deepline 0.3.460 → 0.3.462

package/dist/bundling-sources/shared_libs/monitors/callback-security.ts

@@ -1,40 +1,3 @@
-import { createHmac, timingSafeEqual } from 'node:crypto';
-
-const PARALLEL_WEBHOOK_SIGNATURE_TOLERANCE_MS = 5 * 60 * 1000;
-const STANDARD_WEBHOOK_SECRET_PREFIX = 'whsec_';
-
-type WebhookVerificationOk = {
-  ok: true;
-  mode: 'verified' | 'unsigned_non_prod';
-};
-
-type WebhookVerificationFailure = {
-  ok: false;
-  status: 401 | 500;
-  code: string;
-  message: string;
-};
-
-export type WebhookVerificationResult =
-  | WebhookVerificationOk
-  | WebhookVerificationFailure;
-
-export type ProviderCallbackBindingValidationFailure = {
-  ok: false;
-  status: 409;
-  code: 'provider_callback_binding_mismatch';
-  message: string;
-  fields: string[];
-};
-
-export type ProviderCallbackBindingValidationResult =
-  | { ok: true }
-  | ProviderCallbackBindingValidationFailure;
-
-function normalizedEnvFlag(value: string | undefined) {
-  return value?.trim().toLowerCase();
-}
-
 function readRecord(value: unknown): Record<string, unknown> {
   return value && typeof value === 'object' && !Array.isArray(value)
     ? (value as Record<string, unknown>)
@@ -48,94 +11,6 @@ function readString(value: unknown) {
   return trimmed || null;
 }
 
