deepline 0.3.366 → 0.3.368

package/dist/bundling-sources/sdk/src/release.ts

@@ -200,7 +200,7 @@ export const SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: '0.3.366',
+  version: '0.3.368',
   updateSummary:
     'Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.',
   packageCapabilities: {

package/dist/bundling-sources/sdk/src/types.ts

@@ -171,6 +171,11 @@ export interface ToolPricingSummary {
     sampleSize: number;
     inputMode: string;
   };
+  /**
+   * Largest single charge any call to this tool settled in the trailing
+   * window. A recorded worst case, not a rate, quote, or ceiling.
+   */
+  observedMax?: { creditsPerCall: number; windowDays: number };
 }
 
 /** A discoverable provider, returned by {@link DeeplineClient.listProviders}. */

package/dist/bundling-sources/shared_libs/observability/scheduled-jobs.json

@@ -9,7 +9,7 @@
     "locator": "schedule:",
     "owner": "product",
     "criticality": "critical",
-    "purpose": "Run clean Sonnet/Claude Code and Luna/Codex installs from the production homepage prompt through browser claim completion and the agent’s complete starter handoff.",
+    "purpose": "Run clean Sonnet/Claude Code and Luna/Codex installs from the production homepage prompt through browser claim completion and the agent\u2019s complete starter handoff.",
     "successDefinition": "Both latest coding harnesses install Deepline without installation warnings or errors, finish browser authorization and setup, present all four starter choices as a card or text, and verify test key revocation; after seven valid daily runs each finishes within 240 seconds.",
     "failureDefinition": "Either agent, browser claim completion, read-only setup verification, complete starter handoff, verified key cleanup, or the applicable timing gate fails.",
     "startGraceMs": 900000,
@@ -1304,37 +1304,37 @@
   {
     "id": "github.credit-purchase-readiness-scan",
     "name": "Credit Purchase Readiness Daily Scan",
-    "scheduler": "github_actions",
-    "cadence": "0 8 * * *",
-    "timezone": "America/New_York",
-    "source": ".github/workflows/credit-purchase-readiness-scan.yml",
-    "locator": "schedule:",
+    "scheduler": "convex_cron",
+    "cadence": "0 12 * * *",
+    "timezone": "UTC",
+    "source": "packages/convex/crons.ts",
+    "locator": "credit purchase readiness daily scan",
     "owner": "billing",
     "criticality": "critical",
-    "purpose": "Inspect every workspace through the production read-only credit addition check and retain private evidence.",
-    "successDefinition": "A complete, source-certified scan/report is retained and aggregate telemetry is ingested; account findings remain visible in the Better Stack monitor.",
-    "failureDefinition": "The scan or report is missing, incomplete, inaccessible, or cannot publish telemetry.",
+    "purpose": "Start a durable read-only credit readiness sweep; each continuation checks one workspace.",
