deepline 0.3.85 → 0.3.87

package/dist/bundling-sources/shared_libs/security/secret-redaction.ts

@@ -0,0 +1,267 @@
+const REDACTED_VALUE = '[REDACTED]';
+
+type SecretRedactionOptions = {
+  redactHighEntropy?: boolean;
+};
+
+const SENSITIVE_KEY_PATTERNS = [
+  /^api[-_]?key$/i,
+  /^x[-_]?api[-_]?key$/i,
+  /secret/i,
+  /token/i,
+  /password/i,
+  /authorization/i,
+  /cookie/i,
+  /credential/i,
+  /private/i,
+];
+
+const SAFE_IDENTIFIER_KEYS = new Set([
+  'artifactHash',
+  'artifactHashes',
+  'artifact_hash',
+  'artifact_hashes',
+  'graphHash',
+  'graph_hash',
+  'hash',
+  'idempotencyKey',
+  'idempotency_key',
+  'key',
+  'session',
+  'sessionId',
+  'session_id',
+  'sessionIds',
+  'session_ids',
+  'promptId',
+  'prompt_id',
+  'requestId',
+  'request_id',
+  'upload_id',
+  // Durable-call runtime identity fields. These are non-secret
+  // `ctx:<org>:call:tool:<tool>:<hash>` receipt/idempotency keys (and their
+  // `:force:<lease>` / `:ordered:<hash>` variants) surfaced on tool-result
+  // `_metadata.execution` and echoed provider idempotency metadata.
+  // Explicit-secret patterns below still redact real secrets that ever appear
+  // under these keys.
+  'receiptKey',
+  'receipt_key',
+  'attachedToReceiptKey',
+  'attached_to_receipt_key',
+  'durableCallReceiptKey',
+  'durable_call_receipt_key',
+  'providerIdempotencyKey',
+  'provider_idempotency_key',
+  'cacheKey',
+  'cache_key',
+  // Non-secret run-output identifiers.
+  'targetTable',
+  'target_table',
+  'tableNamespace',
+  'table_namespace',
+  'queryId',
+  'query_id',
+  'queryIds',
+  'query_ids',
+  'snowflakeQueryId',
+  'snowflake_query_id',
+  'snowflakeQueryIds',
+  'snowflake_query_ids',
+]);
+
+const EXPLICIT_SECRET_VALUE_PATTERNS = [
+  /\bnapi_[a-z0-9]{20,}\b/i,
+  /\bgh[opsu]_[A-Za-z0-9_]{20,}\b/,
+  /\bwhsec_[a-z0-9]+\b/i,
+  /\bsk-proj-[A-Za-z0-9_-]{20,}\b/,
+  /\bxox[baprs]-[A-Za-z0-9-]{20,}\b/i,
+  /\b(sk|rk)_(live|test)_[a-z0-9]+\b/i,
+  /\bpostgres(?:ql)?:\/\/[^\s'"]+/i,
+  /\bhttps?:\/\/[^/\s'"]+:[^@\s'"]+@[^/\s'"]+/i,
+];
+
+const HIGH_ENTROPY_VALUE_PATTERN = /\b[A-Za-z0-9+/=_-]{32,}\b/g;
+// A public hostname can legitimately contain a generated label longer than the
+// high-entropy threshold (for example, a per-run probe hostname). Preserve the
+// complete hostname after known secret formats have already been checked.
+const PUBLIC_DNS_NAME_PATTERN =
+  /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}\.?$/i;
+const SENSITIVE_URL_PARAM_KEY_PATTERN =
+  /(?:api[-_]?key|x[-_]?api[-_]?key|token|access[-_]?token|refresh[-_]?token|secret|password|authorization|credential|signature|sig)/i;
+const BEARER_SECRET_PATTERN = /\b(Bearer)\s+[A-Za-z0-9._~+/=-]{8,}/gi;
+const ASSIGNMENT_SECRET_PATTERN =
