deepline 0.3.436 → 0.3.438

package/dist/bundling-sources/sdk/src/release.ts

@@ -205,7 +205,7 @@ export const SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: '0.3.436',
+  version: '0.3.438',
   updateSummary: {
     introducedIn: '0.3.90',
     summary:

package/dist/bundling-sources/shared_libs/observability/scheduled-jobs.json

@@ -345,6 +345,25 @@
     "failureAlert": "github_workflow_run",
     "domainReportRequired": true
   },
+  {
+    "id": "github.tamradar-dev-account-cleanup",
+    "name": "TamRadar Dev Account Cleanup",
+    "workflowEvents": ["schedule"],
+    "scheduler": "github_actions",
+    "cadence": "0 3 * * *",
+    "timezone": "America/New_York",
+    "source": ".github/workflows/tamradar-dev-account-cleanup.yml",
+    "locator": "schedule:",
+    "owner": "platform",
+    "criticality": "maintenance",
+    "purpose": "Deactivate every active radar on the TamRadar dev account at 3 AM New York time, so radars left by Preview, local development and load tests cost at most a day. Refuses any key but the pinned dev key, and any account without the pinned marker radar.",
+    "successDefinition": "The run proves the pinned dev key and marker radar, deactivates every active radar it lists, and a final listing finds none.",
+    "failureDefinition": "The key or account check refuses, TamRadar refuses a radar or keeps answering 429, a final listing still finds active radars, or the pass exceeds its 45-minute timeout.",
+    "startGraceMs": 3600000,
+    "runTimeoutMs": 2700000,
+    "failureAlert": "github_workflow_run",
+    "domainReportRequired": true
+  },
   {
     "id": "github.neon-ingestion-cleanup",
     "name": "Neon Ingestion Project Cleanup",

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -6597,7 +6597,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
   }
 
   get run(): PlayAuthoringRunScope {
-    return { id: this.currentRunId };
+    return { id: this.currentRunId, actor: this.#options.runActor ?? null };
   }
 
   private get currentReceiptOwnerRunId(): string {

package/dist/bundling-sources/shared_libs/play-runtime/ctx-types.ts

@@ -888,6 +888,10 @@ export interface ContextOptions {
   maxConcurrentRows?: number | null;
   orgId?: string;
   userEmail?: string;
+  /** Immutable authenticated identity supplied by the runner, never authored input. */
+  runActor?:
+    | import('../plays/authoring-contract').PlayAuthoringRunActor
+    | null;
   playName?: string;
   graphHash?: string | null;
   artifactHash?: string | null;

package/dist/bundling-sources/shared_libs/play-runtime/execution-capabilities.ts

@@ -61,6 +61,10 @@ export type RuntimeAuthorityDescriptor = {
   synthetic?: boolean | null;
   actorUserId?: string | null;
   actorEmail?: string | null;
+  /** Account display name captured at admission; absent on older launches. */
+  actorName?: string | null;
+  /** False marks an explicitly resolved system or unavailable account; absence is legacy. */
+  actorIsUserAccount?: boolean;
   /** Durable scheduler topology, carried into each newly minted attempt token. */
   schedulerSchema?: string | null;
   /**
@@ -168,6 +172,7 @@ export function requireRuntimeAuthorityDescriptor(
     );
   }
   return {
+    ...descriptor,
     ...(descriptor.operationPolicy
       ? { operationPolicy: descriptor.operationPolicy }
       : {}),
@@ -187,6 +192,7 @@ export function requireRuntimeAuthorityDescriptor(
     synthetic: descriptor.synthetic === true,
     actorUserId: descriptor.actorUserId ?? null,
     actorEmail: descriptor.actorEmail ?? null,
+    actorName: descriptor.actorName ?? null,
     schedulerSchema: normalizeRuntimeSchedulerSchema(
       descriptor.schedulerSchema,
     ),

package/dist/bundling-sources/shared_libs/play-runtime/protocol.ts

@@ -252,6 +252,10 @@ export interface PlayRunnerContextConfig extends RetainedPipelineCarrier {
   runAttempt?: number | null;
   playName?: string;
   userEmail?: string;
+  /** Authenticated account snapshot projected from durable runtime authority. */
+  runActor?:
+    | import('../plays/authoring-contract').PlayAuthoringRunActor
+    | null;
   convexUrl?: string;
   staticPipeline?: PlayStaticPipeline | null;
   force?: boolean | null;

package/dist/bundling-sources/shared_libs/play-runtime/runner-app/index.ts

@@ -2422,6 +2422,9 @@ async function run(
     vercelProtectionBypassToken: config.context.vercelProtectionBypassToken,
     orgId: config.context.orgId,
     userEmail: config.context.userEmail,
+    runActor: config.context.runActor
+      ? Object.freeze({ ...config.context.runActor })
+      : null,
     playName: config.context.playName,
     graphHash: config.artifact.graphHash,
     artifactHash: config.artifact.artifactHash,