+    "successDefinition": "The scan intent and first page are atomically scheduled; the morning report verifies fleet completion.",
+    "failureDefinition": "The scan cannot be started or its daily completion evidence is unavailable.",
     "startGraceMs": 900000,
     "runTimeoutMs": 3000000,
-    "failureAlert": "github_workflow_run",
+    "failureAlert": "convex_action_wrapper",
     "domainReportRequired": true
   },
   {
     "id": "github.credit-purchase-readiness-morning",
     "name": "Credit Purchase Readiness Morning Report",
-    "scheduler": "github_actions",
-    "cadence": "0 9 * * *",
-    "timezone": "America/New_York",
-    "source": ".github/workflows/credit-purchase-readiness-morning.yml",
-    "locator": "schedule:",
+    "scheduler": "convex_cron",
+    "cadence": "0 13 * * *",
+    "timezone": "UTC",
+    "source": "packages/convex/crons.ts",
+    "locator": "credit purchase readiness morning report",
     "owner": "billing",
     "criticality": "critical",
-    "purpose": "Publish daily issue counts and feed the Axiom to Better Stack readiness alert at 9 a.m. Eastern.",
-    "successDefinition": "A complete, source-certified scan/report is retained and aggregate telemetry is ingested; account findings remain visible in the Better Stack monitor.",
+    "purpose": "Publish daily credit readiness counts through existing Convex telemetry.",
+    "successDefinition": "Today\u2019s complete scan is reported to Axiom; purchase defects and unknown prerequisites remain visible in Better Stack.",
     "failureDefinition": "The scan or report is missing, incomplete, inaccessible, or cannot publish telemetry.",
     "startGraceMs": 900000,
     "runTimeoutMs": 600000,
-    "failureAlert": "github_workflow_run",
+    "failureAlert": "convex_action_wrapper",
     "domainReportRequired": true
   },
   {
@@ -1354,5 +1354,23 @@
     "runTimeoutMs": 120000,
     "failureAlert": "convex_action_wrapper",
     "domainReportRequired": true
+  },
+  {
+    "id": "convex.credit-purchase-readiness-page",
+    "name": "Credit purchase readiness page",
+    "scheduler": "convex_scheduled_action",
+    "cadence": "runAfter previous credit readiness checkpoint",
+    "timezone": "UTC",
+    "source": "packages/convex/scheduledJobsNode.ts",
+    "locator": "checkCreditReadinessPage",
+    "owner": "billing",
+    "criticality": "critical",
+    "purpose": "Inspect one workspace without a payment or grant and commit a fenced aggregate checkpoint.",
+    "successDefinition": "A read-only page is committed once with its next continuation, or a stale delivery is skipped.",
+    "failureDefinition": "A callback or checkpoint fails; the scan remains incomplete and the daily report pages.",
+    "startGraceMs": 120000,
+    "runTimeoutMs": 300000,
+    "failureAlert": "convex_action_wrapper",
+    "domainReportRequired": true
   }
 ]

