deepline 0.3.89 → 0.3.91

package/dist/bundling-sources/shared_libs/play-runtime/workflow-executor-auth.ts

@@ -0,0 +1,169 @@
+import { mintWorkflowRunExecutionToken } from './internal-bootstrap-token';
+import type { RuntimeExecutionCapability } from './/execution-capabilities';
+import type { FixtureBehavior } from './/fixture-behavior';
+import type { DirectCompletedTerminalContract } from './/scheduler-backends/terminal-contract';
+
+const ENCRYPTION_KEY_ENV = 'INTEGRATION_CREDENTIALS_ENCRYPTION_KEY';
+const AES_GCM_ALGORITHM = 'AES-GCM';
+const IV_LENGTH_BYTES = 12;
+const AUTH_TAG_LENGTH_BYTES = 16;
+
+export type EncryptedWorkflowExecutorApiKey = {
+  ciphertext: string;
+  iv: string;
+  tag: string;
+};
+
+export function hasWorkflowExecutorEncryptionKey(): boolean {
+  return typeof process.env[ENCRYPTION_KEY_ENV] === 'string';
+}
+
+function getEncryptionKeyBytes(): Uint8Array {
+  const raw = process.env[ENCRYPTION_KEY_ENV];
+  if (!raw) {
+    throw new Error(`Missing ${ENCRYPTION_KEY_ENV} environment variable.`);
+  }
+  const key = decodeBase64(raw);
+  if (key.byteLength !== 32) {
+    throw new Error(
+      `${ENCRYPTION_KEY_ENV} must be a base64-encoded 32-byte key.`,
+    );
+  }
+  return key;
+}
+
+async function importEncryptionKey() {
+  return crypto.subtle.importKey(
+    'raw',
+    toArrayBuffer(getEncryptionKeyBytes()),
+    { name: AES_GCM_ALGORITHM },
+    false,
+    ['encrypt', 'decrypt'],
+  );
+}
+
+export async function encryptWorkflowExecutorApiKey(
+  apiKey: string,
+): Promise<EncryptedWorkflowExecutorApiKey> {
+  const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH_BYTES));
+  const key = await importEncryptionKey();
+  const encrypted = new Uint8Array(
+    await crypto.subtle.encrypt(
+      {
+        name: AES_GCM_ALGORITHM,
+        iv: toArrayBuffer(iv),
+        tagLength: AUTH_TAG_LENGTH_BYTES * 8,
+      },
+      key,
+      new TextEncoder().encode(apiKey),
+    ),
+  );
+  const ciphertext = encrypted.slice(0, -AUTH_TAG_LENGTH_BYTES);
+  const tag = encrypted.slice(-AUTH_TAG_LENGTH_BYTES);
+  return {
+    ciphertext: encodeBase64(ciphertext),
+    iv: encodeBase64(iv),
+    tag: encodeBase64(tag),
+  };
+}
+
+export async function maybeEncryptWorkflowExecutorApiKey(
+  apiKey: string,
+): Promise<EncryptedWorkflowExecutorApiKey | null> {
+  if (!hasWorkflowExecutorEncryptionKey()) {
+    return null;
+  }
+  return encryptWorkflowExecutorApiKey(apiKey);
+}
+
+export async function decryptWorkflowExecutorApiKey(
+  payload: EncryptedWorkflowExecutorApiKey,
+): Promise<string> {
+  const key = await importEncryptionKey();
+  const iv = decodeBase64(payload.iv);
+  const ciphertext = decodeBase64(payload.ciphertext);
+  const tag = decodeBase64(payload.tag);
+  const combined = new Uint8Array(ciphertext.byteLength + tag.byteLength);
+  combined.set(ciphertext, 0);
+  combined.set(tag, ciphertext.byteLength);
+  const plaintext = await crypto.subtle.decrypt(
