deepline 0.2.48 → 0.2.50

package/dist/bundling-sources/sdk/src/client.ts

@@ -818,10 +818,14 @@ export type MonitorsNamespace = {
   list: (options?: MonitorsListOptions) => Promise<MonitorsListResult>;
   /** Fetch one deployed monitor by public key (without dependents). */
   get: (key: string) => Promise<MonitorDetail>;
-  /** Send an explicit payload through the deployed monitor's normal webhook path. */
+  /**
+   * Test a deployed monitor. `validationOnly` safely verifies the callback
+   * envelope; omitted options preserve the historic full-ingestion behavior.
+   */
   test: (
     key: string,
     payload: Record<string, unknown>,
+    options?: { validationOnly?: boolean },
   ) => Promise<MonitorTestResult>;
   validate: (key: string) => Promise<MonitorValidateResult>;
   /** List the published plays depending on one monitor's output streams. */
@@ -1634,7 +1638,8 @@ export class DeeplineClient {
       deploy: (definition, options) => this.deployMonitor(definition, options),
       list: (options) => this.listMonitors(options),
       get: (key) => this.getMonitor(key),
-      test: (key, payload) => this.testMonitorWebhook(key, payload),
+      test: (key, payload, options) =>
+        this.testMonitorWebhook(key, payload, options),
       validate: (key) => this.validateMonitor(key),
       dependents: (key) => this.getMonitorDependents(key),
       update: (key, patch) => this.updateMonitor(key, patch),
@@ -4547,10 +4552,17 @@ export class DeeplineClient {
   async testMonitorWebhook(
     key: string,
     payload: Record<string, unknown>,
+    options?: { validationOnly?: boolean },
   ): Promise<MonitorTestResult> {
     return this.http.request<MonitorTestResult>(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}/test`,
-      { method: 'POST', body: { payload } },
+      {
+        method: 'POST',
+        body: {
+          payload,
+          ...(options?.validationOnly ? { mode: 'validation_only' } : {}),
+        },
+      },
     );
   }
 

package/dist/bundling-sources/sdk/src/play.ts

@@ -176,7 +176,8 @@ export type PlayFetchResponse = PlayAuthoringFetchResponse;
  *
  * A play can be triggered three ways, declared as the third argument to
  * {@link definePlay}:
- * - `webhook` — an inbound HTTP call (with optional HMAC signature verification);
+ * - `webhook` — an inbound HTTP call (with optional legacy HMAC or Standard
+ *   Webhooks signature verification);
  * - `cron` — a schedule; or
  * - `sqlListeners` — a **monitor**: the play runs whenever a monitor writes a new
  *   row to its output stream. This is how you build a play "on top of" a monitor
@@ -198,6 +199,19 @@ export type PlayFetchResponse = PlayAuthoringFetchResponse;
  * });
  * ```
  *
+ * @example Svix / Standard Webhooks verification with Deepline Secrets
+ * ```typescript
+ * definePlay('visitor-webhook', handler, {
+ *   webhook: {
+ *     auth: {
+ *       type: 'standard-webhooks',
+ *       headerFamily: 'svix',
+ *       signingSecrets: ['VECTOR_WEBHOOK_SECRET'],
+ *     },
+ *   },
+ * });
+ * ```
+ *
  * @example Cron schedule
  * ```typescript
  * definePlay('nightly-sync', handler, {

package/dist/bundling-sources/sdk/src/release.ts

@@ -160,7 +160,7 @@ export const SDK_RELEASE = {
   // 0.2.0 makes Dataset Handles uniformly async-only after 0.1.320 briefly
   // exposed storage-dependent synchronous access. This deliberate minor
   // release keeps lazy paging semantics independent of row residency.
-  version: '0.2.48',
+  version: '0.2.50',
   contracts: {
     api: {
       name: 'sdk-http-api',

