deepline 0.3.86 → 0.3.87

package/dist/bundling-sources/shared_libs/security/secret-redaction.ts

@@ -0,0 +1,267 @@
+const REDACTED_VALUE = '[REDACTED]';
+
+type SecretRedactionOptions = {
+  redactHighEntropy?: boolean;
+};
+
+const SENSITIVE_KEY_PATTERNS = [
+  /^api[-_]?key$/i,
+  /^x[-_]?api[-_]?key$/i,
+  /secret/i,
+  /token/i,
+  /password/i,
+  /authorization/i,
+  /cookie/i,
+  /credential/i,
+  /private/i,
+];
+
+const SAFE_IDENTIFIER_KEYS = new Set([
+  'artifactHash',
+  'artifactHashes',
+  'artifact_hash',
+  'artifact_hashes',
+  'graphHash',
+  'graph_hash',
+  'hash',
+  'idempotencyKey',
+  'idempotency_key',
+  'key',
+  'session',
+  'sessionId',
+  'session_id',
+  'sessionIds',
+  'session_ids',
+  'promptId',
+  'prompt_id',
+  'requestId',
+  'request_id',
+  'upload_id',
+  // Durable-call runtime identity fields. These are non-secret
+  // `ctx:<org>:call:tool:<tool>:<hash>` receipt/idempotency keys (and their
+  // `:force:<lease>` / `:ordered:<hash>` variants) surfaced on tool-result
+  // `_metadata.execution` and echoed provider idempotency metadata.
+  // Explicit-secret patterns below still redact real secrets that ever appear
+  // under these keys.
+  'receiptKey',
+  'receipt_key',
+  'attachedToReceiptKey',
+  'attached_to_receipt_key',
+  'durableCallReceiptKey',
+  'durable_call_receipt_key',
+  'providerIdempotencyKey',
+  'provider_idempotency_key',
+  'cacheKey',
+  'cache_key',
+  // Non-secret run-output identifiers.
+  'targetTable',
+  'target_table',
+  'tableNamespace',
+  'table_namespace',
+  'queryId',
+  'query_id',
+  'queryIds',
+  'query_ids',
+  'snowflakeQueryId',
+  'snowflake_query_id',
+  'snowflakeQueryIds',
+  'snowflake_query_ids',
+]);
+
+const EXPLICIT_SECRET_VALUE_PATTERNS = [
+  /\bnapi_[a-z0-9]{20,}\b/i,
+  /\bgh[opsu]_[A-Za-z0-9_]{20,}\b/,
+  /\bwhsec_[a-z0-9]+\b/i,
+  /\bsk-proj-[A-Za-z0-9_-]{20,}\b/,
+  /\bxox[baprs]-[A-Za-z0-9-]{20,}\b/i,
+  /\b(sk|rk)_(live|test)_[a-z0-9]+\b/i,
+  /\bpostgres(?:ql)?:\/\/[^\s'"]+/i,
+  /\bhttps?:\/\/[^/\s'"]+:[^@\s'"]+@[^/\s'"]+/i,
+];
+
+const HIGH_ENTROPY_VALUE_PATTERN = /\b[A-Za-z0-9+/=_-]{32,}\b/g;
+// A public hostname can legitimately contain a generated label longer than the
+// high-entropy threshold (for example, a per-run probe hostname). Preserve the
+// complete hostname after known secret formats have already been checked.
+const PUBLIC_DNS_NAME_PATTERN =
+  /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}\.?$/i;
+const SENSITIVE_URL_PARAM_KEY_PATTERN =
+  /(?:api[-_]?key|x[-_]?api[-_]?key|token|access[-_]?token|refresh[-_]?token|secret|password|authorization|credential|signature|sig)/i;
+const BEARER_SECRET_PATTERN = /\b(Bearer)\s+[A-Za-z0-9._~+/=-]{8,}/gi;
+const ASSIGNMENT_SECRET_PATTERN =
+  /\b(access[-_]?token|refresh[-_]?token|token|x[-_\s]?api[-_\s]?key|api[-_\s]?key|apikey|password|secret|session)\b(\s*[:=]\s*)[^\s'",;)}\]]+/gi;
+const AUTH_ASSIGNMENT_SECRET_PATTERN =
+  /\b(auth(?:orization)?)\b(\s*[:=]\s*)(?!Bearer\b)(?:[A-Za-z]+\s+)?[^\s'",;)}\]]+/gi;
+const SENSITIVE_URL_PARAM_VALUE_PATTERN =
+  /([?&#](?:api[-_]?key|x[-_]?api[-_]?key|token|access[-_]?token|refresh[-_]?token|secret|password|authorization|credential|signature|sig)=)[^&#\s'"]+/gi;
+
+function inspectStandalonePublicHttpUrl(
+  value: string,
+): 'safe' | 'sensitive' | null {
+  const trimmed = value.trim();
+  if (!trimmed || /\s/.test(trimmed)) {
+    return null;
+  }
+
+  let url: URL;
+  try {
+    url = new URL(trimmed);
+  } catch {
+    return null;
+  }
+
+  if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+    return null;
+  }
+  if (url.username || url.password) {
+    return 'sensitive';
+  }
+
+  for (const key of url.searchParams.keys()) {
+    if (SENSITIVE_URL_PARAM_KEY_PATTERN.test(key)) {
+      return 'sensitive';
+    }
+  }
+  if (url.hash && SENSITIVE_URL_PARAM_KEY_PATTERN.test(url.hash)) {
+    return 'sensitive';
+  }
+  return 'safe';
+}
+
+function shouldRedactKey(key: string) {
+  if (SAFE_IDENTIFIER_KEYS.has(key)) {
+    return false;
+  }
+  return SENSITIVE_KEY_PATTERNS.some((pattern) => pattern.test(key));
+}
+
+function maybeRedactString(value: string, options: SecretRedactionOptions) {
