deepline 0.3.460 → 0.3.462

package/dist/bundling-sources/shared_libs/plays/run-output-summary.ts

@@ -0,0 +1,66 @@
+import { isSerializedPlayDataset } from './dataset';
+
+const label = (key: string) =>
+  key
+    .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+    .replace(/[_-]+/g, ' ')
+    .replace(/^./, (character) => character.toUpperCase());
+
+function datasetRowCount(value: unknown): number | null {
+  if (isSerializedPlayDataset(value)) return value.count;
+  if (!value || typeof value !== 'object') return null;
+  const record = value as Record<string, unknown>;
+  return record.kind === 'dataset' &&
+    typeof record.tableNamespace === 'string' &&
+    typeof record.count === 'number' &&
+    Number.isFinite(record.count) &&
+    record.count >= 0
+    ? record.count
+    : null;
+}
+
+/** Describe recorded output, never infer external effects from run success. */
+export function summarizeRunOutput(
+  result: unknown,
+  options: { preview?: boolean } = {},
+): string | undefined {
+  const count = datasetRowCount(result);
+  if (count !== null) {
+    return `${count} ${count === 1 ? 'row' : 'rows'} returned`;
+  }
+  if (Array.isArray(result)) {
+    if (options.preview) return undefined;
+    return `${result.length} ${result.length === 1 ? 'item' : 'items'} returned`;
+  }
+  if (typeof result !== 'object' || result === null) return undefined;
+  const output = result as Record<string, unknown>;
+  const parts: string[] = [];
+  for (const [key, value] of Object.entries(output)) {
+    if (key === '_metadata') continue;
+    if (typeof value === 'number' && Number.isFinite(value)) {
+      parts.push(`${label(key)}: ${value}`);
+    } else if (typeof value === 'boolean') {
+      parts.push(`${label(key)}: ${value ? 'Yes' : 'No'}`);
+    } else if (datasetRowCount(value) !== null) {
+      const rows = datasetRowCount(value)!;
+      parts.push(`${label(key)}: ${rows} ${rows === 1 ? 'row' : 'rows'}`);
+    } else if (Array.isArray(value) && !options.preview) {
+      parts.push(
+        `${label(key)}: ${value.length} ${value.length === 1 ? 'item' : 'items'}`,
+      );
+    }
+  }
+  // The summary names available results; the run record retains every value.
+  if (parts.length > 0) {
+    return [
+      ...parts.slice(0, 3),
+      ...(parts.length > 3 ? [`+${parts.length - 3} more results`] : []),
+    ].join(' · ');
+  }
+  const fields = Object.keys(output).filter(
+    (key) => key !== '_metadata' && output[key] !== undefined,
+  );
+  return fields.length > 0
+    ? `Returned ${fields.slice(0, 3).map(label).join(', ')}${fields.length > 3 ? ` and ${fields.length - 3} more fields` : ''}`
+    : undefined;
+}

package/dist/bundling-sources/shared_libs/plays/script-entry.ts

@@ -132,7 +132,7 @@ export type ScriptPlay = ScriptPlayParts & {
 };
 
 /**
- * The file `deepline plays run -e '<code>'` writes and runs. A one-off inline
+ * The file `deepline run -e '<code>'` (or `plays run -e`) writes and runs. A one-off inline
  * play is the only play whose tool calls may omit `description`.
  */
 export const INLINE_PLAY_FILE = '.inline.play.ts';

package/dist/bundling-sources/shared_libs/product-notifications/catalog.ts

@@ -82,6 +82,7 @@ export type ProductNotificationPresentation = {
   severity?: ProductNotificationSeverity;
   /** Selects an alternate email layout; absent means the standard one. */
   emailFormat?: 'thank_you';
+  playRun?: import('./content').PlayRunEmailContent;
 };
 
