deepline 0.3.347 → 0.3.348

package/dist/bundling-sources/sdk/src/client.ts

@@ -1,3 +1,5 @@
+import type { BillingEntitlements } from '../../shared_libs/integration-contracts/billing-entitlements';
+export type { BillingEntitlements } from '../../shared_libs/integration-contracts/billing-entitlements';
 import type {
   PlaySettingsResult,
   PlaySettingsPatch,
@@ -2495,6 +2497,8 @@ export type BillingUsageResult = {
  * @sdkReference client 030 client.billing
  */
 export type BillingNamespace = {
+  /** Current workspace provider benefits; discovery does not authorize a call. */
+  entitlements: () => Promise<BillingEntitlements>;
   /** Charge the saved payment method and add Deepline credits to the active workspace. */
   topUp: (options: {
     credits: number;
@@ -2914,6 +2918,7 @@ export class DeeplineClient {
       planQuery: (input) => planCustomerDbQuery(input),
     };
     this.billing = {
+      entitlements: () => this.http.get('/api/v2/billing/entitlements'),
       topUp: (options) => this.topUpBillingBalance(options),
       topUpWithReceipt: (options) =>
         this.topUpBillingBalanceWithReceipt(options),

package/dist/bundling-sources/sdk/src/index.ts

@@ -1,3 +1,4 @@
+export type { BillingEntitlements } from '../../shared_libs/integration-contracts/billing-entitlements';
 export type {
   PlaySettings,
   PlayPath,

package/dist/bundling-sources/sdk/src/release.ts

@@ -200,7 +200,7 @@ export const SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: '0.3.347',
+  version: '0.3.348',
   updateSummary:
     'Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.',
   packageCapabilities: {

package/dist/bundling-sources/shared_libs/integration-contracts/billing-entitlements.ts

@@ -0,0 +1,29 @@
+/** Customer-visible discovery data; execution always rechecks admission. */
+export type BillingEntitlements = {
+  org_id: string;
+  as_of: number;
+  /** The held commercial plan or existing legacy billing catalog plan. */
+  plan: {
+    sku: string;
+    name: string;
+    catalog_revision: string | null;
+    included_credits: number;
+    interval: 'month' | 'year' | null;
+  } | null;
+  benefits: {
+    quickenrichUnlimited?: {
+      status: 'active' | 'past_due';
+      value: { enabled: boolean; requestsPerMinute: number };
+      expiresAt?: number;
+    };
+  };
+  /** Configuration provenance is separate from the purchased promise. */
+  effective_limits: {
+    quickenrichUnlimited?: {
+      baseline: number;
+      effective: number;
+      source: 'plan' | 'override';
+      override_expires_at?: number;
+    };
+  };
+};

package/dist/bundling-sources/shared_libs/play-runtime/app-runtime-api.ts

@@ -9,7 +9,10 @@ import { stat } from 'node:fs/promises';
 import { Readable } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
 import type { PlaySheetContract } from '../plays/static-pipeline';
-import type { AsyncPlayRunRef } from '../plays/authoring-contract';
+import type {
+  AsyncPlayRunRef,
+  BillingEntitlements,
+} from '../plays/authoring-contract';
 import type { PlayRowUpdate } from './/ctx-types';
 import type { PlayRunTimelineEntry } from './/live-events';
 import type { PlayDatasetBornFrom } from './/cell-provenance';
@@ -361,6 +364,7 @@ type RuntimeApiRequest =
   | ({
       action: 'governor_budget_charge';
     } & PlayRunnerBudgetChargeInput)
+  | { action: 'get_billing_entitlements' }
   | { action: 'get_runtime_traffic_policy' }
   | RuntimeReceiptAction;
 
@@ -2162,6 +2166,33 @@ export async function chargeGovernorBudgetViaAppRuntime(
   });
 }
 
