deepline 0.1.246 → 0.1.248

package/dist/bundling-sources/sdk/src/release.ts

@@ -113,7 +113,7 @@ export const SDK_RELEASE = {
   // runtime intentionally no longer compiles at publish or launch time.
   // 0.1.242 removes the retired Workers/ESM compiler, generated bundles, and
   // deploy-time artifact migration. Play authoring now has one CJS contract.
-  version: '0.1.246',
+  version: '0.1.248',
   apiContract: '2026-07-cjs-absurd-only-play-runtime-hard-cutover',
   supportPolicy: {
     minimumSupported: '0.1.53',

package/dist/bundling-sources/shared_libs/play-runtime/ctx-types.ts

@@ -514,7 +514,7 @@ export interface ContextOptions {
    * Runtime-sheet transport selected by the runner. Daytona sandboxes use the
    * execution gateway and must never fall back to minting direct DB sessions.
    */
-  dbSessionStrategy?: 'preloaded' | 'sandbox_public_key' | 'gateway_only';
+  dbSessionStrategy?: 'preloaded' | 'gateway_only' | 'trusted_dynamic';
   vercelProtectionBypassToken?: string | null;
   /** Optional per-run integration execution mode for provider calls. */
   integrationMode?: 'live' | 'eval_stub' | 'fixture';

package/dist/bundling-sources/shared_libs/play-runtime/db-session-plan.ts

@@ -1,9 +1,10 @@
 import {
-  flattenStaticPipeline,
-  resolveSheetContractForTableNamespace,
+  getCompiledPipelineSubsteps,
   type PlaySheetContract,
   type PlayStaticPipeline,
+  type PlayStaticSubstep,
 } from '../plays/static-pipeline';
+import { normalizeTableNamespace } from '../plays/row-identity';
 import {
   RUNTIME_SHEET_ROWS_LOGICAL_TABLE,
   RUNTIME_WORK_RECEIPT_LOGICAL_TABLE,
@@ -21,27 +22,143 @@ export type RuntimeDbSessionRequirement = {
   sheetContract?: PlaySheetContract | null;
 };
 
