deepline 0.3.423 → 0.3.424

package/dist/bundling-sources/sdk/src/client.ts

@@ -1194,12 +1194,18 @@ export type MonitorsAvailableOptions = {
 /**
  * Stable customer-facing Monitor/Fleet state.
  *
- * Provider provisioning, cleanup, retries, and failures are Monitor Job
- * progress and must never be added to this union. The `status` and `active`
- * fields below are retained only as deprecated compatibility aliases for
- * older API responses.
+ * `provisioning` is a monitor whose create was recorded but that the provider
+ * has not confirmed yet; it delivers no events and does not bill until it
+ * becomes `active`. A Fleet is never `provisioning`. Provider cleanup,
+ * retries, and failures are Monitor Job progress and must never be added to
+ * this union. The `status` and `active` fields below are retained only as
+ * deprecated compatibility aliases for older API responses.
  */
-export type MonitorState = 'active' | 'billing_suspended' | 'disabled';
+export type MonitorState =
+  | 'active'
+  | 'provisioning'
+  | 'billing_suspended'
+  | 'disabled';
 
 /** List filters accepted by the canonical state surface. */
 export type MonitorStateFilter = MonitorState | 'all';
@@ -1873,7 +1879,8 @@ export type MonitorsNamespace = {
     options?: MonitorLifecycleOptions,
   ) => Promise<MonitorJobResult | MonitorDeployResult>;
   /** List deployed monitors (active by default). Use `state` to filter the
-   * three customer states; `status` is retained for older servers.
+   * four customer states (`active`, `provisioning`, `billing_suspended`,
+   * `disabled`); `status` is retained for older servers.
    * `includeConsumers` requires a limit of 20 or fewer. */
   list: (options?: MonitorsListOptions) => Promise<MonitorsListResult>;
   /** Fetch one deployed monitor by public key with bounded current listener health. */

package/dist/bundling-sources/sdk/src/release.ts

@@ -205,7 +205,7 @@ export const SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: '0.3.423',
+  version: '0.3.424',
   updateSummary: {
     introducedIn: '0.3.90',
     summary:

package/dist/bundling-sources/shared_libs/monitors/fleets/verdict.ts

@@ -46,6 +46,16 @@ export type FleetStatusVerdict =
   | 'billing_suspended'
   | 'billing_reactivating';
 
+/**
+ * A Fleet's customer state. A Fleet has no `provisioning` state: its first
+ * convergence is reported by the durable Fleet operation, while each member
+ * monitor still pending its create reports `provisioning` itself.
+ */
+export type FleetCustomerState = Exclude<
+  ProviderMonitorCustomerState,
+  'provisioning'
+>;
+
 /**
  * The Fleet's stable customer state. Convergence and lifecycle transitions are
  * reported by the durable Fleet operation, not by growing this union.
@@ -54,7 +64,7 @@ export function fleetCustomerState(input: {
   lifecycle: FleetLifecycleStatus;
   verdict: FleetStatusVerdict;
   convergedGeneration: number | null;
-}): ProviderMonitorCustomerState {
+}): FleetCustomerState {
   switch (input.lifecycle) {
     case 'billing_suspending':
     case 'billing_suspended':

package/dist/bundling-sources/shared_libs/monitors/inventory-reconciliation.ts

@@ -9,6 +9,17 @@ export type InventoryDecision = {
   radarId?: string;
 };
 