-function readStringAtPath(record: Record<string, unknown>, path: string) {
-  const value = path.split('.').reduce<unknown>((current, part) => {
-    if (!current || typeof current !== 'object' || Array.isArray(current)) {
-      return undefined;
-    }
-    return (current as Record<string, unknown>)[part];
-  }, record);
-  return readString(value);
-}
-
-function addString(
-  values: Set<string>,
-  value: string | number | null | undefined,
-) {
-  const string = readString(value);
-  if (string) values.add(string);
-}
-
-function genericWebhookIdsFromPayload(payload: Record<string, unknown>) {
-  const values = new Set<string>();
-  for (const path of [
-    'webhook_id',
-    'webhookId',
-    'hook_id',
-    'hookId',
-    'webhook.id',
-    'data.webhook_id',
-    'data.webhookId',
-    'data.hook_id',
-    'data.hookId',
-    'result.webhook_id',
-    'result.webhookId',
-    'result.data.webhook_id',
-    'result.data.webhookId',
-  ]) {
-    addString(values, readStringAtPath(payload, path));
-  }
-
-  const events = Array.isArray(payload.events) ? payload.events : [];
-  for (const item of events) {
-    const event = readRecord(item);
-    addString(values, readStringAtPath(event, 'webhook_id'));
-    addString(values, readStringAtPath(event, 'webhookId'));
-  }
-
-  return values;
-}
-
-function isTheirstackWebhookBindingPayload(payload: Record<string, unknown>) {
-  return Boolean(
-    readString(payload.id) &&
-    readString(payload.search_id) &&
-    readString(payload.event_type) &&
-    readString(payload.url),
-  );
-}
-
-function theirstackWebhookIdsFromPayload(payload: Record<string, unknown>) {
-  const values = new Set<string>();
-  addString(values, payload.webhook_id as string | number | null | undefined);
-  addString(values, payload.webhookId as string | number | null | undefined);
-  if (isTheirstackWebhookBindingPayload(payload)) {
-    addString(values, payload.id as string | number | null | undefined);
-  }
-  return values;
-}
-
-function theirstackSavedSearchIdsFromPayload(payload: Record<string, unknown>) {
-  const values = new Set<string>();
-  addString(values, payload.search_id as string | number | null | undefined);
-  addString(
-    values,
-    payload.saved_search_id as string | number | null | undefined,
-  );
-  return values;
-}
-
-function mismatchedFields(input: {
-  expected: string | null;
-  actual: Set<string>;
-  field: string;
-}) {
-  if (!input.expected || input.actual.size === 0) return [];
-  return [...input.actual].some((value) => value !== input.expected)
-    ? [input.field]
-    : [];
-}
-
 export function theirstackSavedSearchIdFromProviderBinding(
   providerBinding: Record<string, unknown>,
 ) {
@@ -149,185 +24,3 @@ export function theirstackSavedSearchIdFromProviderBinding(
     readString(readRecord(webhook.data).search_id)
   );
 }
-
-export function validateProviderCallbackBinding(input: {
-  provider: string;
-  payload: Record<string, unknown>;
-  providerBinding: Record<string, unknown>;
-  upstreamWebhookId?: string | null;
-}): ProviderCallbackBindingValidationResult {
-  const fields =
-    input.provider === 'theirstack'
-      ? [
-          ...mismatchedFields({
-            expected: input.upstreamWebhookId ?? null,
-            actual: theirstackWebhookIdsFromPayload(input.payload),
-            field: 'webhook_id',
-          }),
-          ...mismatchedFields({
-            expected: theirstackSavedSearchIdFromProviderBinding(
-              input.providerBinding,
-            ),
-            actual: theirstackSavedSearchIdsFromPayload(input.payload),
-            field: 'search_id',
-          }),
-        ]
-      : mismatchedFields({
-          expected: input.upstreamWebhookId ?? null,
-          actual: genericWebhookIdsFromPayload(input.payload),
-          field: 'webhook_id',
-        });
-
-  if (fields.length === 0) {
-    return { ok: true };
-  }
-
-  return {
-    ok: false,
-    status: 409,
-    code: 'provider_callback_binding_mismatch',
-    message:
-      'Callback payload provider identifiers do not match the authenticated Deepline monitor binding.',
-    fields: Array.from(new Set(fields)),
-  };
-}
-
-function shouldRequireParallelWebhookSignature() {
-  const explicit = normalizedEnvFlag(
-    process.env.DEEPLINE_REQUIRE_PARALLEL_WEBHOOK_SIGNATURE,
-  );
-  if (explicit === 'true' || explicit === '1' || explicit === 'yes') {
-    return true;
-  }
-  if (explicit === 'false' || explicit === '0' || explicit === 'no') {
-    return false;
-  }
-  return process.env.NODE_ENV === 'production';
-}
-
-function parallelWebhookSigningSecret() {
-  return (
-    process.env.DEEPLINE_PARALLEL_WEBHOOK_SECRET?.trim() ||
-    process.env.PARALLEL_WEBHOOK_SECRET?.trim() ||
-    null
-  );
-}
-
-function signingKey(secret: string) {
-  if (secret.startsWith(STANDARD_WEBHOOK_SECRET_PREFIX)) {
-    return Buffer.from(
-      secret.slice(STANDARD_WEBHOOK_SECRET_PREFIX.length),
-      'base64',
-    );
-  }
-  return secret;
-}
-
-function readStandardWebhookHeader(headers: Headers, name: string) {
-  return (
-    headers.get(name) ?? headers.get(`svix-${name.replace('webhook-', '')}`)
-  );
-}
-
-function parseTimestampMs(value: string) {
-  const trimmed = value.trim();
-  if (/^\d+$/.test(trimmed)) {
-    const numeric = Number(trimmed);
-    if (!Number.isFinite(numeric)) return null;
-    return numeric > 10_000_000_000 ? numeric : numeric * 1000;
-  }
-  const parsed = Date.parse(trimmed);
-  return Number.isFinite(parsed) ? parsed : null;
-}
-
-function readSignatures(header: string) {
-  return header
-    .split(/\s+/)
-    .map((part) => part.trim())
-    .filter(Boolean)
-    .flatMap((part) => {
-      const [version, signature] = part.split(',', 2);
-      return version === 'v1' && signature ? [signature] : [];
-    });
-}
-
-function signaturesEqual(expectedBase64: string, actualBase64: string) {
-  const expected = Buffer.from(expectedBase64, 'base64');
-  const actual = Buffer.from(actualBase64, 'base64');
-  if (expected.length === 0 || actual.length === 0) return false;
-  if (expected.length !== actual.length) return false;
-  return timingSafeEqual(expected, actual);
-}
-
-export function verifyParallelWebhookRequest(input: {
-  headers: Headers;
-  rawBody: string;
-  nowMs?: number;
-}): WebhookVerificationResult {
-  const secret = parallelWebhookSigningSecret();
-  if (!secret) {
-    if (shouldRequireParallelWebhookSignature()) {
-      return {
-        ok: false,
-        status: 500,
-        code: 'parallel_webhook_secret_missing',
-        message: 'Parallel webhook signing secret is not configured.',
-      };
-    }
-    return { ok: true, mode: 'unsigned_non_prod' };
-  }
-
-  const webhookId = readStandardWebhookHeader(input.headers, 'webhook-id');
-  const webhookTimestamp = readStandardWebhookHeader(
-    input.headers,
-    'webhook-timestamp',
-  );
-  const webhookSignature = readStandardWebhookHeader(
-    input.headers,
-    'webhook-signature',
-  );
-
-  if (!webhookId || !webhookTimestamp || !webhookSignature) {
-    return {
-      ok: false,
-      status: 401,
-      code: 'parallel_webhook_signature_missing',
-      message: 'Parallel webhook signature headers are missing.',
-    };
-  }
-
-  const timestampMs = parseTimestampMs(webhookTimestamp);
-  const nowMs = input.nowMs ?? Date.now();
-  if (
-    timestampMs === null ||
-    Math.abs(nowMs - timestampMs) > PARALLEL_WEBHOOK_SIGNATURE_TOLERANCE_MS
-  ) {
-    return {
-      ok: false,
-      status: 401,
-      code: 'parallel_webhook_timestamp_invalid',
-      message: 'Parallel webhook timestamp is outside the accepted window.',
-    };
-  }
-
-  const signedPayload = `${webhookId}.${webhookTimestamp}.${input.rawBody}`;
-  const expectedSignature = createHmac('sha256', signingKey(secret))
-    .update(signedPayload)
-    .digest('base64');
-  const signatures = readSignatures(webhookSignature);
-  if (
-    signatures.length === 0 ||
-    !signatures.some((signature) =>
-      signaturesEqual(expectedSignature, signature),
-    )
-  ) {
-    return {
-      ok: false,
-      status: 401,
-      code: 'parallel_webhook_signature_invalid',
-      message: 'Parallel webhook signature is invalid.',
-    };
-  }
-
-  return { ok: true, mode: 'verified' };
-}

