deepline 0.3.85 → 0.3.87

package/dist/bundling-sources/shared_libs/monitors/provider-monitor-consumer-health.ts

@@ -0,0 +1,56 @@
+import { internal } from '@convex/_generated/api';
+import { getRequiredInternalConvexClient } from '@/lib/convex/internal-client';
+
+type MonitorStreamResource = {
+  key: string;
+  tool: string;
+  outputs?: unknown;
+};
+
+function record(value: unknown): Record<string, unknown> {
+  return value && typeof value === 'object' && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : {};
+}
+
+/**
+ * Resolve current SQL-listener consumers for one monitor. Binding metadata is
+ * cheap and preserves the established `bound_plays` list contract. Delivery/run
+ * health is an explicit, bounded opt-in; monitor source/webhook health remains
+ * on the monitor resource itself.
+ */
+export async function boundPlaysForProviderMonitor(input: {
+  orgId: string;
+  monitor: MonitorStreamResource;
+  includeHealth?: boolean;
+}): Promise<{ plays: unknown[]; truncated: boolean }> {
+  const outputs = record(input.monitor.outputs);
+  const tables = Object.values(outputs).flatMap((output) => {
+    const table = record(output).table;
+    return typeof table === 'string' ? [table] : [];
+  });
+  const [provider, capability] = input.monitor.tool.split('.', 2);
+  if (!provider || !capability) return { plays: [], truncated: false };
+
+  const convex = getRequiredInternalConvexClient();
+  const bound = (await convex.query(
+    internal.monitorObservability.dependentPlaysForMonitor,
+    {
+      orgId: input.orgId,
+      monitorKey: input.monitor.key,
+      provider,
+      capability,
+      outputKeys: Object.keys(outputs),
+      tables,
+      includeHealth: input.includeHealth === true,
+    },
+  )) as { plays?: unknown[]; truncated?: boolean } | null;
+
+  // Consumer-health is supplementary observability. An absent result during a
+  // rolling control-plane deploy must never make the established monitor
+  // list/get surface fail; it simply means there are no observable consumers.
+  return {
+    plays: Array.isArray(bound?.plays) ? bound.plays : [],
+    truncated: bound?.truncated === true,
+  };
+}

package/dist/bundling-sources/shared_libs/monitors/provider-monitor-errors.ts

@@ -0,0 +1,131 @@
+export class ProviderMonitorNotFoundError extends Error {
+  constructor(readonly monitorKey: string) {
+    super(`Provider monitor "${monitorKey}" was not found.`);
+    this.name = 'ProviderMonitorNotFoundError';
+  }
+}
+
+/**
+ * An old Convex org is being indexed for exact provider-identity admission.
+ * This is intentionally a temporary, retryable refusal instead of making one
+ * customer-facing deploy synchronously scan every legacy monitor definition.
+ */
+export class ProviderMonitorIdentityBackfillInProgressError extends Error {
+  constructor() {
+    super(
+      'Monitor identity records are still being prepared for this workspace. Retry in a few seconds; no upstream monitor was created.',
+    );
+    this.name = 'ProviderMonitorIdentityBackfillInProgressError';
+  }
+}
+
+/**
+ * A caller tried to publish an older monitor definition after newer control
+ * state had committed. Re-read before deciding whether to retry.
+ */
+export class ProviderMonitorControlStateConflictError extends Error {
+  constructor(readonly monitorKey: string) {
+    super(
+      `Monitor "${monitorKey}" changed while this update was in progress. Re-read it and retry the update if it is still needed.`,
+    );
+    this.name = 'ProviderMonitorControlStateConflictError';
+  }
+}
+
+export class ProviderMonitorCapacityBackfillInProgressError extends Error {
+  constructor() {
+    super(
+      'Monitor capacity records are still being prepared for this workspace. Retry in a few seconds; no upstream monitor was created.',
+    );
+    this.name = 'ProviderMonitorCapacityBackfillInProgressError';
+  }
+}
+
+export type ProviderMonitorCapacitySnapshot = {
+  used: number;
+  reserved: number;
+  limit: number;
+  remaining: number;
+  over_by: number;
+  can_create: boolean;
+};
+
+export class ProviderMonitorOrgLimitExceededError extends Error {
+  readonly code = 'ORG_MONITOR_LIMIT_EXCEEDED';
+
+  constructor(readonly capacity: ProviderMonitorCapacitySnapshot) {
+    super(
+      `This organization is watching ${capacity.used + capacity.reserved} of ${capacity.limit} accounts.`,
+    );
+    this.name = 'ProviderMonitorOrgLimitExceededError';
+  }
+}
+
+/**
+ * The organization may watch this account, but not with another signal.
