deepline 0.3.347 → 0.3.349

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (125) hide show
  1. package/dist/bundling-sources/sdk/src/client.ts +5 -0
  2. package/dist/bundling-sources/sdk/src/index.ts +1 -0
  3. package/dist/bundling-sources/sdk/src/release.ts +1 -1
  4. package/dist/bundling-sources/shared_libs/integration-contracts/billing-entitlements.ts +29 -0
  5. package/dist/bundling-sources/shared_libs/play-runtime/app-runtime-api.ts +32 -1
  6. package/dist/bundling-sources/shared_libs/play-runtime/context.ts +17 -1
  7. package/dist/bundling-sources/shared_libs/play-runtime/execution-capabilities.ts +18 -0
  8. package/dist/bundling-sources/shared_libs/play-runtime/internal-bootstrap-token.ts +9 -0
  9. package/dist/bundling-sources/shared_libs/play-runtime/runtime-authority.ts +11 -0
  10. package/dist/bundling-sources/shared_libs/play-runtime/runtime-operation-contract.ts +6 -0
  11. package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/postgres.ts +38 -13
  12. package/dist/bundling-sources/shared_libs/play-runtime/workflow-executor-auth.ts +3 -0
  13. package/dist/bundling-sources/shared_libs/plays/authoring-contract.ts +13 -0
  14. package/dist/bundling-sources/shared_libs/product-notifications/billing-sales.ts +1 -1
  15. package/dist/bundling-sources/shared_libs/product-notifications/catalog.ts +1 -1
  16. package/dist/bundling-sources/shared_libs/product-notifications/events.ts +5 -1
  17. package/dist/cli/auth-KGXZELZ3.js +31 -0
  18. package/dist/cli/{auth-RWP45MJX.mjs → auth-MPHXSP64.mjs} +4 -4
  19. package/dist/cli/{billing-F6RNSQWW.js → billing-2KUUGVDZ.js} +99 -72
  20. package/dist/cli/{billing-XPKHI4LF.mjs → billing-K5WCTRBE.mjs} +31 -4
  21. package/dist/cli/{chunk-FKKNYKDY.js → chunk-5O4B6AUN.js} +2 -0
  22. package/dist/cli/{chunk-AOKWJJLP.mjs → chunk-6OVLJLYH.mjs} +1 -1
  23. package/dist/cli/{chunk-GS2ZSOAQ.js → chunk-6YZDQZE6.js} +2 -2
  24. package/dist/cli/{chunk-NTVTZAVZ.mjs → chunk-7E66A24V.mjs} +2 -0
  25. package/dist/cli/{chunk-VRYRVD3F.mjs → chunk-BEGPN6NG.mjs} +1 -1
  26. package/dist/cli/{chunk-X32ZLEUU.mjs → chunk-BPJTGASI.mjs} +2 -2
  27. package/dist/cli/{chunk-AGV2VS4U.js → chunk-CRSMVSER.js} +54 -54
  28. package/dist/cli/{chunk-NU5EU2SH.mjs → chunk-DOHULRK2.mjs} +4 -4
  29. package/dist/cli/{chunk-IIOBMOMH.mjs → chunk-DSWSEHRX.mjs} +1 -1
  30. package/dist/cli/{chunk-ROEN4NXY.js → chunk-GHYMVZID.js} +60 -60
  31. package/dist/cli/{chunk-Y6D2JYBR.mjs → chunk-GXN7DGNL.mjs} +2 -2
  32. package/dist/cli/{chunk-LH4VHCN5.mjs → chunk-HVD3DK7S.mjs} +6 -6
  33. package/dist/cli/{chunk-BUXJSW26.js → chunk-I4VZKXMX.js} +26 -26
  34. package/dist/cli/{chunk-EOS73ZCP.js → chunk-IHYVEM5Q.js} +8 -8
  35. package/dist/cli/{chunk-5UJOJKPW.js → chunk-JBGR6U57.js} +4 -4
  36. package/dist/cli/{chunk-PQGDU7B5.mjs → chunk-JKJSTQ2I.mjs} +1 -1
  37. package/dist/cli/{chunk-L4TXOCCC.js → chunk-KW25DKRC.js} +1 -1
  38. package/dist/cli/{chunk-LPKV6IBM.js → chunk-M42H2BPA.js} +8 -8
  39. package/dist/cli/{chunk-3PRBUTJK.js → chunk-MVQ3JAJA.js} +242 -242
  40. package/dist/cli/{chunk-LTJOC47W.mjs → chunk-O2FM2MS5.mjs} +7 -7
  41. package/dist/cli/{chunk-GT7OCAWV.js → chunk-QAM2K3CG.js} +48 -48
  42. package/dist/cli/{chunk-JB4UKD3B.js → chunk-QCSLIEMC.js} +6 -6
  43. package/dist/cli/{chunk-OJVAVQLB.js → chunk-QGKPTBRR.js} +3 -3
  44. package/dist/cli/{chunk-723POEH5.js → chunk-S347PHNB.js} +10 -9
