deepline 0.1.306 → 0.1.308

package/dist/cli/index.mjs

@@ -1022,7 +1022,7 @@ var SDK_RELEASE = {
   // 0.1.253 makes play-page browser opening opt-in and retires --no-open.
   // 0.1.254 removes the internal operations tree from the published SDK CLI.
   // Operators use the checkout-local deepline-admin binary instead.
-  version: "0.1.306",
+  version: "0.1.308",
   contracts: {
     api: {
       name: "sdk-http-api",
@@ -1441,8 +1441,8 @@ var HttpClient = class {
             }
             throw lastError;
           }
-          if (response.status === 401 && !isProviderOriginatedHttpError(parsed) || response.status === 403 && !options?.forbiddenAsApiError) {
-            throw new AuthError();
+          if (response.status === 401 && !isProviderOriginatedHttpError(parsed)) {
+            throw new AuthError(apiErrorMessage(parsed, response.status));
           }
           if (!response.ok) {
             const retryableApiError = options?.retryApiErrors === true && isRetryableApiErrorResponse(response.status);
@@ -1541,10 +1541,11 @@ var HttpClient = class {
    * @typeParam T - Expected response body type
    * @param path - API path (e.g. `"/api/v2/tools"`)
    */
-  async get(path) {
+  async get(path, options) {
     return this.request(path, {
       method: "GET",
-      retryApiErrors: true
+      retryApiErrors: true,
+      ...options
     });
   }
   async *streamSse(path, options) {
@@ -1569,8 +1570,8 @@ var HttpClient = class {
         if (!response.ok) {
           const body = await response.text();
           const parsed = parseResponseBody(body);
-          if (response.status === 401 && !isProviderOriginatedHttpError(parsed) || response.status === 403) {
-            throw new AuthError();
+          if (response.status === 401 && !isProviderOriginatedHttpError(parsed)) {
+            throw new AuthError(apiErrorMessage(parsed, response.status));
           }
           const htmlError = detectHtmlErrorBody(
             body,
@@ -3968,7 +3969,6 @@ var DeeplineClient = class {
       },
       headers,
       {
-        forbiddenAsApiError: true,
         timeout: options?.timeout ?? resolveToolExecuteTimeoutMs(toolId, input2),
         maxRetries: options?.maxRetries ?? 0,
         exactUrlOnly: true,
@@ -4019,9 +4019,7 @@ var DeeplineClient = class {
       "/api/v2/ingestion/repair",
       {
         ...input2?.provider ? { provider: input2.provider } : {}
-      },
-      void 0,
-      { forbiddenAsApiError: true }
+      }
     );
   }
   // ——————————————————————————————————————————————————————————
@@ -4177,7 +4175,7 @@ var DeeplineClient = class {
         compilerManifest
       },
       void 0,
-      { forbiddenAsApiError: true, retryApiErrors: true }
+      { retryApiErrors: true }
     );
   }
   /**
@@ -4192,7 +4190,7 @@ var DeeplineClient = class {
         "/api/v2/plays/artifacts",
         { artifacts },
         void 0,
-        { forbiddenAsApiError: true, retryApiErrors: true }
+        { retryApiErrors: true }
       );
     }
     const compiledArtifacts = await mapWithConcurrency(
@@ -4217,7 +4215,7 @@ var DeeplineClient = class {
             artifacts: chunk
           },
           void 0,
-          { forbiddenAsApiError: true, retryApiErrors: true }
+          { retryApiErrors: true }
         )
       );
     }
@@ -5346,9 +5344,7 @@ var DeeplineClient = class {
     const encodedName = encodeURIComponent(name);
     return this.http.post(
       `/api/v2/plays/${encodedName}/live`,
-      request,
-      void 0,
-      { forbiddenAsApiError: true }
+      request
     );
   }
   /**
@@ -5639,15 +5635,14 @@ var DeeplineClient = class {
     const suffix = query ? `?${query}` : "";
     return this.http.request(
       `/api/v2/monitors/tools${suffix}`,
-      { method: "GET", forbiddenAsApiError: true }
+      { method: "GET" }
     );
   }
   /** Validate a monitor definition without deploying it. Prefer `client.monitors.check(...)`. */
   async checkMonitor(definition) {
     return this.http.request("/api/v2/monitors/check", {
       method: "POST",
-      body: definition,
-      forbiddenAsApiError: true
+      body: definition
     });
   }
   /**
@@ -5659,14 +5654,12 @@ var DeeplineClient = class {