+  /\b(access[-_]?token|refresh[-_]?token|token|x[-_\s]?api[-_\s]?key|api[-_\s]?key|apikey|password|secret|session)\b(\s*[:=]\s*)[^\s'",;)}\]]+/gi;
+const AUTH_ASSIGNMENT_SECRET_PATTERN =
+  /\b(auth(?:orization)?)\b(\s*[:=]\s*)(?!Bearer\b)(?:[A-Za-z]+\s+)?[^\s'",;)}\]]+/gi;
+const SENSITIVE_URL_PARAM_VALUE_PATTERN =
+  /([?&#](?:api[-_]?key|x[-_]?api[-_]?key|token|access[-_]?token|refresh[-_]?token|secret|password|authorization|credential|signature|sig)=)[^&#\s'"]+/gi;
+
+function inspectStandalonePublicHttpUrl(
+  value: string,
+): 'safe' | 'sensitive' | null {
+  const trimmed = value.trim();
+  if (!trimmed || /\s/.test(trimmed)) {
+    return null;
+  }
+
+  let url: URL;
+  try {
+    url = new URL(trimmed);
+  } catch {
+    return null;
+  }
+
+  if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+    return null;
+  }
+  if (url.username || url.password) {
+    return 'sensitive';
+  }
+
+  for (const key of url.searchParams.keys()) {
+    if (SENSITIVE_URL_PARAM_KEY_PATTERN.test(key)) {
+      return 'sensitive';
+    }
+  }
+  if (url.hash && SENSITIVE_URL_PARAM_KEY_PATTERN.test(url.hash)) {
+    return 'sensitive';
+  }
+  return 'safe';
+}
+
+function shouldRedactKey(key: string) {
+  if (SAFE_IDENTIFIER_KEYS.has(key)) {
+    return false;
+  }
+  return SENSITIVE_KEY_PATTERNS.some((pattern) => pattern.test(key));
+}
+
+function maybeRedactString(value: string, options: SecretRedactionOptions) {
+  if (EXPLICIT_SECRET_VALUE_PATTERNS.some((pattern) => pattern.test(value))) {
+    return REDACTED_VALUE;
+  }
+  const publicHttpUrl = inspectStandalonePublicHttpUrl(value);
+  if (publicHttpUrl === 'sensitive') {
+    return REDACTED_VALUE;
+  }
+  if (publicHttpUrl === 'safe') {
+    return value;
+  }
+  if (PUBLIC_DNS_NAME_PATTERN.test(value.trim())) {
+    return value;
+  }
+  const redacted = value
+    .replace(BEARER_SECRET_PATTERN, `$1 ${REDACTED_VALUE}`)
+    .replace(AUTH_ASSIGNMENT_SECRET_PATTERN, `$1$2${REDACTED_VALUE}`)
+    .replace(ASSIGNMENT_SECRET_PATTERN, `$1$2${REDACTED_VALUE}`)
+    .replace(SENSITIVE_URL_PARAM_VALUE_PATTERN, `$1${REDACTED_VALUE}`);
+  return options.redactHighEntropy === false
+    ? redacted
+    : redacted.replace(HIGH_ENTROPY_VALUE_PATTERN, REDACTED_VALUE);
+}
+
+export function redactSecretsInValue<T>(
+  value: T,
+  parentKey?: string,
+  options: SecretRedactionOptions = {},
+): T {
+  if (typeof value === 'string') {
+    if (EXPLICIT_SECRET_VALUE_PATTERNS.some((pattern) => pattern.test(value))) {
+      return REDACTED_VALUE as T;
+    }
+    if (parentKey && SAFE_IDENTIFIER_KEYS.has(parentKey)) {
+      return value as T;
+    }
+    if (parentKey && shouldRedactKey(parentKey)) {
+      return REDACTED_VALUE as T;
+    }
+    return maybeRedactString(value, options) as T;
+  }
+
+  if (!value || typeof value !== 'object') return value;
