deepline 0.3.247 → 0.3.248

package/dist/bundling-sources/shared_libs/play-data-plane/sheet-contract.ts

@@ -3,9 +3,11 @@ import type {
   PlayDatasetColumnTypes,
   PlaySheetContract,
 } from './contracts';
+import { RUNTIME_SHEET_SYSTEM_COLUMNS } from './runtime-sheet-orm';
 import {
   legacyPostgresTruncatedPlayColumnName,
   sqlSafePlayColumnName,
+  sqlSafePlayStepColumnName,
 } from './column-names';
 
 export type PhysicalSheetColumnProjection = {
@@ -20,6 +22,7 @@ export type LegacyPhysicalSheetColumnBackfill = {
 };
 
 const RUNTIME_SHEET_SYSTEM_FIELDS = new Set([
+  ...RUNTIME_SHEET_SYSTEM_COLUMNS,
   '_key',
   '_status',
   '_run_id',
@@ -51,8 +54,18 @@ export function physicalSheetColumnProjections(
     const fieldName =
       column.source === 'input' || column.source === 'datasetColumn'
         ? column.field?.trim() || column.id.trim() || sqlName
-        : sqlName;
-    if (!sqlName || sqlName.startsWith('_') || seen.has(sqlName)) {
+        : column.source === 'waterfallStep' &&
+            column.stepId &&
+            sqlName ===
+              sqlSafePlayStepColumnName(
+                column.field ?? column.waterfallId ?? column.id,
+                column.stepId,
+              )
+          ? // The runtime's logical patch/checkpoint keys are intentionally stable.
+            // Only newly compiled physical storage names use the debug prefix.
+            sqlSafePlayColumnName(column.id)
+          : sqlName;
+    if (!isDatasetPayloadField(sqlName) || seen.has(sqlName)) {
       continue;
     }
     seen.add(sqlName);
@@ -65,7 +78,7 @@ export function physicalSheetColumnProjections(
   // A prior run may have introduced fields absent from the current artifact.
   // Keep their live storage projection so reads and writes do not hide them.
   for (const sqlName of physicalColumns ?? []) {
-    if (!sqlName || sqlName.startsWith('_') || seen.has(sqlName)) continue;
+    if (!isDatasetPayloadField(sqlName) || seen.has(sqlName)) continue;
     seen.add(sqlName);
     columns.push({ sqlName, fieldName: sqlName });
   }
@@ -90,7 +103,7 @@ export function legacyPhysicalSheetColumnBackfills(
   const backfills: LegacyPhysicalSheetColumnBackfill[] = [];
   for (const column of sheetContract.columns) {
     const sqlName = column.sqlName.trim();
-    if (!sqlName || sqlName.startsWith('_')) {
+    if (!isDatasetPayloadField(sqlName)) {
       continue;
     }
     const candidates = [
@@ -99,6 +112,8 @@ export function legacyPhysicalSheetColumnBackfills(
     ];
     for (const candidate of candidates) {
       if (!candidate) continue;
+      // Prefix-preserving columns must not borrow an unrelated non-debug field.
+      if (candidate.startsWith('_') && sqlName.startsWith('_')) continue;
       const legacySqlName = legacyPostgresTruncatedPlayColumnName(candidate);
       const key = legacySqlName ? `${sqlName}:${legacySqlName}` : '';
       if (!legacySqlName || legacySqlName === sqlName || seen.has(key)) {
@@ -148,8 +163,7 @@ export function outputPhysicalSheetColumnProjections(
     if (
       column.source === 'input' ||
       typeof column.field !== 'string' ||
-      !sqlName ||
-      sqlName.startsWith('_') ||
+      !isDatasetPayloadField(sqlName) ||
       seen.has(sqlName)
     ) {
       continue;
@@ -194,6 +208,14 @@ export function augmentSheetContractWithDatasetFields(input: {
   }
 
   const existingDatasetPayloadFields = new Set<string>();
+  const existingPatchFields = new Set(
+    physicalSheetColumnProjections({
+      ...input.contract,
+      columns: input.contract.columns.filter(
+        (column) => column.source === 'waterfallStep',
+      ),
+    }).map((column) => column.fieldName),
+  );
   const existingSqlNames = new Set<string>();
   const inputColumns: PlaySheetContract['columns'] = [];
   const outputColumns: PlaySheetContract['columns'] = [];
@@ -239,8 +261,18 @@ export function augmentSheetContractWithDatasetFields(input: {
   }
 