+ *
+ * Distinct from the organization limit on purpose: the customer's next action
+ * is different. A full organization means stop watching some account; a full
+ * account means drop one of the signals on this one.
+ */
+export class ProviderMonitorEntityLimitExceededError extends Error {
+  readonly code = 'MONITOR_ENTITY_LIMIT_EXCEEDED';
+
+  constructor(
+    readonly entityKey: string,
+    readonly monitorsPerEntity: number,
+  ) {
+    super(
+      `This account already has ${monitorsPerEntity} of ${monitorsPerEntity} monitors.`,
+    );
+    this.name = 'ProviderMonitorEntityLimitExceededError';
+  }
+}
+
+export class ProviderMonitorCapacityCleanupRequiredError extends Error {
+  readonly code = 'MONITOR_CAPACITY_CLEANUP_REQUIRED';
+
+  constructor(readonly monitorKey: string) {
+    super(
+      `Monitor "${monitorKey}" still owns capacity because upstream cleanup is incomplete.`,
+    );
+    this.name = 'ProviderMonitorCapacityCleanupRequiredError';
+  }
+}
+
+/**
+ * An update already created its new upstream resource and is waiting to remove
+ * the recorded previous one. A different desired definition is unsafe until
+ * the original update finishes.
+ */
+export class ProviderMonitorUpdateOperationInProgressError extends Error {
+  constructor(readonly monitorKey: string) {
+    super(
+      `Monitor "${monitorKey}" is still finishing its previous change. Rerun that same deploy or update before making a different change.`,
+    );
+    this.name = 'ProviderMonitorUpdateOperationInProgressError';
+  }
+}
+
+/**
+ * A prior delete reached an upstream provider and did not get a confirmed
+ * result. Only a retry of that delete may proceed; a deploy or update would
+ * risk creating a second resource while the first is still live.
+ */
+export class ProviderMonitorDeleteOperationInProgressError extends Error {
+  constructor(readonly monitorKey: string) {
+    super(
+      `Monitor "${monitorKey}" still has an unfinished delete. Rerun the same delete before deploying, updating, or reactivating it.`,
+    );
+    this.name = 'ProviderMonitorDeleteOperationInProgressError';
+  }
+}
+
+export class PriorityMonitorExecutionLimitError extends Error {
+  constructor(readonly max: number) {
+    super(
+      `This workspace already has ${max} priority radars. Remove priority from a radar that is no longer urgent before creating another one.`,
+    );
+    this.name = 'PriorityMonitorExecutionLimitError';
+  }
+}

package/dist/bundling-sources/shared_libs/monitors/provider-monitor-identity-claims.ts

@@ -0,0 +1,527 @@
+import { randomUUID } from 'node:crypto';
+import {
+  PriorityMonitorExecutionLimitError,
+  ProviderMonitorCapacityBackfillInProgressError,
+  ProviderMonitorCapacityCleanupRequiredError,
+  ProviderMonitorIdentityBackfillInProgressError,
+  ProviderMonitorEntityLimitExceededError,
+  ProviderMonitorOrgLimitExceededError,
+} from '@deepline/monitors/provider-monitor-errors';
+import { MAX_PRIORITY_MONITORS_PER_ORG } from '@deepline/monitors/provider-monitor-priority-execution';
+import { internal } from '@convex/_generated/api';
+import { getRequiredInternalConvexClient } from '@/lib/convex/internal-client';
+import {
+  providerMonitorUpstreamIdentitySignature,
+  type ProviderMonitorUpstreamIdentitySignature,
+} from '@deepline/monitors/provider-monitor-upstream-identity';
+
+export type ProviderMonitorIdentityClaim = {
+  tool: string;
+  identityKey: string;
+  identity: Record<string, string | null>;
+};
+
+type OrgAuthContext = { orgId: string };
+
+/**
+ * The durable control-plane release operation needs only the opaque claim
+ * locator. Keep the display identity out of this boundary: Convex validates
+ * release arguments strictly so a rich conflict claim cannot turn a completed
+ * upstream delete into a failed local transition.