+export async function getBillingEntitlementsViaAppRuntime(
+  context: WorkerRuntimeApiContext,
+): Promise<BillingEntitlements> {
+  try {
+    return await postAppRuntimeApi<BillingEntitlements>(context, {
+      action: 'get_billing_entitlements',
+    });
+  } catch (error) {
+    if (
+      error instanceof AppRuntimeApiResponseError &&
+      error.status === 403 &&
+      error.code === null &&
+      error.detail === 'Unsupported runtime action capability scope.'
+    ) {
+      throw new AppRuntimeApiResponseError({
+        action: 'get_billing_entitlements',
+        status: 503,
+        code: 'BILLING_ENTITLEMENTS_UNAVAILABLE',
+        retryable: false,
+        detail:
+          'The app runtime receiver does not support billing entitlements.',
+      });
+    }
+    throw error;
+  }
+}
+
 export async function getRuntimeTrafficPolicyViaAppRuntime(
   context: WorkerRuntimeApiContext,
 ): Promise<RuntimeTrafficPolicy> {

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -39,7 +39,10 @@ import {
 } from './batch-runtime';
 import type { CompiledRequestBatch } from './batch-runtime';
 import type { AnyBatchOperationStrategy } from './batching-types';
-import type { RuntimeApiResponseMeta } from './app-runtime-api';
+import {
+  getBillingEntitlementsViaAppRuntime,
+  type RuntimeApiResponseMeta,
+} from './app-runtime-api';
 import {
   parseExecuteServerTiming,
   type ExecuteServerTiming,
@@ -2694,6 +2697,7 @@ type ScalarPlayAuthoringRuntimeContext = Pick<
   PlayAuthoringRuntimeContext,
   | 'tools'
   | 'customerDb'
+  | 'billing'
   | 'run'
   | 'tool'
   | 'step'
@@ -3275,6 +3279,18 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     },
   };
 
+  readonly billing = {
+    entitlements: () => {
+      this.assertNoPendingDurableSuspension();
+      return getBillingEntitlementsViaAppRuntime({
+        baseUrl: this.#options.baseUrl ?? '',
+        executorToken: this.#options.executorToken ?? '',
+        vercelProtectionBypassToken: this.#options.vercelProtectionBypassToken,
+        signal: this.#options.executionSignal,
+      });
+    },
+  };
+
   readonly secrets = {
     get: (name: string): PlaySecretPromise => {
       if (typeof name !== 'string' || !name.trim()) {

package/dist/bundling-sources/shared_libs/play-runtime/execution-capabilities.ts

@@ -4,6 +4,17 @@ import {
 } from './fixture-behavior';
 import { normalizeRuntimeSchedulerSchema } from './runtime-scheduler-topology';
 
+/** An optional restriction, never a grant of runtime authority. */
+export const MCP_EXECUTION_OPERATION_POLICY = 'mcp' as const;
+export const EXECUTION_OPERATION_POLICY_HEADER = 'x-deepline-operation-policy';
+export type ExecutionOperationPolicy = typeof MCP_EXECUTION_OPERATION_POLICY;
+
+export function isExecutionOperationPolicy(
+  value: unknown,
+): value is ExecutionOperationPolicy {
+  return value === MCP_EXECUTION_OPERATION_POLICY;
+}
+
 export const RUNTIME_EXECUTION_CAPABILITIES = [
   'artifact.read',
   'file.read',
@@ -36,6 +47,8 @@ const CAPABILITY_SET = new Set<string>(RUNTIME_EXECUTION_CAPABILITIES);
  * a bearer credential, so a scheduler can mint one short-lived token per leg.
  */
 export type RuntimeAuthorityDescriptor = {
+  /** Server-owned restriction inherited by every descendant and attempt. */
+  operationPolicy?: ExecutionOperationPolicy;
   orgId: string;
   workflowId: string;
   runId: string;
@@ -144,6 +157,8 @@ export function requireRuntimeAuthorityDescriptor(
       (entry) => typeof entry !== 'string' || entry.trim().length === 0,
     ) ||
     capabilities.length === 0 ||
+    (descriptor.operationPolicy !== undefined &&
+      !isExecutionOperationPolicy(descriptor.operationPolicy)) ||
     !fixtureBehavior.ok ||
     (fixtureBehavior.behavior !== null &&
       descriptor.integrationMode !== 'fixture')
@@ -153,6 +168,9 @@ export function requireRuntimeAuthorityDescriptor(
     );
   }
   return {
+    ...(descriptor.operationPolicy
+      ? { operationPolicy: descriptor.operationPolicy }
+      : {}),
     orgId: descriptor.orgId!,
     workflowId: descriptor.workflowId!,
     runId: descriptor.runId!,