   for (const field of candidateFields) {
-    if (existingDatasetPayloadFields.has(field)) continue;
-    const sqlName = sqlSafePlayColumnName(field);
+    if (
+      existingDatasetPayloadFields.has(field) ||
+      existingPatchFields.has(field)
+    )
+      continue;
+    // A stored contract is authoritative, including legacy underscore aliases.
+    const existingColumn = input.contract.columns.find(
+      (column) =>
+        (column.source === 'input' || column.source === 'datasetColumn') &&
+        (column.field ?? column.id) === field,
+    );
+    const sqlName = existingColumn?.sqlName ?? sqlSafePlayColumnName(field);
     if (existingSqlNames.has(sqlName)) continue;
     appendColumn(outputFields.has(field) ? outputColumns : inputColumns, {
       id: `runtime:${input.contract.tableNamespace}:${field}`,

package/dist/bundling-sources/shared_libs/play-runtime/app-runtime-api.ts

@@ -9,6 +9,7 @@ import type { AsyncPlayRunRef } from '../plays/authoring-contract';
 import type { PlayRowUpdate } from './/ctx-types';
 import type { PlayRunTimelineEntry } from './/live-events';
 import type { PlayDatasetBornFrom } from './/cell-provenance';
+import type { PlayLogContext } from './/log-context';
 import {
   routePlayActivityObservation,
   type PlayActivityObservation,
@@ -104,6 +105,8 @@ export type RuntimeStatusUpdate = {
   activeBoundaryId?: string | null;
   lastCheckpointAt?: number | null;
   liveLogs?: string[];
+  /** Search-only context aligned to `liveLogs`; stripped before Convex. */
+  liveLogContexts?: Array<PlayLogContext | null>;
   /**
    * Monotonic count of log lines the producer ever emitted on this run's
    * channel. `liveLogs` is a rotating tail of those lines; the total lets the
@@ -148,6 +151,7 @@ export type RuntimeStatusUpdate = {
    */
   terminalLogReplay?: {
     lines: string[];
+    lineContexts?: Array<PlayLogContext | null>;
     totalCount?: number;
     dedupeMode?: 'semantic' | 'exact';
     producerAttempt?: number;
@@ -254,6 +258,7 @@ type RuntimeApiRequest =
       runtimeBackend?: string | null;
       schedulerBackend?: string | null;
       schedulerSchema?: string | null;
+      runLogStore?: 'planet_scale';
       executionProfile?: string | null;
       runtimeReleaseId?: string | null;
       runtimeDeployVersion?: string | null;
@@ -2190,6 +2195,7 @@ async function updateRunStatusViaAppRuntimeUnlocked(
   const logSlice = Array.isArray(update.liveLogs)
     ? slicePositionalLogLines({
         bufferLines: update.liveLogs,
+        bufferContexts: update.liveLogContexts,
         bufferTotalCount: update.liveLogTotalCount ?? update.liveLogs.length,
         sentCount,
       })
@@ -2200,11 +2206,28 @@ async function updateRunStatusViaAppRuntimeUnlocked(
       : isTerminalRuntimeStatus(update.status) && Array.isArray(update.liveLogs)
         ? {
             lines: update.liveLogs,
+            lineContexts: update.liveLogContexts,
             totalCount: update.liveLogTotalCount,
             producerAttempt: update.liveLogProducerAttempt,
           }
         : null;
-  const statusPatchLogSlice = terminalLogReplay ? null : logSlice;
+  let statusPatchLogSlice = terminalLogReplay ? null : logSlice;
+  // A direct worker's terminal replay can contain only its summary suffix.
+  // Do not discard live lines that were observed but have not yet been sent.
+  // Preserve the non-overlapping prefix; recovery still owns the replay range.
+  if (
+    terminalLogReplay &&
+    logSlice &&
+    terminalLogReplay.totalCount !== undefined
+  ) {
+    const replayOffset =
+      terminalLogReplay.totalCount - terminalLogReplay.lines.length;
+    const prefix = logSlice.lines.slice(
+      0,
+      Math.max(0, replayOffset - logSlice.channelOffset),
+    );
+    if (prefix.length) statusPatchLogSlice = { ...logSlice, lines: prefix };
+  }
   const events = buildPlayRunLedgerEventsFromStatusPatch({
     patch: {
       runId: update.playId,
@@ -2213,6 +2236,7 @@ async function updateRunStatusViaAppRuntimeUnlocked(
       runtimeBackend: update.runtimeBackend ?? null,
       lastCheckpointAt: update.lastCheckpointAt ?? null,
       liveLogs: statusPatchLogSlice?.lines ?? null,
+      liveLogContexts: statusPatchLogSlice?.lineContexts ?? null,
       liveLogsChannelOffset: statusPatchLogSlice?.channelOffset ?? null,
       liveLogsProducerAttempt: update.liveLogProducerAttempt ?? null,
       liveNodeProgress: update.liveNodeProgress ?? null,
@@ -2297,6 +2321,7 @@ async function updateRunStatusViaAppRuntimeUnlocked(
           source: 'worker',
           occurredAt: update.lastCheckpointAt ?? Date.now(),
           lines: terminalLogReplay.lines,
+          lineContexts: terminalLogReplay.lineContexts,
           liveLogTotalCount: terminalLogReplay.totalCount,
           dedupeMode: terminalLogReplay.dedupeMode,
           producerAttempt: terminalLogReplay.producerAttempt,

