deepline 0.3.89 → 0.3.91

package/dist/bundling-sources/shared_libs/monitors/package.json

@@ -4,21 +4,130 @@
   "private": true,
   "type": "module",
   "exports": {
-    "./billing/*": "./billing/*.ts",
-    "./*.js": "./*.ts",
-    "./*": "./*.ts"
+    "./fleets/limits": "./fleets/limits.ts",
+    "./analytics-install-guides": "./analytics-install-guides.ts",
+    "./analytics-install-guides.js": "./analytics-install-guides.ts",
+    "./analytics-public": "./analytics-public.ts",
+    "./analytics-public.js": "./analytics-public.ts",
+    "./billing/charges": "./billing/charges.ts",
+    "./billing/charges.js": "./billing/charges.ts",
+    "./billing/policy-builders": "./billing/policy-builders.ts",
+    "./billing/policy-builders.js": "./billing/policy-builders.ts",
+    "./billing/pricing": "./billing/pricing.ts",
+    "./billing/pricing.js": "./billing/pricing.ts",
+    "./billing/public-pricing": "./billing/public-pricing.ts",
+    "./billing/public-pricing.js": "./billing/public-pricing.ts",
+    "./billing/session": "./billing/session.ts",
+    "./billing/session.js": "./billing/session.ts",
+    "./billing/state": "./billing/state.ts",
+    "./billing/state.js": "./billing/state.ts",
+    "./billing/tamradar": "./billing/tamradar.ts",
+    "./billing/tamradar.js": "./billing/tamradar.ts",
+    "./billing/types": "./billing/types.ts",
+    "./billing/types.js": "./billing/types.ts",
+    "./callback-security": "./callback-security.ts",
+    "./callback-security.js": "./callback-security.ts",
+    "./cursor-page": "./cursor-page.ts",
+    "./cursor-page.js": "./cursor-page.ts",
+    "./deactivation-reasons": "./deactivation-reasons.ts",
+    "./deactivation-reasons.js": "./deactivation-reasons.ts",
+    "./fleets/errors": "./fleets/errors.ts",
+    "./fleets/errors.js": "./fleets/errors.ts",
+    "./fleets/plan": "./fleets/plan.ts",
+    "./fleets/plan.js": "./fleets/plan.ts",
+    "./fleets/verdict": "./fleets/verdict.ts",
+    "./fleets/verdict.js": "./fleets/verdict.ts",
+    "./framework-managed-payload-fields": "./framework-managed-payload-fields.ts",
+    "./framework-managed-payload-fields.js": "./framework-managed-payload-fields.ts",
+    "./generated/provider-monitor-callback-admission-targets": "./generated/provider-monitor-callback-admission-targets.ts",
+    "./generated/provider-monitor-callback-admission-targets.js": "./generated/provider-monitor-callback-admission-targets.ts",
+    "./http-error-response": "./http-error-response.ts",
+    "./http-error-response.js": "./http-error-response.ts",
+    "./inbound-publish-key": "./inbound-publish-key.ts",
+    "./inbound-publish-key.js": "./inbound-publish-key.ts",
+    "./inbound-queue": "./inbound-queue.ts",
+    "./inbound-queue.js": "./inbound-queue.ts",
+    "./inventory-reconciliation": "./inventory-reconciliation.ts",
+    "./inventory-reconciliation.js": "./inventory-reconciliation.ts",
+    "./lifecycle-notifications": "./lifecycle-notifications.ts",
+    "./lifecycle-notifications.js": "./lifecycle-notifications.ts",
+    "./monitor-fleet-limits": "./monitor-fleet-limits.ts",
+    "./monitor-fleet-limits.js": "./monitor-fleet-limits.ts",
+    "./org-monitor-limits": "./org-monitor-limits.ts",
+    "./org-monitor-limits.js": "./org-monitor-limits.ts",
+    "./provider-callback-verification": "./provider-callback-verification.ts",
+    "./provider-callback-verification.js": "./provider-callback-verification.ts",
+    "./provider-monitor-batch-operation": "./provider-monitor-batch-operation.ts",
+    "./provider-monitor-batch-operation.js": "./provider-monitor-batch-operation.ts",
+    "./provider-monitor-capability": "./provider-monitor-capability.ts",
+    "./provider-monitor-capability.js": "./provider-monitor-capability.ts",
+    "./provider-monitor-consumer-health": "./provider-monitor-consumer-health.ts",
+    "./provider-monitor-consumer-health.js": "./provider-monitor-consumer-health.ts",
+    "./provider-monitor-errors": "./provider-monitor-errors.ts",
+    "./provider-monitor-errors.js": "./provider-monitor-errors.ts",