     if (options?.dryRun) {
       return this.http.request("/api/v2/monitors/check", {
         method: "POST",
-        body: definition,
-        forbiddenAsApiError: true
+        body: definition
       });
     }
     return this.http.request("/api/v2/monitors/deploy", {
       method: "POST",
-      body: definition,
-      forbiddenAsApiError: true
+      body: definition
     });
   }
   /** List deployed monitors. Prefer `client.monitors.list(...)`. */
@@ -5681,28 +5674,28 @@ var DeeplineClient = class {
     const suffix = query ? `?${query}` : "";
     return this.http.request(
       `/api/v2/monitors/deployed${suffix}`,
-      { method: "GET", forbiddenAsApiError: true }
+      { method: "GET" }
     );
   }
   /** Fetch one deployed monitor by public key. Prefer `client.monitors.get(...)`. */
   async getMonitor(key) {
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}`,
-      { method: "GET", forbiddenAsApiError: true }
+      { method: "GET" }
     );
   }
   /** Published plays depending on one monitor. Prefer `client.monitors.dependents(...)`. */
   async getMonitorDependents(key) {
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}/dependents`,
-      { method: "GET", forbiddenAsApiError: true }
+      { method: "GET" }
     );
   }
   /** Update a deployed monitor by public key. Prefer `client.monitors.update(...)`. */
   async updateMonitor(key, patch) {
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}`,
-      { method: "PATCH", body: patch, forbiddenAsApiError: true }
+      { method: "PATCH", body: patch }
     );
   }
   /**
@@ -5717,7 +5710,7 @@ var DeeplineClient = class {
     const query = params.toString();
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}${query ? `?${query}` : ""}`,
-      { method: "DELETE", forbiddenAsApiError: true }
+      { method: "DELETE" }
     );
   }
   /**
@@ -5728,7 +5721,7 @@ var DeeplineClient = class {
     const query = options?.dryRun ? "?dry_run=true" : "";
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}/reactivate${query}`,
-      { method: "POST", body: {}, forbiddenAsApiError: true }
+      { method: "POST", body: {} }
     );
   }
   /**
@@ -7863,8 +7856,7 @@ async function handleSubscribe(planVersionId, options) {
     "/api/v2/billing/subscription/checkout",
     {
       method: "POST",
-      body: { plan_version_id: planVersionId },
-      forbiddenAsApiError: true
+      body: { plan_version_id: planVersionId }
     }
   );
   const url = String(payload.checkout_url || "");
@@ -12179,6 +12171,134 @@ function resolveEnabledExecutionProfile(override) {
   }
 }
 
+// ../shared_libs/play-runtime/sandbox-runtime-limits.ts
+var STANDARD_PLAY_SANDBOX_RUNTIME_LIMITS = {
+  timeoutSeconds: 30 * 60,
+  memoryGiB: 1,
+  cpu: 1,
+  diskGiB: 3
+};
+var MAX_PLAY_SANDBOX_RUNTIME_LIMITS = {
+  timeoutSeconds: 4 * 60 * 60,
+  memoryGiB: 16,
+  cpu: 4,
+  diskGiB: 50
+};
+function parsePositiveInteger3(value, unit) {
+  const match = new RegExp(`^(\\d+)\\s*${unit}$`, "i").exec(value.trim());
+  if (!match) return null;
+  const parsed = Number(match[1]);
+  return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : null;
+}
+function parseTimeout(value) {
+  const match = /^(\d+)\s*([mh])$/i.exec(value.trim());
+  if (!match) return null;
+  const amount = Number(match[1]);
+  if (!Number.isSafeInteger(amount) || amount <= 0) return null;
+  return amount * (match[2].toLowerCase() === "h" ? 3600 : 60);
+}
+function resolvePlaySandboxRuntimeLimits(declaration) {
+  const base = STANDARD_PLAY_SANDBOX_RUNTIME_LIMITS;
+  if (!declaration) return { ...base };
+  const timeoutSeconds = declaration.timeout ? parseTimeout(declaration.timeout) : base.timeoutSeconds;
+  const memoryGiB = declaration.memory ? parsePositiveInteger3(declaration.memory, "GiB") : base.memoryGiB;
+  const diskGiB = declaration.disk ? parsePositiveInteger3(declaration.disk, "GiB") : base.diskGiB;
+  const cpu = declaration.cpu ?? base.cpu;
+  if (timeoutSeconds === null || memoryGiB === null || diskGiB === null || !Number.isSafeInteger(cpu) || cpu <= 0) {
+    throw new Error(
+      'Invalid runtime sandbox declaration. Use timeout like "90m" or "2h", memory/disk like "4GiB", and a positive integer cpu.'
