deepline 0.3.319 → 0.3.321

package/dist/bundling-sources/sdk/src/release.ts

@@ -200,7 +200,7 @@ export const SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: '0.3.319',
+  version: '0.3.321',
   updateSummary:
     'Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.',
   packageCapabilities: {

package/dist/bundling-sources/shared_libs/observability/scheduled-jobs.json

@@ -125,6 +125,24 @@
     "failureAlert": "github_workflow_run",
     "domainReportRequired": true
   },
+  {
+    "id": "github.convex-preview-usage-limit-reset",
+    "name": "Apply Convex Preview usage limits",
+    "scheduler": "github_actions",
+    "cadence": "5 0 * * *",
+    "timezone": "UTC",
+    "source": ".github/workflows/apply-preview-convex-usage-limits.yml",
+    "locator": "schedule:",
+    "owner": "platform",
+    "criticality": "operational",
+    "purpose": "Reapply strict per-deployment daily hard stops and daily/monthly warnings to current-project Convex Previews after UTC daily counters reset.",
+    "successDefinition": "Every current-project Preview has six active daily hard stops and warnings plus monthly warnings; monthly hard stops are inactive. Thresholds above baseline are retained only when already-consumed usage requires it and tightened after that window resets. Only explicitly retired inventory entries are skipped.",
+    "failureDefinition": "Preview inventory is unavailable, a deployment cannot be addressed, or any usage threshold cannot be set and verified.",
+    "startGraceMs": 900000,
+    "runTimeoutMs": 2700000,
+    "failureAlert": "github_workflow_run",
+    "domainReportRequired": true
+  },
   {
     "id": "github.daily-slack-report",
     "name": "Daily Slack report",
@@ -308,9 +326,7 @@
   {
     "id": "github.runtime-lifecycle",
     "name": "On-Demand Runtime Lifecycle Load Check",
-    "legacyNames": [
-      "Scheduled Runtime Lifecycle Load Monitor"
-    ],
+    "legacyNames": ["Scheduled Runtime Lifecycle Load Monitor"],
     "scheduler": "github_actions",
     "cadence": "runAfter explicit workflow dispatch or PR label",
     "timezone": "UTC",
@@ -802,11 +818,11 @@
   {
     "id": "inngest.play-cron-tick",
     "name": "Play cron tick",
-    "scheduler": "inngest",
+    "scheduler": "convex_cron",
     "cadence": "* * * * *",
     "timezone": "UTC",
-    "source": "apps/deepline-api/src/lib/workflows/inngest/functions.ts",
-    "locator": "play_cron_tick_v1",
+    "source": "packages/convex/crons.ts",
+    "locator": "play cron tick",
     "owner": "runtime",
     "criticality": "critical",
     "purpose": "Find due Play schedules and enqueue their next Play executions.",
@@ -814,7 +830,7 @@
     "failureDefinition": "Scan/enqueue fails or a due Play lacks a durable disposition.",
     "startGraceMs": 120000,
     "runTimeoutMs": 1800000,
-    "failureAlert": "inngest_on_failure",
+    "failureAlert": "convex_action_wrapper",
     "domainReportRequired": true
   },
   {
@@ -1302,5 +1318,23 @@
     "runTimeoutMs": 600000,
     "failureAlert": "github_workflow_run",
     "domainReportRequired": true
+  },
+  {
+    "id": "convex.sql-listener-dispatch-retry",
+    "name": "SQL-listener dispatch retry",
+    "scheduler": "convex_scheduled_action",
+    "cadence": "runAfter inline SQL-listener dispatch failure or partial result",
+    "timezone": "UTC",
+    "source": "packages/convex/scheduledJobsNode.ts",
+    "locator": "dispatchSqlListenerRetry",
+    "owner": "runtime",
+    "criticality": "critical",
+    "purpose": "Run one org-scoped pass over an already durable SQL-listener outbox through Convex Workpool.",
+    "successDefinition": "The signed Vercel callback confirms matching request identity and scalar row dispositions without starting a polling loop.",
+    "failureDefinition": "The callback fails, returns an ambiguous or mismatched result, or reports rows needing another inbound event or operator dispatch.",
+    "startGraceMs": 120000,
+    "runTimeoutMs": 120000,
+    "failureAlert": "convex_action_wrapper",
+    "domainReportRequired": true
   }
 ]

