deepline 0.1.313 → 0.1.315

package/dist/bundling-sources/sdk/src/play.ts

@@ -198,16 +198,12 @@ export type PlayBindings = {
     /** Stop the run before a billed action would push total run credits above this cap. */
     maxCreditsPerRun?: number;
   };
-  /** Requested sandbox envelope; the server enforces the final allowed limits. */
+  /** Requested prebuilt sandbox and runtime deadline. */
   runtime?: {
     /** Duration such as `"90m"` or `"2h"`. */
     timeout?: string;
-    /** Memory such as `"4GiB"`. */
-    memory?: string;
-    /** Whole vCPU count. */
-    cpu?: number;
-    /** Disk such as `"10GiB"`. */
-    disk?: string;
+    /** Deepline-managed prebuilt sandbox size. */
+    size?: 'standard';
   };
   /** Webhook trigger with optional HMAC signature verification. */
   webhook?: {
@@ -1204,7 +1200,7 @@ export type DefinePlayConfig<TInput, TOutput extends PlayReturnObject> = {
   bindings?: PlayBindings;
   /** Billing options. */
   billing?: PlayBindings['billing'];
-  /** Requested sandbox envelope; the server enforces the final allowed limits. */
+  /** Requested prebuilt sandbox and runtime deadline. */
   runtime?: PlayBindings['runtime'];
   /** Runtime compatibility override. Omit for the current typed contract. */
   compatibility?: PlayBindings['compatibility'];
@@ -1367,7 +1363,7 @@ export type DefinedPlay<TInput, TOutput extends PlayReturnObject> = ((
   DeeplineNamedPlay<TInput, TOutput> & {
     /** Optional trigger bindings (cron, webhook). */
     readonly bindings?: PlayBindings;
-    /** Requested sandbox envelope. */
+    /** Requested prebuilt sandbox and runtime deadline. */
     readonly runtime?: PlayBindings['runtime'];
     /** Runtime compatibility explicitly selected by the author. */
     readonly compatibility?: PlayBindings['compatibility'];

package/dist/bundling-sources/sdk/src/release.ts

@@ -157,7 +157,7 @@ export const SDK_RELEASE = {
   // 0.1.253 makes play-page browser opening opt-in and retires --no-open.
   // 0.1.254 removes the internal operations tree from the published SDK CLI.
   // Operators use the checkout-local deepline-admin binary instead.
-  version: '0.1.313',
+  version: '0.1.315',
   contracts: {
     api: {
       name: 'sdk-http-api',

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -1291,6 +1291,12 @@ function createPacingResolver(
 export class PlayContextImpl {
   private rowStates = new Map<number, RowState>();
   private toolCallQueue: ToolCallRequest[] = [];
+  private pendingRuntimeToolOwnershipAssertions: Array<{
+    targets: Array<{ receiptKey: string; leaseId: string }>;
+    resolve: () => void;
+    reject: (error: unknown) => void;
+  }> = [];
+  private runtimeToolOwnershipAssertionFlushScheduled = false;
   /**
    * Direct durable boundaries (including ctx.fetch) arrive independently from
    * concurrent map rows. Hold one microtask's worth so they can use the bulk
@@ -2094,17 +2100,19 @@ export class PlayContextImpl {
     try {
       const receipts = await this.dispatchChunkedRuntimeReceiptRequest(
         requests,
-        (chunk) =>
-          claimReceipts({
+        (chunk) => {
+          const leaseId = `receipt-lease:${crypto.randomUUID()}`;
+          return claimReceipts({
             keys: chunk.map((request) => request.key),
-            leaseIds: chunk.map(() => `receipt-lease:${crypto.randomUUID()}`),
+            leaseIds: chunk.map(() => leaseId),
             runId: this.currentReceiptOwnerRunId,
             runAttempt: this.currentRunAttempt,
             leaseAware: true,
             ...(first.reclaimRunning ? { reclaimRunning: true } : {}),
             ...(first.forceRefresh ? { forceRefresh: true } : {}),
             ...(first.forceFailedRefresh ? { forceFailedRefresh: true } : {}),
-          }),
+          });
+        },
       );
       for (let index = 0; index < requests.length; index += 1) {
         const request = requests[index]!;
@@ -2203,59 +2211,148 @@ export class PlayContextImpl {
   private async assertRuntimeToolReceiptOwnership(
     requests: ToolCallRequest[],
   ): Promise<void> {
-    const targets = requests.flatMap((request) => {
+    const targets = this.runtimeToolReceiptOwnershipTargets(requests);
+    if (targets.length === 0) return;
+
+    return await new Promise<void>((resolve, reject) => {
+      this.pendingRuntimeToolOwnershipAssertions.push({
+        targets,
+        resolve,
+        reject,
+      });
+      if (this.runtimeToolOwnershipAssertionFlushScheduled) return;
+      this.runtimeToolOwnershipAssertionFlushScheduled = true;
+      queueMicrotask(() => void this.flushRuntimeToolOwnershipAssertionBatch());
+    });
+  }
+
+  private runtimeToolReceiptOwnershipTargets(
+    requests: ToolCallRequest[],
+  ): Array<{ receiptKey: string; leaseId: string }> {
+    return requests.flatMap((request) => {
       const receiptKey = request.receiptKey?.trim() || null;
       if (!receiptKey) return [];
       const leaseId = request.receiptLeaseId?.trim() || null;
       if (!leaseId) return [];
       return [{ receiptKey, leaseId }];
     });
-    if (targets.length === 0) return;
+  }
 