+    );
+  }
+  const resolved = { timeoutSeconds, memoryGiB, cpu, diskGiB };
+  for (const key of ["memoryGiB", "cpu", "diskGiB"]) {
+    if (resolved[key] < base[key]) {
+      throw new Error(
+        `Requested runtime ${key}=${resolved[key]} is below the supported minimum ${base[key]}.`
+      );
+    }
+  }
+  for (const key of Object.keys(
+    resolved
+  )) {
+    if (resolved[key] > MAX_PLAY_SANDBOX_RUNTIME_LIMITS[key]) {
+      throw new Error(
+        `Requested runtime ${key}=${resolved[key]} exceeds this organisation's maximum ${MAX_PLAY_SANDBOX_RUNTIME_LIMITS[key]}.`
+      );
+    }
+  }
+  return resolved;
+}
+function hasNonStandardPlaySandboxRuntimeLimits(value) {
+  return Object.keys(value).some(
+    (key) => value[key] !== STANDARD_PLAY_SANDBOX_RUNTIME_LIMITS[key]
+  );
+}
+
+// ../shared_libs/play-runtime/worker-api-types.ts
+var DAYTONA_COMPUTE_PRICING_USD = {
+  vcpuSecond: 14e-6,
+  memoryGiBSecond: 45e-7,
+  storageGiBSecond: 3e-8,
+  includedStorageGiB: 5
+};
+function roundUsd(amount) {
+  return Number(Math.max(0, amount).toFixed(12));
+}
+function resolveDaytonaSandboxComputeItem(input2) {
+  const billableSeconds = Math.max(1, Math.ceil(input2.wallTimeSeconds));
+  const cpu = Math.max(0, input2.cpu);
+  const memoryGiB = Math.max(0, input2.memoryGiB);
+  const billableDiskGiB = Math.max(
+    0,
+    input2.diskGiB - DAYTONA_COMPUTE_PRICING_USD.includedStorageGiB
+  );
+  const providerCostUsd = roundUsd(
+    billableSeconds * (cpu * DAYTONA_COMPUTE_PRICING_USD.vcpuSecond + memoryGiB * DAYTONA_COMPUTE_PRICING_USD.memoryGiBSecond + billableDiskGiB * DAYTONA_COMPUTE_PRICING_USD.storageGiBSecond)
+  );
+  return {
+    itemId: input2.itemId,
+    source: input2.source ?? "daytona",
+    unit: "sandbox_second",
+    units: billableSeconds,
+    providerCostUsd,
+    metadata: {
+      sandboxId: input2.sandboxId ?? null,
+      cpu,
+      memoryGiB,
+      diskGiB: Math.max(0, input2.diskGiB),
+      billableDiskGiB,
+      startedAt: input2.startedAt,
+      endedAt: input2.endedAt
+    }
+  };
+}
+
+// ../shared_libs/billing/compute-pricing.ts
+var COMPUTE_BILLING_MARKUP_MULTIPLIER = 5;
+var DEFAULT_USD_PER_CUSTOMER_CREDIT = 0.1;
+var DEFAULT_PROVIDER_MARKUP_MULTIPLIER = 1.4;
+function roundUpCredits(value) {
+  if (!Number.isFinite(value) || value <= 0) return 0;
+  return Math.ceil(value * 100) / 100;
+}
+function estimateDaytonaMaximumComputeCredits(limits) {
+  const item = resolveDaytonaSandboxComputeItem({
+    itemId: "estimate",
+    wallTimeSeconds: limits.timeoutSeconds,
+    cpu: limits.cpu,
+    memoryGiB: limits.memoryGiB,
+    diskGiB: limits.diskGiB
+  });
+  return roundUpCredits(
+    item.providerCostUsd * COMPUTE_BILLING_MARKUP_MULTIPLIER * DEFAULT_PROVIDER_MARKUP_MULTIPLIER / DEFAULT_USD_PER_CUSTOMER_CREDIT
+  );
+}
+function formatNonStandardSandboxRuntimeWarning(limits) {
