deepline 0.3.169 → 0.3.170

package/dist/bundling-sources/sdk/src/release.ts

@@ -200,7 +200,7 @@ export const SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: '0.3.169',
+  version: '0.3.170',
   updateSummary:
     'Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.',
   packageCapabilities: {

package/dist/bundling-sources/shared_libs/observability/dlq.ts

@@ -389,7 +389,12 @@ export type QueueItemEvidence = {
 };
 
 export type QueueItemUnavailable = {
-  readonly code: 'item_reader_unavailable' | 'state_filter_unavailable';
+  readonly code:
+    | 'item_reader_unavailable'
+    | 'state_filter_unavailable'
+    | 'scope_required'
+    | 'scope_unsupported'
+    | 'cursor_invalid';
   readonly reason: string;
 };
 
@@ -524,6 +529,8 @@ export type QueueItemConnectorContext = {
   readonly limit: number;
   readonly cursor?: string;
   readonly state?: QueueItemState;
+  /** Explicit tenant scope for owner sources stored in a Customer DB. */
+  readonly orgId?: string;
   readonly actorId?: string;
   readonly operationId?: string;
 };
@@ -538,6 +545,10 @@ export type QueueItemConnector = {
   readonly id: string;
   readonly queueId: string;
   readonly source: string;
+  /** Stable reason surfaced when this registration is an unavailable shell. */
+  readonly unavailableReason?: string;
+  /** True only when the owner explicitly declares that no item reader exists. */
+  readonly explicitlyUnavailable?: boolean;
   readonly mapNativeState: (nativeState: string) => QueueItemState;
   readonly list: (context: QueueItemConnectorContext) => Promise<QueueItemList>;
   /** Optional source-indexed failure-window listing for safe, bounded
@@ -1035,7 +1046,64 @@ const DLQ_PATH_METADATA: Readonly<Record<string, DlqPathMetadata>> = {
         enabled: false,
         requiresApproval: true,
         reason:
-          'Recovery must prove upstream ownership, current monitor binding, and idempotent re-enqueue; no generic replay is allowed.',
+          'This legacy ID is the provider-monitor source-routing DLQ. Recovery must prove upstream ownership, current monitor binding, and idempotent re-enqueue; no generic replay is allowed.',
+      },
+    ],
+  },
+  'signal-radar-inbound-receipts': {
+    lookupIndex: {
+      table: 'signalRadarInboundReceipts',
+      index: 'by_state_created_at',
+      key: 'state + createdAt',
+      bounded: true,
+    },
+    transitions: [
+      {
+        action: 'retry',
+        fromStates: ['dead_lettered'],
+        toState: 'pending',
+        enabled: false,
+        requiresApproval: true,
+        reason:
+          'The receipt owner does not expose a fenced transition from dead_lettered; scheduled recovery owns pending retries.',
+      },
+    ],
+  },
+  'signal-radar-inbound-legacy-dlq': {
+    lookupIndex: {
+      table: 'dl_meta.signal_radar_inbound_dead_letter',
+      index: 'idx_dl_meta_sr_dead_letter_status',
+      key: 'status + created_at (one organization only)',
+      bounded: true,
+    },
+    transitions: [
+      {
+        action: 'replay',
+        fromStates: ['open'],
+        toState: 'replayed',
+        enabled: false,
+        requiresApproval: true,
+        reason:
+          'The legacy replay owner does not verify current charge authorization or expose the shared revision and idempotency contract; inspect with --org, but do not replay through the generic queue action.',
+      },
+    ],
+  },
+  'signal-radar-inbound-typed-write-failures': {
+    lookupIndex: {
+      table: 'dl_meta.monitor_inbound_raw',
+      index: 'idx_dl_meta_monitor_inbound_raw_status_received',
+      key: 'status + received_at (one organization only)',
+      bounded: true,
+    },
+    transitions: [
+      {
+        action: 'retry',
+        fromStates: ['write_failed'],
+        toState: 'written',
+        enabled: false,
+        requiresApproval: true,
+        reason:
+          'Raw failure rows are immutable delivery evidence. Provider redelivery and the receipt owner control retries; no per-item operator retry exists.',
       },
     ],
   },