+
+  type Container = unknown[] | Record<string, unknown>;
+  const root: Container = Array.isArray(value) ? [] : {};
+  const pending: Array<{
+    source: Container;
+    target: Container;
+    parentKey?: string;
+  }> = [{ source: value as Container, target: root, parentKey }];
+
+  const redactNestedValue = (
+    item: unknown,
+    itemParentKey: string | undefined,
+  ): unknown => {
+    if (typeof item !== 'string') return item;
+    if (EXPLICIT_SECRET_VALUE_PATTERNS.some((pattern) => pattern.test(item))) {
+      return REDACTED_VALUE;
+    }
+    if (itemParentKey && SAFE_IDENTIFIER_KEYS.has(itemParentKey)) return item;
+    if (itemParentKey && shouldRedactKey(itemParentKey)) return REDACTED_VALUE;
+    return maybeRedactString(item, options);
+  };
+
+  while (pending.length > 0) {
+    const current = pending.pop();
+    if (!current) break;
+    const sourceIsArray = Array.isArray(current.source);
+    for (const [key, item] of Object.entries(current.source)) {
+      const itemParentKey = sourceIsArray ? current.parentKey : key;
+      if (!sourceIsArray && shouldRedactKey(key)) {
+        (current.target as Record<string, unknown>)[key] = REDACTED_VALUE;
+        continue;
+      }
+      if (item && typeof item === 'object') {
+        const nestedTarget: Container = Array.isArray(item) ? [] : {};
+        (current.target as Record<string, unknown>)[key] = nestedTarget;
+        pending.push({
+          source: item as Container,
+          target: nestedTarget,
+          parentKey: itemParentKey,
+        });
+        continue;
+      }
+      (current.target as Record<string, unknown>)[key] = redactNestedValue(
+        item,
+        itemParentKey,
+      );
+    }
+  }
+
+  return root as T;
+}
+
+/**
+ * Redaction for customer-authored inputs and outputs. Preserve arbitrary
+ * identifiers while still removing explicit credential formats, sensitive
+ * keys, authorization values, and credential-bearing URLs.
+ */
+export function redactSecretsInCustomerValue<T>(
+  value: T,
+  parentKey?: string,
+): T {
+  return redactSecretsInValue(value, parentKey, { redactHighEntropy: false });
+}
+
+export function redactSecretsInJsonText(
+  text: string,
+  options: SecretRedactionOptions = {},
+) {
+  try {
+    const parsed = JSON.parse(text) as unknown;
+    return JSON.stringify(
+      redactSecretsInValue(parsed, undefined, options),
+      null,
+      2,
+    );
+  } catch {
+    let redacted = text;
+    for (const pattern of EXPLICIT_SECRET_VALUE_PATTERNS) {
+      redacted = redacted.replace(pattern, REDACTED_VALUE);
+    }
+    return maybeRedactString(redacted, options);
+  }
+}
+
+export function redactSecretsInCustomerJsonText(text: string) {
+  return redactSecretsInJsonText(text, { redactHighEntropy: false });
+}