+  private async renewRuntimeToolReceiptOwnership(
+    requests: ToolCallRequest[],
+  ): Promise<void> {
+    const targets = this.runtimeToolReceiptOwnershipTargets(requests);
+    if (targets.length === 0) return;
+    if (!this.#options.heartbeatRuntimeStepReceipts) {
+      return await this.assertRuntimeToolReceiptOwnership(requests);
+    }
     const byLeaseId = new Map<string, string[]>();
     for (const target of targets) {
       const keys = byLeaseId.get(target.leaseId) ?? [];
       keys.push(target.receiptKey);
       byLeaseId.set(target.leaseId, keys);
     }
-
-    if (this.#options.heartbeatRuntimeStepReceipts) {
-      for (const [leaseId, keys] of byLeaseId) {
-        const receipts = await this.#options.heartbeatRuntimeStepReceipts({
+    await Promise.all(
+      [...byLeaseId].map(async ([leaseId, keys]) => {
+        const receipts = await this.#options.heartbeatRuntimeStepReceipts!({
           runId: this.currentReceiptOwnerRunId,
           runAttempt: this.currentRunAttempt,
           leaseId,
           keys,
         });
         this.assertRuntimeToolReceiptHeartbeatResult(keys, leaseId, receipts);
+      }),
+    );
+  }
+
+  private async flushRuntimeToolOwnershipAssertionBatch(): Promise<void> {
+    this.runtimeToolOwnershipAssertionFlushScheduled = false;
+    const assertions = this.pendingRuntimeToolOwnershipAssertions.splice(0);
+    if (assertions.length === 0) return;
+    const targets = assertions.flatMap((assertion) => assertion.targets);
+
+    if (this.#options.heartbeatRuntimeStepReceipts) {
+      try {
+        const byLeaseId = new Map<string, string[]>();
+        for (const target of targets) {
+          const keys = byLeaseId.get(target.leaseId) ?? [];
+          keys.push(target.receiptKey);
+          byLeaseId.set(target.leaseId, keys);
+        }
+        const renewed = new Map<string, RuntimeStepReceipt | null>();
+        await Promise.all(
+          [...byLeaseId].map(async ([leaseId, keys]) => {
+            const receipts = await this.#options.heartbeatRuntimeStepReceipts!({
+              runId: this.currentReceiptOwnerRunId,
+              runAttempt: this.currentRunAttempt,
+              leaseId,
+              keys,
+            });
+            for (let index = 0; index < keys.length; index += 1) {
+              renewed.set(keys[index]!, receipts[index] ?? null);
+            }
+          }),
+        );
+        for (const assertion of assertions) {
+          const lost = assertion.targets.find((target) => {
+            const receipt = renewed.get(target.receiptKey);
+            return !this.runtimeToolReceiptStillOwned(receipt, target.leaseId);
+          });
+          if (lost) {
+            assertion.reject(
+              new RuntimeReceiptLeaseLostError({
+                receiptKey: lost.receiptKey,
+                runId: this.currentReceiptOwnerRunId,
+                leaseId: lost.leaseId,
+              }),
+            );
+          } else {
+            assertion.resolve();
+          }
+        }
+      } catch (error) {
+        for (const assertion of assertions) assertion.reject(error);
       }
       return;
     }
 