package/dist/bundling-sources/shared_libs/monitors/http-error-response.ts

@@ -143,6 +143,9 @@ export function monitorErrorNextAction(payload: MonitorErrorPayload): string {
   if (code === 'monitor_control_plane_unavailable') {
     return 'Wait briefly, then rerun the same monitor read. No monitor state was changed.';
   }
+  if (code === 'monitor_job_control_plane_unavailable') {
+    return 'Wait briefly, then retry the same request once, reusing its Idempotency-Key if it sent one. Deepline could not confirm whether it was applied.';
+  }
   if (code === 'provider_monitor_identity_backfill_in_progress') {
     return typeof retryAfterSeconds === 'number'
       ? `Wait ${retryAfterSeconds} seconds, then retry the same monitor lifecycle request once. No upstream monitor was created.`

package/dist/bundling-sources/shared_libs/monitors/lifecycle-notifications.ts

@@ -18,8 +18,9 @@
 //     dev-bootstrap test orgs are always suppressed (see
 //     `shouldSuppressMonitorActor` + the transport-level guard in
 //     the shared Slack delivery contract).
-//   - Environments: ALL (dev + preview + prod). The two channels declare
-//     `requiredEnv: 'all'` in the delivery contract, so they post in local dev too.
+//   - Environments: Production only (KAR-77). Gauntlet and local tests trigger
+//     monitor errors on purpose, and these channels resolve to the production
+//     channel IDs wherever the reporting bot token is set.
 //   - Spend: NEVER include provider spend. These payloads carry only keys,
 //     counts, and trigger metadata — no provider-cost fields.
 