package/dist/bundling-sources/shared_libs/observability/queue-health.ts

@@ -201,10 +201,46 @@ export const OPERATIONS_QUEUE_CATALOG = [
   ),
   queue(
     'signal-radar-inbound-dlq',
-    'Signal-radar inbound / DLQ',
+    'Signal-radar reconciliation source-routing DLQ',
     'provider_queue',
     'monitors',
-    'Persist inbound provider events and isolate poison events',
+    'Preserved legacy ID for provider-monitor source-routing failures; this is not the inbound delivery queue',
+    300_000,
+    900_000,
+  ),
+  queue(
+    'signal-radar-inbound-receipts',
+    'Signal-radar inbound receipts',
+    'leased_workset',
+    'monitors',
+    'Process the global Convex inbox of authenticated provider callbacks',
+    300_000,
+    900_000,
+  ),
+  queue(
+    'signal-radar-inbound-legacy-dlq',
+    'Signal-radar legacy inbound dead-letters',
+    'provider_queue',
+    'monitors',
+    'Tenant-scoped legacy poison-callback records; counts can overlap raw write failures',
+    300_000,
+    900_000,
+  ),
+  queue(
+    'signal-radar-inbound-typed-write-failures',
+    'Signal-radar typed-write failures',
+    'provider_queue',
+    'monitors',
+    'Tenant-scoped raw callback receipts whose typed write failed; records can overlap legacy dead-letters',
+    300_000,
+    900_000,
+  ),
+  queue(
+    'signal-radar-inbound-legacy-vercel-drain',
+    'Signal-radar legacy Vercel Queue drain',
+    'provider_queue',
+    'monitors',
+    'Deprecated drain-only Vercel Queue implementation with no owner item reader',
     300_000,
     900_000,
   ),

package/dist/bundling-sources/shared_libs/observability/queue-item-connectors.ts

@@ -17,6 +17,7 @@ export type QueueConnectorBackend =
   | 'convex'
   | 'workpool'
   | 'postgres-outbox'
+  | 'customer-db'
   | 'absurd'
   | 'provider';
 
@@ -99,7 +100,9 @@ export class QueueItemConnectorRegistry {
   /** True only after the owner has replaced the safe unavailable placeholder. */
   hasOwnerConnector(queueId: string): boolean {
     const registration = this.registrations.get(queueId);
-    return registration !== undefined && !isUnavailableRegistration(registration);
+    return (
+      registration !== undefined && !isUnavailableRegistration(registration)
+    );
   }
 
   list(): readonly QueueItemConnectorRegistration[] {
@@ -127,11 +130,16 @@ const unavailableReason = (options: UnavailableConnectorOptions): string =>
 export function createUnavailableQueueItemConnector(
   options: UnavailableConnectorOptions,
 ): QueueItemConnectorRegistration {
+  if (options.reason !== undefined && options.reason.trim().length === 0) {
+    throw new Error('An explicit unavailable queue connector needs a reason.');
+  }
   const reason = unavailableReason(options);
   const connector: QueueItemConnector = {
     id: options.id ?? `${options.backend}-${options.queueId}-unavailable`,
     queueId: options.queueId,
     source: options.source,
+    unavailableReason: reason,
+    ...(options.reason === undefined ? {} : { explicitlyUnavailable: true }),
     mapNativeState: (nativeState: string): QueueItemState =>
       normalizeQueueItemState(nativeState),
     async list(context: QueueItemConnectorContext): Promise<QueueItemList> {
@@ -221,6 +229,16 @@ export function createPostgresOutboxQueueItemConnector(
   });
 }
 