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -13,6 +13,7 @@
  * - onBatchComplete: called after each provider batch for scheduler checkpointing
  */
 import { AsyncLocalStorage } from 'async_hooks';
+import { isDatasetPayloadField } from '../play-data-plane/sheet-contract';
 import {
   createDeferredPlayDataset,
   deserializeLegacyPlayDataset,
@@ -447,7 +448,12 @@ import type {
   PlayAsyncCallOptions,
 } from './ctx-types';
 import { assertKnownResolvedBoundary } from './checkpoint-boundaries';
-import { RunLogBuffer } from './run-log-buffer';
+import {
+  boundRunLogLine,
+  RunLogBuffer,
+  RUNNER_LOG_CONTEXT_MAX_BYTES,
+} from './run-log-buffer';
+import { normalizePlayLogContext, type PlayLogContext } from './log-context';
 import type { AsyncPlayRunRef } from '../plays/authoring-contract';
 import { admitAsyncPlayLineage } from './async-play-invocation';
 import {
@@ -1896,7 +1902,7 @@ const ACTIVE_MAP_CHECKPOINT_ROW_META_LEDGER_KEY = Symbol(
 );
 
 function shouldPersistMapCellField(fieldName: string): boolean {
-  return !fieldName.startsWith('_') || fieldName === '_metadata';
+  return isDatasetPayloadField(fieldName);
 }
 
 function runtimeSheetPatchFieldName(fieldName: string): string {
@@ -1991,6 +1997,7 @@ type RuntimeMapRowPersistence = {
 function createRuntimeMapRowPersistence(
   persistRows: (rows: PersistableMapRow[]) => Promise<void>,
   options?: {
+    prepareTerminalRow?: (row: PersistableMapRow) => PersistableMapRow;
     persistCheckpoint?: (updates: PlayRowUpdate[]) => Promise<void>;
     onFailure?: (error: unknown) => void;
     /**
@@ -2066,7 +2073,9 @@ function createRuntimeMapRowPersistence(
           continue;
         }
         if (identity) queued.add(identity);
-        const settlement = writer.settle(row);
+        const settlement = writer.settle(
+          options?.prepareTerminalRow?.(row) ?? row,
+        );
         admissions.push(
           settlement.admitted.catch((error) => {
             clearQueuedState(identity);
@@ -2672,6 +2681,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
   private readonly rootRuntimeContract: PlayArtifactRuntimeContract;
   private readonly executionScope: RunExecutionScope;
   private readonly logBuffer = new RunLogBuffer();
+  private logContextBudgetWarningLogged = false;
   private readonly logRateLimitState = new Map<
     Exclude<LogLevel, 'warn' | 'error'>,
     LogRateLimitState
@@ -3438,6 +3448,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     // read. Same reasoning as `__deeplineDocflowHit` above: injected at compile
     // time, so the run is the only place left to decide.
     if (!this.docflowCaptureEnabled) return execute();
+    // Inline composition changes logical identity, but its gateway token and
+    // durable observations remain owned by the executing receipt scope.
+    const runId = this.currentReceiptOwnerRunId;
     const attempt = this.currentRunAttempt;
     const inputs = buildPlayDocflowNodeInputPreviewMap(inputCaptures, {
       redactor: this.secretRedactor,
@@ -3455,7 +3468,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       at: Date.now(),
     });
     this.emitDocflowObservation({
-      runId: this.currentGovernance.currentRunId,
+      runId,
       attempt,
       nodeId: observationNodeId,
       invocationSeq,
@@ -3501,7 +3514,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         at: Date.now(),
       });
       this.emitDocflowObservation({
-        runId: this.currentGovernance.currentRunId,
+        runId,
         attempt,
         nodeId: observationNodeId,
         invocationSeq,
@@ -3533,7 +3546,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         at: Date.now(),
       });
       this.emitDocflowObservation({
-        runId: this.currentGovernance.currentRunId,
+        runId,
         attempt,
         nodeId: observationNodeId,
         invocationSeq,
@@ -3770,6 +3783,19 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     });
   }
 