-export function planRuntimeSheetDbSessionRequirements(
+export type RuntimeSheetDbSessionPlanInspection = {
+  datasetCount: number;
+  datasetNamespaces: string[];
+  plannedNamespaces: string[];
+  errors: string[];
+};
+
+type DatasetSessionContract = {
+  tableNamespace: string;
+  sheetContract: PlaySheetContract | null;
+  error?: string;
+};
+
+function currentExecutionScopeSubsteps(
+  substeps: readonly PlayStaticSubstep[],
+): PlayStaticSubstep[] {
+  const flattened: PlayStaticSubstep[] = [];
+  for (const substep of substeps) {
+    flattened.push(substep);
+    if (
+      (substep.type === 'dataset' ||
+        substep.type === 'step_suite' ||
+        substep.type === 'control_flow') &&
+      substep.steps?.length
+    ) {
+      flattened.push(...currentExecutionScopeSubsteps(substep.steps));
+    }
+    // A child play with a dataset owns a separate run and session scope. Its
+    // nested pipeline must never reserve a table under the parent play token.
+  }
+  return flattened;
+}
+
+function datasetSessionContracts(
   pipeline: PlayStaticPipeline | null,
-): RuntimeDbSessionRequirement[] {
-  if (!pipeline) {
-    return [];
+): DatasetSessionContract[] {
+  if (!pipeline) return [];
+  const rootNamespace = pipeline.tableNamespace?.trim();
+  let normalizedRootNamespace: string | null = null;
+  if (rootNamespace) {
+    try {
+      normalizedRootNamespace = normalizeTableNamespace(rootNamespace);
+    } catch {
+      normalizedRootNamespace = null;
+    }
   }
-  const byNamespace = new Map<string, PlaySheetContract>();
-  for (const substep of flattenStaticPipeline(pipeline)) {
-    if (substep.type !== 'dataset') continue;
-    const tableNamespace = (
-      substep.tableNamespace ??
-      substep.field ??
-      ''
-    ).trim();
-    if (!tableNamespace) continue;
+  const rootContract = pipeline.sheetContract ?? null;
+  return currentExecutionScopeSubsteps(
+    getCompiledPipelineSubsteps(pipeline),
+  ).flatMap<DatasetSessionContract>((substep): DatasetSessionContract[] => {
+    if (substep.type !== 'dataset') return [];
+    const rawNamespace = (substep.tableNamespace ?? substep.field ?? '').trim();
+    if (!rawNamespace) {
+      return [{ tableNamespace: '', sheetContract: null }];
+    }
+    let tableNamespace: string;
+    try {
+      tableNamespace = normalizeTableNamespace(rawNamespace);
+    } catch (error) {
+      return [
+        {
+          tableNamespace: rawNamespace,
+          sheetContract: null,
+          error: error instanceof Error ? error.message : String(error),
+        },
+      ];
+    }
     const sheetContract =
-      resolveSheetContractForTableNamespace(pipeline, tableNamespace) ??
       substep.sheetContract ??
-      null;
-    if (!sheetContract) continue;
-    byNamespace.set(tableNamespace, sheetContract);
+      (normalizedRootNamespace === tableNamespace ? rootContract : null);
+    return [{ tableNamespace, sheetContract }];
+  });
+}
+
+export function inspectRuntimeSheetDbSessionPlan(
+  pipeline: PlayStaticPipeline | null,
+): RuntimeSheetDbSessionPlanInspection {
+  const datasets = datasetSessionContracts(pipeline);
+  const datasetNamespaces: string[] = [];
+  const plannedNamespaces: string[] = [];
+  const errors = [...(pipeline?.sheetContractErrors ?? [])];
+  const seen = new Set<string>();
+  for (const dataset of datasets) {
+    if (dataset.error) {
+      errors.push(dataset.error);
+      continue;
+    }
+    if (!dataset.tableNamespace) {
+      errors.push('Dataset is missing a Runtime Sheet namespace.');
+      continue;
+    }
+    datasetNamespaces.push(dataset.tableNamespace);
+    if (seen.has(dataset.tableNamespace)) {
+      errors.push(
+        `Dataset "${dataset.tableNamespace}" is declared more than once in the same play execution scope.`,
+      );
+      continue;
+    }
+    seen.add(dataset.tableNamespace);
+    if (!dataset.sheetContract) {
+      errors.push(
+        `Dataset "${dataset.tableNamespace}" is missing a compiled Runtime Sheet contract.`,
+      );
+      continue;
+    }
+    let contractNamespace: string;
+    try {
+      contractNamespace = normalizeTableNamespace(
+        dataset.sheetContract.tableNamespace,
+      );
+    } catch (error) {
+      errors.push(error instanceof Error ? error.message : String(error));
+      continue;
+    }
+    if (contractNamespace !== dataset.tableNamespace) {
+      errors.push(
+        `Dataset "${dataset.tableNamespace}" has a Runtime Sheet contract for "${contractNamespace}".`,
+      );
+      continue;
+    }
+    plannedNamespaces.push(dataset.tableNamespace);
+  }
+  return {
+    datasetCount: datasets.length,
+    datasetNamespaces,
+    plannedNamespaces,
+    errors,
+  };
+}
+
+export function planRuntimeSheetDbSessionRequirements(
+  pipeline: PlayStaticPipeline | null,
+): RuntimeDbSessionRequirement[] {
+  const byNamespace = new Map<string, PlaySheetContract>();
+  for (const dataset of datasetSessionContracts(pipeline)) {
+    if (!dataset.tableNamespace || !dataset.sheetContract) continue;
+    byNamespace.set(dataset.tableNamespace, dataset.sheetContract);
   }
   return [...byNamespace.entries()].map(([tableNamespace, sheetContract]) => ({
     tableNamespace,

package/dist/bundling-sources/shared_libs/play-runtime/protocol.ts

@@ -111,15 +111,13 @@ export interface PlayRunnerContextConfig {
   /**
    * Controls how scoped Postgres sessions enter the runner. `preloaded` means
    * the launch config carries short-lived encrypted sessions minted before
-   * dispatch; `sandbox_public_key` means the runner mints missing sessions
-   * through the app runtime API with a per-request public key.
+   * dispatch. Daytona sandboxes never mint direct database sessions.
    */
-  dbSessionStrategy?: 'preloaded' | 'sandbox_public_key' | 'gateway_only';
+  dbSessionStrategy?: 'preloaded' | 'gateway_only' | 'trusted_dynamic';
   /**
    * Short-lived scoped Postgres sessions minted by the worker before the runner
-   * starts. They are only an initial fast path: the runner still renews through
-   * the app runtime API when a session is absent, too close to expiry, or not an
-   * exact-enough match for the requested play/table/operation scope.
+   * starts. A missing or mismatched session is a fatal launch-contract error;
+   * an external attempt token can never mint a replacement.
    */
   preloadedDbSessions?: PreloadedRuntimeDbSession[];
   /**