     if (
-      !this.#options.getRuntimeStepReceipt &&
-      !this.#options.getRuntimeStepReceipts
+      this.#options.getRuntimeStepReceipt ||
+      this.#options.getRuntimeStepReceipts
     ) {
-      throw new RuntimeReceiptLeaseLostError({
-        receiptKey: targets[0]?.receiptKey ?? 'unknown',
-        runId: this.currentReceiptOwnerRunId,
-        leaseId: targets[0]?.leaseId ?? 'unknown',
-      });
-    }
-
-    const latest = await this.getRuntimeStepReceipts(
-      targets.map((target) => target.receiptKey),
-    );
-    for (const target of targets) {
-      const receipt = latest.get(target.receiptKey);
-      if (!this.runtimeToolReceiptStillOwned(receipt, target.leaseId)) {
-        throw new RuntimeReceiptLeaseLostError({
-          receiptKey: target.receiptKey,
-          runId: this.currentReceiptOwnerRunId,
-          leaseId: target.leaseId,
-        });
+      try {
+        const latest = await this.getRuntimeStepReceipts(
+          targets.map((target) => target.receiptKey),
+        );
+        for (const assertion of assertions) {
+          const lost = assertion.targets.find((target) => {
+            const receipt = latest.get(target.receiptKey);
+            return !this.runtimeToolReceiptStillOwned(receipt, target.leaseId);
+          });
+          if (lost) {
+            assertion.reject(
+              new RuntimeReceiptLeaseLostError({
+                receiptKey: lost.receiptKey,
+                runId: this.currentReceiptOwnerRunId,
+                leaseId: lost.leaseId,
+              }),
+            );
+          } else {
+            assertion.resolve();
+          }
+        }
+      } catch (error) {
+        for (const assertion of assertions) assertion.reject(error);
       }
+      return;
     }
+
+    const error = new RuntimeReceiptLeaseLostError({
+      receiptKey: targets[0]?.receiptKey ?? 'unknown',
+      runId: this.currentReceiptOwnerRunId,
+      leaseId: targets[0]?.leaseId ?? 'unknown',
+    });
+    for (const assertion of assertions) assertion.reject(error);
   }
 
   private assertRuntimeToolReceiptHeartbeatResult(
@@ -2458,22 +2555,23 @@ export class PlayContextImpl {
     if (uniqueKeys.length === 0) return new Map();
     const claimReceipts = this.#options.claimRuntimeStepReceipts;
     const receipts = claimReceipts
-      ? await this.dispatchChunkedRuntimeReceiptRequest(uniqueKeys, (chunk) =>
-          claimReceipts({
+      ? await this.dispatchChunkedRuntimeReceiptRequest(uniqueKeys, (chunk) => {
+          const leaseId = `receipt-lease:${crypto.randomUUID()}`;
+          return claimReceipts({
             keys: chunk,
             // A transport retry can replay this mutation after the store
             // committed but before the response body was consumed. Stable
             // caller-owned tokens distinguish that replay from a concurrent
             // claimant without weakening the provider-call execution fence.
-            leaseIds: chunk.map(() => `receipt-lease:${crypto.randomUUID()}`),
+            leaseIds: chunk.map(() => leaseId),
             runId: this.currentReceiptOwnerRunId,
             runAttempt: this.currentRunAttempt,
             leaseAware: true,
             ...(reclaimRunning ? { reclaimRunning: true } : {}),
             ...(forceRefresh ? { forceRefresh: true } : {}),
             ...(forceFailedRefresh ? { forceFailedRefresh: true } : {}),
-          }),
-        )
+          });
+        })
       : await Promise.all(
           uniqueKeys.map((key) =>
             this.claimRuntimeStepReceipt(
@@ -8286,7 +8384,7 @@ export class PlayContextImpl {
                     executionAuthScopeDigest: owner.executionAuthScopeDigest,
                     receiptLeaseExpiresAt: owner.receiptLeaseExpiresAt,
                     heartbeatReceipt: () =>
-                      this.assertRuntimeToolReceiptOwnership([owner]),
+                      this.renewRuntimeToolReceiptOwnership([owner]),
                     providerIdempotencyKey:
                       this.providerIdempotencyKeyForToolCall({
                         cacheKey: owner.cacheKey,
@@ -8563,7 +8661,7 @@ export class PlayContextImpl {
                         batch.memberRequests,
                       ),
                     heartbeatReceipt: () =>
-                      this.assertRuntimeToolReceiptOwnership(
+                      this.renewRuntimeToolReceiptOwnership(
                         batch.memberRequests,
                       ),
                   },
@@ -8726,7 +8824,7 @@ export class PlayContextImpl {
                             }),
                           receiptLeaseExpiresAt: request.receiptLeaseExpiresAt,
                           heartbeatReceipt: () =>
-                            this.assertRuntimeToolReceiptOwnership([request]),
+                            this.renewRuntimeToolReceiptOwnership([request]),
                         }
                       : {}),
                     timeoutMs: resolveRuntimeTimeoutMsForClaimedOwners([