package/dist/bundling-sources/shared_libs/plays/authoring-contract.ts

@@ -56,6 +56,7 @@ export const PLAY_AUTHORING_CONTRACT_ISSUE_CODES = [
   'play_authoring_billing_limit_invalid',
   'play_authoring_billing_limit_unresolved',
   'play_authoring_webhook_hmac_invalid',
+  'play_authoring_standard_webhooks_invalid',
   'play_authoring_secret_invalid',
   'play_authoring_cron_timezone_invalid',
   'play_authoring_tool_request_invalid',
@@ -83,6 +84,16 @@ export type PlayAuthoringContractIssue = {
 };
 
 export type PlaySqlListenerOperation = 'INSERT' | 'UPDATE' | 'DELETE';
+export type PlayStandardWebhookHeaderFamily = 'standard' | 'svix';
+export type PlayStandardWebhookAuth = {
+  type: 'standard-webhooks';
+  /** `webhook-*` for Standard Webhooks, `svix-*` for Svix senders. */
+  headerFamily: PlayStandardWebhookHeaderFamily;
+  /** Deepline Secret names used for ordinary operation and rotation overlap. */
+  signingSecrets: string[];
+  /** Replay-protection window. Omitted means the Standard Webhooks 5-minute default. */
+  toleranceSeconds?: number;
+};
 export const PLAY_SQL_LISTENER_WHERE_OPERATORS = [
   'eq',
   'neq',
@@ -259,6 +270,7 @@ export type PlayAuthoringAstBindings = {
       header?: string;
       secretEnv: string;
     };
+    auth?: PlayStandardWebhookAuth;
   };
   cron?: { schedule: string; timezone?: string };
   sqlListeners?: PlayAuthoringAstSqlListenerDeclaration[];
@@ -287,6 +299,7 @@ export type PlayAuthoringBindings = {
       header?: string;
       secretEnv: string;
     };
+    auth?: PlayStandardWebhookAuth;
   };
   cron?: {
     schedule: string;
@@ -973,6 +986,81 @@ export const PLAY_AUTHORING_FIELD_REGISTRY = {
     errorMessage:
       'bindings.webhook.hmac.header must be a non-empty static string.',
   },
+  'bindings.webhook.auth.type': {
+    schema: Type.Literal('standard-webhooks'),
+    fixtures: {
+      valid: 'standard-webhooks',
+      invalid: 'svix',
+      absent: undefined,
+      unresolved: { expression: 'type' },
+      edition1: undefined,
+    },
+    referenceType: "'standard-webhooks'",
+    // auth itself is optional; once present, the AST adapter requires this
+    // field together with headerFamily and signingSecrets.
+    required: false,
+    resolution: 'static-required',
+    issueCode: 'play_authoring_standard_webhooks_invalid',
+    description: 'Uses the Standard Webhooks v1 symmetric signing scheme.',
+    errorMessage:
+      'bindings.webhook.auth.type must be the static literal "standard-webhooks".',
+  },
+  'bindings.webhook.auth.headerFamily': {
+    schema: Type.Union([Type.Literal('standard'), Type.Literal('svix')]),
+    fixtures: {
+      valid: 'svix',
+      invalid: 'webhook',
+      absent: undefined,
+      unresolved: { expression: 'headerFamily' },
+      edition1: undefined,
+    },
+    referenceType: "'standard' | 'svix'",
+    // auth itself is optional; once present, the AST adapter requires this
+    // field together with type and signingSecrets.
+    required: false,
+    resolution: 'static-required',
+    issueCode: 'play_authoring_standard_webhooks_invalid',