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/backends/daytona-payload-transport.ts

@@ -247,6 +247,7 @@ function remoteRuntimeContextForDaytona(
     vercelProtectionBypassToken: null,
     dbSessionStrategy: 'gateway_only',
     preloadedDbSessions: undefined,
+    postgresSessionUnwrapKey: undefined,
   };
 }
 

package/dist/bundling-sources/shared_libs/play-runtime/runtime-api.ts

@@ -121,11 +121,7 @@ type RuntimeApiContext = {
   runId?: string | null;
   userEmail?: string | null;
   integrationMode?: 'live' | 'eval_stub' | 'fixture' | null;
-  dbSessionStrategy?:
-    | 'preloaded'
-    | 'sandbox_public_key'
-    | 'gateway_only'
-    | null;
+  dbSessionStrategy?: 'preloaded' | 'gateway_only' | 'trusted_dynamic' | null;
   preloadedDbSessions?: PreloadedRuntimeDbSession[] | null;
   vercelProtectionBypassToken?: string | null;
   runtimeTestFaultHeader?: string | null;
@@ -1147,9 +1143,6 @@ function findPreloadedRuntimeDbSession(
     limits?: DbSessionLimits;
   },
 ): CreateDbSessionResponse | null {
-  if (context.dbSessionStrategy === 'sandbox_public_key') {
-    return null;
-  }
   const preloadedSessions = context.preloadedDbSessions ?? [];
   if (preloadedSessions.length === 0) {
     return null;
@@ -1289,6 +1282,12 @@ async function getRuntimeDbSession(
       return unwrappedPreloaded;
     }
 
+    if (context.dbSessionStrategy !== 'trusted_dynamic') {
+      throw new Error(
+        `RUNTIME_DB_SESSION_PRELOAD_INCOMPLETE: no preloaded Runtime DB session matches play=${context.playName} table=${normalizeTableNamespace(input.tableNamespace)} logical_table=${input.logicalTable}. Dynamic database authority requires an explicit trusted control-plane context.`,
+      );
+    }
+
     if (shouldEnsureRuntimeSheetBeforeSession(input)) {
       await ensureRuntimeSheet(context, {
         playName: context.playName,
@@ -1386,9 +1385,6 @@ function runtimeDbSessionRowLimit(rowCount: number): number {
 export async function prewarmRuntimePostgresSessions(
   context: RuntimeApiContext,
 ): Promise<void> {
-  if (context.dbSessionStrategy === 'sandbox_public_key') {
-    return;
-  }
   const sessions = context.preloadedDbSessions ?? [];
   if (sessions.length === 0) {
     return;

package/dist/bundling-sources/shared_libs/plays/static-pipeline.ts

@@ -166,14 +166,74 @@ export function ensureCompiledSheetContract(
   if (!pipeline) {
     return pipeline;
   }
-  if (pipeline.sheetContract) {
-    return pipeline;
-  }
-  const compiled = compileSheetContract(pipeline);
-  return {
+  const datasetErrors: string[] = [];
+  const compileDatasetSubsteps = (
+    substeps: PlayStaticSubstep[],
+  ): PlayStaticSubstep[] =>
+    substeps.map((substep) => {
+      if (substep.type === 'play_call' && substep.pipeline) {
+        return {
+          ...substep,
+          pipeline: ensureCompiledSheetContract(substep.pipeline) ?? null,
+        };
+      }
+      if (
+        substep.type !== 'dataset' &&
+        substep.type !== 'step_suite' &&
+        substep.type !== 'control_flow'
+      ) {
+        return substep;
+      }
+      const steps = substep.steps?.length
+        ? compileDatasetSubsteps(substep.steps)
+        : (substep.steps ?? []);
+      if (substep.type !== 'dataset' || substep.sheetContract) {
+        return { ...substep, steps } as PlayStaticSubstep;
+      }
+      const tableNamespace = (substep.tableNamespace ?? substep.field).trim();
+      const compiledDataset = compileSheetContract({
+        tableNamespace,
+        inputFields: substep.inputFields,
+        rowKeyFields: substep.rowKeyFields,
+        fields:
+          substep.outputFields ??
+          substep.columns?.map((column) => column.id) ??
+          [],
+        substeps: steps,
+      });
+      datasetErrors.push(
+        ...compiledDataset.errors.map(
+          (error) => `Dataset "${tableNamespace}": ${error}`,
+        ),
+      );
+      return {
+        ...substep,
+        steps,
+        sheetContract: compiledDataset.contract,
+      };
+    });
+  const withDatasetContracts: PlayStaticPipeline = {
     ...pipeline,
+    ...(pipeline.stages
+      ? { stages: compileDatasetSubsteps(pipeline.stages) }
+      : {}),
+    // Stored legacy rows can predate the required static-pipeline arrays.
+    // Preserve the missing field so compileSheetContract reports it instead
+    // of crashing or silently normalizing malformed persisted data.
+    ...(Array.isArray(pipeline.substeps)
+      ? { substeps: compileDatasetSubsteps(pipeline.substeps) }
+      : {}),
+  };
+  const compiled = pipeline.sheetContract
+    ? {
+        contract: pipeline.sheetContract,
+        errors: [...(pipeline.sheetContractErrors ?? [])],
+      }
+    : compileSheetContract(withDatasetContracts);
+  return {
+    ...withDatasetContracts,
     sheetContract: compiled.contract,
-    sheetContractErrors: compiled.errors,
+    sheetContractErrors: [...compiled.errors, ...datasetErrors],
   };
 }
 