+  private withPendingMapRowData(
+    row: PersistableMapRow,
+    tableNamespace: string,
+  ): PersistableMapRow {
+    const patch = this.activeMapCheckpointUpdates?.get(
+      `${tableNamespace}\u0000${row.key}`,
+    )?.dataPatch;
+    // Nested step values exist in cell patches, not the authored return row.
+    // Commit them with the terminal row before clearing its checkpoint state,
+    // without adding internal fields to the immediate authored result snapshot.
+    return patch ? { ...row, data: { ...row.data, ...patch } } : row;
+  }
+
   private clearActiveMapCheckpointUpdate(
     key: string,
     tableNamespace: string,
@@ -8646,6 +8672,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         if (!this.#options.onMapRowsCompleted || rows.length === 0) {
           return;
         }
+        rows = rows.map((row) =>
+          this.withPendingMapRowData(row, resolvedTableNamespace),
+        );
         for (const row of rows) {
           assertPersistableMapRowWithinCustomerOutputLimits({
             mapName: normalizedMapNamespace,
@@ -8870,6 +8899,8 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         const incrementalPersistence = createRuntimeMapRowPersistence(
           persistMapRows,
           {
+            prepareTerminalRow: (row) =>
+              this.withPendingMapRowData(row, resolvedTableNamespace),
             persistCheckpoint: this.#options.onMapRowsCheckpoint
               ? (updates) =>
                   this.#options.onMapRowsCheckpoint!({
@@ -9717,6 +9748,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       if (!this.#options.onMapRowsCompleted || rows.length === 0) {
         return;
       }
+      rows = rows.map((row) =>
+        this.withPendingMapRowData(row, resolvedTableNamespace),
+      );
       for (const row of rows) {
         assertPersistableMapRowWithinCustomerOutputLimits({
           mapName: normalizedMapNamespace,
@@ -9770,6 +9804,8 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     };
     const incrementalPersistence = this.#options.onMapRowsCompleted
       ? createRuntimeMapRowPersistence(persistMapRows, {
+          prepareTerminalRow: (row) =>
+            this.withPendingMapRowData(row, resolvedTableNamespace),
           persistCheckpoint: this.#options.onMapRowsCheckpoint
             ? (updates) =>
                 this.#options.onMapRowsCheckpoint!({
@@ -11750,12 +11786,12 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           key: rowStore.rowKey ?? null,
           tableNamespace: rowStore.tableNamespace ?? null,
           fieldName,
-          status: 'completed',
+          status: stageExecution.skipped ? 'skipped' : 'completed',
           rowStatus: 'running',
-          stage: 'completed',
+          stage: stageExecution.skipped ? 'skipped' : 'completed',
           provider: null,
           error: null,
-          completedAt: Date.now(),
+          ...(stageExecution.skipped ? {} : { completedAt: Date.now() }),
           dataPatch: { [patchFieldName]: cellValue },
         });
       }
@@ -12773,6 +12809,62 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     toolId: string,
     input: Record<string, unknown>,
     options?: ToolCallOptions,
+  ): Promise<unknown> {
+    const startedAt = Date.now();
+    const row = rowContext.getStore();
+    // Capture caller scope before asynchronous dispatch. Provider batches do
+    // not own a single row, and direct calls have no dataset scope at all.
+    const context = {
+      run_id: this.currentRunId,
+      ...(row?.tableNamespace ? { dataset: row.tableNamespace } : {}),
+      ...(row?.rowKey ? { row_key: row.rowKey } : {}),
+      ...(row?.fieldName ? { column: row.fieldName } : {}),
+      call_key: this.normalizeContextKey(key, 'tool'),
+      tool: toolId,
+    };
+    let result: unknown;
+    try {
+      result = await this.executeToolInternal(key, toolId, input, options);
+    } catch (error) {
+      // Parking is control flow, not a failed tool execution.
+      if (
+        !isPlayExecutionSuspendedError(error) &&
+        !isPlayRowExecutionSuspendedError(error) &&
+        !(error instanceof PlayRowProviderBackpressureError)
+      ) {
+        this.runtimeLog(
+          JSON.stringify({
+            event: 'tool_call_failed',
+            ...context,
+            status: 'failed',
+            duration_ms: Math.max(0, Date.now() - startedAt),
+          }),
+        );
+      }
+      throw error;
+    }
+    const toolResult = isToolExecuteResult(result) ? result : undefined;
+    const execution = toolResult?._metadata?.execution;
+    this.runtimeLog(
+      JSON.stringify({
+        event: 'tool_call_completed',
+        ...context,
+        ...(execution?.receiptKey ? { receipt_key: execution.receiptKey } : {}),
+        ...(execution?.source ? { execution_source: execution.source } : {}),
+        status: toolResult?.status ?? 'completed',
+        // Caller wall time includes queueing/reuse and result delivery. It is
+        // deliberately not described as provider request duration.
+        duration_ms: Math.max(0, Date.now() - startedAt),
+      }),
+    );
+    return result;
+  }
+
+  private async executeToolInternal(
+    key: string,
+    toolId: string,
+    input: Record<string, unknown>,
+    options?: ToolCallOptions,
   ): Promise<unknown> {
     if (!rowContext.getStore()) this.assertRowAdmissionOpen();
     this.assertNoPendingDurableSuspension();
@@ -14420,15 +14512,33 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     );
   }
 
