deepline 0.3.113 → 0.3.114

package/dist/bundling-sources/shared_libs/observability/scheduled-jobs.json

@@ -976,13 +976,13 @@
     "domainReportRequired": true
   },
   {
-    "id": "vercel.play-webhook-receipt-recovery",
+    "id": "convex.recover-play-webhook-receipts",
     "name": "Recover Play webhook receipts",
-    "scheduler": "vercel_cron",
-    "cadence": "* * * * *",
+    "scheduler": "convex_cron",
+    "cadence": "every 60s",
     "timezone": "UTC",
-    "source": "apps/deepline-api/vercel.json",
-    "locator": "/api/v2/cron/play-webhook-receipt-recovery",
+    "source": "packages/convex/crons.ts",
+    "locator": "recover Play webhook receipts",
     "owner": "runtime",
     "criticality": "critical",
     "purpose": "Recover Play webhook receipts whose admission/dispatch continuation is delayed or stranded.",
@@ -990,7 +990,25 @@
     "failureDefinition": "A receipt cannot be safely recovered, remains stranded, or evidence cannot persist.",
     "startGraceMs": 300000,
     "runTimeoutMs": 1800000,
-    "failureAlert": "vercel_route_wrapper",
+    "failureAlert": "convex_action_wrapper",
+    "domainReportRequired": true
+  },
+  {
+    "id": "convex.recover-signal-radar-inbound-receipts",
+    "name": "Recover Signal Radar inbound receipts",
+    "scheduler": "convex_cron",
+    "cadence": "every 60s",
+    "timezone": "UTC",
+    "source": "packages/convex/crons.ts",
+    "locator": "recover Signal Radar inbound receipts",
+    "owner": "monitors",
+    "criticality": "critical",
+    "purpose": "Recover Signal Radar inbound receipts whose processing is delayed or stranded.",
+    "successDefinition": "Every eligible receipt is retried or terminally classified with evidence; no eligible receipts is a valid no-op.",
+    "failureDefinition": "A receipt cannot be safely recovered, remains stranded, or evidence cannot persist.",
+    "startGraceMs": 300000,
+    "runTimeoutMs": 1800000,
+    "failureAlert": "convex_action_wrapper",
     "domainReportRequired": true
   },
   {
@@ -1011,24 +1029,6 @@
     "failureAlert": "convex_action_wrapper",
     "domainReportRequired": true
   },
-  {
-    "id": "github.modal-ci-runner-weekly-proof",
-    "name": "Modal CI runner",
-    "scheduler": "github_actions",
-    "cadence": "23 6 * * 1",
-    "timezone": "UTC",
-    "source": ".github/workflows/modal-ci-runner.yml",
-    "locator": "schedule:",
-    "owner": "platform",
-    "criticality": "maintenance",
-    "purpose": "Lint, test, deploy, and prove the pinned Modal CI runner image and isolated smoke path.",
-    "successDefinition": "Pinned package lint/tests, control-plane/image deploy, and exact-image credential-isolation smoke all pass.",
-    "failureDefinition": "Any lint/test/deploy/health/smoke/cleanup proof fails or image identity is wrong.",
-    "startGraceMs": 600000,
-    "runTimeoutMs": 3600000,
-    "failureAlert": "github_workflow_run",
-    "domainReportRequired": true
-  },
   {
     "id": "convex.async-usage-recovery-continuation",
     "name": "Async usage recovery continuation",

package/dist/bundling-sources/shared_libs/observability/scheduled-work-manual.ts

@@ -18,6 +18,8 @@ export const MANUALLY_RUNNABLE_CONVEX_CRON_JOB_IDS = [
   'convex.monitor-deployment-job-tick',
   'convex.provider-monitor-global-audit-daily',
   'convex.recover-notification-delivery-work',
+  'convex.recover-play-webhook-receipts',
+  'convex.recover-signal-radar-inbound-receipts',
   'convex.process-notification-usage-refreshes',
   'convex.observe-operational-queue-health',
   'convex.cleanup-expired-notification-audit-records',

