deepline 0.1.250 → 0.1.251

package/dist/bundling-sources/sdk/src/release.ts

@@ -113,7 +113,7 @@ export const SDK_RELEASE = {
   // runtime intentionally no longer compiles at publish or launch time.
   // 0.1.242 removes the retired Workers/ESM compiler, generated bundles, and
   // deploy-time artifact migration. Play authoring now has one CJS contract.
-  version: '0.1.250',
+  version: '0.1.251',
   apiContract: '2026-07-cjs-absurd-only-play-runtime-hard-cutover',
   supportPolicy: {
     minimumSupported: '0.1.53',

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -1542,13 +1542,17 @@ export class PlayContextImpl {
       this.#options.workflowId &&
       this.#options.runId
     ) {
-      const response = await fetch(
-        `${this.#options.baseUrl.replace(/\/$/, '')}${PLAY_RUNTIME_API_COMPAT_PATH}`,
-        {
+      const url = `${this.#options.baseUrl.replace(/\/$/, '')}${PLAY_RUNTIME_API_COMPAT_PATH}`;
+      const requestId = `ctx-secret-${crypto.randomUUID()}`;
+      const startedAt = Date.now();
+      let response: Response;
+      try {
+        response = await fetch(url, {
           method: 'POST',
           headers: {
             Authorization: `Bearer ${this.#options.executorToken}`,
             'Content-Type': 'application/json',
+            'x-deepline-request-id': requestId,
             ...(await this.vercelProtectionHeaders()),
           },
           body: JSON.stringify({
@@ -1556,11 +1560,89 @@ export class PlayContextImpl {
             name: auth.secret.name,
             playName: this.#options.playName,
           }),
-        },
-      );
-      if (response.ok) {
-        const payload = (await response.json()) as { value?: unknown };
-        value = typeof payload.value === 'string' ? payload.value : null;
+        });
+      } catch (error) {
+        const diagnostic = describeTransportError(error);
+        this.log(
+          `[runtime.secret_resolution_failure] ${JSON.stringify({
+            stage: 'transport',
+            secret_name: auth.secret.name,
+            gateway_origin: transportGatewayOriginForDiagnostic(url),
+            request_id: requestId,
+            elapsed_ms: Date.now() - startedAt,
+            error: diagnostic,
+          })}`,
+        );
+        throw new Error(
+          `Secret ${auth.secret.name} resolution transport failed (request_id=${requestId}): ${diagnostic.message ?? 'unknown transport error'}`,
+        );
+      }
+
+      const responseDiagnostic = {
+        stage: response.ok ? 'invalid_response' : 'http_response',
+        secret_name: auth.secret.name,
+        gateway_origin: transportGatewayOriginForDiagnostic(url),
+        request_id: requestId,
+        elapsed_ms: Date.now() - startedAt,
+        http_status: response.status,
+        status_text: response.statusText || null,
+        content_type: response.headers.get('content-type'),
+        server: response.headers.get('server'),
+        vercel_request_id:
+          response.headers.get('x-vercel-id') ??
+          response.headers.get('x-vercel-request-id'),
+        response_request_id: response.headers.get('x-deepline-request-id'),
+        error_code: response.headers.get('x-deepline-error-code'),
+        retry_after: response.headers.get('retry-after'),
+      };
+      if (!response.ok) {
+        this.log(
+          `[runtime.secret_resolution_failure] ${JSON.stringify(responseDiagnostic)}`,
+        );
+        throw new Error(
+          `Secret ${auth.secret.name} is not available to this run (resolution status=${response.status}, request_id=${requestId}).`,
+        );
+      }
+
+      let payload: unknown;
+      try {
+        payload = await response.json();
+      } catch (error) {
+        this.log(
+          `[runtime.secret_resolution_failure] ${JSON.stringify({
+            ...responseDiagnostic,
+            response_kind: 'invalid_json',
+            parse_error_name:
+              error instanceof Error ? error.name : typeof error,
+          })}`,
+        );
+        throw new Error(
+          `Secret ${auth.secret.name} is not available to this run (invalid resolution response, request_id=${requestId}).`,
+        );
+      }
+
+      value =
+        payload &&
+        typeof payload === 'object' &&
+        !Array.isArray(payload) &&
+        typeof (payload as { value?: unknown }).value === 'string'
+          ? (payload as { value: string }).value
+          : null;
+      if (!value) {
+        this.log(
+          `[runtime.secret_resolution_failure] ${JSON.stringify({
+            ...responseDiagnostic,
+            response_kind:
+              payload === null
+                ? 'null'
+                : Array.isArray(payload)
+                  ? 'array'
+                  : typeof payload,
+          })}`,
+        );
+        throw new Error(
+          `Secret ${auth.secret.name} is not available to this run (missing resolution value, request_id=${requestId}).`,
+        );
       }
     } else {
       throw new Error(