+    description: 'Header namespace expected from the webhook provider.',
+    errorMessage:
+      'bindings.webhook.auth.headerFamily must be the static literal "standard" or "svix".',
+  },
+  'bindings.webhook.auth.signingSecrets[]': {
+    schema: SecretEnvironmentNameSchema,
+    fixtures: {
+      valid: 'VECTOR_WEBHOOK_SECRET',
+      invalid: 'vector_webhook_secret',
+      absent: undefined,
+      unresolved: { expression: 'secret' },
+      edition1: undefined,
+    },
+    referenceType: 'string',
+    // auth itself is optional; once present, the AST adapter requires this
+    // field together with type and headerFamily.
+    required: false,
+    resolution: 'static-required',
+    issueCode: 'play_authoring_standard_webhooks_invalid',
+    description: 'Deepline Secret name used to verify Standard Webhooks.',
+    errorMessage:
+      'bindings.webhook.auth.signingSecrets entries must be uppercase Deepline Secret names beginning with a letter.',
+  },
+  'bindings.webhook.auth.toleranceSeconds': {
+    schema: Type.Integer({ minimum: 1, maximum: 3600 }),
+    fixtures: {
+      valid: 300,
+      invalid: 0,
+      absent: undefined,
+      unresolved: { expression: 'toleranceSeconds' },
+      edition1: undefined,
+    },
+    referenceType: 'number',
+    required: false,
+    resolution: 'static-required',
+    issueCode: 'play_authoring_standard_webhooks_invalid',
+    description:
+      'Accepted delivery timestamp skew in seconds, from 1 through 3600.',
+    errorMessage:
+      'bindings.webhook.auth.toleranceSeconds must be a static whole number from 1 through 3600.',
+  },
   'bindings.cron.schedule': {
     schema: Type.String({ minLength: 1 }),
     fixtures: {
@@ -2157,7 +2245,7 @@ export const PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   `  inline?: ${cloudReferenceType('inline')};`,
   `  billing?: { maxCreditsPerRun?: ${cloudReferenceType('billing.maxCreditsPerRun')} };`,
   `  runtime?: { timeout?: ${cloudReferenceType('runtime.timeout')}; size?: ${cloudReferenceType('runtime.size')} };`,
-  `  webhook?: { hmac?: { algorithm?: ${cloudReferenceType('bindings.webhook.hmac.algorithm')}; header?: ${cloudReferenceType('bindings.webhook.hmac.header')}; secretEnv: ${cloudReferenceType('bindings.webhook.hmac.secretEnv')} } };`,
+  `  webhook?: { hmac?: { algorithm?: ${cloudReferenceType('bindings.webhook.hmac.algorithm')}; header?: ${cloudReferenceType('bindings.webhook.hmac.header')}; secretEnv: ${cloudReferenceType('bindings.webhook.hmac.secretEnv')} }; auth?: { type: ${cloudReferenceType('bindings.webhook.auth.type')}; headerFamily: ${cloudReferenceType('bindings.webhook.auth.headerFamily')}; signingSecrets: readonly ${cloudReferenceType('bindings.webhook.auth.signingSecrets[]')}[]; toleranceSeconds?: ${cloudReferenceType('bindings.webhook.auth.toleranceSeconds')} } };`,
   `  cron?: { schedule: ${cloudReferenceType('bindings.cron.schedule')}; timezone?: ${cloudReferenceType('bindings.cron.timezone')} };`,
   '  sqlListeners?: readonly SqlListenerDeclaration[];',
   `  secrets?: readonly ${cloudReferenceType('bindings.secrets[]')}[];`,

