deepline 0.3.462 → 0.3.464

package/dist/bundling-sources/sdk/src/play.ts

@@ -1498,6 +1498,8 @@ function extractorDescriptorRecord(
         .map((entry) => entry.trim())
         .filter(Boolean);
       const emailStatus = emailStatusExtractorConfig(descriptor.emailStatus);
+      const means =
+        typeof descriptor.means === 'string' ? descriptor.means : undefined;
       return [
         [
           key,
@@ -1506,6 +1508,7 @@ function extractorDescriptorRecord(
             ...(transforms.length > 0 ? { transforms } : {}),
             ...(enumValues.length > 0 ? { enum: enumValues } : {}),
             ...(emailStatus ? { emailStatus } : {}),
+            ...(means !== undefined ? { means } : {}),
           },
         ],
       ];

package/dist/bundling-sources/sdk/src/release.ts

@@ -205,7 +205,7 @@ export const SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: '0.3.462',
+  version: '0.3.464',
   updateSummary: {
     introducedIn: '0.3.90',
     summary:

package/dist/bundling-sources/shared_libs/monitors/billing/tamradar.ts

@@ -106,17 +106,25 @@ export const TAMRADAR_RADAR_TYPE_PRICING = {
     providerCostUsd: 0.045,
     unitLabel: 'finding',
   },
-  // DORMANT (disabled from deployment — see TAMRADAR_DISABLED_RADAR_TYPES).
-  // Kept for reversibility: $150/mo resell-tier subscription pricing is retained
-  // so the type can be re-enabled per-partner by removing it from the disabled
-  // set. It is excluded from the deployable enum + public pricing surface.
+  // Source: TAMRadar per-update pricing (confidential/internal), confirmed
+  // per result with TAMRadar on 2026-11-03 (it was a $150/mo resell tier).
+  // https://docs.tamradar.com/webhooks/industry/funding-rounds
   industry_funding_rounds: {
     capability: 'industry_radar',
     label: 'Industry funding rounds',
-    mode: 'monitor_subscription',
-    providerCostUsd: 150,
-    unitLabel: 'month',
-    periodDays: 30,
+    mode: 'monitor_usage',
+    providerCostUsd: 0.1,
+    unitLabel: 'finding',
+  },
+  // Source: TAMRadar per-update pricing (confidential/internal), confirmed
+  // per result with TAMRadar on 2026-11-03 (it was a $250/mo resell tier).
+  // https://docs.tamradar.com/webhooks/industry/new-companies
+  industry_new_companies: {
+    capability: 'industry_radar',
+    label: 'Industry new companies',
+    mode: 'monitor_usage',
+    providerCostUsd: 0.15,
+    unitLabel: 'finding',
   },
 } as const;
 
@@ -132,9 +140,7 @@ export function isTamradarRadarType(value: string): value is TamradarRadarType {
 // `radar_type` enum (so they never appear in `monitors tools`/CLI and payload
 // validation rejects them) and from the public pricing surface — the deploy
 // path surfaces a clear "radar type not available for deployment" error rather
-// than a bare enum mismatch. Flipping a type back on is a one-line delete here
-// (the two resell-tier types below carry resell rights and may be enabled
-// per-partner).
+// than a bare enum mismatch. Flipping a type back on is a one-line delete here.
 //
 // IMPORTANT (guardrail): these reason strings are CUSTOMER-VISIBLE — they flow
 // into the deploy-rejection `suggestion` via `tamradarDisabledRadarTypeReason`.
@@ -144,12 +150,6 @@ export function isTamradarRadarType(value: string): value is TamradarRadarType {
 export const TAMRADAR_DISABLED_RADAR_TYPES: Record<string, string> = {
   company_social_posts_cxo:
     'This Deepline radar type is not available for self-serve deploy.',
-  // Internal note (NOT customer-visible): $250/mo resell-tier subscription.
-  industry_new_companies:
-    'This Deepline radar type is not available for self-serve deploy.',
-  // Internal note (NOT customer-visible): $150/mo resell-tier subscription.
-  industry_funding_rounds:
-    'This Deepline radar type is not available for self-serve deploy.',
 };
 
 export function isTamradarDisabledRadarType(value: string): boolean {

package/dist/bundling-sources/shared_libs/monitors/provider-monitor-batch-operation.ts