+ */
+export type ProviderMonitorIdentityClaimReference = Pick<
+  ProviderMonitorIdentityClaim,
+  'tool' | 'identityKey'
+>;
+
+export function providerMonitorIdentityClaimReference(
+  claim: ProviderMonitorIdentityClaim | null | undefined,
+): ProviderMonitorIdentityClaimReference | null {
+  return claim ? { tool: claim.tool, identityKey: claim.identityKey } : null;
+}
+
+export type ProviderMonitorIdentityReservation =
+  | {
+      kind: 'acquired';
+      claim: ProviderMonitorIdentityClaim;
+      restoredState: 'release' | 'active';
+      operationId: string;
+    }
+  | {
+      kind: 'occupied';
+      claim: ProviderMonitorIdentityClaim;
+      monitorKey: string;
+      state: 'provisioning' | 'active' | 'migration_conflict';
+      conflictingMonitorKeys?: string[];
+    }
+  | {
+      kind: 'in_progress';
+      claim: ProviderMonitorIdentityClaim;
+      monitorKey: string;
+      retryAt: number;
+    };
+
+/**
+ * An exact, per-monitor-key fence around an upstream lifecycle request.
+ * Unlike an identity claim, this applies even when a provider does not expose
+ * an account-unique identity.
+ */
+export type ProviderMonitorLifecycleReservation =
+  | {
+      kind: 'acquired';
+      state: 'provisioning' | 'deleting';
+      operationId: string;
+    }
+  | {
+      kind: 'in_progress';
+      state: 'provisioning' | 'deleting';
+      retryAt: number;
+    }
+  | {
+      kind: 'deleting';
+      state: 'deleting';
+      retryAt: number;
+    }
+  | {
+      kind: 'not_eligible';
+    };
+
+function record(value: unknown): Record<string, unknown> | null {
+  return value && typeof value === 'object' && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : null;
+}
+
+function finiteNumber(value: unknown): number | null {
+  return typeof value === 'number' && Number.isFinite(value) ? value : null;
+}
+
+/** Convex owns lifecycle admission and validates every durable result. */
+export function normalizeProviderMonitorLifecycleReservation(input: {
+  result: unknown;
+  state: 'provisioning' | 'deleting';
+  operationId: string;
+}): ProviderMonitorLifecycleReservation {
+  const result = record(input.result);
+  if (!result || typeof result.kind !== 'string') {
+    throw new Error(
+      'Provider monitor lifecycle admission returned an invalid control-plane result.',
+    );
+  }
+  if (result.kind === 'acquired') {
+    return {
+      kind: 'acquired',
+      state: input.state,
+      operationId: input.operationId,
+    };
+  }
+  if (result.kind === 'not_eligible') {
+    return { kind: 'not_eligible' };
+  }
+  if (
+    (result.kind !== 'in_progress' && result.kind !== 'deleting') ||
+    (result.state !== 'provisioning' && result.state !== 'deleting') ||
+    finiteNumber(result.retryAt) === null
+  ) {
+    throw new Error(
+      'Provider monitor lifecycle admission returned an unknown control-plane result.',
+    );
+  }
+  if (result.kind === 'deleting' && result.state !== 'deleting') {
+    throw new Error(
+      'Provider monitor lifecycle deletion admission returned an invalid operation state.',
+    );
+  }
+  if (result.kind === 'in_progress') {
+    return {
+      kind: 'in_progress',
+      state: result.state as 'provisioning' | 'deleting',
+      retryAt: result.retryAt as number,
+    };
+  }
+  return {
+    kind: 'deleting',
+    state: 'deleting',
+    retryAt: result.retryAt as number,
+  };
+}
+
+function claimFromSignature(
+  signature: ProviderMonitorUpstreamIdentitySignature,
+): ProviderMonitorIdentityClaim {
+  const identity = Object.fromEntries(
+    Object.entries(signature.key).sort(([a], [b]) => a.localeCompare(b)),
+  );
+  return {
+    tool: signature.tool,
+    identityKey: JSON.stringify(identity),
+    identity,
+  };
+}
+
+export function providerMonitorIdentityClaim(input: {
+  tool: string;
+  payload: Record<string, unknown> | null | undefined;
+}) {
+  // Claims protect provider resources, including legacy rows whose public
+  // capability id was later retired. The Convex-safe identity contract owns
+  // those aliases; the live capability registry intentionally does not.