package/dist/bundling-sources/shared_libs/observability/scheduled-work.ts

@@ -1,4 +1,6 @@
-export const SCHEDULED_WORK_OBSERVABILITY_VERSION = 1 as const;
+/** The only scheduled-work telemetry envelope emitted after the hard cut. */
+export const SCHEDULED_WORK_OBSERVABILITY_VERSION = 2 as const;
+export const SCHEDULED_WORK_CONTRACT_VERSION = 2 as const;
 
 export type ScheduledWorkScheduler =
   | 'convex_cron'
@@ -11,6 +13,17 @@ export type ScheduledWorkScheduler =
 
 export type ScheduledWorkOutcome = 'running' | 'succeeded' | 'failed';
 export type ScheduledWorkTrigger = 'scheduled' | 'manual';
+export type ScheduledWorkDomainOutcome = 'success' | 'warning' | 'failure';
+export type ScheduledWorkFailureClass = 'execution' | 'domain';
+
+export type ScheduledWorkTelemetryDisposition = {
+  /** The occurrence slot this event belongs to, when one exists. */
+  occurrenceId?: string;
+  expectedAt?: number;
+  /** Explicit domain result; absence is a migration gap, not a green run. */
+  domainOutcome?: ScheduledWorkDomainOutcome;
+  failureClass?: ScheduledWorkFailureClass;
+};
 
 export type ScheduledWorkVolume = {
   unit: string;
@@ -44,9 +57,12 @@ export type ScheduledWorkObservation = {
 
 export function scheduledWorkTelemetryFields(
   observation: ScheduledWorkObservation,
+  disposition: ScheduledWorkTelemetryDisposition = {},
 ): Record<string, string | number> {
   return {
     scheduledWorkSchemaVersion: SCHEDULED_WORK_OBSERVABILITY_VERSION,
+    // Keep one explicit marker for the hard-cut occurrence/domain contract.
+    scheduledWorkContractVersion: SCHEDULED_WORK_CONTRACT_VERSION,
     scheduledWorkJobId: observation.jobId,
     scheduledWorkJobName: observation.jobName,
     scheduledWorkScheduler: observation.scheduler,
@@ -55,6 +71,18 @@ export function scheduledWorkTelemetryFields(
     scheduledWorkOutcome: observation.outcome,
     scheduledWorkInvocationId: observation.invocationId,
     scheduledWorkExpectedWithinMs: observation.expectedWithinMs,
+    ...(disposition.occurrenceId === undefined
+      ? {}
+      : { scheduledWorkOccurrenceId: disposition.occurrenceId }),
+    ...(disposition.expectedAt === undefined
+      ? {}
+      : { scheduledWorkExpectedAt: disposition.expectedAt }),
+    ...(disposition.domainOutcome === undefined
+      ? {}
+      : { scheduledWorkDomainOutcome: disposition.domainOutcome }),
+    ...(disposition.failureClass === undefined
+      ? {}
+      : { scheduledWorkFailureClass: disposition.failureClass }),
     ...(observation.trigger === undefined
       ? {}
       : { scheduledWorkTrigger: observation.trigger }),

package/dist/bundling-sources/shared_libs/play-runtime/admission-transport-policy.ts