package/dist/bundling-sources/shared_libs/monitors/package.json

@@ -95,6 +95,8 @@
     "./quickstart-prompts.js": "./quickstart-prompts.ts",
     "./signal-radars/inbound-dead-letter": "./signal-radars/inbound-dead-letter.ts",
     "./signal-radars/inbound-dead-letter.js": "./signal-radars/inbound-dead-letter.ts",
+    "./signal-radars/inbound-failure-codes": "./signal-radars/inbound-failure-codes.ts",
+    "./signal-radars/inbound-failure-codes.js": "./signal-radars/inbound-failure-codes.ts",
     "./signal-radars/inbound-message": "./signal-radars/inbound-message.ts",
     "./signal-radars/inbound-message.js": "./signal-radars/inbound-message.ts",
     "./signal-radars/inbound-queue": "./signal-radars/inbound-queue.ts",

package/dist/bundling-sources/shared_libs/monitors/provider-callback-verification.ts

@@ -519,6 +519,40 @@ export function tamradarCallbackRadarId(payload: Record<string, unknown>) {
   );
 }
 
+export type TamradarBatchNotice = {
+  updateType: 'bulk_completed' | 'radar_failure';
+  bulkId: string;
+  itemIndex: number | null;
+  code: number | null;
+};
+
+/**
+ * A shared bulk callback also carries messages about the batch itself: the
+ * final `bulk_completed` summary, and a `radar_failure` for an item TamRadar
+ * refused, which never became a radar. Neither has a radar ID to route by, and
+ * neither is a finding. A message with no `bulk_id` is not one of these.
+ */
+export function tamradarBatchNotice(
+  payload: Record<string, unknown>,
+): TamradarBatchNotice | null {
+  const unwrapped = unwrapTamradarPayload(payload);
+  const bulkId = readString(unwrapped.bulk_id);
+  const updateType = readString(unwrapped.update_type);
+  if (
+    !bulkId ||
+    (updateType !== 'bulk_completed' && updateType !== 'radar_failure')
+  ) {
+    return null;
+  }
+  return {
+    updateType,
+    bulkId,
+    itemIndex:
+      typeof unwrapped.item_index === 'number' ? unwrapped.item_index : null,
+    code: typeof unwrapped.code === 'number' ? unwrapped.code : null,
+  };
+}
+
 function genericWebhookIds(payload: Record<string, unknown>) {
   return [
     'webhook_id',

package/dist/bundling-sources/shared_libs/monitors/provider-monitor-batch-operation.ts