+  if (EXPLICIT_SECRET_VALUE_PATTERNS.some((pattern) => pattern.test(value))) {
+    return REDACTED_VALUE;
+  }
+  const publicHttpUrl = inspectStandalonePublicHttpUrl(value);
+  if (publicHttpUrl === 'sensitive') {
+    return REDACTED_VALUE;
+  }
+  if (publicHttpUrl === 'safe') {
+    return value;
+  }
+  if (PUBLIC_DNS_NAME_PATTERN.test(value.trim())) {
+    return value;
+  }
+  const redacted = value
+    .replace(BEARER_SECRET_PATTERN, `$1 ${REDACTED_VALUE}`)
+    .replace(AUTH_ASSIGNMENT_SECRET_PATTERN, `$1$2${REDACTED_VALUE}`)
+    .replace(ASSIGNMENT_SECRET_PATTERN, `$1$2${REDACTED_VALUE}`)
+    .replace(SENSITIVE_URL_PARAM_VALUE_PATTERN, `$1${REDACTED_VALUE}`);
+  return options.redactHighEntropy === false
+    ? redacted
+    : redacted.replace(HIGH_ENTROPY_VALUE_PATTERN, REDACTED_VALUE);
+}
+
+export function redactSecretsInValue<T>(
+  value: T,
+  parentKey?: string,
+  options: SecretRedactionOptions = {},
+): T {
+  if (typeof value === 'string') {
+    if (EXPLICIT_SECRET_VALUE_PATTERNS.some((pattern) => pattern.test(value))) {
+      return REDACTED_VALUE as T;
+    }
+    if (parentKey && SAFE_IDENTIFIER_KEYS.has(parentKey)) {
+      return value as T;
+    }
+    if (parentKey && shouldRedactKey(parentKey)) {
+      return REDACTED_VALUE as T;
+    }
+    return maybeRedactString(value, options) as T;
+  }
+
+  if (!value || typeof value !== 'object') return value;
+
+  type Container = unknown[] | Record<string, unknown>;
+  const root: Container = Array.isArray(value) ? [] : {};
+  const pending: Array<{
+    source: Container;
+    target: Container;
+    parentKey?: string;
+  }> = [{ source: value as Container, target: root, parentKey }];
+
+  const redactNestedValue = (
+    item: unknown,
+    itemParentKey: string | undefined,
+  ): unknown => {
+    if (typeof item !== 'string') return item;
+    if (EXPLICIT_SECRET_VALUE_PATTERNS.some((pattern) => pattern.test(item))) {
+      return REDACTED_VALUE;
+    }
+    if (itemParentKey && SAFE_IDENTIFIER_KEYS.has(itemParentKey)) return item;
+    if (itemParentKey && shouldRedactKey(itemParentKey)) return REDACTED_VALUE;
+    return maybeRedactString(item, options);
+  };
+
+  while (pending.length > 0) {
+    const current = pending.pop();
+    if (!current) break;
+    const sourceIsArray = Array.isArray(current.source);
+    for (const [key, item] of Object.entries(current.source)) {
+      const itemParentKey = sourceIsArray ? current.parentKey : key;
+      if (!sourceIsArray && shouldRedactKey(key)) {
+        (current.target as Record<string, unknown>)[key] = REDACTED_VALUE;
+        continue;
+      }
+      if (item && typeof item === 'object') {
+        const nestedTarget: Container = Array.isArray(item) ? [] : {};
+        (current.target as Record<string, unknown>)[key] = nestedTarget;
+        pending.push({
+          source: item as Container,
+          target: nestedTarget,
+          parentKey: itemParentKey,
+        });
+        continue;
+      }
+      (current.target as Record<string, unknown>)[key] = redactNestedValue(
+        item,
+        itemParentKey,
+      );
+    }
+  }
+
+  return root as T;
+}
+
+/**
+ * Redaction for customer-authored inputs and outputs. Preserve arbitrary
+ * identifiers while still removing explicit credential formats, sensitive
+ * keys, authorization values, and credential-bearing URLs.
+ */
+export function redactSecretsInCustomerValue<T>(
+  value: T,
+  parentKey?: string,
+): T {
+  return redactSecretsInValue(value, parentKey, { redactHighEntropy: false });
+}
+
+export function redactSecretsInJsonText(
+  text: string,
+  options: SecretRedactionOptions = {},
+) {
+  try {
+    const parsed = JSON.parse(text) as unknown;
+    return JSON.stringify(
+      redactSecretsInValue(parsed, undefined, options),
+      null,
+      2,
+    );
+  } catch {
+    let redacted = text;
+    for (const pattern of EXPLICIT_SECRET_VALUE_PATTERNS) {
+      redacted = redacted.replace(pattern, REDACTED_VALUE);
+    }
+    return maybeRedactString(redacted, options);
+  }
+}
+
+export function redactSecretsInCustomerJsonText(text: string) {
+  return redactSecretsInJsonText(text, { redactHighEntropy: false });
+}