package/dist/bundling-sources/shared_libs/play-runtime/governor/app-runtime-rate-state-backend.ts

@@ -814,36 +814,36 @@ export class AppRuntimeRateStateBackend implements RateStateBackend {
 }
 
 /**
- * Multiplier applied to a default-pacing rule's `requestsPerWindow` to derive the
- * `adaptiveMaxRps` ceiling. Matches the DB seed's `DEFAULT_PACING_MAX_RPS_MULTIPLIER`
- * and the old in-memory AIMD range (default RPS ramps up to base * 25).
+ * Multiplier applied to an adaptive pacing rule's `requestsPerWindow` to derive
+ * its `adaptiveMaxRps` ceiling. The configured rate is a safe seed, while 429
+ * feedback drives AIMD toward the provider's actual limit.
  */
-const DEFAULT_PACING_ADAPTIVE_MAX_RPS_MULTIPLIER = 25;
+const ADAPTIVE_MAX_RPS_MULTIPLIER = 25;
 
 /**
  * A rule id shaped `default:<toolId>` is the undeclared-tool default-pacing rule
- * minted by `defaultPacingForTool` in governor.ts. Only those ramp above their
- * base rate; declared providers pin at their contractual rate.
+ * minted by `defaultPacingForTool` in governor.ts.
  */
 function isDefaultPacingRuleId(ruleId: string): boolean {
   return ruleId.startsWith('default:');
 }
 
 /**
- * Preserve explicit advisory ceilings and stamp the legacy base * 25 ceiling
- * only onto undeclared default-pacing rules. Declared rules without a ceiling
- * remain pinned at base.
+ * Preserve explicit advisory ceilings. Otherwise stamp the base * 25 ceiling
+ * onto legacy default-pacing rules and declared per-second rules. This lets a
+ * declared 10 QPS provider discover a higher entitlement, while longer-window
+ * declared budgets remain fixed because multiplying RPM into RPS is unsafe.
  */
 function withAdaptiveMaxRps(rules: readonly PacingRule[]): PacingRule[] {
   return rules.map((rule) =>
     rule.adaptiveMaxRps != null
       ? rule
-      : isDefaultPacingRuleId(rule.ruleId)
+      : isDefaultPacingRuleId(rule.ruleId) || rule.windowMs === 1_000
         ? ({
             ...rule,
             adaptiveMaxRps:
               rule.requestsPerWindow *
-              DEFAULT_PACING_ADAPTIVE_MAX_RPS_MULTIPLIER,
+              ADAPTIVE_MAX_RPS_MULTIPLIER,
           } as PacingRule)
         : rule,
   );

package/dist/bundling-sources/shared_libs/play-runtime/runner-backends/backends/daytona-lifecycle.ts

