T>(
   const redactNestedValue = (
     item: unknown,
     itemParentKey: string | undefined,
+    path: readonly string[],
   ): unknown => {
     if (typeof item !== 'string') return item;
+    if (
+      options.redactJsonStrings &&
+      jsonStringContainsSecrets(item, options, itemParentKey, path)
+    ) {
+      return REDACTED_VALUE;
+    }
     if (hasExplicitSecretValue(item, options)) {
       return REDACTED_VALUE;
     }
@@ -473,7 +552,15 @@ export function redactSecretsInValue<T>(
         (!item || typeof item !== 'object')
       ) {
         const redacted =
-          typeof item === 'string' ? maybeRedactString(item, options) : item;
+          typeof item === 'string'
+            ? options.redactJsonStrings &&
+              jsonStringContainsSecrets(item, options, itemParentKey, [
+                ...current.path,
+                key,
+              ])
+              ? REDACTED_VALUE
+              : maybeRedactString(item, options)
+            : item;
         (current.target as Record<string, unknown>)[key] =
           options.placeholderContinuationValues &&
           isPublicResultCursorKey(key, current.path) &&
@@ -502,6 +589,7 @@ export function redactSecretsInValue<T>(
       (current.target as Record<string, unknown>)[key] = redactNestedValue(
         item,
         itemParentKey,
+        sourceIsArray ? current.path : [...current.path, key],
       );
     }
   }

package/dist/cli/index.js

@@ -3515,7 +3515,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.283",
+  version: "0.3.284",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/cli/index.mjs

@@ -3510,7 +3510,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.283",
+  version: "0.3.284",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/index.js

@@ -1328,7 +1328,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.283",
+  version: "0.3.284",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/index.mjs

@@ -1232,7 +1232,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.283",
+  version: "0.3.284",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/release.d.mts

@@ -149,7 +149,7 @@ type SdkRelease = {
     supportPolicy: SdkSupportPolicy;
 };
 declare const SDK_RELEASE: {
-    readonly version: "0.3.283";
+    readonly version: "0.3.284";
     readonly updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.";
     readonly packageCapabilities: {
         readonly updatePreferences: 1;

package/dist/release.d.ts

@@ -149,7 +149,7 @@ type SdkRelease = {
     supportPolicy: SdkSupportPolicy;
 };
 declare const SDK_RELEASE: {
-    readonly version: "0.3.283";
+    readonly version: "0.3.284";
     readonly updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.";
     readonly packageCapabilities: {
         readonly updatePreferences: 1;

package/dist/release.js

@@ -74,7 +74,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.283",
+  version: "0.3.284",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/release.mjs

@@ -48,7 +48,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.283",
+  version: "0.3.284",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.3.283",
+  "version": "0.3.284",
   "description": "GTM data CLI and TypeScript SDK for coding agents",
   "license": "MIT",
   "homepage": "https://code.deepline.com",