deepline 0.1.216 → 0.1.218

package/dist/bundling-sources/apps/play-runner-workers/src/coordinator-entry.ts

@@ -57,13 +57,9 @@ import {
   PLAY_RUNTIME_CONTRACT_HEADER,
 } from '../../../shared_libs/play-runtime/runtime-contract';
 import {
-  PLAY_RUNTIME_API_CURRENT_PATH,
-  PLAY_RUNTIME_TAIL_LOG_CURRENT_PATH,
+  PLAY_RUNTIME_API_COMPAT_PATH,
+  PLAY_RUNTIME_TAIL_LOG_COMPAT_PATH,
 } from '../../../shared_libs/play-runtime/runtime-api-paths';
-import {
-  executorTokenFromAuthorizationHeader,
-  isCoordinatorRuntimeProxyPath,
-} from './coordinator-runtime-proxy';
 import {
   decideWorkflowPlatformRetry,
   PLATFORM_DEPLOY_WORKFLOW_RETRY_LIMIT,
@@ -1335,7 +1331,7 @@ async function markWorkflowRuntimeFailure(input: {
       } satisfies PlayRunLedgerEvent,
     ],
   });
-  const url = `${baseUrl.replace(/\/$/, '')}${PLAY_RUNTIME_API_CURRENT_PATH}`;
+  const url = `${baseUrl.replace(/\/$/, '')}${PLAY_RUNTIME_API_COMPAT_PATH}`;
   const backoffMs = [200, 500, 1500];
   let lastError: unknown = null;
   for (let attempt = 0; attempt <= backoffMs.length; attempt += 1) {
@@ -1424,7 +1420,7 @@ async function appendWorkflowChildCompletedRunEvent(input: {
       } satisfies PlayRunLedgerEvent,
     ],
   });
-  const url = `${baseUrl.replace(/\/$/, '')}${PLAY_RUNTIME_API_CURRENT_PATH}`;
+  const url = `${baseUrl.replace(/\/$/, '')}${PLAY_RUNTIME_API_COMPAT_PATH}`;
   const response = await fetch(url, { method: 'POST', headers, body });
   if (!response.ok) {
     throw new Error(
@@ -1844,7 +1840,7 @@ async function markRegisteredChildRunFailed(input: {
     contract: PLAY_RUNTIME_CONTRACT,
     executorToken: input.childExecutorToken,
     baseUrl: input.baseUrl,
-    path: PLAY_RUNTIME_API_CURRENT_PATH,
+    path: PLAY_RUNTIME_API_COMPAT_PATH,
     headers: {
       'x-deepline-request-id': crypto.randomUUID(),
       [PLAY_RUNTIME_CONTRACT_HEADER]: String(PLAY_RUNTIME_CONTRACT),
@@ -1901,7 +1897,7 @@ async function appendRegisteredChildRunTerminal(input: {
     contract: PLAY_RUNTIME_CONTRACT,
     executorToken: input.childExecutorToken,
     baseUrl: input.baseUrl,
-    path: PLAY_RUNTIME_API_CURRENT_PATH,
+    path: PLAY_RUNTIME_API_COMPAT_PATH,
     headers: {
       'x-deepline-request-id': crypto.randomUUID(),
       [PLAY_RUNTIME_CONTRACT_HEADER]: String(PLAY_RUNTIME_CONTRACT),
@@ -1983,7 +1979,7 @@ async function callRuntimeApiFromCoordinator(input: {
     contract: PLAY_RUNTIME_CONTRACT,
     executorToken: input.executorToken,
     baseUrl: input.baseUrl,
-    path: PLAY_RUNTIME_API_CURRENT_PATH,
+    path: PLAY_RUNTIME_API_COMPAT_PATH,
     body,
     headers: {
       'x-deepline-request-id': requestId,
@@ -3122,8 +3118,7 @@ async function submitChildWorkflowThroughCoordinator(input: {
  * Workflows serializes the dynamic Worker's `env` map when it persists
  * workflow state. WorkerEntrypoint stubs ARE cloneable.
  *
- * Path allowlist: the current runtime endpoint plus `/api/v2/plays/*` and
- * `/api/v2/integrations/*`.
+ * Path allowlist: only `/api/v2/plays/*` and `/api/v2/integrations/*`.
  * Anything else is a sandbox-escape attempt and gets a loud 403 — the
  * coordinator must NOT proxy a play's request to internal admin routes
  * even if the play tries to construct such a URL.
@@ -3132,7 +3127,6 @@ export class RuntimeApi extends WorkerEntrypoint<CoordinatorEnv, undefined> {
   async fetch(request: Request): Promise<Response> {
     const incoming = new URL(request.url);
     const allowed =
-      incoming.pathname === PLAY_RUNTIME_API_CURRENT_PATH ||
       incoming.pathname.startsWith('/api/v2/plays/') ||
       incoming.pathname.startsWith('/api/v2/integrations/');
     if (!allowed) {
@@ -3765,62 +3759,6 @@ const coordinatorEntrypoint = {
 