@@ -1,33 +1,29 @@
-import {
-  Image,
-  type CreateSandboxFromImageParams,
-  type Daytona,
-} from '@daytonaio/sdk';
-import { DAYTONA_DEFAULT_WORKDIR } from '@shared_libs/play-runtime/daytona-runtime-config';
+import { type Daytona } from '@daytonaio/sdk';
 import type {
   PlayRunnerExecutionConfig,
   PlayRunnerResult,
 } from '@shared_libs/play-runtime/protocol';
 import { isIsolatedRuntimeSchedulerSchema } from '@shared_libs/play-runtime/runtime-scheduler-topology';
 import { PLAY_RUNNER_TIMEOUT_SECONDS } from '@shared_libs/play-runtime/runtime-constants';
-import { resolvePlaySandboxRuntimeLimits } from '@shared_libs/play-runtime/sandbox-runtime-limits';
+import {
+  STANDARD_PLAY_SANDBOX_RUNTIME_LIMITS,
+  validatePlaySandboxRuntimeLimits,
+} from '@shared_libs/play-runtime/sandbox-runtime-limits';
 
 const DAYTONA_CREATE_TIMEOUT_SECONDS = 10;
-const DAYTONA_CUSTOM_RESOURCE_CREATE_TIMEOUT_SECONDS = 120;
 const DAYTONA_CREATE_RETRY_DELAYS_MS = [0, 500, 1_500] as const;
 // Explicit runner deadline + scheduler GC own the normal lifecycle. Daytona's
 // inactivity stop is a wider crash backstop measured from sandbox creation, so
 // setup time cannot consume the terminal-flush grace.
 const DAYTONA_AUTO_ARCHIVE_INTERVAL_MINUTES = 15;
 const DAYTONA_SANDBOX_LABEL_SOURCE = 'deepline-play-runner';
-const DAYTONA_CUSTOM_RESOURCE_IMAGE = Image.base(
-  'node:20-bookworm-slim',
-).workdir(DAYTONA_DEFAULT_WORKDIR);
-// Daytona's default image is the fast path. Resources are pinned at creation
-// and verified during acquisition, before customer code or billing starts.
-export const DAYTONA_SANDBOX_CPU = 1;
-export const DAYTONA_SANDBOX_MEMORY_GIB = 1;
-export const DAYTONA_SANDBOX_DISK_GIB = 3;
+// Daytona's Deepline-managed default snapshot is the only admitted prebuilt.
+// Resources are verified during acquisition, before customer code or billing.
+export const DAYTONA_SANDBOX_CPU = STANDARD_PLAY_SANDBOX_RUNTIME_LIMITS.cpu;
+export const DAYTONA_SANDBOX_MEMORY_GIB =
+  STANDARD_PLAY_SANDBOX_RUNTIME_LIMITS.memoryGiB;
+export const DAYTONA_SANDBOX_DISK_GIB =
+  STANDARD_PLAY_SANDBOX_RUNTIME_LIMITS.diskGiB;
 export const DAYTONA_SANDBOX_GPU = 0;
 const DAYTONA_NETWORK_ALLOW_LIST_ENV = 'DEEPLINE_DAYTONA_NETWORK_ALLOW_LIST';
 
@@ -182,15 +178,10 @@ async function createOneShotDaytonaSandbox(input: {
   orgId: string;
   context: DaytonaExecutionContext;
 }): Promise<DaytonaSandbox> {
-  const limits = resolvePlaySandboxRuntimeLimits(
-    input.context.sandboxRuntimeLimits
-      ? {
-          timeout: `${input.context.sandboxRuntimeLimits.timeoutSeconds / 60}m`,
-          memory: `${input.context.sandboxRuntimeLimits.memoryGiB}GiB`,
-          cpu: input.context.sandboxRuntimeLimits.cpu,
-          disk: `${input.context.sandboxRuntimeLimits.diskGiB}GiB`,
-        }
-      : null,
+  const limits = validatePlaySandboxRuntimeLimits(
+    input.context.sandboxRuntimeLimits ?? {
+      ...STANDARD_PLAY_SANDBOX_RUNTIME_LIMITS,
+    },
   );
   const orgId = normalizeLabelValue(input.orgId);
   const workflowId = normalizeLabelValue(input.context.workflowId);
@@ -213,10 +204,6 @@ async function createOneShotDaytonaSandbox(input: {
     runtimeSchedulerSchema: input.context.runtimeSchedulerSchema ?? null,
   });
 
