deepline 0.3.415 → 0.3.417

package/dist/bundling-sources/sdk/src/release.ts

@@ -205,7 +205,7 @@ export const SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: '0.3.415',
+  version: '0.3.417',
   updateSummary: {
     introducedIn: '0.3.90',
     summary:

package/dist/bundling-sources/shared_libs/observability/scheduled-jobs.json

@@ -1447,5 +1447,23 @@
     "runTimeoutMs": 300000,
     "failureAlert": "convex_action_wrapper",
     "domainReportRequired": true
+  },
+  {
+    "id": "convex.billing-credit-delivery-watchdog",
+    "name": "Billing credit delivery watchdog",
+    "scheduler": "convex_scheduled_action",
+    "cadence": "runAfter at 30 and 120 seconds per paid invoice",
+    "timezone": "UTC",
+    "source": "packages/convex/scheduledJobsNode.ts",
+    "locator": "checkBillingInvoiceDelivery",
+    "owner": "billing",
+    "criticality": "critical",
+    "purpose": "Observe paid-invoice credit delivery independently of renewal operations and admit the shared direct Slack alert.",
+    "successDefinition": "The invoice is verified delivered, outside scope, or a missing-credit alert is durably admitted.",
+    "failureDefinition": "Payment or credit evidence cannot be verified, or observation/notification admission fails.",
+    "startGraceMs": 120000,
+    "runTimeoutMs": 60000,
+    "failureAlert": "convex_action_wrapper",
+    "domainReportRequired": true
   }
 ]

package/dist/bundling-sources/shared_libs/product-notifications/billing-sales.ts

@@ -4,10 +4,15 @@ export const BILLING_SALES_SLACK_CHANNEL_ID = 'C0AGWVD2TNK';
 export const BILLING_SALES_CONNECTION_ID = 'platform-reporting-bot';
 export const BILLING_SALES_CREDIT_PURCHASE_MINIMUM_CENTS = 1;
 export const BILLING_PURCHASE_LATE_RULE_KEY = 'internal.billing.purchase_late';
+export const BILLING_RENEWAL_LATE_RULE_KEY = 'internal.billing.renewal_late';
+export const BILLING_DELIVERY_LATE_RULE_KEYS: readonly string[] = [
+  BILLING_PURCHASE_LATE_RULE_KEY,
+  BILLING_RENEWAL_LATE_RULE_KEY,
+];
 export const BILLING_SALES_RULE_KEYS: readonly string[] = [
   'internal.billing.credit_purchase',
   'internal.billing.paid_plan',
-  BILLING_PURCHASE_LATE_RULE_KEY,
+  ...BILLING_DELIVERY_LATE_RULE_KEYS,
 ];
 
 export function isPlatformNotificationGroup(groupKey: string): boolean {

package/dist/bundling-sources/shared_libs/product-notifications/catalog.ts

@@ -15,6 +15,7 @@ import { legacySlackNotificationType } from './legacy-slack';
 import type { NotificationText } from './content';
 import {
   BILLING_PURCHASE_LATE_RULE_KEY,
+  BILLING_RENEWAL_LATE_RULE_KEY,
   BILLING_SALES_CREDIT_PURCHASE_MINIMUM_CENTS,
   BILLING_SALES_GROUP_KEY,
 } from './billing-sales';
@@ -273,6 +274,46 @@ const GROWTH_LEARN_MORE_DETAILS: NotificationText[] = [
 ];
 
