deepline 0.1.239 → 0.1.241

package/dist/bundling-sources/sdk/src/release.ts

@@ -110,10 +110,13 @@ export const SDK_RELEASE = {
   // silently materializing them as unmatched results.
   // 0.1.220 deprecates SDK CLI versions below 0.1.219 and updates them
   // automatically without blocking their current command.
-  version: '0.1.239',
-  apiContract: '2026-06-dataset-handle-results-hard-cutover',
+  // 0.1.241 hard-cuts published and launched plays to immutable cjs_node20
+  // artifacts. Older clients can submit esm_workers artifacts that the Absurd
+  // runtime intentionally no longer compiles at publish or launch time.
+  version: '0.1.241',
+  apiContract: '2026-07-immutable-cjs-play-artifacts-hard-cutover',
   supportPolicy: {
-    latest: '0.1.239',
+    latest: '0.1.241',
     minimumSupported: '0.1.53',
     deprecatedBelow: '0.1.219',
     commandMinimumSupported: [

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -5852,6 +5852,10 @@ export class PlayContextImpl {
     for (const wake of waiters) wake();
   }
 
+  private toolBatchDispatcherNowMs(): number {
+    return this.#options.toolBatchDispatcherClock?.nowMs() ?? Date.now();
+  }
+
   private enqueueToolCall(request: ToolCallRequest): void {
     if (this.toolDispatcherFailure != null) {
       const resolver = this.toolCallResolvers.get(request.callId);
@@ -5864,7 +5868,10 @@ export class PlayContextImpl {
     this.toolCallQueue.push(request);
     const batchKey = this.toolBatchCoalesceKey(request);
     if (batchKey && !this.toolBatchQueuedAtByKey.has(batchKey)) {
-      this.toolBatchQueuedAtByKey.set(batchKey, Date.now());
+      this.toolBatchQueuedAtByKey.set(
+        batchKey,
+        this.toolBatchDispatcherNowMs(),
+      );
     }
     this.wakeToolDispatcher();
   }
@@ -5941,15 +5948,26 @@ export class PlayContextImpl {
 
   private waitForToolDispatcherWake(deadlineMs: number | null): Promise<void> {
     return new Promise((resolve) => {
-      let timer: ReturnType<typeof setTimeout> | null = null;
+      let cancelDeadline: (() => void) | null = null;
       const wake = () => {
-        if (timer) clearTimeout(timer);
+        cancelDeadline?.();
+        cancelDeadline = null;
         this.toolDispatcherWakeWaiters.delete(wake);
         resolve();
       };
       this.toolDispatcherWakeWaiters.add(wake);
       if (deadlineMs != null) {
-        timer = setTimeout(wake, Math.max(0, deadlineMs - Date.now()));
+        const delayMs = Math.max(
+          0,
+          deadlineMs - this.toolBatchDispatcherNowMs(),
+        );
+        const clock = this.#options.toolBatchDispatcherClock;
+        if (clock) {
+          cancelDeadline = clock.schedule(delayMs, wake);
+        } else {
+          const timer = setTimeout(wake, delayMs);
+          cancelDeadline = () => clearTimeout(timer);
+        }
       }
     });
   }
@@ -5977,7 +5995,9 @@ export class PlayContextImpl {
           throw this.toolDispatcherFailure;
         }
 
-        const dispatchable = this.takeDispatchableToolCalls(Date.now());
+        const dispatchable = this.takeDispatchableToolCalls(
+          this.toolBatchDispatcherNowMs(),
+        );
         if (dispatchable.requests.length > 0) {
           pass += 1;
           this.log(`  Batch pass ${pass}`);
@@ -6688,8 +6708,8 @@ export class PlayContextImpl {
       rowScopeKey ? `@${rowScopeKey}` : ''
     }`;
     if (rowScope) {
-      const namespaces =
-        rowScope.inlineChildInvocationNamespaces ??= new Set<string>();
+      const namespaces = (rowScope.inlineChildInvocationNamespaces ??=
+        new Set<string>());
       namespaces.add(namespace);
       if (namespaces.size > MAX_INLINE_CHILD_INVOCATIONS_PER_ROW) {
         throw new Error(

package/dist/bundling-sources/shared_libs/play-runtime/ctx-types.ts

@@ -680,6 +680,14 @@ export interface ContextOptions {
   getBatchOperationStrategy?: (
     operation: string,
   ) => AnyBatchOperationStrategy | null;
+  /**
+   * Internal deterministic clock for fixed-window dispatcher tests. Runtime
+   * adapters omit this and use the system clock.
+   */
+  toolBatchDispatcherClock?: {
+    nowMs: () => number;
+    schedule: (delayMs: number, wake: () => void) => () => void;
+  };
   // How long batchable calls wait for same-key row continuations before
   // dispatching, measured from the first queued item. Defaults to 5ms in
   // production; tests override it to a large value to make coalescing

package/dist/bundling-sources/shared_libs/play-runtime/run-ledger.ts

@@ -1055,7 +1055,12 @@ export function reducePlayRunLedgerEvent(
       if (ignoreNonTerminalAfterStickyTerminal) {
         return withTiming(base);
       }
-      const createdStatus = event.status ?? base.status;
+      // Scheduler wait/resume events own the active lifecycle once a run is
+      // parked. Worker registration can arrive later through an independent
+      // ledger append lane; replaying that older `run.created` fact must not
+      // make an externally-waiting run look active again.
+      const createdStatus =
+        base.status === 'waiting' ? 'waiting' : (event.status ?? base.status);
       return withTiming({
         ...base,
         playName: event.playName ?? base.playName ?? null,
@@ -1075,7 +1080,9 @@ export function reducePlayRunLedgerEvent(
         playName: event.playName ?? base.playName ?? null,
         status: isTerminalPlayRunLedgerStatus(base.status)
           ? base.status
-          : 'running',
+          : base.status === 'waiting'
+            ? 'waiting'
+            : 'running',
         startedAt: base.startedAt ?? occurredAt,
       });
     case 'run.waiting':
@@ -1200,7 +1207,9 @@ export function reducePlayRunLedgerEvent(
         ...base,
         status: isTerminalPlayRunLedgerStatus(base.status)
           ? base.status
-          : 'running',
+          : base.status === 'waiting'
+            ? 'waiting'
+            : 'running',
         startedAt: base.startedAt ?? occurredAt,
         orderedStepIds: appendOrderedStepId(base, event.stepId),
         stepsById: { ...base.stepsById, [event.stepId]: nextStep },