package/dist/cli/index.js

@@ -1225,7 +1225,7 @@ var SDK_RELEASE = {
   // available at toolResponse.rawV2 while toolResponse.raw and all declared
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
-  version: "0.3.86",
+  version: "0.3.87",
   updateSummary: "Automatic CLI updates are now enabled by default. To opt out, run `deepline settings autoupdate off`; use `deepline settings autoupdate on` to re-enable updates or `deepline settings autoupdate pin <version>` to hold an exact release. This release also adds raw-v2 tool responses at toolResponse.rawV2 while preserving existing toolResponse.raw and declared getters.",
   packageCapabilities: {
     updatePreferences: 1
@@ -4353,7 +4353,7 @@ async function* observeRunEvents(options) {
   }
 }
 
-// ../../shared_libs/integrations/theirstack-execution-policy.ts
+// ../integration-contracts/theirstack/execution-policy.ts
 var THEIRSTACK_SLOW_JOB_SEARCH_PROVIDER_TIMEOUT_MS = 135e3;
 var THEIRSTACK_SLOW_JOB_SEARCH_CLIENT_TIMEOUT_MS = 6e4 + THEIRSTACK_SLOW_JOB_SEARCH_PROVIDER_TIMEOUT_MS + 15e3;
 var THEIRSTACK_COMPANY_SEARCH_CLIENT_TIMEOUT_MS = 21e4;
@@ -4407,7 +4407,7 @@ function resolveTheirstackClientTimeoutMs(endpointId, payload) {
   return usesExtendedTheirstackJobSearchBudget(endpointId, payload) ? THEIRSTACK_SLOW_JOB_SEARCH_CLIENT_TIMEOUT_MS : null;
 }
 