 type ProductNotificationRuleInput = {
@@ -189,6 +190,29 @@ function playRunPresentation(
   occurredAt?: number,
   trigger?: ProductNotificationTrigger,
 ): ProductNotificationPresentation {
+  const playRun = {
+    name: String(payload.playName),
+    description:
+      typeof payload.playDescription === 'string'
+        ? payload.playDescription
+        : undefined,
+    output:
+      typeof payload.outputSummary === 'string'
+        ? payload.outputSummary
+        : undefined,
+    runId: String(payload.runId),
+    details: [] as NotificationText[],
+  };
+  const context = [
+    ...(typeof payload.playDescription === 'string' &&
+    payload.playDescription.trim()
+      ? [`What this Play does: ${payload.playDescription}`]
+      : []),
+    ...(typeof payload.outputSummary === 'string' &&
+    payload.outputSummary.trim()
+      ? [`Run output: ${payload.outputSummary}`]
+      : []),
+  ];
   if (!succeeded) {
     const failedAt =
       typeof occurredAt === 'number'
@@ -196,6 +220,19 @@ function playRunPresentation(
         : null;
     return {
       title: 'Play failed',
+      playRun: {
+        ...playRun,
+        error:
+          typeof payload.reason === 'string' && payload.reason.trim()
+            ? payload.reason
+            : undefined,
+        details: [
+          ...(failedAt ? [['Failed at ', failedAt] as const] : []),
+          ...(trigger?.kind === 'consecutive_outcomes'
+            ? [['Failures ', String(trigger.count)] as const]
+            : []),
+        ],
+      },
       summary: [
         'Your play ',
         { strong: String(payload.playName) },
@@ -203,6 +240,10 @@ function playRunPresentation(
       ],
       details: [
         ['Play ', { strong: String(payload.playName) }],
+        ...context,
+        ...(typeof payload.reason === 'string' && payload.reason.trim()
+          ? [`Why it failed: ${payload.reason}`]
+          : []),
         ...(failedAt ? [['Failed at ', failedAt] as const] : []),
         ...(trigger?.kind === 'consecutive_outcomes'
           ? [['Failures ', String(trigger.count)] as const]
@@ -217,12 +258,13 @@ function playRunPresentation(
 
   return {
     title: succeeded ? 'Play succeeded' : 'Play failed',
+    playRun,
     summary: [
       `${payload.playName} ${succeeded ? 'succeeded' : 'failed'} in your `,
       { workspace: true },
       '.',
     ],
-    details: [`Run: ${payload.runId}`],
+    details: [...context, `Run: ${payload.runId}`],
     targetUrl: String(payload.targetUrl),
     subjectKind: 'play',
     subjectId: String(payload.playId),

package/dist/bundling-sources/shared_libs/product-notifications/content.ts

@@ -13,6 +13,15 @@ export type NotificationText =
 
 export type NotificationIcon = 'calendar' | 'book-open';
 
+export type PlayRunEmailContent = {
+  name: string;
+  description?: string;
+  output?: string;
+  error?: string;
+  runId: string;
+  details: NotificationText[];
+};
+
 export function notificationText(
   content: NotificationText,
   workspaceName?: string,

package/dist/bundling-sources/shared_libs/product-notifications/email.ts

@@ -8,7 +8,11 @@ import {
   notificationSettingsUrl,
   type NotificationWorkspace,
 } from './workspace';
-import { notificationText, type NotificationText } from './content';
+import {
+  notificationText,
+  type NotificationText,
+  type PlayRunEmailContent,
+} from './content';
 
 export {
   normalizeProductNotificationEmail,
@@ -38,9 +42,25 @@ type ProductNotificationEmailContent = {
    * own format so these emails can diverge later.
    */
   emailFormat?: 'thank_you';
+  playRun?: PlayRunEmailContent;
 };
 
 const MAX_RECIPIENTS = 50;
+const MAX_FAILURE_PREVIEW_CHARACTERS = 280;
+const MAX_FAILURE_PREVIEW_LINES = 3;
+
+function failurePreview(error: string): string {
+  const lines = error.split(/\r?\n/, MAX_FAILURE_PREVIEW_LINES + 1);
+  const characters = Array.from(
+    lines.slice(0, MAX_FAILURE_PREVIEW_LINES).join('\n'),
+  );
+  const shortened =
+    lines.length > MAX_FAILURE_PREVIEW_LINES ||
+    characters.length > MAX_FAILURE_PREVIEW_CHARACTERS;
+  return shortened
+    ? `${characters.slice(0, MAX_FAILURE_PREVIEW_CHARACTERS - 1).join('')}…`
+    : characters.join('');
+}
 
