deepline 0.3.184 → 0.3.186

package/dist/bundling-sources/shared_libs/play-runtime/governor/governor.ts

@@ -21,6 +21,7 @@ import {
   resolveRowConcurrency,
 } from './policy';
 import {
+  DEFAULT_UNKNOWN_PROVIDER_COLD_START_RPS,
   type PacingPermit,
   type PacingRule,
   type ProviderConcurrencyGrant,
@@ -50,6 +51,8 @@ export interface ProviderPermit extends WorkLease {
   readonly concurrencyGrant?: ProviderConcurrencyGrant | null;
   /** Effective rate-controller reading for this physical provider permit. */
   readonly pacingGrant?: ProviderPacingGrant | null;
+  /** Signed shared-scope proof consumed by the execution gateway after queueing. */
+  readonly gatewayDispatchProof?: PacingPermit['gatewayDispatchProof'];
   /**
    * Return an acquired provider permit before an outbound request started.
    * Unlike `release`, this returns the rate reservation as well as any
@@ -64,6 +67,8 @@ export interface ProviderPermit extends WorkLease {
    * backend's lease block when that block is still live; otherwise refunds.
    */
   park(): Promise<void>;
+  /** Recheck shared provider state immediately before network dispatch. */
+  validate?(): Promise<boolean>;
 }
 
 export type BudgetKind = 'toolCall' | 'retry' | 'waterfallStep';
@@ -174,7 +179,7 @@ export interface PlayExecutionGovernor {
    */
   acquireProviderPermit(
     toolId: string,
-    opts?: { signal?: AbortSignal },
+    opts?: { signal?: AbortSignal; yieldProviderHolds?: boolean },
   ): Promise<ProviderPermit>;
 
   /**
@@ -226,6 +231,8 @@ export interface PlayExecutionGovernor {
      */
     toolId?: string;
     retryAfterMs: number;
+    /** Absolute provider retry deadline from the observed response. */
+    retryAtMs?: number;
     /** Provider residence for the rejected physical request, when observed. */
     latencyMs?: number | null;
     /** Server-authored context for attributing this physical provider 429. */
@@ -434,6 +441,15 @@ export function createPlayExecutionGovernor(
       provider,
       concurrencyGrant: rateLease.concurrencyGrant ?? null,
       pacingGrant: rateLease.pacingGrant ?? null,
+      gatewayDispatchProof: rateLease.gatewayDispatchProof ?? null,
+      ...(rateLease.validate
+        ? {
+            validate: async () => {
+              if (settled) return false;
+              return await rateLease.validate!();
+            },
+          }
+        : {}),
       release() {
         if (settled) return;
         settled = true;
@@ -487,16 +503,37 @@ export function createPlayExecutionGovernor(
       // Passthrough: hand the DB-backed pacer the declared rules verbatim (or
       // the default-pacing shape when undeclared). No in-memory admission — the
       // row is authoritative.
-      const pacing = declaredPacing ?? defaultPacingForTool(toolId, policy);
+      const fallback = defaultPacingForTool(toolId, policy);
+      const pacing = declaredPacing ?? {
+        ...fallback,
+        provider: resolvedPacing?.provider ?? fallback.provider,
+      };
+      if (!declaredPacing) {
+        // bucketId is the authenticated quota scope. Unknown tools sharing a
+        // credential must not each mint an independent copy of the default rate.
+        // Start its one shared lane at one probe/sec; the DB-owned AIMD quickly
+        // ramps on sustained success and reacts to Retry-After if the provider
+        // tells us the quota is lower.
+        pacing.rules = pacing.rules.map((rule) => ({
+          ...rule,
+          ruleId: 'default:provider-scope',
+          requestsPerWindow: DEFAULT_UNKNOWN_PROVIDER_COLD_START_RPS,
+          windowMs: 1_000,
+        }));
+      }
       providerByTool.set(toolId, pacing.provider);
       pacingRulesByTool.set(toolId, pacing.rules);
       return pacing;
     }
+    const fallback = defaultPacingForTool(toolId, policy);
     const pacing = adaptiveAdmission.resolvePacing({
       orgId: input.scope.orgId,
       toolId,
       declaredPacing,
-      fallbackPacing: defaultPacingForTool(toolId, policy),
+      fallbackPacing: {
+        ...fallback,
+        provider: resolvedPacing?.provider ?? fallback.provider,
+      },
     });
     providerByTool.set(toolId, pacing.provider);
     pacingRulesByTool.set(toolId, pacing.rules);
@@ -623,8 +660,13 @@ export function createPlayExecutionGovernor(
           rateScopeToken: rateScope[1],
           rules: pacing.rules,
           signal: opts?.signal,
+          yieldProviderHolds: opts?.yieldProviderHolds,
         });
-        return providerPermitFrom(pacing.provider, rateLease, localConcurrencySlot);
+        return providerPermitFrom(
+          pacing.provider,
+          rateLease,
+          localConcurrencySlot,
+        );
       } catch (error) {
         localConcurrencySlot?.release();
         throw error;
@@ -727,6 +769,7 @@ export function createPlayExecutionGovernor(
         bucketId: rateScope[0],
         ...(rateScope[1] ? { rateScopeToken: rateScope[1] } : {}),
         cooldownMs: bp.retryAfterMs,
+        ...(bp.retryAtMs != null ? { retryAtMs: bp.retryAtMs } : {}),
         ...(rules ? { rules } : {}),
         ...(bp.latencyMs != null ? { latencyMs: bp.latencyMs } : {}),
         ...(bp.concurrencyGrant