@@ -521,6 +521,8 @@ export const PROVIDER_MONITOR_BATCH_CHANGE_BUCKETS: Readonly<
   provider_create_adjudicated: 'created',
   provider_create_adopted_by_operator: 'created',
   named_batch_create: 'created',
+  // A named Batch dry run's planned create, counted as the create it plans.
+  dry_run_create: 'created',
   named_batch_start: 'created',
   provider_repaired: 'created',
   fleet_converged: 'created',

package/dist/bundling-sources/shared_libs/monitors/provider-monitor-upstream-identity.ts

@@ -31,6 +31,17 @@ type ProviderMonitorUpstreamIdentityDefinition = {
    * treating different authored filters as an exact duplicate.
    */
   allowDistinctConfigurations?: boolean;
+  /**
+   * Scope values whose provider resource has no configuration of its own: a
+   * global feed delivers the same findings whatever else the payload says.
+   * Inside these scopes every other payload field (such as `updates_since`)
+   * is left out of the claim, so a second monitor for the same feed is an
+   * exact duplicate even when its other fields differ.
+   */
+  configurationFreeScopes?: readonly {
+    field: string;
+    values: readonly string[];
+  }[];
   /**
    * Payload fields that never change which findings the provider resource
    * delivers. `updates_since` only sets how far back the first delivery
@@ -58,6 +69,14 @@ const PROVIDER_MONITOR_UPSTREAM_IDENTITY_FIELDS = {
       { name: 'industry', runtimePayloadAliases: ['keyword'] },
     ],
     allowDistinctConfigurations: true,
+    // TamRadar's funding-round and new-company radars take no filter, so one
+    // per workspace is the whole feed.
+    configurationFreeScopes: [
+      {
+        field: 'radar_type',
+        values: ['industry_funding_rounds', 'industry_new_companies'],
+      },
+    ],
     nonConfigurationFields: ['updates_since'],
   },
 } as const satisfies Record<string, ProviderMonitorUpstreamIdentityDefinition>;
@@ -167,10 +186,18 @@ export function providerMonitorUpstreamIdentityClaimKey(
     return scopeKey;
   }
 
-  const definition =
+  const definition: ProviderMonitorUpstreamIdentityDefinition =
     PROVIDER_MONITOR_UPSTREAM_IDENTITY_FIELDS[
       signature.tool as keyof typeof PROVIDER_MONITOR_UPSTREAM_IDENTITY_FIELDS
     ];
+  if (
+    definition.configurationFreeScopes?.some((scope) => {
+      const value = signature.key[scope.field];
+      return typeof value === 'string' && scope.values.includes(value);
+    })
+  ) {
+    return scopeKey;
+  }
   const scopeAndAliases = new Set<string>(
     definition.fields.flatMap((field) => [
       field.name,

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -705,7 +705,9 @@ const TOOL_RETRY_AFTER_FALLBACK_MS = 1_000;
 // broken gateway-to-runner connection, not slow provider work.
 export const TOOL_EXECUTE_RESPONSE_BODY_TIMEOUT_MS = 30_000;
 const TOOL_RETRY_HEARTBEAT_INTERVAL_MS = 30_000;
-const TOOL_PROVIDER_RESIDENT_WAIT_BUDGET_MS = 5_000;
+// Avoid paying sandbox startup and checkpoint replay for ordinary provider
+// holds. Bound cumulative residency so sustained holds still park durably.
+const TOOL_PROVIDER_RESIDENT_WAIT_BUDGET_MS = 10 * 60_000;
 // The call already waited its whole admission budget in this sandbox, so it
 // rejoins the shared lane promptly instead of adding a fixed delay of its own.
 const PROVIDER_ADMISSION_REQUEUE_DELAY_MS = 1_000;