  45. package/dist/cli/{chunk-U2GPF4SB.mjs → chunk-SPB6CF4S.mjs} +2 -2
  46. package/dist/cli/{chunk-WX7W76U7.js → chunk-TVS3TAFR.js} +15 -15
  47. package/dist/cli/{chunk-OS6CZRJE.mjs → chunk-UE7DS2YV.mjs} +3 -3
  48. package/dist/cli/{chunk-AYR45POY.mjs → chunk-VDOH4A34.mjs} +2 -1
  49. package/dist/cli/{chunk-3JJLQQLW.mjs → chunk-WOFHIUOT.mjs} +2 -2
  50. package/dist/cli/{chunk-SFJEAK54.mjs → chunk-ZQ6UF55Y.mjs} +1 -1
  51. package/dist/cli/{client-FZJ3RSO3.mjs → client-JWKYNLCR.mjs} +3 -3
  52. package/dist/cli/client-O4DPNWVJ.js +20 -0
  53. package/dist/cli/{csv-QSMT5HZS.js → csv-IW75DRFX.js} +12 -12
  54. package/dist/cli/{csv-HPBPBU3I.mjs → csv-Y2O237NO.mjs} +3 -3
  55. package/dist/cli/{db-IKZKICP3.js → db-6Q4VK5T2.js} +29 -29
  56. package/dist/cli/{db-2KAUAVVC.mjs → db-JW6UUJXC.mjs} +4 -4
  57. package/dist/cli/{describe-QM7Q5Y2H.js → describe-DI65QISF.js} +17 -17
  58. package/dist/cli/{describe-EW4GZMUK.mjs → describe-JLN4RTGM.mjs} +10 -10
  59. package/dist/cli/{executions-5ICONLFX.js → executions-GB2E3BU6.js} +6 -6
  60. package/dist/cli/{executions-U5WWUFEZ.mjs → executions-UK6LA2O5.mjs} +4 -4
  61. package/dist/cli/{feedback-N2KGAK4V.js → feedback-MJE3A5ON.js} +7 -7
  62. package/dist/cli/{feedback-ZBQPQPFG.mjs → feedback-N2KAFS3R.mjs} +3 -3
  63. package/dist/cli/git-A7J4SSRV.js +23 -0
  64. package/dist/cli/{git-M5YEP57H.mjs → git-NWRJFNII.mjs} +4 -4
  65. package/dist/cli/index.js +79 -79
  66. package/dist/cli/index.mjs +31 -31
  67. package/dist/cli/{legacy-noops-IQIPPJF7.js → legacy-noops-EIO65N6W.js} +7 -7
  68. package/dist/cli/{legacy-noops-GJUYBH2F.mjs → legacy-noops-RR4W2TTE.mjs} +4 -4
  69. package/dist/cli/{monitors-XJAJNMG4.mjs → monitors-HNUCJYET.mjs} +4 -4
  70. package/dist/cli/{monitors-DQUCHISX.js → monitors-U7NVJDQL.js} +85 -85
  71. package/dist/cli/{org-DFWDN4EJ.mjs → org-O7MFRQNG.mjs} +4 -4
  72. package/dist/cli/{org-G45CXUJV.js → org-UBHNTBSB.js} +60 -60
  73. package/dist/cli/{play-URTZW2Q4.mjs → play-4EIIEFQK.mjs} +9 -9
  74. package/dist/cli/play-IHLNNVPR.js +153 -0
  75. package/dist/cli/{providers-IVUWWGFP.js → providers-CJ56HZIT.js} +7 -7
  76. package/dist/cli/{providers-CCKMRCXU.mjs → providers-REJIT7CX.mjs} +4 -4
  77. package/dist/cli/{quickstart-MMIVNRV4.js → quickstart-BZUQWQK5.js} +5 -5
  78. package/dist/cli/{quickstart-CRHIA3PZ.mjs → quickstart-DQN2LYBC.mjs} +3 -3
  79. package/dist/cli/{search-NDRDOINX.mjs → search-35UOMFL2.mjs} +5 -5
  80. package/dist/cli/search-4EPCIU2T.js +26 -0
  81. package/dist/cli/{secrets-GQUBMJGM.js → secrets-G4RYNUUD.js} +13 -13
  82. package/dist/cli/{secrets-SUC3KLLH.mjs → secrets-YJB66UXU.mjs} +4 -4
  83. package/dist/cli/{sessions-7CAU6JL5.mjs → sessions-BUWSRUSJ.mjs} +4 -4
  84. package/dist/cli/{sessions-AQCRVLHW.js → sessions-DGS7S6XX.js} +5 -5
  85. package/dist/cli/{settings-LFFOFAU6.mjs → settings-OCMJXIFD.mjs} +7 -7
  86. package/dist/cli/{settings-4SDI73XW.js → settings-OTWDMCM5.js} +74 -74
  87. package/dist/cli/{setup-FQ3E7U7G.js → setup-MYD34DUG.js} +41 -41
  88. package/dist/cli/{setup-BKCQOJBD.mjs → setup-UXYFRGIX.mjs} +6 -6
  89. package/dist/cli/skills-7UHWU7XL.js +28 -0
  90. package/dist/cli/{skills-USGJ5MF7.mjs → skills-LOWITZWQ.mjs} +4 -4
  91. package/dist/cli/tools-CBYKQ7IY.js +40 -0
  92. package/dist/cli/{tools-5HTXLDZ4.mjs → tools-YJHZJLES.mjs} +7 -7
  93. package/dist/cli/update-5M3OKPEU.js +28 -0