+/**
+ * Desynced definition findings that audit-scoped repair acts on. Every other
+ * desynced reason is resolved elsewhere (operator bind, orphan cleanup), so
+ * submitting repair for it would be a no-op that recurs every audit.
+ */
+export const GLOBAL_AUDIT_REPAIRABLE_REASONS: ReadonlySet<string> = new Set([
+  'missing_tamradar_radar',
+  'tamradar_state_differs',
+  'tamradar_configuration_differs',
+]);
+
 /** Call only after BOTH inventories completed. Absence is otherwise unknown. */
 export function compareMonitorInventory(input: {
   desired: 'active' | 'inactive';
@@ -24,20 +35,43 @@ export function compareMonitorInventory(input: {
   if (!resourceId) {
     if (marker.length > 1)
       return { verdict: 'unknown', reason: 'ambiguous_tamradar_binding' };
-    if (marker.length === 1)
+    const stamped = marker[0];
+    if (stamped && desired === 'active')
       return {
         verdict: 'desynced',
         reason: 'adoptable_tamradar_radar',
-        radarId: marker[0]!.id,
+        radarId: stamped.id,
       };
+    // An inactive definition never adopts: binding refuses a row that may not
+    // occupy an upstream identity. Its stamped radar is either already closed
+    // or a live leftover that provider-side orphan cleanup owns.
+    if (stamped) {
+      if (stamped.status === 'unknown')
+        return {
+          verdict: 'unknown',
+          reason: 'unknown_tamradar_state',
+          radarId: stamped.id,
+        };
+      return stamped.status === 'inactive'
+        ? { verdict: 'converged', reason: 'in_sync', radarId: stamped.id }
+        : {
+            verdict: 'desynced',
+            reason: 'orphaned_tamradar_radar',
+            radarId: stamped.id,
+          };
+    }
   }
   const radar = exact[0];
   if (!radar) {
     if (!resourceId) {
       // A complete account list proves that no stamped counterpart exists; it
       // cannot prove which resource an unbound historical row used to own.
-      // Creation or adoption is a separate, explicit operator operation.
-      return { verdict: 'unknown', reason: 'missing_tamradar_binding' };
+      // Creation or adoption is a separate, explicit operator operation. An
+      // inactive row wants nothing upstream, and a markerless legacy radar is
+      // reported on the provider side as unattributed, so it has converged.
+      return desired === 'inactive'
+        ? { verdict: 'converged', reason: 'in_sync' }
+        : { verdict: 'unknown', reason: 'missing_tamradar_binding' };
     }
     return desired === 'inactive'
       ? { verdict: 'converged', reason: 'in_sync' }

package/dist/bundling-sources/shared_libs/monitors/provider-monitor-batch-operation.ts

@@ -235,6 +235,18 @@ export function providerMonitorBatchOperationId(input: {
   return `monitor-batch:${orgId}:${idempotencyKey}`;
 }
 
+/**
+ * The lifecycle operation one batch run creates one monitor under. A row the
+ * run writes ahead names it, and its settle publishes under it, so both must
+ * derive it here.
+ */
+export function providerMonitorBatchCreateOperationId(
+  runId: string,
+  monitorKey: string,
+): string {
+  return `${runId}:provider-create:${monitorKey}`;
+}
+
 export function isProviderMonitorBatchOperationKind(
   value: string,
 ): value is ProviderMonitorBatchOperationKind {

package/dist/bundling-sources/shared_libs/monitors/provider-monitor-control-plane-capability.ts

@@ -37,6 +37,31 @@ export function providerMonitorBatchOperationContinuationSecret(
   );
 }
 
+/**
+ * TEMPORARY(#8221), disabled. Uncomment this, its re-export in
+ * apps/deepline-api/src/lib/monitors/provider-monitor-control-plane-capability.ts,
+ * the `expected` line in the five webhook-reconciliation continuation routes,
+ * and `reconciliationSecret` in scripts/lib/monitor-load-test-dispatch-config.ts
+ * together to let the update-feed reconciliation self-drive on a Preview.
+ *
+ * The webhook-reconciliation continuation routes accept only the dedicated
+ * secret, which Preview does not carry, so the update-feed reconciliation can
+ * never self-drive on a Preview and the monitor load test's Stage 2 cannot
+ * exercise it. On a Vercel Preview with no dedicated secret, this also accepts
+ * the capability derived from the Preview internal token, which the load-test
+ * driver sets on the branch Convex. Production carries the dedicated secret
+ * and is unaffected.
+ */
+// export function providerMonitorReconciliationContinuationSecret(
+//   env: Record<string, string | undefined> = process.env,
+// ): string | undefined {
+//   const dedicated = env[LEGACY_SECRET_ENV]?.trim();
+//   if (dedicated) return dedicated;
+//   return env.VERCEL_ENV === 'preview'
+//     ? derivedControlPlaneCapability(env)
+//     : undefined;
+// }
+
 export function providerMonitorGlobalAuditContinuationSecret(
   env: Record<string, string | undefined> = process.env,
 ): string | undefined {

package/dist/bundling-sources/shared_libs/monitors/provider-monitor-errors.ts

@@ -121,6 +121,16 @@ export class ProviderMonitorDeleteOperationInProgressError extends Error {
   }
 }
 
