deepline 0.3.168 → 0.3.170

package/README.md

@@ -41,7 +41,7 @@ with project-local skills automatically.
 Paste this into Claude Code, Codex, or another coding agent:
 
 ```text
-Install the official Deepline CLI globally from npm (package: deepline) by following https://code.deepline.com/INSTALL.md.
+Install and set up the official Deepline CLI globally from npm (package: deepline) by following https://code.deepline.com/INSTALL.md.
 ```
 
 Once setup is complete, tell your agent what you want to do:

package/dist/bundling-sources/sdk/src/release.ts

@@ -200,7 +200,7 @@ export const SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: '0.3.168',
+  version: '0.3.170',
   updateSummary:
     'Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.',
   packageCapabilities: {

package/dist/bundling-sources/shared_libs/monitors/package.json

@@ -73,6 +73,8 @@
     "./provider-monitor-errors.js": "./provider-monitor-errors.ts",
     "./provider-monitor-identity-claims": "./provider-monitor-identity-claims.ts",
     "./provider-monitor-identity-claims.js": "./provider-monitor-identity-claims.ts",
+    "./provider-monitor-conflicts": "./provider-monitor-conflicts.ts",
+    "./provider-monitor-conflicts.js": "./provider-monitor-conflicts.ts",
     "./provider-monitor-legacy-aliases": "./provider-monitor-legacy-aliases.ts",
     "./provider-monitor-legacy-aliases.js": "./provider-monitor-legacy-aliases.ts",
     "./provider-monitor-priority-execution": "./provider-monitor-priority-execution.ts",

package/dist/bundling-sources/shared_libs/monitors/provider-monitor-capability.ts

@@ -197,10 +197,17 @@ export type ProviderMonitorCapabilityDefinition = {
    */
   upstreamCollision?: {
     identityKeyFields: readonly string[];
+    /**
+     * Different effective payload configurations may hold separate Deepline
+     * claims inside one provider identity scope. This does not override an
+     * upstream 409 if the provider itself enforces a broader uniqueness rule.
+     */
+    allowDistinctConfigurations?: boolean;
     /**
      * This provider can create an updated resource for the same Deepline
      * monitor key before the prior upstream resource is deprovisioned. This
-     * never permits a second key to occupy the same identity in one org.
+     * never permits a second key to occupy the same exact configuration in
+     * one org.
      */
     supportsSameIdentityReplacement?: boolean;
   };
@@ -444,7 +451,7 @@ export function defineProviderMonitorCapability(input: {
       },
       identity: {
         semantics: input.upstreamCollision
-          ? `One monitor identity uses ${input.upstreamCollision.identityKeyFields.join(', ')}.`
+          ? `The provider resource scope uses ${input.upstreamCollision.identityKeyFields.join(', ')}.${input.upstreamCollision.allowDistinctConfigurations ? ' Different effective payload configurations in that scope may be separate monitor resources; exact duplicates still conflict.' : ''}`
           : 'This monitor uses the provider capability identity declared by Deepline.',
         update:
           'Use monitors update for a patch or deploy for a complete desired definition.',