+    "./provider-monitor-identity-claims": "./provider-monitor-identity-claims.ts",
+    "./provider-monitor-identity-claims.js": "./provider-monitor-identity-claims.ts",
+    "./provider-monitor-legacy-aliases": "./provider-monitor-legacy-aliases.ts",
+    "./provider-monitor-legacy-aliases.js": "./provider-monitor-legacy-aliases.ts",
+    "./provider-monitor-priority-execution": "./provider-monitor-priority-execution.ts",
+    "./provider-monitor-priority-execution.js": "./provider-monitor-priority-execution.ts",
+    "./provider-monitor-public-aliases": "./provider-monitor-public-aliases.ts",
+    "./provider-monitor-public-aliases.js": "./provider-monitor-public-aliases.ts",
+    "./provider-monitor-runtime-read-eligibility": "./provider-monitor-runtime-read-eligibility.ts",
+    "./provider-monitor-runtime-read-eligibility.js": "./provider-monitor-runtime-read-eligibility.ts",
+    "./provider-monitor-state": "./provider-monitor-state.ts",
+    "./provider-monitor-state.js": "./provider-monitor-state.ts",
+    "./provider-monitor-status": "./provider-monitor-status.ts",
+    "./provider-monitor-status.js": "./provider-monitor-status.ts",
+    "./provider-monitor-upstream-identity": "./provider-monitor-upstream-identity.ts",
+    "./provider-monitor-upstream-identity.js": "./provider-monitor-upstream-identity.ts",
+    "./provider-webhook-monitor-runtime": "./provider-webhook-monitor-runtime.ts",
+    "./provider-webhook-monitor-runtime.js": "./provider-webhook-monitor-runtime.ts",
+    "./quickstart-prompts": "./quickstart-prompts.ts",
+    "./quickstart-prompts.js": "./quickstart-prompts.ts",
+    "./signal-radars/inbound-dead-letter": "./signal-radars/inbound-dead-letter.ts",
+    "./signal-radars/inbound-dead-letter.js": "./signal-radars/inbound-dead-letter.ts",
+    "./signal-radars/inbound-message": "./signal-radars/inbound-message.ts",
+    "./signal-radars/inbound-message.js": "./signal-radars/inbound-message.ts",
+    "./signal-radars/inbound-queue": "./signal-radars/inbound-queue.ts",
+    "./signal-radars/inbound-queue-ack-probe": "./signal-radars/inbound-queue-ack-probe.ts",
+    "./signal-radars/inbound-queue-ack-probe.js": "./signal-radars/inbound-queue-ack-probe.ts",
+    "./signal-radars/inbound-queue-delivery": "./signal-radars/inbound-queue-delivery.ts",
+    "./signal-radars/inbound-queue-delivery.js": "./signal-radars/inbound-queue-delivery.ts",
+    "./signal-radars/inbound-queue.js": "./signal-radars/inbound-queue.ts",
+    "./snitcher-install-validation": "./snitcher-install-validation.ts",
+    "./snitcher-install-validation.js": "./snitcher-install-validation.ts",
+    "./snitcher-ip2company": "./snitcher-ip2company.ts",
+    "./snitcher-ip2company.js": "./snitcher-ip2company.ts",
+    "./snitcher-radar": "./snitcher-radar.ts",
+    "./snitcher-radar.js": "./snitcher-radar.ts",
+    "./starter-templates": "./starter-templates.ts",
+    "./starter-templates.js": "./starter-templates.ts",
+    "./tracking-provider-guidance": "./tracking-provider-guidance.ts",
+    "./tracking-provider-guidance.js": "./tracking-provider-guidance.ts",
+    "./tracking-provider-integrations": "./tracking-provider-integrations.ts",
+    "./tracking-provider-integrations.js": "./tracking-provider-integrations.ts",
+    "./validation": "./validation.ts",
+    "./validation.js": "./validation.ts"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json --noEmit",
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
+    "@deepline/auth": "workspace:*",
     "@deepline/billing": "workspace:*",
+    "@deepline/convex-client": "workspace:*",
     "@deepline/ingestion-v2": "workspace:*",
+    "@deepline/play-runtime": "workspace:*",
     "@deepline/plays": "workspace:*",
+    "@deepline/product-notifications": "workspace:*",
+    "@vercel/oidc": "^3.0.5",
+    "@vercel/queue": "^0.4.0",
     "next": "16.3.0-canary.60",
     "pg": "^8.19.0",
-    "react": "19.2.5"
+    "react": "19.2.5",
+    "@deepline/integration-contracts": "workspace:*"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",