@@ -0,0 +1,91 @@
+import { PLAY_WEBHOOK_RECEIPT_LARGE_BATCH_MAX_RECEIPTS } from '../security/receipt-admission-token';
+
+/**
+ * The per-request concurrency budget for moving a durable Play source into
+ * the Runtime Postgres + Absurd admission transaction. This is not an
+ * execution limit: Absurd owns execution capacity independently.
+ *
+ * Thirty-two is the private batch's entire scheduler-client budget for a
+ * normal 1,000-delivery burst. One client remains reserved below, rather than
+ * letting source admission consume every control-plane connection.
+ */
+export const PLAY_ADMISSION_MAX_PARALLELISM = 32;
+
+/**
+ * The private batch owns all 32 serverless scheduler clients, but one remains
+ * available for executor-token and other critical runtime control-plane work.
+ * Only atomic Runtime Postgres + Absurd submission uses this value.
+ * Source-lifecycle preflight has its own bounded budget because it does not
+ * consume a scheduler-pool client.
+ */
+export const PLAY_ADMISSION_MAX_ACTIVE_SUBMITS =
+  PLAY_ADMISSION_MAX_PARALLELISM - 1;
+
+/**
+ * A batch is allowed to prepare more independent source lifecycles than it
+ * may submit to Runtime Postgres at once. Preparation is mostly Convex/CPU
+ * work (read the immutable receipt, validate its pinned launch, mint its
+ * authority); it must not sit behind a scarce PgBouncer connection. The
+ * scheduler submitter remains capped by `PLAY_ADMISSION_MAX_ACTIVE_SUBMITS`.
+ *
+ * This is deliberately finite. It lets a 1K burst fill the 31 durable-submit
+ * slots while prior sources are still doing their non-Postgres preparation,
+ * without turning the private route into an unbounded fan-out.
+ */
+export const PLAY_ADMISSION_MAX_ACTIVE_LIFECYCLES = 256;
+
+/**
+ * A private 1K batch may queue behind the bounded scheduler submit cohort for
+ * longer than an ordinary single-run request, but never beyond this deadline.
+ */
+export const PLAY_ADMISSION_MAX_ACQUIRE_QUEUE_WAIT_MS = 120_000;
+
+/**
+ * One managed transport request may carry this many independently durable
+ * sources. The Vercel adapter processes one legacy wave at bounded
+ * source-lifecycle concurrency; its scheduler submit gate separately reserves
+ * critical control-plane capacity.
+ */
+export const PLAY_ADMISSION_BATCH_SIZE = PLAY_ADMISSION_MAX_PARALLELISM;
+
+/**
+ * `batch_v2` carries one full, bounded ingress burst into a single Vercel
+ * invocation. The invocation still submits at most
+ * `PLAY_ADMISSION_MAX_ACTIVE_SUBMITS` Runs at a time; this only removes the
+ * serial Convex-to-Vercel round trip between 32-receipt waves. The current
+ * dispatcher sends one request and lets that request drain its owned tail.
+ */
+export const PLAY_ADMISSION_LARGE_BATCH_SIZE =
+  PLAY_WEBHOOK_RECEIPT_LARGE_BATCH_MAX_RECEIPTS;
+
+/**
+ * `batch_v1` remains during the Convex-before-Vercel rollout window. It
+ * drains this many 32-source waves from one fenced Workpool action. New
+ * Retained custom-runner v2 actions may take a second large wave while their
+ * finite rollout cohort drains. Current scheduled dispatches own one
+ * exact wave and do not use this compatibility limit.
+ */
+export const PLAY_ADMISSION_BATCHES_PER_DISPATCH = 32;
+
+export const PLAY_ADMISSION_LARGE_BATCHES_PER_DISPATCH = 2;
+
+/**
+ * Upper bound for one direct drain under continuous traffic, not an admission
+ * SLO or a debounce. A request stops as soon as its queue is empty. Keep the
+ * exported name and persisted deadline compatible with retained dispatches.
+ */
+export const PLAY_ADMISSION_DIRECT_BATCH_COLLECTION_MAX_MS = 60_000;
+
+/** Poll/debounce interval for retained legacy dispatch implementations only. */
+export const PLAY_ADMISSION_DIRECT_BATCH_QUIET_MS = 250;
+
+/**
+ * Workpool is recovery, not the normal batch transport. It becomes eligible
+ * quickly, but the ownerless direct-dispatch fence keeps it from claiming the
+ * same source while the private request drains. That gives a lost action
+ * prompt recovery without adding another normal-path batch request.
+ */
+export const PLAY_ADMISSION_DIRECT_FALLBACK_DELAY_MS = 15_000;
+
+/** A pending source older than this is actionable queue delay. */
+export const PLAY_ADMISSION_DEGRADED_QUEUE_AGE_MS = 60_000;

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -1123,6 +1123,8 @@ export function resolveToolRuntimeTimeoutMs(
     normalized === 'deeplineagent_deeplineagent' ||
     normalized === 'ai_inference' ||
     normalized === 'deeplineagent_ai_inference' ||
+    normalized === 'ai_evaluate' ||
+    normalized === 'deeplineagent_ai_evaluate' ||
     normalized === 'aiinference'
     ? DEEPLINEAGENT_TOOL_RUNTIME_TIMEOUT_MS
     : DEFAULT_TOOL_RUNTIME_TIMEOUT_MS;

package/dist/bundling-sources/shared_libs/play-runtime/direct-admission-deadline.ts