package/dist/bundling-sources/shared_libs/observability/scheduled-work-manual.ts

@@ -8,6 +8,8 @@
  * key impersonate GitHub, Vercel, or Inngest).
  */
 export const MANUALLY_RUNNABLE_CONVEX_CRON_JOB_IDS = [
+  // These persisted operations ids predate the move of their clocks to Convex.
+  'inngest.play-cron-tick',
   'convex.fold-usage-rollups',
   'convex.cleanup-expired-org-day-usage-shards',
   'convex.record-neon-managed-project-usage',

package/dist/bundling-sources/shared_libs/play-runtime/internal-bootstrap-token.ts

@@ -16,6 +16,7 @@ import {
   mintPlayWebhookReceiptBatchAdmissionToken as mintPlayWebhookReceiptBatchAdmissionTokenShared,
   mintPlayWebhookReceiptAdmissionToken as mintPlayWebhookReceiptAdmissionTokenShared,
   mintSignalRadarInboundReceiptToken as mintSignalRadarInboundReceiptTokenShared,
+  mintSqlListenerDispatchRetryToken as mintSqlListenerDispatchRetryTokenShared,
 } from '../security/receipt-admission-token';
 import { SignJWT, exportJWK, importJWK, jwtVerify, type JWK } from 'jose';
 import {
@@ -1335,6 +1336,67 @@ export async function mintSignalRadarInboundReceiptToken(input: {
   return await mintSignalRadarInboundReceiptTokenShared(input);
 }
 
+export const mintSqlListenerDispatchRetryToken =
+  mintSqlListenerDispatchRetryTokenShared;
+
+export type SqlListenerDispatchRetryTokenClaims = {
+  org_id: string;
+  event_id: string;
+  subject?: string;
+  limit?: number;
+  claim_lease_ms?: number;
+  max_attempts?: number;
+};
+
+export async function verifySqlListenerDispatchRetryToken(
+  token: string,
+  nowMs = Date.now(),
+): Promise<SqlListenerDispatchRetryTokenClaims> {
+  const segments = token.split('.');
+  if (segments.length !== 3)
+    throw new Error('Invalid SQL-listener retry token.');
+  const [headerPart, claimsPart, signature] = segments;
+  const header = decodeJson<Record<string, unknown>>(headerPart);
+  const expected = await signTokenMaterial(`${headerPart}.${claimsPart}`);
+  if (
+    header.alg !== 'HS256' ||
+    header.typ !== 'JWT' ||
+    !timingSafeEqual(fromBase64Url(signature), fromBase64Url(expected))
+  )
+    throw new Error('Invalid SQL-listener retry token.');
+  const claims = decodeJson<Record<string, unknown>>(claimsPart);
+  if (
+    claims.v !== INTERNAL_BOOTSTRAP_TOKEN_VERSION ||
+    claims.iss !== INTERNAL_BOOTSTRAP_TOKEN_ISSUER ||
+    claims.aud !== 'deepline.sql_listener.dispatch_retry' ||
+    claims.purpose !== 'sql_listener_dispatch_retry' ||
+    claims.sub !== 'sql_listener_retry_dispatcher' ||
+    typeof claims.org_id !== 'string' ||
+    !claims.org_id.trim() ||
+    typeof claims.event_id !== 'string' ||
+    !claims.event_id.trim() ||
+    typeof claims.iat !== 'number' ||
+    !Number.isFinite(claims.iat) ||
+    typeof claims.exp !== 'number' ||
+    !Number.isFinite(claims.exp) ||
+    (claims.subject !== undefined &&
+      (typeof claims.subject !== 'string' || !claims.subject.trim())) ||
+    ['limit', 'claim_lease_ms', 'max_attempts'].some(
+      (key) =>
+        claims[key] !== undefined &&
+        (typeof claims[key] !== 'number' ||
+          !Number.isSafeInteger(claims[key]) ||
+          Number(claims[key]) <= 0),
+    )
+  )
+    throw new Error('Invalid SQL-listener retry token.');
+  const nowSeconds = Math.floor(nowMs / 1000);
+  if (claims.exp <= nowSeconds || claims.iat > nowSeconds + 30) {
+    throw new Error('SQL-listener retry token expired.');
+  }
+  return claims as SqlListenerDispatchRetryTokenClaims;
+}
+
 export async function verifySignalRadarInboundReceiptToken(
   token: string,
   nowMs = Date.now(),

