deepline 0.3.374 → 0.3.376

package/dist/cli/{chunk-A62HBMHY.mjs → chunk-H7SLESX6.mjs}

@@ -21,7 +21,7 @@ import {
   RETAINED_PIPELINE_RECEIVERS_HEADER,
   RUNTIME_ENVIRONMENT_TOKEN_HEADER,
   resolveConfig
-} from "./chunk-VZSVYNZH.mjs";
+} from "./chunk-HDB4GAWY.mjs";
 import {
   DeeplineError,
   TOOL_EXECUTION_ERROR_SCHEMA_HEADER,
@@ -29,11 +29,6 @@ import {
   ToolExecutionError
 } from "./chunk-NXGCO4JB.mjs";
 
-// ../plays/trigger-config-route.ts
-function playTriggerConfigPath(playName) {
-  return `/api/v2/plays/${encodeURIComponent(playName)}/triggers`;
-}
-
 // src/csv-header-matching.ts
 var CSV_HEADER_MATCHING_NOTE = 'A header matches a column when it equals the column name or its default header, ignoring case, spaces and punctuation: LINKEDIN_URL, linkedin-url and "Linkedin Url" all match linkedin_url. A capital inside a word starts a new word, so "LinkedIn URL" reads as linked_in_url and does not match. Map any other header in the input: {"csv":"<path>","columns":{"<column>":"<your header>"}}.';
 
@@ -57,31 +52,6 @@ async function* iterateCursorPages(fetchPage) {
   }
 }
 
-// src/plays/input-example.ts
-function playInputExampleArgs(schema) {
-  if (!schema) return " --input '@<input.json>'";
-  if (schema.$ref || schema.allOf) return " --input '@<input.json>'";
-  const csv = schema.csvInput;
-  const csvField = typeof csv?.inputField === "string" ? csv.inputField : null;
-  const required = Array.isArray(schema.required) ? schema.required : [];
-  const csvOnlyRequired = required.every((key) => key === csvField);
-  const alternatives = schema.oneOf ?? schema.anyOf;
-  const hasCsvAlternative = Array.isArray(alternatives) && alternatives.some((branch) => {
-    if (!branch || typeof branch !== "object") return false;
-    const keys = branch.required;
-    return Array.isArray(keys) && keys.includes(csvField) && keys.every((key) => key === csvField);
-  });
-  if (csvField && csvOnlyRequired && (!alternatives || hasCsvAlternative)) {
-    if (csvField === "csv") return " --csv '<contacts.csv>'";
-    const value = JSON.stringify({ [csvField]: "<contacts.csv>" });
-    return ` --input '${value.replace(/'/g, "'\\''")}'`;
-  }
-  if (Array.isArray(schema.required) && !required.length && !csv && !alternatives) {
-    return "";
-  }
-  return " --input '@<input.json>'";
-}
-
 // src/billing-idempotency.ts
 function requireBillingIdempotencyKey(value) {
   const normalized = value.trim();
@@ -747,302 +717,166 @@ var PRODUCT_NOTIFICATION_DELIVERY_LEASE_MS = 2 * 6e4;
 var PRODUCT_NOTIFICATION_SUCCESS_TTL_MS = 15 * 6e4;
 var PRODUCT_NOTIFICATION_FAILURE_TTL_MS = 24 * 60 * 6e4;
 
-// ../product-notifications/configuration.ts
-var PRODUCT_NOTIFICATION_EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-function normalizeProductNotificationEmail(value) {
-  const email = typeof value === "string" ? value.trim().toLowerCase() : "";
-  return email && email.length <= 320 && PRODUCT_NOTIFICATION_EMAIL_PATTERN.test(email) ? email : null;
-}
-var DEFAULT_PRODUCT_NOTIFICATION_DELIVERY_TIMING = {
-  mode: "rolling_limit",
-  windowMs: 36e5
+// ../play-runtime/log-provenance.ts
+var LOG_LEVELS = [
+  "debug",
+  "info",
+  "warn",
+  "error"
+];
+var LOG_LEVEL_RANK = {
+  debug: 0,
+  info: 1,
+  warn: 2,
+  error: 3
 };
-
-// ../play-runtime/live-events.ts
-function projectPlayStepProgressCounters(progress) {
-  return {
-    completed: progress.completed,
-    total: progress.total,
-    failed: progress.failed,
-    startedRows: progress.startedRows,
-    activeRows: progress.activeRows,
-    waitingRows: progress.waitingRows,
-    completedRows: progress.completedRows,
-    supersededRows: progress.supersededRows
-  };
+var LOG_PROVENANCE_CLASSES = [
+  "user",
+  "lifecycle",
+  "replay",
+  "infra",
+  "diagnostic",
+  "receipt"
+];
+var LOG_PROVENANCE_POLICY = {
+  user: { watch: true, ui: true, debug: true },
+  lifecycle: { watch: true, ui: true, debug: true },
+  replay: { watch: false, ui: false, debug: true },
+  infra: { watch: false, ui: false, debug: true },
+  diagnostic: { watch: true, ui: true, debug: true },
+  receipt: { watch: false, ui: false, debug: true }
+};
+function logProvenanceReaches(provenance, surface) {
+  return LOG_PROVENANCE_POLICY[provenance][surface];
 }
-function resolveTimingWindow(input) {
-  const startedAt = typeof input.startedAt === "number" && Number.isFinite(input.startedAt) ? input.startedAt : null;
-  const completedAt = typeof input.completedAt === "number" && Number.isFinite(input.completedAt) ? input.completedAt : null;
-  const updatedAt = typeof input.updatedAt === "number" && Number.isFinite(input.updatedAt) ? input.updatedAt : null;
+var PROVENANCE_SENTINEL = "
";
+var PROVENANCE_PREFIX = `${PROVENANCE_SENTINEL}prov:`;
+function logLevelReaches(level, minimum) {
+  return LOG_LEVEL_RANK[level] >= LOG_LEVEL_RANK[minimum];
+}
+function parseLogLevel(value) {
+  const normalized = value.trim().toLowerCase();
+  return LOG_LEVELS.includes(normalized) ? normalized : null;
+}
+function readProvenanceTag(line) {
+  if (!line.startsWith(PROVENANCE_PREFIX)) {
+    return { provenance: null, line };
+  }
+  const end = line.indexOf(PROVENANCE_SENTINEL, PROVENANCE_PREFIX.length);
+  if (end === -1) {
+    return { provenance: null, line };
+  }
+  const candidate = line.slice(PROVENANCE_PREFIX.length, end);
+  const provenance = LOG_PROVENANCE_CLASSES.includes(candidate) ? candidate : null;
+  return { provenance, line: line.slice(end + 1) };
+}
+function classifyLegacyLogLine(line) {
+  const message = stripLeadingTimestamp(line);
+  if (/recovered (?:from checkpoint|response from checkpoint)/i.test(message)) {
+    return "replay";
+  }
+  if (/^\[perf\] runtime receipt\b/i.test(message)) {
+    return "receipt";
+  }
+  if (/^\[perf\]/i.test(message) || /^\[runtime\.(?:phase_summary|logs|log_transport)\]/i.test(message) || /\[worker\] picked up run\b/.test(message) || /\[worker\] heartbeat\b/.test(message) || /\[worker\] progress completedRows=\d+ totalRows=\d+ rowUpdates=\d+/.test(
+    message
+  ) || /\[worker\] step started\b/.test(message) || /\[worker\] Preparing run files\b/.test(message) || /\[worker\] Run files ready\b/.test(message) || /\[worker\] Runtime ready\b/.test(message) || /\[worker\] Sandbox (?:starting|create start|create done|workspace ready|upload start|runner uploaded)\b/.test(
+    message
+  ) || /^\[event\] play\.step\.progress\b/.test(message) || /^\[event\] play\.run\.snapshot\b/.test(message) || /^\[event\] play\.sheet\.summary\b/.test(message)) {
+    return "infra";
+  }
+  if (/^\[warn\]/i.test(message) || /^\[error\]/i.test(message) || /^\[runtime\.[a-z_]*(?:failure|error)\]/i.test(message)) {
+    return "diagnostic";
+  }
+  return "user";
+}
+function classifyLogLine(line) {
+  const tagged = readProvenanceTag(line);
+  const provenance = tagged.provenance ?? classifyLegacyLogLine(tagged.line);
+  if (tagged.provenance !== null) {
+    return {
+      provenance,
+      level: inferLogLevel(provenance, tagged.line),
+      line: tagged.line
+    };
+  }
   return {
-    startedAt,
-    completedAt,
-    updatedAt
+    provenance,
+    level: inferLogLevel(provenance, tagged.line),
+    line: tagged.line
   };
 }
-
-// ../play-runtime/run-failure.ts
-var PUBLIC_FAILURE_TEXT_BYTE_LIMIT = 64 * 1024;
-
-// ../play-runtime/log-context.ts
-var utf8 = new TextEncoder();
-
-// ../play-runtime/run-log-buffer.ts
-var RUNNER_LOG_MAX_BYTES = 5 * 1024 * 1024;
-var RUNNER_LOG_CONTEXT_MAX_BYTES = 128 * 1024;
-var TERMINAL_RESERVE_BYTES = 64 * 1024;
-var encoder = new TextEncoder();
-
-// ../play-runtime/secret-redaction.ts
-var SECRET_REDACTION_PLACEHOLDER = "[REDACTED_SECRET]";
-var BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
-var BASIC_CREDENTIAL_RE = /\bBasic\s+[A-Za-z0-9+/]{4,}={0,2}\b/g;
-var JWT_RE = /\b[A-Za-z0-9_-]{8,16384}\.[A-Za-z0-9_-]{1,16384}\.[A-Za-z0-9_-]{8,16384}\b/g;
-var EMAIL_LOCAL_CHAR_RE = /[A-Za-z0-9.!#$%&'*+/=?^_`{|}~-]/;
-var EMAIL_DOMAIN_RE = /^[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?\.[A-Za-z]{2,63}\b/;
-function isEmailLocalPart(value, start, end) {
-  let localStart = start;
-  while (localStart > 0 && EMAIL_LOCAL_CHAR_RE.test(value[localStart - 1])) {
-    localStart -= 1;
+function inferLogLevel(provenance, line) {
+  const message = stripLeadingTimestamp(line);
+  if (/^\[info\]/i.test(message)) {
+    return "info";
   }
-  let localEnd = end;
-  while (localEnd < value.length && EMAIL_LOCAL_CHAR_RE.test(value[localEnd])) {
-    localEnd += 1;
+  if (/^\[debug\]/i.test(message)) {
+    return "debug";
   }
-  return localStart < localEnd && localEnd - localStart <= 64 && value[localEnd] === "@" && EMAIL_DOMAIN_RE.test(value.slice(localEnd + 1));
+  if (/^\[console\.error\]/i.test(message) || /^\[error\]/i.test(message)) {
+    return "error";
+  }
+  if (/^\[console\.warn\]/i.test(message) || /^\[warn\]/i.test(message)) {
+    return "warn";
+  }
+  if (/^\[console\.debug\]/i.test(message)) {
+    return "debug";
+  }
+  if (provenance === "replay" || provenance === "infra" || provenance === "receipt") {
+    return "debug";
+  }
+  if (provenance === "diagnostic") {
+    return "warn";
+  }
+  return "info";
 }
-function redactTokenUnlessEmail(match, offset, source) {
-  return isEmailLocalPart(source, offset, offset + match.length) ? match : SECRET_REDACTION_PLACEHOLDER;
