deepline 0.1.252 → 0.1.253

package/dist/bundling-sources/sdk/src/release.ts

@@ -116,7 +116,7 @@ export const SDK_RELEASE = {
   // 0.1.252 hard-cuts the customer Monitor catalog to the two launched
   // Deepline-native radars. Older clients must update before discovering,
   // checking, or deploying an unlaunched monitor integration.
-  version: '0.1.252',
+  version: '0.1.253',
   apiContract: '2026-07-native-monitor-launch-hard-cutover',
   supportPolicy: {
     minimumSupported: '0.1.53',

package/dist/bundling-sources/sdk/src/types.ts

@@ -551,6 +551,8 @@ export interface PlayRunPackage {
     durationMs?: number | null;
     error?: string;
   };
+  /** Bounded customer-safe warnings about output projection or availability. */
+  warnings?: string[];
   /** Step-level summaries emitted by the runtime. */
   steps: Array<Record<string, unknown>>;
   /** Named output summaries, including dataset handles and scalar outputs. */

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -8282,9 +8282,9 @@ export class PlayContextImpl {
     const url = `${this.#options.baseUrl}/api/v2/integrations/${encodeURIComponent(toolId)}/execute`;
     const timeoutMs = resolveToolRuntimeTimeoutMs(toolId, options?.timeoutMs);
 