+    {
+      name: AES_GCM_ALGORITHM,
+      iv: toArrayBuffer(iv),
+      tagLength: AUTH_TAG_LENGTH_BYTES * 8,
+    },
+    key,
+    toArrayBuffer(combined),
+  );
+  return new TextDecoder().decode(plaintext);
+}
+
+export async function mintWorkflowExecutorToken(input: {
+  orgId: string;
+  workflowId: string;
+  runId: string;
+  billingRunId?: string | null;
+  playName?: string;
+  allowedSecrets?: readonly string[] | null;
+  maxCreditsPerRun?: number | null;
+  integrationMode?: 'live' | 'eval_stub' | 'fixture' | null;
+  fixtureBehavior?: FixtureBehavior | null;
+  synthetic?: boolean | null;
+  actorUserId?: string | null;
+  actorEmail?: string | null;
+  schedulerSchema?: string | null;
+  runAttempt?: number | null;
+  runLeaseToken?: string | null;
+  terminalContract?: DirectCompletedTerminalContract | null;
+  capabilities?: readonly RuntimeExecutionCapability[];
+  runtimeOrigin?: string | null;
+}) {
+  const playName = input.playName?.trim() || input.workflowId;
+  return mintWorkflowRunExecutionToken({
+    orgId: input.orgId,
+    workflowId: input.workflowId,
+    runId: input.runId,
+    billingRunId: input.billingRunId,
+    playName,
+    allowedSecrets: input.allowedSecrets,
+    maxCreditsPerRun: input.maxCreditsPerRun,
+    integrationMode: input.integrationMode,
+    fixtureBehavior: input.fixtureBehavior,
+    synthetic: input.synthetic,
+    actorUserId: input.actorUserId,
+    actorEmail: input.actorEmail,
+    schedulerSchema: input.schedulerSchema,
+    runAttempt: input.runAttempt,
+    runLeaseToken: input.runLeaseToken,
+    terminalContract: input.terminalContract,
+    capabilities: input.capabilities,
+    runtimeOrigin: input.runtimeOrigin,
+  });
+}
+
+function encodeBase64(bytes: Uint8Array): string {
+  return btoa(String.fromCharCode(...bytes));
+}
+
+function decodeBase64(value: string): Uint8Array {
+  // Match the lenient base64 handling the rest of the app uses for
+  // INTEGRATION_CREDENTIALS_ENCRYPTION_KEY (Buffer.from(raw, 'base64') in
+  // crypto.ts / cloud-jobs/runtime.ts): tolerate the base64url alphabet and
+  // missing padding. This module runs in the edge/Convex runtime (no Buffer),
+  // and bare atob() rejects base64url / unpadded keys with "InvalidCharacterError",
+  // which previously made `workflows call` 500 on any deployment whose key was
+  // stored base64url. Standard padded base64 is unaffected (normalization is a
+  // no-op), so production keys decode identically.
+  let normalized = value.trim().replace(/-/g, '+').replace(/_/g, '/');
+  const remainder = normalized.length % 4;
+  if (remainder === 2) normalized += '==';
+  else if (remainder === 3) normalized += '=';
+  return Uint8Array.from(atob(normalized), (char) => char.charCodeAt(0));
+}
+
+function toArrayBuffer(bytes: Uint8Array): ArrayBuffer {
+  return bytes.buffer.slice(
+    bytes.byteOffset,
+    bytes.byteOffset + bytes.byteLength,
+  ) as ArrayBuffer;
+}