package/dist/bundling-sources/shared_libs/monitors/provider-monitor-conflicts.ts

@@ -0,0 +1,85 @@
+import {
+  providerMonitorUpstreamIdentityClaimKey,
+  providerMonitorUpstreamIdentitySignature,
+} from './provider-monitor-upstream-identity';
+
+export type ProviderMonitorConflictIdentity = {
+  tool: string;
+  /** Exact effective configuration key stored in providerMonitorIdentityClaims. */
+  identityKey: string;
+  /** Broad provider-declared scope; this is also the legacy claim key. */
+  scopeKey: string;
+  /** Safe, customer-facing description of the provider-declared scope. */
+  identity: Record<string, string | null>;
+};
+
+/**
+ * Builds the one canonical conflict identity used by scalar Monitors, Fleets,
+ * and Batches. Same scope + same configuration conflicts; same scope with a
+ * distinct supported configuration gets its own indexed claim.
+ */
+export function providerMonitorConflictIdentity(input: {
+  tool: string;
+  payload: Record<string, unknown> | null | undefined;
+}): ProviderMonitorConflictIdentity | null {
+  const signature = providerMonitorUpstreamIdentitySignature(
+    input.tool,
+    input.payload,
+  );
+  if (!signature) return null;
+  const identity = Object.fromEntries(
+    Object.entries(signature.key).sort(([left], [right]) =>
+      left.localeCompare(right),
+    ),
+  );
+  const scopeKey = JSON.stringify(identity);
+  return {
+    tool: signature.tool,
+    identityKey:
+      providerMonitorUpstreamIdentityClaimKey(input.tool, input.payload) ??
+      scopeKey,
+    scopeKey,
+    identity,
+  };
+}
+
+/** Exact same effective configuration, regardless of monitor key or owner. */
+export function sameProviderMonitorConflictIdentity(
+  left: ProviderMonitorConflictIdentity | null | undefined,
+  right: ProviderMonitorConflictIdentity | null | undefined,
+) {
+  return Boolean(
+    left &&
+    right &&
+    left.tool === right.tool &&
+    left.identityKey === right.identityKey,
+  );
+}
+
+/** Same provider resource scope, even when filter/configuration differs. */
+export function sameProviderMonitorConflictScope(
+  left: ProviderMonitorConflictIdentity | null | undefined,
+  right: ProviderMonitorConflictIdentity | null | undefined,
+) {
+  return Boolean(
+    left &&
+    right &&
+    left.tool === right.tool &&
+    left.scopeKey === right.scopeKey,
+  );
+}
+
+/**
+ * Whether the definitions are valid separate variants under the capability's
+ * declared policy. Providers can still reject the second create; their 409 is
+ * handled as an upstream conflict, not mistaken for a Deepline duplicate.
+ */
+export function providerMonitorDefinitionsAreDistinctConfigurations(
+  left: ProviderMonitorConflictIdentity | null | undefined,
+  right: ProviderMonitorConflictIdentity | null | undefined,
+) {
+  return Boolean(
+    sameProviderMonitorConflictScope(left, right) &&
+    !sameProviderMonitorConflictIdentity(left, right),
+  );
+}

package/dist/bundling-sources/shared_libs/monitors/provider-monitor-identity-claims.ts

@@ -10,14 +10,14 @@ import {
 import { MAX_PRIORITY_MONITORS_PER_ORG } from '@deepline/monitors/provider-monitor-priority-execution';
 import { internal } from '@deepline/convex-client/function-references';
 import { getRequiredInternalConvexClient } from '@deepline/convex-client/internal-client';
-import {
-  providerMonitorUpstreamIdentitySignature,
-  type ProviderMonitorUpstreamIdentitySignature,
-} from '@deepline/monitors/provider-monitor-upstream-identity';
+import { providerMonitorConflictIdentity } from '@deepline/monitors/provider-monitor-conflicts';
 
 export type ProviderMonitorIdentityClaim = {
   tool: string;
+  /** Exact effective configuration identity, used by the indexed claim. */
   identityKey: string;
+  /** Provider-declared broad identity scope; legacy claims used this key. */
+  scopeKey: string;
   identity: Record<string, string | null>;
 };
 
@@ -31,13 +31,19 @@ type OrgAuthContext = { orgId: string };
  */
 export type ProviderMonitorIdentityClaimReference = Pick<
   ProviderMonitorIdentityClaim,
-  'tool' | 'identityKey'
+  'tool' | 'identityKey' | 'scopeKey'
 >;
 
 export function providerMonitorIdentityClaimReference(
   claim: ProviderMonitorIdentityClaim | null | undefined,
 ): ProviderMonitorIdentityClaimReference | null {
-  return claim ? { tool: claim.tool, identityKey: claim.identityKey } : null;
+  return claim
+    ? {
+        tool: claim.tool,
+        identityKey: claim.identityKey,
+        scopeKey: claim.scopeKey,
+      }
+    : null;
 }
 
 export type ProviderMonitorIdentityReservation =
@@ -146,19 +152,6 @@ export function normalizeProviderMonitorLifecycleReservation(input: {
   };
 }
 
-function claimFromSignature(
-  signature: ProviderMonitorUpstreamIdentitySignature,
-): ProviderMonitorIdentityClaim {
-  const identity = Object.fromEntries(
-    Object.entries(signature.key).sort(([a], [b]) => a.localeCompare(b)),
-  );
-  return {
-    tool: signature.tool,
-    identityKey: JSON.stringify(identity),
-    identity,
-  };
-}
-
 export function providerMonitorIdentityClaim(input: {
   tool: string;
   payload: Record<string, unknown> | null | undefined;
@@ -166,11 +159,7 @@ export function providerMonitorIdentityClaim(input: {
   // Claims protect provider resources, including legacy rows whose public
   // capability id was later retired. The Convex-safe identity contract owns
   // those aliases; the live capability registry intentionally does not.
-  const signature = providerMonitorUpstreamIdentitySignature(
-    input.tool,
-    input.payload,
-  );
-  return signature ? claimFromSignature(signature) : null;
+  return providerMonitorConflictIdentity(input);
 }
 