package/dist/bundling-sources/shared_libs/play-runtime/governor/policy.ts

@@ -188,7 +188,9 @@ export const SHARED_EXECUTION_POLICY: ResolvedExecutionPolicy = {
     maxWaterfallStepExecutions: 5_000_000,
   },
   pacing: {
-    // Undeclared providers; declared providers (rate-limit-definitions.ts) win.
+    // Keep the generic fallback rate. The shared Postgres backend separately
+    // cold-starts unknown provider scopes at one probe/sec.
+    // Declared providers (rate-limit-definitions.ts) keep their own rates.
     defaultProviderRequestsPerSecond: 10,
     // This is the scheduler's resident-call envelope, not an RPS target.
     // Keep it aligned with the explicit run ceiling so an RPS-only provider

package/dist/bundling-sources/shared_libs/play-runtime/governor/rate-state-backend.ts

@@ -14,6 +14,12 @@
  */
 export const DEFAULT_ADVISORY_PROVIDER_MAX_RPS = 100;
 
+/** Cold-start rate for an unknown provider bucket shared across a fleet key. */
+export const DEFAULT_UNKNOWN_PROVIDER_COLD_START_RPS = 1;
+
+/** AIMD state cooldown cap; provider Retry-After holds remain uncapped. */
+export const PROVIDER_AIMD_COOLDOWN_CAP_MS = 45 * 60 * 1_000;
+
 /** A single resolved rate rule for a bucket (from rate-limit-definitions). */
 export interface PacingRule {
   readonly ruleId: string;
@@ -83,10 +89,18 @@ export interface PacingPermit {
    * Absent on backends that keep no local block; callers use `cancel` then.
    */
   park?(): Promise<void>;
+  /** Recheck the durable provider-scope hold immediately before dispatch. */
+  validate?(): Promise<boolean>;
   /** Server-authored context for attributing this request's provider 429. */
   readonly concurrencyGrant?: ProviderConcurrencyGrant | null;
   /** Effective shared rate for every app-runtime provider permit. */
   readonly pacingGrant?: ProviderPacingGrant | null;
+  /** Signed shared-scope proof for revalidation after the execution-gateway queue. */
+  readonly gatewayDispatchProof?: {
+    readonly bucketId: string;
+    readonly rateScopeToken: string;
+    readonly retryAtMsAtGrant: number;
+  } | null;
 }
 
 /**
@@ -118,6 +132,8 @@ export interface RateStateBackend {
     rateScopeToken?: string | null;
     rules: readonly PacingRule[];
     signal?: AbortSignal;
+    /** Managed Plays hand a shared provider hold to durable row suspension. */
+    yieldProviderHolds?: boolean;
   }): Promise<PacingPermit>;
 