@@ -499,3 +499,62 @@ export function providerMonitorBatchOperationRequestFingerprint(
   }
   return canonicalJson(normalized);
 }
+
+export type ProviderMonitorBatchChangeBucket =
+  | 'created'
+  | 'updated'
+  | 'removed';
+
+/**
+ * What a changed result did to the provider resource, by its code. Every
+ * code a runner records with `changed: true` belongs here; the
+ * provider-monitor-batch-change-buckets test reads the runner sources and
+ * fails on one that is missing. A missing code would otherwise count as
+ * changed with no bucket, so `created + updated + removed` falls short of
+ * `changed` rather than reporting a close as a create (KAR-115).
+ */
+export const PROVIDER_MONITOR_BATCH_CHANGE_BUCKETS: Readonly<
+  Record<string, ProviderMonitorBatchChangeBucket>
+> = {
+  // A new provider resource.
+  provider_batch_created: 'created',
+  provider_create_adjudicated: 'created',
+  provider_create_adopted_by_operator: 'created',
+  named_batch_create: 'created',
+  named_batch_start: 'created',
+  provider_repaired: 'created',
+  fleet_converged: 'created',
+  // An existing provider resource replaced or reconciled.
+  existing_monitor_replaced: 'updated',
+  existing_monitor_reconciled_by_identity: 'updated',
+  named_batch_update: 'updated',
+  provider_configuration_repaired: 'updated',
+  // A provider resource closed, or proven absent. A create stopped or deleted
+  // by the customer's intent before it settled ends removed.
+  upstream_deactivated: 'removed',
+  upstream_inactive_verified: 'removed',
+  already_absent_upstream: 'removed',
+  deleted_monitor_resource_closed: 'removed',
+  deleted_monitor_intent_closed: 'removed',
+  fleet_member_removed: 'removed',
+  fleet_converged_inactive: 'removed',
+  provider_batch_created_then_stopped: 'removed',
+  provider_batch_created_then_deleted: 'removed',
+  pending_create_intent_satisfied: 'removed',
+};
+
+export function providerMonitorBatchChangeBucket(input: {
+  operationKind: ProviderMonitorBatchOperationKind | undefined;
+  state: ProviderMonitorBatchResultState | undefined;
+  changed: boolean;
+  code?: string;
+}): ProviderMonitorBatchChangeBucket | null {
+  if (input.state !== 'done' || !input.changed) return null;
+  // A runner that predates a code split still records the old code, so a
+  // deactivation stays removed whatever it reports.
+  if (input.operationKind === 'deactivate') return 'removed';
+  if (input.code === undefined) return null;
+  return Object.hasOwn(PROVIDER_MONITOR_BATCH_CHANGE_BUCKETS, input.code)
+    ? PROVIDER_MONITOR_BATCH_CHANGE_BUCKETS[input.code]!
+    : null;
+}

package/dist/bundling-sources/shared_libs/monitors/provider-monitor-upstream-identity.ts

@@ -31,16 +31,26 @@ type ProviderMonitorUpstreamIdentityDefinition = {
    * treating different authored filters as an exact duplicate.
    */
   allowDistinctConfigurations?: boolean;
+  /**
+   * Payload fields that never change which findings the provider resource
+   * delivers. `updates_since` only sets how far back the first delivery
+   * replays, so two monitors that differ only there watch the same feed.
+   * Claim keys written before this list existed still carry these fields;
+   * readers resolve them through `canonicalProviderMonitorIdentityClaimKey`.
+   */
+  nonConfigurationFields?: readonly string[];
 };
 
 const PROVIDER_MONITOR_UPSTREAM_IDENTITY_FIELDS = {
   'deepline_native.company_radar': {
     fields: [{ name: 'radar_type' }, { name: 'domain' }],
     allowDistinctConfigurations: true,
+    nonConfigurationFields: ['updates_since'],
   },
   'deepline_native.contact_radar': {
     fields: [{ name: 'radar_type' }, { name: 'profile_url' }],
     allowDistinctConfigurations: true,
+    nonConfigurationFields: ['updates_since'],
   },
   'deepline_native.industry_radar': {
     fields: [
@@ -48,6 +58,7 @@ const PROVIDER_MONITOR_UPSTREAM_IDENTITY_FIELDS = {
       { name: 'industry', runtimePayloadAliases: ['keyword'] },
     ],
     allowDistinctConfigurations: true,
+    nonConfigurationFields: ['updates_since'],
   },
 } as const satisfies Record<string, ProviderMonitorUpstreamIdentityDefinition>;
 