package/dist/cli/index.js

@@ -184,7 +184,7 @@ configureProxyFromEnv();
 var import_promises11 = require("fs/promises");
 var import_node_path29 = require("path");
 var import_node_os18 = require("os");
-var import_commander4 = require("commander");
+var import_commander5 = require("commander");
 
 // src/config.ts
 var import_node_fs = require("fs");
@@ -1225,7 +1225,7 @@ var SDK_RELEASE = {
   // available at toolResponse.rawV2 while toolResponse.raw and all declared
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
-  version: "0.3.85",
+  version: "0.3.87",
   updateSummary: "Automatic CLI updates are now enabled by default. To opt out, run `deepline settings autoupdate off`; use `deepline settings autoupdate on` to re-enable updates or `deepline settings autoupdate pin <version>` to hold an exact release. This release also adds raw-v2 tool responses at toolResponse.rawV2 while preserving existing toolResponse.raw and declared getters.",
   packageCapabilities: {
     updatePreferences: 1
@@ -4353,7 +4353,7 @@ async function* observeRunEvents(options) {
   }
 }
 
-// ../../shared_libs/integrations/theirstack-execution-policy.ts
+// ../integration-contracts/theirstack/execution-policy.ts
 var THEIRSTACK_SLOW_JOB_SEARCH_PROVIDER_TIMEOUT_MS = 135e3;
 var THEIRSTACK_SLOW_JOB_SEARCH_CLIENT_TIMEOUT_MS = 6e4 + THEIRSTACK_SLOW_JOB_SEARCH_PROVIDER_TIMEOUT_MS + 15e3;
 var THEIRSTACK_COMPANY_SEARCH_CLIENT_TIMEOUT_MS = 21e4;
@@ -4407,7 +4407,7 @@ function resolveTheirstackClientTimeoutMs(endpointId, payload) {
   return usesExtendedTheirstackJobSearchBudget(endpointId, payload) ? THEIRSTACK_SLOW_JOB_SEARCH_CLIENT_TIMEOUT_MS : null;
 }
 
-// ../../shared_libs/integrations/bettercontact-execution-policy.ts
+// ../integration-contracts/bettercontact/execution-policy.ts
 var BETTERCONTACT_LAUNCHER_CLIENT_TIMEOUT_MS = 12e4;
 var BETTERCONTACT_LAUNCHER_TOOL_IDS = /* @__PURE__ */ new Set([
   "bettercontact_enrich",
@@ -17008,7 +17008,7 @@ function resolveDaytonaSandboxComputeItem(input2) {
   };
 }
 
-// ../../shared_libs/billing/compute-pricing.ts
+// ../billing/compute-pricing-contract.ts
 var COMPUTE_BILLING_MARKUP_MULTIPLIER = 5;
 var DEFAULT_USD_PER_CUSTOMER_CREDIT = 0.1;
 var DEFAULT_PROVIDER_MARKUP_MULTIPLIER = 1.4;
@@ -30821,6 +30821,7 @@ function registerEnrichCommand(program) {
 }
 
 // src/cli/commands/feedback.ts
+var import_commander3 = require("commander");
 var import_node_fs13 = require("fs");
 async function handleFeedback(text, options) {
   const message = resolveFeedbackText(text, options.file);
@@ -30830,7 +30831,8 @@ async function handleFeedback(text, options) {
     requested: options.requested === true,
     environment: collectLocalEnvInfo(),
     ...options.command ? { command: options.command } : {},
-    ...options.payload ? { payload: options.payload } : {}
+    ...options.payload ? { payload: options.payload } : {},
+    ...options.errorOutcome ? { error_outcome: options.errorOutcome } : {}
   });
   printCommandEnvelope(
     {
@@ -30880,10 +30882,12 @@ function registerFeedbackCommands(program) {
 Notes:
   Sends the feedback text plus local CLI environment info to Deepline support.
   Use --command and --payload to attach a reproducible command shape.
-  Agents should pass --requested when the user asked them to submit the report.
+  For error reports, use --error-outcome to record whether the error stopped the
+  task or work continued. Agents should pass --requested when the user asked them
+  to submit the report.
 