 /**
@@ -230,6 +219,7 @@ export async function getProviderMonitorIdentityOwner(input: {
       orgId: input.auth.orgId,
       tool: input.claim.tool,
       identityKey: input.claim.identityKey,
+      scopeKey: input.claim.scopeKey,
     },
   );
 }
@@ -455,6 +445,7 @@ export async function beginProviderMonitorIdentityReservation(input: {
       orgId: input.auth.orgId,
       tool: claim.tool,
       identityKey: claim.identityKey,
+      scopeKey: claim.scopeKey,
       monitorKey: input.monitorKey,
       operationId,
       ...(input.reclaimSelfProvisioning
@@ -491,6 +482,7 @@ async function mutateClaim(
       orgId: input.auth.orgId,
       tool: input.claim.tool,
       identityKey: input.claim.identityKey,
+      ...(action === 'release' ? { scopeKey: input.claim.scopeKey } : {}),
       monitorKey: input.monitorKey,
       ...(input.operationId ? { operationId: input.operationId } : {}),
     },

package/dist/bundling-sources/shared_libs/monitors/provider-monitor-upstream-identity.ts

@@ -22,20 +22,34 @@ type ProviderMonitorUpstreamIdentityField = {
   runtimePayloadAliases?: readonly string[];
 };
 
+type ProviderMonitorUpstreamIdentityDefinition = {
+  fields: readonly ProviderMonitorUpstreamIdentityField[];
+  /**
+   * Let distinct effective configurations reserve separate provider monitor
+   * claims inside one broad identity scope. The upstream provider can still
+   * reject a second resource with 409; this only prevents Deepline from
+   * treating different authored filters as an exact duplicate.
+   */
+  allowDistinctConfigurations?: boolean;
+};
+
 const PROVIDER_MONITOR_UPSTREAM_IDENTITY_FIELDS = {
-  'deepline_native.company_radar': [{ name: 'radar_type' }, { name: 'domain' }],
-  'deepline_native.contact_radar': [
-    { name: 'radar_type' },
-    { name: 'profile_url' },
-  ],
-  'deepline_native.industry_radar': [
-    { name: 'radar_type' },
-    { name: 'industry', runtimePayloadAliases: ['keyword'] },
-  ],
-} as const satisfies Record<
-  string,
-  readonly ProviderMonitorUpstreamIdentityField[]
->;
+  'deepline_native.company_radar': {
+    fields: [{ name: 'radar_type' }, { name: 'domain' }],
+    allowDistinctConfigurations: true,
+  },
+  'deepline_native.contact_radar': {
+    fields: [{ name: 'radar_type' }, { name: 'profile_url' }],
+    allowDistinctConfigurations: true,
+  },
+  'deepline_native.industry_radar': {
+    fields: [
+      { name: 'radar_type' },
+      { name: 'industry', runtimePayloadAliases: ['keyword'] },
+    ],
+    allowDistinctConfigurations: true,
+  },
+} as const satisfies Record<string, ProviderMonitorUpstreamIdentityDefinition>;
 
 function canonicalMonitorTool(tool: string) {
   // Public TamRadar ids existed before the deepline_native hard cutover. Keep
@@ -82,7 +96,18 @@ export function providerMonitorUpstreamIdentityFields(tool: string) {
   const canonical = canonicalMonitorTool(tool);
   return PROVIDER_MONITOR_UPSTREAM_IDENTITY_FIELDS[
     canonical as keyof typeof PROVIDER_MONITOR_UPSTREAM_IDENTITY_FIELDS
-  ]?.map((field) => field.name);
+  ]?.fields.map((field) => field.name);
+}
+
+export function providerMonitorUpstreamIdentityAllowsDistinctConfigurations(
+  tool: string,
+) {
+  const canonical = canonicalMonitorTool(tool);
+  return (
+    PROVIDER_MONITOR_UPSTREAM_IDENTITY_FIELDS[
+      canonical as keyof typeof PROVIDER_MONITOR_UPSTREAM_IDENTITY_FIELDS
+    ]?.allowDistinctConfigurations ?? false
+  );
 }
 