@@ -0,0 +1,34 @@
+/**
+ * Bounds a synchronous direct-admission attempt. The source and its delayed
+ * Workpool recovery item already committed before this helper is used, so a
+ * timeout is deliberately an ambiguous outcome rather than a failed delivery.
+ * The race does not cancel already-started work; a replay must use the same
+ * idempotency identity and converge on the existing Runtime Run/Absurd task.
+ */
+export const PLAY_DIRECT_ADMISSION_DEADLINE_MS = 1_500;
+
+export class PlayDirectAdmissionDeadlineExceededError extends Error {
+  constructor(timeoutMs: number) {
+    super(`Direct Play admission exceeded its ${timeoutMs}ms deadline.`);
+    this.name = 'PlayDirectAdmissionDeadlineExceededError';
+  }
+}
+
+export async function withPlayDirectAdmissionDeadline<T>(
+  fn: () => Promise<T> | T,
+  timeoutMs = PLAY_DIRECT_ADMISSION_DEADLINE_MS,
+): Promise<T> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const work = Promise.resolve().then(fn);
+  const deadline = new Promise<never>((_resolve, reject) => {
+    timer = setTimeout(
+      () => reject(new PlayDirectAdmissionDeadlineExceededError(timeoutMs)),
+      timeoutMs,
+    );
+  });
+  try {
+    return await Promise.race([work, deadline]);
+  } finally {
+    if (timer !== undefined) clearTimeout(timer);
+  }
+}

package/dist/bundling-sources/shared_libs/play-runtime/fixture-behavior.ts

@@ -456,6 +456,7 @@ export function isReplaySafeFixtureToolId(toolId: string): boolean {
   return (
     shouldRouteFixtureToolId(normalized) &&
     normalized !== 'ai_inference' &&
+    normalized !== 'ai_evaluate' &&
     normalized !== 'deeplineagent' &&
     !normalized.startsWith('deeplineagent_')
   );

package/dist/bundling-sources/shared_libs/play-runtime/internal-bootstrap-token.ts

@@ -10,6 +10,13 @@ import {
   type FixtureBehavior,
 } from './/fixture-behavior';
 import { normalizeRuntimeSchedulerSchema } from './/runtime-scheduler-topology';
+import {
+  mintPlayWebhookReceiptLargeBatchAdmissionToken as mintPlayWebhookReceiptLargeBatchAdmissionTokenShared,
+  mintPlayTriggerEventAdmissionToken as mintPlayTriggerEventAdmissionTokenShared,
+  mintPlayWebhookReceiptBatchAdmissionToken as mintPlayWebhookReceiptBatchAdmissionTokenShared,
+  mintPlayWebhookReceiptAdmissionToken as mintPlayWebhookReceiptAdmissionTokenShared,
+  mintSignalRadarInboundReceiptToken as mintSignalRadarInboundReceiptTokenShared,
+} from '../security/receipt-admission-token';
 import { SignJWT, exportJWK, importJWK, jwtVerify, type JWK } from 'jose';
 import {
   directCompletedTerminalContract,
@@ -79,6 +86,24 @@ const PRODUCT_NOTIFICATION_DELIVERY_AUDIENCE =
   'deepline.product_notification.delivery' as const;
 const PRODUCT_NOTIFICATION_DELIVERY_PURPOSE =
   'product_notification_delivery' as const;
+const PLAY_WEBHOOK_RECEIPT_ADMISSION_AUDIENCE =
+  'deepline.play_webhook_receipt.admission' as const;
+const PLAY_WEBHOOK_RECEIPT_ADMISSION_PURPOSE =
+  'play_webhook_receipt_admission' as const;
+const PLAY_WEBHOOK_RECEIPT_BATCH_ADMISSION_AUDIENCE =
+  'deepline.play_webhook_receipt.batch_admission' as const;
+const PLAY_WEBHOOK_RECEIPT_BATCH_ADMISSION_PURPOSE =
+  'play_webhook_receipt_batch_admission' as const;
+const PLAY_WEBHOOK_RECEIPT_LARGE_BATCH_ADMISSION_PURPOSE =
+  'play_webhook_receipt_large_batch_admission' as const;
+const PLAY_TRIGGER_EVENT_ADMISSION_AUDIENCE =
+  'deepline.play_trigger_event.admission' as const;
+const PLAY_TRIGGER_EVENT_ADMISSION_PURPOSE =
+  'play_trigger_event_admission' as const;
+const SIGNAL_RADAR_INBOUND_RECEIPT_AUDIENCE =
+  'deepline.signal_radar_inbound_receipt.process' as const;
+const SIGNAL_RADAR_INBOUND_RECEIPT_PURPOSE =
+  'signal_radar_inbound_receipt_process' as const;
 const PRODUCT_NOTIFICATION_UNSUBSCRIBE_AUDIENCE =
   'deepline.product_notification.unsubscribe' as const;
 const PRODUCT_NOTIFICATION_UNSUBSCRIBE_PURPOSE =
@@ -146,6 +171,67 @@ export type ProductNotificationDeliveryTokenClaims = {
   v: typeof INTERNAL_BOOTSTRAP_TOKEN_VERSION;
 };
 