 export default coordinatorEntrypoint;
 
-const COORDINATOR_RUNTIME_PROXY_MAX_BODY_BYTES = 16 * 1024 * 1024;
-
-async function proxyCoordinatorRuntimeApiRequest(input: {
-  request: Request;
-  env: CoordinatorEnv;
-  url: URL;
-}): Promise<Response> {
-  const { request, env, url } = input;
-  if (request.method !== 'GET' && request.method !== 'POST') {
-    return new Response('method not allowed', { status: 405 });
-  }
-  const executorToken = executorTokenFromAuthorizationHeader(
-    request.headers.get('authorization'),
-  );
-  if (!executorToken) {
-    return Response.json(
-      { error: 'Runtime gateway requires a bearer executor token.' },
-      { status: 401 },
-    );
-  }
-  const contentLength = Number(request.headers.get('content-length') ?? '0');
-  if (
-    Number.isFinite(contentLength) &&
-    contentLength > COORDINATOR_RUNTIME_PROXY_MAX_BODY_BYTES
-  ) {
-    return Response.json(
-      { error: 'Runtime gateway request body exceeds the 16 MiB limit.' },
-      { status: 413 },
-    );
-  }
-  let body: unknown = {};
-  if (request.method === 'POST') {
-    try {
-      body = await request.json();
-    } catch {
-      return Response.json(
-        { error: 'Runtime gateway requires a JSON request body.' },
-        { status: 400 },
-      );
-    }
-  }
-  const upstream = await env.HARNESS.runtimeApiCall({
-    contract: PLAY_RUNTIME_CONTRACT,
-    executorToken,
-    method: request.method,
-    path: `${url.pathname}${url.search}`,
-    body,
-    headers: Object.fromEntries(request.headers.entries()),
-  });
-  const headers = new Headers(upstream.headers);
-  // The harness materializes the upstream response body as a string. Let this
-  // Response calculate its own byte length instead of forwarding a stale one.
-  headers.delete('content-length');
-  return new Response(upstream.body, { status: upstream.status, headers });
-}
-
 /**
  * Route dispatcher for the coordinator fetch handler. Extracted as a standalone
  * function so the outer {@link coordinatorEntrypoint.fetch} try/catch backstop
@@ -3849,19 +3787,6 @@ async function coordinatorRouteFetch(
     }
     return new Response('ok', { status: 200, headers });
   }
-  if (isCoordinatorRuntimeProxyPath(url.pathname)) {
-    try {
-      return await proxyCoordinatorRuntimeApiRequest({ request, env, url });
-    } catch (error) {
-      return coordinatorRouteErrorResponse({
-        logTag: '[coordinator.runtime_proxy.error]',
-        code: 'COORDINATOR_RUNTIME_PROXY_FAILED',
-        phase: 'coordinator.runtime_proxy',
-        runId: null,
-        error,
-      });
-    }
-  }
   if (url.pathname === '/internal-token/probe') {
     const authError = authorizeCoordinatorControlRequest({ request, env });
     if (authError) return authError;
@@ -4110,7 +4035,7 @@ async function flushTailRunLogs(
         return;
       }
       await fetch(
-        `${env.DEEPLINE_API_BASE_URL}${PLAY_RUNTIME_TAIL_LOG_CURRENT_PATH}`,
+        `${env.DEEPLINE_API_BASE_URL}${PLAY_RUNTIME_TAIL_LOG_COMPAT_PATH}`,
         {
           method: 'POST',
           headers: {
@@ -5530,7 +5455,7 @@ export class TenantWorkflow extends WorkflowEntrypoint {
     const runId = payload && typeof payload.runId === "string" ? payload.runId : "warmup";
     const startedAt = Date.now();
     if (this.env.RUNTIME_API) {
-      await this.env.RUNTIME_API.fetch(new Request("https://deepline.runtime.internal${PLAY_RUNTIME_API_CURRENT_PATH}", {
+      await this.env.RUNTIME_API.fetch(new Request("https://deepline.runtime.internal${PLAY_RUNTIME_API_COMPAT_PATH}", {
         method: "POST",
         headers: { "content-type": "application/json" },
         body: "{}"