  94. package/dist/cli/{update-F7TIJEIV.mjs → update-PB5UCW4I.mjs} +6 -6
  95. package/dist/cli/{workflow-J5JVOUIL.js → workflow-DJYTA2YM.js} +15 -15
  96. package/dist/cli/{workflow-FXJ2D2MG.mjs → workflow-IH2FQSYZ.mjs} +5 -5
  97. package/dist/{client-rHyf5s_Y.d.ts → client-4DbE-U6e.d.ts} +3 -1
  98. package/dist/{client-D20uyRYB.d.mts → client-DIJpwhl-.d.mts} +3 -1
  99. package/dist/{compiler-manifest-CButyeZ8.d.ts → compiler-manifest-DgdW0q0b.d.mts} +42 -1
  100. package/dist/{compiler-manifest-CButyeZ8.d.mts → compiler-manifest-DgdW0q0b.d.ts} +42 -1
  101. package/dist/{index-BMsNUoL5.d.mts → index-C3nQQTI-.d.mts} +1 -1
  102. package/dist/{index-LDRzwo09.d.ts → index-CEYQAfS0.d.ts} +1 -1
  103. package/dist/index.d.mts +6 -6
  104. package/dist/index.d.ts +6 -6
  105. package/dist/index.js +7 -7
  106. package/dist/index.mjs +4 -4
  107. package/dist/install-integrity.json +85 -84
  108. package/dist/plays/bundle-play-file.d.mts +3 -3
  109. package/dist/plays/bundle-play-file.d.ts +3 -3
  110. package/dist/plays/bundle-play-file.mjs +2 -2
  111. package/dist/plays/run-request.d.mts +2 -2
  112. package/dist/plays/run-request.d.ts +2 -2
  113. package/dist/release.d.mts +1 -1
  114. package/dist/release.d.ts +1 -1
  115. package/dist/release.js +2 -2
  116. package/dist/release.mjs +1 -1
  117. package/package.json +1 -1
  118. package/dist/cli/auth-PSMCNXBC.js +0 -31
  119. package/dist/cli/client-J4QGSQ6Y.js +0 -20
  120. package/dist/cli/git-2N5LS25H.js +0 -23
  121. package/dist/cli/play-WWMUYKWS.js +0 -153
  122. package/dist/cli/search-YZL2QRIF.js +0 -26
  123. package/dist/cli/skills-7BPEGDIA.js +0 -28
  124. package/dist/cli/tools-5VEZ4QR4.js +0 -40
  125. package/dist/cli/update-YFPMWKI4.js +0 -28
@@ -1,3 +1,5 @@
1
+ import type { BillingEntitlements } from '../../shared_libs/integration-contracts/billing-entitlements';
2
+ export type { BillingEntitlements } from '../../shared_libs/integration-contracts/billing-entitlements';
1
3
  import type {
2
4
  PlaySettingsResult,
3
5
  PlaySettingsPatch,
@@ -2495,6 +2497,8 @@ export type BillingUsageResult = {
2495
2497
  * @sdkReference client 030 client.billing
2496
2498
  */
2497
2499
  export type BillingNamespace = {
2500
+ /** Current workspace provider benefits; discovery does not authorize a call. */
2501
+ entitlements: () => Promise<BillingEntitlements>;
2498
2502
  /** Charge the saved payment method and add Deepline credits to the active workspace. */
2499
2503
  topUp: (options: {
2500
2504
  credits: number;
@@ -2914,6 +2918,7 @@ export class DeeplineClient {
2914
2918
  planQuery: (input) => planCustomerDbQuery(input),
2915
2919
  };
2916
2920
  this.billing = {
2921
+ entitlements: () => this.http.get('/api/v2/billing/entitlements'),
2917
2922
  topUp: (options) => this.topUpBillingBalance(options),
2918
2923
  topUpWithReceipt: (options) =>
2919
2924
  this.topUpBillingBalanceWithReceipt(options),
@@ -1,3 +1,4 @@
1
+ export type { BillingEntitlements } from '../../shared_libs/integration-contracts/billing-entitlements';
1
2
  export type {
2
3
  PlaySettings,
3
4
  PlayPath,
@@ -200,7 +200,7 @@ export const SDK_RELEASE = {
200
200
  // getters keep their established compatibility behavior.
201
201
  // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
202
202
  // 0.3.90 is the first deliberately versioned SDK release for API v3.