-    // The Governor's tool slot is the single seam for tool-call budget + the
-    // global tool-concurrency backstop + per-(org, provider) pacing. It blocks
-    // until all three are satisfied and is held (across retries) until release.
+    // Hold one logical tool slot and charge one logical tool call for this
+    // execution. Per-provider rate admission is intentionally deferred until
+    // each physical fetch is ready to leave this process.
     const admissionStartedAt = Date.now();
     const toolSlot = await this.resourceGovernor.acquireTool({
       orgId: this.#options.orgId ?? null,
@@ -8408,7 +8408,6 @@ export class PlayContextImpl {
                   `[perf] tool call id=${toolId} phase=before_provider_ownership elapsed_ms=${Date.now() - ownershipStartedAt}`,
                 );
               }
-              providerCallStartedAt = Date.now();
               const heartbeatIntervalMs = hasReceiptHeartbeat
                 ? runtimeLeaseHeartbeatIntervalFromExpiry({
                     leaseExpiresAt: options?.receiptLeaseExpiresAt,
@@ -8438,71 +8437,87 @@ export class PlayContextImpl {
                   : null;
               receiptHeartbeatSupervisor?.start();
               try {
+                // Complete all local/receipt preparation before taking the
+                // shared provider permit. Once admitted, the next awaited work
+                // is the fetch itself, so independently delayed runners cannot
+                // compress real provider arrivals after their tickets.
+                const protectionHeaders = await this.vercelProtectionHeaders();
+                const providerPermit =
+                  await this.resourceGovernor.acquireProviderPermit({
+                    toolId,
+                    signal: abortController?.signal,
+                  });
                 const integrationFetchStartedAt = Date.now();
-                response = await fetch(url, {
-                  method: 'POST',
-                  signal: abortController?.signal,
-                  headers: {
-                    'Content-Type': 'application/json',
-                    Authorization: `Bearer ${this.#options.executorToken}`,
-                    [EXECUTE_RESPONSE_CONTRACT_HEADER]:
-                      V2_EXECUTE_RESPONSE_CONTRACT,
-                    [EXECUTE_RESPONSE_INTENT_HEADER]: 'dataset',
-                    [EXECUTE_TOOL_METADATA_HEADER]: 'true',
-                    'x-deepline-request-id': deeplineRequestId,
-                    ...(providerIdempotencyKey
-                      ? {
-                          'x-deepline-idempotency-key': providerIdempotencyKey,
-                        }
-                      : {}),
-                    ...(await this.vercelProtectionHeaders()),
-                  },
-                  body: JSON.stringify({
-                    payload: input,
-                    metadata: {
-                      parent_run_id: this.#options.runId,
-                      ...(durableCallReceiptKey
-                        ? {
-                            durable_call_receipt_key: durableCallReceiptKey,
-                            ...(executionAuthScopeDigest
-                              ? {
-                                  execution_auth_scope_digest:
-                                    executionAuthScopeDigest,
-                                }
-                              : {}),
-                          }
-                        : {}),
-                      ...(options?.customerDbDataset
+                providerCallStartedAt = integrationFetchStartedAt;
+                try {
+                  response = await fetch(url, {
+                    method: 'POST',
+                    signal: abortController?.signal,
+                    headers: {
+                      'Content-Type': 'application/json',
+                      Authorization: `Bearer ${this.#options.executorToken}`,
+                      [EXECUTE_RESPONSE_CONTRACT_HEADER]:
+                        V2_EXECUTE_RESPONSE_CONTRACT,
+                      [EXECUTE_RESPONSE_INTENT_HEADER]: 'dataset',
+                      [EXECUTE_TOOL_METADATA_HEADER]: 'true',
+                      'x-deepline-request-id': deeplineRequestId,
+                      ...(providerIdempotencyKey
                         ? {
-                            query_result_dataset: {
-                              limit: options.customerDbDataset.limit,
-                              offset: options.customerDbDataset.offset,
-                              page_size: options.customerDbDataset.pageSize,
-                              total_rows: options.customerDbDataset.totalRows,
-                            },
-                            ...(isCustomerDbDatasetTool(toolId)
-                              ? {
-                                  customer_db_dataset: {
-                                    limit: options.customerDbDataset.limit,
-                                    offset: options.customerDbDataset.offset,
-                                    page_size:
-                                      options.customerDbDataset.pageSize,
-                                    total_rows:
-                                      options.customerDbDataset.totalRows,
-                                  },
-                                }
-                              : {}),
+                            'x-deepline-idempotency-key':
+                              providerIdempotencyKey,
                           }
                         : {}),
-                      ...(providerIdempotencyKey
-                        ? { provider_idempotency_key: providerIdempotencyKey }
-                        : {}),
+                      ...protectionHeaders,
                     },
-                    ...(this.#options.integrationMode
-                      ? { integration_mode: this.#options.integrationMode }
-                      : {}),
-                  }),
-                });
+                    body: JSON.stringify({
+                      payload: input,
+                      metadata: {
+                        parent_run_id: this.#options.runId,
+                        ...(durableCallReceiptKey
+                          ? {
+                              durable_call_receipt_key: durableCallReceiptKey,
+                              ...(executionAuthScopeDigest
+                                ? {
+                                    execution_auth_scope_digest:
+                                      executionAuthScopeDigest,
+                                  }
+                                : {}),
+                            }
+                          : {}),
+                        ...(options?.customerDbDataset
+                          ? {
+                              query_result_dataset: {
+                                limit: options.customerDbDataset.limit,
+                                offset: options.customerDbDataset.offset,
+                                page_size: options.customerDbDataset.pageSize,
+                                total_rows: options.customerDbDataset.totalRows,
+                              },
+                              ...(isCustomerDbDatasetTool(toolId)
+                                ? {
+                                    customer_db_dataset: {
+                                      limit: options.customerDbDataset.limit,
+                                      offset: options.customerDbDataset.offset,
+                                      page_size:
+                                        options.customerDbDataset.pageSize,
+                                      total_rows:
+                                        options.customerDbDataset.totalRows,
+                                    },
+                                  }
+                                : {}),
+                            }
+                          : {}),
+                        ...(providerIdempotencyKey
+                          ? { provider_idempotency_key: providerIdempotencyKey }
+                          : {}),
+                      },
+                      ...(this.#options.integrationMode
+                        ? { integration_mode: this.#options.integrationMode }
+                        : {}),
+                    }),
+                  });
+                } finally {
+                  providerPermit.release();
+                }
                 if (runtimeReceiptReadTraceEnabled) {
                   this.log(
                     `[perf] tool call id=${toolId} phase=integration_fetch_headers elapsed_ms=${Date.now() - integrationFetchStartedAt} status=${response.status}`,