package/dist/bundling-sources/apps/play-runner-workers/src/entry.ts

@@ -185,8 +185,8 @@ import {
   PLAY_RUNTIME_CONTRACT_HEADER,
 } from '../../../shared_libs/play-runtime/runtime-contract';
 import {
-  PLAY_RUNTIME_API_CURRENT_PATH,
-  PLAY_RUNTIME_EGRESS_FETCH_CURRENT_PATH,
+  PLAY_RUNTIME_API_COMPAT_PATH,
+  PLAY_RUNTIME_EGRESS_FETCH_COMPAT_PATH,
 } from '../../../shared_libs/play-runtime/runtime-api-paths';
 import { DYNAMIC_PLAY_WORKER_ARTIFACT_VERSION } from '../../../shared_libs/play-runtime/dynamic-worker-version';
 import {
@@ -860,7 +860,7 @@ async function fetchRuntimeApi(
       ? Math.max(1, Math.ceil(options.timeoutMsOverride))
       : path === '/api/v2/plays/run'
         ? RUNTIME_API_PLAY_RUN_TIMEOUT_MS
-        : path === PLAY_RUNTIME_EGRESS_FETCH_CURRENT_PATH
+        : path === PLAY_RUNTIME_EGRESS_FETCH_COMPAT_PATH
           ? RUNTIME_API_EGRESS_FETCH_TIMEOUT_MS
           : /^\/api\/v2\/integrations\/[^/]+\/execute$/.test(path)
             ? RUNTIME_API_INTEGRATION_EXECUTE_TIMEOUT_MS
@@ -1170,6 +1170,8 @@ function recordRunnerPerfTrace(input: {
     ts: Date.now(),
     source: 'dynamic_worker' as const,
     runId: input.req.runId,
+    playName: input.req.playName,
+    orgId: input.req.orgId,
     phase,
     ms: input.ms ?? 0,
     ...(input.extra ?? {}),
@@ -1316,7 +1318,7 @@ async function postRuntimeApi<T>(
     try {
       res = await fetchRuntimeApi(
         baseUrl,
-        PLAY_RUNTIME_API_CURRENT_PATH,
+        PLAY_RUNTIME_API_COMPAT_PATH,
         {
           method: 'POST',
           headers: {
@@ -2890,7 +2892,7 @@ async function postRuntimeEgressFetch(
   ) {
     const response = await fetchRuntimeApi(
       req.baseUrl,
-      PLAY_RUNTIME_EGRESS_FETCH_CURRENT_PATH,
+      PLAY_RUNTIME_EGRESS_FETCH_COMPAT_PATH,
       {
         method: 'POST',
         headers: {
@@ -4263,7 +4265,7 @@ function createMinimalWorkerCtx(
     if (!auth) return {};
     const response = await fetchRuntimeApi(
       req.baseUrl,
-      PLAY_RUNTIME_API_CURRENT_PATH,
+      PLAY_RUNTIME_API_COMPAT_PATH,
       {
         method: 'POST',
         headers: {
@@ -8942,7 +8944,7 @@ export class TenantWorkflow extends WorkflowEntrypoint<
         try {
           const response = await fetchRuntimeApi(
             req.baseUrl,
-            PLAY_RUNTIME_API_CURRENT_PATH,
+            PLAY_RUNTIME_API_COMPAT_PATH,
             {
               method: 'POST',
               headers: {

package/dist/bundling-sources/sdk/src/release.ts

@@ -106,10 +106,10 @@ export const SDK_RELEASE = {
   // 0.1.154 removes the short-lived generated enrich StepOptions recompute
   // fields shipped in 0.1.153.
   // 0.1.175 ships loud `deepline enrich` empty-waterfall reporting.
-  version: '0.1.216',
+  version: '0.1.218',
   apiContract: '2026-06-dataset-handle-results-hard-cutover',
   supportPolicy: {
-    latest: '0.1.216',
+    latest: '0.1.218',
     minimumSupported: '0.1.53',
     deprecatedBelow: '0.1.53',
     commandMinimumSupported: [