+  if (!hasNonStandardPlaySandboxRuntimeLimits(limits)) return null;
+  const maximumComputeCredits = estimateDaytonaMaximumComputeCredits(limits);
+  return `This Play requests a non-standard sandbox (${limits.timeoutSeconds}s, ${limits.memoryGiB}GiB memory, ${limits.cpu} CPU, ${limits.diskGiB}GiB disk). Maximum compute estimate: ${maximumComputeCredits.toFixed(2)} Deepline credits. It may queue longer.`;
+}
+
 // ../shared_libs/play-runtime/internal-step-ids.ts
 var INTERNAL_GLUE_NODE_ID_PREFIX = "run_javascript:";
 function isInternalGlueStepId(stepId) {
@@ -12738,7 +12858,7 @@ function looksLikeFilePath(target) {
   }
   return target.includes("\\") || /\.(ts|js|mjs|play\.ts)$/.test(target);
 }
-function parsePositiveInteger3(value, flagName) {
+function parsePositiveInteger4(value, flagName) {
   const parsed = Number.parseInt(value, 10);
   if (!Number.isFinite(parsed) || parsed <= 0) {
     throw new Error(`${flagName} must be a positive integer.`);
@@ -16258,7 +16378,7 @@ function parsePlayRunOptions(args) {
       );
     }
     if ((arg === "--tail-timeout-ms" || arg === "--timeout-ms") && args[index + 1]) {
-      waitTimeoutMs = parsePositiveInteger3(args[++index], arg);
+      waitTimeoutMs = parsePositiveInteger4(args[++index], arg);
       continue;
     }
     if (PLAY_RUN_RESERVED_BOOLEAN_FLAGS.has(arg)) {
@@ -16581,23 +16701,49 @@ function formatPlayCheckIssueLines(issue) {
   }
   return lines;
 }
-function printPlayCheckIssues(issues, writer) {
-  if (!issues?.length) return;
-  const errorIssues = issues.filter((issue) => issue.severity === "error");
-  const warningIssues = issues.filter((issue) => issue.severity === "warning");
+function printPlayCheckIssues(issues, writer, warnings = void 0) {
+  const errorIssues = (issues ?? []).filter(
+    (issue) => issue.severity === "error"
+  );
+  const warningIssues = (issues ?? []).filter(
+    (issue) => issue.severity === "warning"
+  );
+  const structuredWarningMessages = warningIssues.map(
+    (issue) => issue.message.trim()
+  );
+  const stringWarnings = [...new Set(warnings ?? [])].filter((warning) => {
+    const trimmed = warning.trim();
+    return trimmed.length > 0 && !structuredWarningMessages.some(
+      (message) => trimmed === message || trimmed.startsWith(message)
+    );
+  });
   if (errorIssues.length) {
     writer("  issues:");
     for (const issue of errorIssues) {
       for (const line of formatPlayCheckIssueLines(issue)) writer(line);
     }
   }
-  if (warningIssues.length) {
+  if (warningIssues.length || stringWarnings.length) {
     writer("  warnings:");
     for (const issue of warningIssues) {
       for (const line of formatPlayCheckIssueLines(issue)) writer(line);
     }
+    for (const warning of stringWarnings) writer(`  - ${warning.trim()}`);
   }
 }
+function formatPlaySandboxRuntimeWarning(declaration) {