package/dist/bundling-sources/shared_libs/play-runtime/runtime-api.ts

@@ -4932,6 +4932,20 @@ async function buildRuntimeSheetDatasetStartResult(
       );
       return Object.keys(cells).length ? [{ key, cells }] : [];
     });
+  // History readers (`datasetRowInput: current_run`) seed rows from authored
+  // input plus `__deepline*` runtime fields only and read stored output through
+  // `previousCells`. Merging that output into the rows too would send every
+  // completed cell twice and can push a resume admission past its byte budget.
+  const rowFieldsForReader = (
+    data: Record<string, unknown>,
+  ): Record<string, unknown> =>
+    input.includePreviousCells
+      ? Object.fromEntries(
+          Object.entries(data).filter(([field]) =>
+            field.startsWith('__deepline'),
+          ),
+        )
+      : data;
   const buildFreshRow = (entry: RuntimeDatasetRowEntry) => {
     const row: Record<string, unknown> = {
       ...sanitizePostgresJsonValue(entry.row),
@@ -5024,7 +5038,7 @@ async function buildRuntimeSheetDatasetStartResult(
         }
         completedRows.push({
           ...entry.row,
-          ...stored,
+          ...rowFieldsForReader(stored),
           __deeplineRowKey: entry.key,
         });
       } else if (disposition === 'blocked') {
@@ -5056,7 +5070,7 @@ async function buildRuntimeSheetDatasetStartResult(
   const buildMergedRow = (entry: RuntimeDatasetRowEntry) => {
     const merged = { ...entry.row };
     for (const [field, value] of Object.entries(
-      persistedRowsByKey.get(entry.key) ?? {},
+      rowFieldsForReader(persistedRowsByKey.get(entry.key) ?? {}),
     )) {
       if (
         value !== null ||

package/dist/bundling-sources/shared_libs/play-runtime/tool-execute-retry-policy.ts

@@ -399,22 +399,25 @@ function isConcurrencyBackpressureResponse(input: {
   );
 }
 
-function isCredentialDispatchRefusalResponse(input: {
+function isPreDispatchRateRefusalResponse(input: {
   status: number;
   bodyText: string;
   executionFenced?: boolean;
 }): boolean {
-  // Fenced gateway attempts have their own qualified redelivery contract.
-  // This exemption is only for the ordinary execute route's released charge.
-  if (input.status !== 429 || input.executionFenced === true) return false;
+  if (input.status !== 429) return false;
   const body = parseJsonObject(input.bodyText);
   return (
     body?.code === 'RATE_LIMIT' &&
     body.failure_origin === 'deepline_rate_limit' &&
     body.error_category === 'rate_limit' &&
-    body.rate_limit_bucket_scope === 'credential_shared' &&
-    body.rate_limit_kind === 'requests_per_second' &&
-    body.provider_request_dispatched === false
+    body.provider_request_dispatched === false &&
+    // Workspace tool admission precedes billing for both execute paths.
+    // Credential refusals release a charge and retain their unfenced contract.
+    ((body.rate_limit_bucket_scope === 'customer_tool' &&
+      body.rate_limit_kind === 'requests_per_minute') ||
+      (input.executionFenced !== true &&
+        body.rate_limit_bucket_scope === 'credential_shared' &&
+        body.rate_limit_kind === 'requests_per_second'))
   );
 }
 