 /** One canonical registry owns every notification type's runtime and UI metadata. */
+function lateCreditDeliveryRegistration<Id extends string>(
+  id: Id,
+  eventName: ProductNotificationEventName,
+  label: 'Purchase' | 'Renewal',
+  identityField: 'operationId' | 'stripeInvoiceId',
+) {
+  return {
+    id,
+    eventName,
+    requiredFilter: {},
+    allowedTriggers: ['each_match'],
+    catalog: undefined,
+    shadow: true,
+    rule: {
+      default: { ruleKey: id, groupKey: BILLING_SALES_GROUP_KEY },
+      create: (_input, base) => ({
+        ...base,
+        repeatMode: 'every_match',
+        trigger: { kind: 'each_match' },
+      }),
+      present: ({ payload }) => ({
+        title: `${label} not completed after ${payload.thresholdSeconds} seconds`,
+        summary: [
+          `<!channel> ${label} fulfillment in `,
+          { workspace: true },
+          ' needs investigation. Verify payment and fulfillment independently.',
+        ],
+        details: [
+          `${label === 'Purchase' ? 'Operation' : 'Stripe invoice'}: ${payload[identityField]}`,
+        ],
+        targetUrl: String(payload.targetUrl),
+        subjectKind:
+          label === 'Purchase' ? 'billing_operation' : 'billing_invoice',
+        subjectId: String(payload[identityField]),
+        severity: 'error',
+      }),
+    },
+  } satisfies NotificationTypeRegistration;
+}
+
 const PRODUCT_NOTIFICATION_TYPE_REGISTRY = [
   {
     id: 'monitor.disabled.insufficient_credits',
@@ -816,38 +857,18 @@ const PRODUCT_NOTIFICATION_TYPE_REGISTRY = [
       }),
     },
   },
-  {
-    id: BILLING_PURCHASE_LATE_RULE_KEY,
-    eventName: ProductNotificationEvent.BillingPurchaseLate,
-    requiredFilter: {},
-    allowedTriggers: ['each_match'],
-    catalog: undefined,
-    shadow: true,
-    rule: {
-      default: {
-        ruleKey: BILLING_PURCHASE_LATE_RULE_KEY,
-        groupKey: BILLING_SALES_GROUP_KEY,
-      },
-      create: (_input, base) => ({
-        ...base,
-        repeatMode: 'every_match',
-        trigger: { kind: 'each_match' },
-      }),
-      present: ({ payload }) => ({
-        title: `Purchase not completed after ${payload.thresholdSeconds} seconds`,
-        summary: [
-          '<!channel> Purchase fulfillment in ',
-          { workspace: true },
-          ' needs investigation. Verify payment and fulfillment independently.',
-        ],
-        details: [`Operation: ${payload.operationId}`],
-        targetUrl: String(payload.targetUrl),
-        subjectKind: 'billing_operation',
-        subjectId: String(payload.operationId),
-        severity: 'error',
-      }),
-    },
-  },
+  lateCreditDeliveryRegistration(
+    BILLING_PURCHASE_LATE_RULE_KEY,
+    ProductNotificationEvent.BillingPurchaseLate,
+    'Purchase',
+    'operationId',
+  ),
+  lateCreditDeliveryRegistration(
+    BILLING_RENEWAL_LATE_RULE_KEY,
+    ProductNotificationEvent.BillingRenewalLate,
+    'Renewal',
+    'stripeInvoiceId',
+  ),
   {
     id: 'play.failed',
     eventName: ProductNotificationEvent.PlayRunCompleted,

package/dist/bundling-sources/shared_libs/product-notifications/default-policy.ts

@@ -20,7 +20,7 @@ import {
  * they create sparse copy-on-write overrides.
  */
 export const CURRENT_PRODUCT_NOTIFICATION_DEFAULT_POLICY = {
-  version: 9,
+  version: 10,
   groups: [
     {
       groupKey: 'default',

package/dist/bundling-sources/shared_libs/product-notifications/events.ts

@@ -21,6 +21,7 @@ export const ProductNotificationEvent = {
   AutoTopupLimitObserved: 'billing.auto_topup.limit_observed',
   BillingPlanPurchased: 'billing.plan.purchased',
   BillingPurchaseLate: 'billing.purchase.late',
+  BillingRenewalLate: 'billing.renewal.late',
   MonitorLifecycleChanged: 'monitor.lifecycle.changed',
   PlayLifecycleChanged: 'play.lifecycle.changed',
   PlayRunCompleted: 'play.run.completed',
@@ -64,6 +65,7 @@ export const PRODUCT_NOTIFICATION_EVENT_NAMES = [
   ProductNotificationEvent.CreditsPurchaseCompleted,
   ProductNotificationEvent.BillingPlanPurchased,
   ProductNotificationEvent.BillingPurchaseLate,
+  ProductNotificationEvent.BillingRenewalLate,
 ] as const;
 