+function stripLeadingTimestamp(line) {
+  const match = line.match(/^\[([^\]]+)\]\s*([\s\S]*)$/);
+  if (!match) {
+    return line;
+  }
+  const inner = match[1] ?? "";
+  const isTimestamp = !Number.isNaN(new Date(inner).getTime());
+  return isTimestamp ? match[2] ?? line : line;
 }
-var PRIVATE_KEY_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
-var SENSITIVE_FIELD_NAME = "authorization|cookie|password|(?:client[_-]?)?secret|(?:access|refresh)[_-]?token|(?:x[_-]?)?api[_-]?key|private[_-]?key|token|credentials";
-var COMMON_SECRET_RE = /\b(?:[prs]k_(?:live|test)_|(?:pat|ghp|github_pat)_|xox[baprs]-)[A-Za-z0-9_./+=:-]{12,}\b/gi;
-var GENERIC_PREFIXED_SECRET_RE = /\b(?:key|token|secret|api[_-]?key)_[A-Za-z0-9_./+=:-]{12,}\b/gi;
-var URL_SECRET_VALUE_RE = /\b(?:[spr]k|pat|ghp|github_pat|xox)[A-Za-z0-9_./+=:-]{12,}\b/i;
-var GENERIC_SECRET_ASSIGNMENT_RE = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*["']?[^"',\s]{12,}["']?/gi;
-var HIGH_ENTROPY_ASSIGNMENT_RE = /\b(?:api[_-]?key|token|secret|password|authorization|(?:access|refresh)[_-]?token)\b\s*[:=]\s*["']?[^"',\s]{16,}["']?/gi;
-var SENSITIVE_URL_PARAM_RE = /[?#&](?:\w*(?:key|token)|secret|password|authorization|credential|signature|sig)(?:=|$)/i;
-var SENSITIVE_FIELD_NAME_RE = new RegExp(
-  `(^|[._-])(?:${SENSITIVE_FIELD_NAME})$`,
-  "i"
-);
-var SENSITIVE_FIELD_NAME_CACHE_MAX_ENTRIES = 4096;
-var sensitiveFieldNameCache = /* @__PURE__ */ new Map();
-function isSensitiveFieldName(key) {
-  const cached = sensitiveFieldNameCache.get(key);
-  if (cached !== void 0) return cached;
-  const sensitive = SENSITIVE_FIELD_NAME_RE.test(key);
-  if (sensitiveFieldNameCache.size >= SENSITIVE_FIELD_NAME_CACHE_MAX_ENTRIES) {
-    sensitiveFieldNameCache.clear();
+
+// src/runs/read-errors.ts
+function isTransientPlayRunReadError(error) {
+  if (error instanceof DeeplineError && error.code === "PLAY_STREAM_NETWORK_ABORTED") {
+    return true;
   }
-  sensitiveFieldNameCache.set(key, sensitive);
-  return sensitive;
+  if (error instanceof DeeplineError && typeof error.statusCode === "number") {
+    return error.statusCode >= 500 && error.statusCode < 600;
+  }
+  const text = error instanceof Error ? error.message : String(error);
+  return /auth validation backend timed out|coordinator \/submit(?:\?[^ ]*)? 5\d\d|Worker threw exception|Internal Server Error|Service Unavailable|fetch failed|eaddrnotavail|econnreset|etimedout|eai_again|socket hang up/i.test(
+    text
+  );
 }
-var SERIALIZED_SECRET_FIELD_RE = new RegExp(
-  `"(${SENSITIVE_FIELD_NAME})"\\s*:\\s*(?:"[^"\\\\]*"|\\{[^{}]*\\})`,
-  "gi"
-);
-function escapeRegExp(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+// src/runs/log-cursor.ts
+var RUN_LOGS_CURSOR_PREFIX = "before:";
+function encodeRunLogsCursor(beforeSequence) {
+  return `${RUN_LOGS_CURSOR_PREFIX}${beforeSequence}`;
 }
-var REDACTION_TRIGGER_RE = new RegExp(
-  [
-    // Sensitive field names, in object keys and in `name=`/`"name":` text.
-    "token",
-    "secret",
-    "password",
-    "authorization",
-    "cookie",
-    "credential",
-    // One `key` branch instead of `api[_-]?key`, `private[_-]?key` and `key_`.
-    // A regex alternation costs roughly one substring scan per branch, and a
-    // broader branch can only send more payloads down the exact path.
-    "key",
-    // Self-identifying credential prefixes.
-    "bearer",
-    "basic",
-    "-----BEGIN",
-    "xox[baprs]-",
-    "[prs]k_",
-    "pat_",
-    "ghp_",
-    // URL credentials: `//user:pass@host` userinfo and sensitive query params.
-    // The userinfo class excludes `/` exactly as the rule it guards does.
-    "//[^\\s/]{0,256}@",
-    "[?#&]sig",
-    // JWTs carry no keyword at all, so the shape itself is the marker. Anchor
-    // on the separating dot and drop JWT_RE's leading `{8,}` segment: a dot is
-    // rare enough for the engine to skip between candidates, which makes this
-    // gate roughly ten times cheaper than re-running JWT_RE itself, and
-    // dropping a required segment can only widen what it accepts.
-    "\\.[A-Za-z0-9_-]{1,16384}\\.[A-Za-z0-9_-]{8}"
-  ].join("|"),
-  "i"
-);
-function mightContainRedactableSecret(value) {
-  return REDACTION_TRIGGER_RE.test(value);
-}
-function redactSecretLikeString(value) {
-  if (!mightContainRedactableSecret(value)) return value;
-  const serializedRedacted = value.replace(
-    SERIALIZED_SECRET_FIELD_RE,
-    `"$1":"${SECRET_REDACTION_PLACEHOLDER}"`
-  );
-  const trimmed = serializedRedacted.trim();
-  if (/^https?:\/\/\S+$/i.test(trimmed)) {
-    if (/^https?:\/\/[^/?#@]+@/i.test(trimmed) || SENSITIVE_URL_PARAM_RE.test(trimmed)) {
-      return SECRET_REDACTION_PLACEHOLDER;
-    }
-    if (!URL_SECRET_VALUE_RE.test(serializedRedacted)) {
-      return serializedRedacted;
-    }
-  }
-  return serializedRedacted.replace(PRIVATE_KEY_RE, SECRET_REDACTION_PLACEHOLDER).replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`).replace(BASIC_CREDENTIAL_RE, `Basic ${SECRET_REDACTION_PLACEHOLDER}`).replace(JWT_RE, redactTokenUnlessEmail).replace(COMMON_SECRET_RE, redactTokenUnlessEmail).replace(GENERIC_PREFIXED_SECRET_RE, redactTokenUnlessEmail).replace(GENERIC_SECRET_ASSIGNMENT_RE, SECRET_REDACTION_PLACEHOLDER).replace(HIGH_ENTROPY_ASSIGNMENT_RE, (match) => {
-    const separator = match.includes("=") ? "=" : ":";
-    const [key] = match.split(separator, 1);
-    return `${key.trim()}${separator}${SECRET_REDACTION_PLACEHOLDER}`;
-  });
+function isRunLogsCursor(value) {
+  return value.startsWith(RUN_LOGS_CURSOR_PREFIX);
 }
-function createSecretRedactionContext(initialValues = []) {
-  const exactSecrets = /* @__PURE__ */ new Set();
-  const exactSecretMatchers = /* @__PURE__ */ new Map();
-  function register(value) {
-    if (value.length > 0) exactSecrets.add(value);
-  }
-  function matchersForSecret(secret) {
-    const cached = exactSecretMatchers.get(secret);
-    if (cached) return cached;
-    const literals = [secret];
-    try {
-      const encoded = encodeURIComponent(secret);
-      if (encoded !== secret) literals.push(encoded);
-    } catch {
-    }
-    const built = literals.map((literal) => ({
-      literal,
-      matcher: new RegExp(escapeRegExp(literal), "g")
-    }));
-    exactSecretMatchers.set(secret, built);
-    return built;
-  }
-  for (const value of initialValues) register(value);
-  function containsRegisteredSecret(value, {
-    includeEncoded = false,
-    minimumLength = 1
-  } = {}) {
-    for (const secret of exactSecrets) {
-      if (secret.length < minimumLength) continue;
-      if (value.includes(secret)) return true;
-      if (includeEncoded) {
-        try {
-          const encoded = encodeURIComponent(secret);
-          if (encoded !== secret && value.includes(encoded)) return true;
-        } catch {
-        }
-      }
-    }
-    return false;
-  }
-  function matchesRegisteredSecret(value) {
-    return exactSecrets.has(value);
-  }
-  function redactRegisteredSecrets(value) {
-    if (exactSecrets.size === 0) return value;
-    let output = value;
-    for (const secret of exactSecrets) {
-      for (const { literal, matcher } of matchersForSecret(secret)) {
-        if (!output.includes(literal)) continue;
-        matcher.lastIndex = 0;
-        output = output.replace(matcher, SECRET_REDACTION_PLACEHOLDER);
-      }
-    }
-    return output;
-  }
-  function redactString(value) {
-    const output = redactRegisteredSecrets(value);
-    return redactSecretLikeString(output);
-  }
-  function redact(value) {
-    if (typeof value === "string") return redactString(value);
-    if (Array.isArray(value)) {
-      let changed = false;
-      const next = new Array(value.length);
-      for (let index = 0; index < value.length; index += 1) {
-        const entry = value[index];
-        const redacted = redact(entry);
-        next[index] = redacted;
-        if (redacted !== entry) changed = true;
-      }
-      return changed ? next : value;
-    }
-    if (value && typeof value === "object") {
-      const prototype = Object.getPrototypeOf(value);
-      let changed = prototype !== Object.prototype && prototype !== null;
-      const source = value;
-      const keys = Object.keys(source);
-      const redactedValues = new Array(keys.length);
-      for (let index = 0; index < keys.length; index += 1) {
-        const key = keys[index];
-        const entry = source[key];
-        const redacted = isSensitiveFieldName(key) ? SECRET_REDACTION_PLACEHOLDER : redact(entry);
-        redactedValues[index] = redacted;
-        if (redacted !== entry) changed = true;
-      }
-      if (!changed) return value;
-      return Object.fromEntries(
-        keys.map((key, index) => [key, redactedValues[index]])
-      );
-    }
-    return value;
-  }
-  function redactKnownSecrets(value) {
-    if (typeof value === "string") return redactRegisteredSecrets(value);
-    if (Array.isArray(value)) {
-      return value.map((entry) => redactKnownSecrets(entry));
-    }
-    if (value && typeof value === "object") {
-      return Object.fromEntries(
-        Object.entries(value).map(([key, entry]) => [
-          key,
-          redactKnownSecrets(entry)
-        ])
-      );
-    }
-    return value;
+function parseRunLogsCursor(value) {