+export function createCustomerDbQueueItemConnector(
+  options: BackendConnectorOptions,
+): QueueItemConnectorRegistration {
+  return createUnavailableQueueItemConnector({
+    ...options,
+    backend: 'customer-db',
+    source: options.source ?? 'customer-db',
+  });
+}
+
 export function createAbsurdQueueItemConnector(
   options: BackendConnectorOptions,
 ): QueueItemConnectorRegistration {
@@ -257,7 +275,11 @@ export const QUEUE_CONNECTOR_BACKENDS: Readonly<
   'monitor-deployment-jobs': 'workpool',
   'monitor-batch-operations': 'workpool',
   'provider-monitor-reconciliation': 'provider',
-  'signal-radar-inbound-dlq': 'provider',
+  'signal-radar-inbound-dlq': 'convex',
+  'signal-radar-inbound-receipts': 'convex',
+  'signal-radar-inbound-legacy-dlq': 'customer-db',
+  'signal-radar-inbound-typed-write-failures': 'customer-db',
+  'signal-radar-inbound-legacy-vercel-drain': 'provider',
   'charge-reconciliation-backlog': 'postgres-outbox',
   'workspace-fast-settlement': 'convex',
   'metronome-usage-delivery': 'postgres-outbox',
@@ -283,6 +305,8 @@ function defaultRegistration(
   if (backend === 'workpool') return createWorkpoolQueueItemConnector(options);
   if (backend === 'postgres-outbox')
     return createPostgresOutboxQueueItemConnector(options);
+  if (backend === 'customer-db')
+    return createCustomerDbQueueItemConnector(options);
   if (backend === 'absurd') return createAbsurdQueueItemConnector(options);
   return createProviderQueueItemConnector(options);
 }

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/absurd-play-deploy-task.ts

@@ -149,7 +149,11 @@ export type PlayDeployTaskParams = {
   playProjectId: string;
   deployToken: string;
   appBaseUrl: string;
-  /** Pinned by the first enqueue. Missing means the original Fly executor. */
+  /**
+   * Always `vercel` for new tasks, which is the only executor. `fly` and a
+   * missing value survive only in tasks queued before the Fly build path was
+   * removed; the dispatcher builds those on Vercel too.
+   */
   buildBackend?: 'fly' | 'vercel';
 };
 

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/postgres.ts

@@ -15317,9 +15317,15 @@ function runLedgerPrecedesSql(
   successor: string,
   inclusive = false,
 ): string {
-  const position = (alias: string) =>
-    `(CASE ${alias}.event_type WHEN 'run.created' THEN 0 WHEN 'run.started' THEN 1 ELSE 2 END, ${alias}.created_at, ${alias}.event_id)`;
-  return `${position(predecessor)} ${inclusive ? '<=' : '<'} ${position(successor)}`;
+  return `${runLedgerPositionSql(predecessor)} ${inclusive ? '<=' : '<'} ${runLedgerPositionSql(successor)}`;
+}
+
+function runLedgerPositionSql(alias: string): string {
+  return `(${runLedgerOrderSql(alias)})`;
+}
+
+function runLedgerOrderSql(alias: string): string {
+  return `CASE ${alias}.event_type WHEN 'run.created' THEN 0 WHEN 'run.started' THEN 1 ELSE 2 END, ${alias}.created_at, ${alias}.event_id`;
 }
 