-// ../../shared_libs/integrations/bettercontact-execution-policy.ts
+// ../integration-contracts/bettercontact/execution-policy.ts
 var BETTERCONTACT_LAUNCHER_CLIENT_TIMEOUT_MS = 12e4;
 var BETTERCONTACT_LAUNCHER_TOOL_IDS = /* @__PURE__ */ new Set([
   "bettercontact_enrich",
@@ -17008,7 +17008,7 @@ function resolveDaytonaSandboxComputeItem(input2) {
   };
 }
 
-// ../../shared_libs/billing/compute-pricing.ts
+// ../billing/compute-pricing-contract.ts
 var COMPUTE_BILLING_MARKUP_MULTIPLIER = 5;
 var DEFAULT_USD_PER_CUSTOMER_CREDIT = 0.1;
 var DEFAULT_PROVIDER_MARKUP_MULTIPLIER = 1.4;
@@ -38372,6 +38372,8 @@ var SDK_SIDECAR_CRITICAL_PACKAGE_FILES = [
   "dist/index.d.ts",
   "dist/plays/bundle-play-file.mjs",
   "dist/bundling-sources/shared_libs/observability/telemetry.ts",
+  "dist/bundling-sources/shared_libs/integration-contracts/bettercontact/execution-policy.ts",
+  "dist/bundling-sources/shared_libs/integration-contracts/theirstack/execution-policy.ts",
   "dist/bundling-sources/shared_libs/play-runtime/backend.ts",
   "dist/bundling-sources/shared_libs/plays/bundling/index.ts",
   "dist/bundling-sources/shared_libs/product-notifications/contract.ts",

package/dist/cli/index.mjs

@@ -1210,7 +1210,7 @@ var SDK_RELEASE = {
   // available at toolResponse.rawV2 while toolResponse.raw and all declared
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
-  version: "0.3.86",
+  version: "0.3.87",
   updateSummary: "Automatic CLI updates are now enabled by default. To opt out, run `deepline settings autoupdate off`; use `deepline settings autoupdate on` to re-enable updates or `deepline settings autoupdate pin <version>` to hold an exact release. This release also adds raw-v2 tool responses at toolResponse.rawV2 while preserving existing toolResponse.raw and declared getters.",
   packageCapabilities: {
     updatePreferences: 1
@@ -4338,7 +4338,7 @@ async function* observeRunEvents(options) {
   }
 }
 
-// ../../shared_libs/integrations/theirstack-execution-policy.ts
+// ../integration-contracts/theirstack/execution-policy.ts
 var THEIRSTACK_SLOW_JOB_SEARCH_PROVIDER_TIMEOUT_MS = 135e3;
 var THEIRSTACK_SLOW_JOB_SEARCH_CLIENT_TIMEOUT_MS = 6e4 + THEIRSTACK_SLOW_JOB_SEARCH_PROVIDER_TIMEOUT_MS + 15e3;
 var THEIRSTACK_COMPANY_SEARCH_CLIENT_TIMEOUT_MS = 21e4;
@@ -4392,7 +4392,7 @@ function resolveTheirstackClientTimeoutMs(endpointId, payload) {
   return usesExtendedTheirstackJobSearchBudget(endpointId, payload) ? THEIRSTACK_SLOW_JOB_SEARCH_CLIENT_TIMEOUT_MS : null;
 }
 
-// ../../shared_libs/integrations/bettercontact-execution-policy.ts
+// ../integration-contracts/bettercontact/execution-policy.ts
 var BETTERCONTACT_LAUNCHER_CLIENT_TIMEOUT_MS = 12e4;
 var BETTERCONTACT_LAUNCHER_TOOL_IDS = /* @__PURE__ */ new Set([
   "bettercontact_enrich",
@@ -17070,7 +17070,7 @@ function resolveDaytonaSandboxComputeItem(input2) {
   };
 }
 