 export function providerMonitorUpstreamIdentitySignature(
@@ -93,7 +118,7 @@ export function providerMonitorUpstreamIdentitySignature(
   const fields =
     PROVIDER_MONITOR_UPSTREAM_IDENTITY_FIELDS[
       canonical as keyof typeof PROVIDER_MONITOR_UPSTREAM_IDENTITY_FIELDS
-    ];
+    ]?.fields;
   if (!fields?.length) return null;
   const key: Record<string, ProviderMonitorUpstreamIdentityValue> = {};
   for (const field of fields) {
@@ -110,3 +135,42 @@ export function providerMonitorUpstreamIdentitySignature(
   }
   return { tool: canonical, key };
 }
+
+/**
+ * Exact claim identity used by the Convex conflict index. The provider's
+ * declared scope remains visible in `scopeKey`; providers that allow
+ * configuration variants add every non-scope payload field to the claim key.
+ * Keeping the old scope JSON as the prefix lets readers recognize claims
+ * created before this distinction was introduced.
+ */
+export function providerMonitorUpstreamIdentityClaimKey(
+  tool: string,
+  payload: Record<string, unknown> | null | undefined,
+) {
+  const signature = providerMonitorUpstreamIdentitySignature(tool, payload);
+  if (!signature) return null;
+  const scopeKey = stableJson(signature.key);
+  if (!providerMonitorUpstreamIdentityAllowsDistinctConfigurations(tool)) {
+    return scopeKey;
+  }
+
+  const definition =
+    PROVIDER_MONITOR_UPSTREAM_IDENTITY_FIELDS[
+      signature.tool as keyof typeof PROVIDER_MONITOR_UPSTREAM_IDENTITY_FIELDS
+    ];
+  const scopeAndAliases = new Set<string>(
+    definition.fields.flatMap((field) => [
+      field.name,
+      ...('runtimePayloadAliases' in field
+        ? (field.runtimePayloadAliases ?? [])
+        : []),
+    ]),
+  );
+  const configuration = Object.fromEntries(
+    Object.entries(payload ?? {}).filter(
+      ([field]) => !scopeAndAliases.has(field),
+    ),
+  );
+  if (Object.keys(configuration).length === 0) return scopeKey;
+  return `${scopeKey}#configuration=${stableJson(configuration)}`;
+}

package/dist/bundling-sources/shared_libs/observability/dlq.ts

@@ -389,7 +389,12 @@ export type QueueItemEvidence = {
 };
 
 export type QueueItemUnavailable = {
-  readonly code: 'item_reader_unavailable' | 'state_filter_unavailable';
+  readonly code:
+    | 'item_reader_unavailable'
+    | 'state_filter_unavailable'
+    | 'scope_required'
+    | 'scope_unsupported'
+    | 'cursor_invalid';
   readonly reason: string;
 };
 
@@ -524,6 +529,8 @@ export type QueueItemConnectorContext = {
   readonly limit: number;
   readonly cursor?: string;
   readonly state?: QueueItemState;
+  /** Explicit tenant scope for owner sources stored in a Customer DB. */
+  readonly orgId?: string;
   readonly actorId?: string;
   readonly operationId?: string;
 };
@@ -538,6 +545,10 @@ export type QueueItemConnector = {
   readonly id: string;
   readonly queueId: string;
   readonly source: string;
+  /** Stable reason surfaced when this registration is an unavailable shell. */
+  readonly unavailableReason?: string;
+  /** True only when the owner explicitly declares that no item reader exists. */
+  readonly explicitlyUnavailable?: boolean;
   readonly mapNativeState: (nativeState: string) => QueueItemState;
   readonly list: (context: QueueItemConnectorContext) => Promise<QueueItemList>;
   /** Optional source-indexed failure-window listing for safe, bounded
@@ -1035,7 +1046,64 @@ const DLQ_PATH_METADATA: Readonly<Record<string, DlqPathMetadata>> = {
         enabled: false,
         requiresApproval: true,
         reason:
-          'Recovery must prove upstream ownership, current monitor binding, and idempotent re-enqueue; no generic replay is allowed.',
+          'This legacy ID is the provider-monitor source-routing DLQ. Recovery must prove upstream ownership, current monitor binding, and idempotent re-enqueue; no generic replay is allowed.',
+      },
+    ],
+  },
+  'signal-radar-inbound-receipts': {
+    lookupIndex: {
+      table: 'signalRadarInboundReceipts',
+      index: 'by_state_created_at',
+      key: 'state + createdAt',
+      bounded: true,
+    },
+    transitions: [
+      {
+        action: 'retry',
+        fromStates: ['dead_lettered'],
+        toState: 'pending',
+        enabled: false,
+        requiresApproval: true,
+        reason:
+          'The receipt owner does not expose a fenced transition from dead_lettered; scheduled recovery owns pending retries.',
+      },
+    ],
+  },
+  'signal-radar-inbound-legacy-dlq': {
+    lookupIndex: {
+      table: 'dl_meta.signal_radar_inbound_dead_letter',
+      index: 'idx_dl_meta_sr_dead_letter_status',
+      key: 'status + created_at (one organization only)',
+      bounded: true,
+    },
+    transitions: [
+      {
+        action: 'replay',
+        fromStates: ['open'],
+        toState: 'replayed',
+        enabled: false,
+        requiresApproval: true,
+        reason:
+          'The legacy replay owner does not verify current charge authorization or expose the shared revision and idempotency contract; inspect with --org, but do not replay through the generic queue action.',
+      },
+    ],
+  },
+  'signal-radar-inbound-typed-write-failures': {
+    lookupIndex: {
+      table: 'dl_meta.monitor_inbound_raw',
+      index: 'idx_dl_meta_monitor_inbound_raw_status_received',
+      key: 'status + received_at (one organization only)',
+      bounded: true,
+    },
+    transitions: [
+      {
+        action: 'retry',
+        fromStates: ['write_failed'],
+        toState: 'written',
+        enabled: false,
+        requiresApproval: true,
+        reason:
+          'Raw failure rows are immutable delivery evidence. Provider redelivery and the receipt owner control retries; no per-item operator retry exists.',
       },
     ],
   },