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/backends/daytona-payload-transport.ts

@@ -32,6 +32,7 @@ export type StagedDaytonaPayload = {
   workDir: string;
   command: string;
   readyPath: string;
+  startAckPath: string;
   outputPath: string;
   exitCodePath: string;
   progressEventPath: string;
@@ -389,6 +390,7 @@ export async function stageDaytonaRunnerPayload(input: {
   const outputPath = `${workDir}/deepline-play-output-${randomUUID()}.log`;
   const exitCodePath = `${workDir}/deepline-play-exit-${randomUUID()}.txt`;
   const readyPath = `${workDir}/deepline-play-ready-${randomUUID()}.json`;
+  const startAckPath = `${workDir}/deepline-play-start-ack-${randomUUID()}.json`;
   const progressEventPath = `${workDir}/deepline-play-progress-${randomUUID()}.jsonl`;
   const runnerTraceEnv =
     process.env.DEEPLINE_RUNTIME_RECEIPT_TRACE === '1'
@@ -401,18 +403,19 @@ export async function stageDaytonaRunnerPayload(input: {
     artifactCodePath,
     artifactSourceMapPath,
     crashPusherPath,
-  })} && DEEPLINE_PLAY_RUNNER_READY_PATH=${shellQuote(readyPath)} DEEPLINE_PLAY_RUNNER_PROGRESS_EVENT_PATH=${shellQuote(progressEventPath)} DEEPLINE_PLAY_RUNNER_STDOUT_EVENT_MODE=compact ${runnerTraceEnv}node ${shellQuote(runnerPath)} ${shellQuote(configPath)}`;
+  })} && DEEPLINE_PLAY_RUNNER_READY_PATH=${shellQuote(readyPath)} DEEPLINE_PLAY_RUNNER_START_ACK_PATH=${shellQuote(startAckPath)} DEEPLINE_PLAY_RUNNER_PROGRESS_EVENT_PATH=${shellQuote(progressEventPath)} DEEPLINE_PLAY_RUNNER_STDOUT_EVENT_MODE=compact ${runnerTraceEnv}node ${shellQuote(runnerPath)} ${shellQuote(configPath)}`;
   // Crash-containment epilogue: runs UNCONDITIONALLY after the runner exits and
   // pushes the parsed (or synthesized) terminal to the gateway so the parked
   // worker wakes within seconds of ANY runner death — process.exit abuse, OOM
   // SIGKILL, or a crash before the in-process push. Idempotent against a
   // successful in-runner push (terminals are first-write-wins).
-  const command = `rm -f ${shellQuote(outputPath)} ${shellQuote(exitCodePath)} ${shellQuote(readyPath)} ${shellQuote(progressEventPath)} ${shellQuote(`${progressEventPath}.*`)}; ( ${runnerCommand} ) > ${shellQuote(outputPath)} 2>&1; code=$?; printf '%s' "$code" > ${shellQuote(exitCodePath)}; node ${shellQuote(crashPusherPath)} ${shellQuote(configPath)} "$code" ${shellQuote(outputPath)} >> ${shellQuote(outputPath)} 2>&1 || true; printf 'deepline runner output captured: %s\\n' ${shellQuote(outputPath)}; exit "$code"`;
+  const command = `rm -f ${shellQuote(outputPath)} ${shellQuote(exitCodePath)} ${shellQuote(readyPath)} ${shellQuote(startAckPath)} ${shellQuote(progressEventPath)} ${shellQuote(`${progressEventPath}.*`)}; ( ${runnerCommand} ) > ${shellQuote(outputPath)} 2>&1; code=$?; printf '%s' "$code" > ${shellQuote(exitCodePath)}; node ${shellQuote(crashPusherPath)} ${shellQuote(configPath)} "$code" ${shellQuote(outputPath)} >> ${shellQuote(outputPath)} 2>&1 || true; printf 'deepline runner output captured: %s\\n' ${shellQuote(outputPath)}; exit "$code"`;
 
   return {
     workDir: input.workDir,
     command,
     readyPath,
+    startAckPath,
     outputPath,
     exitCodePath,
     progressEventPath,

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/backends/daytona-session-execution.ts