-// ../../shared_libs/billing/compute-pricing.ts
+// ../billing/compute-pricing-contract.ts
 var COMPUTE_BILLING_MARKUP_MULTIPLIER = 5;
 var DEFAULT_USD_PER_CUSTOMER_CREDIT = 0.1;
 var DEFAULT_PROVIDER_MARKUP_MULTIPLIER = 1.4;
@@ -38489,6 +38489,8 @@ var SDK_SIDECAR_CRITICAL_PACKAGE_FILES = [
   "dist/index.d.ts",
   "dist/plays/bundle-play-file.mjs",
   "dist/bundling-sources/shared_libs/observability/telemetry.ts",
+  "dist/bundling-sources/shared_libs/integration-contracts/bettercontact/execution-policy.ts",
+  "dist/bundling-sources/shared_libs/integration-contracts/theirstack/execution-policy.ts",
   "dist/bundling-sources/shared_libs/play-runtime/backend.ts",
   "dist/bundling-sources/shared_libs/plays/bundling/index.ts",
   "dist/bundling-sources/shared_libs/product-notifications/contract.ts",

package/dist/index.d.mts

@@ -1922,7 +1922,7 @@ declare function defineMonitor<TPayload extends MonitorPayload = MonitorPayload>
 /**
  * The fleet member ceiling, mirrored — deliberately a literal.
  *
- * The canonical declaration is shared_libs/monitors/monitor-fleet-limits.ts,
+ * The canonical declaration is packages/monitors/monitor-fleet-limits.ts,
  * which the Convex commit mutation reads to size its transaction. This package
  * cannot import it: the workspace-architecture ratchet forbids NEW shared_libs
  * imports from packages absolutely (only relocations of pre-existing edges

package/dist/index.d.ts

@@ -1922,7 +1922,7 @@ declare function defineMonitor<TPayload extends MonitorPayload = MonitorPayload>
 /**
  * The fleet member ceiling, mirrored — deliberately a literal.
  *
- * The canonical declaration is shared_libs/monitors/monitor-fleet-limits.ts,
+ * The canonical declaration is packages/monitors/monitor-fleet-limits.ts,
  * which the Convex commit mutation reads to size its transaction. This package
  * cannot import it: the workspace-architecture ratchet forbids NEW shared_libs
  * imports from packages absolutely (only relocations of pre-existing edges

package/dist/index.js

@@ -832,7 +832,7 @@ var SDK_RELEASE = {
   // available at toolResponse.rawV2 while toolResponse.raw and all declared
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
-  version: "0.3.86",
+  version: "0.3.87",
   updateSummary: "Automatic CLI updates are now enabled by default. To opt out, run `deepline settings autoupdate off`; use `deepline settings autoupdate on` to re-enable updates or `deepline settings autoupdate pin <version>` to hold an exact release. This release also adds raw-v2 tool responses at toolResponse.rawV2 while preserving existing toolResponse.raw and declared getters.",
   packageCapabilities: {
     updatePreferences: 1
@@ -3826,7 +3826,7 @@ async function* observeRunEvents(options) {
   }
 }
 
-// ../../shared_libs/integrations/theirstack-execution-policy.ts
+// ../integration-contracts/theirstack/execution-policy.ts
 var THEIRSTACK_SLOW_JOB_SEARCH_PROVIDER_TIMEOUT_MS = 135e3;
 var THEIRSTACK_SLOW_JOB_SEARCH_CLIENT_TIMEOUT_MS = 6e4 + THEIRSTACK_SLOW_JOB_SEARCH_PROVIDER_TIMEOUT_MS + 15e3;
 var THEIRSTACK_COMPANY_SEARCH_CLIENT_TIMEOUT_MS = 21e4;
@@ -3880,7 +3880,7 @@ function resolveTheirstackClientTimeoutMs(endpointId, payload) {
   return usesExtendedTheirstackJobSearchBudget(endpointId, payload) ? THEIRSTACK_SLOW_JOB_SEARCH_CLIENT_TIMEOUT_MS : null;
 }
 