package/dist/bundling-sources/shared_libs/observability/queue-health.ts

@@ -201,10 +201,46 @@ export const OPERATIONS_QUEUE_CATALOG = [
   ),
   queue(
     'signal-radar-inbound-dlq',
-    'Signal-radar inbound / DLQ',
+    'Signal-radar reconciliation source-routing DLQ',
     'provider_queue',
     'monitors',
-    'Persist inbound provider events and isolate poison events',
+    'Preserved legacy ID for provider-monitor source-routing failures; this is not the inbound delivery queue',
+    300_000,
+    900_000,
+  ),
+  queue(
+    'signal-radar-inbound-receipts',
+    'Signal-radar inbound receipts',
+    'leased_workset',
+    'monitors',
+    'Process the global Convex inbox of authenticated provider callbacks',
+    300_000,
+    900_000,
+  ),
+  queue(
+    'signal-radar-inbound-legacy-dlq',
+    'Signal-radar legacy inbound dead-letters',
+    'provider_queue',
+    'monitors',
+    'Tenant-scoped legacy poison-callback records; counts can overlap raw write failures',
+    300_000,
+    900_000,
+  ),
+  queue(
+    'signal-radar-inbound-typed-write-failures',
+    'Signal-radar typed-write failures',
+    'provider_queue',
+    'monitors',
+    'Tenant-scoped raw callback receipts whose typed write failed; records can overlap legacy dead-letters',
+    300_000,
+    900_000,
+  ),
+  queue(
+    'signal-radar-inbound-legacy-vercel-drain',
+    'Signal-radar legacy Vercel Queue drain',
+    'provider_queue',
+    'monitors',
+    'Deprecated drain-only Vercel Queue implementation with no owner item reader',
     300_000,
     900_000,
   ),

package/dist/bundling-sources/shared_libs/observability/queue-item-connectors.ts

@@ -17,6 +17,7 @@ export type QueueConnectorBackend =
   | 'convex'
   | 'workpool'
   | 'postgres-outbox'
+  | 'customer-db'
   | 'absurd'
   | 'provider';
 
@@ -99,7 +100,9 @@ export class QueueItemConnectorRegistry {
   /** True only after the owner has replaced the safe unavailable placeholder. */
   hasOwnerConnector(queueId: string): boolean {
     const registration = this.registrations.get(queueId);
-    return registration !== undefined && !isUnavailableRegistration(registration);
+    return (
+      registration !== undefined && !isUnavailableRegistration(registration)
+    );
   }
 
   list(): readonly QueueItemConnectorRegistration[] {
@@ -127,11 +130,16 @@ const unavailableReason = (options: UnavailableConnectorOptions): string =>
 export function createUnavailableQueueItemConnector(
   options: UnavailableConnectorOptions,
 ): QueueItemConnectorRegistration {
+  if (options.reason !== undefined && options.reason.trim().length === 0) {
+    throw new Error('An explicit unavailable queue connector needs a reason.');
+  }
   const reason = unavailableReason(options);
   const connector: QueueItemConnector = {
     id: options.id ?? `${options.backend}-${options.queueId}-unavailable`,
     queueId: options.queueId,
     source: options.source,
+    unavailableReason: reason,
+    ...(options.reason === undefined ? {} : { explicitlyUnavailable: true }),
     mapNativeState: (nativeState: string): QueueItemState =>
       normalizeQueueItemState(nativeState),
     async list(context: QueueItemConnectorContext): Promise<QueueItemList> {
@@ -221,6 +229,16 @@ export function createPostgresOutboxQueueItemConnector(
   });
 }
 