203
- version: '0.3.347',
203
+ version: '0.3.349',
204
204
  updateSummary:
205
205
  'Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.',
206
206
  packageCapabilities: {
@@ -0,0 +1,29 @@
1
+ /** Customer-visible discovery data; execution always rechecks admission. */
2
+ export type BillingEntitlements = {
3
+ org_id: string;
4
+ as_of: number;
5
+ /** The held commercial plan or existing legacy billing catalog plan. */
6
+ plan: {
7
+ sku: string;
8
+ name: string;
9
+ catalog_revision: string | null;
10
+ included_credits: number;
11
+ interval: 'month' | 'year' | null;
12
+ } | null;
13
+ benefits: {
14
+ quickenrichUnlimited?: {
15
+ status: 'active' | 'past_due';
16
+ value: { enabled: boolean; requestsPerMinute: number };
17
+ expiresAt?: number;
18
+ };
19
+ };
20
+ /** Configuration provenance is separate from the purchased promise. */
21
+ effective_limits: {
22
+ quickenrichUnlimited?: {
23
+ baseline: number;
24
+ effective: number;
25
+ source: 'plan' | 'override';
26
+ override_expires_at?: number;
27
+ };
28
+ };
29
+ };
@@ -9,7 +9,10 @@ import { stat } from 'node:fs/promises';
9
9
  import { Readable } from 'node:stream';
10
10
  import { pipeline } from 'node:stream/promises';
11
11
  import type { PlaySheetContract } from '../plays/static-pipeline';
12
- import type { AsyncPlayRunRef } from '../plays/authoring-contract';
12
+ import type {
13
+ AsyncPlayRunRef,
14
+ BillingEntitlements,
15
+ } from '../plays/authoring-contract';
13
16
  import type { PlayRowUpdate } from './/ctx-types';
14
17
  import type { PlayRunTimelineEntry } from './/live-events';
15
18
  import type { PlayDatasetBornFrom } from './/cell-provenance';
@@ -361,6 +364,7 @@ type RuntimeApiRequest =
361
364
  | ({
362
365
  action: 'governor_budget_charge';
363
366
  } & PlayRunnerBudgetChargeInput)
367
+ | { action: 'get_billing_entitlements' }
364
368
  | { action: 'get_runtime_traffic_policy' }
365
369
  | RuntimeReceiptAction;
366
370
 
@@ -2162,6 +2166,33 @@ export async function chargeGovernorBudgetViaAppRuntime(
2162
2166
  });
2163
2167
  }
2164
2168
 
2169
+ export async function getBillingEntitlementsViaAppRuntime(
2170
+ context: WorkerRuntimeApiContext,
2171
+ ): Promise<BillingEntitlements> {
2172
+ try {
2173
+ return await postAppRuntimeApi<BillingEntitlements>(context, {
2174
+ action: 'get_billing_entitlements',
2175
+ });
2176
+ } catch (error) {
2177
+ if (
2178
+ error instanceof AppRuntimeApiResponseError &&
2179
+ error.status === 403 &&
2180
+ error.code === null &&
2181
+ error.detail === 'Unsupported runtime action capability scope.'
2182
+ ) {
2183
+ throw new AppRuntimeApiResponseError({
2184
+ action: 'get_billing_entitlements',
2185
+ status: 503,
2186
+ code: 'BILLING_ENTITLEMENTS_UNAVAILABLE',
2187
+ retryable: false,
2188
+ detail:
2189
+ 'The app runtime receiver does not support billing entitlements.',
2190
+ });
2191
+ }
2192
+ throw error;
2193
+ }
2194
+ }
2195
+
2165
2196
  export async function getRuntimeTrafficPolicyViaAppRuntime(
2166
2197
  context: WorkerRuntimeApiContext,
2167
2198
  ): Promise<RuntimeTrafficPolicy> {
@@ -39,7 +39,10 @@ import {
39
39
  } from './batch-runtime';
40
40
  import type { CompiledRequestBatch } from './batch-runtime';
41
41
  import type { AnyBatchOperationStrategy } from './batching-types';
42
- import type { RuntimeApiResponseMeta } from './app-runtime-api';
42
+ import {
43
+ getBillingEntitlementsViaAppRuntime,
44
+ type RuntimeApiResponseMeta,
45
+ } from './app-runtime-api';
43
46
  import {
44
47
  parseExecuteServerTiming,
45
48
  type ExecuteServerTiming,
@@ -2694,6 +2697,7 @@ type ScalarPlayAuthoringRuntimeContext = Pick<
2694
2697
  PlayAuthoringRuntimeContext,
2695
2698
  | 'tools'
2696
2699
  | 'customerDb'
2700
+ | 'billing'
2697
2701
  | 'run'
2698
2702
  | 'tool'
2699
2703
  | 'step'
@@ -3275,6 +3279,18 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
3275
3279
  },
3276
3280
  };
3277
3281
 
3282
+ readonly billing = {
3283
+ entitlements: () => {
3284
+ this.assertNoPendingDurableSuspension();
3285
+ return getBillingEntitlementsViaAppRuntime({
3286
+ baseUrl: this.#options.baseUrl ?? '',
3287
+ executorToken: this.#options.executorToken ?? '',
3288
+ vercelProtectionBypassToken: this.#options.vercelProtectionBypassToken,
3289
+ signal: this.#options.executionSignal,
3290
+ });
3291
+ },
3292
+ };
3293
+
3278
3294
  readonly secrets = {
3279
3295
  get: (name: string): PlaySecretPromise => {
3280
3296
  if (typeof name !== 'string' || !name.trim()) {
@@ -4,6 +4,17 @@ import {
4
4
  } from './fixture-behavior';
5
5
  import { normalizeRuntimeSchedulerSchema } from './runtime-scheduler-topology';
6
6
 
7
+ /** An optional restriction, never a grant of runtime authority. */
8
+ export const MCP_EXECUTION_OPERATION_POLICY = 'mcp' as const;
9
+ export const EXECUTION_OPERATION_POLICY_HEADER = 'x-deepline-operation-policy';
10
+ export type ExecutionOperationPolicy = typeof MCP_EXECUTION_OPERATION_POLICY;
11
+
12
+ export function isExecutionOperationPolicy(
13
+ value: unknown,
14
+ ): value is ExecutionOperationPolicy {
15
+ return value === MCP_EXECUTION_OPERATION_POLICY;
16
+ }
17
+
7
18
  export const RUNTIME_EXECUTION_CAPABILITIES = [
8
19
  'artifact.read',
9
20
  'file.read',
@@ -36,6 +47,8 @@ const CAPABILITY_SET = new Set<string>(RUNTIME_EXECUTION_CAPABILITIES);
36
47
  * a bearer credential, so a scheduler can mint one short-lived token per leg.