package/dist/bundling-sources/shared_libs/monitors/provider-monitor-batch-operation.ts

@@ -17,6 +17,10 @@ export const PROVIDER_MONITOR_BATCH_OPERATION_KINDS = [
   'reactivate',
   'audit',
   'repair',
+  // Fleet plans already write canonical desired state. This internal
+  // operation is the durable, observable hand-off to the fenced Fleet
+  // executor; it is not a second lifecycle verb or a raw provider create.
+  'converge',
 ] as const;
 
 export type ProviderMonitorBatchOperationKind =
@@ -56,7 +60,13 @@ export type ProviderMonitorBatchOperationRequest = {
   kind: ProviderMonitorBatchOperationKind;
   scope: ProviderMonitorBatchScope;
   dryRun: boolean;
-  /** Required for deactivate; absent for every other operation. */
+  /**
+   * The application deployment that accepted this operation. A provider
+   * callback is part of the create side effect, so a continuation must retain
+   * this origin instead of recomputing it from a later deployment.
+   */
+  callbackBaseUrl?: string;
+  /** Required for direct/target deactivation; Fleet teardown may be customer-owned. */
   deactivationReason?: string;
 };
 
@@ -79,6 +89,29 @@ function canonicalJson(value: unknown): string {
   return JSON.stringify(value);
 }
 