+export function createCustomerDbQueueItemConnector(
+  options: BackendConnectorOptions,
+): QueueItemConnectorRegistration {
+  return createUnavailableQueueItemConnector({
+    ...options,
+    backend: 'customer-db',
+    source: options.source ?? 'customer-db',
+  });
+}
+
 export function createAbsurdQueueItemConnector(
   options: BackendConnectorOptions,
 ): QueueItemConnectorRegistration {
@@ -257,7 +275,11 @@ export const QUEUE_CONNECTOR_BACKENDS: Readonly<
   'monitor-deployment-jobs': 'workpool',
   'monitor-batch-operations': 'workpool',
   'provider-monitor-reconciliation': 'provider',
-  'signal-radar-inbound-dlq': 'provider',
+  'signal-radar-inbound-dlq': 'convex',
+  'signal-radar-inbound-receipts': 'convex',
+  'signal-radar-inbound-legacy-dlq': 'customer-db',
+  'signal-radar-inbound-typed-write-failures': 'customer-db',
+  'signal-radar-inbound-legacy-vercel-drain': 'provider',
   'charge-reconciliation-backlog': 'postgres-outbox',
   'workspace-fast-settlement': 'convex',
   'metronome-usage-delivery': 'postgres-outbox',
@@ -283,6 +305,8 @@ function defaultRegistration(
   if (backend === 'workpool') return createWorkpoolQueueItemConnector(options);
   if (backend === 'postgres-outbox')
     return createPostgresOutboxQueueItemConnector(options);
+  if (backend === 'customer-db')
+    return createCustomerDbQueueItemConnector(options);
   if (backend === 'absurd') return createAbsurdQueueItemConnector(options);
   return createProviderQueueItemConnector(options);
 }

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/absurd-play-deploy-task.ts

@@ -149,7 +149,11 @@ export type PlayDeployTaskParams = {
   playProjectId: string;
   deployToken: string;
   appBaseUrl: string;
-  /** Pinned by the first enqueue. Missing means the original Fly executor. */
+  /**
+   * Always `vercel` for new tasks, which is the only executor. `fly` and a
+   * missing value survive only in tasks queued before the Fly build path was
+   * removed; the dispatcher builds those on Vercel too.
+   */
   buildBackend?: 'fly' | 'vercel';
 };
 

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/postgres.ts

@@ -15317,9 +15317,15 @@ function runLedgerPrecedesSql(
   successor: string,
   inclusive = false,
 ): string {
-  const position = (alias: string) =>
-    `(CASE ${alias}.event_type WHEN 'run.created' THEN 0 WHEN 'run.started' THEN 1 ELSE 2 END, ${alias}.created_at, ${alias}.event_id)`;
-  return `${position(predecessor)} ${inclusive ? '<=' : '<'} ${position(successor)}`;
+  return `${runLedgerPositionSql(predecessor)} ${inclusive ? '<=' : '<'} ${runLedgerPositionSql(successor)}`;
+}
+
+function runLedgerPositionSql(alias: string): string {
+  return `(${runLedgerOrderSql(alias)})`;
+}
+
+function runLedgerOrderSql(alias: string): string {
+  return `CASE ${alias}.event_type WHEN 'run.created' THEN 0 WHEN 'run.started' THEN 1 ELSE 2 END, ${alias}.created_at, ${alias}.event_id`;
 }
 