   /**
@@ -140,6 +156,8 @@ export interface RateStateBackend {
     bucketId: string;
     rateScopeToken?: string | null;
     cooldownMs: number;
+    /** Absolute upstream retry deadline, stable across transport retries. */
+    retryAtMs?: number;
     /** Resolved provider rules for the rejected physical attempt. */
     rules?: readonly PacingRule[];
     /** Provider residence measured at the HTTP boundary. */

package/dist/bundling-sources/shared_libs/play-runtime/launch-identity.ts

@@ -0,0 +1,229 @@
+import { sha256Hex, stableStringify } from '../plays/row-identity';
+import { LEGACY_MAX_CONCURRENT_EXTERNAL_CALLS } from './governor/policy';
+import type { PlaySchedulerSubmitInput } from './scheduler-backend';
+
+/** Optional launch-envelope field used by the mixed-release admission fence. */
+export const PLAY_LAUNCH_IDENTITY_DIGEST_FIELD = 'launchIdentityDigest';
+const PLAY_LAUNCH_IDENTITY_DIGEST_NAMESPACE = 'deepline:play-launch-identity';
+
+export type PlayLaunchFieldRole = 'identity' | 'detail';
+
+/**
+ * Keep this list exhaustive over the launch envelope. A newly added field must
+ * be classified before it can participate in launch admission.
+ */
+export const PLAY_LAUNCH_ENVELOPE_FIELD_ROLES: {
+  readonly [K in keyof PlaySchedulerSubmitInput]-?: PlayLaunchFieldRole;
+} = {
+  orgId: 'identity',
+  playName: 'identity',
+  playReference: 'identity',
+  definitionScope: 'identity',
+  revisionId: 'identity',
+  artifactStorageKey: 'identity',
+  artifactHash: 'identity',
+  graphHash: 'identity',
+  workflowFamilyKey: 'identity',
+  inputSha256: 'identity',
+  source: 'identity',
+  triggerSource: 'identity',
+  parentRunId: 'identity',
+  rootRunId: 'identity',
+  asyncLaunchKey: 'identity',
+  asyncInvocationKey: 'identity',
+  asyncRequestFingerprint: 'identity',
+  force: 'identity',
+  forceToolRefresh: 'identity',
+  maxConcurrentExternalCalls: 'identity',
+  maxConcurrentRows: 'identity',
+  integrationMode: 'identity',
+  runtimeSandboxPlacementPolicyId: 'identity',
+  input: 'identity',
+  inputFile: 'identity',
+  inlineInputFile: 'identity',
+  inlineCsv: 'identity',
+  packagedFiles: 'identity',
+  runId: 'detail',
+  existingOnly: 'detail',
+  asyncParentRunAttempt: 'detail',
+  asyncParentRunLeaseToken: 'detail',
+  asyncParentAttemptRequired: 'detail',
+  asyncAncestryPlayIds: 'detail',
+  playId: 'detail',
+  schedulerSchema: 'detail',
+  requiresRunCreatedProjection: 'detail',
+  runtimeArtifact: 'detail',
+  runtimeProtocolVersion: 'detail',
+  staticPipeline: 'detail',
+  inputSummary: 'detail',
+  inputBytes: 'detail',
+  inputFileId: 'detail',
+  replayedFromRunId: 'detail',
+  totalRows: 'detail',
+  contractSnapshot: 'detail',
+  executionPlan: 'detail',
+  preloadedDbSessions: 'detail',
+  preloadedDbSessionUnwrapKey: 'detail',
+  executorToken: 'detail',
+  runtimeAuthority: 'detail',
+  runtimeApiBaseUrl: 'detail',
+  runtimeTokenOrigin: 'detail',
+  baseUrl: 'detail',
+  coordinatorUrl: 'detail',
+  coordinatorInternalToken: 'detail',
+  runtimeDeployVersion: 'detail',
+  absurdReleaseId: 'detail',
+  absurdReleaseEnvironment: 'detail',
+  vercelProtectionBypassToken: 'detail',
+  preferredReceiptGatewayMachineId: 'detail',
+  runtimeTestFaultHeader: 'detail',
+  testPolicyOverrides: 'detail',
+  submittedAtMs: 'detail',
+  schedulerBackend: 'detail',
+  executionProfile: 'detail',
+  runtimeBackend: 'detail',
+  queueMaxDelaySeconds: 'detail',
+  queuePriority: 'detail',
+  userEmail: 'detail',
+  userId: 'detail',
+  launchIdentityDigest: 'detail',
+};
+
+export const PLAY_LAUNCH_IDENTITY_FIELDS_COMPARED_OUTSIDE_DIGEST: readonly string[] =
+  Object.freeze(['runtimeSandboxPlacementPolicyId']);
+
+export const PLAY_LAUNCH_IDENTITY_FIELDS: readonly string[] = Object.freeze(
+  Object.entries(PLAY_LAUNCH_ENVELOPE_FIELD_ROLES)
+    .filter(([, role]) => role === 'identity')
+    .map(([field]) => field)
+    .sort(),
+);
+
+export const PLAY_LAUNCH_DETAIL_FIELDS: readonly string[] = Object.freeze(
+  Object.entries(PLAY_LAUNCH_ENVELOPE_FIELD_ROLES)
+    .filter(([, role]) => role === 'detail')
+    .map(([field]) => field)
+    .sort(),