+function normalizeCallbackBaseUrl(
+  value: string | undefined,
+): string | undefined {
+  if (value === undefined) return undefined;
+  let parsed: URL;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new Error('callbackBaseUrl must be an absolute HTTP(S) origin.');
+  }
+  if (
+    (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') ||
+    parsed.username ||
+    parsed.password ||
+    parsed.search ||
+    parsed.hash ||
+    (parsed.pathname !== '' && parsed.pathname !== '/')
+  ) {
+    throw new Error('callbackBaseUrl must be an absolute HTTP(S) origin.');
+  }
+  return parsed.origin;
+}
+
 /**
  * A job id is deterministic on purpose.  Convex's existing `by_run` point
  * lookup is then the idempotency index: the same org/key can only own one run,
@@ -126,6 +159,10 @@ export function validateProviderMonitorBatchOperationRequest(
   if (!isProviderMonitorBatchOperationKind(request.kind)) {
     throw new Error(`Unknown monitor batch operation '${request.kind}'.`);
   }
+  const callbackBaseUrl = normalizeCallbackBaseUrl(request.callbackBaseUrl);
+  if (callbackBaseUrl !== undefined && request.kind !== 'deploy') {
+    throw new Error('callbackBaseUrl is only valid for a batch deploy.');
+  }
   if (!request.scope || typeof request.scope !== 'object') {
     throw new Error('A monitor batch operation requires exactly one scope.');
   }
@@ -151,6 +188,9 @@ export function validateProviderMonitorBatchOperationRequest(
         'Batch deploy requires a durable manifest of complete definitions.',
       );
     }
+    if (request.kind === 'converge') {
+      throw new Error('Batch converge requires exactly one Fleet scope.');
+    }
     if (request.kind === 'deactivate' && !request.deactivationReason) {
       throw new Error(
         'Batch deactivate requires a declared deactivation reason.',
@@ -159,7 +199,11 @@ export function validateProviderMonitorBatchOperationRequest(
     if (request.kind === 'deactivate') {
       requireMonitorDeactivationReason(request.deactivationReason!);
     }
-    return { ...request, scope: { kind: 'keys', monitorKeys: keys } };
+    return {
+      ...request,
+      scope: { kind: 'keys', monitorKeys: keys },
+      ...(callbackBaseUrl === undefined ? {} : { callbackBaseUrl }),
+    };
   }
   if (scope.kind === 'target') {
     if (request.kind === 'deploy') {
@@ -167,6 +211,9 @@ export function validateProviderMonitorBatchOperationRequest(
         'Batch deploy requires a durable manifest of complete definitions.',
       );
     }
+    if (request.kind === 'converge') {
+      throw new Error('Batch converge requires exactly one Fleet scope.');
+    }
     if (!isProviderMonitorBatchTarget(scope.target)) {
       throw new Error(`Unknown monitor batch target '${scope.target}'.`);
     }
@@ -178,7 +225,10 @@ export function validateProviderMonitorBatchOperationRequest(
     if (request.kind === 'deactivate') {
       requireMonitorDeactivationReason(request.deactivationReason!);
     }
-    return request;
+    return {
+      ...request,
+      ...(callbackBaseUrl === undefined ? {} : { callbackBaseUrl }),
+    };
   }
   if (scope.kind === 'fleet') {
     if (request.kind === 'deploy') {
@@ -188,17 +238,13 @@ export function validateProviderMonitorBatchOperationRequest(
     }
     if (!scope.fleetId.trim())
       throw new Error('A Fleet scope requires fleetId.');
-    if (request.kind === 'deactivate' && !request.deactivationReason) {
-      throw new Error(
-        'Batch deactivate requires a declared deactivation reason.',
-      );
-    }
-    if (request.kind === 'deactivate') {
+    if (request.kind === 'deactivate' && request.deactivationReason) {
       requireMonitorDeactivationReason(request.deactivationReason!);
     }
     return {
       ...request,
       scope: { kind: 'fleet', fleetId: scope.fleetId.trim() },
+      ...(callbackBaseUrl === undefined ? {} : { callbackBaseUrl }),
     };
   }
   if (scope.kind === 'manifest') {
@@ -230,6 +276,7 @@ export function validateProviderMonitorBatchOperationRequest(
           ? {}
           : { sha256: scope.sha256.trim().toLowerCase() }),
       },
+      ...(callbackBaseUrl === undefined ? {} : { callbackBaseUrl }),
     };
   }
   throw new Error(

package/dist/bundling-sources/shared_libs/monitors/provider-monitor-consumer-health.ts

@@ -1,5 +1,5 @@
-import { internal } from '@convex/_generated/api';
-import { getRequiredInternalConvexClient } from '@/lib/convex/internal-client';
+import { internal } from '@deepline/convex-client/function-references';
+import { getRequiredInternalConvexClient } from '@deepline/convex-client/internal-client';
 
 type MonitorStreamResource = {
   key: string;

package/dist/bundling-sources/shared_libs/monitors/provider-monitor-identity-claims.ts

@@ -8,8 +8,8 @@ import {
   ProviderMonitorOrgLimitExceededError,
 } from '@deepline/monitors/provider-monitor-errors';
 import { MAX_PRIORITY_MONITORS_PER_ORG } from '@deepline/monitors/provider-monitor-priority-execution';
-import { internal } from '@convex/_generated/api';
-import { getRequiredInternalConvexClient } from '@/lib/convex/internal-client';
+import { internal } from '@deepline/convex-client/function-references';
+import { getRequiredInternalConvexClient } from '@deepline/convex-client/internal-client';
 import {
   providerMonitorUpstreamIdentitySignature,
   type ProviderMonitorUpstreamIdentitySignature,

package/dist/bundling-sources/shared_libs/monitors/provider-monitor-public-aliases.ts