 /**
  * Lucide icons rasterized to 48px PNGs in the light-theme muted foreground
@@ -173,9 +193,17 @@ export function renderProductNotificationEmail(
     );
   }
 
-  const targetUrl = input.content.targetUrl
+  const playRun = input.content.playRun;
+  let targetUrl = input.content.targetUrl
     ? workspaceAppUrl(input.appUrl, input.workspaceId, input.content.targetUrl)
     : null;
+  if (playRun && input.content.targetUrl) {
+    const target = new URL(input.content.targetUrl, input.appUrl);
+    target.searchParams.set('runId', playRun.runId);
+    target.searchParams.set('tab', 'runs');
+    target.searchParams.set('view', 'run');
+    targetUrl = workspaceAppUrl(input.appUrl, input.workspaceId, target.href);
+  }
   const settingsUrl = notificationSettingsUrl(input, input.groupKey);
   const logoUrl =
     targetUrl ?? workspaceAppUrl(input.appUrl, input.workspaceId, '/dashboard');
@@ -186,17 +214,39 @@ export function renderProductNotificationEmail(
     ? unsubscribeUrl(input.oneClickUnsubscribeUrl)
     : optOutUrl;
   const showGroupHeader = input.content.emailFormat !== 'thank_you';
+  if (playRun && !targetUrl) {
+    throw new Error('Play run email requires a run link.');
+  }
+  const errorPreview = playRun?.error
+    ? failurePreview(playRun.error)
+    : undefined;
   const text = [
     input.content.title,
-    ...(showGroupHeader
+    ...(showGroupHeader && !playRun
       ? [`Notification group: ${input.content.groupName}`]
       : []),
-    ...(targetUrl ? [`Open Deepline: ${targetUrl}`] : []),
+    ...(targetUrl && !playRun ? [`Open Deepline: ${targetUrl}`] : []),
     '',
-    notificationText(input.content.summary, input.workspaceName),
-    ...input.content.details.map((detail) =>
-      notificationText(detail, input.workspaceName),
-    ),
+    ...(playRun
+      ? [
+          notificationText(input.content.summary, input.workspaceName),
+          '',
+          `${playRun.name}: ${targetUrl}`,
+          ...(playRun.description ? [playRun.description] : []),
+          '---',
+          ...(playRun.output ? [playRun.output] : []),
+          ...(errorPreview ? [`Failure: ${errorPreview}`] : []),
+          ...playRun.details.map((detail) =>
+            notificationText(detail, input.workspaceName),
+          ),
+          `Run: ${playRun.runId} (${targetUrl})`,
+        ]
+      : [
+          notificationText(input.content.summary, input.workspaceName),
+          ...input.content.details.map((detail) =>
+            notificationText(detail, input.workspaceName),
+          ),
+        ]),
     '',
     `You are receiving this because of your Deepline notification settings: ${settingsUrl}`,
     ...(optOutUrl
@@ -217,16 +267,44 @@ export function renderProductNotificationEmail(
     `<td align="left" valign="middle"><a href="${escapeHtml(logoUrl)}" style="display:inline-block;text-decoration:none"><img src="https://code.deepline.com/brand/logo_full_dark.png" width="120" height="auto" alt="Deepline" style="display:block;border:0"></a></td>`,
     `<td align="right" valign="middle">${severityBadge}</td>`,
     '</tr></table>',
-    ...(showGroupHeader
+    ...(showGroupHeader && !playRun
       ? [
           '<p style="margin:0 0 16px">',
           `<span style="font-size:12px;color:#a3a3a3;letter-spacing:.06em;text-transform:uppercase">${escapeHtml(input.content.groupName)}</span>`,
           '</p>',
         ]
       : []),
-    `<h1 style="margin:0 0 8px;font-size:22px;font-weight:600;color:#0a0a0a;line-height:1.3;letter-spacing:-0.02em">${escapeHtml(input.content.title)}</h1>`,