package/dist/bundling-sources/shared_libs/play-runtime/app-runtime-api.ts

@@ -38,7 +38,7 @@ import {
   PLAY_RUNTIME_CONTRACT,
   PLAY_RUNTIME_CONTRACT_HEADER,
 } from '@shared_libs/play-runtime/runtime-contract';
-import { PLAY_RUNTIME_API_CURRENT_PATH } from '@shared_libs/play-runtime/runtime-api-paths';
+import { PLAY_RUNTIME_API_COMPAT_PATH } from '@shared_libs/play-runtime/runtime-api-paths';
 import { PLAY_RUNTIME_TEST_FAULT_HEADER } from '@shared_libs/play-runtime/test-runtime-seams';
 import { vercelProtectionBypassHeaders } from '@shared_libs/play-runtime/vercel-protection';
 
@@ -788,7 +788,7 @@ export class AppRuntimeApiTransportError extends Error {
 
 function resolveAppRuntimeApiUrl(context: WorkerRuntimeApiContext): string {
   const baseUrl = context.baseUrl.trim().replace(/\/$/, '');
-  return `${baseUrl}${PLAY_RUNTIME_API_CURRENT_PATH}`;
+  return `${baseUrl}${PLAY_RUNTIME_API_COMPAT_PATH}`;
 }
 
 async function postAppRuntimeApi<TResponse>(

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -47,7 +47,10 @@ import {
   RUNTIME_SCHEDULER_SCHEMA_OVERRIDE_HEADER,
   SYNTHETIC_RUN_HEADER,
 } from './coordinator-headers';
-import { PLAY_RUNTIME_API_CURRENT_PATH } from './runtime-api-paths';
+import {
+  PLAY_RUNTIME_API_COMPAT_PATH,
+  PLAY_RUNTIME_API_CURRENT_PATH,
+} from './runtime-api-paths';
 import {
   createRootRunExecutionScope,
   deriveChildRunExecutionScope,
@@ -1728,7 +1731,7 @@ export class PlayContextImpl {
     | null
   > {
     const response = await fetch(
-      `${this.runtimeApiBaseUrl()}${PLAY_RUNTIME_API_CURRENT_PATH}`,
+      `${this.runtimeApiBaseUrl()}${PLAY_RUNTIME_API_COMPAT_PATH}`,
       {
         method: 'POST',
         headers: await this.runtimeApiHeaders(),
@@ -1843,7 +1846,7 @@ export class PlayContextImpl {
       this.#options.runId
     ) {
       const response = await fetch(
-        `${this.#options.baseUrl.replace(/\/$/, '')}${PLAY_RUNTIME_API_CURRENT_PATH}`,
+        `${this.#options.baseUrl.replace(/\/$/, '')}${PLAY_RUNTIME_API_COMPAT_PATH}`,
         {
           method: 'POST',
           headers: {

package/dist/bundling-sources/shared_libs/play-runtime/runtime-api.ts

@@ -95,7 +95,7 @@ import {
   PLAY_RUNTIME_CONTRACT,
   PLAY_RUNTIME_CONTRACT_HEADER,
 } from './runtime-contract';
-import { PLAY_RUNTIME_API_CURRENT_PATH } from './runtime-api-paths';
+import { PLAY_RUNTIME_API_COMPAT_PATH } from './runtime-api-paths';
 import {
   PLAY_RUNTIME_SHEET_ATTEMPT_LEASE_TTL_MS,
   PLAY_RUNTIME_WORK_RECEIPT_LEASE_TTL_MS,
@@ -298,7 +298,6 @@ const RUNTIME_WORK_RECEIPT_LEASE_COLUMNS = [
   'lease_expires_at',
 ] as const;
 const RUNTIME_WORK_RECEIPT_FAILURE_KIND_COLUMN = 'failure_kind';
-const RUNTIME_WORK_RECEIPT_KEY_INDEX = 'idx_deepline_step_receipts_k_unique';
 const RUNTIME_WORK_RECEIPT_SELF_HEAL_COLUMNS = [
   ...RUNTIME_WORK_RECEIPT_LEASE_COLUMNS,
   RUNTIME_WORK_RECEIPT_FAILURE_KIND_COLUMN,
@@ -505,7 +504,7 @@ function resolveRuntimeApiUrl(context: RuntimeApiContext): string {
   if (!baseUrl) {
     throw new Error('Runner runtime API requires a baseUrl.');
   }
-  return `${baseUrl.replace(/\/$/, '')}${PLAY_RUNTIME_API_CURRENT_PATH}`;
+  return `${baseUrl.replace(/\/$/, '')}${PLAY_RUNTIME_API_COMPAT_PATH}`;
 }
 
 function resolveRuntimeApiHeaders(
@@ -2043,22 +2042,6 @@ function isMissingRuntimeWorkReceiptSelfHealColumnError(
   );
 }
 