+  const signature = providerMonitorUpstreamIdentitySignature(
+    input.tool,
+    input.payload,
+  );
+  return signature ? claimFromSignature(signature) : null;
+}
+
+/**
+ * Makes a legacy Convex org safe for indexed identity admission. A new org
+ * gets one bounded page inline so normal small workspaces stay transparent;
+ * a larger org continues in a durable, no-provider-side-effect Convex job and
+ * receives a retryable response rather than scanning tens of thousands of
+ * legacy definitions synchronously. Later calls are a single complete-marker
+ * read.
+ */
+export async function ensureProviderMonitorIdentityBackfill(input: {
+  auth: OrgAuthContext;
+}) {
+  const client = getRequiredInternalConvexClient();
+  const globallyComplete = await client.query(
+    internal.providerMonitorIdentityClaims.globalBackfillComplete,
+    {},
+  );
+  if (globallyComplete) return;
+  const state = await client.query(
+    internal.providerMonitorIdentityClaims.backfillStatus,
+    { orgId: input.auth.orgId },
+  );
+  if (state === 'complete') return;
+
+  if (state === 'not_started') {
+    // The marker/fence is committed before the first page reads the legacy
+    // index. Therefore every caller, including a rolling pre-claim app
+    // process, reaches the current Convex upsert and cannot slip an unclaimed
+    // identity behind this cursor.
+    await client.mutation(
+      internal.providerMonitorIdentityClaims.startBackfill,
+      { orgId: input.auth.orgId, schedule: false },
+    );
+    const initialPage = await client.mutation(
+      internal.providerMonitorIdentityClaims.backfillNextPage,
+      { orgId: input.auth.orgId },
+    );
+    if (initialPage.complete) return;
+  }
+
+  const started = await client.mutation(
+    internal.providerMonitorIdentityClaims.startBackfill,
+    { orgId: input.auth.orgId },
+  );
+  if (started.state === 'complete') return;
+  throw new ProviderMonitorIdentityBackfillInProgressError();
+}
+
+export async function getProviderMonitorIdentityOwner(input: {
+  auth: OrgAuthContext;
+  claim: ProviderMonitorIdentityClaim;
+}) {
+  return getRequiredInternalConvexClient().query(
+    internal.providerMonitorIdentityClaims.get,
+    {
+      orgId: input.auth.orgId,
+      tool: input.claim.tool,
+      identityKey: input.claim.identityKey,
+    },
+  );
+}
+
+export function providerMonitorIdentityProvisioningForMonitor(input: {
+  auth: OrgAuthContext;
+  monitorKey: string;
+}) {
+  return getRequiredInternalConvexClient().query(
+    internal.providerMonitorIdentityClaims.provisioningForMonitor,
+    { orgId: input.auth.orgId, monitorKey: input.monitorKey },
+  );
+}
+
+export function priorityMonitorExecutionLimitFromLifecycleError(
+  error: unknown,
+) {
+  if (
+    error instanceof Error &&
+    error.message.includes('PRIORITY_MONITOR_LIMIT_EXCEEDED')
+  ) {
+    return new PriorityMonitorExecutionLimitError(
+      MAX_PRIORITY_MONITORS_PER_ORG,
+    );
+  }
+  return null;
+}
+
+// Convex retries mutations itself. This is the bounded outer retry for the
+// rare case in which that budget is exhausted while the short capacity-fold
+// mutation is updating the same organization fence. Lifecycle admission is
+// still pre-provider and reuses one operation id, so replaying it cannot make
+// an upstream monitor, charge, or fence duplicate.