+  const raw = isRunLogsCursor(value) ? value.slice(RUN_LOGS_CURSOR_PREFIX.length) : "";
+  const parsed = /^[1-9]\d*$/.test(raw) ? Number(raw) : NaN;
+  if (!Number.isSafeInteger(parsed)) {
+    throw Object.assign(
+      new Error(
+        `Invalid run log cursor ${JSON.stringify(value)}. Pass the nextCursor value from a previous deepline runs logs result.`
+      ),
+      { exitCode: 2 }
+    );
   }
-  return {
-    register,
-    containsRegisteredSecret,
-    matchesRegisteredSecret,
-    redactRegisteredSecrets,
-    redactString,
-    redactKnownSecrets,
-    redact
-  };
+  return parsed;
 }
 
-// ../play-runtime/output-size-limits.ts
-var TERMINAL_RUN_RESULT_MAX_BYTES = 6 * 1024 * 1024;
-var LEDGER_TERMINAL_RESULT_MAX_BYTES = 256 * 1024;
-var CUSTOMER_OUTPUT_VALUE_MAX_BYTES = 5 * 1024 * 1024;
-var CUSTOMER_OUTPUT_TOTAL_MAX_BYTES = 5 * 1024 * 1024;
-var RUNTIME_RECEIPT_OUTPUT_MAX_BYTES = 10 * 1024 * 1024;
-var RUNTIME_RECEIPT_COMPLETION_BUFFER_MAX_BYTES = 32 * 1024 * 1024;
-var RUNTIME_RECEIPT_CONTROL_BUFFER_MAX_BYTES = 2 * 1024 * 1024;
-var RUNNER_TERMINAL_PUSH_MAX_BODY_BYTES = 16 * 1024 * 1024;
-var RUNTIME_RECEIPT_GATEWAY_BATCH_MAX_BYTES = 12 * 1024 * 1024;
-var RUNTIME_RECEIPT_WRITER_TARGET_BATCH_BYTES = 8 * 1024 * 1024;
-var RUNNER_POST_TERMINAL_DIAGNOSTIC_MAX_BYTES = 64 * 1024;
-var JSON_SIZE_LIMIT_REACHED = Symbol("JSON_SIZE_LIMIT_REACHED");
-
-// ../play-runtime/ledger-safe-payload.ts
-var ledgerIngressRedactor = createSecretRedactionContext();
-
-// ../play-runtime/docflow-node-io.ts
-var utf8Encoder = new TextEncoder();
-var PLAY_DATASET_BRAND = Symbol.for("deepline.play.dataset");
-
 // ../play-runtime/run-event-catalog.ts
 var RUN_EVENT_KIND = {
   runCreated: "run.created",
@@ -1458,1254 +1292,1420 @@ var RUN_EVENT_SEARCH_FALLBACK_KIND_SQL_LITERAL = sqlStringLiteral(
   RUN_EVENT_SEARCH_FALLBACK_KIND
 );
 
-// ../play-data-plane/runtime-sheet-orm.ts
-var RUNTIME_SHEET_CELL_META_COLUMN = {
-  name: "_cell_meta",
-  dataType: "jsonb",
-  nullable: "NO",
-  defaultSql: "'{}'::jsonb"
+// ../play-runtime/run-event-query.ts
+var stringField = { type: "string", nullable: false };
+var optionalString = { type: "string", nullable: true };
+var RUN_EVENT_QUERY_FIELD_CATALOG = {
+  eventId: stringField,
+  orgId: stringField,
+  runtimeScope: stringField,
+  runId: stringField,
+  playName: stringField,
+  kind: stringField,
+  source: optionalString,
+  occurredAt: { type: "timestamp", nullable: false },
+  status: optionalString,
+  level: { type: "level", nullable: true },
+  stepId: optionalString,
+  stepKind: optionalString,
+  datasetId: optionalString,
+  phase: optionalString,
+  provider: optionalString,
+  operation: optionalString,
+  producerAttempt: { type: "number", nullable: true }
 };
-var RUNTIME_SHEET_COLUMN_CONTRACTS = [
-  {
-    name: "_key",
-    sqlType: "text",
-    dataType: "text",
-    nullable: "NO",
-    defaultSql: null,
-    repairable: false,
-    requiresDefault: false
-  },
-  {
-    name: "_status",
-    sqlType: "text NOT NULL",
-    dataType: "text",
-    nullable: "NO",
-    defaultSql: null,
-    repairable: false,
-    requiresDefault: false
-  },
-  {
-    name: "_run_id",
-    sqlType: "text",
-    dataType: "text",
-    nullable: "YES",
-    defaultSql: null,
-    repairable: true,
-    requiresDefault: false
-  },
-  {
-    name: "_error",
-    sqlType: "text",
-    dataType: "text",
-    nullable: "YES",
-    defaultSql: null,
-    repairable: true,
-    requiresDefault: false
-  },
-  {
-    name: "_stage",
-    sqlType: "text",
-    dataType: "text",
-    nullable: "YES",
-    defaultSql: null,
-    repairable: true,
-    requiresDefault: false
-  },
-  {
-    name: "_provider",
-    sqlType: "text",
-    dataType: "text",
-    nullable: "YES",
-    defaultSql: null,
-    repairable: true,
-    requiresDefault: false
-  },
-  {
-    name: "_input_index",
-    sqlType: "bigint",
-    dataType: "bigint",
-    nullable: "YES",
-    defaultSql: null,
-    repairable: true,
-    requiresDefault: false
-  },
-  {
-    name: "_attempt_id",
-    sqlType: "text",
-    dataType: "text",
-    nullable: "YES",
-    defaultSql: null,
-    repairable: true,
-    requiresDefault: false
-  },
-  {
-    name: "_attempt_owner_run_id",
-    sqlType: "text",
-    dataType: "text",
-    nullable: "YES",
-    defaultSql: null,
-    repairable: true,
-    requiresDefault: false
-  },
-  {
-    name: "_attempt_expires_at",
-    sqlType: "timestamptz",
-    dataType: "timestamp with time zone",
-    nullable: "YES",
-    defaultSql: null,
-    repairable: true,
-    requiresDefault: false
-  },
-  {
-    name: "_attempt_seq",
-    sqlType: "integer",
-    dataType: "integer",
-    nullable: "YES",
-    defaultSql: null,
-    repairable: true,
-    requiresDefault: false
-  },
-  {
-    name: "_write_version",
-    sqlType: "bigint NOT NULL DEFAULT 0",
-    dataType: "bigint",
-    nullable: "NO",
-    defaultSql: "0",
-    repairable: true,
-    requiresDefault: true
-  },
-  {
-    name: "_writer_run_id",
-    sqlType: "text",
-    dataType: "text",
-    nullable: "YES",
-    defaultSql: null,
-    repairable: true,
-    requiresDefault: false
-  },
-  {
-    name: "_created_at",
-    sqlType: "timestamptz NOT NULL DEFAULT now()",
-    dataType: "timestamp with time zone",
-    nullable: "NO",
-    defaultSql: "now()",
-    repairable: true,
-    requiresDefault: true
-  },
-  {
-    name: "_updated_at",
-    sqlType: "timestamptz NOT NULL DEFAULT now()",
-    dataType: "timestamp with time zone",
-    nullable: "NO",
-    defaultSql: "now()",
-    repairable: true,
-    requiresDefault: true
-  },
-  {
-    name: "_version",
-    sqlType: "bigint NOT NULL",
-    dataType: "bigint",
-    nullable: "NO",
-    defaultSql: null,
-    defaultKind: "version_sequence",
-    repairable: true,
-    requiresDefault: true
-  },
-  {
-    ...RUNTIME_SHEET_CELL_META_COLUMN,
-    sqlType: `jsonb NOT NULL DEFAULT ${RUNTIME_SHEET_CELL_META_COLUMN.defaultSql}`,
-    repairable: true,
-    requiresDefault: true
-  }
-];
-var RUNTIME_SHEET_ATTEMPT_COLUMNS = RUNTIME_SHEET_COLUMN_CONTRACTS.filter(
-  (column) => column.name.startsWith("_attempt_")
-).map((column) => column.name);
-var RUNTIME_SHEET_WRITE_VERSION_COLUMNS = RUNTIME_SHEET_COLUMN_CONTRACTS.filter(
-  (column) => column.name === "_write_version" || column.name === "_writer_run_id"
-).map((column) => column.name);
-var RUNTIME_SHEET_TIMESTAMP_COLUMNS = RUNTIME_SHEET_COLUMN_CONTRACTS.filter(
-  (column) => column.name === "_created_at" || column.name === "_updated_at"
-).map((column) => column.name);
-var RUNTIME_SHEET_SYSTEM_COLUMNS = new Set(
-  RUNTIME_SHEET_COLUMN_CONTRACTS.map((column) => column.name)
-);
-var RUNTIME_SHEET_REPAIRABLE_COLUMNS = RUNTIME_SHEET_COLUMN_CONTRACTS.filter(
-  (column) => column.repairable
-);
-
-// ../play-runtime/run-ledger.ts
-var TERMINAL_STATUS_BY_EVENT_TYPE = {
-  [RUN_EVENT_KIND.runCompleted]: "completed",
-  [RUN_EVENT_KIND.runFailed]: "failed",
-  [RUN_EVENT_KIND.runCancelled]: "cancelled"
-};
-
-// ../play-runtime/log-provenance.ts
-var LOG_LEVELS = [
-  "debug",
-  "info",
-  "warn",
-  "error"
-];
-var LOG_LEVEL_RANK = {
-  debug: 0,
-  info: 1,
-  warn: 2,
-  error: 3
-};
-var LOG_PROVENANCE_CLASSES = [
-  "user",
-  "lifecycle",
-  "replay",
-  "infra",
-  "diagnostic",
-  "receipt"
+var RUN_EVENT_QUERY_RETENTION_MS = 7 * 864e5;
+var RUN_EVENT_QUERY_MAX_LIMIT = 200;
+var RUN_EVENT_QUERY_MAX_PAYLOAD_LIMIT = 10;
+var RUN_EVENT_QUERY_MAX_CURSOR_BYTES = 48 * 1024;
+var RUN_EVENT_QUERY_MAX_REQUEST_BYTES = 64 * 1024;
+var MAX_BYTES = 8192;
+var MAX_DEPTH = 8;
+var MAX_PREDICATES = 64;
+var OPERATORS = [
+  "eq",
+  "ne",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "exists",
+  "in"
 ];
-var LOG_PROVENANCE_POLICY = {
-  user: { watch: true, ui: true, debug: true },
-  lifecycle: { watch: true, ui: true, debug: true },
-  replay: { watch: false, ui: false, debug: true },
-  infra: { watch: false, ui: false, debug: true },
-  diagnostic: { watch: true, ui: true, debug: true },
-  receipt: { watch: false, ui: false, debug: true }
+var RunEventQueryInputError = class extends TypeError {
+  constructor(message, code = "invalid_run_event_query") {
+    super(message);
+    this.code = code;
+    this.name = "RunEventQueryInputError";
+  }
 };
-function logProvenanceReaches(provenance, surface) {
-  return LOG_PROVENANCE_POLICY[provenance][surface];
-}
-var PROVENANCE_SENTINEL = "
";
-var PROVENANCE_PREFIX = `${PROVENANCE_SENTINEL}prov:`;
-function logLevelReaches(level, minimum) {
-  return LOG_LEVEL_RANK[level] >= LOG_LEVEL_RANK[minimum];
-}
-function parseLogLevel(value) {
-  const normalized = value.trim().toLowerCase();
-  return LOG_LEVELS.includes(normalized) ? normalized : null;
+function fail(message) {
+  throw new RunEventQueryInputError(message);
 }
-function readProvenanceTag(line) {
-  if (!line.startsWith(PROVENANCE_PREFIX)) {
-    return { provenance: null, line };
-  }
-  const end = line.indexOf(PROVENANCE_SENTINEL, PROVENANCE_PREFIX.length);
-  if (end === -1) {
-    return { provenance: null, line };
-  }
-  const candidate = line.slice(PROVENANCE_PREFIX.length, end);
-  const provenance = LOG_PROVENANCE_CLASSES.includes(candidate) ? candidate : null;
-  return { provenance, line: line.slice(end + 1) };