37
48
  */
38
49
  export type RuntimeAuthorityDescriptor = {
50
+ /** Server-owned restriction inherited by every descendant and attempt. */
51
+ operationPolicy?: ExecutionOperationPolicy;
39
52
  orgId: string;
40
53
  workflowId: string;
41
54
  runId: string;
@@ -144,6 +157,8 @@ export function requireRuntimeAuthorityDescriptor(
144
157
  (entry) => typeof entry !== 'string' || entry.trim().length === 0,
145
158
  ) ||
146
159
  capabilities.length === 0 ||
160
+ (descriptor.operationPolicy !== undefined &&
161
+ !isExecutionOperationPolicy(descriptor.operationPolicy)) ||
147
162
  !fixtureBehavior.ok ||
148
163
  (fixtureBehavior.behavior !== null &&
149
164
  descriptor.integrationMode !== 'fixture')
@@ -153,6 +168,9 @@ export function requireRuntimeAuthorityDescriptor(
153
168
  );
154
169
  }
155
170
  return {
171
+ ...(descriptor.operationPolicy
172
+ ? { operationPolicy: descriptor.operationPolicy }
173
+ : {}),
156
174
  orgId: descriptor.orgId!,
157
175
  workflowId: descriptor.workflowId!,
158
176
  runId: descriptor.runId!,
@@ -1,5 +1,7 @@
1
1
  import { WORKFLOW_EXECUTOR_TOKEN_TTL_SECONDS } from './/runtime-constants';
2
2
  import {
3
+ isExecutionOperationPolicy,
4
+ type ExecutionOperationPolicy,
3
5
  DEFAULT_RUNTIME_EXECUTION_CAPABILITIES,
4
6
  isRuntimeExecutionCapability,
5
7
  normalizeRuntimeExecutionCapabilities,
@@ -303,6 +305,7 @@ type WorkflowInternalTokenBaseClaims = {
303
305
  export type WorkflowRunExecutionTokenClaims =
304
306
  WorkflowInternalTokenBaseClaims & {
305
307
  purpose: typeof INTERNAL_WORKFLOW_EXECUTION_PURPOSE;
308
+ operation_policy?: ExecutionOperationPolicy;
306
309
  workflow_id: string;
307
310
  run_id: string;
308
311
  // Billing owner for this execution. Defaults to run_id on older tokens and
@@ -642,6 +645,8 @@ function isValidWorkflowClaimsShape(
642
645
  (claims.fixture_behavior === undefined ||
643
646
  (claims.integration_mode === 'fixture' &&
644
647
  validateFixtureBehavior(claims.fixture_behavior).ok)) &&
648
+ (claims.operation_policy === undefined ||
649
+ isExecutionOperationPolicy(claims.operation_policy)) &&
645
650
  (claims.synthetic === undefined || claims.synthetic === true) &&
646
651
  (claims.actor_user_id === undefined ||
647
652
  typeof claims.actor_user_id === 'string') &&
@@ -737,6 +742,7 @@ export async function mintIngestionSubscriptionExecutionToken(input: {
737
742
  }
738
743
 
739
744
  export async function mintWorkflowRunExecutionToken(input: {
745
+ operationPolicy?: ExecutionOperationPolicy;
740
746
  orgId: string;
741
747
  workflowId: string;
742
748
  runId: string;
@@ -781,6 +787,9 @@ export async function mintWorkflowRunExecutionToken(input: {
781
787
  iss: INTERNAL_BOOTSTRAP_TOKEN_ISSUER,
782
788
  aud: INTERNAL_WORKFLOW_EXECUTION_AUDIENCE,
783
789
  purpose: INTERNAL_WORKFLOW_EXECUTION_PURPOSE,
790
+ ...(input.operationPolicy
791
+ ? { operation_policy: input.operationPolicy }
792
+ : {}),
784
793
  org_id: input.orgId,
785
794
  workflow_id: input.workflowId,
786
795
  run_id: input.runId,
@@ -2,6 +2,7 @@ import { mintWorkflowExecutorToken } from './/workflow-executor-auth';
2
2
  import {
3
3
  DEFAULT_RUNTIME_EXECUTION_CAPABILITIES,
4
4
  normalizeRuntimeExecutionCapabilities,
5
+ type ExecutionOperationPolicy,
5
6
  type RuntimeAuthorityDescriptor,
6
7
  type RuntimeExecutionCapability,
7
8
  } from './/execution-capabilities';
@@ -33,6 +34,9 @@ export function deriveAsyncChildRuntimeAuthority(input: {
33
34
  allowedSecrets: readonly string[];
34
35
  }): RuntimeAuthorityDescriptor {
35
36
  return {
37
+ ...(input.parent.operationPolicy
38
+ ? { operationPolicy: input.parent.operationPolicy }
39
+ : {}),
36
40
  orgId: input.parent.orgId,
37
41
  workflowId: input.workflowId,
38
42
  runId: input.runId,
@@ -85,6 +89,7 @@ export async function mintPlayRunRuntimeAuthorityDescriptor(input: {
85
89
  }
86
90
 
87
91
  export async function mintPlayRunRuntimeAuthority(input: {
92
+ operationPolicy?: ExecutionOperationPolicy;
88
93
  orgId: string;
89
94
  workflowId: string;
90
95
  runId: string;
@@ -104,6 +109,9 @@ export async function mintPlayRunRuntimeAuthority(input: {
104
109
  runLedgerIngressPrefixOrigin?: string | null;
105
110
  }): Promise<RuntimeAuthority> {
