deepline 0.3.88 → 0.3.89

package/dist/bundling-sources/shared_libs/product-notifications/events.ts

@@ -0,0 +1,433 @@
+import type {
+  ProductNotificationFacts,
+  ProductNotificationTrigger,
+} from './configuration';
+import type {
+  ProductNotificationObservation,
+  ProductNotificationOutcomeFact,
+} from './evaluation';
+
+export const PRODUCT_NOTIFICATION_EVENT_SCHEMA_VERSION = 1 as const;
+export const PRODUCT_NOTIFICATION_MAX_EVENT_BYTES = 16_000;
+export const PRODUCT_NOTIFICATION_MAX_EVENT_FACTS = 20;
+export const PRODUCT_NOTIFICATION_MAX_EVENT_AGE_MS = 30 * 24 * 60 * 60 * 1_000;
+export const PRODUCT_NOTIFICATION_MAX_SOURCE_CLOCK_SKEW_MS = 5 * 60 * 1_000;
+
+export const ProductNotificationEvent = {
+  CreditsBalanceChanged: 'credits.balance.changed',
+  CreditsUsageRecorded: 'credits.usage.recorded',
+  MonitorLifecycleChanged: 'monitor.lifecycle.changed',
+  PlayLifecycleChanged: 'play.lifecycle.changed',
+  PlayRunCompleted: 'play.run.completed',
+  WebhookDeliveryCompleted: 'webhook.delivery.completed',
+  PlayCronSucceeded: 'play.cron.succeeded',
+  PlayCronFailed: 'play.cron.failed',
+  PlayWebhookSucceeded: 'play.webhook.succeeded',
+  PlayWebhookFailed: 'play.webhook.failed',
+} as const;
+
+export type ProductNotificationEvent =
+  (typeof ProductNotificationEvent)[keyof typeof ProductNotificationEvent];
+
+export const ProductNotificationProducerKey = {
+  BillingCredits: 'billing.credits',
+  BillingUsage: 'billing.usage',
+  MonitorsLifecycle: 'monitors.lifecycle',
+  PlaysLifecycle: 'plays.lifecycle',
+  PlaysRuns: 'plays.runs',
+  WebhooksDelivery: 'webhooks.delivery',
+  LegacyProductNotifications: 'legacy.product_notifications',
+} as const;
+
+export type ProductNotificationProducerKey =
+  (typeof ProductNotificationProducerKey)[keyof typeof ProductNotificationProducerKey];
+
+export const ProductNotificationTargetPath = {
+  Billing: '/dashboard/billing',
+} as const;
+
+export const PRODUCT_NOTIFICATION_EVENT_NAMES = [
+  ProductNotificationEvent.CreditsBalanceChanged,
+  ProductNotificationEvent.MonitorLifecycleChanged,
+  ProductNotificationEvent.PlayLifecycleChanged,
+  ProductNotificationEvent.PlayRunCompleted,
+  ProductNotificationEvent.WebhookDeliveryCompleted,
+  ProductNotificationEvent.CreditsUsageRecorded,
+] as const;
+
+export const PRODUCT_NOTIFICATION_COMPATIBILITY_EVENT_NAMES = [
+  ProductNotificationEvent.PlayCronSucceeded,
+  ProductNotificationEvent.PlayCronFailed,
+  ProductNotificationEvent.PlayWebhookSucceeded,
+  ProductNotificationEvent.PlayWebhookFailed,
+] as const;
+
+export type ProductNotificationEventName =
+  | (typeof PRODUCT_NOTIFICATION_EVENT_NAMES)[number]
+  | (typeof PRODUCT_NOTIFICATION_COMPATIBILITY_EVENT_NAMES)[number];
+
+export type ProductNotificationCanonicalEvent = {
+  orgId: string;
+  producerKey: ProductNotificationProducerKey;
+  sourceEventId: string;
+  eventName: ProductNotificationEventName;
+  eventSchemaVersion: typeof PRODUCT_NOTIFICATION_EVENT_SCHEMA_VERSION;
+  occurredAt: number;
+  admittedAt: number;
+  payload: ProductNotificationFacts;
+};
+
+type FactType = 'string' | 'number' | 'boolean';
+export type ProductNotificationEventDefinition = {
+  eventName: ProductNotificationEventName;
+  producerKey: ProductNotificationProducerKey;
+  requiredFacts: Record<string, FactType>;
+  optionalFacts?: Record<string, FactType>;
+  orderingSubjectFact: string;
+  allowedTriggers: ProductNotificationTrigger['kind'][];
+  allowedThresholdUnits?: string[];
+};
+
+export const PRODUCT_NOTIFICATION_EVENT_DEFINITIONS: readonly ProductNotificationEventDefinition[] =
+  [
+    {
+      eventName: ProductNotificationEvent.CreditsBalanceChanged,
+      producerKey: ProductNotificationProducerKey.BillingCredits,
+      requiredFacts: {
+        accountId: 'string',
+        previousCredits: 'number',
+        currentCredits: 'number',
+        targetUrl: 'string',