-    `<p style="margin:0 0 24px;font-size:15px;line-height:1.6;color:#525252">${contentHtml(input.content.summary, input.workspaceName)}</p>`,
-    ...(detailCount > 0
+    ...(playRun
+      ? [
+          `<p style="margin:0 0 24px;font-size:14px;line-height:1.6;color:#525252">${contentHtml(input.content.summary, input.workspaceName)}</p>`,
+          `<p style="margin:0 0 8px;font-size:18px;line-height:1.4"><a href="${escapeHtml(targetUrl!)}" style="color:#0a0a0a;text-decoration:underline"><strong>${escapeHtml(playRun.name)}</strong></a></p>`,
+          ...(playRun.description
+            ? [
+                `<p style="margin:0 0 24px;font-size:14px;line-height:1.6;color:#525252">${escapeHtml(playRun.description)}</p>`,
+              ]
+            : []),
+          '<div style="height:1px;background-color:#e5e5e5;margin:24px 0"></div>',
+          ...(playRun.output
+            ? [
+                `<p style="margin:0 0 16px;font-size:14px;line-height:1.6;color:#0a0a0a">${escapeHtml(playRun.output)}</p>`,
+              ]
+            : []),
+          ...(errorPreview
+            ? [
+                '<p style="margin:0 0 8px;font-size:14px;color:#0a0a0a">Failure:</p>',
+                `<pre style="margin:0 0 16px;padding:12px;background-color:#f5f5f5;border-radius:6px;white-space:pre-wrap;overflow-wrap:anywhere;user-select:all;font-family:Menlo,Consolas,monospace;font-size:14px;line-height:1.6;color:#0a0a0a"><code>${escapeHtml(errorPreview)}</code></pre>`,
+              ]
+            : []),
+          ...playRun.details.map((detail) =>
+            detailHtml(detail, input.workspaceName, false, true),
+          ),
+          `<p style="margin:16px 0 32px;font-size:14px;line-height:1.6;color:#525252">Run: <a href="${escapeHtml(targetUrl!)}" style="color:#525252;text-decoration:underline">${escapeHtml(playRun.runId)}</a></p>`,
+        ]
+      : [
+          `<h1 style="margin:0 0 8px;font-size:22px;font-weight:600;color:#0a0a0a;line-height:1.3;letter-spacing:-0.02em">${escapeHtml(input.content.title)}</h1>`,
+          `<p style="margin:0 0 24px;font-size:15px;line-height:1.6;color:#525252">${contentHtml(input.content.summary, input.workspaceName)}</p>`,
+        ]),
+    ...(!playRun && detailCount > 0
       ? [
           `<table role="presentation" width="100%" cellspacing="0" cellpadding="0" style="border:1px solid #e5e5e5;border-radius:10px;margin:0 0 28px"><tr><td style="padding:${showGroupHeader ? '4px' : '11px'} 18px">`,
           ...input.content.details.map((detail, index) =>
@@ -240,7 +318,7 @@ export function renderProductNotificationEmail(
           '</td></tr></table>',
         ]
       : []),
-    ...(targetUrl
+    ...(targetUrl && !playRun
       ? [
           '<table role="presentation" cellspacing="0" cellpadding="0" style="margin:0 0 32px"><tr>',
           `<td style="background-color:#0a0a0a;border-radius:6px"><a href="${escapeHtml(targetUrl)}" style="display:inline-block;padding:12px 24px;font-size:14px;font-weight:500;color:#ffffff;text-decoration:none">Open Deepline</a></td>`,

package/dist/bundling-sources/shared_libs/product-notifications/events.ts

@@ -173,6 +173,9 @@ export const PRODUCT_NOTIFICATION_EVENT_DEFINITIONS: readonly ProductNotificatio
       optionalFacts: {
         triggerKind: 'string',
         isAutomated: 'boolean',
+        playDescription: 'string',
+        outputSummary: 'string',
+        reason: 'string',
       },
       orderingSubjectFact: 'playId',
       allowedTriggers: ['each_match', 'consecutive_outcomes'],

package/dist/bundling-sources/shared_libs/product-notifications/slack-delivery.ts