106
111
  const descriptor: RuntimeAuthorityDescriptor = {
112
+ ...(input.operationPolicy
113
+ ? { operationPolicy: input.operationPolicy }
114
+ : {}),
107
115
  orgId: input.orgId,
108
116
  workflowId: input.workflowId,
109
117
  runId: input.runId,
@@ -140,6 +148,9 @@ export function runtimeAuthorityMintInput(
140
148
  } = {},
141
149
  ) {
142
150
  return {
151
+ ...(descriptor.operationPolicy
152
+ ? { operationPolicy: descriptor.operationPolicy }
153
+ : {}),
143
154
  orgId: descriptor.orgId,
144
155
  workflowId: descriptor.workflowId,
145
156
  runId: descriptor.runId,
@@ -71,6 +71,8 @@ export const RUNTIME_OPERATION_CAPABILITIES = {
71
71
  get_runtime_traffic_policy: 'rate.acquire',
72
72
  governor_budget_charge: 'budget.charge',
73
73
  resolve_secret: 'secret.resolve',
74
+ // Provider prices and availability use the existing discovery authority.
75
+ get_billing_entitlements: 'tool.inspect',
74
76
  } as const satisfies Readonly<Record<string, RuntimeExecutionCapability>>;
75
77
 
76
78
  export const RUNTIME_OPERATION_CONTRACT: DeployedOperationContract =
@@ -78,6 +80,10 @@ export const RUNTIME_OPERATION_CONTRACT: DeployedOperationContract =
78
80
  id: 'runtime-api-actions',
79
81
  actions: RUNTIME_OPERATION_CAPABILITIES,
80
82
  olderReceiver: {
83
+ get_billing_entitlements: {
84
+ kind: 'feature-unavailable',
85
+ code: 'BILLING_ENTITLEMENTS_UNAVAILABLE',
86
+ },
81
87
  project_run_events: {
82
88
  kind: 'equivalent-fallback',
83
89
  action: 'append_run_events',
@@ -18712,6 +18712,40 @@ export async function readPostgresSchedulerOutboxNextDueAt(
18712
18712
  ): Promise<Date | null> {
18713
18713
  const result = await client.query<{ due_at: Date | string | null }>(
18714
18714
  `
18715
+ -- Discover only run identities before seeking each lane's causal head.
18716
+ -- Proving that every pending fact has no predecessor can be quadratic for
18717
+ -- a large receipt backlog, even while another replica drains that run.
18718
+ WITH pending_runs AS MATERIALIZED (
18719
+ SELECT DISTINCT pending.run_id
18720
+ FROM ${tableName('outbox', options)} AS pending
18721
+ WHERE pending.delivered_at IS NULL
18722
+ ), heads AS MATERIALIZED (
18723
+ SELECT pending_run.run_id, false AS search_only, head.*
18724
+ FROM pending_runs AS pending_run
18725
+ CROSS JOIN LATERAL (
18726
+ SELECT pending.created_at, pending.next_attempt_at,
18727
+ pending.failed_at, pending.lease_expires_at
18728
+ FROM ${tableName('outbox', options)} AS pending
18729
+ WHERE pending.run_id = pending_run.run_id
18730
+ AND pending.delivered_at IS NULL
18731
+ AND ${searchLaneSql('pending')} = false
18732
+ ORDER BY ${runLedgerOrderSql('pending')}
18733
+ LIMIT 1
18734
+ ) AS head
18735
+ UNION ALL
18736
+ SELECT pending_run.run_id, true AS search_only, head.*
18737
+ FROM pending_runs AS pending_run
18738
+ CROSS JOIN LATERAL (
18739
+ SELECT pending.created_at, pending.next_attempt_at,
18740
+ pending.failed_at, pending.lease_expires_at
18741
+ FROM ${tableName('outbox', options)} AS pending
18742
+ WHERE pending.run_id = pending_run.run_id
18743
+ AND pending.delivered_at IS NULL
18744
+ AND ${searchLaneSql('pending')} = true
18745
+ ORDER BY ${runLedgerOrderSql('pending')}
18746
+ LIMIT 1
18747
+ ) AS head
18748
+ )
18715
18749
  SELECT min(greatest(
18716
18750
  CASE
18717
18751
  WHEN lease_expires_at IS NOT NULL AND lease_expires_at > now()
@@ -18721,22 +18755,13 @@ export async function readPostgresSchedulerOutboxNextDueAt(
18721
18755
  (SELECT max(active.lease_expires_at)
18722
18756
  FROM ${tableName('outbox', options)} AS active
18723
18757
  WHERE active.run_id = candidate.run_id
18724
- AND ${searchLaneSql('active')} = ${searchLaneSql('candidate')}
18758
+ AND ${searchLaneSql('active')} = candidate.search_only
18725
18759
  AND active.delivered_at IS NULL AND active.lease_owner IS NOT NULL
18726
18760
  AND active.lease_expires_at > now())
18727
18761
  )) AS due_at
18728
- FROM ${tableName('outbox', options)} AS candidate
18729
- WHERE candidate.delivered_at IS NULL
18730
- AND candidate.failed_at IS NULL
18731
- -- Match the competing-consumer claim exactly. A successor blocked by
18732
- -- an older event must not create a zero-delay recovery spin.