package/dist/bundling-sources/shared_libs/observability/scheduled-work-manual.ts

@@ -9,6 +9,8 @@
  */
 export const MANUALLY_RUNNABLE_CONVEX_CRON_JOB_IDS = [
   // These persisted operations ids predate the move of their clocks to Convex.
+  'github.credit-purchase-readiness-scan',
+  'github.credit-purchase-readiness-morning',
   'inngest.play-cron-tick',
   'convex.fold-usage-rollups',
   'convex.cleanup-expired-org-day-usage-shards',

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/runtime-event-search.ts

@@ -86,7 +86,7 @@ const RUNTIME_EVENT_LOG_POSITION_EXPRESSION = `jsonb_set(
 // Migration readiness tracks this projection body independently of scheduler
 // wire and schema versions. Bump when a changed trigger must be reinstalled.
 export const RUNTIME_EVENT_SEARCH_OUTBOX_PROJECTION_MARKER =
-  'runtime-event-search-origin-batch-fields-once-primary-key-fence';
+  'runtime-event-search-primary-key-fence-direct-independent-receipts';
 /** Trusted trigger-authored state; absent on already-projected legacy rows. */
 export const RUNTIME_EVENT_DEFERRED_PROJECTION_FIELD =
   '_runtimeSearchProjectionPending';
@@ -1905,7 +1905,7 @@ export async function attachRuntimeEventSearchTriggers(
   await client.query(`
     CREATE OR REPLACE FUNCTION ${schema}.search_receipt_event() RETURNS trigger
     LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog AS $function$
-    DECLARE play text; ref uuid; canonical_events boolean;
+    DECLARE play text; ref uuid; canonical_events boolean; deferred_run boolean;
     BEGIN
       IF NEW.status NOT IN ('completed', 'failed', 'skipped') THEN RETURN NEW; END IF;
       IF TG_OP = 'UPDATE' THEN
@@ -1918,7 +1918,10 @@ export async function attachRuntimeEventSearchTriggers(
       IF NEW.run_id IS NULL OR NEW.org_id IS NULL THEN
         RAISE EXCEPTION 'Terminal receipt search projection requires run and organization';
       END IF;
-      IF ${schema}.defer_runtime_event_projection_for_run(NEW.run_id) THEN
+      deferred_run := ${schema}.defer_runtime_event_projection_for_run(NEW.run_id);
+      -- Independent projection indexes the receipt row directly below. Only
+      -- the deferred compatibility stage still queues a receipt carrier.
+      IF deferred_run AND NOT ${schema}.independent_runtime_event_projection() THEN
         IF NOT EXISTS (SELECT 1 FROM ${schema}.runs
           WHERE run_id = NEW.run_id AND org_id = NEW.org_id) THEN
           RAISE EXCEPTION 'Terminal receipt search projection has no matching run';
@@ -1935,8 +1938,12 @@ export async function attachRuntimeEventSearchTriggers(
             FROM ${schema}.outbox WHERE run_id = NEW.run_id), clock_timestamp())));
         RETURN NEW;
       END IF;
-      -- Serialize event ordering with the same per-run lock as outbox facts.
-      PERFORM pg_advisory_xact_lock(hashtext(${quoteLiteral(scope)}), hashtext(NEW.run_id));
+      -- Inline runs serialize event ordering with the same per-run lock as
+      -- outbox facts. Independent runs index logs from a background prefix,
+      -- so this one-row receipt insert takes no log mutex and need not wait.
+      IF NOT deferred_run THEN
+        PERFORM pg_advisory_xact_lock(hashtext(${quoteLiteral(scope)}), hashtext(NEW.run_id));
+      END IF;
       SELECT play_name, run_event_store = 'planet_scale'
         INTO play, canonical_events FROM ${schema}.runs
        WHERE run_id = NEW.run_id AND org_id = NEW.org_id;
@@ -1961,7 +1968,8 @@ export async function attachRuntimeEventSearchTriggers(
           'source', 'receipt', 'producerAttempt', NEW.lease_owner_attempt,
           -- Only the reserved runtime diagnostic record supplies this flat
           -- context. Ordinary authored receipt outputs are never indexed.
-          'context', CASE WHEN NEW.k LIKE 'tool-evidence:%'
+          -- The reserved key is buildDurableToolReceiptPrefix(call-evidence).
+          'context', CASE WHEN NEW.k LIKE 'ctx:%:call:tool:call\\_evidence:%'
             AND NEW.output_json->>'kind' = 'tool_call_evidence' THEN jsonb_strip_nulls(jsonb_build_object(
               'callKey', NEW.output_json#>'{context,callKey}',
               'toolId', NEW.output_json#>'{context,toolId}',

package/dist/bundling-sources/shared_libs/security/receipt-admission-token.ts

@@ -75,6 +75,75 @@ async function mint(claims: Record<string, unknown>): Promise<string> {
   return `${signingInput}.${await sign(signingInput)}`;
 }
 