+  if (!declaration) return null;
+  const warning = formatNonStandardSandboxRuntimeWarning(
+    resolvePlaySandboxRuntimeLimits(declaration)
+  );
+  return warning ? `Warning: ${warning}` : null;
+}
+function printBundledRuntimeWarning(bundle) {
+  const warning = formatPlaySandboxRuntimeWarning(
+    bundle.sandboxRuntimeDeclaration
+  );
+  if (warning) console.warn(warning);
+}
 function partitionMirroredErrors(errors, issues) {
   const errorMessages = (issues ?? []).filter((issue) => issue.severity === "error").map((issue) => issue.message.trim()).filter((message) => message.length > 0);
   if (errorMessages.length === 0) {
@@ -16775,7 +16921,11 @@ async function handlePlayCheck(args) {
     }
     printPlayTriggers(enrichedResult.triggers);
     printRecognizedSummary(enrichedResult.recognized);
-    printPlayCheckIssues(enrichedResult.issues, (line) => console.log(line));
+    printPlayCheckIssues(
+      enrichedResult.issues,
+      (line) => console.log(line),
+      enrichedResult.warnings
+    );
     printToolGetterHints(enrichedResult.toolGetterHints);
   } else {
     console.error(`\u2717 ${playName} failed cloud play check`);
@@ -16786,7 +16936,11 @@ async function handlePlayCheck(args) {
     for (const error of unstructuredErrors) {
       console.error(`  ${error}`);
     }
-    printPlayCheckIssues(enrichedResult.issues, (line) => console.error(line));
+    printPlayCheckIssues(
+      enrichedResult.issues,
+      (line) => console.error(line),
+      enrichedResult.warnings
+    );
     printToolGetterHints(enrichedResult.toolGetterHints);
   }
   return enrichedResult.valid ? 0 : 1;
@@ -16847,6 +17001,7 @@ async function handleFileBackedRun(options, hooks) {
   }
   const bundleResult = graph.root;
   const playName = bundleResult.playName ?? extractPlayName(sourceCode, absolutePlayPath);
+  printBundledRuntimeWarning(bundleResult);
   try {
     progress.phase("publishing imported plays");
     await traceCliSpan(
@@ -17384,7 +17539,7 @@ async function handleRunLogs(args) {
   for (let index = 0; index < args.length; index += 1) {
     const arg = args[index];
     if (arg === "--limit" && args[index + 1]) {
-      limit = parsePositiveInteger3(args[++index], "--limit");
+      limit = parsePositiveInteger4(args[++index], "--limit");
       continue;
     }
     if (arg === "--out" && args[index + 1]) {

package/dist/index.d.mts

@@ -3171,7 +3171,9 @@ declare const SDK_API_CONTRACT: string;
 /**
  * Thrown when the API rejects the request due to an invalid or missing API key.
  *
- * This maps to HTTP 401/403 responses. The SDK never retries auth errors —
+ * This maps to HTTP 401 responses. HTTP 403 means the caller was authenticated
+ * but lacks permission, so the SDK preserves the server's API error instead.
+ * The SDK never retries auth errors —
  * they fail immediately.