 /**
@@ -16527,17 +16533,24 @@ export async function dispatchRunLedgerOutboxToLedgerBatchOnceWithClientScope(
     try {
       const selected = await client.query<{ run_id: string }>(
         `
+        WITH heads AS MATERIALIZED (
+          SELECT DISTINCT ON (pending.run_id)
+            pending.run_id,
+            pending.event_id,
+            pending.event_type,
+            pending.created_at,
+            pending.next_attempt_at,
+            pending.failed_at
+          FROM ${tableName('outbox', options)} AS pending
+          WHERE pending.delivered_at IS NULL
+            AND ($1::text IS NULL OR pending.run_id = $1)
+          ORDER BY pending.run_id, ${runLedgerOrderSql('pending')}
+        )
         SELECT runs.run_id
-        FROM ${tableName('outbox', options)} AS head
+        FROM heads AS head
         JOIN ${tableName('runs', options)} AS runs ON runs.run_id = head.run_id
-        WHERE ($1::text IS NULL OR runs.run_id = $1)
-          AND head.delivered_at IS NULL AND head.failed_at IS NULL
+        WHERE head.failed_at IS NULL
           AND coalesce(head.next_attempt_at, head.created_at) <= now()
-          AND NOT EXISTS (
-            SELECT 1 FROM ${tableName('outbox', options)} AS predecessor
-            WHERE predecessor.run_id = head.run_id AND predecessor.delivered_at IS NULL
-              AND ${runLedgerPrecedesSql('predecessor', 'head')}
-          )
           AND NOT EXISTS (
             SELECT 1 FROM ${tableName('outbox', options)} AS active
             WHERE active.run_id = runs.run_id AND active.delivered_at IS NULL

package/dist/bundling-sources/shared_libs/security/secret-redaction.ts

@@ -185,6 +185,101 @@ const EXPLICIT_SECRET_VALUE_PATTERNS = [
   /\bhttps?:\/\/[^/\s'"]+:[^@\s'"]+@[^/\s'"]+/i,
 ];
 
+const EMAIL_LOCAL_CHAR_RE = /[A-Za-z0-9.!#$%&'*+/=?^_`{|}~-]/;
+const EMAIL_DOMAIN_RE =
+  /^[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?\.[A-Za-z]{2,63}\b/;
+
+function isEmailLocalPart(value: string, start: number, end: number): boolean {
+  let localStart = start;
+  while (localStart > 0 && EMAIL_LOCAL_CHAR_RE.test(value[localStart - 1]!)) {
+    localStart -= 1;
+  }
+  let localEnd = end;
+  while (
+    localEnd < value.length &&
+    EMAIL_LOCAL_CHAR_RE.test(value[localEnd]!)
+  ) {
+    localEnd += 1;
+  }
+  return (
+    localStart < localEnd &&
+    localEnd - localStart <= 64 &&
+    value[localEnd] === '@' &&
+    EMAIL_DOMAIN_RE.test(value.slice(localEnd + 1))
+  );
+}
+
+function isPublicEmailIdentifier(
+  value: string,
+  start: number,
+  end: number,
+  patternIndex: number,
+  options: SecretRedactionOptions,
+): boolean {
+  // Only self-identifying token prefixes can also be valid email local parts.
+  // Keep strict telemetry redaction and URL credential detection unchanged.
+  return (
+    options.redactHighEntropy === false &&
+    patternIndex < 6 &&
+    isEmailLocalPart(value, start, end)
+  );
+}
+
+function hasExplicitSecretValue(
+  value: string,
+  options: SecretRedactionOptions,
+): boolean {
+  return EXPLICIT_SECRET_VALUE_PATTERNS.some((pattern, patternIndex) => {
+    if (!pattern.test(value)) return false;
+    if (options.redactHighEntropy !== false || patternIndex >= 6) return true;
+    const globalPattern = new RegExp(pattern.source, `${pattern.flags}g`);
+    for (const match of value.matchAll(globalPattern)) {
+      if (
+        !isPublicEmailIdentifier(
+          value,
+          match.index,
+          match.index + match[0].length,
+          patternIndex,
+          options,
+        )
+      ) {
+        return true;
+      }
+    }
+    return false;
+  });
+}
+
+function redactExplicitSecretsInText(
+  value: string,
+  options: SecretRedactionOptions,
+): string {
+  let redacted = value;
+  for (const [
+    patternIndex,
+    pattern,
+  ] of EXPLICIT_SECRET_VALUE_PATTERNS.entries()) {
+    const globalPattern = new RegExp(pattern.source, `${pattern.flags}g`);
+    let next = '';
+    let end = 0;
+    for (const match of redacted.matchAll(globalPattern)) {
+      next += redacted.slice(end, match.index);
+      next += isPublicEmailIdentifier(
+        redacted,
+        match.index,
+        match.index + match[0].length,
+        patternIndex,
+        options,
+      )
+        ? match[0]
+        : REDACTED_VALUE;
+      end = match.index + match[0].length;
+    }
+    redacted = next + redacted.slice(end);
+  }
+  return redacted;
+}
+
 const HIGH_ENTROPY_VALUE_PATTERN = /\b[A-Za-z0-9+/=_-]{32,}\b/g;
 // A public hostname can legitimately contain a generated label longer than the
 // high-entropy threshold (for example, a per-run probe hostname). Preserve the
@@ -275,7 +370,7 @@ function isPublicResultSafeTokenKey(
 }
 