+function object(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
 }
-function classifyLegacyLogLine(line) {
-  const message = stripLeadingTimestamp(line);
-  if (/recovered (?:from checkpoint|response from checkpoint)/i.test(message)) {
-    return "replay";
-  }
-  if (/^\[perf\] runtime receipt\b/i.test(message)) {
-    return "receipt";
-  }
-  if (/^\[perf\]/i.test(message) || /^\[runtime\.(?:phase_summary|logs|log_transport)\]/i.test(message) || /\[worker\] picked up run\b/.test(message) || /\[worker\] heartbeat\b/.test(message) || /\[worker\] progress completedRows=\d+ totalRows=\d+ rowUpdates=\d+/.test(
-    message
-  ) || /\[worker\] step started\b/.test(message) || /\[worker\] Preparing run files\b/.test(message) || /\[worker\] Run files ready\b/.test(message) || /\[worker\] Runtime ready\b/.test(message) || /\[worker\] Sandbox (?:starting|create start|create done|workspace ready|upload start|runner uploaded)\b/.test(
-    message
-  ) || /^\[event\] play\.step\.progress\b/.test(message) || /^\[event\] play\.run\.snapshot\b/.test(message) || /^\[event\] play\.sheet\.summary\b/.test(message)) {
-    return "infra";
-  }
-  if (/^\[warn\]/i.test(message) || /^\[error\]/i.test(message) || /^\[runtime\.[a-z_]*(?:failure|error)\]/i.test(message)) {
-    return "diagnostic";
+function bounded(value, maxBytes = MAX_BYTES) {
+  let encoded;
+  try {
+    encoded = JSON.stringify(value);
+  } catch {
+    fail("Run event query must be bounded JSON without cycles.");
   }
-  return "user";
+  if (!encoded || new TextEncoder().encode(encoded).length > maxBytes)
+    fail(`Run event query exceeds ${maxBytes} bytes.`);
 }
-function classifyLogLine(line) {
-  const tagged = readProvenanceTag(line);
-  const provenance = tagged.provenance ?? classifyLegacyLogLine(tagged.line);
-  if (tagged.provenance !== null) {
-    return {
-      provenance,
-      level: inferLogLevel(provenance, tagged.line),
-      line: tagged.line
-    };
-  }
-  return {
-    provenance,
-    level: inferLogLevel(provenance, tagged.line),
-    line: tagged.line
+function validateRunEventField(value) {
+  if (typeof value !== "string") fail("Run event field must be a string.");
+  const field = value.startsWith("$.") ? value.slice(2) : value;
+  if (Object.prototype.hasOwnProperty.call(RUN_EVENT_QUERY_FIELD_CATALOG, field))
+    return field;
+  if (/^context\.[A-Za-z_][A-Za-z0-9_]{0,63}$/.test(field) && !["__proto__", "prototype", "constructor"].includes(field.slice(8)))
+    return field;
+  const alternatives = {
+    step: "stepId",
+    severity: "level",
+    timestamp: "occurredAt",
+    play: "playName",
+    run: "runId",
+    attempt: "producerAttempt"
   };
+  fail(
+    `Unsupported run event field: ${field}. Use ${alternatives[field] ?? "a catalog field or context.<key>"}; call fields() for supported fields.`
+  );
 }
-function inferLogLevel(provenance, line) {
-  const message = stripLeadingTimestamp(line);
-  if (/^\[info\]/i.test(message)) {
-    return "info";
-  }
-  if (/^\[debug\]/i.test(message)) {
-    return "debug";
-  }
-  if (/^\[console\.error\]/i.test(message) || /^\[error\]/i.test(message)) {
-    return "error";
-  }
-  if (/^\[console\.warn\]/i.test(message) || /^\[warn\]/i.test(message)) {
-    return "warn";
-  }
-  if (/^\[console\.debug\]/i.test(message)) {
-    return "debug";
-  }
-  if (provenance === "replay" || provenance === "infra" || provenance === "receipt") {
-    return "debug";
-  }
-  if (provenance === "diagnostic") {
-    return "warn";
+function scalar(field, value, op) {
+  if (value !== null && typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean")
+    fail(`Run event ${field} requires a JSON scalar.`);
+  if (typeof value === "number" && !Number.isFinite(value))
+    fail(`Run event ${field} requires a finite number.`);
+  if (typeof value === "string" && new TextEncoder().encode(value).length > 1024)
+    fail(`Run event ${field} value exceeds 1024 bytes.`);
+  const descriptor = RUN_EVENT_QUERY_FIELD_CATALOG[field];
+  if (descriptor) {
+    if (value === null) {
+      if (!descriptor.nullable) fail(`Run event ${field} cannot be null.`);
+    } else if (descriptor.type === "number") {
+      if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 1)
+        fail(`Run event ${field} requires a positive integer.`);
+    } else if (typeof value !== "string")
+      fail(`Run event ${field} requires a string.`);
+    else if (descriptor.type === "level" && !RUN_LOG_LEVELS.includes(value))
+      fail("Run event level requires debug, info, warn or error.");
+    else if (descriptor.type === "timestamp") {
+      value = normalizeRunEventQueryTimestamp(value);
+    }
   }
-  return "info";
+  if (["gt", "gte", "lt", "lte"].includes(op) && (value === null || typeof value === "boolean"))
+    fail(`Run event ${op} requires a string or number.`);
+  return value;
 }
-function stripLeadingTimestamp(line) {
-  const match = line.match(/^\[([^\]]+)\]\s*([\s\S]*)$/);
-  if (!match) {
-    return line;
+function comparison(field, op, value) {
+  if (!OPERATORS.includes(op))
+    fail(`Unsupported run event operator: ${op}. Use ${OPERATORS.join(", ")}.`);
+  if (op === "exists") {
+    if (typeof value !== "boolean")
+      fail("Run event exists requires a boolean.");
+    return { field, op, value };
+  }
+  if (op === "in") {
+    if (!Array.isArray(value) || value.length < 1 || value.length > 32)
+      fail("Run event in requires between 1 and 32 scalars.");
+    return { field, op, value: value.map((item) => scalar(field, item, "eq")) };
   }
-  const inner = match[1] ?? "";
-  const isTimestamp = !Number.isNaN(new Date(inner).getTime());
-  return isTimestamp ? match[2] ?? line : line;
-}
-
-// ../play-runtime/run-snapshot-stream.ts
-function isTerminalPlayRunLiveStatus(status) {
-  return isTerminalPlayRunLifecycleStatus(status);
-}
-function makeRunStreamEvent(input) {
   return {
-    ...input,
-    scope: "play",
-    at: input.at ?? (/* @__PURE__ */ new Date()).toISOString()
+    field,
+    op,
+    value: scalar(field, value, op)
   };
 }
-var EMPTY_PLAY_RUN_STREAM_DIFF_STATE = {
-  runSignature: "",
-  snapshotSignature: "",
-  stepStatusSignature: "",
-  stepProgressSignature: "",
-  lastLogSeq: 0
-};
-function getSnapshotCursor(snapshot) {
-  return String(snapshot.updatedAt ?? Date.now());
+function admitObject(input, depth = 0, budget = { count: 0 }) {
+  if (depth > MAX_DEPTH) fail("Run event where exceeds depth 8.");
+  if (!object(input) || !Object.keys(input).length)
+    fail("Run event where requires a nonempty object.");
+  const terms = [];
+  const fieldTerms = (raw, filter) => {
+    const field = validateRunEventField(raw);
+    const operators = object(filter) ? Object.entries(filter) : [["eq", filter]];
+    if (!operators.length)
+      fail(`Run event ${field} has an empty operator object.`);
+    for (const [op, value] of operators) {
+      if (++budget.count > MAX_PREDICATES)
+        fail("Run event where exceeds 64 predicates.");
+      terms.push(comparison(field, op, value));
+    }
+  };
+  for (const [key, filter] of Object.entries(input)) {
+    if (key === "and" || key === "or") {
+      if (!Array.isArray(filter) || filter.length < 1 || filter.length > MAX_PREDICATES)
+        fail(`Run event ${key} requires a nonempty bounded array.`);
+      const children = filter.map(
+        (item) => admitObject(item, depth + 1, budget)
+      );
+      terms.push(key === "and" ? { and: children } : { or: children });
+    } else if (key === "context") {
+      if (!object(filter) || !Object.keys(filter).length)
+        fail("Run event context requires flat scalar fields.");
+      for (const [contextKey, value] of Object.entries(filter))
+        fieldTerms(`context.${contextKey}`, value);
+    } else fieldTerms(key, filter);
+  }
+  return terms.length === 1 ? terms[0] : { and: terms };
 }
-function getRunSignature(snapshot) {
-  return [snapshot.runId, snapshot.status, snapshot.updatedAt ?? 0].join(":");
+function compact(predicate) {
+  if ("and" in predicate) {
+    const merged = {};
+    for (const term of predicate.and) {
+      const child = compact(term);
+      for (const [key, value] of Object.entries(child)) {
+        if (key === "and") return { and: predicate.and.map(compact) };
+        if (key === "context") {
+          const context = merged.context ?? {};
+          for (const [name, filter2] of Object.entries(value)) {
+            if (Object.prototype.hasOwnProperty.call(context, name)) {
+              const combined = combineFilters(context[name], filter2);
+              if (!combined) return { and: predicate.and.map(compact) };
+              context[name] = combined;
+            } else context[name] = filter2;
+          }
+          merged.context = context;
+        } else if (Object.prototype.hasOwnProperty.call(merged, key)) {
+          const combined = key === "or" ? void 0 : combineFilters(merged[key], value);
+          if (!combined) return { and: predicate.and.map(compact) };
+          merged[key] = combined;
+        } else merged[key] = value;
+      }
+    }
+    return merged;
+  }
+  if ("or" in predicate) return { or: predicate.or.map(compact) };
+  const filter = predicate.op === "eq" ? predicate.value : { [predicate.op]: predicate.value };
+  if (predicate.field.startsWith("context."))