 /**
@@ -16527,17 +16533,24 @@ export async function dispatchRunLedgerOutboxToLedgerBatchOnceWithClientScope(
     try {
       const selected = await client.query<{ run_id: string }>(
         `
+        WITH heads AS MATERIALIZED (
+          SELECT DISTINCT ON (pending.run_id)
+            pending.run_id,
+            pending.event_id,
+            pending.event_type,
+            pending.created_at,
+            pending.next_attempt_at,
+            pending.failed_at
+          FROM ${tableName('outbox', options)} AS pending
+          WHERE pending.delivered_at IS NULL
+            AND ($1::text IS NULL OR pending.run_id = $1)
+          ORDER BY pending.run_id, ${runLedgerOrderSql('pending')}
+        )
         SELECT runs.run_id
-        FROM ${tableName('outbox', options)} AS head
+        FROM heads AS head
         JOIN ${tableName('runs', options)} AS runs ON runs.run_id = head.run_id
-        WHERE ($1::text IS NULL OR runs.run_id = $1)
-          AND head.delivered_at IS NULL AND head.failed_at IS NULL
+        WHERE head.failed_at IS NULL
           AND coalesce(head.next_attempt_at, head.created_at) <= now()
-          AND NOT EXISTS (
-            SELECT 1 FROM ${tableName('outbox', options)} AS predecessor
-            WHERE predecessor.run_id = head.run_id AND predecessor.delivered_at IS NULL
-              AND ${runLedgerPrecedesSql('predecessor', 'head')}
-          )
           AND NOT EXISTS (
             SELECT 1 FROM ${tableName('outbox', options)} AS active
             WHERE active.run_id = runs.run_id AND active.delivered_at IS NULL

package/dist/bundling-sources/shared_libs/security/secret-redaction.ts

@@ -185,6 +185,101 @@ const EXPLICIT_SECRET_VALUE_PATTERNS = [
   /\bhttps?:\/\/[^/\s'"]+:[^@\s'"]+@[^/\s'"]+/i,
 ];
 
+const EMAIL_LOCAL_CHAR_RE = /[A-Za-z0-9.!#$%&'*+/=?^_`{|}~-]/;
+const EMAIL_DOMAIN_RE =
+  /^[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?\.[A-Za-z]{2,63}\b/;
+
+function isEmailLocalPart(value: string, start: number, end: number): boolean {
+  let localStart = start;
+  while (localStart > 0 && EMAIL_LOCAL_CHAR_RE.test(value[localStart - 1]!)) {
+    localStart -= 1;
+  }
+  let localEnd = end;
+  while (
+    localEnd < value.length &&
+    EMAIL_LOCAL_CHAR_RE.test(value[localEnd]!)
+  ) {
+    localEnd += 1;
+  }
+  return (
+    localStart < localEnd &&
+    localEnd - localStart <= 64 &&
+    value[localEnd] === '@' &&
+    EMAIL_DOMAIN_RE.test(value.slice(localEnd + 1))
+  );
+}
+
+function isPublicEmailIdentifier(
+  value: string,
+  start: number,
+  end: number,
+  patternIndex: number,
+  options: SecretRedactionOptions,
+): boolean {
+  // Only self-identifying token prefixes can also be valid email local parts.
+  // Keep strict telemetry redaction and URL credential detection unchanged.
+  return (
+    options.redactHighEntropy === false &&
+    patternIndex < 6 &&
+    isEmailLocalPart(value, start, end)
+  );
+}
+
+function hasExplicitSecretValue(
+  value: string,
+  options: SecretRedactionOptions,
+): boolean {
+  return EXPLICIT_SECRET_VALUE_PATTERNS.some((pattern, patternIndex) => {
+    if (!pattern.test(value)) return false;
+    if (options.redactHighEntropy !== false || patternIndex >= 6) return true;
+    const globalPattern = new RegExp(pattern.source, `${pattern.flags}g`);
+    for (const match of value.matchAll(globalPattern)) {
+      if (
+        !isPublicEmailIdentifier(
+          value,
+          match.index,
+          match.index + match[0].length,
+          patternIndex,
+          options,
+        )
+      ) {
+        return true;
+      }
+    }
+    return false;
+  });
+}
+
+function redactExplicitSecretsInText(
+  value: string,
+  options: SecretRedactionOptions,
+): string {
+  let redacted = value;
+  for (const [
+    patternIndex,
+    pattern,
+  ] of EXPLICIT_SECRET_VALUE_PATTERNS.entries()) {
+    const globalPattern = new RegExp(pattern.source, `${pattern.flags}g`);
+    let next = '';
+    let end = 0;
+    for (const match of redacted.matchAll(globalPattern)) {
+      next += redacted.slice(end, match.index);
+      next += isPublicEmailIdentifier(
+        redacted,
+        match.index,
+        match.index + match[0].length,
+        patternIndex,
+        options,
+      )
+        ? match[0]
+        : REDACTED_VALUE;
+      end = match.index + match[0].length;
+    }
+    redacted = next + redacted.slice(end);
+  }
+  return redacted;
+}
+
 const HIGH_ENTROPY_VALUE_PATTERN = /\b[A-Za-z0-9+/=_-]{32,}\b/g;
 // A public hostname can legitimately contain a generated label longer than the
 // high-entropy threshold (for example, a per-run probe hostname). Preserve the
@@ -275,7 +370,7 @@ function isPublicResultSafeTokenKey(
 }
 