package/dist/bundling-sources/shared_libs/play-runtime/internal-bootstrap-token.ts

@@ -1,5 +1,7 @@
 import { WORKFLOW_EXECUTOR_TOKEN_TTL_SECONDS } from './/runtime-constants';
 import {
+  isExecutionOperationPolicy,
+  type ExecutionOperationPolicy,
   DEFAULT_RUNTIME_EXECUTION_CAPABILITIES,
   isRuntimeExecutionCapability,
   normalizeRuntimeExecutionCapabilities,
@@ -303,6 +305,7 @@ type WorkflowInternalTokenBaseClaims = {
 export type WorkflowRunExecutionTokenClaims =
   WorkflowInternalTokenBaseClaims & {
     purpose: typeof INTERNAL_WORKFLOW_EXECUTION_PURPOSE;
+    operation_policy?: ExecutionOperationPolicy;
     workflow_id: string;
     run_id: string;
     // Billing owner for this execution. Defaults to run_id on older tokens and
@@ -642,6 +645,8 @@ function isValidWorkflowClaimsShape(
     (claims.fixture_behavior === undefined ||
       (claims.integration_mode === 'fixture' &&
         validateFixtureBehavior(claims.fixture_behavior).ok)) &&
+    (claims.operation_policy === undefined ||
+      isExecutionOperationPolicy(claims.operation_policy)) &&
     (claims.synthetic === undefined || claims.synthetic === true) &&
     (claims.actor_user_id === undefined ||
       typeof claims.actor_user_id === 'string') &&
@@ -737,6 +742,7 @@ export async function mintIngestionSubscriptionExecutionToken(input: {
 }
 
 export async function mintWorkflowRunExecutionToken(input: {
+  operationPolicy?: ExecutionOperationPolicy;
   orgId: string;
   workflowId: string;
   runId: string;
@@ -781,6 +787,9 @@ export async function mintWorkflowRunExecutionToken(input: {
     iss: INTERNAL_BOOTSTRAP_TOKEN_ISSUER,
     aud: INTERNAL_WORKFLOW_EXECUTION_AUDIENCE,
     purpose: INTERNAL_WORKFLOW_EXECUTION_PURPOSE,
+    ...(input.operationPolicy
+      ? { operation_policy: input.operationPolicy }
+      : {}),
     org_id: input.orgId,
     workflow_id: input.workflowId,
     run_id: input.runId,

package/dist/bundling-sources/shared_libs/play-runtime/runtime-authority.ts

@@ -2,6 +2,7 @@ import { mintWorkflowExecutorToken } from './/workflow-executor-auth';
 import {
   DEFAULT_RUNTIME_EXECUTION_CAPABILITIES,
   normalizeRuntimeExecutionCapabilities,
+  type ExecutionOperationPolicy,
   type RuntimeAuthorityDescriptor,
   type RuntimeExecutionCapability,
 } from './/execution-capabilities';
@@ -33,6 +34,9 @@ export function deriveAsyncChildRuntimeAuthority(input: {
   allowedSecrets: readonly string[];
 }): RuntimeAuthorityDescriptor {
   return {
+    ...(input.parent.operationPolicy
+      ? { operationPolicy: input.parent.operationPolicy }
+      : {}),
     orgId: input.parent.orgId,
     workflowId: input.workflowId,
     runId: input.runId,
@@ -85,6 +89,7 @@ export async function mintPlayRunRuntimeAuthorityDescriptor(input: {
 }
 