+/** Capability for exactly one Convex-owned webhook receipt admission. */
+export type PlayWebhookReceiptAdmissionTokenClaims = {
+  aud: typeof PLAY_WEBHOOK_RECEIPT_ADMISSION_AUDIENCE;
+  exp: number;
+  iat: number;
+  iss: typeof INTERNAL_BOOTSTRAP_TOKEN_ISSUER;
+  org_id: string;
+  purpose: typeof PLAY_WEBHOOK_RECEIPT_ADMISSION_PURPOSE;
+  receipt_id: string;
+  sub: 'play_webhook_receipt_dispatcher';
+  v: typeof INTERNAL_BOOTSTRAP_TOKEN_VERSION;
+};
+
+/** Capability for a bounded, single-workspace collection of receipt IDs. */
+type PlayWebhookReceiptBatchAdmissionTokenBaseClaims = {
+  aud: typeof PLAY_WEBHOOK_RECEIPT_BATCH_ADMISSION_AUDIENCE;
+  exp: number;
+  iat: number;
+  iss: typeof INTERNAL_BOOTSTRAP_TOKEN_ISSUER;
+  org_id: string;
+  v: typeof INTERNAL_BOOTSTRAP_TOKEN_VERSION;
+};
+
+export type PlayWebhookReceiptBatchAdmissionTokenClaims =
+  | (PlayWebhookReceiptBatchAdmissionTokenBaseClaims & {
+      purpose: typeof PLAY_WEBHOOK_RECEIPT_BATCH_ADMISSION_PURPOSE;
+      receipt_ids: string[];
+      sub: 'play_webhook_receipt_batch_dispatcher';
+    })
+  | (PlayWebhookReceiptBatchAdmissionTokenBaseClaims & {
+      purpose: typeof PLAY_WEBHOOK_RECEIPT_LARGE_BATCH_ADMISSION_PURPOSE;
+      receipt_ids_sha256: string;
+      sub: 'play_webhook_receipt_large_batch_dispatcher';
+    });
+
+/** Capability for exactly one Convex-owned cron trigger-event admission. */
+export type PlayTriggerEventAdmissionTokenClaims = {
+  aud: typeof PLAY_TRIGGER_EVENT_ADMISSION_AUDIENCE;
+  event_id: string;
+  exp: number;
+  iat: number;
+  iss: typeof INTERNAL_BOOTSTRAP_TOKEN_ISSUER;
+  org_id: string;
+  purpose: typeof PLAY_TRIGGER_EVENT_ADMISSION_PURPOSE;
+  sub: 'play_trigger_event_dispatcher';
+  v: typeof INTERNAL_BOOTSTRAP_TOKEN_VERSION;
+};
+
+/** Capability for one Convex-owned monitor inbound receipt processor call. */
+export type SignalRadarInboundReceiptTokenClaims = {
+  aud: typeof SIGNAL_RADAR_INBOUND_RECEIPT_AUDIENCE;
+  exp: number;
+  iat: number;
+  iss: typeof INTERNAL_BOOTSTRAP_TOKEN_ISSUER;
+  org_id: string;
+  purpose: typeof SIGNAL_RADAR_INBOUND_RECEIPT_PURPOSE;
+  receipt_id: string;
+  sub: 'signal_radar_inbound_receipt_dispatcher';
+  v: typeof INTERNAL_BOOTSTRAP_TOKEN_VERSION;
+};
+
 export type ProductNotificationUnsubscribeTokenClaims = {
   aud: typeof PRODUCT_NOTIFICATION_UNSUBSCRIBE_AUDIENCE;
   group_key: string;
@@ -1045,6 +1131,245 @@ export async function verifyProductNotificationDeliveryToken(
   return claims as ProductNotificationDeliveryTokenClaims;
 }
 