 function maybeRedactString(value: string, options: SecretRedactionOptions) {
-  if (EXPLICIT_SECRET_VALUE_PATTERNS.some((pattern) => pattern.test(value))) {
+  if (hasExplicitSecretValue(value, options)) {
     return REDACTED_VALUE;
   }
   const publicHttpUrl = inspectStandalonePublicHttpUrl(value);
@@ -304,7 +399,7 @@ export function redactSecretsInValue<T>(
   options: SecretRedactionOptions = {},
 ): T {
   if (typeof value === 'string') {
-    if (EXPLICIT_SECRET_VALUE_PATTERNS.some((pattern) => pattern.test(value))) {
+    if (hasExplicitSecretValue(value, options)) {
       return REDACTED_VALUE as T;
     }
     if (isPublicResultTransferUrl(value, parentKey, options)) return value as T;
@@ -348,7 +443,7 @@ export function redactSecretsInValue<T>(
     itemParentKey: string | undefined,
   ): unknown => {
     if (typeof item !== 'string') return item;
-    if (EXPLICIT_SECRET_VALUE_PATTERNS.some((pattern) => pattern.test(item))) {
+    if (hasExplicitSecretValue(item, options)) {
       return REDACTED_VALUE;
     }
     if (isPublicResultTransferUrl(item, itemParentKey, options)) return item;
@@ -444,11 +539,10 @@ export function redactSecretsInJsonText(
       2,
     );
   } catch {
-    let redacted = text;
-    for (const pattern of EXPLICIT_SECRET_VALUE_PATTERNS) {
-      redacted = redacted.replace(pattern, REDACTED_VALUE);
-    }
-    return maybeRedactString(redacted, options);
+    return maybeRedactString(
+      redactExplicitSecretsInText(text, options),
+      options,
+    );
   }
 }
 

package/dist/cli/index.js

@@ -3051,7 +3051,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.169",
+  version: "0.3.170",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/cli/index.mjs

@@ -3046,7 +3046,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.169",
+  version: "0.3.170",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/index.js

@@ -864,7 +864,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.169",
+  version: "0.3.170",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/index.mjs

@@ -768,7 +768,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.169",
+  version: "0.3.170",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/release.d.mts

@@ -149,7 +149,7 @@ type SdkRelease = {
     supportPolicy: SdkSupportPolicy;
 };
 declare const SDK_RELEASE: {
-    readonly version: "0.3.169";
+    readonly version: "0.3.170";
     readonly updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.";
     readonly packageCapabilities: {
         readonly updatePreferences: 1;

package/dist/release.d.ts

@@ -149,7 +149,7 @@ type SdkRelease = {
     supportPolicy: SdkSupportPolicy;
 };
 declare const SDK_RELEASE: {
-    readonly version: "0.3.169";
+    readonly version: "0.3.170";
     readonly updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.";
     readonly packageCapabilities: {
         readonly updatePreferences: 1;

package/dist/release.js

@@ -74,7 +74,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.169",
+  version: "0.3.170",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/release.mjs

@@ -48,7 +48,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.169",
+  version: "0.3.170",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.3.169",
+  "version": "0.3.170",
   "description": "GTM data CLI and TypeScript SDK for coding agents",
   "license": "MIT",
   "homepage": "https://code.deepline.com",