@@ -11,7 +11,7 @@ import {
 export type SlackChannelKey =
   | 'user_signup'
   | 'session_activity'
-  | 'error_activity'
+  | 'billing_alerts'
   | 'daily_activity_summary'
   | 'integration_requests'
   | 'deploy_events'
@@ -50,8 +50,6 @@ type ResolvedRequestMetadata = {
 
 const CHANNEL_WEBHOOK_ENV: Partial<Record<SlackChannelKey, string>> = {
   session_activity: 'SLACK_SESSION_ACTIVITY_WEBHOOK_URL',
-  error_activity: 'SLACK_ERROR_ACTIVITY_WEBHOOK_URL',
-  daily_activity_summary: 'SLACK_DAILY_ACTIVITY_SUMMARY_WEBHOOK_URL',
   integration_requests: 'SLACK_INTEGRATION_REQUEST_WEBHOOK_URL',
   deploy_events: 'SLACK_DEV_WEBHOOK_URL',
   provider_health: 'SLACK_PROVIDER_HEALTH_WEBHOOK_URL',
@@ -74,7 +72,6 @@ const CHANNEL_WEBHOOK_FALLBACK_ENVS: Partial<
 const SLACK_DEEPLINE_REPORTING_BOT_TOKEN_ENV =
   'SLACK_DEEPLINE_REPORTING_BOT_TOKEN';
 const SLACK_PROVIDER_ALERTS_CHANNEL_ID_ENV = 'SLACK_PROVIDER_ALERTS_CHANNEL_ID';
-const SLACK_ERROR_ACTIVITY_CHANNEL_ID_ENV = 'SLACK_ERROR_ACTIVITY_CHANNEL_ID';
 const SLACK_USER_SIGNUP_CHANNEL_ID_ENV = 'SLACK_USER_SIGNUP_CHANNEL_ID';
 const SLACK_INBOUND_LEADS_CHANNEL_ID_ENV = 'SLACK_INBOUND_LEADS_CHANNEL_ID';
 // #alerts-gtm. Inbound demo requests go where GTM already watches for leads.
@@ -91,6 +88,11 @@ const DEFAULT_MONITOR_ERROR_ACTIVITY_CHANNEL_ID = 'C0CD0JQTU20';
 // #deepline-monitor-cron-failures: failures of scheduled jobs owned by monitors.
 export const MONITOR_CRON_FAILURES_SLACK_CHANNEL_ID = 'C0CCZCKETEV';
 