+/** A deploy found the monitor stopped or deleted after it was submitted. */
+export class ProviderMonitorStoppedAfterSubmitError extends Error {
+  constructor(readonly monitorKey: string) {
+    super(
+      `Monitor "${monitorKey}" was stopped or deleted after this deploy was submitted, so the deploy left it as it is. Deploy it again to turn it back on.`,
+    );
+    this.name = 'ProviderMonitorStoppedAfterSubmitError';
+  }
+}
+
 export class PriorityMonitorExecutionLimitError extends Error {
   constructor(readonly max: number) {
     super(

package/dist/bundling-sources/shared_libs/monitors/provider-monitor-identity-claims.ts

@@ -6,6 +6,7 @@ import {
   ProviderMonitorIdentityBackfillInProgressError,
   ProviderMonitorEntityLimitExceededError,
   ProviderMonitorOrgLimitExceededError,
+  type ProviderMonitorCapacitySnapshot,
 } from '@deepline/monitors/provider-monitor-errors';
 import { MAX_PRIORITY_MONITORS_PER_ORG } from '@deepline/monitors/provider-monitor-priority-execution';
 import { internal } from '@deepline/convex-client/function-references';
@@ -374,6 +375,206 @@ export async function beginProviderMonitorLifecycleReservation(input: {
   });
 }
 