 Examples:
-  deepline feedback send "plays run failed after upload" --command "deepline plays run my.play.ts --watch"
+  deepline feedback send "plays run failed after upload" --command "deepline plays run my.play.ts --watch" --error-outcome terminal
   deepline feedback send "unexpected billing output" --payload '{"command":"billing usage"}' --json
 `
   );
@@ -30895,9 +30899,14 @@ Examples:
   deepline feedback send --file incident.md --requested --json
   cat incident.md | deepline feedback send --requested --json
   deepline feedback send "tools search returned stale results" --requested --json
-  deepline feedback send "plays run failed after upload" --command "deepline plays run my.play.ts --watch"
+  deepline feedback send "plays run failed after upload" --command "deepline plays run my.play.ts --watch" --error-outcome terminal
 `
-  ).argument("[text]", "Feedback text").option("--file <path>", "Read feedback text from a file, or - for stdin").option("--command <command>", "Command that reproduced the issue").option("--payload <payload>", "JSON or plain-text payload for the repro").option(
+  ).argument("[text]", "Feedback text").option("--file <path>", "Read feedback text from a file, or - for stdin").option("--command <command>", "Command that reproduced the issue").option("--payload <payload>", "JSON or plain-text payload for the repro").addOption(
+    new import_commander3.Option(
+      "--error-outcome <outcome>",
+      "Error impact on the task: terminal or continued"
+    ).choices(["terminal", "continued"])
+  ).option(
     "--requested",
     "Mark the report as explicitly requested by the user"
   ).option("--json", "Emit JSON output").action(handleFeedback);
@@ -38363,6 +38372,8 @@ var SDK_SIDECAR_CRITICAL_PACKAGE_FILES = [
   "dist/index.d.ts",
   "dist/plays/bundle-play-file.mjs",
   "dist/bundling-sources/shared_libs/observability/telemetry.ts",
+  "dist/bundling-sources/shared_libs/integration-contracts/bettercontact/execution-policy.ts",
+  "dist/bundling-sources/shared_libs/integration-contracts/theirstack/execution-policy.ts",
   "dist/bundling-sources/shared_libs/play-runtime/backend.ts",
   "dist/bundling-sources/shared_libs/plays/bundling/index.ts",
   "dist/bundling-sources/shared_libs/product-notifications/contract.ts",
@@ -40137,7 +40148,7 @@ chooses the connected Slack channel or member and the events it receives.
 }
 
 // src/cli/commands/tools.ts
-var import_commander3 = require("commander");
+var import_commander4 = require("commander");
 var import_node_fs25 = require("fs");
 var import_node_os17 = require("os");
 var import_node_path27 = require("path");
@@ -41194,12 +41205,12 @@ Examples:
     "--examples-only",
     "Only print runnable examples and sample payloads"
   ).option("--getters-only", "Only print extracted list/value getters").addOption(
-    new import_commander3.Option(
+    new import_commander4.Option(
       "--compact",
       "Compatibility alias for the default compact view"
     ).hideHelp()
   ).addOption(
-    new import_commander3.Option(
+    new import_commander4.Option(
       "--contract-json",
       "Compatibility alias for compact contract JSON"
     ).hideHelp()
@@ -43851,7 +43862,7 @@ async function main() {
   if (printStartupPhase) {
     progress?.phase("loading deepline cli");
   }
-  const program = new import_commander4.Command();
+  const program = new import_commander5.Command();
   program.name("deepline").description(
     "Deepline CLI \u2014 GTM enrichment tools, plays, and runs from your terminal."
   ).version(SDK_VERSION, "-v, --version", "Show version").exitOverride().showHelpAfterError().showSuggestionAfterError(true).addHelpText(

package/dist/cli/index.mjs

@@ -161,7 +161,7 @@ configureProxyFromEnv();
 import { mkdtemp as mkdtemp2, rm as rm2, writeFile as writeFile6 } from "fs/promises";
 import { join as join24 } from "path";
 import { tmpdir as tmpdir6 } from "os";
-import { Command as Command4 } from "commander";
+import { Command as Command5 } from "commander";
 
 // src/config.ts
 import {
@@ -1210,7 +1210,7 @@ var SDK_RELEASE = {
   // available at toolResponse.rawV2 while toolResponse.raw and all declared
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
-  version: "0.3.85",
+  version: "0.3.87",
   updateSummary: "Automatic CLI updates are now enabled by default. To opt out, run `deepline settings autoupdate off`; use `deepline settings autoupdate on` to re-enable updates or `deepline settings autoupdate pin <version>` to hold an exact release. This release also adds raw-v2 tool responses at toolResponse.rawV2 while preserving existing toolResponse.raw and declared getters.",
   packageCapabilities: {
     updatePreferences: 1
@@ -4338,7 +4338,7 @@ async function* observeRunEvents(options) {
   }
 }
 