@@ -59,6 +70,8 @@ function canonicalMonitorTool(tool: string) {
     : tool;
 }
 
+const CONFIGURATION_SEPARATOR = '#configuration=';
+
 function stableJson(value: unknown): string {
   if (Array.isArray(value)) return `[${value.map(stableJson).join(',')}]`;
   if (value && typeof value === 'object') {
@@ -172,5 +185,85 @@ export function providerMonitorUpstreamIdentityClaimKey(
     ),
   );
   if (Object.keys(configuration).length === 0) return scopeKey;
-  return `${scopeKey}#configuration=${stableJson(configuration)}`;
+  return `${scopeKey}${CONFIGURATION_SEPARATOR}${stableJson(configuration)}`;
+}
+
+function parseJsonObject(text: string): Record<string, unknown> | null {
+  try {
+    const parsed: unknown = JSON.parse(text);
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+      ? (parsed as Record<string, unknown>)
+      : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Splits a stored claim key into its scope JSON and configuration JSON. A
+ * scope value may itself contain the separator text, so the split is the one
+ * where both halves parse as JSON objects. Scope-only keys return null.
+ */
+function splitClaimKey(identityKey: string) {
+  let separator = identityKey.indexOf(CONFIGURATION_SEPARATOR);
+  while (separator !== -1) {
+    const scopeKey = identityKey.slice(0, separator);
+    const configuration = parseJsonObject(
+      identityKey.slice(separator + CONFIGURATION_SEPARATOR.length),
+    );
+    if (configuration && parseJsonObject(scopeKey)) {
+      return { scopeKey, configuration };
+    }
+    separator = identityKey.indexOf(CONFIGURATION_SEPARATOR, separator + 1);
+  }
+  return null;
+}
+
+/**
+ * The claim key with every `nonConfigurationFields` entry removed. Two claim
+ * keys with the same canonical form occupy the same provider feed. A key that
+ * is already canonical, scope-only, or for a tool without such fields is
+ * returned unchanged, so this is idempotent and safe on any stored key.
+ */
+export function canonicalProviderMonitorIdentityClaimKey(
+  tool: string,
+  identityKey: string,
+) {
+  const definition: ProviderMonitorUpstreamIdentityDefinition | undefined =
+    PROVIDER_MONITOR_UPSTREAM_IDENTITY_FIELDS[
+      canonicalMonitorTool(
+        tool,
+      ) as keyof typeof PROVIDER_MONITOR_UPSTREAM_IDENTITY_FIELDS
+    ];
+  const ignored = definition?.nonConfigurationFields;
+  if (!ignored?.length) return identityKey;
+  const parts = splitClaimKey(identityKey);
+  if (!parts) return identityKey;
+  const configuration = Object.fromEntries(
+    Object.entries(parts.configuration).filter(
+      ([field]) => !ignored.includes(field),
+    ),
+  );
+  if (Object.keys(configuration).length === 0) return parts.scopeKey;
+  return `${parts.scopeKey}${CONFIGURATION_SEPARATOR}${stableJson(configuration)}`;
+}
+
+/** Whether a claim key carries configuration beyond its scope. */
+export function providerMonitorIdentityClaimKeyHasConfiguration(
+  identityKey: string,
+) {
+  return splitClaimKey(identityKey) !== null;
+}
+
+/** True when the stored claim key and the identity key name the same feed. */
+export function providerMonitorIdentityClaimKeysMatch(
+  tool: string,
+  left: string,
+  right: string,
+) {
+  return (
+    left === right ||
+    canonicalProviderMonitorIdentityClaimKey(tool, left) ===
+      canonicalProviderMonitorIdentityClaimKey(tool, right)
+  );
 }

package/dist/bundling-sources/shared_libs/monitors/signal-radars/inbound-dead-letter.ts

@@ -1,6 +1,14 @@
 import { randomUUID } from 'node:crypto';
 import { isRepairableTenantDataPlaneError } from '@deepline/ingestion-v2/tenant-data-plane-errors';
+import {
+  MONITOR_REFUND_SETTLEMENT_PENDING_CODE,
+  PROVIDER_MONITOR_CONTROL_STATE_PENDING_CODE,
+} from '@deepline/monitors/signal-radars/inbound-failure-codes';
 import type { SignalRadarInboundMessage } from '@deepline/monitors/signal-radars/inbound-message';
+import {
+  hasMonitorSdkValidationIssues,
+  MONITOR_SDK_VALIDATION_ERROR_CODE,
+} from '@deepline/monitors/validation';
 