package/dist/bundling-sources/shared_libs/play-runtime/zerobounce-batching.ts

@@ -0,0 +1,122 @@
+import {
+  defineBatchStrategyMap,
+  type BatchOperationStrategy,
+} from './batching-types';
+
+type Single = { email?: string; ip_address?: string };
+type Bulk = {
+  email_batch: Array<{ email_address: string; ip_address?: string }>;
+};
+type Verdict = Record<string, unknown> & { address: string; status: string };
+type Results = { email_batch?: unknown[]; errors?: unknown[]; data?: Results };
+
+function emailKey(email: string) {
+  return email.trim().toLowerCase();
+}
+function bucket(payload: Single) {
+  // The response identifies emails, but does not echo the supplied IP.
+  return JSON.stringify([
+    'zerobounce_batch_validate',
+    payload.ip_address ?? null,
+  ]);
+}
+
+export const zerobounceValidateBatchStrategy: BatchOperationStrategy<
+  Single,
+  Bulk,
+  Results,
+  { data: Verdict }
+> = {
+  sourceOperation: 'zerobounce_validate',
+  batchOperation: 'zerobounce_batch_validate',
+  kind: 'identifier_batch',
+  maxBatchSize: 100,
+  bucketKeyPayloadFields: ['ip_address'],
+  canBatchWith: (left, right) => bucket(left) === bucket(right),
+  toBucketKey: bucket,
+  toItemKey: (payload) =>
+    JSON.stringify([emailKey(payload.email ?? ''), payload.ip_address ?? null]),
+  compile(payloads) {
+    const first = payloads[0];
+    if (
+      !first ||
+      payloads.length > 100 ||
+      payloads.some((p) => !p.email?.trim() || bucket(p) !== bucket(first))
+    ) {
+      throw new Error(
+        'ZeroBounce batch requires 1–100 emails with matching IP options.',
+      );
+    }
+    return {
+      // Receipt deduplication may leave one owned email. Keep the bulk operation.
+      batchOperation: 'zerobounce_batch_validate',
+      batchPayload: {
+        email_batch: [...new Set(payloads.map((p) => emailKey(p.email!)))].map(
+          (email_address) => ({
+            email_address,
+            ...(first.ip_address ? { ip_address: first.ip_address } : {}),
+          }),
+        ),
+      },
+      items: payloads.map((payload) => ({
+        itemKey: zerobounceValidateBatchStrategy.toItemKey(payload),
+        payload,
+      })),
+    };
+  },
+  splitResult(fullResult, compiled) {
+    const result = fullResult.data ?? fullResult;
+    if (
+      !Array.isArray(result.email_batch) ||
+      (result.errors !== undefined &&
+        (!Array.isArray(result.errors) || result.errors.length > 0))
+    ) {
+      throw new Error(
+        'ZeroBounce bulk verification returned errors or no result list.',
+      );
+    }
+    const expected = new Set(
+      compiled.batchPayload.email_batch.map((p) => emailKey(p.email_address)),
+    );
+    const byEmail = new Map<string, Verdict>();
+    for (const value of result.email_batch) {
+      const row = value as Verdict | null;
+      if (
+        !row ||
+        typeof row.address !== 'string' ||
+        ![
+          'valid',
+          'invalid',
+          'catch-all',
+          'unknown',
+          'spamtrap',
+          'abuse',
+          'do_not_mail',
+        ].includes(row.status)
+      ) {
+        throw new Error(
+          'ZeroBounce bulk verification returned a malformed verdict.',
+        );
+      }
+      const key = emailKey(row.address);
+      if (!expected.has(key) || byEmail.has(key)) {
+        throw new Error(
+          'ZeroBounce bulk verification returned unexpected or duplicate verdicts.',
+        );
+      }
+      byEmail.set(key, row);
+    }
+    return compiled.items.map((item) => {
+      const row = byEmail.get(emailKey(item.payload.email!));
+      if (!row)
+        throw new Error(
+          'ZeroBounce bulk verification omitted a requested email result.',
+        );
+      return { itemKey: item.itemKey, result: { data: row }, rawResult: row };
+    });
+  },
+};
+
+export const zerobounceBatchStrategies = defineBatchStrategyMap({
+  zerobounce_validate: zerobounceValidateBatchStrategy,
+});

package/dist/bundling-sources/shared_libs/plays/artifact-types.ts

@@ -36,6 +36,8 @@ export type PlayArtifactCompatibility = {
   toolResponseContract?: ToolResponseContract;
   /** Missing preserves the receipt namespace of artifacts created before this revision existed. */
   toolResponseReceiptRevision?: string;
+  /** Missing preserves Slack HITL's historical parked timeout behavior. */
+  slackHitlTimeoutOutcome?: 'error';
 };
 