@@ -1,6 +1,8 @@
 import type { DaytonaSandbox } from './daytona-lifecycle';
 
 export type DetachedDaytonaStartupDiagnostic = {
+  readyMarkerObserved: boolean;
+  startAcknowledgementAttempted: boolean;
   commandFound: boolean;
   exitCode: number | null;
   sessionFound: boolean;
@@ -51,6 +53,8 @@ export async function inspectDetachedDaytonaStartup(input: {
 }): Promise<DetachedDaytonaStartupDiagnostic> {
   const errors: string[] = [];
   const diagnostic: DetachedDaytonaStartupDiagnostic = {
+    readyMarkerObserved: false,
+    startAcknowledgementAttempted: false,
     commandFound: false,
     exitCode: null,
     sessionFound: false,
@@ -119,7 +123,10 @@ export const DAYTONA_RUNNER_READY_TIMEOUT_MS = 60_000;
 const DAYTONA_RUNNER_READY_POLL_MS = 250;
 
 export class DaytonaRunnerInitializationError extends Error {
-  constructor(message: string) {
+  constructor(
+    message: string,
+    readonly startupDiagnostic: DetachedDaytonaStartupDiagnostic,
+  ) {
     super(message);
     this.name = 'DaytonaRunnerInitializationError';
   }
@@ -163,6 +170,7 @@ export async function confirmDetachedDaytonaRunnerReady(input: {
   sessionId: string;
   cmdId: string;
   readyPath: string;
+  startAckPath: string;
   exitCodePath: string;
   timeoutMs?: number;
   pollMs?: number;
@@ -180,6 +188,8 @@ export async function confirmDetachedDaytonaRunnerReady(input: {
   const pollMs = Math.max(1, input.pollMs ?? DAYTONA_RUNNER_READY_POLL_MS);
   const deadline = now() + timeoutMs;
   let markerDiagnosis = 'ready_marker_unavailable';
+  let readyMarkerObserved = false;
+  let startAcknowledgementAttempted = false;
 
   while (now() < deadline) {
     try {
@@ -187,8 +197,21 @@ export async function confirmDetachedDaytonaRunnerReady(input: {
       const parsed = JSON.parse(marker.toString('utf-8')) as {
         ready?: unknown;
       };
-      if (parsed.ready === true) return;
-      markerDiagnosis = 'ready_marker_invalid';
+      if (parsed.ready === true) {
+        readyMarkerObserved = true;
+        startAcknowledgementAttempted = true;
+        try {
+          await input.sandbox.fs.uploadFile(
+            Buffer.from('{"start":true}', 'utf-8'),
+            input.startAckPath,
+          );
+          return;
+        } catch {
+          markerDiagnosis = 'start_ack_unavailable';
+        }
+      } else {
+        markerDiagnosis = 'ready_marker_invalid';
+      }
     } catch {
       markerDiagnosis = 'ready_marker_unavailable';
     }
@@ -201,9 +224,12 @@ export async function confirmDetachedDaytonaRunnerReady(input: {
     cmdId: input.cmdId,
     exitCodePath: input.exitCodePath,
   });
+  diagnostic.readyMarkerObserved = readyMarkerObserved;
+  diagnostic.startAcknowledgementAttempted = startAcknowledgementAttempted;
   const oomIndicated =
     diagnostic.exitCode === 137 || diagnostic.exitCodeFile === 137;
   throw new DaytonaRunnerInitializationError(
-    `RUNTIME_SANDBOX_START_FAILED: Daytona accepted detached command ${input.cmdId} in sandbox ${input.sandbox.id}, but the play runner did not materialize and establish receipt-gateway liveness within ${timeoutMs}ms. Marker diagnosis: ${markerDiagnosis}. Daytona diagnosis: ${JSON.stringify(diagnostic)}. OOM is ${oomIndicated ? 'indicated by exit code 137' : 'not confirmed by the available Daytona evidence'}. The play was stopped and was not retried.`,
+    `RUNTIME_SANDBOX_START_FAILED: Daytona accepted detached command ${input.cmdId} in sandbox ${input.sandbox.id}, but the play runner did not materialize and establish receipt-gateway liveness within ${timeoutMs}ms. Marker diagnosis: ${markerDiagnosis}. Daytona diagnosis: ${JSON.stringify(diagnostic)}. OOM is ${oomIndicated ? 'indicated by exit code 137' : 'not confirmed by the available Daytona evidence'}. The worker will not park this runner; the failed runner was stopped and was not retried in place.`,
+    diagnostic,
   );
 }

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/backends/daytona.ts

@@ -474,6 +474,27 @@ function isRetryableDaytonaInfrastructureFailure(error: unknown): boolean {
   return DAYTONA_INFRASTRUCTURE_RETRY_PATTERN.test(message);
 }
 
+function isRetryableUnstartedDaytonaRunner(
+  error: unknown,
+): error is DaytonaRunnerInitializationError {
+  if (!(error instanceof DaytonaRunnerInitializationError)) return false;
+  const diagnostic = error.startupDiagnostic;
+  // The ready fence runs before any customer play code. If Daytona accepted
+  // the command but the worker never observed its ready marker, the runner
+  // cannot pass the reverse start-ack fence and customer code cannot begin.
+  // Terminate that sandbox and retry once on a fresh one even when its Node
+  // process is still alive. Do not retry after a start acknowledgement was
+  // attempted (its write outcome may be ambiguous), or after a runner exit.
+  return (
+    diagnostic.commandFound &&
+    diagnostic.sessionFound &&
+    diagnostic.exitCode === null &&
+    diagnostic.exitCodeFile === null &&
+    !diagnostic.readyMarkerObserved &&
+    !diagnostic.startAcknowledgementAttempted
+  );
+}
+
 function prepareDaytonaExecution(
   input: PlayRunnerPrepareInput,
   callbacks: Parameters<PlayRunnerBackend['execute']>[1],
@@ -819,6 +840,7 @@ export const daytonaPlayRunnerBackend: PlayRunnerBackend = {
               sessionId: start.sessionId,
               cmdId: start.cmdId,
               readyPath: stagedPayload.readyPath,
+              startAckPath: stagedPayload.startAckPath,
               exitCodePath: stagedPayload.exitCodePath,
             }),
             cancellationPromise,
@@ -868,6 +890,25 @@ export const daytonaPlayRunnerBackend: PlayRunnerBackend = {
             onCancel();
             throw new Error(DAYTONA_CANCELLED_ERROR);
           }
+          if (
+            executionAttempt < DAYTONA_RUNTIME_INITIALIZATION_MAX_ATTEMPTS &&
+            isRetryableUnstartedDaytonaRunner(error)
+          ) {
+            emitDaytonaStage(callbacks, config.context, 'execute:retry', {
+              sandboxId: sandboxForAttempt?.id ?? null,
+              attempt: executionAttempt + 1,
+              reason: 'runner_startup_not_live',
+              error: error.message,
+              elapsedMs: Date.now() - startedAt,
+            });
+            if (sandboxForAttempt) {
+              activeAcquiredResource!.billingEndedAt = Date.now();
+              await reportRetiringRuntimeResource(activeAcquiredResource!);
+              sandboxCleanup.stashActiveSandboxForRetry();
+            }
+            acquiredSandboxPromise = sandboxLifecycle.createFreshSandbox();
+            continue;
+          }
           if (
             executionAttempt < DAYTONA_INFRASTRUCTURE_MAX_ATTEMPTS &&
             isRetryableDaytonaInfrastructureFailure(error)