+/** Keys one batch provisioning call fences: Convex's own 100-key bound. */
+const PROVISIONING_BATCH_CHUNK = 100;
+
+/**
+ * One item's lifecycle admission, decided for its whole chunk ahead of time.
+ *
+ * Calling it yields exactly what `beginProviderMonitorLifecycleReservation`
+ * would have yielded for the item - the same reservation, or the same typed
+ * refusal thrown - so a caller can swap one for the other per item.
+ */
+export type ProviderMonitorLifecycleAdmission =
+  () => Promise<ProviderMonitorLifecycleReservation>;
+
+/**
+ * Begin the provisioning fence for many new monitors, taking organization
+ * capacity once per chunk of 100 instead of once per item.
+ *
+ * Per chunk: one query counts which accounts already carry a monitor, one
+ * short mutation (`reserveProvisioningCapacityAdmission`) takes allowance for
+ * the accounts the chunk will open, and one transaction
+ * (`beginLifecycleProvisioningBatch`) fences every item against that grant
+ * without touching the organization fence. Items the grant cannot decide
+ * exactly are admitted by the scalar path when their admission is called.
+ *
+ * Asking for exactly the accounts with no monitor yet keeps the grant from
+ * holding allowance a concurrent job could use. Planning can race another
+ * writer either way: an account opened meanwhile simply hands its unit back
+ * when the chunk settles, and an item that needs a unit nobody asked for is
+ * handed to the scalar path - never refused by a limit the fence did not hit.
+ */
+export async function beginProviderMonitorProvisioningBatch(input: {
+  auth: OrgAuthContext;
+  items: ReadonlyArray<{
+    monitorKey: string;
+    operationId: string;
+    entityKey?: string | null;
+  }>;
+}): Promise<Map<string, ProviderMonitorLifecycleAdmission>> {
+  const client = getRequiredInternalConvexClient();
+  const orgId = input.auth.orgId;
+  const admissions = new Map<string, ProviderMonitorLifecycleAdmission>();
+  const scalar =
+    (item: (typeof input.items)[number]): ProviderMonitorLifecycleAdmission =>
+    () =>
+      beginProviderMonitorLifecycleReservation({
+        auth: input.auth,
+        monitorKey: item.monitorKey,
+        operationId: item.operationId,
+        entityKey: item.entityKey ?? null,
+        state: 'provisioning',
+      });
+  for (
+    let offset = 0;
+    offset < input.items.length;
+    offset += PROVISIONING_BATCH_CHUNK
+  ) {
+    const chunk = input.items.slice(offset, offset + PROVISIONING_BATCH_CHUNK);
+    const entityKeyOf = (item: (typeof chunk)[number]) =>
+      item.entityKey || `monitor:${item.monitorKey}`;
+    const entityKeys = [...new Set(chunk.map(entityKeyOf))];
+    const counts = (await client.query(
+      internal.providerMonitorCapacity.countMonitorsByEntities,
+      { orgId, entityKeys },
+    )) as Array<{ entityKey: string; monitors: number }>;
+    const requested = counts.filter((count) => count.monitors === 0).length;
+    const reservationId = `direct-batch-provisioning:${randomUUID()}`;
+    const admission =
+      requested > 0
+        ? ((await retryProviderMonitorLifecycleAdmission(() =>
+            client.mutation(
+              internal.providerMonitorCapacity
+                .reserveProvisioningCapacityAdmission,
+              { orgId, reservationId, requested },
+            ),
+          )) as {
+            granted: number;
+            capacity: ProviderMonitorCapacitySnapshot & {
+              monitors_per_entity: number;
+            };
+          })
+        : null;
+    let batch: {
+      items: Array<
+        | { monitorKey: string; kind: 'acquired' }
+        | {
+            monitorKey: string;
+            kind: 'in_progress' | 'deleting';
+            state: 'provisioning' | 'deleting';
+            retryAt: number;
+          }
+        | { monitorKey: string; kind: 'limit_exceeded' }
+        | {
+            monitorKey: string;
+            kind: 'entity_limit_exceeded';
+            entityKey: string;
+            monitorsPerEntity: number;
+          }
+        | { monitorKey: string; kind: 'cleanup_blocked' }
+        | { monitorKey: string; kind: 'fallback' }
+      >;
+    };
+    try {
+      batch = await retryProviderMonitorLifecycleAdmission(() =>
+        client.mutation(
+          internal.providerMonitorIdentityClaims
+            .beginLifecycleProvisioningBatch,
+          {
+            orgId,
+            ...(admission ? { reservationId } : {}),
+            items: chunk.map((item) => ({
+              monitorKey: item.monitorKey,
+              operationId: item.operationId,
+              entityKey: entityKeyOf(item),
+            })),
+          },
+        ),
+      );
+    } catch (error) {
+      // Hand the grant back now rather than when it expires. Safe whether or
+      // not the batch committed: a committed batch consumed the grant, and
+      // releasing a consumed grant is a no-op.
+      if (admission && admission.granted > 0) {
+        await client
+          .mutation(
+            internal.providerMonitorCapacity.releaseExpiredOrgCapacityAdmission,
+            { orgId, reservationId },
+          )
+          .catch(() => undefined);
+      }
+      // Every item of the chunk fails the way its own admission would have
+      // failed, on its own retry path; the error is not swallowed.
+      for (const item of chunk) {
+        admissions.set(item.monitorKey, () => Promise.reject(error));
+      }
+      continue;
+    }
+    const byKey = new Map(chunk.map((item) => [item.monitorKey, item]));
+    for (const result of batch.items) {
+      const item = byKey.get(result.monitorKey);
+      if (!item) {
+        throw new Error(
+          `Provider monitor batch provisioning answered for unknown monitor ${result.monitorKey}.`,
+        );
+      }
+      byKey.delete(result.monitorKey);
+      switch (result.kind) {
+        case 'acquired':
+        case 'in_progress':
+        case 'deleting': {
+          const reservation = normalizeProviderMonitorLifecycleReservation({
+            result,
+            state: 'provisioning',
+            operationId: item.operationId,
+          });
+          admissions.set(item.monitorKey, async () => reservation);
+          break;
+        }
+        case 'limit_exceeded': {
+          if (!admission) {
+            throw new Error(
+              'Provider monitor batch provisioning refused an account it was never asked to grant.',
+            );
+          }
+          const capacity = admission.capacity;
+          admissions.set(item.monitorKey, () =>
+            Promise.reject(new ProviderMonitorOrgLimitExceededError(capacity)),
+          );
+          break;
+        }
+        case 'entity_limit_exceeded':
+          admissions.set(item.monitorKey, () =>
+            Promise.reject(
+              new ProviderMonitorEntityLimitExceededError(
+                result.entityKey,
+                result.monitorsPerEntity,
+              ),
+            ),
+          );
+          break;
+        case 'cleanup_blocked':
+          admissions.set(item.monitorKey, () =>
+            Promise.reject(
+              new ProviderMonitorCapacityCleanupRequiredError(item.monitorKey),
+            ),
+          );
+          break;
+        case 'fallback':
+          admissions.set(item.monitorKey, scalar(item));
+          break;
+      }
+    }
+    if (byKey.size > 0) {
+      throw new Error(
+        'Provider monitor batch provisioning did not answer for every monitor key.',
+      );
+    }
+  }
+  return admissions;
+}
+
 async function ensureProviderMonitorCapacityBackfill(input: {
   auth: OrgAuthContext;
 }) {