  *
  * Fix: run `deepline auth register` to obtain a valid key, or pass one via
@@ -3809,6 +3811,17 @@ type PlayBindings = {
         /** Stop the run before a billed action would push total run credits above this cap. */
         maxCreditsPerRun?: number;
     };
+    /** Requested sandbox envelope; the server enforces the final allowed limits. */
+    runtime?: {
+        /** Duration such as `"90m"` or `"2h"`. */
+        timeout?: string;
+        /** Memory such as `"4GiB"`. */
+        memory?: string;
+        /** Whole vCPU count. */
+        cpu?: number;
+        /** Disk such as `"10GiB"`. */
+        disk?: string;
+    };
     /** Webhook trigger with optional HMAC signature verification. */
     webhook?: {
         hmac?: {
@@ -4623,6 +4636,8 @@ type DefinePlayConfig<TInput, TOutput extends PlayReturnObject> = {
     bindings?: PlayBindings;
     /** Billing options. */
     billing?: PlayBindings['billing'];
+    /** Requested sandbox envelope; the server enforces the final allowed limits. */
+    runtime?: PlayBindings['runtime'];
     /** Runtime compatibility override. Omit for the current typed contract. */
     compatibility?: PlayBindings['compatibility'];
 };
@@ -4665,6 +4680,8 @@ declare function runIf<Row, Value>(predicate: (row: Row, index: number) => boole
 type DefinedPlay<TInput, TOutput extends PlayReturnObject> = ((ctx: DeeplinePlayRuntimeContext, input: TInput) => Promise<TOutput>) & DeeplineNamedPlay<TInput, TOutput> & {
     /** Optional trigger bindings (cron, webhook). */
     readonly bindings?: PlayBindings;
+    /** Requested sandbox envelope. */
+    readonly runtime?: PlayBindings['runtime'];
     /** Runtime compatibility explicitly selected by the author. */
     readonly compatibility?: PlayBindings['compatibility'];
     /** The play's name (same as `.name`). */
@@ -4676,6 +4693,7 @@ type PlayMetadata = {
     bindings?: PlayBindings;
     inputSchema?: Record<string, unknown>;
     billing?: PlayBindings['billing'];
+    runtime?: PlayBindings['runtime'];
     compatibility?: PlayBindings['compatibility'];
 };
 /**

package/dist/index.d.ts

@@ -3171,7 +3171,9 @@ declare const SDK_API_CONTRACT: string;
 /**
  * Thrown when the API rejects the request due to an invalid or missing API key.
  *
- * This maps to HTTP 401/403 responses. The SDK never retries auth errors —
+ * This maps to HTTP 401 responses. HTTP 403 means the caller was authenticated
+ * but lacks permission, so the SDK preserves the server's API error instead.
+ * The SDK never retries auth errors —
  * they fail immediately.
  *
  * Fix: run `deepline auth register` to obtain a valid key, or pass one via
@@ -3809,6 +3811,17 @@ type PlayBindings = {
         /** Stop the run before a billed action would push total run credits above this cap. */
         maxCreditsPerRun?: number;
     };
+    /** Requested sandbox envelope; the server enforces the final allowed limits. */
+    runtime?: {
+        /** Duration such as `"90m"` or `"2h"`. */
+        timeout?: string;
+        /** Memory such as `"4GiB"`. */
+        memory?: string;
+        /** Whole vCPU count. */
+        cpu?: number;
+        /** Disk such as `"10GiB"`. */
+        disk?: string;
+    };
     /** Webhook trigger with optional HMAC signature verification. */
     webhook?: {
         hmac?: {
@@ -4623,6 +4636,8 @@ type DefinePlayConfig<TInput, TOutput extends PlayReturnObject> = {
     bindings?: PlayBindings;
     /** Billing options. */
     billing?: PlayBindings['billing'];
+    /** Requested sandbox envelope; the server enforces the final allowed limits. */
+    runtime?: PlayBindings['runtime'];
     /** Runtime compatibility override. Omit for the current typed contract. */
     compatibility?: PlayBindings['compatibility'];
 };
@@ -4665,6 +4680,8 @@ declare function runIf<Row, Value>(predicate: (row: Row, index: number) => boole
 type DefinedPlay<TInput, TOutput extends PlayReturnObject> = ((ctx: DeeplinePlayRuntimeContext, input: TInput) => Promise<TOutput>) & DeeplineNamedPlay<TInput, TOutput> & {
     /** Optional trigger bindings (cron, webhook). */
     readonly bindings?: PlayBindings;
+    /** Requested sandbox envelope. */
+    readonly runtime?: PlayBindings['runtime'];
     /** Runtime compatibility explicitly selected by the author. */
     readonly compatibility?: PlayBindings['compatibility'];
     /** The play's name (same as `.name`). */
@@ -4676,6 +4693,7 @@ type PlayMetadata = {
     bindings?: PlayBindings;
     inputSchema?: Record<string, unknown>;
     billing?: PlayBindings['billing'];
+    runtime?: PlayBindings['runtime'];
     compatibility?: PlayBindings['compatibility'];
 };
 /**