-// ../../shared_libs/integrations/bettercontact-execution-policy.ts
+// ../integration-contracts/bettercontact/execution-policy.ts
 var BETTERCONTACT_LAUNCHER_CLIENT_TIMEOUT_MS = 12e4;
 var BETTERCONTACT_LAUNCHER_TOOL_IDS = /* @__PURE__ */ new Set([
   "bettercontact_enrich",

package/dist/index.mjs

@@ -744,7 +744,7 @@ var SDK_RELEASE = {
   // available at toolResponse.rawV2 while toolResponse.raw and all declared
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
-  version: "0.3.86",
+  version: "0.3.87",
   updateSummary: "Automatic CLI updates are now enabled by default. To opt out, run `deepline settings autoupdate off`; use `deepline settings autoupdate on` to re-enable updates or `deepline settings autoupdate pin <version>` to hold an exact release. This release also adds raw-v2 tool responses at toolResponse.rawV2 while preserving existing toolResponse.raw and declared getters.",
   packageCapabilities: {
     updatePreferences: 1
@@ -3738,7 +3738,7 @@ async function* observeRunEvents(options) {
   }
 }
 
-// ../../shared_libs/integrations/theirstack-execution-policy.ts
+// ../integration-contracts/theirstack/execution-policy.ts
 var THEIRSTACK_SLOW_JOB_SEARCH_PROVIDER_TIMEOUT_MS = 135e3;
 var THEIRSTACK_SLOW_JOB_SEARCH_CLIENT_TIMEOUT_MS = 6e4 + THEIRSTACK_SLOW_JOB_SEARCH_PROVIDER_TIMEOUT_MS + 15e3;
 var THEIRSTACK_COMPANY_SEARCH_CLIENT_TIMEOUT_MS = 21e4;
@@ -3792,7 +3792,7 @@ function resolveTheirstackClientTimeoutMs(endpointId, payload) {
   return usesExtendedTheirstackJobSearchBudget(endpointId, payload) ? THEIRSTACK_SLOW_JOB_SEARCH_CLIENT_TIMEOUT_MS : null;
 }
 
-// ../../shared_libs/integrations/bettercontact-execution-policy.ts
+// ../integration-contracts/bettercontact/execution-policy.ts
 var BETTERCONTACT_LAUNCHER_CLIENT_TIMEOUT_MS = 12e4;
 var BETTERCONTACT_LAUNCHER_TOOL_IDS = /* @__PURE__ */ new Set([
   "bettercontact_enrich",