 export async function mintPlayRunRuntimeAuthority(input: {
+  operationPolicy?: ExecutionOperationPolicy;
   orgId: string;
   workflowId: string;
   runId: string;
@@ -104,6 +109,9 @@ export async function mintPlayRunRuntimeAuthority(input: {
   runLedgerIngressPrefixOrigin?: string | null;
 }): Promise<RuntimeAuthority> {
   const descriptor: RuntimeAuthorityDescriptor = {
+    ...(input.operationPolicy
+      ? { operationPolicy: input.operationPolicy }
+      : {}),
     orgId: input.orgId,
     workflowId: input.workflowId,
     runId: input.runId,
@@ -140,6 +148,9 @@ export function runtimeAuthorityMintInput(
   } = {},
 ) {
   return {
+    ...(descriptor.operationPolicy
+      ? { operationPolicy: descriptor.operationPolicy }
+      : {}),
     orgId: descriptor.orgId,
     workflowId: descriptor.workflowId,
     runId: descriptor.runId,

package/dist/bundling-sources/shared_libs/play-runtime/runtime-operation-contract.ts

@@ -71,6 +71,8 @@ export const RUNTIME_OPERATION_CAPABILITIES = {
   get_runtime_traffic_policy: 'rate.acquire',
   governor_budget_charge: 'budget.charge',
   resolve_secret: 'secret.resolve',
+  // Provider prices and availability use the existing discovery authority.
+  get_billing_entitlements: 'tool.inspect',
 } as const satisfies Readonly<Record<string, RuntimeExecutionCapability>>;
 
 export const RUNTIME_OPERATION_CONTRACT: DeployedOperationContract =
@@ -78,6 +80,10 @@ export const RUNTIME_OPERATION_CONTRACT: DeployedOperationContract =
     id: 'runtime-api-actions',
     actions: RUNTIME_OPERATION_CAPABILITIES,
     olderReceiver: {
+      get_billing_entitlements: {
+        kind: 'feature-unavailable',
+        code: 'BILLING_ENTITLEMENTS_UNAVAILABLE',
+      },
       project_run_events: {
         kind: 'equivalent-fallback',
         action: 'append_run_events',

package/dist/bundling-sources/shared_libs/play-runtime/workflow-executor-auth.ts

@@ -1,3 +1,4 @@
+import type { ExecutionOperationPolicy } from './execution-capabilities';
 import { mintWorkflowRunExecutionToken } from './internal-bootstrap-token';
 import type { RuntimeExecutionCapability } from './/execution-capabilities';
 import type { FixtureBehavior } from './/fixture-behavior';
@@ -99,6 +100,7 @@ export async function decryptWorkflowExecutorApiKey(
 }
 
 export async function mintWorkflowExecutorToken(input: {
+  operationPolicy?: ExecutionOperationPolicy;
   orgId: string;
   workflowId: string;
   runId: string;
@@ -121,6 +123,7 @@ export async function mintWorkflowExecutorToken(input: {
 }) {
   const playName = input.playName?.trim() || input.workflowId;
   return mintWorkflowRunExecutionToken({
+    operationPolicy: input.operationPolicy,
     orgId: input.orgId,
     workflowId: input.workflowId,
     runId: input.runId,