package/dist/bundling-sources/shared_libs/play-runtime/secret-redaction.ts

@@ -2,7 +2,11 @@ export const SECRET_REDACTION_PLACEHOLDER = '[REDACTED_SECRET]';
 
 const BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
 const BASIC_CREDENTIAL_RE = /\bBasic\s+[A-Za-z0-9+/]{4,}={0,2}\b/g;
-const JWT_RE = /\b[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{1,}\.[A-Za-z0-9_-]{8,}\b/g;
+// Bound each segment so V8 cannot recursively backtrack across a multi-megabyte
+// opaque receipt value that contains no dots. Real executor/provider JWT
+// segments are far smaller; 16 KiB per segment still leaves ample headroom.
+const JWT_RE =
+  /\b[A-Za-z0-9_-]{8,16384}\.[A-Za-z0-9_-]{1,16384}\.[A-Za-z0-9_-]{8,16384}\b/g;
 const PRIVATE_KEY_RE =
   /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
 const SENSITIVE_FIELD_NAME =

package/dist/bundling-sources/shared_libs/plays/artifact-kind-guard.ts

@@ -42,12 +42,18 @@ export function bundledCodeHasCloudflareSchemeImport(
 export class PlayArtifactKindMismatchError extends Error {
   readonly expectedKind: PlayArtifactKind;
   readonly actualKind: PlayArtifactKind;
-  readonly reason: 'kind_mismatch' | 'cloudflare_scheme_import';
+  readonly reason:
+    | 'kind_mismatch'
+    | 'code_format_mismatch'
+    | 'cloudflare_scheme_import';
 
   constructor(input: {
     expectedKind: PlayArtifactKind;
     actualKind: PlayArtifactKind;
-    reason: 'kind_mismatch' | 'cloudflare_scheme_import';
+    reason:
+      | 'kind_mismatch'
+      | 'code_format_mismatch'
+      | 'cloudflare_scheme_import';
     message: string;
   }) {
     super(input.message);
@@ -96,6 +102,19 @@ export function assertNodeRunnableArtifact(input: {
     });
   }
 
+  if (artifact.codeFormat !== 'cjs_module') {
+    throw new PlayArtifactKindMismatchError({
+      expectedKind,
+      actualKind,
+      reason: 'code_format_mismatch',
+      message:
+        `Node runner (${context}) received a "${actualKind}" play artifact ` +
+        `with codeFormat "${artifact.codeFormat}" but requires "cjs_module". ` +
+        `The artifact metadata is inconsistent; rebuild it for the node runner ` +
+        `before launch.`,
+    });
+  }
+
   if (bundledCodeHasCloudflareSchemeImport(artifact.bundledCode)) {
     throw new PlayArtifactKindMismatchError({
       expectedKind,

package/dist/bundling-sources/shared_libs/plays/bundling/index.ts

@@ -440,6 +440,17 @@ function findSourceImportReferences(
   );
 }
 
+/**
+ * Reports local runtime edges using the same parser that drives graph analysis.
+ * Migration code uses this to distinguish truly single-file source from stored
+ * graph metadata without maintaining a second import parser.
+ */
+export function countLocalRuntimeImportReferences(sourceCode: string): number {
+  return findSourceImportReferences(sourceCode).filter((reference) =>
+    isLocalSpecifier(reference.specifier),
+  ).length;
+}
+
 function findMatchingBrace(source: string, openIndex: number): number {
   const structuralSource = maskSourceForStructure(source);
   let depth = 0;

package/dist/bundling-sources/shared_libs/plays/secret-guardrails.ts

@@ -6,6 +6,10 @@ const BEARER_LITERAL_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/i;
 const ASSIGNMENT_SECRET_LITERAL_PATTERN =
   /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*['"][^'"]{12,}['"]/i;
 const HIGH_ENTROPY_LITERAL_PATTERN = /['"]([A-Za-z0-9+/=_-]{32,})['"]/g;
+const UUID_IDENTIFIER_PATTERN =
+  /^((?:[A-Za-z0-9]+[-_])*)?([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
+const SECRET_LABEL_PATTERN =
+  /(?:^|[-_])(?:api|auth|access|secret|token|key|password|credential|bearer|sk|pk|live)(?:[-_]|$)/i;
 
 function shannonEntropy(value: string): number {
   const counts = new Map<string, number>();
@@ -16,6 +20,13 @@ function shannonEntropy(value: string): number {
   }, 0);
 }
 