+// #deepline-billing-alerts: charge, ledger and payment notices needing review.
+export const BILLING_ALERTS_SLACK_CHANNEL_ID = 'C0CEBRS6PHS';
+// #internal-reports-deepline-api.
+export const DAILY_ACTIVITY_SUMMARY_SLACK_CHANNEL_ID = 'C0APQ088CKX';
+
 export const SDK_CLI_ACTIVITY_SLACK_CHANNEL_ID = 'C0B7D7DB40Y';
 export const SDK_CLI_ERRORS_SLACK_CHANNEL_ID = 'C0B6JUJ9QJW';
 export const SDK_CLI_FEEDBACK_SLACK_CHANNEL_ID = 'C0B63EX130F';
@@ -114,7 +116,7 @@ const CHANNEL_ALERT_LEVEL: Record<
 > = {
   user_signup: 'info',
   session_activity: 'info',
-  error_activity: 'error',
+  billing_alerts: 'error',
   daily_activity_summary: 'info',
   integration_requests: 'info',
   deploy_events: 'info',
@@ -151,12 +153,16 @@ function getSlackChannelEnvironmentRequirement(
     case 'sdk_cli_errors':
     // Vercel crons run only in production.
     case 'monitor_cron_failures':
+    // Gauntlet and local tests trigger monitor errors on purpose, and these
+    // channels fall back to production channel IDs wherever the bot token is set.
+    case 'monitor_activity':
+    case 'monitor_error_activity':
     // Preview and local deploys must never page GTM with test submissions.
     case 'inbound_leads':
+    case 'billing_alerts':
+    case 'daily_activity_summary':
       return 'prod';
     case 'session_activity':
-    case 'error_activity':
-    case 'daily_activity_summary':
     case 'integration_requests':
     case 'deploy_events':
     case 'provider_alerts':
@@ -165,8 +171,6 @@ function getSlackChannelEnvironmentRequirement(
     case 'dashboard_feedback':
     case 'python_cli_feedback':
     case 'python_cli_session':
-    case 'monitor_activity':
-    case 'monitor_error_activity':
     case 'plain_thread_activity':
       return 'all';
     default:
@@ -205,6 +209,8 @@ function requireWebhookUrl(channel: SlackChannelKey): string {
 function isBotOnlySlackChannel(channel: SlackChannelKey): boolean {
   return (
     channel === 'user_signup' ||
+    channel === 'billing_alerts' ||
+    channel === 'daily_activity_summary' ||
     channel === 'sdk_cli_activity' ||
     channel === 'sdk_cli_errors' ||
     channel === 'monitor_cron_failures' ||
@@ -222,17 +228,10 @@ function resolveBotChannel(
   if (!token) return null;
 
   switch (channel) {
-    case 'error_activity': {
-      // This is an explicit production cutover, not a global behavior change
-      // whenever a local test or Preview happens to have a reporting token.
-      const channelId =
-        process.env[SLACK_ERROR_ACTIVITY_CHANNEL_ID_ENV]?.trim();
-      if (!channelId) return null;
-      return {
-        token,
-        channelId,
-      };
-    }
+    case 'billing_alerts':
+      return { token, channelId: BILLING_ALERTS_SLACK_CHANNEL_ID };
+    case 'daily_activity_summary':
+      return { token, channelId: DAILY_ACTIVITY_SUMMARY_SLACK_CHANNEL_ID };
     case 'user_signup':
       return {
         token,
@@ -295,6 +294,17 @@ function isMonitorSlackChannel(channel: SlackChannelKey): boolean {
   return channel.startsWith('monitor_');
 }
 
+/**
+ * `getRuntimeEnv()` reads `DEEPLINE_ENV` and `CONVEX_DEPLOYMENT` before
+ * `VERCEL_ENV`, so a Preview carrying a production hint resolves to prod. A
+ * non-production Vercel marker wins for monitor channels; workers without
+ * Vercel metadata still fall through to the runtime check.
+ */
+function isNonProductionVercelDeployment(): boolean {
+  const vercelEnv = process.env.VERCEL_ENV?.trim();
+  return Boolean(vercelEnv) && vercelEnv !== 'production';
+}
+
 function isSlackChannelUnavailableError(error: unknown): boolean {
   const message = error instanceof Error ? error.message : String(error);
   return (
@@ -564,6 +574,9 @@ export async function sendSlackEvent(
   ) {
     return;
   }
+  if (isMonitorSlackChannel(channel) && isNonProductionVercelDeployment()) {
+    return;
+  }
   if (isSyntheticActorEmail(extractActorEmail(payload))) return;
   if (!payload.bypassInternalActorBlock && isBlockedInternalActor(payload)) {
     return;
@@ -600,10 +613,14 @@ export async function sendSlackEvent(
 