-function isMissingRuntimeWorkReceiptKeyConstraintError(
-  error: unknown,
-): boolean {
-  if (!error || typeof error !== 'object') {
-    return false;
-  }
-  const code = 'code' in error ? String(error.code) : '';
-  const message = 'message' in error ? String(error.message) : '';
-  return (
-    code === '42P10' ||
-    /no unique or exclusion constraint matching the ON CONFLICT specification/i.test(
-      message,
-    )
-  );
-}
-
 function runtimeWorkReceiptEnsureCacheKey(
   session: RuntimePostgresSession,
 ): string {
@@ -2138,29 +2121,22 @@ async function ensureRuntimeWorkReceiptTable(
         session,
         client,
       );
-      if (missingColumns.length > 0) {
-        await client.query(`
-          ALTER TABLE ${workReceiptTable(session)}
-            ${missingColumns
-              .map((column) => {
-                const type =
-                  column === 'lease_expires_at'
-                    ? 'timestamptz'
-                    : column === 'lease_owner_attempt'
-                      ? 'integer'
-                      : column === RUNTIME_WORK_RECEIPT_FAILURE_KIND_COLUMN
-                        ? 'smallint NOT NULL DEFAULT 0'
-                        : 'text';
-                return `ADD COLUMN IF NOT EXISTS ${column} ${type}`;
-              })
-              .join(',\n          ')}
-        `);
-      }
+      if (missingColumns.length === 0) return;
       await client.query(`
-        CREATE UNIQUE INDEX IF NOT EXISTS ${quoteIdentifier(
-          RUNTIME_WORK_RECEIPT_KEY_INDEX,
-        )}
-        ON ${workReceiptTable(session)} (k)
+        ALTER TABLE ${workReceiptTable(session)}
+          ${missingColumns
+            .map((column) => {
+              const type =
+                column === 'lease_expires_at'
+                  ? 'timestamptz'
+                  : column === 'lease_owner_attempt'
+                    ? 'integer'
+                    : column === RUNTIME_WORK_RECEIPT_FAILURE_KIND_COLUMN
+                      ? 'smallint NOT NULL DEFAULT 0'
+                      : 'text';
+              return `ADD COLUMN IF NOT EXISTS ${column} ${type}`;
+            })
+            .join(',\n          ')}
       `);
     })
     .then(() => undefined);
@@ -2264,8 +2240,7 @@ async function withRuntimeWorkReceiptClient<T>(
     } catch (error) {
       if (
         isMissingRelationError(error) ||
-        isMissingRuntimeWorkReceiptSelfHealColumnError(error) ||
-        isMissingRuntimeWorkReceiptKeyConstraintError(error)
+        isMissingRuntimeWorkReceiptSelfHealColumnError(error)
       ) {
         runtimeWorkReceiptEnsureCache.delete(
           runtimeWorkReceiptEnsureCacheKey(session),

package/dist/cli/index.js

@@ -623,10 +623,10 @@ var SDK_RELEASE = {
   // 0.1.154 removes the short-lived generated enrich StepOptions recompute
   // fields shipped in 0.1.153.
   // 0.1.175 ships loud `deepline enrich` empty-waterfall reporting.
-  version: "0.1.216",
+  version: "0.1.218",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.216",
+    latest: "0.1.218",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [
@@ -19217,7 +19217,14 @@ async function emitSdkEnrichTelemetry(context, event, summary) {
       method: "POST",
       headers: {
         Authorization: `Bearer ${context.apiKey}`,
-        "Content-Type": "application/json"
+        "Content-Type": "application/json",
+        "User-Agent": `deepline-ts-sdk/${SDK_VERSION}`,
+        "X-Deepline-Client-Family": "sdk",
+        "X-Deepline-CLI-Family": "sdk",
+        "X-Deepline-Agent-Runtime": detectAgentRuntime(),
+        "X-Deepline-CLI-Version": SDK_VERSION,
+        "X-Deepline-SDK-Version": SDK_VERSION,
+        "X-Deepline-API-Contract": SDK_API_CONTRACT
       },
       body: JSON.stringify(body),
       signal: controller.signal