+export async function mintPlayWebhookReceiptAdmissionToken(input: {
+  orgId: string;
+  receiptId: string;
+  nowMs?: number;
+}): Promise<string> {
+  return await mintPlayWebhookReceiptAdmissionTokenShared(input);
+}
+
+export async function mintPlayWebhookReceiptBatchAdmissionToken(input: {
+  orgId: string;
+  receiptIds: readonly string[];
+  nowMs?: number;
+}): Promise<string> {
+  return await mintPlayWebhookReceiptBatchAdmissionTokenShared(input);
+}
+
+export async function mintPlayWebhookReceiptLargeBatchAdmissionToken(input: {
+  orgId: string;
+  receiptIds: readonly string[];
+  nowMs?: number;
+}): Promise<string> {
+  return await mintPlayWebhookReceiptLargeBatchAdmissionTokenShared(input);
+}
+
+export async function verifyPlayWebhookReceiptBatchAdmissionToken(
+  token: string,
+  nowMs = Date.now(),
+): Promise<PlayWebhookReceiptBatchAdmissionTokenClaims> {
+  const segments = token.split('.');
+  if (segments.length !== 3)
+    throw new Error('Invalid webhook receipt batch token.');
+  const [encodedHeader, encodedClaims, signature] = segments;
+  const header = decodeJson<Record<string, unknown>>(encodedHeader);
+  if (header.alg !== 'HS256' || header.typ !== 'JWT') {
+    throw new Error('Invalid webhook receipt batch token.');
+  }
+  const expectedSignature = await signTokenMaterial(
+    `${encodedHeader}.${encodedClaims}`,
+  );
+  if (
+    !timingSafeEqual(fromBase64Url(signature), fromBase64Url(expectedSignature))
+  ) {
+    throw new Error('Invalid webhook receipt batch token.');
+  }
+  const claims = decodeJson<Record<string, unknown>>(encodedClaims);
+  const hasInvalidBaseClaims =
+    claims.v !== INTERNAL_BOOTSTRAP_TOKEN_VERSION ||
+    claims.iss !== INTERNAL_BOOTSTRAP_TOKEN_ISSUER ||
+    claims.aud !== PLAY_WEBHOOK_RECEIPT_BATCH_ADMISSION_AUDIENCE ||
+    typeof claims.org_id !== 'string' ||
+    claims.org_id.length === 0 ||
+    typeof claims.iat !== 'number' ||
+    !Number.isFinite(claims.iat) ||
+    typeof claims.exp !== 'number' ||
+    !Number.isFinite(claims.exp);
+  const hasValidV1Claims =
+    claims.purpose === PLAY_WEBHOOK_RECEIPT_BATCH_ADMISSION_PURPOSE &&
+    claims.sub === 'play_webhook_receipt_batch_dispatcher' &&
+    Array.isArray(claims.receipt_ids) &&
+    claims.receipt_ids.length >= 1 &&
+    claims.receipt_ids.length <= 32 &&
+    !claims.receipt_ids.some(
+      (receiptId) => typeof receiptId !== 'string' || receiptId.length === 0,
+    ) &&
+    new Set(claims.receipt_ids).size === claims.receipt_ids.length;
+  const hasValidV2Claims =
+    claims.purpose === PLAY_WEBHOOK_RECEIPT_LARGE_BATCH_ADMISSION_PURPOSE &&
+    claims.sub === 'play_webhook_receipt_large_batch_dispatcher' &&
+    typeof claims.receipt_ids_sha256 === 'string' &&
+    /^[A-Za-z0-9_-]{43}$/.test(claims.receipt_ids_sha256);
+  if (
+    hasInvalidBaseClaims ||
+    (!hasValidV1Claims && !hasValidV2Claims)
+  ) {
+    throw new Error('Invalid webhook receipt batch token.');
+  }
+  // `hasInvalidBaseClaims` is deliberately a named diagnostic, but TypeScript
+  // cannot narrow `Record<string, unknown>` through that boolean. Reassert the
+  // already-validated temporal claim types before comparing them below.