+);
+
+export type PlayLaunchIdentitySource = Readonly<
+  Partial<Record<keyof PlaySchedulerSubmitInput, unknown>>
+>;
+
+function text(value: unknown): string | null {
+  return typeof value === 'string' && value.trim() ? value.trim() : null;
+}
+
+function flag(value: unknown): boolean {
+  return value === true;
+}
+
+function count(value: unknown): number | null {
+  return typeof value === 'number' && Number.isFinite(value) ? value : null;
+}
+
+function record(value: unknown): Record<string, unknown> | null {
+  return value && typeof value === 'object' && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : null;
+}
+
+function stagedFileIdentity(value: unknown): Record<string, unknown> | null {
+  const file = record(value);
+  if (!file) return null;
+  return {
+    logicalPath:
+      text(file.logicalPath) ?? text(file.path) ?? text(file.playPath),
+    fileName: text(file.fileName) ?? text(file.name),
+    contentType: text(file.contentType),
+    bytes: count(file.bytes),
+    contentDigest:
+      typeof file.contentBase64 === 'string'
+        ? sha256Hex(file.contentBase64)
+        : typeof file.inlineText === 'string'
+          ? sha256Hex(file.inlineText)
+          : null,
+  };
+}
+
+function stagedFileListIdentity(
+  value: unknown,
+): Array<Record<string, unknown>> {
+  if (!Array.isArray(value)) return [];
+  return value
+    .map((entry) => stagedFileIdentity(entry))
+    .filter((entry): entry is Record<string, unknown> => entry !== null)
+    .sort((left, right) =>
+      stableStringify(left).localeCompare(stableStringify(right)),
+    );
+}
+
+/** Return only customer intent; transport, authority, and release details are excluded. */
+export function buildPlayLaunchIdentity(
+  launch: PlayLaunchIdentitySource,
+): Record<string, unknown> {
+  const inlineCsv = record(launch.inlineCsv);
+  return {
+    orgId: text(launch.orgId),
+    playName: text(launch.playName),
+    playReference: text(launch.playReference) ?? text(launch.playName),
+    definitionScope: text(launch.definitionScope),
+    revisionId: text(launch.revisionId),
+    artifactStorageKey: text(launch.artifactStorageKey),
+    artifactHash: text(launch.artifactHash),
+    graphHash: text(launch.graphHash),
+    workflowFamilyKey: text(launch.workflowFamilyKey),
+    inputSha256: text(launch.inputSha256),
+    source: text(launch.source),
+    triggerSource: text(launch.triggerSource),
+    parentRunId: text(launch.parentRunId),
+    rootRunId: text(launch.rootRunId),
+    asyncLaunchKey: text(launch.asyncLaunchKey),
+    asyncInvocationKey: text(launch.asyncInvocationKey),
+    asyncRequestFingerprint: text(launch.asyncRequestFingerprint),
+    force: flag(launch.force),
+    forceToolRefresh: flag(launch.forceToolRefresh),
+    integrationMode: text(launch.integrationMode),
+    maxConcurrentExternalCalls:
+      count(launch.maxConcurrentExternalCalls) ??
+      LEGACY_MAX_CONCURRENT_EXTERNAL_CALLS,
+    maxConcurrentRows: count(launch.maxConcurrentRows),
+    inputDigest: sha256Hex(stableStringify(launch.input ?? {})),
+    inputFile: stagedFileIdentity(launch.inputFile),
+    inlineInputFile: stagedFileIdentity(launch.inlineInputFile),
+    inlineCsv: inlineCsv
+      ? {
+          name: text(inlineCsv.name),
+          rowsDigest: sha256Hex(stableStringify(inlineCsv.rows ?? [])),
+        }
+      : null,
+    packagedFiles: stagedFileListIdentity(launch.packagedFiles),
+  };
+}
+
+export const PLAY_LAUNCH_DIGESTED_IDENTITY_FIELDS: readonly string[] =
+  Object.freeze(
+    PLAY_LAUNCH_IDENTITY_FIELDS.filter(
+      (field) =>
+        !PLAY_LAUNCH_IDENTITY_FIELDS_COMPARED_OUTSIDE_DIGEST.includes(field),
+    ),
+  );
+
+export function buildPlayLaunchIdentityDigest(
+  launch: PlayLaunchIdentitySource,
+): string {
+  return sha256Hex(
+    `${PLAY_LAUNCH_IDENTITY_DIGEST_NAMESPACE}\0${stableStringify(
+      buildPlayLaunchIdentity(launch),
+    )}`,
+  );
+}
+
+export function withPlayLaunchIdentityDigest<
+  T extends PlaySchedulerSubmitInput,
+>(launch: T): T {
+  return {
+    ...launch,
+    launchIdentityDigest: buildPlayLaunchIdentityDigest(launch),
+  };
+}