@@ -2,7 +2,7 @@ import {
   ANALYTICS_INTEGRATION_SLUG,
   ANALYTICS_PUBLIC_PROVIDER,
   ANALYTICS_PUBLIC_TOOL,
-} from '@/lib/analytics/public';
+} from '@deepline/monitors/analytics-public';
 
 export const ANALYTICS_MONITOR_KEY = ANALYTICS_INTEGRATION_SLUG;
 export const ANALYTICS_INTERNAL_MONITOR_KEY = 'snitcher-website-sessions';

package/dist/bundling-sources/shared_libs/monitors/signal-radars/inbound-dead-letter.ts

@@ -0,0 +1,245 @@
+import { randomUUID } from 'node:crypto';
+import { isRepairableTenantDataPlaneError } from '@deepline/ingestion-v2/tenant-data-plane-errors';
+import type { SignalRadarInboundMessage } from '@deepline/monitors/signal-radars/inbound-message';
+
+// Minimal pg client seam shared with the ingestion stack: a `query(sql, args)`
+// that returns `{ rows }`. Deliberately structural so PGlite (tests) and the
+// Neon pooled client (prod) both satisfy it without adapters.
+export type InboundPgClient = {
+  query: (
+    sql: string,
+    args?: unknown[],
+  ) => Promise<{ rows?: unknown[]; rowCount?: number }>;
+};
+
+export type InboundFailureClass = 'transient' | 'permanent';
+
+function errorMessage(error: unknown): string {
+  if (error instanceof Error && error.message.trim()) return error.message;
+  if (typeof error === 'string' && error.trim()) return error;
+  return String(error ?? 'unknown error');
+}
+
+// A TRANSIENT failure is an infra outage the event can survive: keep retrying
+// via backoff so a long Neon/Convex flap drains on recovery instead of being
+// dead-lettered (which would drop a real customer signal). A PERMANENT failure
+// is a poison message — an unrecognized/invalid payload shape that will never
+// succeed no matter how many times we redeliver — so it must give up + record.
+//
+// The transient side reuses the SAME classification the rest of the ingestion
+// stack already treats as repairable (permission-denied / role drift / conn
+// resets), so the worker never disagrees with the route on "transient".
+export function classifyInboundFailure(error: unknown): InboundFailureClass {
+  if (isRepairableTenantDataPlaneError(error)) return 'transient';
+
+  const code =
+    error && typeof error === 'object'
+      ? String((error as { code?: unknown }).code ?? '')
+      : '';
+  const transientCodes = new Set([
+    'tenant_data_plane_repair_required',
+    'provider_monitor_convex_sync_pending',
+    // The worker emits this after capture-first receipt persistence cannot be
+    // completed. The event has not entered durable storage, so it must remain
+    // retryable even after the ordinary poison-message delivery budget.
+    'provider_callback_raw_capture_unavailable',
+    // A concurrent worker still owns the durable receipt. Acknowledging this
+    // redelivery as poison could dead-letter a live callback and clear the
+    // owner's receipt before its lease completes.
+    'provider_callback_raw_receipt_in_progress',
+    'ECONNRESET',
+    'ECONNREFUSED',
+    'ETIMEDOUT',
+    'EPIPE',
+    'ENOTFOUND',
+    'EAI_AGAIN',
+    'snitcher_ip2company_retryable',
+    '57P01', // admin shutdown
+    '57P02', // crash shutdown
+    '57P03', // cannot connect now
+    '08000', // connection exception
+    '08003', // connection does not exist
+    '08006', // connection failure
+    '53300', // too many connections
+  ]);
+  if (code && transientCodes.has(code)) return 'transient';
+
+  const message = errorMessage(error);
+  const transientPatterns = [
+    /connection (?:terminated|refused|reset|closed|failure)/i,
+    /could not connect to server/i,
+    /connection to server .* failed/i,
+    /the database system is (?:starting up|shutting down|in recovery)/i,
+    /timeout(?: exceeded)?(?: when trying)? to connect/i,
+    /connect(?:ion)? timeout/i,
+    /terminating connection due to/i,
+    /too many connections/i,
+    /ECONNRESET|ECONNREFUSED|ETIMEDOUT/i,
+    /convex.*(?:unavailable|timeout|network)/i,
+    /fetch failed/i,
+    /socket hang up/i,
+  ];
+  if (transientPatterns.some((pattern) => pattern.test(message))) {
+    return 'transient';
+  }
+
+  // Default to permanent: an unclassified failure is treated as poison so it is
+  // recorded for human review rather than retried forever. Transient outages are
+  // the ones we can positively identify (above); everything else is give-up-able.
+  return 'permanent';
+}
+
+type DeadLetterMessageInput = Pick<
+  SignalRadarInboundMessage,
+  'provider' | 'orgId' | 'token' | 'headers' | 'receivedAt'
+> & {
+  admission?: SignalRadarInboundMessage['admission'];
+  radarKey?: string | null;
+  eventIdempotencyKey?: string | null;
+  rawBody?: string;
+};
+
+async function markCapturedRawWriteFailed(
+  client: InboundPgClient,
+  eventIdempotencyKey: string,
+  lastError: string,
+) {
+  // The capture-first raw row (dl_meta.monitor_inbound_raw) may already exist for
+  // this event. Flip it to write_failed so on-call sees "captured, dead-lettered,
+  // replayable" in one place. Best-effort: a missing table/row must not block the