package/dist/bundling-sources/shared_libs/play-runtime/runtime-authority.ts

@@ -1,3 +1,4 @@
+import type { PlayAuthoringRunActor } from '../plays/authoring-contract';
 import { mintWorkflowExecutorToken } from './/workflow-executor-auth';
 import {
   DEFAULT_RUNTIME_EXECUTION_CAPABILITIES,
@@ -53,6 +54,10 @@ export function deriveAsyncChildRuntimeAuthority(input: {
     synthetic: input.parent.synthetic === true,
     actorUserId: input.parent.actorUserId ?? null,
     actorEmail: input.parent.actorEmail ?? null,
+    actorName: input.parent.actorName ?? null,
+    ...(input.parent.actorIsUserAccount !== undefined
+      ? { actorIsUserAccount: input.parent.actorIsUserAccount }
+      : {}),
     schedulerSchema: input.parent.schedulerSchema ?? null,
     docflowEnabled: input.parent.docflowEnabled === true,
     asyncChildAdmissionAttemptRequired:
@@ -102,6 +107,8 @@ export async function mintPlayRunRuntimeAuthority(input: {
   synthetic?: boolean | null;
   actorUserId?: string | null;
   actorEmail?: string | null;
+  actorName?: string | null;
+  actorIsUserAccount?: boolean;
   schedulerSchema?: string | null;
   /** Docflow rollout answer for the launching actor, resolved by the caller. */
   docflowEnabled?: boolean | null;
@@ -124,6 +131,10 @@ export async function mintPlayRunRuntimeAuthority(input: {
     synthetic: input.synthetic === true,
     actorUserId: input.actorUserId ?? null,
     actorEmail: input.actorEmail ?? null,
+    actorName: input.actorName ?? null,
+    ...(input.actorIsUserAccount !== undefined
+      ? { actorIsUserAccount: input.actorIsUserAccount }
+      : {}),
     schedulerSchema: input.schedulerSchema ?? null,
     docflowEnabled: input.docflowEnabled === true,
     capabilities: normalizeRuntimeExecutionCapabilities(
@@ -228,3 +239,17 @@ export function requireComputeBillingDispatchRuntimeAuthority(
     capabilities: ['billing.write'],
   };
 }
+
+/** Project only trusted launch facts, including launches written before names existed. */
+export function playRunActor(
+  authority: RuntimeAuthorityDescriptor | null | undefined,
+): PlayAuthoringRunActor | null {
+  if (authority?.actorIsUserAccount === false) return null;
+  const userId = authority?.actorUserId?.trim();
+  if (!userId || userId === 'unknown') return null;
+  return Object.freeze({
+    userId,
+    name: authority?.actorName?.trim() || null,
+    email: authority?.actorEmail?.trim() || null,
+  });
+}

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/postgres.ts

@@ -224,7 +224,10 @@ import {
   withPlayLaunchIdentityDigest,
 } from '../launch-identity';
 import { PlayRunLaunchConflictError } from '../play-runs/admission/contracts';
-import { mintPlayRunAttemptRuntimeToken } from '../runtime-authority';
+import {
+  mintPlayRunAttemptRuntimeToken,
+  playRunActor,
+} from '../runtime-authority';
 import { withActiveSpan } from '../../observability/tracing';
 import type {
   DurableInvocationRecord,
@@ -15725,6 +15728,7 @@ export function buildPostgresSchedulerRunnerContext(
     runAttempt,
     playName: launch.playName,
     userEmail: launch.userEmail,
+    runActor: playRunActor(launch.runtimeAuthority),
     force: launch.force === true,
     forceToolRefresh: launch.forceToolRefresh === true,
     ...(asyncAncestryPlayIds?.length

package/dist/bundling-sources/shared_libs/plays/authoring-contract.ts

@@ -1437,8 +1437,16 @@ export type PlayAuthoringRunStepsOptions = {
  * The id is unchanged while Deepline resumes or retries the same durable run.
  * A separately submitted run intentionally receives a new id.
  */
+export type PlayAuthoringRunActor = {
+  readonly userId: string;
+  readonly name: string | null;
+  readonly email: string | null;
+};
+
 export type PlayAuthoringRunScope = {
   readonly id: string;
+  /** Authenticated launching account, inherited by child Plays. Never read from inputs. */
+  readonly actor: PlayAuthoringRunActor | null;
 };
 
 /** Factual authoring guidance rendered into SDK and offline-agent references. */
@@ -3414,7 +3422,7 @@ export const PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   '  csv<T = Record<string, unknown>>(path: string | CsvInput<T & object>, options?: CsvOptions): Promise<PlayDataset<T>>;',
   '  dataset<TSource extends PlayDatasetInput<object>>(key: string, items: TSource): DatasetBuilder<PlayDatasetRow<TSource> & object, PlayDatasetRow<TSource> & object>;',
   '  map<TSource extends PlayDatasetInput<object>>(key: string, items: TSource, options?: DatasetDefinitionOptions<PlayDatasetRow<TSource> & object>): never;',
-  '  readonly run: { readonly id: string };',
+  '  readonly run: { readonly id: string; readonly actor: { readonly userId: string; readonly name: string | null; readonly email: string | null } | null };',
   `  runSteps<TInput extends Record<string, unknown>, TOutput>(program: RunnableStepProgram<TInput, TOutput>, input: TInput, options?: { description?: ${cloudReferenceType('ctx.runSteps.options.description')}; staleAfterSeconds?: ${cloudReferenceType('ctx.runSteps.options.staleAfterSeconds')} }): Promise<TOutput>;`,
   '  tools: { execute<K extends string>(request: ToolExecutionRequest<K>): Promise<ToolExecutionOutput<K>> };',
   `  customerDb: { query<TRow extends Record<string, unknown> = Record<string, unknown>>(statement: SqlQuery, options?: { id?: ${cloudReferenceType('ctx.customerDb.query.options.id')}; staleAfterSeconds?: ${cloudReferenceType('ctx.customerDb.query.options.staleAfterSeconds')}; maxRows?: ${cloudReferenceType('ctx.customerDb.query.options.maxRows')}; timeoutMs?: ${cloudReferenceType('ctx.customerDb.query.options.timeoutMs')} }): Promise<TRow[]> };`,