package/dist/bundling-sources/shared_libs/plays/authoring-contract.ts

@@ -1,3 +1,5 @@
+import type { BillingEntitlements } from '../integration-contracts/billing-entitlements';
+export type { BillingEntitlements } from '../integration-contracts/billing-entitlements';
 import { Type, type Static, type TSchema } from '@sinclair/typebox';
 import { Value } from '@sinclair/typebox/value';
 import type { PreviousCell } from './cell-staleness';
@@ -1481,6 +1483,15 @@ export const PLAY_AUTHORING_STATIC_FETCH_KEY_HINT =
 export interface PlayAuthoringRuntimeContext<
   TListGetter extends 'dataset' | 'array' = 'dataset',
 > {
+  billing: {
+    /**
+     * Read current workspace plan benefits. Execution rechecks admission;
+     * this read is fresh and is not a durable receipt.
+     * @sdkReference runtime 179 ctx.billing.entitlements()
+     */
+    entitlements(): Promise<BillingEntitlements>;
+  };
+
   /**
    * Load a staged CSV file as a durable dataset handle.
    * @sdkReference runtime 040 ctx.csv(path, options)
@@ -3315,7 +3326,9 @@ export const PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   '  run(options?: DatasetRunOptions<InputRow>): Promise<PlayDataset<OutputRow>>;',
   '};',
   'export type PlayReferenceLike<TInput extends Record<string, unknown> = Record<string, unknown>> = ({ readonly playName: string; readonly name?: string } | { readonly name: string; readonly playName?: string }) & { readonly __inputType?: TInput };',
+  "export type BillingEntitlements = { org_id: string; as_of: number; plan: { sku: string; name: string; catalog_revision: string | null; included_credits: number; interval: 'month' | 'year' | null } | null; benefits: { quickenrichUnlimited?: { status: 'active' | 'past_due'; value: { enabled: boolean; requestsPerMinute: number }; expiresAt?: number } }; effective_limits: { quickenrichUnlimited?: { baseline: number; effective: number; source: 'plan' | 'override'; override_expires_at?: number } } };",
   'export interface DeeplinePlayRuntimeContext {',
+  '  billing: { entitlements(): Promise<BillingEntitlements> };',
   '  csv<T = Record<string, unknown>>(path: string | CsvInput<T & object>, options?: CsvOptions): Promise<PlayDataset<T>>;',
   '  dataset<TSource extends PlayDatasetInput<object>>(key: string, items: TSource): DatasetBuilder<PlayDatasetRow<TSource> & object, PlayDatasetRow<TSource> & object>;',
   '  map<TSource extends PlayDatasetInput<object>>(key: string, items: TSource, options?: DatasetDefinitionOptions<PlayDatasetRow<TSource> & object>): never;',

package/dist/cli/{auth-RWP45MJX.mjs → auth-ME53BGXD.mjs}

@@ -9,11 +9,11 @@ import {
   registerAuthCommands,
   reportSetupCompleted,
   resolvePendingAuthClaimForResume
-} from "./chunk-Y6D2JYBR.mjs";
-import "./chunk-SFJEAK54.mjs";
-import "./chunk-PQGDU7B5.mjs";
+} from "./chunk-5UWZ52IW.mjs";
+import "./chunk-5AZNXX2S.mjs";
+import "./chunk-VWSEZMCR.mjs";
 import "./chunk-DLIRSHV6.mjs";
-import "./chunk-AOKWJJLP.mjs";
+import "./chunk-2G7KMDDI.mjs";
 import "./chunk-NXGCO4JB.mjs";
 import "./chunk-WZYKRD7T.mjs";
 import "./chunk-KRD6H754.mjs";