+    return { context: { [predicate.field.slice(8)]: filter } };
+  return { [predicate.field]: filter };
 }
-function getStepStatusSignature(snapshot) {
-  return snapshot.nodeStates.map(
-    (state) => [
-      state.nodeId,
-      state.status,
-      state.artifactTableNamespace ?? "",
-      state.startedAt ?? "",
-      state.completedAt ?? "",
-      state.progress?.startedAt ?? "",
-      state.progress?.completedAt ?? "",
-      state.updatedAt ?? "",
-      state.progress?.updatedAt ?? ""
-    ].join(":")
-  ).join("|");
+function combineFilters(left, right) {
+  const first = object(left) ? left : { eq: left };
+  const second = object(right) ? right : { eq: right };
+  if (Object.keys(first).some(
+    (key) => Object.prototype.hasOwnProperty.call(second, key)
+  ))
+    return void 0;
+  return { ...first, ...second };
 }
-function getStepProgressSignature(snapshot) {
-  return JSON.stringify(
-    snapshot.nodeStates.map((state) => [
-      state.nodeId,
-      projectPlayStepProgressCounters(state.progress ?? {}),
-      state.progress?.artifactTableNamespace ?? "",
-      state.progress?.startedAt ?? "",
-      state.progress?.completedAt ?? "",
-      state.progress?.updatedAt ?? "",
-      state.progress?.message ?? ""
-    ])
+function canonical(predicate) {
+  if ("field" in predicate) return predicate;
+  const operator = "and" in predicate ? "and" : "or";
+  const source = "and" in predicate ? predicate.and : predicate.or;
+  const terms = source.map(canonical).flatMap((term) => {
+    if (operator === "and" && "and" in term) return term.and;
+    if (operator === "or" && "or" in term) return term.or;
+    return [term];
+  });
+  terms.sort((a, b) => JSON.stringify(a).localeCompare(JSON.stringify(b)));
+  const unique = terms.filter(
+    (term, i) => i === 0 || JSON.stringify(term) !== JSON.stringify(terms[i - 1])
   );
+  if (unique.length === 1) return unique[0];
+  return operator === "and" ? { and: unique } : { or: unique };
 }
-function getSnapshotSignature(snapshot) {
-  return JSON.stringify(snapshot);
-}
-function resolvePlayRunLogGap(snapshot, lastLogSeq) {
-  if (snapshot.totalLogCount <= lastLogSeq) {
-    return null;
-  }
-  const tailFirstSeq = snapshot.totalLogCount - snapshot.logs.length + 1;
-  if (lastLogSeq + 1 >= tailFirstSeq) {
-    return null;
-  }
-  return {
-    missingCount: tailFirstSeq - 1 - lastLogSeq,
-    tailFirstSeq
+function parseDsl(input) {
+  let position = 0;
+  let count = 0;
+  const skip = () => {
+    while (/\s/.test(input[position] ?? "") && position < input.length)
+      position++;
   };
-}
-function diffLogLines(input) {
-  const { logs, totalLogCount } = input.snapshot;
-  if (input.snapshot.logsUnavailable) {
-    return {
-      lines: [],
-      lastLogSeq: input.lastLogSeq,
-      firstSeq: null
-    };
-  }
-  if (totalLogCount <= input.lastLogSeq) {
-    return { lines: [], lastLogSeq: input.lastLogSeq, firstSeq: null };
-  }
-  const tailFirstSeq = totalLogCount - logs.length + 1;
-  if (input.lastLogSeq + 1 >= tailFirstSeq) {
-    return {
-      lines: logs.slice(input.lastLogSeq + 1 - tailFirstSeq),
-      lastLogSeq: totalLogCount,
-      firstSeq: input.lastLogSeq + 1
-    };
-  }
-  const missingCount = tailFirstSeq - 1 - input.lastLogSeq;
-  return {
-    lines: [
-      `[watch] ${missingCount} log lines not retained in the live window; full logs via runs logs`,
-      ...logs
-    ],
-    lastLogSeq: totalLogCount,
-    firstSeq: null
-  };
-}
-function diffPlayRunStreamEvents(input) {
-  const { snapshot, streamId, previous } = input;
-  const cursor = getSnapshotCursor(snapshot);
-  const logDiff = diffLogLines({
-    snapshot,
-    lastLogSeq: previous.lastLogSeq
-  });
-  const next = {
-    runSignature: getRunSignature(snapshot),
-    stepStatusSignature: getStepStatusSignature(snapshot),
-    stepProgressSignature: getStepProgressSignature(snapshot),
-    snapshotSignature: getSnapshotSignature(snapshot),
-    lastLogSeq: logDiff.lastLogSeq
+  const take = (token) => {
+    skip();
+    if (input.startsWith(token, position)) {
+      position += token.length;
+      return true;
+    }
+    return false;
   };
-  const events = [];
-  if (next.stepStatusSignature !== previous.stepStatusSignature) {
-    for (const state of snapshot.nodeStates) {
-      if (state.status === "idle") {
-        continue;
+  const json = () => {
+    skip();
+    const start = position;
+    if (input[position] === '"') {
+      position++;
+      let closed = false;
+      while (position < input.length) {
+        const char = input[position++];
+        if (char === "\\") position++;
+        else if (char === '"') {
+          closed = true;
+          break;
+        }
       }
-      const persistedStartedAt = state.startedAt ?? state.progress?.startedAt ?? null;
-      const persistedCompletedAt = state.completedAt ?? state.progress?.completedAt ?? null;
-      events.push(
-        makeRunStreamEvent({
-          cursor,
-          streamId,
-          type: "play.step.status",
-          payload: {
-            runId: snapshot.runId,
-            stepId: state.nodeId,
-            status: state.status,
-            artifactTableNamespace: state.artifactTableNamespace ?? null,
-            ...resolveTimingWindow({
-              startedAt: persistedStartedAt,
-              completedAt: persistedCompletedAt,
-              updatedAt: state.updatedAt ?? state.progress?.updatedAt ?? snapshot.updatedAt ?? null
-            })
-          }
-        })
+      if (!closed) fail("Run event DSL has an unterminated JSON string.");
+    } else {
+      const match = /^(?:true|false|null|-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?)/.exec(
+        input.slice(position)
       );
+      if (!match)
+        fail("Run event DSL requires a JSON quoted string or scalar.");
+      position += match[0].length;
     }
-  }
-  if (next.stepProgressSignature !== previous.stepProgressSignature) {
-    for (const state of snapshot.nodeStates) {
-      if (!state.progress) {
-        continue;
+    try {
+      return JSON.parse(input.slice(start, position));
+    } catch {
+      fail("Run event DSL requires valid JSON scalars.");
+    }
+  };
+  const term = (depth) => {
+    if (depth > MAX_DEPTH) fail("Run event where exceeds depth 8.");
+    if (take("(")) {
+      const nested = or(depth + 1);
+      if (!take(")")) fail("Run event DSL is missing a closing parenthesis.");
+      return nested;
+    }
+    skip();
+    const match = /^(?:\$\.)?[A-Za-z_][A-Za-z0-9_.]*/.exec(
+      input.slice(position)
+    );
+    if (!match) fail("Run event DSL requires a supported field.");
+    position += match[0].length;
+    const field = validateRunEventField(match[0]);
+    if (++count > MAX_PREDICATES)
+      fail("Run event where exceeds 64 predicates.");
+    skip();
+    const operation = /^(==|!=|>=|<=|>|<|\b(?:eq|ne|gte|gt|lte|lt|in|exists)\b)/.exec(
+      input.slice(position)
+    );
+    if (!operation) {
+      const token = /^(?:[=!<>~]+|[A-Za-z_]+)/.exec(input.slice(position))?.[0] ?? input[position] ?? "<end>";
+      if (token === "=") {
+        const corrected = `${input.slice(0, position)}==${input.slice(position + 1)}`;
+        fail(
+          `Run event DSL does not support "=" at character ${position + 1}. For equality, replace this "=" with "==": ${JSON.stringify(corrected)}.`
+        );
       }
-      events.push(
-        makeRunStreamEvent({
-          cursor: String(
-            state.progress.updatedAt ?? snapshot.updatedAt ?? Date.now()
-          ),
-          streamId,
-          type: "play.step.progress",
-          payload: {
-            runId: snapshot.runId,
-            stepId: state.nodeId,
-            ...projectPlayStepProgressCounters(state.progress),
-            message: state.progress.message,
-            artifactTableNamespace: state.progress.artifactTableNamespace ?? state.artifactTableNamespace ?? null,
-            ...resolveTimingWindow({
-              startedAt: state.startedAt ?? state.progress.startedAt ?? null,
-              completedAt: state.completedAt ?? state.progress.completedAt ?? null,
-              updatedAt: state.progress.updatedAt ?? snapshot.updatedAt ?? null
-            })
-          }
-        })
+      fail(
+        `Run event DSL does not support ${JSON.stringify(token)} after ${JSON.stringify(match[0])} at character ${position + 1}. Use ==, !=, >, >=, <, <=, in or exists.`
       );
     }
-  }
-  if (logDiff.lines.length > 0) {
-    events.push(
-      makeRunStreamEvent({
-        cursor,
-        streamId,
-        type: "play.run.log",
-        payload: {
-          runId: snapshot.runId,
-          lines: logDiff.lines,
-          source: "worker",
-          ...logDiff.firstSeq !== null ? { firstSeq: logDiff.firstSeq } : {},
-          totalLogCount: snapshot.totalLogCount
-        }
-      })
+    position += operation[0].length;
+    const symbols = {
+      "==": "eq",
+      "!=": "ne",
+      ">=": "gte",
+      "<=": "lte",
+      ">": "gt",
+      "<": "lt"
+    };
+    const op = symbols[operation[0]] ?? operation[0];
+    if (op === "in") {
+      if (!take("[")) fail("Run event DSL in requires a JSON scalar array.");
+      const values = [];
+      if (!take("]")) {
+        do {
+          values.push(json());
+          if (values.length > 32)
+            fail("Run event in requires between 1 and 32 scalars.");
+        } while (take(","));
+        if (!take("]")) fail("Run event DSL in requires a closing bracket.");
+      }
+      return comparison(field, op, values);
+    }
+    return comparison(field, op, json());
+  };
+  const and = (depth) => {
+    const terms = [term(depth)];
+    while (take("&&")) terms.push(term(depth));
+    return terms.length === 1 ? terms[0] : { and: terms };
+  };
+  const or = (depth) => {
+    const terms = [and(depth)];
+    while (take("||")) terms.push(and(depth));
+    return terms.length === 1 ? terms[0] : { or: terms };
+  };
+  const result = or(0);
+  skip();
+  if (position !== input.length)
+    fail(`Run event DSL has unsupported input at position ${position}.`);
+  return result;
+}
+function parseRunEventWhere(input) {
+  bounded(input);
+  const where = compact(
+    canonical(typeof input === "string" ? parseDsl(input) : admitObject(input))
+  );
+  bounded(where);
+  return where;
+}
+function normalizeRunEventQueryTimestamp(value) {
+  let extraMicros = "";
+  if (typeof value === "string") {
+    const timestamp = /^[+-]?\d{4,6}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.(\d{1,6}))?(?:Z|[+-]\d{2}:\d{2})$/.exec(
+      value
     );
+    if (!timestamp)
+      fail(
+        "Run event time bounds require an ISO timestamp with a timezone and at most six fractional digits."