+      },
+      orderingSubjectFact: 'accountId',
+      allowedTriggers: ['threshold_crossing'],
+      allowedThresholdUnits: ['credits'],
+    },
+    {
+      eventName: ProductNotificationEvent.MonitorLifecycleChanged,
+      producerKey: ProductNotificationProducerKey.MonitorsLifecycle,
+      requiredFacts: {
+        monitorId: 'string',
+        monitorName: 'string',
+        previousState: 'string',
+        currentState: 'string',
+        reasonCode: 'string',
+        targetUrl: 'string',
+      },
+      orderingSubjectFact: 'monitorId',
+      optionalFacts: { previousReasonCode: 'string' },
+      allowedTriggers: ['state_transition'],
+    },
+    {
+      eventName: ProductNotificationEvent.PlayLifecycleChanged,
+      producerKey: ProductNotificationProducerKey.PlaysLifecycle,
+      requiredFacts: {
+        playId: 'string',
+        playName: 'string',
+        previousState: 'string',
+        currentState: 'string',
+        reasonCode: 'string',
+        targetUrl: 'string',
+      },
+      orderingSubjectFact: 'playId',
+      optionalFacts: { previousReasonCode: 'string' },
+      allowedTriggers: ['state_transition'],
+    },
+    {
+      eventName: ProductNotificationEvent.PlayRunCompleted,
+      producerKey: ProductNotificationProducerKey.PlaysRuns,
+      requiredFacts: {
+        playId: 'string',
+        playName: 'string',
+        runId: 'string',
+        outcome: 'string',
+        targetUrl: 'string',
+      },
+      optionalFacts: {
+        triggerKind: 'string',
+      },
+      orderingSubjectFact: 'playId',
+      allowedTriggers: ['each_match', 'consecutive_outcomes'],
+    },
+    {
+      eventName: ProductNotificationEvent.WebhookDeliveryCompleted,
+      producerKey: ProductNotificationProducerKey.WebhooksDelivery,
+      requiredFacts: {
+        endpointId: 'string',
+        endpointName: 'string',
+        deliveryId: 'string',
+        outcome: 'string',
+        targetUrl: 'string',
+      },
+      orderingSubjectFact: 'endpointId',
+      allowedTriggers: ['each_match', 'consecutive_outcomes'],
+    },
+    {
+      eventName: ProductNotificationEvent.CreditsUsageRecorded,
+      producerKey: ProductNotificationProducerKey.BillingUsage,
+      requiredFacts: {
+        accountId: 'string',
+        creditsUsed: 'number',
+        limitDenied: 'boolean',
+        targetUrl: 'string',
+      },
+      orderingSubjectFact: 'accountId',
+      allowedTriggers: ['threshold_crossing'],
+      allowedThresholdUnits: ['percent', 'usage'],
+    },
+    ...PRODUCT_NOTIFICATION_COMPATIBILITY_EVENT_NAMES.map((eventName) => ({
+      eventName,
+      producerKey: ProductNotificationProducerKey.LegacyProductNotifications,
+      requiredFacts: {
+        playId: 'string' as const,
+        playName: 'string' as const,
+        targetUrl: 'string' as const,
+      },
+      optionalFacts: {
+        runId: 'string' as const,
+        reasonCode: 'string' as const,
+        reason: 'string' as const,
+      },
+      orderingSubjectFact: 'playId',
+      allowedTriggers: ['each_match' as const],
+    })),
+  ];
+
+export function getProductNotificationEventDefinition(
+  eventName: string,
+): ProductNotificationEventDefinition {
+  const definition = PRODUCT_NOTIFICATION_EVENT_DEFINITIONS.find(
+    (candidate) => candidate.eventName === eventName,
+  );
+  if (!definition) throw new Error(`Unknown notification event ${eventName}.`);
+  return definition;
+}
+
+function requiredString(value: unknown, field: string) {
+  if (typeof value !== 'string' || !value.trim()) {
+    throw new Error(`${field} must be a non-empty string.`);
+  }
+  if (value.length > 512) throw new Error(`${field} is too long.`);
+}
+
+function requireInternalTargetPath(value: unknown) {
+  requiredString(value, 'targetUrl');
+  if (
+    typeof value !== 'string' ||
+    !value.startsWith('/') ||
+    value.startsWith('//') ||