package/dist/cli/auth-YHS2NN4I.js

@@ -0,0 +1,31 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+
+
+
+
+
+
+
+var _chunk4JJN7BDIjs = require('./chunk-4JJN7BDI.js');
+require('./chunk-EWYHXSV4.js');
+require('./chunk-GVJPI7MB.js');
+require('./chunk-XNYIZMNQ.js');
+require('./chunk-PQZURAHR.js');
+require('./chunk-7P5AA3SN.js');
+require('./chunk-OG64RBAC.js');
+require('./chunk-COGTRVWW.js');
+
+
+
+
+
+
+
+
+
+
+
+exports.EXIT_WORKSPACE_MISMATCH = _chunk4JJN7BDIjs.EXIT_WORKSPACE_MISMATCH; exports.clearPendingClaim = _chunk4JJN7BDIjs.clearPendingClaim; exports.clearSatisfiedPendingClaim = _chunk4JJN7BDIjs.clearSatisfiedPendingClaim; exports.handleRegister = _chunk4JJN7BDIjs.handleRegister; exports.handleStatus = _chunk4JJN7BDIjs.handleStatus; exports.handleWait = _chunk4JJN7BDIjs.handleWait; exports.readPendingAuthClaim = _chunk4JJN7BDIjs.readPendingAuthClaim; exports.registerAuthCommands = _chunk4JJN7BDIjs.registerAuthCommands; exports.reportSetupCompleted = _chunk4JJN7BDIjs.reportSetupCompleted; exports.resolvePendingAuthClaimForResume = _chunk4JJN7BDIjs.resolvePendingAuthClaimForResume;

package/dist/cli/{billing-XPKHI4LF.mjs → billing-466LUN65.mjs}

@@ -2,7 +2,7 @@ import {
   DeeplineClient,
   iterateCursorPages,
   requireBillingIdempotencyKey
-} from "./chunk-AYR45POY.mjs";
+} from "./chunk-35PLGSH6.mjs";
 import "./chunk-CBVIJSHF.mjs";
 import {
   createTimestampedName,
@@ -10,13 +10,13 @@ import {
   openInBrowser,
   printCommandEnvelope,
   shouldEmitJson
-} from "./chunk-SFJEAK54.mjs";
+} from "./chunk-5AZNXX2S.mjs";
 import {
   AuthError,
   ConfigError
-} from "./chunk-PQGDU7B5.mjs";
+} from "./chunk-VWSEZMCR.mjs";
 import "./chunk-DLIRSHV6.mjs";
-import "./chunk-AOKWJJLP.mjs";
+import "./chunk-2G7KMDDI.mjs";
 import "./chunk-6IKARAYD.mjs";
 import {
   DeeplineError
@@ -1131,6 +1131,32 @@ async function handleTargetStatus(options) {
     { json: options.json }
   );
 }
+async function handleEntitlements(options) {
+  const payload = await new DeeplineClient().billing.entitlements();
+  printCommandEnvelope(
+    {
+      ok: true,
+      ...payload,
+      render: {
+        sections: [
+          {
+            title: "billing entitlements",
+            lines: [
+              `Plan: ${payload.plan?.name ?? "Legacy billing"}`,
+              ...Object.entries(payload.benefits).map(
+                ([key, grant]) => `${key}: ${grant.status}, ${JSON.stringify(grant.value)}${grant.expiresAt === void 0 ? "" : `, expires ${new Date(grant.expiresAt).toISOString()}`}`
+              ),
+              ...Object.entries(payload.effective_limits).map(
+                ([key, limit]) => `${key} rate: ${limit.effective}/minute (${limit.source}; plan baseline ${limit.baseline})`
+              )
+            ]
+          }
+        ]
+      }
+    },
+    { json: options.json }
+  );
+}
 async function handleAutoRechargeStatus(options) {
   const payload = await new DeeplineClient().billing.autoRecharge.get();
   const state = payload.available ? payload.enabled ? "on" : "off" : "unavailable";
@@ -1616,6 +1642,7 @@ Examples:
   billing.command("status").description(
     "Show plan, payment, and recharge state; use usage for charges."
   ).option("--json", "Emit JSON output").action(handleTargetStatus);
+  billing.command("entitlements").description("Show current workspace benefits and effective rate limits.").option("--json", "Emit JSON output").action(handleEntitlements);
   billing.command("auto-recharge").description("Inspect and manage automatic Deepline credit recharge.").addHelpText(
     "after",
     `