package/dist/bundling-sources/shared_libs/monitors/provider-monitor-state.ts

@@ -7,11 +7,16 @@ export type ProviderMonitorDeletionObservation = {
 /**
  * The complete customer-visible lifecycle of a monitor.
  *
+ * `provisioning` means the monitor was accepted and recorded, but the provider
+ * has not yet confirmed that it exists: it does not deliver events or bill
+ * until the create commits and the monitor becomes `active`.
+ *
  * Provider work, retries, and audit evidence intentionally live on separate
  * axes. They must never become additional values in this union.
  */
 export type ProviderMonitorCustomerState =
   | 'active'
+  | 'provisioning'
   | 'billing_suspended'
   | 'disabled';
 
@@ -21,6 +26,32 @@ export type ProviderMonitorCustomerState =
  */
 export type ProviderMonitorState = 'active' | 'inactive';
 
+/**
+ * True when a deploy submitted at `submittedAt` must leave this monitor
+ * alone: its desired state was turned inactive, or it was deleted, after the
+ * deploy was submitted. That stop is newer customer (or policy) intent. A row
+ * without `desiredChangedAt`, or a deploy without `submittedAt`, keeps the
+ * earlier behavior.
+ */
+export function providerMonitorStoppedAfter(
+  row: {
+    status?: string;
+    desired?: ProviderMonitorState;
+    desiredChangedAt?: number;
+  },
+  submittedAt: number | undefined,
+): boolean {
+  if (submittedAt === undefined || row.desiredChangedAt === undefined) {
+    return false;
+  }
+  if (row.desiredChangedAt <= submittedAt) return false;
+  return (
+    row.status === 'deleted' ||
+    row.status === 'deleting' ||
+    row.desired === 'inactive'
+  );
+}
+
 export type ProviderMonitorStatusAlias = ProviderMonitorState;
 
 declare const providerMonitorResourceIdBrand: unique symbol;
@@ -127,10 +158,11 @@ export function providerMonitorCustomerStateForBillingState(
 
 /**
  * The single public monitor-state projection. A billing suspension owns the
- * off state. Otherwise `active` is operational proof: a committed active
- * lifecycle and a non-empty provider resource binding. Internal billing
- * bookkeeping such as an unresolved usage charge must not make a usable
- * provider resource look disabled.
+ * off state. A `pending_create` lifecycle is `provisioning`: the create was
+ * recorded but the provider has not confirmed the resource. Otherwise `active`
+ * is operational proof: a committed active lifecycle and a non-empty provider
+ * resource binding. Internal billing bookkeeping such as an unresolved usage
+ * charge must not make a usable provider resource look disabled.
  */
 export function providerMonitorCustomerState(input: {
   lifecycleStatus?: string | null;
@@ -141,6 +173,7 @@ export function providerMonitorCustomerState(input: {
     input.billingState,
   );
   if (billingState === 'billing_suspended') return billingState;
+  if (input.lifecycleStatus === 'pending_create') return 'provisioning';
 
   const providerResourceId = providerMonitorResourceId(
     input.providerResourceId,
@@ -151,7 +184,11 @@ export function providerMonitorCustomerState(input: {
   return 'disabled';
 }
 