+      );
+    extraMicros = (timestamp[1] ?? "").padEnd(6, "0").slice(3);
   }
-  if (next.snapshotSignature !== previous.snapshotSignature) {
-    const enrichedNodeStates = snapshot.nodeStates.map((state) => {
-      const timing = resolveTimingWindow({
-        startedAt: state.startedAt ?? state.progress?.startedAt ?? null,
-        completedAt: state.completedAt ?? state.progress?.completedAt ?? null,
-        updatedAt: state.updatedAt ?? state.progress?.updatedAt ?? snapshot.updatedAt ?? null
-      });
-      return {
-        ...state,
-        ...timing,
-        progress: state.progress ? {
-          ...state.progress,
-          ...resolveTimingWindow({
-            startedAt: state.progress.startedAt ?? state.startedAt ?? null,
-            completedAt: state.progress.completedAt ?? state.completedAt ?? null,
-            updatedAt: state.progress.updatedAt ?? state.updatedAt ?? snapshot.updatedAt ?? null
-          })
-        } : state.progress
+  const date = new Date(value);
+  if (!Number.isFinite(date.getTime()))
+    fail("Run event time bound is invalid.");
+  const canonical2 = date.toISOString();
+  return /[1-9]/.test(extraMicros) ? canonical2.replace(/Z$/, `${extraMicros}Z`) : canonical2;
+}
+function timestampMicros(value) {
+  const fraction = /\.(\d+)Z$/.exec(value)?.[1] ?? "";
+  return BigInt(Date.parse(value)) * BigInt(1e3) + BigInt(fraction.padEnd(6, "0").slice(3));
+}
+function time(value, nowMs, fallback) {
+  if (value === void 0) value = fallback;
+  let timestamp;
+  if (typeof value === "number") timestamp = value;
+  else if (typeof value === "string") {
+    const relative = /^(\d+(?:\.\d+)?)(ms|s|m|h|d)$/.exec(value);
+    if (relative) {
+      const units = {
+        ms: 1,
+        s: 1e3,
+        m: 6e4,
+        h: 36e5,
+        d: 864e5
       };
-    });
-    events.push(
-      makeRunStreamEvent({
-        cursor,
-        streamId,
-        type: "play.run.snapshot",
-        payload: { ...snapshot, nodeStates: enrichedNodeStates }
-      })
+      timestamp = nowMs - Number(relative[1]) * units[relative[2]];
+    } else {
+      return normalizeRunEventQueryTimestamp(value);
+    }
+  } else fail("Run event time bounds require a timestamp or duration.");
+  return normalizeRunEventQueryTimestamp(timestamp);
+}
+function exact(value, name) {
+  if (typeof value !== "string" || !value.trim() || value.length > 256)
+    fail(
+      `Run event ${name} requires a nonempty string of at most 256 characters.`
     );
+  return value;
+}
+var CRITERIA_KEYS = [
+  "since",
+  "until",
+  "where",
+  "runId",
+  "stepId",
+  "minLevel",
+  "text",
+  "playName",
+  "kind"
+];
+function normalizeRunEventQuery(criteria, nowMs = Date.now()) {
+  if (!object(criteria)) fail("Run event criteria requires an object.");
+  bounded(criteria, RUN_EVENT_QUERY_MAX_REQUEST_BYTES);
+  for (const key of Object.keys(criteria)) {
+    if (!CRITERIA_KEYS.includes(key))
+      fail(`Unsupported run event criterion: ${key}.`);
   }
-  if (next.runSignature !== previous.runSignature) {
-    events.push(
-      makeRunStreamEvent({
-        cursor,
-        streamId,
-        type: "play.run.status",
-        payload: {
-          runId: snapshot.runId,
-          status: snapshot.status,
-          updatedAt: snapshot.updatedAt,
-          ...snapshot.activity ? { activity: snapshot.activity } : {}
-        }
-      })
-    );
+  const until = time(criteria.until, nowMs, nowMs);
+  const since = time(criteria.since, nowMs, Date.parse(until) - 36e5);
+  if (timestampMicros(since) >= timestampMicros(until) || timestampMicros(until) - timestampMicros(since) > BigInt(RUN_EVENT_QUERY_RETENTION_MS) * BigInt(1e3))
+    fail("Run event query requires a window of at most seven days.");
+  const query = { since, until };
+  if (criteria.where !== void 0)
+    query.where = parseRunEventWhere(criteria.where);
+  for (const name of ["runId", "stepId", "playName", "kind"]) {
+    if (criteria[name] !== void 0) query[name] = exact(criteria[name], name);
   }
-  return { events, next };
-}
-
-// src/runs/read-errors.ts
-function isTransientPlayRunReadError(error) {
-  if (error instanceof DeeplineError && error.code === "PLAY_STREAM_NETWORK_ABORTED") {
-    return true;
+  if (criteria.minLevel !== void 0) {
+    if (!RUN_LOG_LEVELS.includes(criteria.minLevel))
+      fail("Run event minLevel requires debug, info, warn or error.");
+    query.minLevel = criteria.minLevel;
   }
-  if (error instanceof DeeplineError && typeof error.statusCode === "number") {
-    return error.statusCode >= 500 && error.statusCode < 600;
+  if (criteria.text !== void 0) {
+    if (typeof criteria.text !== "string" || !criteria.text.length || new TextEncoder().encode(criteria.text).length > 1024)
+      fail("Run event text requires between 1 and 1024 bytes.");
+    query.text = criteria.text;
   }
-  const text = error instanceof Error ? error.message : String(error);
-  return /auth validation backend timed out|coordinator \/submit(?:\?[^ ]*)? 5\d\d|Worker threw exception|Internal Server Error|Service Unavailable|fetch failed|eaddrnotavail|econnreset|etimedout|eai_again|socket hang up/i.test(
-    text
-  );
+  return query;
 }
-
-// src/runs/watch-polling.ts
-var RUN_WATCH_POLL_INTERVAL_MS = 2e3;
-function waitForNextPoll(ms, signal) {
-  if (signal?.aborted) {
-    return Promise.resolve(false);
+function normalizeRunEventOperationRequest(input, nowMs = Date.now()) {
+  bounded(input, RUN_EVENT_QUERY_MAX_REQUEST_BYTES);
+  if (!object(input)) fail("Run event operation requires an object.");
+  const operation = input.operation;
+  if (!["list", "count", "summarize", "fields"].includes(String(operation)))
+    fail("Run event operation requires list, count, summarize or fields.");
+  if (input.resource !== "logs" && input.resource !== "events")
+    fail("Run event resource requires logs or events.");
+  const allowed = [
+    "operation",
+    "resource",
+    "runId",
+    ...operation === "fields" ? [] : CRITERIA_KEYS,
+    ...operation === "list" ? ["limit", "cursor", "includePayloads"] : operation === "summarize" ? ["groupBy", "measures", "limit", "cursor"] : []
+  ];
+  for (const key of Object.keys(input)) {
+    if (!allowed.includes(key))
+      fail(`Run event ${operation} does not support ${key}.`);
   }
-  return new Promise((resolve) => {
-    const finish = (elapsed) => {
-      clearTimeout(timeout);
-      signal?.removeEventListener("abort", onAbort);
-      resolve(elapsed);
+  const base = {
+    operation,
+    resource: input.resource,
+    ...input.runId === void 0 ? {} : { runId: exact(input.runId, "runId") }
+  };
+  if (operation === "fields") return base;
+  if (input.resource === "logs" && !base.runId)
+    fail("Run event logs require runId.");
+  if (input.cursor !== void 0 && (typeof input.cursor !== "string" || !input.cursor.length || input.cursor.length > RUN_EVENT_QUERY_MAX_CURSOR_BYTES))
+    fail("Run event cursor is invalid.");
+  const rawCriteria = Object.fromEntries(
+    Object.entries(input).filter(
+      ([key]) => CRITERIA_KEYS.includes(key) && (key !== "runId" || input.resource === "events")
+    )
+  );
+  const query = normalizeRunEventQuery(
+    input.cursor === void 0 ? rawCriteria : { ...rawCriteria, since: nowMs - 36e5, until: nowMs },
+    nowMs
+  );
+  const criteria = { ...query };
+  if (input.cursor !== void 0) {
+    if (input.since === void 0) delete criteria.since;
+    else criteria.since = time(input.since, nowMs, nowMs - 36e5);
+    if (input.until === void 0) delete criteria.until;
+    else criteria.until = time(input.until, nowMs, nowMs);
+  }
+  if (operation === "count")
+    return { ...base, ...criteria };
+  const limit = input.limit ?? (input.includePayloads === true ? 10 : 50);
+  if (!Number.isSafeInteger(limit) || limit < 1 || limit > RUN_EVENT_QUERY_MAX_LIMIT)
+    fail("Run event limit must be between 1 and 200.");
+  const page = {
+    limit,
+    ...input.cursor === void 0 ? {} : { cursor: input.cursor }
+  };
+  if (operation === "list") {
+    if (input.includePayloads !== void 0 && typeof input.includePayloads !== "boolean")
+      fail("Run event includePayloads requires a boolean.");
+    if (input.includePayloads === true && limit > RUN_EVENT_QUERY_MAX_PAYLOAD_LIMIT)
+      fail("Run event payload pages cannot exceed 10 rows.");
+    return {
+      ...base,
+      ...criteria,
+      ...page,
+      ...input.includePayloads === void 0 ? {} : { includePayloads: input.includePayloads }
     };
-    const onAbort = () => finish(false);
-    const timeout = setTimeout(() => finish(true), ms);
-    signal?.addEventListener("abort", onAbort, { once: true });