-  const hasCustomResources =
-    limits.cpu !== DAYTONA_SANDBOX_CPU ||
-    limits.memoryGiB !== DAYTONA_SANDBOX_MEMORY_GIB ||
-    limits.diskGiB !== DAYTONA_SANDBOX_DISK_GIB;
   const commonParams = {
     labels,
     ephemeral: true,
@@ -232,25 +219,6 @@ async function createOneShotDaytonaSandbox(input: {
     // contradictory flag.
     ...(networkAllowList ? { networkAllowList } : {}),
   };
-  if (hasCustomResources) {
-    // Daytona fixes resources into snapshots and rejects a resources field on
-    // snapshot/default-image creates. Its supported custom-resource path
-    // builds from an OCI image and applies CPU, memory, and disk at creation.
-    const createParams: CreateSandboxFromImageParams = {
-      ...commonParams,
-      image: DAYTONA_CUSTOM_RESOURCE_IMAGE,
-      resources: {
-        cpu: limits.cpu,
-        memory: limits.memoryGiB,
-        disk: limits.diskGiB,
-      },
-    };
-    return input.daytona.create(createParams, {
-      timeout: DAYTONA_CUSTOM_RESOURCE_CREATE_TIMEOUT_SECONDS,
-    });
-  }
-  // Keep the fast default snapshot for standard resources, including plays
-  // that override timeout only.
   return input.daytona.create(commonParams, {
     timeout: DAYTONA_CREATE_TIMEOUT_SECONDS,
   });
@@ -316,15 +284,10 @@ async function acquireOneShotDaytonaSandbox(input: {
   emitStage: DaytonaStageEmitter;
   startedAt: number;
 }): Promise<AcquiredDaytonaSandbox> {
-  const limits = resolvePlaySandboxRuntimeLimits(
-    input.context.sandboxRuntimeLimits
-      ? {
-          timeout: `${input.context.sandboxRuntimeLimits.timeoutSeconds / 60}m`,
-          memory: `${input.context.sandboxRuntimeLimits.memoryGiB}GiB`,
-          cpu: input.context.sandboxRuntimeLimits.cpu,
-          disk: `${input.context.sandboxRuntimeLimits.diskGiB}GiB`,
-        }
-      : null,
+  const limits = validatePlaySandboxRuntimeLimits(
+    input.context.sandboxRuntimeLimits ?? {
+      ...STANDARD_PLAY_SANDBOX_RUNTIME_LIMITS,
+    },
   );
   input.emitStage('create:start');
   const result = await createRetriedOneShotDaytonaSandbox(input);
@@ -334,42 +297,6 @@ async function acquireOneShotDaytonaSandbox(input: {
     diskGiB: result.sandbox.disk,
     gpu: result.sandbox.gpu ?? 0,
   };
-  // Compatibility fallback for Daytona targets that ignore create-time
-  // resources but still support resize. The hosted target should normally
-  // match immediately; either path is verified before code or billing starts.
-  if (
-    typeof result.sandbox.resize === 'function' &&
-    (granted.cpu !== limits.cpu ||
-      granted.memoryGiB !== limits.memoryGiB ||
-      granted.diskGiB !== limits.diskGiB)
-  ) {
-    try {
-      if (granted.diskGiB !== limits.diskGiB) {
-        await result.sandbox.stop(60);
-        await result.sandbox.resize({
-          cpu: limits.cpu,
-          memory: limits.memoryGiB,
-          disk: limits.diskGiB,
-        });
-        await result.sandbox.start(60);
-      } else {
-        await result.sandbox.resize({
-          cpu: limits.cpu,
-          memory: limits.memoryGiB,
-          disk: limits.diskGiB,
-        });
-      }
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      return await rejectAcquiredSandbox(
-        result.sandbox,
-        `Daytona sandbox resize failed before execution: ${message}.`,
-      );
-    }
-    granted.cpu = result.sandbox.cpu;
-    granted.memoryGiB = result.sandbox.memory;
-    granted.diskGiB = result.sandbox.disk;
-  }
   if (
     granted.cpu !== limits.cpu ||
     granted.memoryGiB !== limits.memoryGiB ||