package/dist/bundling-sources/shared_libs/play-runtime/map-execution-frame.ts

@@ -15,6 +15,9 @@ export function cloneMapFrame(frame: MapExecutionFrame): MapExecutionFrame {
           suspendedInputRows: frame.suspendedInputRows.map((row) => ({
             inputIndex: row.inputIndex,
             data: { ...row.data },
+            ...(row.authoredInputDigest
+              ? { authoredInputDigest: row.authoredInputDigest }
+              : {}),
           })),
         }
       : {}),

package/dist/bundling-sources/shared_libs/play-runtime/play-runs/admission/contracts.ts

@@ -42,16 +42,31 @@ export type PlayRunAdmissionJob = {
   admit(input: PlayRunAdmissionInput): Promise<PlayRunAdmissionOutcome>;
 };
 
+export type PlayRunLaunchConflictReason = 'launch_identity_mismatch';
+
 /** A stable, machine-readable rejection for a reused run id with new intent. */
 export class PlayRunLaunchConflictError extends Error {
   readonly code = 'PLAY_RUN_LAUNCH_CONFLICT';
+  readonly conflictReason: PlayRunLaunchConflictReason | undefined;
+  readonly conflictingFields: string[] | undefined;
 
-  constructor(runId: string, options?: { cause?: unknown }) {
+  constructor(
+    runId: string,
+    options?: {
+      cause?: unknown;
+      conflictReason?: PlayRunLaunchConflictReason;
+      conflictingFields?: readonly string[];
+    },
+  ) {
     super(
       `Play run "${runId}" already exists with a different launch.`,
       options,
     );
     this.name = 'PlayRunLaunchConflictError';
+    this.conflictReason = options?.conflictReason;
+    this.conflictingFields = options?.conflictingFields
+      ? [...options.conflictingFields]
+      : undefined;
   }
 }
 

package/dist/bundling-sources/shared_libs/play-runtime/play-runs/admission/postgres-adapter.ts

@@ -54,6 +54,9 @@ export function createPostgresPlayRunAdmissionPorts(input: {
               artifactHash: admission.launch.artifactHash,
               graphHash: admission.launch.graphHash,
               inputSha256: admission.launch.inputSha256,
+              launchIdentityDigest: admission.launch.launchIdentityDigest,
+              conflictReason: conflict.conflictReason ?? null,
+              conflictingFields: conflict.conflictingFields ?? null,
               error: conflict,
             });
             throw conflict;

package/dist/bundling-sources/shared_libs/play-runtime/protocol.ts

@@ -79,6 +79,8 @@ export type PlayRunnerRateStateConcurrencyGrant = {
 export type PlayRunnerRateStateAcquireResult = {
   granted: number;
   waitMs: number;
+  /** This receiver serves rate_state_validate. Absent on pre-expansion readers. */
+  scopeValidationSupported?: boolean;
   /**
    * Gateway clock used to produce `scheduledAtMs`. Runners translate the
    * schedule into relative delays so cross-machine clock skew cannot compress
@@ -108,8 +110,8 @@ export type PlayRunnerRateStateAcquireResult = {
    */
   coolUntilMs?: number;
   /**
-   * The most recent server Retry-After stored verbatim (uncapped) as an absolute
-   * epoch-ms deadline. Purely observational — never gates a grant on its own.
+   * Most recent provider Retry-After deadline, surfaced for diagnostics. The
+   * authoritative admission gate is the durable provider-scope hold row.
    */
   claimedRetryAtMs?: number;
 };
@@ -128,6 +130,12 @@ export type PlayRunnerRateStatePenalizeInput = {
   bucketId: string;
   rateScopeToken?: string | null;
   cooldownMs: number;
+  /** Absolute provider retry deadline captured with the observed response. */
+  retryAtMs?: number;
+  /** Unflushed confirmed successes, sharing acquire's replay-safe identity. */
+  observedSuccesses?: number;
+  concurrencyObservations?: PlayRunnerRateStateConcurrencyObservation[];
+  concurrencyObservationBatch?: PlayRunnerRateStateConcurrencyObservationBatch;
   /**
    * The same resolved rules that admitted the attempt. Optional during the
    * rolling deploy window: old runners retain rate-only backpressure handling.
@@ -140,6 +148,18 @@ export type PlayRunnerRateStatePenalizeInput = {
   schedulerSchema?: string | null;
 };
 