+    value.includes('\\') ||
+    /[\u0000-\u001f\u007f]/.test(value)
+  ) {
+    throw new Error('targetUrl must be a safe internal path.');
+  }
+}
+
+/** Validate the semantic event contract after the producer transaction commits. */
+export function validateProductNotificationEvent(
+  event: ProductNotificationCanonicalEvent,
+  now: number,
+) {
+  const definition = getProductNotificationEventDefinition(event.eventName);
+  requiredString(event.orgId, 'orgId');
+  requiredString(event.producerKey, 'producerKey');
+  requiredString(event.sourceEventId, 'sourceEventId');
+  if (event.producerKey !== definition.producerKey) {
+    throw new Error(`${event.producerKey} cannot produce ${event.eventName}.`);
+  }
+  if (event.eventSchemaVersion !== PRODUCT_NOTIFICATION_EVENT_SCHEMA_VERSION) {
+    throw new Error(
+      `Unsupported ${event.eventName} schema version ${event.eventSchemaVersion}.`,
+    );
+  }
+  if (
+    !Number.isFinite(event.occurredAt) ||
+    !Number.isFinite(event.admittedAt) ||
+    !Number.isFinite(now)
+  ) {
+    throw new Error('Event timestamps must be finite.');
+  }
+  if (event.occurredAt < now - PRODUCT_NOTIFICATION_MAX_EVENT_AGE_MS) {
+    throw new Error('Notification event is older than 30 days.');
+  }
+  if (event.admittedAt > now) {
+    throw new Error('Notification admission time is in the future.');
+  }
+  if (
+    event.occurredAt >
+    event.admittedAt + PRODUCT_NOTIFICATION_MAX_SOURCE_CLOCK_SKEW_MS
+  ) {
+    throw new Error(
+      'Notification event exceeds the allowed source clock skew.',
+    );
+  }
+  const allowedFacts = {
+    ...definition.requiredFacts,
+    ...definition.optionalFacts,
+  };
+  const entries = Object.entries(event.payload);
+  if (entries.length > PRODUCT_NOTIFICATION_MAX_EVENT_FACTS) {
+    throw new Error('Notification event contains too many facts.');
+  }
+  for (const [fact, expectedType] of Object.entries(definition.requiredFacts)) {
+    const value = event.payload[fact];
+    if (typeof value !== expectedType) {
+      throw new Error(`${event.eventName}.${fact} must be ${expectedType}.`);
+    }
+    if (expectedType === 'string') requiredString(value, fact);
+    if (expectedType === 'number' && !Number.isFinite(value)) {
+      throw new Error(`${event.eventName}.${fact} must be finite.`);
+    }
+  }
+  for (const [fact, value] of entries) {
+    const expectedType = allowedFacts[fact];
+    if (!expectedType) {
+      throw new Error(`${event.eventName} does not accept fact ${fact}.`);
+    }
+    if (typeof value !== expectedType) {
+      throw new Error(`${event.eventName}.${fact} must be ${expectedType}.`);
+    }
+    if (expectedType === 'string') requiredString(value, fact);
+    if (expectedType === 'number' && !Number.isFinite(value)) {
+      throw new Error(`${event.eventName}.${fact} must be finite.`);
+    }
+  }
+  requireInternalTargetPath(event.payload.targetUrl);
+  if (
+    new TextEncoder().encode(JSON.stringify(event)).byteLength >
+    PRODUCT_NOTIFICATION_MAX_EVENT_BYTES
+  ) {
+    throw new Error('Notification event exceeds its byte bound.');
+  }
+  return definition;
+}
+
+export function productNotificationOrderingKey(
+  event: ProductNotificationCanonicalEvent,
+) {
+  const definition = getProductNotificationEventDefinition(event.eventName);
+  return `${event.eventName}/${String(
+    event.payload[definition.orderingSubjectFact],
+  )}`;
+}
+
+export function compareProductNotificationOrder(
+  left: { occurredAt: number; sourceEventId: string },
+  right: { occurredAt: number; sourceEventId: string },
+) {
+  return (
+    left.occurredAt - right.occurredAt ||
+    left.sourceEventId.localeCompare(right.sourceEventId)
+  );
+}
+
+export function productNotificationCanonicalOrder(
+  event: Pick<
+    ProductNotificationCanonicalEvent,
+    'occurredAt' | 'sourceEventId'
+  >,
+) {
+  return [event.occurredAt, event.sourceEventId] as const;