package/dist/cli/index.mjs

@@ -608,10 +608,10 @@ var SDK_RELEASE = {
   // 0.1.154 removes the short-lived generated enrich StepOptions recompute
   // fields shipped in 0.1.153.
   // 0.1.175 ships loud `deepline enrich` empty-waterfall reporting.
-  version: "0.1.216",
+  version: "0.1.218",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.216",
+    latest: "0.1.218",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [
@@ -19246,7 +19246,14 @@ async function emitSdkEnrichTelemetry(context, event, summary) {
       method: "POST",
       headers: {
         Authorization: `Bearer ${context.apiKey}`,
-        "Content-Type": "application/json"
+        "Content-Type": "application/json",
+        "User-Agent": `deepline-ts-sdk/${SDK_VERSION}`,
+        "X-Deepline-Client-Family": "sdk",
+        "X-Deepline-CLI-Family": "sdk",
+        "X-Deepline-Agent-Runtime": detectAgentRuntime(),
+        "X-Deepline-CLI-Version": SDK_VERSION,
+        "X-Deepline-SDK-Version": SDK_VERSION,
+        "X-Deepline-API-Contract": SDK_API_CONTRACT
       },
       body: JSON.stringify(body),
       signal: controller.signal

package/dist/index.js

@@ -422,10 +422,10 @@ var SDK_RELEASE = {
   // 0.1.154 removes the short-lived generated enrich StepOptions recompute
   // fields shipped in 0.1.153.
   // 0.1.175 ships loud `deepline enrich` empty-waterfall reporting.
-  version: "0.1.216",
+  version: "0.1.218",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.216",
+    latest: "0.1.218",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [

package/dist/index.mjs

@@ -352,10 +352,10 @@ var SDK_RELEASE = {
   // 0.1.154 removes the short-lived generated enrich StepOptions recompute
   // fields shipped in 0.1.153.
   // 0.1.175 ships loud `deepline enrich` empty-waterfall reporting.
-  version: "0.1.216",
+  version: "0.1.218",
   apiContract: "2026-06-dataset-handle-results-hard-cutover",
   supportPolicy: {
-    latest: "0.1.216",
+    latest: "0.1.218",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.1.216",
+  "version": "0.1.218",
   "description": "Deepline SDK + CLI — B2B data enrichment powered by durable cloud execution",
   "license": "MIT",
   "repository": {

package/dist/bundling-sources/apps/play-runner-workers/src/coordinator-runtime-proxy.ts

@@ -1,34 +0,0 @@
-import {
-  PLAY_RUNTIME_API_CURRENT_PATH,
-  PLAY_RUNTIME_CHILD_EXECUTOR_TOKEN_CURRENT_PATH,
-  PLAY_RUNTIME_EGRESS_FETCH_CURRENT_PATH,
-} from '../../../shared_libs/play-runtime/runtime-api-paths';
-
-/**
- * Paths a credential-isolated Daytona sandbox may send through the
- * coordinator. The sandbox receives the coordinator as its runtime origin so
- * it never holds the Vercel protection-bypass credential; the harness owns the
- * protected upstream hop. Keep this deliberately narrower than the harness
- * allowlist: a coordinator URL is public, while the harness is a service
- * binding.
- */
-export function isCoordinatorRuntimeProxyPath(pathname: string): boolean {
-  return (
-    pathname === PLAY_RUNTIME_API_CURRENT_PATH ||
-    pathname === PLAY_RUNTIME_CHILD_EXECUTOR_TOKEN_CURRENT_PATH ||
-    pathname === PLAY_RUNTIME_EGRESS_FETCH_CURRENT_PATH ||
-    pathname === '/api/v2/plays/run' ||
-    /^\/api\/v2\/plays\/runtime-tools\/[^/]+(?:\/(?:auth-scope|event-wait))?$/.test(
-      pathname,
-    ) ||
-    /^\/api\/v2\/integrations\/[^/]+\/(?:execute|stream)$/.test(pathname)
-  );
-}
-
-export function executorTokenFromAuthorizationHeader(
-  authorization: string | null,
-): string | null {
-  const match = /^Bearer\s+(.+)$/i.exec(authorization?.trim() ?? '');
-  const token = match?.[1]?.trim();
-  return token || null;
-}