+function isNonSecretUuidIdentifier(value: string): boolean {
+  const match = UUID_IDENTIFIER_PATTERN.exec(value);
+  if (!match) return false;
+  const label = match[1] ?? '';
+  return !SECRET_LABEL_PATTERN.test(label);
+}
+
 /**
  * Returns the inline-secret findings in a string (empty if none). The throwing
  * validator below and the workflows→plays migration validator both call this so
@@ -35,6 +46,9 @@ export function collectInlineSecretFindings(sourceCode: string): string[] {
   }
   for (const match of sourceCode.matchAll(HIGH_ENTROPY_LITERAL_PATTERN)) {
     const literal = match[1] ?? '';
+    // UUID-bearing resource names are structured identifiers, not opaque
+    // credentials. Keep secret-looking labels on the conservative path.
+    if (isNonSecretUuidIdentifier(literal)) continue;
     if (literal.length >= 40 && shannonEntropy(literal) >= 4.2) {
       findings.push('high-entropy string literal');
       break;

package/dist/bundling-sources/shared_libs/plays/source-metadata.ts

@@ -0,0 +1,239 @@
+import ts from 'typescript';
+
+type SourceMetadata = {
+  name: string | null;
+  description: string | null;
+};
+
+type SourceContext = {
+  declarations: Map<string, ts.Expression>;
+  namedExports: Map<string, string>;
+  defaultExport: ts.Expression | null;
+};
+
+function unwrap(expression: ts.Expression | null): ts.Expression | null {
+  let current = expression;
+  while (current) {
+    if (
+      ts.isAsExpression(current) ||
+      ts.isSatisfiesExpression(current) ||
+      ts.isTypeAssertionExpression(current) ||
+      ts.isNonNullExpression(current) ||
+      ts.isParenthesizedExpression(current)
+    ) {
+      current = current.expression;
+      continue;
+    }
+    break;
+  }
+  return current;
+}
+
+function buildContext(sourceFile: ts.SourceFile): SourceContext {
+  const declarations = new Map<string, ts.Expression>();
+  const namedExports = new Map<string, string>();
+  let defaultExport: ts.Expression | null = null;
+
+  for (const statement of sourceFile.statements) {
+    if (ts.isVariableStatement(statement)) {
+      const exported = statement.modifiers?.some(
+        (modifier) => modifier.kind === ts.SyntaxKind.ExportKeyword,
+      );
+      const immutable = Boolean(
+        statement.declarationList.flags & ts.NodeFlags.Const,
+      );
+      for (const declaration of statement.declarationList.declarations) {
+        if (!ts.isIdentifier(declaration.name) || !declaration.initializer)
+          continue;
+        if (immutable) {
+          declarations.set(declaration.name.text, declaration.initializer);
+        }
+        if (exported) {
+          namedExports.set(declaration.name.text, declaration.name.text);
+        }
+      }
+      continue;
+    }
+    if (ts.isExportAssignment(statement) && !statement.isExportEquals) {
+      defaultExport = statement.expression;
+      continue;
+    }
+    if (!ts.isExportDeclaration(statement) || !statement.exportClause) {
+      continue;
+    }
+    if (ts.isNamedExports(statement.exportClause)) {
+      for (const element of statement.exportClause.elements) {
+        namedExports.set(
+          element.name.text,
+          element.propertyName?.text ?? element.name.text,
+        );
+      }
+    }
+  }
+  return { declarations, namedExports, defaultExport };
+}
+
+function resolveExpression(
+  expression: ts.Expression | null,
+  context: SourceContext,
+  seen = new Set<string>(),
+): ts.Expression | null {
+  const unwrapped = unwrap(expression);
+  if (!unwrapped || !ts.isIdentifier(unwrapped)) return unwrapped;
+  if (seen.has(unwrapped.text)) return null;
+  seen.add(unwrapped.text);
+  return resolveExpression(
+    context.declarations.get(unwrapped.text) ?? null,
+    context,
+    seen,
+  );
+}
+
+function staticString(
+  expression: ts.Expression | undefined,
+  context: SourceContext,
+  seen = new Set<string>(),
+  trimResult = true,
+): string | null {
+  const resolved = unwrap(expression ?? null);
+  if (
+    resolved &&
+    (ts.isStringLiteral(resolved) ||
+      ts.isNoSubstitutionTemplateLiteral(resolved))
+  ) {
+    if (!resolved.text.trim()) return null;
+    return trimResult ? resolved.text.trim() : resolved.text;
+  }
+  if (
+    resolved &&
+    ts.isBinaryExpression(resolved) &&
+    resolved.operatorToken.kind === ts.SyntaxKind.PlusToken
+  ) {
+    const left = staticString(resolved.left, context, new Set(seen), false);
+    const right = staticString(resolved.right, context, new Set(seen), false);
+    const value = left !== null && right !== null ? `${left}${right}` : null;
+    if (!value?.trim()) return null;
+    return trimResult ? value.trim() : value;
+  }
+  if (!resolved || !ts.isIdentifier(resolved) || seen.has(resolved.text)) {
+    return null;
+  }
+  seen.add(resolved.text);
+  return staticString(
+    context.declarations.get(resolved.text),
+    context,
+    seen,
+    trimResult,
+  );
+}
+
+function propertyName(name: ts.PropertyName): string | null {
+  return ts.isIdentifier(name) ||
+    ts.isStringLiteral(name) ||
+    ts.isNumericLiteral(name)
+    ? name.text
+    : null;
+}
+
+function objectStringProperty(
+  expression: ts.Expression | undefined,
+  key: string,
+  context: SourceContext,
+): string | null {
+  const resolved = resolveExpression(expression ?? null, context);
+  if (!resolved || !ts.isObjectLiteralExpression(resolved)) return null;
+  for (const property of resolved.properties) {
+    if (
+      ts.isPropertyAssignment(property) &&
+      propertyName(property.name) === key
+    ) {
+      return staticString(property.initializer, context);
+    }
+    if (
+      ts.isShorthandPropertyAssignment(property) &&
+      property.name.text === key
+    ) {
+      return staticString(property.name, context);
+    }
+  }
+  return null;
+}
+
+function isDefinePlayCall(call: ts.CallExpression): boolean {
+  const callee = unwrap(call.expression);
+  if (callee && ts.isIdentifier(callee)) {
+    return callee.text === 'definePlay' || callee.text === 'defineWorkflow';
+  }
+  return Boolean(
+    callee &&
+    ts.isPropertyAccessExpression(callee) &&
+    (callee.name.text === 'definePlay' ||
+      callee.name.text === 'defineWorkflow'),
+  );
+}
+
+function metadataFromExpression(
+  expression: ts.Expression | null,
+  context: SourceContext,
+): SourceMetadata | null {
+  const resolved = resolveExpression(expression, context);
+  if (
+    !resolved ||
+    !ts.isCallExpression(resolved) ||
+    !isDefinePlayCall(resolved)
+  ) {
+    return null;
+  }
+  const [first] = resolved.arguments;
+  const name =
+    objectStringProperty(first, 'id', context) ?? staticString(first, context);
+  let description = objectStringProperty(first, 'description', context);
+  for (
+    let index = resolved.arguments.length - 1;
+    !description && index >= 2;
+    index -= 1
+  ) {
+    description = objectStringProperty(
+      resolved.arguments[index],
+      'description',
+      context,
+    );
+  }
+  return name || description ? { name, description } : null;
+}
+
+function extractMetadata(sourceCode: string, exportName: string | null) {
+  const sourceFile = ts.createSourceFile(
+    'play.ts',
+    sourceCode,
+    ts.ScriptTarget.Latest,
+    true,
+    ts.ScriptKind.TS,
+  );
+  const context = buildContext(sourceFile);
+  const exportedExpression = exportName
+    ? exportName === 'default'
+      ? context.defaultExport
+      : (context.declarations.get(
+          context.namedExports.get(exportName) ?? exportName,
+        ) ?? null)
+    : context.defaultExport;
+  const exported = metadataFromExpression(exportedExpression, context);
+  if (exported || exportName) return exported;
+  for (const expression of context.declarations.values()) {
+    const metadata = metadataFromExpression(expression, context);
+    if (metadata) return metadata;
+  }
+  return null;
+}
+
+export function extractDefinedPlayName(sourceCode: string): string | null {
+  return extractMetadata(sourceCode, null)?.name ?? null;
+}
+
+export function extractDefinedPlayDescriptionForExport(
+  sourceCode: string,
+  exportName: string,
+): string | null {
+  return extractMetadata(sourceCode, exportName)?.description ?? null;
+}