-/** Deprecated compatibility projection for the old `status`/`active` keys. */
+/**
+ * Deprecated compatibility projection for the old `status`/`active` keys. The
+ * alias stays two-valued: every non-active state, including `provisioning`,
+ * is `inactive`.
+ */
 export function providerMonitorStatusAlias(
   state: ProviderMonitorCustomerState,
 ): ProviderMonitorStatusAlias {

package/dist/bundling-sources/shared_libs/monitors/provider-webhook-monitor-runtime.ts

@@ -94,16 +94,21 @@ function managedWebhookName(input: {
 /**
  * Resolve the externally reachable origin for provider callbacks and durable
  * workers. Local Convex actions need the preview tunnel, not a loopback URL.
+ * A Vercel Preview shares its app URL settings with Production, so without
+ * an explicit origin it calls back to its own deployment, never Production.
  */
 export function resolveProviderMonitorCallbackBaseUrl(
   explicit?: string | null,
   environment: NodeJS.ProcessEnv = process.env,
 ) {
+  const previewDeployment =
+    environment.VERCEL_ENV === 'preview' ? environment.VERCEL_URL : undefined;
   const baseUrl =
     explicit ||
     environment.DEEPLINE_WORKER_CALLBACK_URL ||
     readPreviewCallbackUrlFile(environment) ||
     environment.WORKTREE_PUBLIC_APP_URL ||
+    previewDeployment ||
     environment.DEEPLINE_API_BASE_URL ||
     environment.NEXT_PUBLIC_APP_URL ||
     environment.APP_URL ||

package/dist/cli/auth-MN7MWTFR.js

@@ -0,0 +1,40 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+var _chunkPNGJIAJ3js = require('./chunk-PNGJIAJ3.js');
+require('./chunk-DD6MM6WX.js');
+require('./chunk-QP5ATTMC.js');
+require('./chunk-NPBJI7RE.js');
+require('./chunk-XNYIZMNQ.js');
+require('./chunk-PPDBRJRW.js');
+require('./chunk-YA3LMTLU.js');
+require('./chunk-OG64RBAC.js');
+require('./chunk-COGTRVWW.js');
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+exports.EXIT_WORKSPACE_MISMATCH = _chunkPNGJIAJ3js.EXIT_WORKSPACE_MISMATCH; exports.authStatusLine = _chunkPNGJIAJ3js.authStatusLine; exports.clearPendingClaim = _chunkPNGJIAJ3js.clearPendingClaim; exports.clearSatisfiedPendingClaim = _chunkPNGJIAJ3js.clearSatisfiedPendingClaim; exports.handleRegister = _chunkPNGJIAJ3js.handleRegister; exports.handleStatus = _chunkPNGJIAJ3js.handleStatus; exports.handleWait = _chunkPNGJIAJ3js.handleWait; exports.httpJson = _chunkPNGJIAJ3js.httpJson; exports.readPendingAuthClaim = _chunkPNGJIAJ3js.readPendingAuthClaim; exports.readStatusBanner = _chunkPNGJIAJ3js.readStatusBanner; exports.registerAuthCommands = _chunkPNGJIAJ3js.registerAuthCommands; exports.reportSetupCompleted = _chunkPNGJIAJ3js.reportSetupCompleted; exports.resolvePendingAuthClaimForResume = _chunkPNGJIAJ3js.resolvePendingAuthClaimForResume; exports.statusBannerLine = _chunkPNGJIAJ3js.statusBannerLine;

package/dist/cli/{auth-L7Q53QKK.mjs → auth-QITAQMHF.mjs}

@@ -13,13 +13,13 @@ import {
   reportSetupCompleted,
   resolvePendingAuthClaimForResume,
   statusBannerLine
-} from "./chunk-NFIZ5YED.mjs";
-import "./chunk-QWJJMQNE.mjs";
-import "./chunk-XSERB7H2.mjs";
+} from "./chunk-UOZCQPD4.mjs";
+import "./chunk-3O7KATMQ.mjs";
+import "./chunk-OWWFCA7A.mjs";
 import "./chunk-MAMVGOSC.mjs";
 import "./chunk-DLIRSHV6.mjs";
 import "./chunk-E4IXDAZI.mjs";
-import "./chunk-JDAXVQV7.mjs";
+import "./chunk-5MD5I4MM.mjs";
 import "./chunk-WZYKRD7T.mjs";
 import "./chunk-KRD6H754.mjs";
 export {