 export const PRODUCT_NOTIFICATION_COMPATIBILITY_EVENT_NAMES = [
@@ -245,6 +247,18 @@ export const PRODUCT_NOTIFICATION_EVENT_DEFINITIONS: readonly ProductNotificatio
       orderingSubjectFact: 'operationId',
       allowedTriggers: ['each_match'],
     },
+    {
+      eventName: ProductNotificationEvent.BillingRenewalLate,
+      producerKey: ProductNotificationProducerKey.BillingPurchases,
+      requiredFacts: {
+        accountId: 'string',
+        stripeInvoiceId: 'string',
+        thresholdSeconds: 'number',
+        targetUrl: 'string',
+      },
+      orderingSubjectFact: 'stripeInvoiceId',
+      allowedTriggers: ['each_match'],
+    },
     ...PRODUCT_NOTIFICATION_COMPATIBILITY_EVENT_NAMES.map((eventName) => ({
       eventName,
       producerKey: ProductNotificationProducerKey.LegacyProductNotifications,

package/dist/bundling-sources/shared_libs/security/receipt-admission-token.ts

@@ -100,6 +100,26 @@ export async function verifyCreditReadinessToken(
   scanId: string;
   cursor: string | null;
 }> {
+  const claims = await verifyObservationToken(
+    token,
+    'deepline.credit_readiness',
+    nowMs,
+  );
+  if (
+    typeof claims.scanId !== 'string' ||
+    !claims.scanId ||
+    (claims.cursor !== null &&
+      (typeof claims.cursor !== 'string' || !claims.cursor))
+  )
+    throw new Error('Invalid credit readiness token.');
+  return { scanId: claims.scanId, cursor: claims.cursor as string | null };
+}
+
+async function verifyObservationToken(
+  token: string,
+  audience: string,
+  nowMs: number,
+): Promise<Record<string, unknown>> {
   const parts = token.split('.');
   if (parts.length !== 3) throw new Error('Invalid credit readiness token.');
   const decode = (value: string) =>
@@ -126,11 +146,7 @@ export async function verifyCreditReadinessToken(
     header.typ !== 'JWT' ||
     claims.v !== TOKEN_VERSION ||
     claims.iss !== TOKEN_ISSUER ||
-    claims.aud !== 'deepline.credit_readiness' ||
-    typeof claims.scanId !== 'string' ||
-    !claims.scanId ||
-    (claims.cursor !== null &&
-      (typeof claims.cursor !== 'string' || !claims.cursor)) ||
+    claims.aud !== audience ||
     !Number.isSafeInteger(claims.iat) ||
     !Number.isSafeInteger(claims.exp) ||
     claims.iat > now + 30 ||
@@ -138,10 +154,7 @@ export async function verifyCreditReadinessToken(
     claims.exp - claims.iat !== TOKEN_TTL_SECONDS
   )
     throw new Error('Invalid credit readiness token.');
-  return {
-    scanId: claims.scanId,
-    cursor: claims.cursor,
-  };
+  return claims as Record<string, unknown>;
 }
 
 /**
@@ -323,3 +336,45 @@ export async function mintSqlListenerDispatchRetryToken(input: {
     exp: issuedAt + TOKEN_TTL_SECONDS,
   });
 }
+
+/** Authorizes one invoice/threshold observation, never a payment, grant or fleet scan. */
+export async function mintBillingDeliveryToken(input: {
+  stripeInvoiceId: string;
+  thresholdSeconds: 30 | 120;
+  nowMs?: number;
+}): Promise<string> {
+  const issuedAt = Math.floor((input.nowMs ?? Date.now()) / 1000);
+  return mint({
+    v: TOKEN_VERSION,
+    iss: TOKEN_ISSUER,
+    aud: 'deepline.billing_delivery',
+    stripeInvoiceId: input.stripeInvoiceId,
+    thresholdSeconds: input.thresholdSeconds,
+    iat: issuedAt,
+    exp: issuedAt + TOKEN_TTL_SECONDS,
+  });
+}
+
+export async function verifyBillingDeliveryToken(
+  token: string,
+  nowMs = Date.now(),
+): Promise<{
+  stripeInvoiceId: string;
+  thresholdSeconds: 30 | 120;
+}> {
+  const claims = await verifyObservationToken(
+    token,
+    'deepline.billing_delivery',
+    nowMs,
+  );
+  if (
+    typeof claims.stripeInvoiceId !== 'string' ||
+    !claims.stripeInvoiceId ||
+    (claims.thresholdSeconds !== 30 && claims.thresholdSeconds !== 120)
+  )
+    throw new Error('Invalid billing delivery token.');
+  return {
+    stripeInvoiceId: claims.stripeInvoiceId,
+    thresholdSeconds: claims.thresholdSeconds,
+  };
+}