+}
+
+export function productNotificationTriggerIsAllowed(
+  eventName: ProductNotificationEventName,
+  trigger: ProductNotificationTrigger,
+) {
+  const definition = getProductNotificationEventDefinition(eventName);
+  if (!definition.allowedTriggers.includes(trigger.kind)) return false;
+  return (
+    trigger.kind !== 'threshold_crossing' ||
+    trigger.unit === undefined ||
+    definition.allowedThresholdUnits?.includes(trigger.unit) === true
+  );
+}
+
+/** Convert a registered event into the generic observation a trigger consumes. */
+export function adaptProductNotificationObservation(input: {
+  event: ProductNotificationCanonicalEvent;
+  trigger: ProductNotificationTrigger;
+  outcomeHistory?: ProductNotificationOutcomeFact[];
+}): ProductNotificationObservation {
+  const { event, trigger } = input;
+  if (!productNotificationTriggerIsAllowed(event.eventName, trigger)) {
+    throw new Error(`${trigger.kind} is not allowed for ${event.eventName}.`);
+  }
+  if (trigger.kind === 'each_match') return { kind: 'match' };
+  if (trigger.kind === 'state_transition') {
+    return {
+      kind: 'state_transition',
+      previousState: String(event.payload.previousState),
+      currentState: String(event.payload.currentState),
+      previousReasonCode:
+        typeof event.payload.previousReasonCode === 'string'
+          ? event.payload.previousReasonCode
+          : undefined,
+      currentReasonCode: String(event.payload.reasonCode),
+      reasonCode: String(event.payload.reasonCode),
+    };
+  }
+  if (trigger.kind === 'consecutive_outcomes') {
+    if (!input.outcomeHistory) {
+      throw new Error(`${event.eventName} requires bounded outcome history.`);
+    }
+    const current = input.outcomeHistory[0];
+    const orderingKey = productNotificationOrderingKey(event);
+    if (
+      !current ||
+      input.outcomeHistory.some(
+        (outcome) => outcome.orderingKey !== orderingKey,
+      ) ||
+      current.sourceEventId !== event.sourceEventId ||
+      current.occurredAt !== event.occurredAt ||
+      current.outcome !== event.payload.outcome
+    ) {
+      throw new Error(
+        `${event.eventName} outcome history must begin with the current event.`,
+      );
+    }
+    return { kind: 'outcome_history', outcomes: input.outcomeHistory };
+  }
+  if (event.eventName === ProductNotificationEvent.CreditsBalanceChanged) {
+    return {
+      kind: 'threshold_crossing',
+      previousValue: Number(event.payload.previousCredits),
+      currentValue: Number(event.payload.currentCredits),
+      unit: 'credits',
+    };
+  }
+  const limit = Number(event.payload.limit);
+  if (event.eventName === ProductNotificationEvent.CreditsUsageRecorded) {
+    if (!(limit > 0)) throw new Error('Monthly usage limit must be positive.');
+    return {
+      kind: 'threshold_state',
+      currentValue: (Number(event.payload.currentUsage) / limit) * 100,
+      unit: 'percent',
+    };
+  }
+  throw new Error(`${event.eventName} has no threshold observation adapter.`);
+}
+
+/** Fingerprint identity excludes admission time so forwarding retries are equal. */
+export async function productNotificationEventFingerprint(
+  event: ProductNotificationCanonicalEvent,
+) {
+  const canonical = JSON.stringify({
+    orgId: event.orgId,
+    producerKey: event.producerKey,
+    sourceEventId: event.sourceEventId,
+    eventName: event.eventName,
+    eventSchemaVersion: event.eventSchemaVersion,
+    occurredAt: event.occurredAt,
+    payload: Object.fromEntries(
+      Object.entries(event.payload).sort(([left], [right]) =>
+        left.localeCompare(right),
+      ),
+    ),
+  });
+  const bytes = new TextEncoder().encode(canonical);
+  const digest = await crypto.subtle.digest('SHA-256', bytes);
+  return [...new Uint8Array(digest)]
+    .map((value) => value.toString(16).padStart(2, '0'))
+    .join('');
+}