package/dist/cli/index.js

@@ -627,10 +627,13 @@ var SDK_RELEASE = {
   // silently materializing them as unmatched results.
   // 0.1.220 deprecates SDK CLI versions below 0.1.219 and updates them
   // automatically without blocking their current command.
-  version: "0.1.239",
-  apiContract: "2026-06-dataset-handle-results-hard-cutover",
+  // 0.1.241 hard-cuts published and launched plays to immutable cjs_node20
+  // artifacts. Older clients can submit esm_workers artifacts that the Absurd
+  // runtime intentionally no longer compiles at publish or launch time.
+  version: "0.1.241",
+  apiContract: "2026-07-immutable-cjs-play-artifacts-hard-cutover",
   supportPolicy: {
-    latest: "0.1.239",
+    latest: "0.1.241",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.219",
     commandMinimumSupported: [
@@ -1371,7 +1374,7 @@ function normalizePlayRunLedgerTerminalSource(value) {
 var SECRET_REDACTION_PLACEHOLDER = "[REDACTED_SECRET]";
 var BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
 var BASIC_CREDENTIAL_RE = /\bBasic\s+[A-Za-z0-9+/]{4,}={0,2}\b/g;
-var JWT_RE = /\b[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{1,}\.[A-Za-z0-9_-]{8,}\b/g;
+var JWT_RE = /\b[A-Za-z0-9_-]{8,16384}\.[A-Za-z0-9_-]{1,16384}\.[A-Za-z0-9_-]{8,16384}\b/g;
 var PRIVATE_KEY_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
 var SENSITIVE_FIELD_NAME = "authorization|cookie|password|(?:client[_-]?)?secret|(?:access|refresh)[_-]?token|(?:x[_-]?)?api[_-]?key|private[_-]?key|token|credentials";
 var COMMON_SECRET_RE = /\b(?:[prs]k_(?:live|test)_|(?:pat|ghp|github_pat)_|xox[baprs]-)[A-Za-z0-9_./+=:-]{12,}\b/gi;
@@ -28040,6 +28043,8 @@ var PRIVATE_KEY_PATTERN = /-----BEGIN (?:RSA |EC |OPENSSH |PGP )?PRIVATE KEY----
 var BEARER_LITERAL_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/i;
 var ASSIGNMENT_SECRET_LITERAL_PATTERN = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*['"][^'"]{12,}['"]/i;
 var HIGH_ENTROPY_LITERAL_PATTERN = /['"]([A-Za-z0-9+/=_-]{32,})['"]/g;
+var UUID_IDENTIFIER_PATTERN = /^((?:[A-Za-z0-9]+[-_])*)?([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
+var SECRET_LABEL_PATTERN = /(?:^|[-_])(?:api|auth|access|secret|token|key|password|credential|bearer|sk|pk|live)(?:[-_]|$)/i;
 function shannonEntropy(value) {
   const counts = /* @__PURE__ */ new Map();
   for (const char of value) counts.set(char, (counts.get(char) ?? 0) + 1);
@@ -28048,6 +28053,12 @@ function shannonEntropy(value) {
     return entropy - p * Math.log2(p);
   }, 0);
 }
+function isNonSecretUuidIdentifier(value) {
+  const match = UUID_IDENTIFIER_PATTERN.exec(value);
+  if (!match) return false;
+  const label = match[1] ?? "";
+  return !SECRET_LABEL_PATTERN.test(label);
+}
 function collectInlineSecretFindings(sourceCode) {
   const findings = [];
   for (const match of sourceCode.matchAll(SECRET_ENV_PATTERN)) {
@@ -28061,6 +28072,7 @@ function collectInlineSecretFindings(sourceCode) {
   }
   for (const match of sourceCode.matchAll(HIGH_ENTROPY_LITERAL_PATTERN)) {
     const literal = match[1] ?? "";
+    if (isNonSecretUuidIdentifier(literal)) continue;
     if (literal.length >= 40 && shannonEntropy(literal) >= 4.2) {
       findings.push("high-entropy string literal");
       break;