@@ -768,7 +771,7 @@ export function classifyToolExecuteHttpFailure(input: {
   const concurrencyBackpressure = isConcurrencyBackpressureResponse(input);
   const runtimeSchedulerCapacity = isRuntimeSchedulerCapacityResponse(input);
   const providerPacingWait = isProviderPacingWaitResponse(input);
-  const credentialDispatchRefusal = isCredentialDispatchRefusalResponse(input);
+  const preDispatchRateRefusal = isPreDispatchRateRefusalResponse(input);
   const edgeGatewayFailure = isEdgeGatewayFailureResponse(input);
   const executionFenced = input.executionFenced === true;
   const explicitRetryable = readExplicitToolHttpRetryability(input);
@@ -987,6 +990,6 @@ export function classifyToolExecuteHttpFailure(input: {
       runtimeSchedulerCapacity ||
       concurrencyBackpressure ||
       providerPacingWait ||
-      credentialDispatchRefusal,
+      preDispatchRateRefusal,
   };
 }

package/dist/bundling-sources/shared_libs/play-runtime/tool-result.ts

@@ -32,6 +32,12 @@ import {
   type JobChangeGetterValue,
   type JobChangeStatus,
 } from '../plays/extractor-targets';
+import {
+  fieldOfName,
+  fieldPaths,
+  resolveFieldName,
+  type FieldBinding,
+} from '../plays/field-catalog';
 import type {
   BasicToolExecuteResult,
   BasicToolResultListAccessor,
@@ -520,6 +526,10 @@ function parseExecuteToolMetadata(
             !Array.isArray(recordEntry.emailStatus)
               ? (recordEntry.emailStatus as EmailStatusExtractorConfig)
               : undefined;
+          const means =
+            typeof recordEntry.means === 'string'
+              ? recordEntry.means
+              : undefined;
           return [
             [
               key,
@@ -544,6 +554,7 @@ function parseExecuteToolMetadata(
                   : {}),
                 ...(overrides.length > 0 ? { overrides } : {}),
                 ...(emailStatus ? { emailStatus } : {}),
+                ...(means !== undefined ? { means } : {}),
               },
             ],
           ];
@@ -1276,10 +1287,10 @@ function buildTargets(
   const declaredTargetPaths = new Map<string, readonly string[]>();
   const semanticStatusTargets = new Set<string>();
   for (const [target, descriptor] of Object.entries(extractors ?? {})) {
-    // Normal scalar getters are total: a declared but absent value reads null.
-    // Semantic status getters stay absent when their provider status did not
-    // resolve; manufacturing an "unknown" status would blur no signal with an
-    // observed provider verdict.
+    // Declared getters are total: a declared but absent value reads null.
+    // Semantic status getters never borrow a sibling key or manufacture an
+    // "unknown" status, which would blur no signal with an observed provider
+    // verdict; an unresolved status reads null like any other miss.
     const isSemanticStatus =
       descriptor.emailStatus !== undefined ||
       descriptor.transforms?.some((transform) =>
@@ -1288,7 +1299,7 @@ function buildTargets(
         ),
       ) === true;
     if (isSemanticStatus) semanticStatusTargets.add(target);
-    else declaredTargetPaths.set(target, descriptor.paths);
+    declaredTargetPaths.set(target, descriptor.paths);
     const emailStatusTarget = buildEmailStatusTarget(result, descriptor);
     if (emailStatusTarget) {
       targets[target] = emailStatusTarget;
@@ -1448,8 +1459,18 @@ function applySerializedTargetValues(
   targetValues: Record<string, ToolResultTargetMetadata> | undefined,
 ): ToolExecuteResult {
   if (!targetValues || Object.keys(targetValues).length === 0) return result;
-  result._metadata.targets = targetValues;
-  result.extractedValues = buildExtractedAccessors(targetValues);
+  // Receipts saved before status getters were total omit an unresolved
+  // status. Keep every declared getter callable on replay: a target the
+  // receipt did not save reads null, never a value recomputed here.
+  const targets: Record<string, ToolResultTargetMetadata> = {};
+  for (const [target, rebuilt] of Object.entries(result._metadata.targets)) {
+    if (!Object.prototype.hasOwnProperty.call(targetValues, target)) {
+      targets[target] = { path: rebuilt.path, value: null };
+    }
+  }
+  Object.assign(targets, targetValues);
+  result._metadata.targets = targets;
+  result.extractedValues = buildExtractedAccessors(targets);
   return result;
 }
 