package/dist/bundling-sources/shared_libs/product-notifications/legacy-slack.ts

@@ -0,0 +1,80 @@
+import type {
+  ProductNotificationDefaultGroup,
+  ProductNotificationDefaultRule,
+} from './configuration';
+import {
+  PRODUCT_NOTIFICATION_EVENT_CATALOG,
+  type ProductNotificationEventType,
+} from './contract';
+
+const TYPE_BY_LEGACY_EVENT = {
+  'play.cron.succeeded': 'compat.play.cron.succeeded',
+  'play.cron.failed': 'compat.play.cron.failed',
+  'play.webhook.succeeded': 'compat.play.webhook.succeeded',
+  'play.webhook.failed': 'compat.play.webhook.failed',
+} as const;
+
+export function legacySlackNotificationType(
+  eventType: ProductNotificationEventType,
+) {
+  return TYPE_BY_LEGACY_EVENT[eventType];
+}
+
+export function legacySlackNotificationTypeMetadata(notificationType: string) {
+  const event = PRODUCT_NOTIFICATION_EVENT_CATALOG.find(
+    ({ id }) => TYPE_BY_LEGACY_EVENT[id] === notificationType,
+  );
+  return event
+    ? { name: event.label, description: event.description }
+    : undefined;
+}
+
+function legacyPrefix(destinationId: string) {
+  if (!destinationId)
+    throw new Error('Legacy Slack destination ID is required.');
+  return `legacy.slack.${destinationId}`;
+}
+
+export function isLegacySlackCompatibilityKey(value: string) {
+  return value.startsWith('legacy.slack.');
+}
+
+export function legacySlackGroupKey(destinationId: string) {
+  return `${legacyPrefix(destinationId)}.group`;
+}
+
+export function legacySlackTargetConfiguration(input: {
+  destinationId: string;
+  destinationName: string;
+  subscriptions: readonly {
+    eventType: ProductNotificationEventType;
+    enabled: boolean;
+  }[];
+}): {
+  group: ProductNotificationDefaultGroup;
+  rules: ProductNotificationDefaultRule[];
+} {
+  const prefix = legacyPrefix(input.destinationId);
+  return {
+    group: {
+      groupKey: legacySlackGroupKey(input.destinationId),
+      name: input.destinationName,
+      enabled: true,
+      deliveryTiming: { mode: 'immediate' },
+    },
+    rules: input.subscriptions.map((subscription) => ({
+      ruleKey: `${prefix}.${subscription.eventType}`,
+      groupKey: legacySlackGroupKey(input.destinationId),
+      enabled: subscription.enabled,
+      notificationType: legacySlackNotificationType(subscription.eventType),
+      eventName: subscription.eventType,
+      eventFilter: {},
+      trigger: { kind: 'each_match' },
+      repeatMode: 'every_match',
+    })),
+  };
+}
+
+export function legacySlackDestinationKey(destinationId: string) {
+  return `${legacyPrefix(destinationId)}.destination`;
+}

package/dist/bundling-sources/shared_libs/product-notifications/workspace.ts

@@ -0,0 +1,38 @@
+export type NotificationWorkspace = {
+  workspaceId: string;
+  workspaceName?: string;
+  appUrl: string;
+};
+
+export function workspaceAppUrl(
+  baseUrl: string,
+  workspaceId: string,
+  path: string,
+): string {
+  const target = new URL(path, baseUrl);
+  if (
+    target.origin !== new URL(baseUrl).origin ||
+    path.startsWith('//') ||
+    path.includes('\\')
+  ) {
+    throw new Error('Notification target must be a safe internal path.');
+  }
+  const url = new URL('/notifications/open', baseUrl);
+  url.searchParams.set('workspace', workspaceId);
+  url.searchParams.set(
+    'next',
+    `${target.pathname}${target.search}${target.hash}`,
+  );
+  return url.toString();
+}
+
+export function notificationSettingsUrl(
+  workspace: NotificationWorkspace,
+  groupKey: string,
+): string {
+  return workspaceAppUrl(
+    workspace.appUrl,
+    workspace.workspaceId,
+    `/dashboard/settings/notifications?group=${encodeURIComponent(groupKey)}`,
+  );
+}