 // Minimal pg client seam shared with the ingestion stack: a `query(sql, args)`
 // that returns `{ rows }`. Deliberately structural so PGlite (tests) and the
@@ -38,7 +46,10 @@ export function classifyInboundFailure(error: unknown): InboundFailureClass {
       : '';
   const transientCodes = new Set([
     'tenant_data_plane_repair_required',
-    'provider_monitor_convex_sync_pending',
+    // An admission-backed callback whose Convex binding has not landed yet.
+    PROVIDER_MONITOR_CONTROL_STATE_PENDING_CODE,
+    // A refund waits for its lifecycle charge, which settles on its own clock.
+    MONITOR_REFUND_SETTLEMENT_PENDING_CODE,
     // The worker emits this after capture-first receipt persistence cannot be
     // completed. The event has not entered durable storage, so it must remain
     // retryable even after the ordinary poison-message delivery budget.
@@ -59,6 +70,9 @@ export function classifyInboundFailure(error: unknown): InboundFailureClass {
     'EPIPE',
     'ENOTFOUND',
     'EAI_AGAIN',
+    // `snitcher_ip2company_quota_exceeded` is left out on purpose: a spent
+    // quota will not recover inside the retry budget, so that event dead-letters
+    // with its payload retained and waits for a redrive.
     'snitcher_ip2company_retryable',
     '57P01', // admin shutdown
     '57P02', // crash shutdown
@@ -73,8 +87,28 @@ export function classifyInboundFailure(error: unknown): InboundFailureClass {
   ]);
   if (code && transientCodes.has(code)) return 'transient';
 
+  // A lifecycle fence is temporary contention, including while recording a
+  // billing suspension. Preserve the callback until its owner finishes; do
+  // not classify unrelated validation failures as retryable.
+  if (
+    code === MONITOR_SDK_VALIDATION_ERROR_CODE &&
+    hasMonitorSdkValidationIssues(error) &&
+    error.issues.length > 0 &&
+    error.issues.every(
+      (issue) =>
+        issue?.code === 'provider_monitor_operation_in_progress' ||
+        issue?.code === 'provider_monitor_delete_in_progress',
+    )
+  ) {
+    return 'transient';
+  }
+
   const message = errorMessage(error);
   const transientPatterns = [
+    // pg reports subsequent operations on a client whose connection failed
+    // without retaining the original socket error's code. A fresh delivery
+    // acquires a usable client; this is infrastructure failure, not poison.
+    /client has encountered a connection error and is not queryable/i,
     /connection (?:terminated|refused|reset|closed|failure)/i,
     /could not connect to server/i,
     /connection to server .* failed/i,

package/dist/bundling-sources/shared_libs/monitors/signal-radars/inbound-failure-codes.ts

@@ -0,0 +1,24 @@
+// Failure codes shared by whoever raises an inbound failure and whoever decides
+// what to do about it. A literal on each side drifted once (KAR-74), so a
+// retryable failure read as poison and dead-lettered. Convex imports this file,
+// so it holds constants only.
+
+/** An admission-backed callback whose Convex monitor binding has not landed. */
+export const PROVIDER_MONITOR_CONTROL_STATE_PENDING_CODE =
+  'provider_monitor_control_state_pending';
+
+/**
+ * A callback for a retired binding of a monitor that still exists: a replaced
+ * radar, a finished rotation or a suspension. Permanent on purpose. It can never
+ * resolve, so it dead-letters on its budget and the row keeps the payload.
+ */
+export const PROVIDER_CALLBACK_BINDING_RETIRED_CODE =
+  'provider_callback_binding_retired';
+
+/** A refund waiting for its lifecycle charge to settle. */
+export const MONITOR_REFUND_SETTLEMENT_PENDING_CODE =
+  'monitor_refund_settlement_pending';
+
+/** Storage has no blob for this receipt. No retry can bring it back. */
+export const SIGNAL_RADAR_INBOUND_PAYLOAD_MISSING_CODE =
+  'signal_radar_inbound_payload_missing';