package/dist/bundling-sources/shared_libs/play-runtime/governor/governor.ts

@@ -6,7 +6,8 @@
  * at once" policy. See ADR 0007 + CONTEXT.md.
  *
  * Surface (small, by design):
- *   - acquireRowSlot / acquireToolSlot                         → blocking leases
+ *   - acquireRowSlot / acquireToolSlot                         → local execution leases
+ *   - acquireProviderPermit                                   → per-attempt provider admission
  *   - chargeBudget                                            → throws on breach
  *   - forkInlineChild                                         → inline recursion scope
  *   - resolveRowConcurrency / reportProviderBackpressure / snapshot
@@ -102,15 +103,24 @@ export interface PlayExecutionGovernor {
   /** Block until a map-row slot is free. */
   acquireRowSlot(opts?: { signal?: AbortSignal }): Promise<WorkLease>;
   /**
-   * Block until the per-provider pacer permit and then a global
-   * tool-concurrency slot are free, charge the tool-call budget, and return a
-   * lease. Parked future permits never consume scarce execution slots.
+   * Acquire the local execution slot and charge one logical tool-call budget.
+   * Provider pacing deliberately happens separately at the HTTP-attempt edge.
    */
   acquireToolSlot(
     toolId: string,
     opts?: { signal?: AbortSignal },
   ): Promise<WorkLease>;
 
+  /**
+   * Block until one physical provider HTTP attempt is admitted under the
+   * provider's shared rate/concurrency rules. Call this immediately before the
+   * outbound request and again for every retry.
+   */
+  acquireProviderPermit(
+    toolId: string,
+    opts?: { signal?: AbortSignal },
+  ): Promise<WorkLease>;
+
   /**
    * Suggested batch parallelism for a tool: the provider's own rate hints
    * tightened to the policy's suggested ceiling. No hints → the fallback.
@@ -373,44 +383,34 @@ export function createPlayExecutionGovernor(
     policy,
 
     acquireRowSlot: (opts) => rowSlots.acquire(opts?.signal),
-    async acquireToolSlot(toolId, opts) {
-      // 1. Per-provider pacing. The provider comes from the pacing
-      //    resolver, so callers only need the toolId. No rules → no pacing.
+    async acquireToolSlot(_toolId, opts) {
+      const slot = await toolSlots.acquire(opts?.signal);
+      // Charge the logical call only after its local execution slot is held, so
+      // a failed/aborted slot acquisition never consumes the budget. The
+      // physical provider admission is intentionally deferred to
+      // acquireProviderPermit at the outbound HTTP edge.
+      try {
+        await chargeBudget('toolCall');
+      } catch (error) {
+        slot.release();
+        throw error;
+      }
+      return slot;
+    },
+
+    async acquireProviderPermit(toolId, opts) {
+      // The rate ticket is an admission for a physical outbound attempt, not a
+      // reservation made while receipt ownership, headers, or local tool slots
+      // may still be waiting. This is what keeps real provider arrivals inside
+      // the declared rolling window under concurrent runners.
       const pacing = await resolveAdaptivePacing(toolId);
       const rateScope = await resolveScope(toolId, pacing.provider);
-      const permit = await input.rateState.acquire({
+      return await input.rateState.acquire({
         bucketId: rateScope[0],
         rateScopeToken: rateScope[1],
         rules: pacing.rules,
         signal: opts?.signal,
       });
-      // 2. Acquire a scarce execution slot only after the provider permit is
-      // due. If the slot wait aborts, refund any concurrency-bearing permit.
-      let slot: WorkLease;
-      try {
-        slot = await toolSlots.acquire(opts?.signal);
-      } catch (error) {
-        permit.release();
-        throw error;
-      }
-      // 3. Charge the budget only once the call is actually cleared to run, so a
-      // failed/aborted acquisition never permanently consumes tool budget.
-      try {
-        await chargeBudget('toolCall');
-      } catch (error) {
-        permit.release();
-        slot.release();
-        throw error;
-      }
-      let released = false;
-      return {
-        release: () => {
-          if (released) return;
-          released = true;
-          permit.release();
-          slot.release();
-        },
-      };
     },
 