   const botChannel = resolveBotChannel(channel);
   if (botChannel) {
-    // Monitor cron alerts await this post, so bound it like a webhook post.
-    const controller = isMonitorSlackChannel(channel)
-      ? new AbortController()
-      : null;
+    // Monitor, billing and daily summary callers await this post, some in the
+    // request path, so bound it like a webhook post.
+    const controller =
+      isMonitorSlackChannel(channel) ||
+      channel === 'billing_alerts' ||
+      channel === 'daily_activity_summary'
+        ? new AbortController()
+        : null;
     const timeout = controller
       ? setTimeout(() => controller.abort(), resolveTimeoutMs())
       : null;

package/dist/bundling-sources/shared_libs/security/attested-client-ip.ts

@@ -0,0 +1,91 @@
+/**
+ * The app proxies Better Auth requests to Convex, whose HTTP edge reports the
+ * proxy itself as the caller. The app attests the browser's address with an
+ * HMAC so Convex can restore it, while a direct caller cannot choose one.
+ */
+export const ATTESTED_CLIENT_IP_HEADER = 'x-deepline-attested-client-ip';
+const DERIVATION_LABEL = 'deepline:attested-client-ip:v1';
+const MAX_AGE_SECONDS = 60;
+
+function hmacKey(secret: string) {
+  return crypto.subtle.importKey(
+    'raw',
+    new TextEncoder().encode(`${secret}:${DERIVATION_LABEL}`),
+    { name: 'HMAC', hash: 'SHA-256' },
+    false,
+    ['sign', 'verify'],
+  );
+}
+
+const signedPayload = (ip: string, issuedAt: number) =>
+  new TextEncoder().encode(`${ip}|${issuedAt}`);
+
+const toHex = (bytes: ArrayBuffer) =>
+  Array.from(new Uint8Array(bytes), (byte) =>
+    byte.toString(16).padStart(2, '0'),
+  ).join('');
+
+const fromHex = (hex: string) =>
+  /^(?:[0-9a-f]{2})+$/.test(hex)
+    ? Uint8Array.from(hex.match(/../g)!, (pair) => parseInt(pair, 16))
+    : null;
+
+export async function attestClientIp(input: {
+  ip: string;
+  secret: string;
+  nowMs?: number;
+}): Promise<string> {
+  const issuedAt = Math.floor((input.nowMs ?? Date.now()) / 1000);
+  const signature = await crypto.subtle.sign(
+    'HMAC',
+    await hmacKey(input.secret),
+    signedPayload(input.ip, issuedAt),
+  );
+  return `${input.ip}|${issuedAt}|${toHex(signature)}`;
+}
+
+/** The attested IP, or null when the value is malformed, stale or forged. */
+export async function verifyAttestedClientIp(input: {
+  value: string;
+  secret: string;
+  nowMs?: number;
+}): Promise<string | null> {
+  const [ip, issuedAtText, signatureHex, ...rest] = input.value.split('|');
+  const issuedAt = Number(issuedAtText);
+  const signature = fromHex(signatureHex ?? '');
+  const ageSeconds = (input.nowMs ?? Date.now()) / 1000 - issuedAt;
+  if (
+    rest.length > 0 ||
+    !ip ||
+    !signature ||
+    !Number.isInteger(issuedAt) ||
+    Math.abs(ageSeconds) > MAX_AGE_SECONDS
+  ) {
+    return null;
+  }
+  const valid = await crypto.subtle.verify(
+    'HMAC',
+    await hmacKey(input.secret),
+    signature,
+    signedPayload(ip, issuedAt),
+  );
+  return valid ? ip : null;
+}
+
+/**
+ * Replace `x-forwarded-for` with the attested client IP when the attestation
+ * verifies. The attestation header is always removed before the request
+ * reaches Better Auth.
+ */
+export async function restoreAttestedClientIp(
+  request: Request,
+  secret: string,
+): Promise<Request> {
+  const attestation = request.headers.get(ATTESTED_CLIENT_IP_HEADER);
+  if (attestation === null) return request;
+  const headers = new Headers(request.headers);
+  headers.delete(ATTESTED_CLIENT_IP_HEADER);
+  const ip = await verifyAttestedClientIp({ value: attestation, secret });
+  if (ip) headers.set('x-forwarded-for', ip);
+  return new Request(request, { headers });
+}

package/dist/bundling-sources/shared_libs/security/internal-actor.ts

@@ -25,17 +25,6 @@ export function isInternalEmail(email?: string | null): boolean {
   );
 }
 