+/** One read-only billing observer page; cannot authorize a payment or grant. */
+export async function mintCreditReadinessToken(input: {
+  scanId: string;
+  cursor: string | null;
+  nowMs?: number;
+}): Promise<string> {
+  const issuedAt = Math.floor((input.nowMs ?? Date.now()) / 1000);
+  return mint({
+    v: TOKEN_VERSION,
+    iss: TOKEN_ISSUER,
+    aud: 'deepline.credit_readiness',
+    scanId: input.scanId,
+    cursor: input.cursor,
+    iat: issuedAt,
+    exp: issuedAt + TOKEN_TTL_SECONDS,
+  });
+}
+
+export async function verifyCreditReadinessToken(
+  token: string,
+  nowMs = Date.now(),
+): Promise<{
+  scanId: string;
+  cursor: string | null;
+}> {
+  const parts = token.split('.');
+  if (parts.length !== 3) throw new Error('Invalid credit readiness token.');
+  const decode = (value: string) =>
+    JSON.parse(Buffer.from(value, 'base64url').toString('utf8'));
+  const key = await crypto.subtle.importKey(
+    'raw',
+    new TextEncoder().encode(rootSecret()),
+    { name: 'HMAC', hash: 'SHA-256' },
+    false,
+    ['verify'],
+  );
+  const header = decode(parts[0]);
+  const claims = decode(parts[1]);
+  const valid = await crypto.subtle.verify(
+    'HMAC',
+    key,
+    Buffer.from(parts[2], 'base64url'),
+    new TextEncoder().encode(`${parts[0]}.${parts[1]}`),
+  );
+  const now = Math.floor(nowMs / 1000);
+  if (
+    !valid ||
+    header.alg !== 'HS256' ||
+    header.typ !== 'JWT' ||
+    claims.v !== TOKEN_VERSION ||
+    claims.iss !== TOKEN_ISSUER ||
+    claims.aud !== 'deepline.credit_readiness' ||
+    typeof claims.scanId !== 'string' ||
+    !claims.scanId ||
+    (claims.cursor !== null &&
+      (typeof claims.cursor !== 'string' || !claims.cursor)) ||
+    !Number.isSafeInteger(claims.iat) ||
+    !Number.isSafeInteger(claims.exp) ||
+    claims.iat > now + 30 ||
+    claims.exp <= now ||
+    claims.exp - claims.iat !== TOKEN_TTL_SECONDS
+  )
+    throw new Error('Invalid credit readiness token.');
+  return {
+    scanId: claims.scanId,
+    cursor: claims.cursor,
+  };
+}
+
 /**
  * Bind a large request body to its capability without putting up to 1,024
  * receipt IDs in an HTTP header. JSON preserves order and length, so this is

package/dist/cli/auth-NJ6RE6XQ.js

@@ -0,0 +1,33 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+
+
+
+
+
+
+
+
+var _chunkBKEYQHJ2js = require('./chunk-BKEYQHJ2.js');
+require('./chunk-SNENR3BL.js');
+require('./chunk-GTC2KAZQ.js');
+require('./chunk-XNYIZMNQ.js');
+require('./chunk-7P5AA3SN.js');
+require('./chunk-S4Y7B2O3.js');
+require('./chunk-OG64RBAC.js');
+require('./chunk-COGTRVWW.js');
+
+
+
+
+
+
+
+
+
+
+
+
+exports.EXIT_WORKSPACE_MISMATCH = _chunkBKEYQHJ2js.EXIT_WORKSPACE_MISMATCH; exports.authStatusLine = _chunkBKEYQHJ2js.authStatusLine; exports.clearPendingClaim = _chunkBKEYQHJ2js.clearPendingClaim; exports.clearSatisfiedPendingClaim = _chunkBKEYQHJ2js.clearSatisfiedPendingClaim; exports.handleRegister = _chunkBKEYQHJ2js.handleRegister; exports.handleStatus = _chunkBKEYQHJ2js.handleStatus; exports.handleWait = _chunkBKEYQHJ2js.handleWait; exports.readPendingAuthClaim = _chunkBKEYQHJ2js.readPendingAuthClaim; exports.registerAuthCommands = _chunkBKEYQHJ2js.registerAuthCommands; exports.reportSetupCompleted = _chunkBKEYQHJ2js.reportSetupCompleted; exports.resolvePendingAuthClaimForResume = _chunkBKEYQHJ2js.resolvePendingAuthClaimForResume;

package/dist/cli/{auth-TZ75C4ZF.mjs → auth-RUWM7VTH.mjs}

@@ -10,12 +10,12 @@ import {
   registerAuthCommands,
   reportSetupCompleted,
   resolvePendingAuthClaimForResume
-} from "./chunk-34VVYOOS.mjs";
-import "./chunk-QGOX4BEC.mjs";
-import "./chunk-HQKAEQYO.mjs";
+} from "./chunk-PU53IS6H.mjs";
+import "./chunk-S3MDB6SI.mjs";
+import "./chunk-EZUGGC5A.mjs";
 import "./chunk-DLIRSHV6.mjs";
 import "./chunk-NXGCO4JB.mjs";
-import "./chunk-4TTEGFR2.mjs";
+import "./chunk-GHZUH33K.mjs";
 import "./chunk-WZYKRD7T.mjs";
 import "./chunk-KRD6H754.mjs";
 export {