     async suggestedParallelism(toolId, fallback) {
@@ -541,6 +541,8 @@ function createInlineChildGovernor(
     policy: root.policy,
     acquireRowSlot: (opts) => root.acquireRowSlot(opts),
     acquireToolSlot: (toolId, opts) => root.acquireToolSlot(toolId, opts),
+    acquireProviderPermit: (toolId, opts) =>
+      root.acquireProviderPermit(toolId, opts),
     suggestedParallelism: (toolId, fallback) =>
       root.suggestedParallelism(toolId, fallback),
     chargeBudget: (kind, amount) => root.chargeBudget(kind, amount),

package/dist/bundling-sources/shared_libs/play-runtime/ledger-safe-payload.ts

@@ -1,10 +1,14 @@
 import { createSecretRedactionContext } from './secret-redaction';
 import {
   assertRuntimeReceiptOutputWithinLimit,
-  TERMINAL_RUN_RESULT_MAX_BYTES,
+  jsonByteLengthUpTo,
+  LEDGER_TERMINAL_RESULT_MAX_BYTES,
 } from './output-size-limits';
 
-export const MAX_LEDGER_RESULT_PAYLOAD_BYTES = TERMINAL_RUN_RESULT_MAX_BYTES;
+// This is an inline Convex event limit, not the durable scheduler-terminal
+// envelope. A full terminal return is projected to an out-of-line reference
+// before it reaches here.
+export const MAX_LEDGER_RESULT_PAYLOAD_BYTES = LEDGER_TERMINAL_RESULT_MAX_BYTES;
 export const MAX_LEDGER_LOG_LINES_PER_EVENT = 500;
 export const MAX_LEDGER_LOG_LINE_LENGTH = 2_000;
 
@@ -17,8 +21,11 @@ export function redactLedgerString(value: unknown): string | null {
 
 export function sanitizeLedgerPayload(value: unknown): unknown {
   if (value === undefined) return undefined;
-  const serialized = JSON.stringify(value);
-  if (serialized && serialized.length > MAX_LEDGER_RESULT_PAYLOAD_BYTES) {
+  const measurement = jsonByteLengthUpTo(
+    value,
+    MAX_LEDGER_RESULT_PAYLOAD_BYTES,
+  );
+  if (measurement.exceeded) {
     throw new Error('run event result payload is too large');
   }
   return ledgerIngressRedactor.redact(value);
@@ -26,11 +33,19 @@ export function sanitizeLedgerPayload(value: unknown): unknown {
 
 /** Secret-redact a receipt payload without coupling its 10 MiB cell limit to the ledger. */
 export function sanitizeRuntimeReceiptPayload(value: unknown): unknown {
+  // Reject an obviously oversized source before doing redaction work, then
+  // validate the exact value that will be persisted. Redaction normally shrinks
+  // credential-shaped values but can expand short matched strings.
   assertRuntimeReceiptOutputWithinLimit({
     output: value,
     path: 'runtime receipt output',
   });
-  return ledgerIngressRedactor.redact(value);
+  const redacted = ledgerIngressRedactor.redact(value);
+  assertRuntimeReceiptOutputWithinLimit({
+    output: redacted,
+    path: 'runtime receipt output after secret redaction',
+  });
+  return redacted;
 }
 
 export function sanitizeLedgerLogLines(value: unknown): string[] {