-// ../../shared_libs/integrations/theirstack-execution-policy.ts
+// ../integration-contracts/theirstack/execution-policy.ts
 var THEIRSTACK_SLOW_JOB_SEARCH_PROVIDER_TIMEOUT_MS = 135e3;
 var THEIRSTACK_SLOW_JOB_SEARCH_CLIENT_TIMEOUT_MS = 6e4 + THEIRSTACK_SLOW_JOB_SEARCH_PROVIDER_TIMEOUT_MS + 15e3;
 var THEIRSTACK_COMPANY_SEARCH_CLIENT_TIMEOUT_MS = 21e4;
@@ -4392,7 +4392,7 @@ function resolveTheirstackClientTimeoutMs(endpointId, payload) {
   return usesExtendedTheirstackJobSearchBudget(endpointId, payload) ? THEIRSTACK_SLOW_JOB_SEARCH_CLIENT_TIMEOUT_MS : null;
 }
 
-// ../../shared_libs/integrations/bettercontact-execution-policy.ts
+// ../integration-contracts/bettercontact/execution-policy.ts
 var BETTERCONTACT_LAUNCHER_CLIENT_TIMEOUT_MS = 12e4;
 var BETTERCONTACT_LAUNCHER_TOOL_IDS = /* @__PURE__ */ new Set([
   "bettercontact_enrich",
@@ -17070,7 +17070,7 @@ function resolveDaytonaSandboxComputeItem(input2) {
   };
 }
 
-// ../../shared_libs/billing/compute-pricing.ts
+// ../billing/compute-pricing-contract.ts
 var COMPUTE_BILLING_MARKUP_MULTIPLIER = 5;
 var DEFAULT_USD_PER_CUSTOMER_CREDIT = 0.1;
 var DEFAULT_PROVIDER_MARKUP_MULTIPLIER = 1.4;
@@ -30883,6 +30883,7 @@ function registerEnrichCommand(program) {
 }
 
 // src/cli/commands/feedback.ts
+import { Option as Option2 } from "commander";
 import { readFileSync as readFileSync9 } from "fs";
 async function handleFeedback(text, options) {
   const message = resolveFeedbackText(text, options.file);
@@ -30892,7 +30893,8 @@ async function handleFeedback(text, options) {
     requested: options.requested === true,
     environment: collectLocalEnvInfo(),
     ...options.command ? { command: options.command } : {},
-    ...options.payload ? { payload: options.payload } : {}
+    ...options.payload ? { payload: options.payload } : {},
+    ...options.errorOutcome ? { error_outcome: options.errorOutcome } : {}
   });
   printCommandEnvelope(
     {
@@ -30942,10 +30944,12 @@ function registerFeedbackCommands(program) {
 Notes:
   Sends the feedback text plus local CLI environment info to Deepline support.
   Use --command and --payload to attach a reproducible command shape.
-  Agents should pass --requested when the user asked them to submit the report.
+  For error reports, use --error-outcome to record whether the error stopped the
+  task or work continued. Agents should pass --requested when the user asked them
+  to submit the report.
 