@@ -483,6 +543,16 @@ export function truncateStaticPipelineForStorage(
   );
 }
 
+export function truncateStaticPipelineForRuntimeContract(
+  pipeline: PlayStaticPipeline | null | undefined,
+): PlayStaticPipeline | null | undefined {
+  return truncateStaticPipelineForStorage(pipeline, {
+    // Runtime admission must preserve every dataset contract. The caller's
+    // serialized artifact-size budget is the bound; a UI depth cap is not.
+    maxStoredSubstepDepth: Number.POSITIVE_INFINITY,
+  });
+}
+
 export interface PlayStaticSourceRange {
   sourcePath?: string;
   startLine: number;

package/dist/cli/index.js

@@ -632,7 +632,7 @@ var SDK_RELEASE = {
   // runtime intentionally no longer compiles at publish or launch time.
   // 0.1.242 removes the retired Workers/ESM compiler, generated bundles, and
   // deploy-time artifact migration. Play authoring now has one CJS contract.
-  version: "0.1.246",
+  version: "0.1.248",
   apiContract: "2026-07-cjs-absurd-only-play-runtime-hard-cutover",
   supportPolicy: {
     minimumSupported: "0.1.53",
@@ -24350,42 +24350,24 @@ function renderAvailableToolsText(payload) {
   const returned = asFiniteNumber(payload.returned) ?? tools.length;
   const total = asFiniteNumber(payload.total);
   const lines = [
-    total !== void 0 ? `Signal Radar types you can deploy (${returned} of ${total}):` : "Signal Radar types you can deploy:"
+    total !== void 0 ? `Monitor tools you can deploy (${returned} of ${total}):` : "Monitor tools you can deploy:"
   ];
-  let currentProvider;
   for (const raw of tools) {
     const entry = asRecord(raw);
     const id = entry ? asString(entry.tool) : void 0;
     if (!entry || !id) continue;
     const name = asString(entry.name) ?? asString(entry.display_name);
     const deployedCount = asFiniteNumber(entry.deployed_count);
-    const description = asString(entry.description);
-    const streams = Array.isArray(entry.streams) ? entry.streams.map((stream) => asString(stream)).filter((stream) => Boolean(stream)) : [];
-    const provider = id.split(".")[0];
-    if (provider && provider !== currentProvider) {
-      currentProvider = provider;
-      lines.push("", `  ${provider}:`);
-    }
     lines.push(
-      `    ${id.split(".").slice(1).join(".") || id}${name ? ` \u2014 ${name}` : ""}${deployedCount !== void 0 ? `  (${deployedCount} deployed)` : ""}`
+      `  ${id}${name ? ` \u2014 ${name}` : ""}${deployedCount !== void 0 ? `  (deployed: ${deployedCount})` : ""}`
     );
-    if (description) lines.push(`      ${description}`);
-    if (streams.length > 0) {
-      lines.push(`      emits: ${streams.join(", ")}`);
-    }
   }
   if (payload.is_truncated === true) {
     lines.push("List truncated; raise --limit to see more.");
   }
   lines.push(
     "",
-    "Next:",
-    "  Inspect payload fields, output columns, and a play binding:",
-    "    deepline monitors available <provider.tool> --json",
-    "  See monitors already deployed in this workspace:",
-    "    deepline monitors list",
-    "  Validate a monitor definition before deploying:",
-    `    deepline monitors check '{"key":"my-radar","tool":"<provider.tool>","payload":{...}}'`
+    "Describe one (payload schema + output streams): deepline monitors available <tool-id> --json"
   );
   return `${lines.join("\n")}
 `;