+  const expiresAt = claims.exp;
+  const issuedAt = claims.iat;
+  if (typeof expiresAt !== 'number' || typeof issuedAt !== 'number') {
+    throw new Error('Invalid webhook receipt batch token.');
+  }
+  const nowSeconds = Math.floor(nowMs / 1000);
+  if (expiresAt <= nowSeconds || issuedAt > nowSeconds + 30) {
+    throw new Error('Webhook receipt batch token expired.');
+  }
+  return claims as PlayWebhookReceiptBatchAdmissionTokenClaims;
+}
+
+export async function verifyPlayWebhookReceiptAdmissionToken(
+  token: string,
+  nowMs = Date.now(),
+): Promise<PlayWebhookReceiptAdmissionTokenClaims> {
+  const segments = token.split('.');
+  if (segments.length !== 3) throw new Error('Invalid webhook receipt token.');
+  const [encodedHeader, encodedClaims, signature] = segments;
+  const header = decodeJson<Record<string, unknown>>(encodedHeader);
+  if (header.alg !== 'HS256' || header.typ !== 'JWT') {
+    throw new Error('Invalid webhook receipt token.');
+  }
+  const expectedSignature = await signTokenMaterial(
+    `${encodedHeader}.${encodedClaims}`,
+  );
+  if (
+    !timingSafeEqual(fromBase64Url(signature), fromBase64Url(expectedSignature))
+  ) {
+    throw new Error('Invalid webhook receipt token.');
+  }
+  const claims = decodeJson<Record<string, unknown>>(encodedClaims);
+  if (
+    claims.v !== INTERNAL_BOOTSTRAP_TOKEN_VERSION ||
+    claims.iss !== INTERNAL_BOOTSTRAP_TOKEN_ISSUER ||
+    claims.aud !== PLAY_WEBHOOK_RECEIPT_ADMISSION_AUDIENCE ||
+    claims.purpose !== PLAY_WEBHOOK_RECEIPT_ADMISSION_PURPOSE ||
+    claims.sub !== 'play_webhook_receipt_dispatcher' ||
+    typeof claims.org_id !== 'string' ||
+    claims.org_id.length === 0 ||
+    typeof claims.receipt_id !== 'string' ||
+    claims.receipt_id.length === 0 ||
+    typeof claims.iat !== 'number' ||
+    !Number.isFinite(claims.iat) ||
+    typeof claims.exp !== 'number' ||
+    !Number.isFinite(claims.exp)
+  ) {
+    throw new Error('Invalid webhook receipt token.');
+  }
+  const nowSeconds = Math.floor(nowMs / 1000);
+  if (claims.exp <= nowSeconds || claims.iat > nowSeconds + 30) {
+    throw new Error('Webhook receipt token expired.');
+  }
+  return claims as PlayWebhookReceiptAdmissionTokenClaims;
+}
+
+export async function mintPlayTriggerEventAdmissionToken(input: {
+  orgId: string;
+  eventId: string;
+  nowMs?: number;
+}): Promise<string> {
+  return await mintPlayTriggerEventAdmissionTokenShared(input);
+}
+
+export async function verifyPlayTriggerEventAdmissionToken(
+  token: string,
+  nowMs = Date.now(),
+): Promise<PlayTriggerEventAdmissionTokenClaims> {
+  const segments = token.split('.');
+  if (segments.length !== 3) throw new Error('Invalid trigger event token.');
+  const [encodedHeader, encodedClaims, signature] = segments;
+  const header = decodeJson<Record<string, unknown>>(encodedHeader);
+  if (header.alg !== 'HS256' || header.typ !== 'JWT') {
+    throw new Error('Invalid trigger event token.');
+  }
+  const expectedSignature = await signTokenMaterial(
+    `${encodedHeader}.${encodedClaims}`,
+  );
+  if (
+    !timingSafeEqual(fromBase64Url(signature), fromBase64Url(expectedSignature))
+  ) {