 Examples:
-  deepline feedback send "plays run failed after upload" --command "deepline plays run my.play.ts --watch"
+  deepline feedback send "plays run failed after upload" --command "deepline plays run my.play.ts --watch" --error-outcome terminal
   deepline feedback send "unexpected billing output" --payload '{"command":"billing usage"}' --json
 `
   );
@@ -30957,9 +30961,14 @@ Examples:
   deepline feedback send --file incident.md --requested --json
   cat incident.md | deepline feedback send --requested --json
   deepline feedback send "tools search returned stale results" --requested --json
-  deepline feedback send "plays run failed after upload" --command "deepline plays run my.play.ts --watch"
+  deepline feedback send "plays run failed after upload" --command "deepline plays run my.play.ts --watch" --error-outcome terminal
 `
-  ).argument("[text]", "Feedback text").option("--file <path>", "Read feedback text from a file, or - for stdin").option("--command <command>", "Command that reproduced the issue").option("--payload <payload>", "JSON or plain-text payload for the repro").option(
+  ).argument("[text]", "Feedback text").option("--file <path>", "Read feedback text from a file, or - for stdin").option("--command <command>", "Command that reproduced the issue").option("--payload <payload>", "JSON or plain-text payload for the repro").addOption(
+    new Option2(
+      "--error-outcome <outcome>",
+      "Error impact on the task: terminal or continued"
+    ).choices(["terminal", "continued"])
+  ).option(
     "--requested",
     "Mark the report as explicitly requested by the user"
   ).option("--json", "Emit JSON output").action(handleFeedback);
@@ -38480,6 +38489,8 @@ var SDK_SIDECAR_CRITICAL_PACKAGE_FILES = [
   "dist/index.d.ts",
   "dist/plays/bundle-play-file.mjs",
   "dist/bundling-sources/shared_libs/observability/telemetry.ts",
+  "dist/bundling-sources/shared_libs/integration-contracts/bettercontact/execution-policy.ts",
+  "dist/bundling-sources/shared_libs/integration-contracts/theirstack/execution-policy.ts",
   "dist/bundling-sources/shared_libs/play-runtime/backend.ts",
   "dist/bundling-sources/shared_libs/plays/bundling/index.ts",
   "dist/bundling-sources/shared_libs/product-notifications/contract.ts",
@@ -40254,7 +40265,7 @@ chooses the connected Slack channel or member and the events it receives.
 }
 
 // src/cli/commands/tools.ts
-import { Option as Option2 } from "commander";
+import { Option as Option3 } from "commander";
 import {
   chmodSync,
   existsSync as existsSync19,
@@ -41323,12 +41334,12 @@ Examples:
     "--examples-only",
     "Only print runnable examples and sample payloads"
   ).option("--getters-only", "Only print extracted list/value getters").addOption(
-    new Option2(
+    new Option3(
       "--compact",
       "Compatibility alias for the default compact view"
     ).hideHelp()
   ).addOption(
-    new Option2(
+    new Option3(
       "--contract-json",
       "Compatibility alias for compact contract JSON"
     ).hideHelp()
@@ -43980,7 +43991,7 @@ async function main() {
   if (printStartupPhase) {
     progress?.phase("loading deepline cli");
   }
-  const program = new Command4();
+  const program = new Command5();
   program.name("deepline").description(
     "Deepline CLI \u2014 GTM enrichment tools, plays, and runs from your terminal."
   ).version(SDK_VERSION, "-v, --version", "Show version").exitOverride().showHelpAfterError().showSuggestionAfterError(true).addHelpText(

package/dist/index.d.mts

@@ -1922,7 +1922,7 @@ declare function defineMonitor<TPayload extends MonitorPayload = MonitorPayload>
 /**
  * The fleet member ceiling, mirrored — deliberately a literal.
  *
- * The canonical declaration is shared_libs/monitors/monitor-fleet-limits.ts,
+ * The canonical declaration is packages/monitors/monitor-fleet-limits.ts,
  * which the Convex commit mutation reads to size its transaction. This package
  * cannot import it: the workspace-architecture ratchet forbids NEW shared_libs
  * imports from packages absolutely (only relocations of pre-existing edges

package/dist/index.d.ts

@@ -1922,7 +1922,7 @@ declare function defineMonitor<TPayload extends MonitorPayload = MonitorPayload>
 /**
  * The fleet member ceiling, mirrored — deliberately a literal.
  *
- * The canonical declaration is shared_libs/monitors/monitor-fleet-limits.ts,
+ * The canonical declaration is packages/monitors/monitor-fleet-limits.ts,
  * which the Convex commit mutation reads to size its transaction. This package
  * cannot import it: the workspace-architecture ratchet forbids NEW shared_libs
  * imports from packages absolutely (only relocations of pre-existing edges

package/dist/index.js

@@ -832,7 +832,7 @@ var SDK_RELEASE = {
   // available at toolResponse.rawV2 while toolResponse.raw and all declared
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
-  version: "0.3.85",
+  version: "0.3.87",
   updateSummary: "Automatic CLI updates are now enabled by default. To opt out, run `deepline settings autoupdate off`; use `deepline settings autoupdate on` to re-enable updates or `deepline settings autoupdate pin <version>` to hold an exact release. This release also adds raw-v2 tool responses at toolResponse.rawV2 while preserving existing toolResponse.raw and declared getters.",
   packageCapabilities: {
     updatePreferences: 1
@@ -3826,7 +3826,7 @@ async function* observeRunEvents(options) {
   }
 }
 