package/dist/cli/index.mjs

@@ -617,7 +617,7 @@ var SDK_RELEASE = {
   // runtime intentionally no longer compiles at publish or launch time.
   // 0.1.242 removes the retired Workers/ESM compiler, generated bundles, and
   // deploy-time artifact migration. Play authoring now has one CJS contract.
-  version: "0.1.246",
+  version: "0.1.248",
   apiContract: "2026-07-cjs-absurd-only-play-runtime-hard-cutover",
   supportPolicy: {
     minimumSupported: "0.1.53",
@@ -24386,42 +24386,24 @@ function renderAvailableToolsText(payload) {
   const returned = asFiniteNumber(payload.returned) ?? tools.length;
   const total = asFiniteNumber(payload.total);
   const lines = [
-    total !== void 0 ? `Signal Radar types you can deploy (${returned} of ${total}):` : "Signal Radar types you can deploy:"
+    total !== void 0 ? `Monitor tools you can deploy (${returned} of ${total}):` : "Monitor tools you can deploy:"
   ];
-  let currentProvider;
   for (const raw of tools) {
     const entry = asRecord(raw);
     const id = entry ? asString(entry.tool) : void 0;
     if (!entry || !id) continue;
     const name = asString(entry.name) ?? asString(entry.display_name);
     const deployedCount = asFiniteNumber(entry.deployed_count);
-    const description = asString(entry.description);
-    const streams = Array.isArray(entry.streams) ? entry.streams.map((stream) => asString(stream)).filter((stream) => Boolean(stream)) : [];
-    const provider = id.split(".")[0];
-    if (provider && provider !== currentProvider) {
-      currentProvider = provider;
-      lines.push("", `  ${provider}:`);
-    }
     lines.push(
-      `    ${id.split(".").slice(1).join(".") || id}${name ? ` \u2014 ${name}` : ""}${deployedCount !== void 0 ? `  (${deployedCount} deployed)` : ""}`
+      `  ${id}${name ? ` \u2014 ${name}` : ""}${deployedCount !== void 0 ? `  (deployed: ${deployedCount})` : ""}`
     );
-    if (description) lines.push(`      ${description}`);
-    if (streams.length > 0) {
-      lines.push(`      emits: ${streams.join(", ")}`);
-    }
   }
   if (payload.is_truncated === true) {
     lines.push("List truncated; raise --limit to see more.");
   }
   lines.push(
     "",
-    "Next:",
-    "  Inspect payload fields, output columns, and a play binding:",
-    "    deepline monitors available <provider.tool> --json",
-    "  See monitors already deployed in this workspace:",
-    "    deepline monitors list",
-    "  Validate a monitor definition before deploying:",
-    `    deepline monitors check '{"key":"my-radar","tool":"<provider.tool>","payload":{...}}'`
+    "Describe one (payload schema + output streams): deepline monitors available <tool-id> --json"
   );
   return `${lines.join("\n")}
 `;

package/dist/index.js

@@ -431,7 +431,7 @@ var SDK_RELEASE = {
   // runtime intentionally no longer compiles at publish or launch time.
   // 0.1.242 removes the retired Workers/ESM compiler, generated bundles, and
   // deploy-time artifact migration. Play authoring now has one CJS contract.
-  version: "0.1.246",
+  version: "0.1.248",
   apiContract: "2026-07-cjs-absurd-only-play-runtime-hard-cutover",
   supportPolicy: {
     minimumSupported: "0.1.53",

package/dist/index.mjs

@@ -361,7 +361,7 @@ var SDK_RELEASE = {
   // runtime intentionally no longer compiles at publish or launch time.
   // 0.1.242 removes the retired Workers/ESM compiler, generated bundles, and
   // deploy-time artifact migration. Play authoring now has one CJS contract.
-  version: "0.1.246",
+  version: "0.1.248",
   apiContract: "2026-07-cjs-absurd-only-play-runtime-hard-cutover",
   supportPolicy: {
     minimumSupported: "0.1.53",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.1.246",
+  "version": "0.1.248",
   "description": "Deepline SDK + CLI — B2B data enrichment powered by durable cloud execution",
   "license": "MIT",
   "repository": {