18733
- AND NOT EXISTS (
18734
- SELECT 1
18735
- FROM ${tableName('outbox', options)} AS predecessor
18736
- WHERE predecessor.run_id = candidate.run_id
18737
- AND predecessor.delivered_at IS NULL
18738
- AND ${runLedgerPrecedesSql('predecessor', 'candidate')}
18739
- )
18762
+ FROM heads AS candidate
18763
+ -- A failed head quarantines its lane; never wake on its successor.
18764
+ WHERE candidate.failed_at IS NULL
18740
18765
  `,
18741
18766
  );
18742
18767
  const value = result.rows[0]?.due_at;
@@ -1,3 +1,4 @@
1
+ import type { ExecutionOperationPolicy } from './execution-capabilities';
1
2
  import { mintWorkflowRunExecutionToken } from './internal-bootstrap-token';
2
3
  import type { RuntimeExecutionCapability } from './/execution-capabilities';
3
4
  import type { FixtureBehavior } from './/fixture-behavior';
@@ -99,6 +100,7 @@ export async function decryptWorkflowExecutorApiKey(
99
100
  }
100
101
 
101
102
  export async function mintWorkflowExecutorToken(input: {
103
+ operationPolicy?: ExecutionOperationPolicy;
102
104
  orgId: string;
103
105
  workflowId: string;
104
106
  runId: string;
@@ -121,6 +123,7 @@ export async function mintWorkflowExecutorToken(input: {
121
123
  }) {
122
124
  const playName = input.playName?.trim() || input.workflowId;
123
125
  return mintWorkflowRunExecutionToken({
126
+ operationPolicy: input.operationPolicy,
124
127
  orgId: input.orgId,
125
128
  workflowId: input.workflowId,
126
129
  runId: input.runId,
@@ -1,3 +1,5 @@
1
+ import type { BillingEntitlements } from '../integration-contracts/billing-entitlements';
2
+ export type { BillingEntitlements } from '../integration-contracts/billing-entitlements';
1
3
  import { Type, type Static, type TSchema } from '@sinclair/typebox';
2
4
  import { Value } from '@sinclair/typebox/value';
3
5
  import type { PreviousCell } from './cell-staleness';
@@ -1481,6 +1483,15 @@ export const PLAY_AUTHORING_STATIC_FETCH_KEY_HINT =
1481
1483
  export interface PlayAuthoringRuntimeContext<
1482
1484
  TListGetter extends 'dataset' | 'array' = 'dataset',
1483
1485
  > {
1486
+ billing: {
1487
+ /**
1488
+ * Read current workspace plan benefits. Execution rechecks admission;
1489
+ * this read is fresh and is not a durable receipt.
1490
+ * @sdkReference runtime 179 ctx.billing.entitlements()
1491
+ */
1492
+ entitlements(): Promise<BillingEntitlements>;
1493
+ };
1494
+
1484
1495
  /**
1485
1496
  * Load a staged CSV file as a durable dataset handle.