package/dist/cli/index.mjs

@@ -612,10 +612,13 @@ var SDK_RELEASE = {
   // silently materializing them as unmatched results.
   // 0.1.220 deprecates SDK CLI versions below 0.1.219 and updates them
   // automatically without blocking their current command.
-  version: "0.1.239",
-  apiContract: "2026-06-dataset-handle-results-hard-cutover",
+  // 0.1.241 hard-cuts published and launched plays to immutable cjs_node20
+  // artifacts. Older clients can submit esm_workers artifacts that the Absurd
+  // runtime intentionally no longer compiles at publish or launch time.
+  version: "0.1.241",
+  apiContract: "2026-07-immutable-cjs-play-artifacts-hard-cutover",
   supportPolicy: {
-    latest: "0.1.239",
+    latest: "0.1.241",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.219",
     commandMinimumSupported: [
@@ -1356,7 +1359,7 @@ function normalizePlayRunLedgerTerminalSource(value) {
 var SECRET_REDACTION_PLACEHOLDER = "[REDACTED_SECRET]";
 var BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
 var BASIC_CREDENTIAL_RE = /\bBasic\s+[A-Za-z0-9+/]{4,}={0,2}\b/g;
-var JWT_RE = /\b[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{1,}\.[A-Za-z0-9_-]{8,}\b/g;
+var JWT_RE = /\b[A-Za-z0-9_-]{8,16384}\.[A-Za-z0-9_-]{1,16384}\.[A-Za-z0-9_-]{8,16384}\b/g;
 var PRIVATE_KEY_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
 var SENSITIVE_FIELD_NAME = "authorization|cookie|password|(?:client[_-]?)?secret|(?:access|refresh)[_-]?token|(?:x[_-]?)?api[_-]?key|private[_-]?key|token|credentials";
 var COMMON_SECRET_RE = /\b(?:[prs]k_(?:live|test)_|(?:pat|ghp|github_pat)_|xox[baprs]-)[A-Za-z0-9_./+=:-]{12,}\b/gi;
@@ -28088,6 +28091,8 @@ var PRIVATE_KEY_PATTERN = /-----BEGIN (?:RSA |EC |OPENSSH |PGP )?PRIVATE KEY----
 var BEARER_LITERAL_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/i;
 var ASSIGNMENT_SECRET_LITERAL_PATTERN = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*['"][^'"]{12,}['"]/i;
 var HIGH_ENTROPY_LITERAL_PATTERN = /['"]([A-Za-z0-9+/=_-]{32,})['"]/g;
+var UUID_IDENTIFIER_PATTERN = /^((?:[A-Za-z0-9]+[-_])*)?([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
+var SECRET_LABEL_PATTERN = /(?:^|[-_])(?:api|auth|access|secret|token|key|password|credential|bearer|sk|pk|live)(?:[-_]|$)/i;
 function shannonEntropy(value) {
   const counts = /* @__PURE__ */ new Map();
   for (const char of value) counts.set(char, (counts.get(char) ?? 0) + 1);
@@ -28096,6 +28101,12 @@ function shannonEntropy(value) {
     return entropy - p * Math.log2(p);
   }, 0);
 }
+function isNonSecretUuidIdentifier(value) {
+  const match = UUID_IDENTIFIER_PATTERN.exec(value);
+  if (!match) return false;
+  const label = match[1] ?? "";
+  return !SECRET_LABEL_PATTERN.test(label);
+}
 function collectInlineSecretFindings(sourceCode) {
   const findings = [];
   for (const match of sourceCode.matchAll(SECRET_ENV_PATTERN)) {
@@ -28109,6 +28120,7 @@ function collectInlineSecretFindings(sourceCode) {
   }
   for (const match of sourceCode.matchAll(HIGH_ENTROPY_LITERAL_PATTERN)) {
     const literal = match[1] ?? "";
+    if (isNonSecretUuidIdentifier(literal)) continue;
     if (literal.length >= 40 && shannonEntropy(literal) >= 4.2) {
       findings.push("high-entropy string literal");
       break;