 /** The only executable Play artifact contract. */

package/dist/bundling-sources/shared_libs/plays/bundling/repository-adapter.ts

@@ -0,0 +1,24 @@
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import type { PlayBundlingAdapter } from './index';
+import { discoverPackagedLocalFiles } from '../local-file-discovery';
+
+/** Repository source bundling shared by the API and the deploy worker.
+ * Callers supply their repository root; cloud validation is an API adapter.
+ */
+export function createRepositoryPlayBundlingAdapter(options: {
+  projectRoot: string;
+  sourceIdentityRoot?: string;
+}): PlayBundlingAdapter {
+  const sdkSourceRoot = resolve(options.projectRoot, 'packages', 'sdk', 'src');
+  return {
+    projectRoot: options.projectRoot,
+    sourceIdentityRoot: options.sourceIdentityRoot,
+    nodeModulesDir: resolve(options.projectRoot, 'node_modules'),
+    cacheDir: join(tmpdir(), 'deepline-play-artifacts-v37'),
+    sdkSourceRoot,
+    sdkPackageJson: resolve(sdkSourceRoot, '..', 'package.json'),
+    sdkEntryFile: resolve(sdkSourceRoot, 'index.ts'),
+    discoverPackagedLocalFiles,
+  };
+}

package/dist/bundling-sources/shared_libs/plays/child-run-projection.ts

@@ -0,0 +1,174 @@
+/**
+ * The bounded, durable read model for direct `ctx.runPlayAsync` descendants.
+ *
+ * A child belongs to an authored launch site through `launchKey`, not through
+ * its play name: one Play may be launched from several sites, and an async
+ * launch inside a fan-out has many independently progressing invocations.
+ * `invocationKey` is deliberately opaque; callers use its `runId` to drill
+ * into one actual Run instead of reconstructing an identity from input data.
+ */
+export type AsyncChildRunSummary = {
+  runId: string;
+  playName: string | null;
+  launchKey: string | null;
+  invocationKey: string | null;
+  rootBillingOwned: boolean;
+  status: string;
+  parentRunId: string | null;
+  rootRunId: string | null;
+  createdAt: number | null;
+  startedAt: number | null;
+  finishedAt: number | null;
+};
+
+export type AsyncChildRunStatusCounts = {
+  total: number;
+  queued: number;
+  active: number;
+  waiting: number;
+  succeeded: number;
+  failed: number;
+  cancelled: number;
+  unknown: number;
+};
+
+export type AsyncChildRunLaunchProjection = {
+  /** `null` is an older child run that predates durable authored attribution. */
+  launchKey: string | null;
+  playName: string | null;
+  counts: AsyncChildRunStatusCounts;
+  children: AsyncChildRunSummary[];
+};
+
+export type AsyncChildRunProjection = {
+  kind: 'async_child_runs';
+  /** Direct children returned by the bounded durable index read. */
+  returnedCount: number;
+  /** False means the displayed counts are a lower bound, never a fake total. */
+  complete: boolean;
+  counts: AsyncChildRunStatusCounts;
+  launches: AsyncChildRunLaunchProjection[];
+};
+
+/**
+ * Wire guard for the bounded projection. Callers must never turn a partial
+ * response into an invented zero-child fanout.
+ */
+export function isAsyncChildRunProjection(
+  value: unknown,
+): value is AsyncChildRunProjection {
+  if (!value || typeof value !== 'object') return false;
+  const candidate = value as Record<string, unknown>;
+  return (
+    candidate.kind === 'async_child_runs' &&
+    typeof candidate.returnedCount === 'number' &&
+    typeof candidate.complete === 'boolean' &&
+    Array.isArray(candidate.launches) &&
+    candidate.counts !== null &&
+    typeof candidate.counts === 'object'