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/backends/daytona.ts

@@ -53,6 +53,13 @@ const RUNTIME_RECEIPT_GATEWAY_TRANSPORT_RETRY_PATTERN =
   /AppRuntimeApiTransportError: App runtime API transport exhausted action=(?:get|claim|mark|complete|fail|heartbeat|release|skip)_runtime_step_receipts?/i;
 const RUNTIME_API_TRANSPORT_RETRY_PATTERN =
   /\bRuntime API request to .+ failed before receiving a response:\s*(?:fetch failed|connection (?:terminated|timed out|closed|reset)|ECONNRESET|ETIMEDOUT|ECONNREFUSED)\b/i;
+// The ready fence precedes customer play execution. A failed detached start is
+// safe to retry only when the runner never wrote its ready marker or attempted
+// the start acknowledgement, and Daytona has no exit evidence. This covers a
+// transient Daytona control-plane blind spot where the accepted command cannot
+// be inspected, while keeping post-start and crash failures terminal.
+const RUNTIME_SANDBOX_UNSTARTED_RETRY_PATTERN =
+  /DaytonaRunnerInitializationError:\s*RUNTIME_SANDBOX_START_FAILED[\s\S]*Marker diagnosis:\s*ready_marker_unavailable[\s\S]*"readyMarkerObserved"\s*:\s*false[\s\S]*"startAcknowledgementAttempted"\s*:\s*false[\s\S]*"exitCode"\s*:\s*null[\s\S]*"exitCodeFile"\s*:\s*null/i;
 const DAYTONA_INFRASTRUCTURE_RETRY_PATTERN =
   /\b(?:Request failed with status code (?:408|429|500|502|503|504)|ECONNRESET|ECONNREFUSED|ETIMEDOUT|UND_ERR_CONNECT_TIMEOUT|fetch failed|socket hang up|Daytona sandbox create failed across|Daytona sandbox create did not complete)\b/i;
 
@@ -446,6 +453,7 @@ export function retryableRuntimeInitializationFailureReason(
   | 'runtime_postgres_connect'
   | 'runtime_api_transport'
   | 'runtime_receipt_gateway_transport'
+  | 'runtime_sandbox_unstarted'
   | null {
   if (result.status !== 'failed') return null;
   if (RUNTIME_POSTGRES_CONNECT_RETRY_PATTERN.test(result.error)) {
@@ -455,6 +463,13 @@ export function retryableRuntimeInitializationFailureReason(
     return 'runtime_receipt_gateway_transport';
   }
   const rowsProcessed = Number(result.stats?.rowsProcessed ?? 0);
+  if (
+    rowsProcessed === 0 &&
+    result.steps.length === 0 &&
+    RUNTIME_SANDBOX_UNSTARTED_RETRY_PATTERN.test(result.error)
+  ) {
+    return 'runtime_sandbox_unstarted';
+  }
   if (
     rowsProcessed === 0 &&
     result.steps.length === 0 &&