+  // dead-letter record itself.
+  try {
+    await client.query(
+      `UPDATE dl_meta.monitor_inbound_raw
+          SET status = 'write_failed', error = $2, updated_at = now()
+        WHERE event_idempotency_key = $1`,
+      [eventIdempotencyKey, lastError.slice(0, 4000)],
+    );
+  } catch (error) {
+    console.warn('[signal-radar.dead_letter.raw_mark_failed]', {
+      event_idempotency_key: eventIdempotencyKey,
+      error: error instanceof Error ? error.message : String(error),
+    });
+  }
+}
+
+// Idempotent dead-letter writer. Keyed on the provider event idempotency key via
+// the partial-unique index, so the SAME poison event redelivered N times yields
+// exactly ONE dead letter (attempts/last_error bumped), while two distinct
+// null-keyed poison events stay distinct (the partial index only enforces
+// uniqueness WHERE event_idempotency_key IS NOT NULL). Also marks the captured
+// raw row write_failed when one exists for the key.
+export async function recordSignalRadarDeadLetter(input: {
+  client: InboundPgClient;
+  message: DeadLetterMessageInput;
+  error: unknown;
+  attempts: number;
+}): Promise<void> {
+  const { client, message } = input;
+  const lastError = errorMessage(input.error);
+  const eventIdempotencyKey = message.eventIdempotencyKey ?? null;
+  const payload = {
+    provider: message.provider,
+    orgId: message.orgId,
+    token: message.token,
+    radarKey: message.radarKey ?? null,
+    eventIdempotencyKey,
+    rawBody: message.rawBody ?? null,
+    headers: message.headers ?? {},
+    receivedAt: message.receivedAt,
+    admission: message.admission ?? null,
+  };
+
+  if (eventIdempotencyKey) {
+    await client.query(
+      `INSERT INTO dl_meta.signal_radar_inbound_dead_letter
+         (dead_letter_id, provider, radar_key, org_id, event_idempotency_key,
+          payload, headers, attempts, last_error, status)
+       VALUES ($1, $2, $3, $4, $5, $6::jsonb, $7::jsonb, $8, $9, 'open')
+       ON CONFLICT (event_idempotency_key)
+         WHERE event_idempotency_key IS NOT NULL
+         DO UPDATE SET
+           attempts = EXCLUDED.attempts,
+           last_error = EXCLUDED.last_error,
+           payload = EXCLUDED.payload,
+           headers = EXCLUDED.headers,
+           updated_at = now()`,
+      [
+        randomUUID(),
+        message.provider,
+        message.radarKey ?? null,
+        message.orgId ?? null,
+        eventIdempotencyKey,
+        JSON.stringify(payload),
+        JSON.stringify(message.headers ?? {}),
+        input.attempts,
+        lastError.slice(0, 8000),
+      ],
+    );
+    await markCapturedRawWriteFailed(client, eventIdempotencyKey, lastError);
+    return;
+  }
+
+  // No idempotency key -> the partial index does not apply, so each null-keyed
+  // poison event is its own dead letter (never merged).
+  await client.query(
+    `INSERT INTO dl_meta.signal_radar_inbound_dead_letter
+       (dead_letter_id, provider, radar_key, org_id, event_idempotency_key,
+        payload, headers, attempts, last_error, status)
+     VALUES ($1, $2, $3, $4, NULL, $5::jsonb, $6::jsonb, $7, $8, 'open')`,
+    [
+      randomUUID(),
+      message.provider,
+      message.radarKey ?? null,
+      message.orgId ?? null,
+      JSON.stringify(payload),
+      JSON.stringify(message.headers ?? {}),
+      input.attempts,
+      lastError.slice(0, 8000),
+    ],
+  );
+}
+
+// The load-bearing retry-callback decision (plan §4a). Runs on every handler
+// throw:
+//   - transient -> back off + redeliver, NEVER acknowledge, regardless of how
+//     far past maxDeliveries we are. A long Neon outage must drain on recovery.
+//   - permanent, still within maxDeliveries -> back off (give it its allotted
+//     retries; a "permanent" verdict can be a transient mislabel early on).
+//   - permanent, past maxDeliveries -> record the dead letter + acknowledge
+//     (stop retrying; it is now durably captured for human review + replay).
+export type InboundRetryDecision =
+  | { afterSeconds: number }
+  | { acknowledge: true };
+
+export function inboundBackoffSeconds(deliveryCount: number): number {
+  // Mirror the plan's bounded exponential backoff: 2^n * 5, capped at 300s.
+  const exponent = Math.max(1, deliveryCount);
+  return Math.min(300, 2 ** exponent * 5);
+}
+
+export async function resolveInboundRetryDecision(input: {
+  client: InboundPgClient;
+  message: DeadLetterMessageInput;
+  error: unknown;
+  deliveryCount: number;
+  maxDeliveries: number;
+}): Promise<InboundRetryDecision> {
+  const failureClass = classifyInboundFailure(input.error);
+
+  if (failureClass === 'transient') {
+    return { afterSeconds: inboundBackoffSeconds(input.deliveryCount) };
+  }
+
+  if (input.deliveryCount <= input.maxDeliveries) {
+    return { afterSeconds: inboundBackoffSeconds(input.deliveryCount) };
+  }
+
+  await recordSignalRadarDeadLetter({
+    client: input.client,
+    message: input.message,
+    error: input.error,
+    attempts: input.deliveryCount,
+  });
+  return { acknowledge: true };
+}