-  private appendRunLog(line: string, terminal = false): void {
-    for (const retained of this.logBuffer.append(line, terminal)) {
-      this.#options.onLog?.(retained);
+  private appendRunLog(
+    line: string,
+    terminal = false,
+    context?: PlayLogContext | null,
+  ): void {
+    const boundedLine = boundRunLogLine(line);
+    const omittedBefore = this.logBuffer.snapshot().omittedLines;
+    for (const retained of this.logBuffer.append(line, terminal, context)) {
+      const originalLineWasRetained =
+        retained === boundedLine &&
+        this.logBuffer.snapshot().omittedLines === omittedBefore;
+      this.#options.onLog?.(
+        retained,
+        originalLineWasRetained
+          ? (this.logBuffer.contexts.at(-1) ?? undefined)
+          : undefined,
+      );
       if (this.#options.verbose) console.log(retained);
     }
   }
 
-  log(msg: string, options?: { level?: LogLevel }): void {
+  log(
+    msg: string,
+    options?: { level?: LogLevel; context?: PlayLogContext },
+  ): void {
     assertNoSecretTaint(msg, 'ctx.log');
+    assertNoSecretTaint(options?.context, 'ctx.log context');
     const requestedLevel = options?.level;
     if (requestedLevel !== undefined && !LOG_LEVELS.includes(requestedLevel)) {
       throw new Error(
@@ -14436,12 +14546,26 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       );
     }
     const level = requestedLevel ?? 'info';
+    const context = normalizePlayLogContext(options?.context);
+    const redactedContext = context
+      ? normalizePlayLogContext(this.secretRedactor.redact(context))
+      : null;
     const timestamped = `[${new Date().toISOString()}] ${this.secretRedactor.redactRegisteredSecrets(msg)}`;
     // Stamp the default too: a customer message that happens to begin with
     // "[error]" is still info unless the author selected a higher severity.
     const line = tagLogEntry('user', level, timestamped);
     if (!this.shouldKeepRateLimitedLog(level)) return;
-    this.appendRunLog(line);
+    const omittedContextsBefore = this.logBuffer.snapshot().omittedContexts;
+    this.appendRunLog(line, false, redactedContext);
+    if (
+      !this.logContextBudgetWarningLogged &&
+      this.logBuffer.snapshot().omittedContexts > omittedContextsBefore
+    ) {
+      this.logContextBudgetWarningLogged = true;
+      this.appendRunLog(
+        `[warn] [structured log context budget reached: later ctx.log messages are retained, but their context fields are omitted for this run; budget ${RUNNER_LOG_CONTEXT_MAX_BYTES} bytes.]`,
+      );
+    }
   }
 