+const LIFECYCLE_ADMISSION_WRITE_CONFLICT =
+  /write conflict|optimisticconcurrencycontrolfailure|documents read from or written to .* changed while this mutation was being run/i;
+const MAX_LIFECYCLE_ADMISSION_RETRIES = 3;
+
+function lifecycleAdmissionWriteConflict(error: unknown) {
+  const message =
+    error instanceof Error
+      ? error.message
+      : typeof error === 'string'
+        ? error
+        : '';
+  return LIFECYCLE_ADMISSION_WRITE_CONFLICT.test(message);
+}
+
+async function sleep(ms: number) {
+  await new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+export async function retryProviderMonitorLifecycleAdmission<T>(
+  operation: () => Promise<T>,
+): Promise<T> {
+  for (
+    let attempt = 0;
+    attempt <= MAX_LIFECYCLE_ADMISSION_RETRIES;
+    attempt += 1
+  ) {
+    try {
+      return await operation();
+    } catch (error) {
+      if (
+        !lifecycleAdmissionWriteConflict(error) ||
+        attempt === MAX_LIFECYCLE_ADMISSION_RETRIES
+      ) {
+        throw error;
+      }
+      await sleep(25 * 2 ** attempt);
+    }
+  }
+  throw new Error('Provider monitor lifecycle admission retry exhausted.');
+}
+
+export async function beginProviderMonitorLifecycleReservation(input: {
+  auth: OrgAuthContext;
+  monitorKey: string;
+  /** Tool and payload of the monitor being provisioned, so capacity can be
+   *  counted against the account it watches rather than against the row. */
+  entityKey?: string | null;
+  state: 'provisioning' | 'deleting';
+  priorityExecutionSlots?: number;
+  expectedControlStateRevision?: number;
+  requiredMonitorStatus?: 'active';
+}): Promise<ProviderMonitorLifecycleReservation> {
+  const operationId = randomUUID();
+  const action =
+    input.state === 'provisioning'
+      ? internal.providerMonitorIdentityClaims.beginLifecycleProvisioning
+      : internal.providerMonitorIdentityClaims.beginLifecycleDeletion;
+  const request = () =>
+    getRequiredInternalConvexClient().mutation(action, {
+      orgId: input.auth.orgId,
+      monitorKey: input.monitorKey,
+      operationId,
+      ...(input.entityKey ? { entityKey: input.entityKey } : {}),
+      ...(input.priorityExecutionSlots === 1
+        ? { priorityExecutionSlots: 1 }
+        : {}),
+      ...(typeof input.expectedControlStateRevision === 'number'
+        ? { expectedControlStateRevision: input.expectedControlStateRevision }
+        : {}),
+      ...(input.requiredMonitorStatus
+        ? { requiredMonitorStatus: input.requiredMonitorStatus }
+        : {}),
+    });
+  // A priority-slot refusal arrives as a thrown lifecycle error, while the
+  // capacity outcomes below arrive as a returned kind. Both paths have to work
+  // on the same call, and the backfill retry has to re-run the same request.
+  const attempt = async () => {
+    try {
+      return await request();
+    } catch (error) {
+      const priorityLimit =
+        priorityMonitorExecutionLimitFromLifecycleError(error);
+      if (priorityLimit) throw priorityLimit;
+      throw error;
+    }
+  };
+  let result = await retryProviderMonitorLifecycleAdmission(attempt);
+  if (result.kind === 'backfill_required') {
+    await ensureProviderMonitorCapacityBackfill({ auth: input.auth });
+    result = await retryProviderMonitorLifecycleAdmission(attempt);
+  }
+  if (result.kind === 'limit_exceeded') {
+    throw new ProviderMonitorOrgLimitExceededError(result.capacity);
+  }
+  if (result.kind === 'entity_limit_exceeded') {
+    throw new ProviderMonitorEntityLimitExceededError(
+      result.entityKey,
+      result.capacity.monitors_per_entity,
+    );
+  }
+  if (result.kind === 'cleanup_blocked') {
+    throw new ProviderMonitorCapacityCleanupRequiredError(input.monitorKey);
+  }
+  if (result.kind === 'backfill_required') {
+    throw new ProviderMonitorCapacityBackfillInProgressError();
+  }
+  return normalizeProviderMonitorLifecycleReservation({
+    result,
+    state: input.state,
+    operationId,
+  });
+}
+
+async function ensureProviderMonitorCapacityBackfill(input: {
+  auth: OrgAuthContext;
+}) {
+  const client = getRequiredInternalConvexClient();
+  const state = await client.query(
