deepline 0.3.335 → 0.3.336

package/dist/bundling-sources/sdk/src/release.ts

@@ -200,7 +200,7 @@ export const SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: '0.3.335',
+  version: '0.3.336',
   updateSummary:
     'Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.',
   packageCapabilities: {

package/dist/bundling-sources/shared_libs/play-runtime/internal-bootstrap-token.ts

@@ -112,6 +112,9 @@ const PRODUCT_NOTIFICATION_UNSUBSCRIBE_PURPOSE =
 const MONITOR_FLEET_DISPATCH_AUDIENCE =
   'deepline.monitor_fleet.dispatch' as const;
 const MONITOR_FLEET_DISPATCH_PURPOSE = 'monitor_fleet_dispatch' as const;
+const AUTO_RECHARGE_TRIGGER_AUDIENCE =
+  'deepline.billing.auto_recharge_trigger' as const;
+const AUTO_RECHARGE_TRIGGER_PURPOSE = 'auto_recharge_trigger' as const;
 const INTERNAL_BOOTSTRAP_TOKEN_DERIVATION_LABEL =
   'deepline:internal-bootstrap-token:v1';
 const WORKFLOW_EXECUTOR_KEY_DERIVATION_LABEL =
@@ -245,6 +248,18 @@ export type ProductNotificationUnsubscribeTokenClaims = {
   v: typeof INTERNAL_BOOTSTRAP_TOKEN_VERSION;
 };
 
+/** Capability to ask the recharge controller to evaluate one workspace. */
+export type AutoRechargeTriggerTokenClaims = {
+  aud: typeof AUTO_RECHARGE_TRIGGER_AUDIENCE;
+  exp: number;
+  iat: number;
+  iss: typeof INTERNAL_BOOTSTRAP_TOKEN_ISSUER;
+  org_id: string;
+  purpose: typeof AUTO_RECHARGE_TRIGGER_PURPOSE;
+  sub: 'credit_balance_reaction';
+  v: typeof INTERNAL_BOOTSTRAP_TOKEN_VERSION;
+};
+
 /** Capability scoped to one durable Monitor Fleet control-plane operation. */
 export type MonitorFleetDispatchTokenClaims = {
   aud: typeof MONITOR_FLEET_DISPATCH_AUDIENCE;
@@ -1512,6 +1527,72 @@ export async function verifyProductNotificationUnsubscribeToken(
   return claims as ProductNotificationUnsubscribeTokenClaims;
 }
 
+/**
+ * Mints a short-lived capability for the balance-triggered recharge
+ * evaluation. It carries no amount: the controller decides from saved policy.
+ */
+export async function mintAutoRechargeTriggerToken(input: {
+  orgId: string;
+  nowMs?: number;
+}): Promise<string> {
+  const issuedAt = Math.floor((input.nowMs ?? Date.now()) / 1000);
+  const claims: AutoRechargeTriggerTokenClaims = {
+    v: INTERNAL_BOOTSTRAP_TOKEN_VERSION,
+    iss: INTERNAL_BOOTSTRAP_TOKEN_ISSUER,
+    aud: AUTO_RECHARGE_TRIGGER_AUDIENCE,
+    purpose: AUTO_RECHARGE_TRIGGER_PURPOSE,
+    org_id: input.orgId,
+    sub: 'credit_balance_reaction',
+    iat: issuedAt,
+    exp: issuedAt + INTERNAL_BOOTSTRAP_TOKEN_TTL_SECONDS,
+  };
+  const signingInput = `${encodeJson({ alg: 'HS256', typ: 'JWT' })}.${encodeJson(claims)}`;
+  return `${signingInput}.${await signTokenMaterial(signingInput)}`;
+}
+
+export async function verifyAutoRechargeTriggerToken(
+  token: string,
+  nowMs = Date.now(),
+): Promise<AutoRechargeTriggerTokenClaims> {
+  const segments = token.split('.');
+  if (segments.length !== 3)
+    throw new Error('Invalid automatic recharge trigger token.');
+  const [encodedHeader, encodedClaims, signature] = segments;
+  const header = decodeJson<Record<string, unknown>>(encodedHeader);
+  if (header.alg !== 'HS256' || header.typ !== 'JWT') {
+    throw new Error('Invalid automatic recharge trigger token.');
+  }
+  const expectedSignature = await signTokenMaterial(
+    `${encodedHeader}.${encodedClaims}`,
+  );
+  if (
+    !timingSafeEqual(fromBase64Url(signature), fromBase64Url(expectedSignature))
+  ) {
+    throw new Error('Invalid automatic recharge trigger token.');
+  }
+  const claims = decodeJson<Record<string, unknown>>(encodedClaims);
+  if (
+    claims.v !== INTERNAL_BOOTSTRAP_TOKEN_VERSION ||
+    claims.iss !== INTERNAL_BOOTSTRAP_TOKEN_ISSUER ||
+    claims.aud !== AUTO_RECHARGE_TRIGGER_AUDIENCE ||
+    claims.purpose !== AUTO_RECHARGE_TRIGGER_PURPOSE ||
+    claims.sub !== 'credit_balance_reaction' ||
+    typeof claims.org_id !== 'string' ||
+    !claims.org_id ||
+    typeof claims.iat !== 'number' ||
+    !Number.isFinite(claims.iat) ||
+    typeof claims.exp !== 'number' ||
+    !Number.isFinite(claims.exp)
+  ) {
+    throw new Error('Invalid automatic recharge trigger token.');
+  }
+  const nowSeconds = Math.floor(nowMs / 1000);
+  if (claims.exp <= nowSeconds || claims.iat > nowSeconds + 30) {
+    throw new Error('Automatic recharge trigger token expired.');
+  }
+  return claims as AutoRechargeTriggerTokenClaims;
+}
+
 export async function mintMonitorFleetDispatchToken(input: {
   orgId: string;
   operation: 'dispatch' | 'daily_sync' | 'job_dispatch';