package/dist/cli/auth-7MV6G26U.js

@@ -0,0 +1,40 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+var _chunkKQJMCYFPjs = require('./chunk-KQJMCYFP.js');
+require('./chunk-S5AVEKTO.js');
+require('./chunk-OSQEFBQA.js');
+require('./chunk-NPBJI7RE.js');
+require('./chunk-XNYIZMNQ.js');
+require('./chunk-PPDBRJRW.js');
+require('./chunk-EBGHNXSH.js');
+require('./chunk-OG64RBAC.js');
+require('./chunk-COGTRVWW.js');
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+exports.EXIT_WORKSPACE_MISMATCH = _chunkKQJMCYFPjs.EXIT_WORKSPACE_MISMATCH; exports.authStatusLine = _chunkKQJMCYFPjs.authStatusLine; exports.clearPendingClaim = _chunkKQJMCYFPjs.clearPendingClaim; exports.clearSatisfiedPendingClaim = _chunkKQJMCYFPjs.clearSatisfiedPendingClaim; exports.handleRegister = _chunkKQJMCYFPjs.handleRegister; exports.handleStatus = _chunkKQJMCYFPjs.handleStatus; exports.handleWait = _chunkKQJMCYFPjs.handleWait; exports.httpJson = _chunkKQJMCYFPjs.httpJson; exports.readPendingAuthClaim = _chunkKQJMCYFPjs.readPendingAuthClaim; exports.readStatusBanner = _chunkKQJMCYFPjs.readStatusBanner; exports.registerAuthCommands = _chunkKQJMCYFPjs.registerAuthCommands; exports.reportSetupCompleted = _chunkKQJMCYFPjs.reportSetupCompleted; exports.resolvePendingAuthClaimForResume = _chunkKQJMCYFPjs.resolvePendingAuthClaimForResume; exports.statusBannerLine = _chunkKQJMCYFPjs.statusBannerLine;

package/dist/cli/{auth-A6D2PZMU.mjs → auth-UDRY6ZL5.mjs}

@@ -13,13 +13,13 @@ import {
   reportSetupCompleted,
   resolvePendingAuthClaimForResume,
   statusBannerLine
-} from "./chunk-IL2YE7B7.mjs";
-import "./chunk-E4ED66S3.mjs";
-import "./chunk-IBF6ASRS.mjs";
+} from "./chunk-DGGQXHAO.mjs";
+import "./chunk-2OTCHLWC.mjs";
+import "./chunk-G6HUOVZ4.mjs";
 import "./chunk-MAMVGOSC.mjs";
 import "./chunk-DLIRSHV6.mjs";
 import "./chunk-E4IXDAZI.mjs";
-import "./chunk-VZ7XCNT7.mjs";
+import "./chunk-SJBJYNJ3.mjs";
 import "./chunk-WZYKRD7T.mjs";
 import "./chunk-KRD6H754.mjs";
 export {

package/dist/cli/{billing-SWG3FF6U.mjs → billing-3PTMADUE.mjs}

@@ -2,7 +2,7 @@ import {
   DeeplineClient,
   iterateCursorPages,
   requireBillingIdempotencyKey
-} from "./chunk-TEDJQVSP.mjs";
+} from "./chunk-GBIWLNWI.mjs";
 import "./chunk-L2VKAASU.mjs";
 import "./chunk-KCC3FKIW.mjs";
 import "./chunk-EIMG75BT.mjs";
@@ -13,8 +13,8 @@ import {
   openInBrowser,
   printCommandEnvelope,
   shouldEmitJson
-} from "./chunk-E4ED66S3.mjs";
-import "./chunk-IBF6ASRS.mjs";
+} from "./chunk-2OTCHLWC.mjs";
+import "./chunk-G6HUOVZ4.mjs";
 import {
   AuthError,
   ConfigError
@@ -23,7 +23,7 @@ import "./chunk-DLIRSHV6.mjs";
 import {
   DeeplineError
 } from "./chunk-E4IXDAZI.mjs";
-import "./chunk-VZ7XCNT7.mjs";
+import "./chunk-SJBJYNJ3.mjs";
 import "./chunk-WZYKRD7T.mjs";
 import "./chunk-KRD6H754.mjs";