+  );
+}
+
+/**
+ * New async children persist root-owned billing attribution at admission. Their
+ * execution facts are therefore already present in the root Run's billing
+ * query. Historic children have no such proof and retain the compatibility
+ * lookup rather than being silently undercounted.
+ */
+export function requiresLegacyChildBillingRead(input: {
+  billingRunId: string;
+  child: Pick<AsyncChildRunSummary, 'runId' | 'rootBillingOwned'>;
+}): boolean {
+  return (
+    !input.child.rootBillingOwned && input.billingRunId !== input.child.runId
+  );
+}
+
+const EMPTY_COUNTS = (): AsyncChildRunStatusCounts => ({
+  total: 0,
+  queued: 0,
+  active: 0,
+  waiting: 0,
+  succeeded: 0,
+  failed: 0,
+  cancelled: 0,
+  unknown: 0,
+});
+
+function addStatus(counts: AsyncChildRunStatusCounts, status: string): void {
+  counts.total += 1;
+  switch (status.trim().toLowerCase()) {
+    case 'queued':
+    case 'pending':
+    case 'scheduled':
+      counts.queued += 1;
+      return;
+    case 'running':
+    case 'in_progress':
+      counts.active += 1;
+      return;
+    case 'waiting':
+    case 'suspended':
+    case 'awaiting_signal':
+      counts.waiting += 1;
+      return;
+    case 'completed':
+    case 'complete':
+    case 'succeeded':
+    case 'success':
+      counts.succeeded += 1;
+      return;
+    case 'failed':
+    case 'error':
+      counts.failed += 1;
+      return;
+    case 'cancelled':
+    case 'canceled':
+    case 'stopped':
+      counts.cancelled += 1;
+      return;
+    default:
+      counts.unknown += 1;
+  }
+}
+
+/**
+ * Builds the one child-run representation shared by agent/API callers and UI.
+ * The input must already be sorted by newest child first; grouping preserves
+ * that order so a consumer can display recent child Runs without re-sorting.
+ */
+export function projectAsyncChildRuns(input: {
+  children: readonly AsyncChildRunSummary[];
+  complete: boolean;
+}): AsyncChildRunProjection {
+  const counts = EMPTY_COUNTS();
+  const byLaunchKey = new Map<string, AsyncChildRunLaunchProjection>();
+
+  for (const child of input.children) {
+    addStatus(counts, child.status);
+    const mapKey = child.launchKey ?? '__unattributed_async_child__';
+    let launch = byLaunchKey.get(mapKey);
+    if (!launch) {
+      launch = {
+        launchKey: child.launchKey,
+        playName: child.playName,
+        counts: EMPTY_COUNTS(),
+        children: [],
+      };
+      byLaunchKey.set(mapKey, launch);
+    }
+    // A key is the authored site, so preserve the first (most-recent) name
+    // while still retaining exact identity on every child row.
+    if (!launch.playName && child.playName) launch.playName = child.playName;
+    addStatus(launch.counts, child.status);
+    launch.children.push(child);
+  }
+
+  return {
+    kind: 'async_child_runs',
+    returnedCount: input.children.length,
+    complete: input.complete,
+    counts,
+    launches: [...byLaunchKey.values()],
+  };
+}

package/dist/bundling-sources/shared_libs/plays/contracts.ts

@@ -47,6 +47,8 @@ export type PlayContractCompatibilitySnapshot = {
   toolResponseContract?: ToolResponseContract;
   /** Legacy response metadata; it does not change completed-result caching. */
   toolResponseReceiptRevision?: string;
+  /** Missing preserves Slack HITL's historical parked timeout behavior. */
+  slackHitlTimeoutOutcome?: 'error';
 };
 
 export type NormalizedPlayContractCompatibilitySnapshot =