package/dist/bundling-sources/shared_libs/monitors/signal-radars/inbound-message.ts

@@ -0,0 +1,38 @@
+// The durable message the thin Monitor inbound receiver enqueues onto the
+// Vercel Queues front-queue. It carries ONLY what the worker needs that is not
+// derivable without the provider's HTTP request — nothing Neon-derived. The
+// worker re-runs the full ingestion machinery from this envelope alone (resolve
+// the radar binding from Neon, capture-first raw, typed write, inline dispatch),
+// so the receiver never has to touch Neon before returning 200.
+
+export type SignalRadarInboundMessage = {
+  provider: string;
+  orgId: string;
+  token: string;
+  rawBody: string;
+  headers: Record<string, string>;
+  receivedAt: string;
+  admission: {
+    id: string;
+    bindingVersion: number;
+    /** A batch callback is resolved by its provider resource ID in Tier 2. */
+    routingMode?: 'single_monitor' | 'batch_by_upstream_resource';
+    verificationMode:
+      | 'hmac_signature'
+      | 'shared_secret_body'
+      | 'secret_header'
+      | 'callback_token_only';
+  };
+  // The Neon-free provider-event publish idempotency key, computed by the
+  // receiver from what is on the wire. Carried so the worker and dead-letter
+  // writer can key on the same grain the publish deduped on.
+  eventIdempotencyKey?: string | null;
+  // A preview monitor callback is received by Vercel but its run executes on
+  // an isolated scheduler lane. Preserve that request-scoped context across
+  // the durable queue boundary.
+  postgresSchedulerSchema?: string | null;
+  runtimeApiBaseUrl?: string | null;
+  // Optional radar hint the worker resolves durably from Neon; present only on
+  // dead-letter/replay envelopes where it was already known.
+  radarKey?: string | null;
+};