+export type PlayRunnerRateStateValidateInput = {
+  bucketId: string;
+  rateScopeToken?: string | null;
+  schedulerSchema?: string | null;
+};
+
+export type PlayRunnerRateStateValidateResult = {
+  allowed: boolean;
+  serverNowMs: number;
+  retryAtMs: number;
+};
+
 export type PlayRunnerBudgetCharge = {
   key: string;
   amount: number;

package/dist/bundling-sources/shared_libs/play-runtime/resource-governor.ts

@@ -711,6 +711,7 @@ export interface RuntimeResourceGovernor {
   acquireProviderPermit(input: {
     toolId: string;
     signal?: AbortSignal;
+    yieldProviderHolds?: boolean;
   }): Promise<RuntimeProviderPermit>;
   /**
    * Non-blocking provider admission from capacity this process already holds.
@@ -748,6 +749,7 @@ export interface RuntimeResourceGovernor {
     provider: string;
     toolId?: string;
     retryAfterMs: number;
+    retryAtMs?: number;
     /** Provider residence for the rejected physical request, when observed. */
     latencyMs?: number | null;
     /** Server-authored context for attributing this physical provider 429. */
@@ -1585,7 +1587,10 @@ export function createRuntimeResourceGovernor(input: {
       const startedAt = Date.now();
       const lease = await input.executionGovernor.acquireProviderPermit(
         providerInput.toolId,
-        { signal: providerInput.signal },
+        {
+          signal: providerInput.signal,
+          yieldProviderHolds: providerInput.yieldProviderHolds,
+        },
       );
       observe({
         providerResourceKey: lease.provider,

package/dist/bundling-sources/shared_libs/play-runtime/run-failure.ts

@@ -241,15 +241,17 @@ export function providerExhaustedMessage(input: {
 }
 
 /**
- * Thrown by the DB-authoritative pacer (`app_runtime_postgres` rate-state
- * backend) when a provider's hold exceeds the tolerable wait
- * (PROVIDER_EXHAUSTED_MAX_WAIT_MS). The call is skipped BEFORE any tool
- * execution request, so nothing is dispatched and nothing is billed. Row-failure
- * isolation still applies: this is a row/step outcome, not a run-fatal error.
+ * Control signal from the DB-authoritative pacer when a provider hold exceeds
+ * the in-process wait threshold. The next provider call is not dispatched.
+ * Managed durable Plays translate this into a persisted run/row wait and resume
+ * after the deadline; callers without durable boundaries receive a repairable
+ * provider-exhausted outcome. This signal is not a terminal row failure in the
+ * managed durable path.
  */
 export class ProviderExhaustedError extends Error {
   readonly code = PROVIDER_EXHAUSTED_CODE;
   readonly provider: string;
+  readonly publicDetails: ToolExecutionError['publicDetails'];
   /** ISO 8601 retry deadline (from the server Retry-After / cooldown). */
   readonly retryAt: string;
   constructor(input: { provider: string; retryAtMs: number; cause?: unknown }) {
@@ -264,6 +266,10 @@ export class ProviderExhaustedError extends Error {
     );
     this.name = 'ProviderExhaustedError';
     this.provider = input.provider;
+    this.publicDetails =
+      input.cause instanceof ToolExecutionError
+        ? input.cause.publicDetails
+        : null;
     this.retryAt = Number.isFinite(Number(input.retryAtMs))
       ? new Date(Number(input.retryAtMs)).toISOString()
       : new Date(0).toISOString();