1486
1497
  * @sdkReference runtime 040 ctx.csv(path, options)
@@ -3315,7 +3326,9 @@ export const PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
3315
3326
  ' run(options?: DatasetRunOptions<InputRow>): Promise<PlayDataset<OutputRow>>;',
3316
3327
  '};',
3317
3328
  'export type PlayReferenceLike<TInput extends Record<string, unknown> = Record<string, unknown>> = ({ readonly playName: string; readonly name?: string } | { readonly name: string; readonly playName?: string }) & { readonly __inputType?: TInput };',
3329
+ "export type BillingEntitlements = { org_id: string; as_of: number; plan: { sku: string; name: string; catalog_revision: string | null; included_credits: number; interval: 'month' | 'year' | null } | null; benefits: { quickenrichUnlimited?: { status: 'active' | 'past_due'; value: { enabled: boolean; requestsPerMinute: number }; expiresAt?: number } }; effective_limits: { quickenrichUnlimited?: { baseline: number; effective: number; source: 'plan' | 'override'; override_expires_at?: number } } };",
3318
3330
  'export interface DeeplinePlayRuntimeContext {',
3331
+ ' billing: { entitlements(): Promise<BillingEntitlements> };',
3319
3332
  ' csv<T = Record<string, unknown>>(path: string | CsvInput<T & object>, options?: CsvOptions): Promise<PlayDataset<T>>;',
3320
3333
  ' dataset<TSource extends PlayDatasetInput<object>>(key: string, items: TSource): DatasetBuilder<PlayDatasetRow<TSource> & object, PlayDatasetRow<TSource> & object>;',
3321
3334
  ' map<TSource extends PlayDatasetInput<object>>(key: string, items: TSource, options?: DatasetDefinitionOptions<PlayDatasetRow<TSource> & object>): never;',
@@ -2,7 +2,7 @@ export const BILLING_SALES_GROUP_KEY = 'shadow.billing-sales';
2
2
  export const BILLING_SALES_DESTINATION_KEY = 'shadow.billing-sales.slack';
3
3
  export const BILLING_SALES_SLACK_CHANNEL_ID = 'C0AGWVD2TNK';
4
4
  export const BILLING_SALES_CONNECTION_ID = 'platform-reporting-bot';
5
- export const BILLING_SALES_CREDIT_PURCHASE_MINIMUM_CENTS = 15_000;
5
+ export const BILLING_SALES_CREDIT_PURCHASE_MINIMUM_CENTS = 1;
6
6
  export const BILLING_PURCHASE_LATE_RULE_KEY = 'internal.billing.purchase_late';
7
7
  export const BILLING_SALES_RULE_KEYS: readonly string[] = [
8
8
  'internal.billing.credit_purchase',
@@ -773,7 +773,7 @@ const PRODUCT_NOTIFICATION_TYPE_REGISTRY = [
773
773
  },
774
774
  }),
775
775
  present: ({ payload }) => ({
776
- title: `Credit purchase: $${(Number(payload.amountPaidCents) / 100).toFixed(2)}`,
776
+ title: `${payload.isFirstPurchase === true ? '🎉 First credit purchase' : 'Credit purchase'}: $${(Number(payload.amountPaidCents) / 100).toFixed(2)}`,
777
777
  summary: [
778
778
  { workspace: true },
779
779
  ` purchased ${formatCredits(Number(payload.credits))} credits.`,
@@ -209,7 +209,11 @@ export const PRODUCT_NOTIFICATION_EVENT_DEFINITIONS: readonly ProductNotificatio
209
209
  credits: 'number',
210
210
  targetUrl: 'string',
211
211
  },
212
- optionalFacts: { amountPaidCents: 'number', currency: 'string' },
212
+ optionalFacts: {
213
+ amountPaidCents: 'number',
214
+ currency: 'string',
215
+ isFirstPurchase: 'boolean',
216
+ },
213
217
  orderingSubjectFact: 'accountId',
214
218
  allowedTriggers: ['threshold_crossing'],
215
219
  allowedThresholdUnits: ['credits', 'usd_cents'],
@@ -0,0 +1,31 @@
1
+ "use strict";Object.defineProperty(exports, "__esModule", {value: true});
2
+
3
+
4
+
5
+
6
+
7
+
8
+
9
+
10
+
11
+
12
+ var _chunkQAM2K3CGjs = require('./chunk-QAM2K3CG.js');
13
+ require('./chunk-QCSLIEMC.js');
14
+ require('./chunk-JBGR6U57.js');
15
+ require('./chunk-XNYIZMNQ.js');
16
+ require('./chunk-KW25DKRC.js');
17
+ require('./chunk-7P5AA3SN.js');
18
+ require('./chunk-OG64RBAC.js');
19
+ require('./chunk-COGTRVWW.js');
20
+
21
+
22
+
23
+
24
+
25
+
26
+
27
+
28
+
29
+
30
+
31
+ exports.EXIT_WORKSPACE_MISMATCH = _chunkQAM2K3CGjs.EXIT_WORKSPACE_MISMATCH; exports.clearPendingClaim = _chunkQAM2K3CGjs.clearPendingClaim; exports.clearSatisfiedPendingClaim = _chunkQAM2K3CGjs.clearSatisfiedPendingClaim; exports.handleRegister = _chunkQAM2K3CGjs.handleRegister; exports.handleStatus = _chunkQAM2K3CGjs.handleStatus; exports.handleWait = _chunkQAM2K3CGjs.handleWait; exports.readPendingAuthClaim = _chunkQAM2K3CGjs.readPendingAuthClaim; exports.registerAuthCommands = _chunkQAM2K3CGjs.registerAuthCommands; exports.reportSetupCompleted = _chunkQAM2K3CGjs.reportSetupCompleted; exports.resolvePendingAuthClaimForResume = _chunkQAM2K3CGjs.resolvePendingAuthClaimForResume;
@@ -9,11 +9,11 @@ import {
9
9
  registerAuthCommands,
10
10
  reportSetupCompleted,
11
11
  resolvePendingAuthClaimForResume
12
- } from "./chunk-Y6D2JYBR.mjs";
13
- import "./chunk-SFJEAK54.mjs";
14
- import "./chunk-PQGDU7B5.mjs";
12
+ } from "./chunk-GXN7DGNL.mjs";
13
+ import "./chunk-ZQ6UF55Y.mjs";
14
+ import "./chunk-JKJSTQ2I.mjs";
15
15
  import "./chunk-DLIRSHV6.mjs";
16
- import "./chunk-AOKWJJLP.mjs";
16
+ import "./chunk-6OVLJLYH.mjs";
17
17
  import "./chunk-NXGCO4JB.mjs";
18
18
  import "./chunk-WZYKRD7T.mjs";
19
19
  import "./chunk-KRD6H754.mjs";