package/dist/cli/auth-6RQLNYNF.js

@@ -0,0 +1,31 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+
+
+
+
+
+
+
+var _chunkQ2HYQOIDjs = require('./chunk-Q2HYQOID.js');
+require('./chunk-I5XF4PWD.js');
+require('./chunk-ZPLBQ24U.js');
+require('./chunk-XNYIZMNQ.js');
+require('./chunk-KZT7YX7R.js');
+require('./chunk-7P5AA3SN.js');
+require('./chunk-OG64RBAC.js');
+require('./chunk-COGTRVWW.js');
+
+
+
+
+
+
+
+
+
+
+
+exports.EXIT_WORKSPACE_MISMATCH = _chunkQ2HYQOIDjs.EXIT_WORKSPACE_MISMATCH; exports.clearPendingClaim = _chunkQ2HYQOIDjs.clearPendingClaim; exports.clearSatisfiedPendingClaim = _chunkQ2HYQOIDjs.clearSatisfiedPendingClaim; exports.handleRegister = _chunkQ2HYQOIDjs.handleRegister; exports.handleStatus = _chunkQ2HYQOIDjs.handleStatus; exports.handleWait = _chunkQ2HYQOIDjs.handleWait; exports.readPendingAuthClaim = _chunkQ2HYQOIDjs.readPendingAuthClaim; exports.registerAuthCommands = _chunkQ2HYQOIDjs.registerAuthCommands; exports.reportSetupCompleted = _chunkQ2HYQOIDjs.reportSetupCompleted; exports.resolvePendingAuthClaimForResume = _chunkQ2HYQOIDjs.resolvePendingAuthClaimForResume;

package/dist/cli/{auth-UAPR5UHG.mjs → auth-M45QKCUL.mjs}

@@ -9,11 +9,11 @@ import {
   registerAuthCommands,
   reportSetupCompleted,
   resolvePendingAuthClaimForResume
-} from "./chunk-BC5OUOUV.mjs";
-import "./chunk-FTX3SMNS.mjs";
-import "./chunk-Z3KXO6AE.mjs";
+} from "./chunk-4S3G43M3.mjs";
+import "./chunk-TGMDQIYJ.mjs";
+import "./chunk-IU3TFWPR.mjs";
 import "./chunk-DLIRSHV6.mjs";
-import "./chunk-G7YDITCA.mjs";
+import "./chunk-B53RXFGP.mjs";
 import "./chunk-NXGCO4JB.mjs";
 import "./chunk-WZYKRD7T.mjs";
 import "./chunk-KRD6H754.mjs";

package/dist/cli/{billing-2M2MOKZ2.mjs → billing-E7ADEFLX.mjs}

@@ -2,7 +2,7 @@ import {
   DeeplineClient,
   iterateCursorPages,
   requireBillingIdempotencyKey
-} from "./chunk-U5MMLE2K.mjs";
+} from "./chunk-VOD4V4G4.mjs";
 import "./chunk-CBVIJSHF.mjs";
 import {
   createTimestampedName,
@@ -10,13 +10,13 @@ import {
   openInBrowser,
   printCommandEnvelope,
   shouldEmitJson
-} from "./chunk-FTX3SMNS.mjs";
+} from "./chunk-TGMDQIYJ.mjs";
 import {
   AuthError,
   ConfigError
-} from "./chunk-Z3KXO6AE.mjs";
+} from "./chunk-IU3TFWPR.mjs";
 import "./chunk-DLIRSHV6.mjs";
-import "./chunk-G7YDITCA.mjs";
+import "./chunk-B53RXFGP.mjs";
 import "./chunk-6IKARAYD.mjs";
 import {
   DeeplineError