   /**
@@ -15087,6 +15211,10 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     return this.logBuffer.lines;
   }
 
+  getLogContexts(): Array<PlayLogContext | null> {
+    return this.logBuffer.contexts.slice();
+  }
+
   assertRowAdmissionOpen(): void {
     this.#options.rowAdmissionSignal?.throwIfAborted();
   }

package/dist/bundling-sources/shared_libs/play-runtime/ctx-types.ts

@@ -10,6 +10,7 @@ import type { PlayRunContractSnapshot } from '../plays/contracts';
 import type { PlayDatasetColumnTypes } from '../play-data-plane/contracts';
 import type { PlayStructuredDefinition } from '../plays/definition';
 import type { PlayStaticPipeline } from '../plays/static-pipeline';
+import type { PlayLogContext } from './log-context';
 import type {
   AsyncPlayRunRef,
   DurableCallStaleAfterSeconds,
@@ -842,7 +843,7 @@ export interface ContextOptions {
   /** Called after each durable batch completes for scheduler checkpointing. */
   onBatchComplete?: (checkpoint: PlayCheckpoint) => void;
   /** Called when the runtime emits a new execution log line. */
-  onLog?: (line: string) => void;
+  onLog?: (line: string, context?: PlayLogContext) => void;
   /**
    * Runtime-provided HTTP transport for ctx.fetch. Node runtimes should provide
    * a transport that validates resolved IP addresses at connect time.

package/dist/bundling-sources/shared_libs/play-runtime/daytona-runtime-config.ts

@@ -16,11 +16,14 @@ export type DaytonaRunnerPathsConfig = {
 };
 
 export function daytonaClientOptions(apiKey: string): DaytonaClientOptions {
+  // Preserve the SDK's legacy URL fallback in the shared configuration owner,
+  // including for generated control clients that do not read SDK env files.
+  const apiUrl =
+    process.env.DAYTONA_API_URL?.trim() ||
+    process.env.DAYTONA_SERVER_URL?.trim();
   return {
     apiKey,
-    ...(process.env.DAYTONA_API_URL?.trim()
-      ? { apiUrl: process.env.DAYTONA_API_URL.trim() }
-      : {}),
+    ...(apiUrl ? { apiUrl } : {}),
     ...(process.env.DAYTONA_TARGET?.trim()
       ? { target: process.env.DAYTONA_TARGET.trim() }
       : {}),

package/dist/bundling-sources/shared_libs/play-runtime/daytona-sandbox-janitor.ts

@@ -44,38 +44,43 @@ export function startDaytonaSandboxJanitor(
     running = true;
     try {
       const [
-        { Daytona },
+        { listDaytonaControlSandboxes },
         { loadDaytonaRequiredConfig },
         {
           createPostgresDaytonaJanitorOwnershipPort,
           reapOrphanDaytonaSandboxes,
         },
       ] = await Promise.all([
-        import('@daytonaio/sdk'),
+        import('./runner-backends/backends/daytona-control-transport'),
         import('.//daytona-runtime-config'),
         import('./daytona-sandbox-reaper'),
       ]);
       const { clientOptions } = loadDaytonaRequiredConfig();
-      const daytona = new Daytona(clientOptions);
-      await withRuntimeSchedulerClient(
-        {
-          url: options.url,
-          applicationName: 'deepline-daytona-janitor',
-          maxClients:
-            options.maxClients ??
-            RUNTIME_CAPACITY_POLICY.runtimePostgres.schedulerPoolMaxClients,
+      await reapOrphanDaytonaSandboxes({
+        daytona: {
+          list: (query) => listDaytonaControlSandboxes(clientOptions, query),
         },
-        (client) =>
-          reapOrphanDaytonaSandboxes({
-            daytona: {
-              list: (query) => daytona.list(query),
-            },
-            ownership: createPostgresDaytonaJanitorOwnershipPort({
-              client,
-              schema: options.schema,
-            }),
-          }),
-      );
+        ownership: createPostgresDaytonaJanitorOwnershipPort({
+          // Provider pagination and per-sandbox work must never retain one of
+          // the controller's shared scheduler connections. Each ownership
+          // operation is one self-contained SQL statement (including its CTE).
+          client: {
+            query: (sql, params) =>
+              withRuntimeSchedulerClient(
+                {
+                  url: options.url,
+                  applicationName: 'deepline-daytona-janitor',
+                  maxClients:
+                    options.maxClients ??
+                    RUNTIME_CAPACITY_POLICY.runtimePostgres
+                      .schedulerPoolMaxClients,
+                },
+                (client) => client.query(sql, params),
+              ),
+          },
+          schema: options.schema,
+        }),
+      });
     } catch (error) {
       // This is a best-effort resource backstop. A failed sweep must never
       // terminate the controller that scales and recovers customer work.