package/dist/index.js

@@ -426,10 +426,13 @@ var SDK_RELEASE = {
   // silently materializing them as unmatched results.
   // 0.1.220 deprecates SDK CLI versions below 0.1.219 and updates them
   // automatically without blocking their current command.
-  version: "0.1.239",
-  apiContract: "2026-06-dataset-handle-results-hard-cutover",
+  // 0.1.241 hard-cuts published and launched plays to immutable cjs_node20
+  // artifacts. Older clients can submit esm_workers artifacts that the Absurd
+  // runtime intentionally no longer compiles at publish or launch time.
+  version: "0.1.241",
+  apiContract: "2026-07-immutable-cjs-play-artifacts-hard-cutover",
   supportPolicy: {
-    latest: "0.1.239",
+    latest: "0.1.241",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.219",
     commandMinimumSupported: [
@@ -1170,7 +1173,7 @@ function normalizePlayRunLedgerTerminalSource(value) {
 var SECRET_REDACTION_PLACEHOLDER = "[REDACTED_SECRET]";
 var BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
 var BASIC_CREDENTIAL_RE = /\bBasic\s+[A-Za-z0-9+/]{4,}={0,2}\b/g;
-var JWT_RE = /\b[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{1,}\.[A-Za-z0-9_-]{8,}\b/g;
+var JWT_RE = /\b[A-Za-z0-9_-]{8,16384}\.[A-Za-z0-9_-]{1,16384}\.[A-Za-z0-9_-]{8,16384}\b/g;
 var PRIVATE_KEY_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
 var SENSITIVE_FIELD_NAME = "authorization|cookie|password|(?:client[_-]?)?secret|(?:access|refresh)[_-]?token|(?:x[_-]?)?api[_-]?key|private[_-]?key|token|credentials";
 var COMMON_SECRET_RE = /\b(?:[prs]k_(?:live|test)_|(?:pat|ghp|github_pat)_|xox[baprs]-)[A-Za-z0-9_./+=:-]{12,}\b/gi;

package/dist/index.mjs

@@ -356,10 +356,13 @@ var SDK_RELEASE = {
   // silently materializing them as unmatched results.
   // 0.1.220 deprecates SDK CLI versions below 0.1.219 and updates them
   // automatically without blocking their current command.
-  version: "0.1.239",
-  apiContract: "2026-06-dataset-handle-results-hard-cutover",
+  // 0.1.241 hard-cuts published and launched plays to immutable cjs_node20
+  // artifacts. Older clients can submit esm_workers artifacts that the Absurd
+  // runtime intentionally no longer compiles at publish or launch time.
+  version: "0.1.241",
+  apiContract: "2026-07-immutable-cjs-play-artifacts-hard-cutover",
   supportPolicy: {
-    latest: "0.1.239",
+    latest: "0.1.241",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.219",
     commandMinimumSupported: [
@@ -1100,7 +1103,7 @@ function normalizePlayRunLedgerTerminalSource(value) {
 var SECRET_REDACTION_PLACEHOLDER = "[REDACTED_SECRET]";
 var BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
 var BASIC_CREDENTIAL_RE = /\bBasic\s+[A-Za-z0-9+/]{4,}={0,2}\b/g;
-var JWT_RE = /\b[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{1,}\.[A-Za-z0-9_-]{8,}\b/g;
+var JWT_RE = /\b[A-Za-z0-9_-]{8,16384}\.[A-Za-z0-9_-]{1,16384}\.[A-Za-z0-9_-]{8,16384}\b/g;
 var PRIVATE_KEY_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
 var SENSITIVE_FIELD_NAME = "authorization|cookie|password|(?:client[_-]?)?secret|(?:access|refresh)[_-]?token|(?:x[_-]?)?api[_-]?key|private[_-]?key|token|credentials";
 var COMMON_SECRET_RE = /\b(?:[prs]k_(?:live|test)_|(?:pat|ghp|github_pat)_|xox[baprs]-)[A-Za-z0-9_./+=:-]{12,}\b/gi;

package/dist/plays/bundle-play-file.mjs

@@ -80,6 +80,8 @@ var PRIVATE_KEY_PATTERN = /-----BEGIN (?:RSA |EC |OPENSSH |PGP )?PRIVATE KEY----
 var BEARER_LITERAL_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/i;
 var ASSIGNMENT_SECRET_LITERAL_PATTERN = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*['"][^'"]{12,}['"]/i;
 var HIGH_ENTROPY_LITERAL_PATTERN = /['"]([A-Za-z0-9+/=_-]{32,})['"]/g;
+var UUID_IDENTIFIER_PATTERN = /^((?:[A-Za-z0-9]+[-_])*)?([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
+var SECRET_LABEL_PATTERN = /(?:^|[-_])(?:api|auth|access|secret|token|key|password|credential|bearer|sk|pk|live)(?:[-_]|$)/i;
 function shannonEntropy(value) {
   const counts = /* @__PURE__ */ new Map();
   for (const char of value) counts.set(char, (counts.get(char) ?? 0) + 1);
@@ -88,6 +90,12 @@ function shannonEntropy(value) {
     return entropy - p * Math.log2(p);
   }, 0);
 }
+function isNonSecretUuidIdentifier(value) {
+  const match = UUID_IDENTIFIER_PATTERN.exec(value);
+  if (!match) return false;
+  const label = match[1] ?? "";
+  return !SECRET_LABEL_PATTERN.test(label);
+}
 function collectInlineSecretFindings(sourceCode) {
   const findings = [];
   for (const match of sourceCode.matchAll(SECRET_ENV_PATTERN)) {
@@ -101,6 +109,7 @@ function collectInlineSecretFindings(sourceCode) {
   }
   for (const match of sourceCode.matchAll(HIGH_ENTROPY_LITERAL_PATTERN)) {
     const literal = match[1] ?? "";
+    if (isNonSecretUuidIdentifier(literal)) continue;
     if (literal.length >= 40 && shannonEntropy(literal) >= 4.2) {
       findings.push("high-entropy string literal");
       break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.1.239",
+  "version": "0.1.241",
   "description": "Deepline SDK + CLI — B2B data enrichment powered by durable cloud execution",
   "license": "MIT",
   "repository": {
@@ -62,6 +62,6 @@
     "typescript": "^5.9.3"
   },
   "deepline": {
-    "apiContract": "2026-06-dataset-handle-results-hard-cutover"
+    "apiContract": "2026-07-immutable-cjs-play-artifacts-hard-cutover"
   }
 }