-/** Actors allowed to request provider fixtures against the production API. */
-export function isAuthorizedProductionFixtureActor(
-  email?: string | null,
-): boolean {
-  const normalized = normalizeInternalEmail(email);
-  return (
-    isInternalEmail(normalized) ||
-    /^bootstrap-[0-9a-f]{8}@deepline\.local$/i.test(normalized ?? '')
-  );
-}
-
 /** Whether an email belongs to a Deepline staff account. */
 export function isDeeplineUser(email?: string | null): boolean {
   return isInternalEmail(email);

package/dist/cli/{auth-HKA6ZVHQ.mjs → auth-JDLEY7VU.mjs}

@@ -13,13 +13,14 @@ import {
   reportSetupCompleted,
   resolvePendingAuthClaimForResume,
   statusBannerLine
-} from "./chunk-XAYO3Q2X.mjs";
-import "./chunk-526R2HON.mjs";
-import "./chunk-OMM54B3X.mjs";
+} from "./chunk-6NNVJDVR.mjs";
+import "./chunk-NHRWZPWZ.mjs";
+import "./chunk-D6DXOUTO.mjs";
+import "./chunk-6RNQGWFD.mjs";
 import "./chunk-4QF2K7TM.mjs";
 import "./chunk-DLIRSHV6.mjs";
 import "./chunk-HBL4PM5Q.mjs";
-import "./chunk-EJGBLXDZ.mjs";
+import "./chunk-XZAFIOUQ.mjs";
 import "./chunk-WZYKRD7T.mjs";
 import "./chunk-KRD6H754.mjs";
 export {

package/dist/cli/auth-UXKY6TCC.js

@@ -0,0 +1,41 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+var _chunkNBLSCHKKjs = require('./chunk-NBLSCHKK.js');
+require('./chunk-3ACMRZRV.js');
+require('./chunk-Y4DPU4OM.js');
+require('./chunk-YT5EODJO.js');
+require('./chunk-ALJJRZNJ.js');
+require('./chunk-XNYIZMNQ.js');
+require('./chunk-DIAWYWT5.js');
+require('./chunk-7VZHXVOQ.js');
+require('./chunk-OG64RBAC.js');
+require('./chunk-COGTRVWW.js');
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+exports.EXIT_WORKSPACE_MISMATCH = _chunkNBLSCHKKjs.EXIT_WORKSPACE_MISMATCH; exports.authStatusLine = _chunkNBLSCHKKjs.authStatusLine; exports.clearPendingClaim = _chunkNBLSCHKKjs.clearPendingClaim; exports.clearSatisfiedPendingClaim = _chunkNBLSCHKKjs.clearSatisfiedPendingClaim; exports.handleRegister = _chunkNBLSCHKKjs.handleRegister; exports.handleStatus = _chunkNBLSCHKKjs.handleStatus; exports.handleWait = _chunkNBLSCHKKjs.handleWait; exports.httpJson = _chunkNBLSCHKKjs.httpJson; exports.readPendingAuthClaim = _chunkNBLSCHKKjs.readPendingAuthClaim; exports.readStatusBanner = _chunkNBLSCHKKjs.readStatusBanner; exports.registerAuthCommands = _chunkNBLSCHKKjs.registerAuthCommands; exports.reportSetupCompleted = _chunkNBLSCHKKjs.reportSetupCompleted; exports.resolvePendingAuthClaimForResume = _chunkNBLSCHKKjs.resolvePendingAuthClaimForResume; exports.statusBannerLine = _chunkNBLSCHKKjs.statusBannerLine;