package/dist/bundling-sources/shared_libs/play-runtime/daytona-sandbox-reaper.ts

@@ -66,8 +66,8 @@ export type ReapableSandbox = {
 };
 
 /**
- * Injected Daytona port. `list` yields our label-scoped sandboxes (the SDK
- * `list` returns an async iterator that auto-pages, so we consume it lazily).
+ * Injected Daytona port. `list` yields our label-scoped sandboxes through an
+ * async iterator that auto-pages, so we consume it lazily.
  * Inventory is the only Daytona surface the janitor touches.
  */
 export type DaytonaJanitorClientPort = {
@@ -659,7 +659,9 @@ export function createPostgresDaytonaJanitorOwnershipPort(input: {
 // CLI entry.
 // ---------------------------------------------------------------------------
 
-export async function runDaytonaSandboxJanitorCli(argv: string[]): Promise<void> {
+export async function runDaytonaSandboxJanitorCli(
+  argv: string[],
+): Promise<void> {
   const dryRun = argv.includes('--dry-run');
   // Escape hatch for deliberate debugging only: reaping against an isolated
   // schema is unsafe because the `source`-scoped fleet is shared across lanes
@@ -669,13 +671,13 @@ export async function runDaytonaSandboxJanitorCli(argv: string[]): Promise<void>
   // Lazy imports so the pure core above stays free of heavy runtime deps and
   // remains trivially unit-testable with fake ports.
   const [
-    { Daytona },
+    { listDaytonaControlSandboxes },
     { loadDaytonaRequiredConfig },
     poolModule,
     schemaModule,
     { isIsolatedRuntimeSchedulerSchema },
   ] = await Promise.all([
-    import('@daytonaio/sdk'),
+    import('./runner-backends/backends/daytona-control-transport'),
     import('.//daytona-runtime-config'),
     import('.//scheduler-backends/postgres-pool'),
     import('.//scheduler-backends/runtime-scheduler-schema'),
@@ -704,22 +706,22 @@ export async function runDaytonaSandboxJanitorCli(argv: string[]): Promise<void>
   }
 
   const { clientOptions } = loadDaytonaRequiredConfig();
-  const daytona = new Daytona(clientOptions);
-
-  const summary = await poolModule.withRuntimeSchedulerClient(
-    { url, applicationName: 'deepline-daytona-janitor' },
-    (client) =>
-      reapOrphanDaytonaSandboxes({
-        daytona: {
-          list: (query) => daytona.list(query),
-        },
-        ownership: createPostgresDaytonaJanitorOwnershipPort({
-          client,
-          schema,
-        }),
-        options: { dryRun },
-      }),
-  );
+  const summary = await reapOrphanDaytonaSandboxes({
+    daytona: {
+      list: (query) => listDaytonaControlSandboxes(clientOptions, query),
+    },
+    ownership: createPostgresDaytonaJanitorOwnershipPort({
+      client: {
+        query: (sql, params) =>
+          poolModule.withRuntimeSchedulerClient(
+            { url, applicationName: 'deepline-daytona-janitor' },
+            (client) => client.query(sql, params),
+          ),
+      },
+      schema,
+    }),
+    options: { dryRun },
+  });
 
   console.info('[daytona-janitor.cli_done]', { ...summary, schema, dryRun });
 }