package/dist/bundling-sources/shared_libs/security/receipt-admission-token.ts

@@ -222,3 +222,35 @@ export async function mintSignalRadarInboundReceiptToken(input: {
     exp: issuedAt + TOKEN_TTL_SECONDS,
   });
 }
+
+/** A single, org-scoped pass over an already durable SQL-listener outbox. */
+export async function mintSqlListenerDispatchRetryToken(input: {
+  orgId: string;
+  eventId: string;
+  subject?: string;
+  limit?: number;
+  claimLeaseMs?: number;
+  maxAttempts?: number;
+  nowMs?: number;
+}): Promise<string> {
+  const issuedAt = Math.floor((input.nowMs ?? Date.now()) / 1000);
+  return await mint({
+    v: TOKEN_VERSION,
+    iss: TOKEN_ISSUER,
+    aud: 'deepline.sql_listener.dispatch_retry',
+    purpose: 'sql_listener_dispatch_retry',
+    sub: 'sql_listener_retry_dispatcher',
+    org_id: input.orgId,
+    event_id: input.eventId,
+    ...(input.subject === undefined ? {} : { subject: input.subject }),
+    ...(input.limit === undefined ? {} : { limit: input.limit }),
+    ...(input.claimLeaseMs === undefined
+      ? {}
+      : { claim_lease_ms: input.claimLeaseMs }),
+    ...(input.maxAttempts === undefined
+      ? {}
+      : { max_attempts: input.maxAttempts }),
+    iat: issuedAt,
+    exp: issuedAt + TOKEN_TTL_SECONDS,
+  });
+}

package/dist/cli/auth-AF2MEC7K.js

@@ -0,0 +1,31 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+
+
+
+
+
+
+
+var _chunkKN5AMK2Njs = require('./chunk-KN5AMK2N.js');
+require('./chunk-57VCSLVP.js');
+require('./chunk-FBJSFMZM.js');
+require('./chunk-XNYIZMNQ.js');
+require('./chunk-23LWIJU5.js');
+require('./chunk-7P5AA3SN.js');
+require('./chunk-OG64RBAC.js');
+require('./chunk-COGTRVWW.js');
+
+
+
+
+
+
+
+
+
+
+
+exports.EXIT_WORKSPACE_MISMATCH = _chunkKN5AMK2Njs.EXIT_WORKSPACE_MISMATCH; exports.clearPendingClaim = _chunkKN5AMK2Njs.clearPendingClaim; exports.clearSatisfiedPendingClaim = _chunkKN5AMK2Njs.clearSatisfiedPendingClaim; exports.handleRegister = _chunkKN5AMK2Njs.handleRegister; exports.handleStatus = _chunkKN5AMK2Njs.handleStatus; exports.handleWait = _chunkKN5AMK2Njs.handleWait; exports.readPendingAuthClaim = _chunkKN5AMK2Njs.readPendingAuthClaim; exports.registerAuthCommands = _chunkKN5AMK2Njs.registerAuthCommands; exports.reportSetupCompleted = _chunkKN5AMK2Njs.reportSetupCompleted; exports.resolvePendingAuthClaimForResume = _chunkKN5AMK2Njs.resolvePendingAuthClaimForResume;

package/dist/cli/{auth-DAXPANFX.mjs → auth-OXD3QIJW.mjs}

@@ -9,11 +9,11 @@ import {
   registerAuthCommands,
   reportSetupCompleted,
   resolvePendingAuthClaimForResume
-} from "./chunk-PUWF6FLJ.mjs";
-import "./chunk-XR4IGFZS.mjs";
-import "./chunk-REBQVNAE.mjs";
+} from "./chunk-SLAJLTYQ.mjs";
+import "./chunk-P5BBV56E.mjs";
+import "./chunk-T6BFDDO7.mjs";
 import "./chunk-DLIRSHV6.mjs";
-import "./chunk-TZ4TLTXI.mjs";
+import "./chunk-QVH4OR5R.mjs";
 import "./chunk-NXGCO4JB.mjs";
 import "./chunk-WZYKRD7T.mjs";
 import "./chunk-KRD6H754.mjs";