package/dist/cli/index.js

@@ -632,7 +632,7 @@ var SDK_RELEASE = {
   // runtime intentionally no longer compiles at publish or launch time.
   // 0.1.242 removes the retired Workers/ESM compiler, generated bundles, and
   // deploy-time artifact migration. Play authoring now has one CJS contract.
-  version: "0.1.250",
+  version: "0.1.251",
   apiContract: "2026-07-cjs-absurd-only-play-runtime-hard-cutover",
   supportPolicy: {
     minimumSupported: "0.1.53",
@@ -24450,7 +24450,7 @@ function renderAvailableToolsText(payload) {
   const returned = asFiniteNumber(payload.returned) ?? tools.length;
   const total = asFiniteNumber(payload.total);
   const lines = [
-    total !== void 0 ? `Signal Radar types you can deploy (${returned} of ${total}):` : "Signal Radar types you can deploy:"
+    total !== void 0 ? `Monitor types you can deploy (${returned} of ${total}):` : "Monitor types you can deploy:"
   ];
   let currentProvider;
   for (const raw of tools) {
@@ -24485,7 +24485,7 @@ function renderAvailableToolsText(payload) {
     "  See monitors already deployed in this workspace:",
     "    deepline monitors list",
     "  Validate a monitor definition before deploying:",
-    `    deepline monitors check '{"key":"my-radar","tool":"<provider.tool>","payload":{...}}'`
+    `    deepline monitors check '{"key":"my-monitor","tool":"<provider.tool>","payload":{...}}'`
   );
   return `${lines.join("\n")}
 `;
@@ -24789,7 +24789,7 @@ Examples:
   deepline monitors deploy --file monitor.json
   deepline monitors list --status all --json
   deepline monitors get my-monitor --json
-  deepline monitors update my-monitor '{"controls":{"enabled":false}}' --json
+  deepline monitors update my-monitor '{"name":"Interested replies"}' --json
   deepline monitors delete my-monitor --dry-run
   deepline monitors reactivate my-monitor --dry-run
 `
@@ -24879,8 +24879,8 @@ Examples:
       `
 Notes:
   Read-only validation. <definition> is a JSON object with key, tool, payload,
-  and optional controls (Deepline lifecycle metadata, e.g.
-  "controls":{"enabled":false}). Pass it positionally, via --file <path>, or
+  and optional controls (Deepline lifecycle metadata). Pass it positionally,
+  via --file <path>, or
   from stdin with --file -. Does not deploy or spend credits.
 
 Examples:
@@ -24899,9 +24899,8 @@ Examples:
       `
 Notes:
   Mutates workspace state and may spend Deepline credits. <definition> is a JSON
-  object with key, tool, payload, and optional controls (e.g.
-  "controls":{"enabled":false}). Pass it positionally, via --file <path>, or
-  from stdin with --file -.
+  object with key, tool, payload, and optional controls. Pass it positionally,
+  via --file <path>, or from stdin with --file -.
   --dry-run validates the definition and shows the plan (deploy cost in Deepline
   credits when the server reports it, plus any existing monitors that may
   already cover this scope) WITHOUT deploying. Exits 0 when valid, 7 when not.
@@ -24924,12 +24923,11 @@ Examples:
       "after",
       `
 Notes:
-  Mutates workspace state. <patch> is a JSON object of fields to update, e.g.
-  '{"controls":{"enabled":false}}' to disable a monitor. Pass it positionally,
-  via --file <path>, or from stdin with --file -.
+  Mutates workspace state. <patch> is a JSON object of fields to update. Pass it
+  positionally, via --file <path>, or from stdin with --file -.
 
 Examples:
-  deepline monitors update my-monitor '{"controls":{"enabled":false}}' --json
+  deepline monitors update my-monitor '{"name":"Interested replies"}' --json
   deepline monitors update my-monitor --file patch.json
 `
     ).option(