 function maybeRedactString(value: string, options: SecretRedactionOptions) {
-  if (EXPLICIT_SECRET_VALUE_PATTERNS.some((pattern) => pattern.test(value))) {
+  if (hasExplicitSecretValue(value, options)) {
     return REDACTED_VALUE;
   }
   const publicHttpUrl = inspectStandalonePublicHttpUrl(value);
@@ -304,7 +399,7 @@ export function redactSecretsInValue<T>(
   options: SecretRedactionOptions = {},
 ): T {
   if (typeof value === 'string') {
-    if (EXPLICIT_SECRET_VALUE_PATTERNS.some((pattern) => pattern.test(value))) {
+    if (hasExplicitSecretValue(value, options)) {
       return REDACTED_VALUE as T;
     }
     if (isPublicResultTransferUrl(value, parentKey, options)) return value as T;
@@ -348,7 +443,7 @@ export function redactSecretsInValue<T>(
     itemParentKey: string | undefined,
   ): unknown => {
     if (typeof item !== 'string') return item;
-    if (EXPLICIT_SECRET_VALUE_PATTERNS.some((pattern) => pattern.test(item))) {
+    if (hasExplicitSecretValue(item, options)) {
       return REDACTED_VALUE;
     }
     if (isPublicResultTransferUrl(item, itemParentKey, options)) return item;
@@ -444,11 +539,10 @@ export function redactSecretsInJsonText(
       2,
     );
   } catch {
-    let redacted = text;
-    for (const pattern of EXPLICIT_SECRET_VALUE_PATTERNS) {
-      redacted = redacted.replace(pattern, REDACTED_VALUE);
-    }
-    return maybeRedactString(redacted, options);
+    return maybeRedactString(
+      redactExplicitSecretsInText(text, options),
+      options,
+    );
   }
 }
 

package/dist/cli/index.js

@@ -3051,7 +3051,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.168",
+  version: "0.3.170",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/cli/index.mjs

@@ -3046,7 +3046,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.168",
+  version: "0.3.170",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/index.js

@@ -864,7 +864,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.168",
+  version: "0.3.170",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/index.mjs

@@ -768,7 +768,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.168",
+  version: "0.3.170",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/install-integrity.json

@@ -64,6 +64,7 @@
     "dist/bundling-sources/shared_libs/monitors/provider-callback-verification.ts",
     "dist/bundling-sources/shared_libs/monitors/provider-monitor-batch-operation.ts",
     "dist/bundling-sources/shared_libs/monitors/provider-monitor-capability.ts",
+    "dist/bundling-sources/shared_libs/monitors/provider-monitor-conflicts.ts",
     "dist/bundling-sources/shared_libs/monitors/provider-monitor-consumer-health.ts",
     "dist/bundling-sources/shared_libs/monitors/provider-monitor-control-plane-capability.ts",
     "dist/bundling-sources/shared_libs/monitors/provider-monitor-errors.ts",

package/dist/release.d.mts

@@ -149,7 +149,7 @@ type SdkRelease = {
     supportPolicy: SdkSupportPolicy;
 };
 declare const SDK_RELEASE: {
-    readonly version: "0.3.168";
+    readonly version: "0.3.170";
     readonly updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.";
     readonly packageCapabilities: {
         readonly updatePreferences: 1;

package/dist/release.d.ts

@@ -149,7 +149,7 @@ type SdkRelease = {
     supportPolicy: SdkSupportPolicy;
 };
 declare const SDK_RELEASE: {
-    readonly version: "0.3.168";
+    readonly version: "0.3.170";
     readonly updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.";
     readonly packageCapabilities: {
         readonly updatePreferences: 1;

package/dist/release.js

@@ -74,7 +74,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.168",
+  version: "0.3.170",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/release.mjs

@@ -48,7 +48,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.168",
+  version: "0.3.170",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.3.168",
+  "version": "0.3.170",
   "description": "GTM data CLI and TypeScript SDK for coding agents",
   "license": "MIT",
   "homepage": "https://code.deepline.com",