+  }
+  if (!Array.isArray(input.groupBy) || input.groupBy.length > 4)
+    fail("Run event groupBy requires at most four fields.");
+  const groupBy = input.groupBy.map(validateRunEventField);
+  if (new Set(groupBy).size !== groupBy.length)
+    fail("Run event groupBy fields must be distinct.");
+  const rawMeasures = input.measures ?? [{ op: "count" }];
+  if (!Array.isArray(rawMeasures) || rawMeasures.length < 1 || rawMeasures.length > 8)
+    fail("Run event measures require between 1 and 8 entries.");
+  const names = /* @__PURE__ */ new Set();
+  const measures = rawMeasures.map((measure) => {
+    if (!object(measure) || measure.op !== "count" && measure.op !== "sum")
+      fail("Run event measures support count and sum.");
+    for (const key of Object.keys(measure)) {
+      if (!["op", "as", ...measure.op === "sum" ? ["field"] : []].includes(key))
+        fail(`Unsupported run event measure option: ${key}.`);
+    }
+    const field = measure.op === "sum" ? validateRunEventField(measure.field) : void 0;
+    if (field && !field.startsWith("context.") && RUN_EVENT_QUERY_FIELD_CATALOG[field].type !== "number")
+      fail(`Run event sum requires a numeric field: ${field}.`);
+    const name = measure.as ?? (field ? `sum_${field.replaceAll(".", "_")}` : "count");
+    if (typeof name !== "string" || !/^[A-Za-z_][A-Za-z0-9_]{0,63}$/.test(name) || names.has(name))
+      fail("Run event measure names must be distinct identifiers.");
+    names.add(name);
+    return field ? { op: "sum", field, as: name } : { op: "count", as: name };
   });
+  return {
+    ...base,
+    ...criteria,
+    ...page,
+    groupBy,
+    measures
+  };
 }
-function readSnapshotResponse(response, runId) {
-  if (!response || typeof response !== "object" || Array.isArray(response)) {
-    throw new Error("Run watch returned an invalid snapshot response.");
-  }
-  const record = response;
-  const snapshot = record.snapshot;
-  if (record.runId !== runId || !snapshot || typeof snapshot !== "object" || Array.isArray(snapshot) || snapshot.runId !== runId || typeof snapshot.status !== "string" || !Array.isArray(snapshot.logs) || !snapshot.logs.every(
-    (line) => typeof line === "string"
-  ) || typeof snapshot.totalLogCount !== "number" || !Array.isArray(snapshot.nodeStates)) {
-    throw new Error(`Run watch returned an invalid snapshot for ${runId}.`);
-  }
-  return { runId, snapshot };
+
+// src/types.ts
+function isStopAllPlayRunsDryRunResult(result) {
+  return "dryRun" in result && result.dryRun === true;
 }
-async function backfillRotatedLogTail(input) {
-  if (!input.previous.runSignature || input.snapshot.logsUnavailable) {
-    return input.snapshot;
+
+// ../plays/trigger-config-route.ts
+function playTriggerConfigPath(playName) {
+  return `/api/v2/plays/${encodeURIComponent(playName)}/triggers`;
+}
+
+// src/plays/input-example.ts
+function playInputExampleArgs(schema) {
+  if (!schema) return " --input '@<input.json>'";
+  if (schema.$ref || schema.allOf) return " --input '@<input.json>'";
+  const csv = schema.csvInput;
+  const csvField = typeof csv?.inputField === "string" ? csv.inputField : null;
+  const required = Array.isArray(schema.required) ? schema.required : [];
+  const csvOnlyRequired = required.every((key) => key === csvField);
+  const alternatives = schema.oneOf ?? schema.anyOf;
+  const hasCsvAlternative = Array.isArray(alternatives) && alternatives.some((branch) => {
+    if (!branch || typeof branch !== "object") return false;
+    const keys = branch.required;
+    return Array.isArray(keys) && keys.includes(csvField) && keys.every((key) => key === csvField);
+  });
+  if (csvField && csvOnlyRequired && (!alternatives || hasCsvAlternative)) {
+    if (csvField === "csv") return " --csv '<contacts.csv>'";
+    const value = JSON.stringify({ [csvField]: "<contacts.csv>" });
+    return ` --input '${value.replace(/'/g, "'\\''")}'`;
   }
-  const gap = resolvePlayRunLogGap(input.snapshot, input.previous.lastLogSeq);
-  if (!gap) {
-    return input.snapshot;
-  }
-  const lines = [];
-  let cursor = input.previous.lastLogSeq;
-  const targetSeq = gap.tailFirstSeq - 1;
-  while (cursor < targetSeq) {
-    const limit = Math.min(1e3, targetSeq - cursor);
-    const page = await input.http.get(
-      `/api/v2/runs/${encodeURIComponent(input.runId)}/logs?afterSeq=${cursor}&limit=${limit}`,
-      { signal: input.signal }
-    );
-    if (!page || !Array.isArray(page.entries) || page.entries.length === 0) {
-      return input.snapshot;
-    }
-    for (const entry of page.entries) {
-      if (!entry || entry.seq !== cursor + 1 || typeof entry.line !== "string") {
-        return input.snapshot;
-      }
-      lines.push(entry.line);
-      cursor = entry.seq;
-    }
-  }
-  if (cursor !== targetSeq) {
-    return input.snapshot;
-  }
-  return { ...input.snapshot, logs: [...lines, ...input.snapshot.logs] };
-}
-async function* watchRunEvents(options) {
-  const { http, runId, signal } = options;
-  const path = `/api/v2/runs/${encodeURIComponent(runId)}?watchSnapshot=true`;
-  const streamId = `play-run-watch:${runId}`;
-  const pollIntervalMs = options.pollIntervalMs ?? RUN_WATCH_POLL_INTERVAL_MS;
-  let previous = EMPTY_PLAY_RUN_STREAM_DIFF_STATE;
-  let consecutiveFailures = 0;
-  let outageNoticeSent = false;
-  while (!signal?.aborted) {
-    const pollStartedAt = Date.now();
-    let snapshot;
-    try {
-      const response = await http.get(path, { signal });
-      snapshot = await backfillRotatedLogTail({
-        http,
-        runId,
-        snapshot: readSnapshotResponse(response, runId).snapshot,
-        previous,
-        signal
-      });
-    } catch (error) {
-      if (signal?.aborted) {
-        return;
-      }
-      if (!isTransientPlayRunReadError(error)) {
-        throw error;
-      }
-      consecutiveFailures += 1;
-      const reason = error instanceof Error ? error.message : String(error);
-      if (!outageNoticeSent) {
-        options.onRetry?.({
-          attempt: consecutiveFailures,
-          delayMs: pollIntervalMs,
-          reason
-        });
-        options.onNotice?.(
-          `[watch] run snapshot request failed; retrying every ${pollIntervalMs / 1e3}s (${reason})`
-        );
-        outageNoticeSent = true;
-      }
-      const remaining2 = Math.max(
-        0,
-        pollIntervalMs - (Date.now() - pollStartedAt)
-      );
-      if (!await waitForNextPoll(remaining2, signal)) {
-        return;
-      }
-      continue;
-    }
-    if (outageNoticeSent) {
-      options.onNotice?.("[watch] run snapshot polling recovered");
-      outageNoticeSent = false;
-    }
-    consecutiveFailures = 0;
-    const diff = diffPlayRunStreamEvents({
-      streamId,
-      snapshot,
-      previous
-    });
-    previous = diff.next;
-    for (const event of diff.events) {
-      yield event;
-    }
-    if (isTerminalPlayRunLiveStatus(snapshot.status)) {
-      return;
-    }
-    const remaining = Math.max(
-      0,
-      pollIntervalMs - (Date.now() - pollStartedAt)
-    );
-    if (!await waitForNextPoll(remaining, signal)) {
-      return;
-    }
+  if (Array.isArray(schema.required) && !required.length && !csv && !alternatives) {
+    return "";
   }
+  return " --input '@<input.json>'";
 }
 
-// src/runs/log-cursor.ts
-var RUN_LOGS_CURSOR_PREFIX = "before:";
-function encodeRunLogsCursor(beforeSequence) {
-  return `${RUN_LOGS_CURSOR_PREFIX}${beforeSequence}`;
+// ../product-notifications/configuration.ts
+var PRODUCT_NOTIFICATION_EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+function normalizeProductNotificationEmail(value) {
+  const email = typeof value === "string" ? value.trim().toLowerCase() : "";
+  return email && email.length <= 320 && PRODUCT_NOTIFICATION_EMAIL_PATTERN.test(email) ? email : null;
 }
-function isRunLogsCursor(value) {
-  return value.startsWith(RUN_LOGS_CURSOR_PREFIX);
+var DEFAULT_PRODUCT_NOTIFICATION_DELIVERY_TIMING = {
+  mode: "rolling_limit",
+  windowMs: 36e5
+};
+
+// ../play-runtime/live-events.ts
+function projectPlayStepProgressCounters(progress) {
+  return {
+    completed: progress.completed,
+    total: progress.total,
+    failed: progress.failed,
+    startedRows: progress.startedRows,
+    activeRows: progress.activeRows,
+    waitingRows: progress.waitingRows,
+    completedRows: progress.completedRows,
+    supersededRows: progress.supersededRows
+  };
 }
-function parseRunLogsCursor(value) {
-  const raw = isRunLogsCursor(value) ? value.slice(RUN_LOGS_CURSOR_PREFIX.length) : "";
-  const parsed = /^[1-9]\d*$/.test(raw) ? Number(raw) : NaN;
-  if (!Number.isSafeInteger(parsed)) {