package/dist/install-integrity.json

@@ -23,11 +23,52 @@
     "dist/bundling-sources/sdk/src/tool-output.ts",
     "dist/bundling-sources/sdk/src/types.ts",
     "dist/bundling-sources/sdk/src/version.ts",
-    "dist/bundling-sources/shared_libs/integrations/bettercontact-execution-policy.ts",
-    "dist/bundling-sources/shared_libs/integrations/theirstack-execution-policy.ts",
+    "dist/bundling-sources/shared_libs/integration-contracts/AGENTS.md",
+    "dist/bundling-sources/shared_libs/integration-contracts/bettercontact/execution-policy.ts",
+    "dist/bundling-sources/shared_libs/integration-contracts/index.ts",
+    "dist/bundling-sources/shared_libs/integration-contracts/README.md",
+    "dist/bundling-sources/shared_libs/integration-contracts/theirstack/execution-policy.ts",
+    "dist/bundling-sources/shared_libs/monitors/analytics-install-guides.ts",
+    "dist/bundling-sources/shared_libs/monitors/billing/charges.ts",
+    "dist/bundling-sources/shared_libs/monitors/billing/policy-builders.ts",
+    "dist/bundling-sources/shared_libs/monitors/billing/pricing.ts",
+    "dist/bundling-sources/shared_libs/monitors/billing/public-pricing.ts",
+    "dist/bundling-sources/shared_libs/monitors/billing/session.ts",
+    "dist/bundling-sources/shared_libs/monitors/billing/state.ts",
+    "dist/bundling-sources/shared_libs/monitors/billing/tamradar.ts",
+    "dist/bundling-sources/shared_libs/monitors/billing/types.ts",
+    "dist/bundling-sources/shared_libs/monitors/callback-security.ts",
+    "dist/bundling-sources/shared_libs/monitors/cursor-page.ts",
     "dist/bundling-sources/shared_libs/monitors/deactivation-reasons.ts",
+    "dist/bundling-sources/shared_libs/monitors/framework-managed-payload-fields.ts",
+    "dist/bundling-sources/shared_libs/monitors/generated/provider-monitor-callback-admission-targets.ts",
+    "dist/bundling-sources/shared_libs/monitors/http-error-response.ts",
+    "dist/bundling-sources/shared_libs/monitors/inbound-publish-key.ts",
+    "dist/bundling-sources/shared_libs/monitors/inbound-queue.ts",
+    "dist/bundling-sources/shared_libs/monitors/lifecycle-notifications.ts",
     "dist/bundling-sources/shared_libs/monitors/monitor-fleet-limits.ts",
     "dist/bundling-sources/shared_libs/monitors/org-monitor-limits.ts",
+    "dist/bundling-sources/shared_libs/monitors/package.json",
+    "dist/bundling-sources/shared_libs/monitors/provider-callback-verification.ts",
+    "dist/bundling-sources/shared_libs/monitors/provider-monitor-capability.ts",
+    "dist/bundling-sources/shared_libs/monitors/provider-monitor-consumer-health.ts",
+    "dist/bundling-sources/shared_libs/monitors/provider-monitor-errors.ts",
+    "dist/bundling-sources/shared_libs/monitors/provider-monitor-identity-claims.ts",
+    "dist/bundling-sources/shared_libs/monitors/provider-monitor-legacy-aliases.ts",
+    "dist/bundling-sources/shared_libs/monitors/provider-monitor-priority-execution.ts",
+    "dist/bundling-sources/shared_libs/monitors/provider-monitor-public-aliases.ts",
+    "dist/bundling-sources/shared_libs/monitors/provider-monitor-runtime-read-eligibility.ts",
+    "dist/bundling-sources/shared_libs/monitors/provider-monitor-status.ts",
+    "dist/bundling-sources/shared_libs/monitors/provider-monitor-upstream-identity.ts",
+    "dist/bundling-sources/shared_libs/monitors/provider-webhook-monitor-runtime.ts",
+    "dist/bundling-sources/shared_libs/monitors/quickstart-prompts.ts",
+    "dist/bundling-sources/shared_libs/monitors/snitcher-install-validation.ts",
+    "dist/bundling-sources/shared_libs/monitors/snitcher-ip2company.ts",
+    "dist/bundling-sources/shared_libs/monitors/snitcher-radar.ts",
+    "dist/bundling-sources/shared_libs/monitors/starter-templates.ts",
+    "dist/bundling-sources/shared_libs/monitors/tracking-provider-guidance.ts",
+    "dist/bundling-sources/shared_libs/monitors/tracking-provider-integrations.ts",
+    "dist/bundling-sources/shared_libs/monitors/tsconfig.json",
     "dist/bundling-sources/shared_libs/monitors/validation.ts",
     "dist/bundling-sources/shared_libs/observability/node-tracing.ts",
     "dist/bundling-sources/shared_libs/observability/redaction.ts",
@@ -261,9 +302,11 @@
     "dist/bundling-sources/shared_libs/plays/user-code-safety.ts",
     "dist/bundling-sources/shared_libs/product-notifications/contract.ts",
     "dist/bundling-sources/shared_libs/runtime-env.ts",
+    "dist/bundling-sources/shared_libs/security/header-safe-env.ts",
     "dist/bundling-sources/shared_libs/security/outbound-url-policy.ts",
     "dist/bundling-sources/shared_libs/security/safe-fetch.ts",
     "dist/bundling-sources/shared_libs/security/safe-outbound-fetch.ts",
+    "dist/bundling-sources/shared_libs/security/secret-redaction.ts",
     "dist/bundling-sources/shared_libs/tool-execution-error.ts",
     "dist/cli/index.d.mts",
     "dist/cli/index.d.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.3.86",
+  "version": "0.3.87",
   "description": "GTM data CLI and TypeScript SDK for coding agents",
   "license": "MIT",
   "homepage": "https://code.deepline.com",
@@ -54,6 +54,8 @@
     "esbuild": "^0.27.0"
   },
   "devDependencies": {
+    "@deepline/billing": "workspace:*",
+    "@deepline/integration-contracts": "workspace:*",
     "@deepline/play-runtime": "workspace:*",
     "@deepline/plays": "workspace:*",
     "@deepline/product-notifications": "workspace:*",