-// ../../shared_libs/integrations/theirstack-execution-policy.ts
+// ../integration-contracts/theirstack/execution-policy.ts
 var THEIRSTACK_SLOW_JOB_SEARCH_PROVIDER_TIMEOUT_MS = 135e3;
 var THEIRSTACK_SLOW_JOB_SEARCH_CLIENT_TIMEOUT_MS = 6e4 + THEIRSTACK_SLOW_JOB_SEARCH_PROVIDER_TIMEOUT_MS + 15e3;
 var THEIRSTACK_COMPANY_SEARCH_CLIENT_TIMEOUT_MS = 21e4;
@@ -3880,7 +3880,7 @@ function resolveTheirstackClientTimeoutMs(endpointId, payload) {
   return usesExtendedTheirstackJobSearchBudget(endpointId, payload) ? THEIRSTACK_SLOW_JOB_SEARCH_CLIENT_TIMEOUT_MS : null;
 }
 
-// ../../shared_libs/integrations/bettercontact-execution-policy.ts
+// ../integration-contracts/bettercontact/execution-policy.ts
 var BETTERCONTACT_LAUNCHER_CLIENT_TIMEOUT_MS = 12e4;
 var BETTERCONTACT_LAUNCHER_TOOL_IDS = /* @__PURE__ */ new Set([
   "bettercontact_enrich",

package/dist/index.mjs

@@ -744,7 +744,7 @@ var SDK_RELEASE = {
   // available at toolResponse.rawV2 while toolResponse.raw and all declared
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
-  version: "0.3.85",
+  version: "0.3.87",
   updateSummary: "Automatic CLI updates are now enabled by default. To opt out, run `deepline settings autoupdate off`; use `deepline settings autoupdate on` to re-enable updates or `deepline settings autoupdate pin <version>` to hold an exact release. This release also adds raw-v2 tool responses at toolResponse.rawV2 while preserving existing toolResponse.raw and declared getters.",
   packageCapabilities: {
     updatePreferences: 1
@@ -3738,7 +3738,7 @@ async function* observeRunEvents(options) {
   }
 }
 
-// ../../shared_libs/integrations/theirstack-execution-policy.ts
+// ../integration-contracts/theirstack/execution-policy.ts
 var THEIRSTACK_SLOW_JOB_SEARCH_PROVIDER_TIMEOUT_MS = 135e3;
 var THEIRSTACK_SLOW_JOB_SEARCH_CLIENT_TIMEOUT_MS = 6e4 + THEIRSTACK_SLOW_JOB_SEARCH_PROVIDER_TIMEOUT_MS + 15e3;
 var THEIRSTACK_COMPANY_SEARCH_CLIENT_TIMEOUT_MS = 21e4;
@@ -3792,7 +3792,7 @@ function resolveTheirstackClientTimeoutMs(endpointId, payload) {
   return usesExtendedTheirstackJobSearchBudget(endpointId, payload) ? THEIRSTACK_SLOW_JOB_SEARCH_CLIENT_TIMEOUT_MS : null;
 }
 
-// ../../shared_libs/integrations/bettercontact-execution-policy.ts
+// ../integration-contracts/bettercontact/execution-policy.ts
 var BETTERCONTACT_LAUNCHER_CLIENT_TIMEOUT_MS = 12e4;
 var BETTERCONTACT_LAUNCHER_TOOL_IDS = /* @__PURE__ */ new Set([
   "bettercontact_enrich",