package/dist/cli/{auth-3R7XJOU4.mjs → auth-2WNDS7OY.mjs}

@@ -13,13 +13,13 @@ import {
   reportSetupCompleted,
   resolvePendingAuthClaimForResume,
   statusBannerLine
-} from "./chunk-TOUMT7XB.mjs";
-import "./chunk-OJGQ7JE3.mjs";
-import "./chunk-Q44253PX.mjs";
+} from "./chunk-2HQOCIFE.mjs";
+import "./chunk-CCRV2MCO.mjs";
+import "./chunk-H25KUAJM.mjs";
 import "./chunk-MAMVGOSC.mjs";
 import "./chunk-DLIRSHV6.mjs";
 import "./chunk-E4IXDAZI.mjs";
-import "./chunk-EMWMLURG.mjs";
+import "./chunk-3U6CYHMT.mjs";
 import "./chunk-WZYKRD7T.mjs";
 import "./chunk-KRD6H754.mjs";
 export {

package/dist/cli/auth-3NIULVL4.js

@@ -0,0 +1,40 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+var _chunkQS7WRPCPjs = require('./chunk-QS7WRPCP.js');
+require('./chunk-OW7VBN4Q.js');
+require('./chunk-QLP4Z6JG.js');
+require('./chunk-NPBJI7RE.js');
+require('./chunk-XNYIZMNQ.js');
+require('./chunk-PPDBRJRW.js');
+require('./chunk-EHGFSE44.js');
+require('./chunk-OG64RBAC.js');
+require('./chunk-COGTRVWW.js');
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+exports.EXIT_WORKSPACE_MISMATCH = _chunkQS7WRPCPjs.EXIT_WORKSPACE_MISMATCH; exports.authStatusLine = _chunkQS7WRPCPjs.authStatusLine; exports.clearPendingClaim = _chunkQS7WRPCPjs.clearPendingClaim; exports.clearSatisfiedPendingClaim = _chunkQS7WRPCPjs.clearSatisfiedPendingClaim; exports.handleRegister = _chunkQS7WRPCPjs.handleRegister; exports.handleStatus = _chunkQS7WRPCPjs.handleStatus; exports.handleWait = _chunkQS7WRPCPjs.handleWait; exports.httpJson = _chunkQS7WRPCPjs.httpJson; exports.readPendingAuthClaim = _chunkQS7WRPCPjs.readPendingAuthClaim; exports.readStatusBanner = _chunkQS7WRPCPjs.readStatusBanner; exports.registerAuthCommands = _chunkQS7WRPCPjs.registerAuthCommands; exports.reportSetupCompleted = _chunkQS7WRPCPjs.reportSetupCompleted; exports.resolvePendingAuthClaimForResume = _chunkQS7WRPCPjs.resolvePendingAuthClaimForResume; exports.statusBannerLine = _chunkQS7WRPCPjs.statusBannerLine;

package/dist/cli/{billing-CEQACJBE.mjs → billing-4Z7QGTTO.mjs}

@@ -2,7 +2,7 @@ import {
   DeeplineClient,
   iterateCursorPages,
   requireBillingIdempotencyKey
-} from "./chunk-Y2CT65YJ.mjs";
+} from "./chunk-ECKCIGJC.mjs";
 import "./chunk-L2VKAASU.mjs";
 import "./chunk-KCC3FKIW.mjs";
 import "./chunk-EIMG75BT.mjs";
@@ -13,8 +13,8 @@ import {
   openInBrowser,
   printCommandEnvelope,
   shouldEmitJson
-} from "./chunk-OJGQ7JE3.mjs";
-import "./chunk-Q44253PX.mjs";
+} from "./chunk-CCRV2MCO.mjs";
+import "./chunk-H25KUAJM.mjs";
 import {
   AuthError,
   ConfigError
@@ -23,7 +23,7 @@ import "./chunk-DLIRSHV6.mjs";
 import {
   DeeplineError
 } from "./chunk-E4IXDAZI.mjs";
-import "./chunk-EMWMLURG.mjs";
+import "./chunk-3U6CYHMT.mjs";
 import "./chunk-WZYKRD7T.mjs";
 import "./chunk-KRD6H754.mjs";