package/dist/bundling-sources/shared_libs/plays/bundling/index.ts

@@ -10,6 +10,7 @@ import {
   join,
   relative,
   resolve,
+  sep,
 } from 'node:path';
 import { builtinModules } from 'node:module';
 import { Parser } from 'acorn';
@@ -94,6 +95,8 @@ export type PlayLocalFileDiscoveryResult = {
 
 export type PlayBundlingAdapter = {
   projectRoot: string;
+  /** Optional root used only to make source-graph identity independent of temporary absolute paths. */
+  sourceIdentityRoot?: string;
   nodeModulesDir: string;
   cacheDir?: string;
   sdkSourceRoot: string;
@@ -179,6 +182,24 @@ function sha256(value: string): string {
   return createHash('sha256').update(value).digest('hex');
 }
 
+function sourceIdentityPath(
+  filePath: string,
+  adapter: PlayBundlingAdapter,
+): string {
+  if (!adapter.sourceIdentityRoot) return filePath;
+  const identityRoot = resolve(adapter.sourceIdentityRoot);
+  const logicalPath = relative(identityRoot, resolve(filePath));
+  if (
+    !logicalPath ||
+    logicalPath === '..' ||
+    logicalPath.startsWith(`..${sep}`) ||
+    isAbsolute(logicalPath)
+  ) {
+    return filePath;
+  }
+  return logicalPath.split(/[\\/]+/).join('/');
+}
+
 function formatEsbuildMessage(message: Message): string {
   const location = message.location
     ? `${message.location.file}:${message.location.line}:${message.location.column}`
@@ -1598,9 +1619,12 @@ async function analyzeSourceGraph(
   const sourceHash = sha256(sourceCode);
   const graphHash = sha256(
     JSON.stringify({
-      entryFile: absoluteEntryFile,
+      entryFile: sourceIdentityPath(absoluteEntryFile, adapter),
       localFiles: [...localFiles.entries()]
-        .map(([filePath, contents]) => ({ filePath, hash: sha256(contents) }))
+        .map(([filePath, contents]) => ({
+          filePath: sourceIdentityPath(filePath, adapter),
+          hash: sha256(contents),
+        }))
         .sort((left, right) => left.filePath.localeCompare(right.filePath)),
       nodeBuiltins: [...nodeBuiltins].sort(),
       packages: [...packages.entries()]
@@ -1608,7 +1632,7 @@ async function analyzeSourceGraph(
         .sort((left, right) => left.name.localeCompare(right.name)),
       importedPlayDependencies: [...importedPlayDependencies.values()]
         .map((dependency) => ({
-          filePath: dependency.filePath,
+          filePath: sourceIdentityPath(dependency.filePath, adapter),
           playName: dependency.playName,
         }))
         .sort((left, right) => left.filePath.localeCompare(right.filePath)),
@@ -1660,7 +1684,7 @@ function artifactCachePath(
   adapter: PlayBundlingAdapter,
 ): string {
   return join(
-    adapter.cacheDir ?? PLAY_ARTIFACT_CACHE_DIR,
+    /* turbopackIgnore: true */ adapter.cacheDir ?? PLAY_ARTIFACT_CACHE_DIR,
     `${graphHash}.${artifactKind}.json`,
   );
 }
@@ -1672,7 +1696,11 @@ async function readArtifactCache(
 ): Promise<PlayBundleArtifact | null> {
   try {
     const serialized = await readFile(
-      artifactCachePath(graphHash, artifactKind, adapter),
+      /* turbopackIgnore: true */ artifactCachePath(
+        graphHash,
+        artifactKind,
+        adapter,
+      ),
       'utf-8',
     );
     return JSON.parse(serialized) as PlayBundleArtifact;
@@ -1686,9 +1714,9 @@ async function writeArtifactCache(
   adapter: PlayBundlingAdapter,
 ): Promise<void> {
   const cacheDir = adapter.cacheDir ?? PLAY_ARTIFACT_CACHE_DIR;
-  await mkdir(cacheDir, { recursive: true });
+  await mkdir(/* turbopackIgnore: true */ cacheDir, { recursive: true });
   await writeFile(
-    artifactCachePath(
+    /* turbopackIgnore: true */ artifactCachePath(
       artifact.graphHash,
       artifact.artifactKind ?? PLAY_ARTIFACT_KINDS.cjsNode20,
       adapter,

package/dist/bundling-sources/shared_libs/plays/enrich-compat-adapter.ts

@@ -0,0 +1,21 @@
+export const ENRICH_COMPAT_DEFAULT_PLAY_NAME = 'deepline-enrich-v1-compat';
+export const ENRICH_COMPAT_DEFAULT_MAP_NAME = 'deepline_enrich_rows';
+
+export type EnrichCompatibilityOptions = {
+  playName?: string;
+  mapName?: string;
+};
+
+export type EnrichCompatibilityPlan = {
+  playName: string;
+  mapName: string;
+};
+
+export function buildEnrichCompatibilityPlan(
+  options: EnrichCompatibilityOptions = {},
+): EnrichCompatibilityPlan {
+  return {
+    playName: options.playName?.trim() || ENRICH_COMPAT_DEFAULT_PLAY_NAME,
+    mapName: options.mapName?.trim() || ENRICH_COMPAT_DEFAULT_MAP_NAME,
+  };
+}