package/dist/cli/index.mjs

@@ -617,7 +617,7 @@ var SDK_RELEASE = {
   // runtime intentionally no longer compiles at publish or launch time.
   // 0.1.242 removes the retired Workers/ESM compiler, generated bundles, and
   // deploy-time artifact migration. Play authoring now has one CJS contract.
-  version: "0.1.250",
+  version: "0.1.251",
   apiContract: "2026-07-cjs-absurd-only-play-runtime-hard-cutover",
   supportPolicy: {
     minimumSupported: "0.1.53",
@@ -24486,7 +24486,7 @@ function renderAvailableToolsText(payload) {
   const returned = asFiniteNumber(payload.returned) ?? tools.length;
   const total = asFiniteNumber(payload.total);
   const lines = [
-    total !== void 0 ? `Signal Radar types you can deploy (${returned} of ${total}):` : "Signal Radar types you can deploy:"
+    total !== void 0 ? `Monitor types you can deploy (${returned} of ${total}):` : "Monitor types you can deploy:"
   ];
   let currentProvider;
   for (const raw of tools) {
@@ -24521,7 +24521,7 @@ function renderAvailableToolsText(payload) {
     "  See monitors already deployed in this workspace:",
     "    deepline monitors list",
     "  Validate a monitor definition before deploying:",
-    `    deepline monitors check '{"key":"my-radar","tool":"<provider.tool>","payload":{...}}'`
+    `    deepline monitors check '{"key":"my-monitor","tool":"<provider.tool>","payload":{...}}'`
   );
   return `${lines.join("\n")}
 `;
@@ -24825,7 +24825,7 @@ Examples:
   deepline monitors deploy --file monitor.json
   deepline monitors list --status all --json
   deepline monitors get my-monitor --json
-  deepline monitors update my-monitor '{"controls":{"enabled":false}}' --json
+  deepline monitors update my-monitor '{"name":"Interested replies"}' --json
   deepline monitors delete my-monitor --dry-run
   deepline monitors reactivate my-monitor --dry-run
 `
@@ -24915,8 +24915,8 @@ Examples:
       `
 Notes:
   Read-only validation. <definition> is a JSON object with key, tool, payload,
-  and optional controls (Deepline lifecycle metadata, e.g.
-  "controls":{"enabled":false}). Pass it positionally, via --file <path>, or
+  and optional controls (Deepline lifecycle metadata). Pass it positionally,
+  via --file <path>, or
   from stdin with --file -. Does not deploy or spend credits.
 
 Examples:
@@ -24935,9 +24935,8 @@ Examples:
       `
 Notes:
   Mutates workspace state and may spend Deepline credits. <definition> is a JSON
-  object with key, tool, payload, and optional controls (e.g.
-  "controls":{"enabled":false}). Pass it positionally, via --file <path>, or
-  from stdin with --file -.
+  object with key, tool, payload, and optional controls. Pass it positionally,
+  via --file <path>, or from stdin with --file -.
   --dry-run validates the definition and shows the plan (deploy cost in Deepline
   credits when the server reports it, plus any existing monitors that may
   already cover this scope) WITHOUT deploying. Exits 0 when valid, 7 when not.
@@ -24960,12 +24959,11 @@ Examples:
       "after",
       `
 Notes:
-  Mutates workspace state. <patch> is a JSON object of fields to update, e.g.
-  '{"controls":{"enabled":false}}' to disable a monitor. Pass it positionally,
-  via --file <path>, or from stdin with --file -.
+  Mutates workspace state. <patch> is a JSON object of fields to update. Pass it
+  positionally, via --file <path>, or from stdin with --file -.
 
 Examples:
-  deepline monitors update my-monitor '{"controls":{"enabled":false}}' --json
+  deepline monitors update my-monitor '{"name":"Interested replies"}' --json
   deepline monitors update my-monitor --file patch.json
 `
     ).option(

package/dist/index.js

@@ -431,7 +431,7 @@ var SDK_RELEASE = {
   // runtime intentionally no longer compiles at publish or launch time.
   // 0.1.242 removes the retired Workers/ESM compiler, generated bundles, and
   // deploy-time artifact migration. Play authoring now has one CJS contract.
-  version: "0.1.250",
+  version: "0.1.251",
   apiContract: "2026-07-cjs-absurd-only-play-runtime-hard-cutover",
   supportPolicy: {
     minimumSupported: "0.1.53",

package/dist/index.mjs

@@ -361,7 +361,7 @@ var SDK_RELEASE = {
   // runtime intentionally no longer compiles at publish or launch time.
   // 0.1.242 removes the retired Workers/ESM compiler, generated bundles, and
   // deploy-time artifact migration. Play authoring now has one CJS contract.
-  version: "0.1.250",
+  version: "0.1.251",
   apiContract: "2026-07-cjs-absurd-only-play-runtime-hard-cutover",
   supportPolicy: {
     minimumSupported: "0.1.53",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.1.250",
+  "version": "0.1.251",
   "description": "Deepline SDK + CLI — B2B data enrichment powered by durable cloud execution",
   "license": "MIT",
   "repository": {