@@ -1530,6 +1551,71 @@ function listTableNamespace(
   }
 }
 
+/**
+ * The outputs of a result that are catalog fields: declared extractors whose
+ * meaning is known, from the tool's own `means` or the name's one meaning.
+ * Values found by guessing at keys are never bindings.
+ */
+function resultFieldBindings(
+  result: ToolExecuteResult | BasicToolExecuteResult,
+): FieldBinding[] {
+  const extractors = result._metadata.extractors ?? {};
+  return Object.entries(extractors).flatMap(([name, descriptor]) => {
+    if (!result.extractedValues[name]) return [];
+    const id = fieldOfName(name, descriptor.means);
+    return id ? [{ name, id }] : [];
+  });
+}
+
+function resultOutputNames(
+  result: ToolExecuteResult | BasicToolExecuteResult,
+): string[] {
+  return [
+    ...Object.keys(result._metadata.extractors ?? {}),
+    ...Object.keys(result.extractedLists),
+  ];
+}
+
+function readResultField(
+  result: ToolExecuteResult | BasicToolExecuteResult,
+  name: string,
+): unknown {
+  const bindings = resultFieldBindings(result);
+  const binding = resolveFieldName(name, bindings, resultOutputNames(result));
+  if (!binding) {
+    const ids = [...new Set(bindings.map((known) => known.id))];
+    throw new Error(
+      `${result._metadata.toolId} has no field "${name}". ${ids.length > 0 ? `Its fields: ${ids.join(', ')}.` : 'It declares no catalog fields.'} Other values are in result.response.`,
+    );
+  }
+  return result.extractedValues[binding.name]!.get();
+}
+
+/** `result.fields`, laid out by `fieldPaths`; each value reads on access. */
+function buildResultFields(
+  result: ToolExecuteResult | BasicToolExecuteResult,
+): Record<string, unknown> {
+  const tree: Record<string, unknown> = {};
+  const lists = Object.keys(result.extractedLists);
+  for (const entry of fieldPaths(
+    resultFieldBindings(result),
+    resultOutputNames(result),
+    lists,
+  )) {
+    let node = tree;
+    for (const key of entry.path.slice(0, -1)) {
+      node = (node[key] ??= {}) as Record<string, unknown>;
+    }
+    Object.defineProperty(node, entry.path[entry.path.length - 1]!, {
+      get: entry.list
+        ? () => result.extractedLists[entry.name]!.get()
+        : () => readResultField(result, entry.name),
+      enumerable: true,
+    });
+  }
+  return tree;
+}
+
 export function createToolExecuteResult<TResult = unknown>(input: {
   status: string;
   jobId?: string;
@@ -1604,11 +1690,33 @@ export function createToolExecuteResult<TResult = unknown>(input: {
     extractedValues,
     extractedLists,
   } as ToolExecuteResult<TResult>;
+  // Read through `this`, so copies made from these descriptors (the edition
+  // projection, native batch views) read their own values.
   Object.defineProperties(wrapper, {
     toolOutput: {
       value: toolResponse,
       enumerable: false,
     },
+    response: {
+      get(this: ToolExecuteResult) {
+        return Object.hasOwn(this.toolResponse, 'rawV2')
+          ? this.toolResponse.rawV2
+          : this.toolResponse.raw;
+      },
+      enumerable: false,
+    },
+    fields: {
+      get(this: ToolExecuteResult) {
+        return buildResultFields(this);
+      },
+      enumerable: false,
+    },
+    field: {
+      value(this: ToolExecuteResult, name: string) {
+        return readResultField(this, name);
+      },
+      enumerable: false,
+    },
   });
   Object.defineProperty(wrapper, '_metadata', {
     value: metadata,