package/dist/bundling-sources/shared_libs/runtime-env.ts

@@ -53,3 +53,9 @@ export function getRuntimeEnvInfo() {
     node_env: process.env.NODE_ENV ?? null,
   };
 }
+
+/** Test seams must never be reachable from a Vercel production deployment. */
+export function isTestOnlyRuntime(): boolean {
+  if (process.env.VERCEL_ENV === 'production') return false;
+  return process.env.VERCEL_ENV === 'preview' || getRuntimeEnv() !== 'prod';
+}

package/dist/bundling-sources/shared_libs/security/header-safe-env.ts

@@ -0,0 +1,28 @@
+/**
+ * Guards for env-derived secrets that are sent as HTTP header values.
+ *
+ * fetch() validates header values and may echo invalid raw values in its
+ * error. Validate secrets before constructing headers so failures identify
+ * the environment variable without leaking its contents.
+ */
+
+const HEADER_UNSAFE_CHAR_PATTERN = /[^\t\u0020-\u007e\u0080-\u00ff]/;
+
+export function isHeaderSafeValue(value: string): boolean {
+  return !HEADER_UNSAFE_CHAR_PATTERN.test(value);
+}
+
+export function assertHeaderSafeEnvValue(input: {
+  envVar: string;
+  value: string;
+}): string {
+  if (!isHeaderSafeValue(input.value)) {
+    throw new Error(
+      `Environment variable ${input.envVar} contains a character that is invalid in an HTTP header value ` +
+        `(typically an embedded newline from a multi-line paste). ` +
+        `Re-set ${input.envVar} as a single-line value. ` +
+        `The raw value is not echoed to avoid leaking a secret.`,
+    );
+  }
+  return input.value;
+}

package/dist/bundling-sources/shared_libs/security/internal-actor.ts

@@ -0,0 +1,50 @@
+export const INTERNAL_EMAIL_DOMAINS = ['getaero.io', 'deepline.com'] as const;
+const LOCAL_DEVELOPMENT_PLATFORM_ADMIN_EMAIL = 'local-dev@deepline.local';
+
+export function normalizeInternalEmail(email?: string | null): string | null {
+  const normalized = String(email ?? '')
+    .trim()
+    .toLowerCase();
+  return normalized || null;
+}
+
+export function isInternalEmail(email?: string | null): boolean {
+  const normalized = normalizeInternalEmail(email);
+  if (!normalized) return false;
+  if (
+    process.env.NODE_ENV === 'development' &&
+    normalized === LOCAL_DEVELOPMENT_PLATFORM_ADMIN_EMAIL
+  ) {
+    return true;
+  }
+  const atIndex = normalized.lastIndexOf('@');
+  if (atIndex === -1) return false;
+  const domain = normalized.slice(atIndex + 1);
+  return INTERNAL_EMAIL_DOMAINS.includes(
+    domain as (typeof INTERNAL_EMAIL_DOMAINS)[number],
+  );
+}
+
+/** Actors allowed to request provider fixtures against the production API. */
+export function isAuthorizedProductionFixtureActor(
+  email?: string | null,
+): boolean {
+  const normalized = normalizeInternalEmail(email);
+  return (
+    isInternalEmail(normalized) ||
+    /^bootstrap-[0-9a-f]{8}@deepline\.local$/i.test(normalized ?? '')
+  );
+}
+
+/** Whether an email belongs to a Deepline staff account. */
+export function isDeeplineUser(email?: string | null): boolean {
+  return isInternalEmail(email);
+}
+
+export function isDeeplineInternalEmail(email?: string | null): boolean {
+  const normalized = normalizeInternalEmail(email);
+  if (!normalized) return false;
+  const atIndex = normalized.lastIndexOf('@');
+  if (atIndex === -1) return false;
+  return normalized.slice(atIndex + 1) === 'deepline.com';
+}