+    internal.providerMonitorCapacity.backfillStatus,
+    { orgId: input.auth.orgId },
+  );
+  if (state === 'complete') return;
+
+  if (state === 'not_started') {
+    await client.mutation(internal.providerMonitorCapacity.startBackfill, {
+      orgId: input.auth.orgId,
+      schedule: false,
+    });
+    const initialPage = await client.mutation(
+      internal.providerMonitorCapacity.backfillNextPage,
+      { orgId: input.auth.orgId },
+    );
+    if (initialPage.complete) return;
+  }
+
+  const started = await client.mutation(
+    internal.providerMonitorCapacity.startBackfill,
+    { orgId: input.auth.orgId },
+  );
+  if (started.state === 'complete') return;
+  throw new ProviderMonitorCapacityBackfillInProgressError();
+}
+
+export function failProviderMonitorLifecycleReservation(input: {
+  auth: OrgAuthContext;
+  monitorKey: string;
+  reservation: Extract<
+    ProviderMonitorLifecycleReservation,
+    { kind: 'acquired' }
+  >;
+}) {
+  return getRequiredInternalConvexClient().mutation(
+    internal.providerMonitorIdentityClaims.failLifecycleOperation,
+    {
+      orgId: input.auth.orgId,
+      monitorKey: input.monitorKey,
+      state: input.reservation.state,
+      operationId: input.reservation.operationId,
+    },
+  );
+}
+
+export async function beginProviderMonitorIdentityReservation(input: {
+  auth: OrgAuthContext;
+  monitorKey: string;
+  tool: string;
+  payload: Record<string, unknown> | null | undefined;
+  /**
+   * Resume rather than wait when THIS monitor key already holds a provisioning
+   * claim. Only for callers that serialise their own passes for a member -
+   * see `reclaimSelfProvisioning` on the mutation.
+   */
+  reclaimSelfProvisioning?: boolean;
+}): Promise<ProviderMonitorIdentityReservation | null> {
+  const claim = providerMonitorIdentityClaim(input);
+  if (!claim) return null;
+  await ensureProviderMonitorIdentityBackfill({ auth: input.auth });
+  const operationId = randomUUID();
+  const result = await getRequiredInternalConvexClient().mutation(
+    internal.providerMonitorIdentityClaims.begin,
+    {
+      orgId: input.auth.orgId,
+      tool: claim.tool,
+      identityKey: claim.identityKey,
+      monitorKey: input.monitorKey,
+      operationId,
+      ...(input.reclaimSelfProvisioning
+        ? { reclaimSelfProvisioning: true }
+        : {}),
+    },
+  );
+  if (result.kind === 'acquired') {
+    return {
+      kind: 'acquired',
+      claim,
+      restoredState: result.restoredState,
+      operationId,
+    };
+  }
+  if (result.kind === 'occupied') {
+    return { ...result, claim };
+  }
+  return { ...result, claim };
+}
+
+async function mutateClaim(
+  action: 'activate' | 'release',
+  input: {
+    auth: OrgAuthContext;
+    monitorKey: string;
+    claim: ProviderMonitorIdentityClaim;
+    operationId?: string;
+  },
+) {
+  return getRequiredInternalConvexClient().mutation(
+    internal.providerMonitorIdentityClaims[action],
+    {
+      orgId: input.auth.orgId,
+      tool: input.claim.tool,
+      identityKey: input.claim.identityKey,
+      monitorKey: input.monitorKey,
+      ...(input.operationId ? { operationId: input.operationId } : {}),
+    },
+  );
+}
+
+export function activateProviderMonitorIdentityReservation(input: {
+  auth: OrgAuthContext;
+  monitorKey: string;
+  claim: ProviderMonitorIdentityClaim;
+  operationId: string;
+}) {
+  return mutateClaim('activate', input);
+}
+
+export function releaseProviderMonitorIdentityClaim(input: {
+  auth: OrgAuthContext;
+  monitorKey: string;
+  claim: ProviderMonitorIdentityClaim;
+}) {
+  return mutateClaim('release', input);
+}
+
+export function failProviderMonitorIdentityReservation(input: {
+  auth: OrgAuthContext;
+  monitorKey: string;
+  reservation: Extract<
+    ProviderMonitorIdentityReservation,
+    { kind: 'acquired' }
+  >;
+}) {
+  return getRequiredInternalConvexClient().mutation(
+    internal.providerMonitorIdentityClaims.fail,
+    {
+      orgId: input.auth.orgId,
+      tool: input.reservation.claim.tool,
+      identityKey: input.reservation.claim.identityKey,
+      monitorKey: input.monitorKey,
+      operationId: input.reservation.operationId,
+    },
+  );
+}