+    throw new Error('Invalid trigger event token.');
+  }
+  const claims = decodeJson<Record<string, unknown>>(encodedClaims);
+  if (
+    claims.v !== INTERNAL_BOOTSTRAP_TOKEN_VERSION ||
+    claims.iss !== INTERNAL_BOOTSTRAP_TOKEN_ISSUER ||
+    claims.aud !== PLAY_TRIGGER_EVENT_ADMISSION_AUDIENCE ||
+    claims.purpose !== PLAY_TRIGGER_EVENT_ADMISSION_PURPOSE ||
+    claims.sub !== 'play_trigger_event_dispatcher' ||
+    typeof claims.org_id !== 'string' ||
+    claims.org_id.length === 0 ||
+    typeof claims.event_id !== 'string' ||
+    claims.event_id.length === 0 ||
+    typeof claims.iat !== 'number' ||
+    !Number.isFinite(claims.iat) ||
+    typeof claims.exp !== 'number' ||
+    !Number.isFinite(claims.exp)
+  ) {
+    throw new Error('Invalid trigger event token.');
+  }
+  const nowSeconds = Math.floor(nowMs / 1000);
+  if (claims.exp <= nowSeconds || claims.iat > nowSeconds + 30) {
+    throw new Error('Trigger event token expired.');
+  }
+  return claims as PlayTriggerEventAdmissionTokenClaims;
+}
+
+export async function mintSignalRadarInboundReceiptToken(input: {
+  orgId: string;
+  receiptId: string;
+  nowMs?: number;
+}): Promise<string> {
+  return await mintSignalRadarInboundReceiptTokenShared(input);
+}
+
+export async function verifySignalRadarInboundReceiptToken(
+  token: string,
+  nowMs = Date.now(),
+): Promise<SignalRadarInboundReceiptTokenClaims> {
+  const segments = token.split('.');
+  if (segments.length !== 3) throw new Error('Invalid inbound receipt token.');
+  const [encodedHeader, encodedClaims, signature] = segments;
+  const header = decodeJson<Record<string, unknown>>(encodedHeader);
+  if (header.alg !== 'HS256' || header.typ !== 'JWT') {
+    throw new Error('Invalid inbound receipt token.');
+  }
+  const expectedSignature = await signTokenMaterial(
+    `${encodedHeader}.${encodedClaims}`,
+  );
+  if (
+    !timingSafeEqual(fromBase64Url(signature), fromBase64Url(expectedSignature))
+  ) {
+    throw new Error('Invalid inbound receipt token.');
+  }
+  const claims = decodeJson<Record<string, unknown>>(encodedClaims);
+  if (
+    claims.v !== INTERNAL_BOOTSTRAP_TOKEN_VERSION ||
+    claims.iss !== INTERNAL_BOOTSTRAP_TOKEN_ISSUER ||
+    claims.aud !== SIGNAL_RADAR_INBOUND_RECEIPT_AUDIENCE ||
+    claims.purpose !== SIGNAL_RADAR_INBOUND_RECEIPT_PURPOSE ||
+    claims.sub !== 'signal_radar_inbound_receipt_dispatcher' ||
+    typeof claims.org_id !== 'string' ||
+    claims.org_id.length === 0 ||
+    typeof claims.receipt_id !== 'string' ||
+    claims.receipt_id.length === 0 ||
+    typeof claims.iat !== 'number' ||
+    !Number.isFinite(claims.iat) ||
+    typeof claims.exp !== 'number' ||
+    !Number.isFinite(claims.exp)
+  ) {
+    throw new Error('Invalid inbound receipt token.');
+  }
+  const nowSeconds = Math.floor(nowMs / 1000);
+  if (claims.exp <= nowSeconds || claims.iat > nowSeconds + 30) {
+    throw new Error('Inbound receipt token expired.');
+  }
+  return claims as SignalRadarInboundReceiptTokenClaims;
+}
+
 /**
  * Mints a durable, narrowly scoped opt-out command. It never expires because
  * an old notification must remain usable to stop future email; rotating the