-    throw Object.assign(
-      new Error(
-        `Invalid run log cursor ${JSON.stringify(value)}. Pass the nextCursor value from a previous deepline runs logs result.`
-      ),
-      { exitCode: 2 }
-    );
-  }
-  return parsed;
+function resolveTimingWindow(input) {
+  const startedAt = typeof input.startedAt === "number" && Number.isFinite(input.startedAt) ? input.startedAt : null;
+  const completedAt = typeof input.completedAt === "number" && Number.isFinite(input.completedAt) ? input.completedAt : null;
+  const updatedAt = typeof input.updatedAt === "number" && Number.isFinite(input.updatedAt) ? input.updatedAt : null;
+  return {
+    startedAt,
+    completedAt,
+    updatedAt
+  };
 }
 
-// ../play-runtime/run-event-query.ts
-var stringField = { type: "string", nullable: false };
-var optionalString = { type: "string", nullable: true };
-var RUN_EVENT_QUERY_FIELD_CATALOG = {
-  eventId: stringField,
-  orgId: stringField,
-  runtimeScope: stringField,
-  runId: stringField,
-  playName: stringField,
-  kind: stringField,
-  source: optionalString,
-  occurredAt: { type: "timestamp", nullable: false },
-  status: optionalString,
-  level: { type: "level", nullable: true },
-  stepId: optionalString,
-  stepKind: optionalString,
-  datasetId: optionalString,
-  phase: optionalString,
-  provider: optionalString,
-  operation: optionalString,
-  producerAttempt: { type: "number", nullable: true }
-};
-var RUN_EVENT_QUERY_RETENTION_MS = 7 * 864e5;
-var RUN_EVENT_QUERY_MAX_LIMIT = 200;
-var RUN_EVENT_QUERY_MAX_PAYLOAD_LIMIT = 10;
-var RUN_EVENT_QUERY_MAX_CURSOR_BYTES = 48 * 1024;
-var RUN_EVENT_QUERY_MAX_REQUEST_BYTES = 64 * 1024;
-var MAX_BYTES = 8192;
-var MAX_DEPTH = 8;
-var MAX_PREDICATES = 64;
-var OPERATORS = [
-  "eq",
-  "ne",
-  "gt",
-  "gte",
-  "lt",
-  "lte",
-  "exists",
-  "in"
-];
-var RunEventQueryInputError = class extends TypeError {
-  constructor(message, code = "invalid_run_event_query") {
-    super(message);
-    this.code = code;
-    this.name = "RunEventQueryInputError";
+// ../play-runtime/run-failure.ts
+var PUBLIC_FAILURE_TEXT_BYTE_LIMIT = 64 * 1024;
+
+// ../play-runtime/log-context.ts
+var utf8 = new TextEncoder();
+
+// ../play-runtime/run-log-buffer.ts
+var RUNNER_LOG_MAX_BYTES = 5 * 1024 * 1024;
+var RUNNER_LOG_CONTEXT_MAX_BYTES = 128 * 1024;
+var TERMINAL_RESERVE_BYTES = 64 * 1024;
+var encoder = new TextEncoder();
+
+// ../play-runtime/secret-redaction.ts
+var SECRET_REDACTION_PLACEHOLDER = "[REDACTED_SECRET]";
+var BEARER_TOKEN_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/g;
+var BASIC_CREDENTIAL_RE = /\bBasic\s+[A-Za-z0-9+/]{4,}={0,2}\b/g;
+var JWT_RE = /\b[A-Za-z0-9_-]{8,16384}\.[A-Za-z0-9_-]{1,16384}\.[A-Za-z0-9_-]{8,16384}\b/g;
+var EMAIL_LOCAL_CHAR_RE = /[A-Za-z0-9.!#$%&'*+/=?^_`{|}~-]/;
+var EMAIL_DOMAIN_RE = /^[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?\.[A-Za-z]{2,63}\b/;
+function isEmailLocalPart(value, start, end) {
+  let localStart = start;
+  while (localStart > 0 && EMAIL_LOCAL_CHAR_RE.test(value[localStart - 1])) {
+    localStart -= 1;
   }
-};
-function fail(message) {
-  throw new RunEventQueryInputError(message);
+  let localEnd = end;
+  while (localEnd < value.length && EMAIL_LOCAL_CHAR_RE.test(value[localEnd])) {
+    localEnd += 1;
+  }
+  return localStart < localEnd && localEnd - localStart <= 64 && value[localEnd] === "@" && EMAIL_DOMAIN_RE.test(value.slice(localEnd + 1));
 }
-function object(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value) && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
+function redactTokenUnlessEmail(match, offset, source) {
+  return isEmailLocalPart(source, offset, offset + match.length) ? match : SECRET_REDACTION_PLACEHOLDER;
 }
-function bounded(value, maxBytes = MAX_BYTES) {
-  let encoded;
-  try {
-    encoded = JSON.stringify(value);
-  } catch {
-    fail("Run event query must be bounded JSON without cycles.");
+var PRIVATE_KEY_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g;
+var SENSITIVE_FIELD_NAME = "authorization|cookie|password|(?:client[_-]?)?secret|(?:access|refresh)[_-]?token|(?:x[_-]?)?api[_-]?key|private[_-]?key|token|credentials";
+var COMMON_SECRET_RE = /\b(?:[prs]k_(?:live|test)_|(?:pat|ghp|github_pat)_|xox[baprs]-)[A-Za-z0-9_./+=:-]{12,}\b/gi;
+var GENERIC_PREFIXED_SECRET_RE = /\b(?:key|token|secret|api[_-]?key)_[A-Za-z0-9_./+=:-]{12,}\b/gi;
+var URL_SECRET_VALUE_RE = /\b(?:[spr]k|pat|ghp|github_pat|xox)[A-Za-z0-9_./+=:-]{12,}\b/i;
+var GENERIC_SECRET_ASSIGNMENT_RE = /\b(?:api[_-]?key|token|secret|password)\b\s*[:=]\s*["']?[^"',\s]{12,}["']?/gi;
+var HIGH_ENTROPY_ASSIGNMENT_RE = /\b(?:api[_-]?key|token|secret|password|authorization|(?:access|refresh)[_-]?token)\b\s*[:=]\s*["']?[^"',\s]{16,}["']?/gi;
+var SENSITIVE_URL_PARAM_RE = /[?#&](?:\w*(?:key|token)|secret|password|authorization|credential|signature|sig)(?:=|$)/i;
+var SENSITIVE_FIELD_NAME_RE = new RegExp(
+  `(^|[._-])(?:${SENSITIVE_FIELD_NAME})$`,
+  "i"
+);
+var SENSITIVE_FIELD_NAME_CACHE_MAX_ENTRIES = 4096;
+var sensitiveFieldNameCache = /* @__PURE__ */ new Map();
+function isSensitiveFieldName(key) {
+  const cached = sensitiveFieldNameCache.get(key);
+  if (cached !== void 0) return cached;
+  const sensitive = SENSITIVE_FIELD_NAME_RE.test(key);
+  if (sensitiveFieldNameCache.size >= SENSITIVE_FIELD_NAME_CACHE_MAX_ENTRIES) {
+    sensitiveFieldNameCache.clear();
   }
-  if (!encoded || new TextEncoder().encode(encoded).length > maxBytes)
-    fail(`Run event query exceeds ${maxBytes} bytes.`);
+  sensitiveFieldNameCache.set(key, sensitive);
+  return sensitive;
 }
-function validateRunEventField(value) {
-  if (typeof value !== "string") fail("Run event field must be a string.");
-  const field = value.startsWith("$.") ? value.slice(2) : value;
-  if (Object.prototype.hasOwnProperty.call(RUN_EVENT_QUERY_FIELD_CATALOG, field))
-    return field;
-  if (/^context\.[A-Za-z_][A-Za-z0-9_]{0,63}$/.test(field) && !["__proto__", "prototype", "constructor"].includes(field.slice(8)))
-    return field;
-  const alternatives = {
-    step: "stepId",
-    severity: "level",
-    timestamp: "occurredAt",
-    play: "playName",
-    run: "runId",
-    attempt: "producerAttempt"
-  };
-  fail(
-    `Unsupported run event field: ${field}. Use ${alternatives[field] ?? "a catalog field or context.<key>"}; call fields() for supported fields.`
-  );
+var SERIALIZED_SECRET_FIELD_RE = new RegExp(
+  `"(${SENSITIVE_FIELD_NAME})"\\s*:\\s*(?:"[^"\\\\]*"|\\{[^{}]*\\})`,
+  "gi"
+);
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function scalar(field, value, op) {
-  if (value !== null && typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean")
-    fail(`Run event ${field} requires a JSON scalar.`);
-  if (typeof value === "number" && !Number.isFinite(value))
-    fail(`Run event ${field} requires a finite number.`);
-  if (typeof value === "string" && new TextEncoder().encode(value).length > 1024)
-    fail(`Run event ${field} value exceeds 1024 bytes.`);
-  const descriptor = RUN_EVENT_QUERY_FIELD_CATALOG[field];
-  if (descriptor) {
-    if (value === null) {
-      if (!descriptor.nullable) fail(`Run event ${field} cannot be null.`);
-    } else if (descriptor.type === "number") {
-      if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 1)
-        fail(`Run event ${field} requires a positive integer.`);
-    } else if (typeof value !== "string")
-      fail(`Run event ${field} requires a string.`);
-    else if (descriptor.type === "level" && !RUN_LOG_LEVELS.includes(value))
-      fail("Run event level requires debug, info, warn or error.");
-    else if (descriptor.type === "timestamp") {
-      value = normalizeRunEventQueryTimestamp(value);
+var REDACTION_TRIGGER_RE = new RegExp(
+  [
+    // Sensitive field names, in object keys and in `name=`/`"name":` text.
+    "token",
+    "secret",
+    "password",
+    "authorization",
+    "cookie",
+    "credential",
+    // One `key` branch instead of `api[_-]?key`, `private[_-]?key` and `key_`.
+    // A regex alternation costs roughly one substring scan per branch, and a
+    // broader branch can only send more payloads down the exact path.
+    "key",
+    // Self-identifying credential prefixes.
+    "bearer",
+    "basic",
+    "-----BEGIN",
+    "xox[baprs]-",
+    "[prs]k_",
+    "pat_",
+    "ghp_",
+    // URL credentials: `//user:pass@host` userinfo and sensitive query params.
+    // The userinfo class excludes `/` exactly as the rule it guards does.
+    "//[^\\s/]{0,256}@",
+    "[?#&]sig",
+    // JWTs carry no keyword at all, so the shape itself is the marker. Anchor
+    // on the separating dot and drop JWT_RE's leading `{8,}` segment: a dot is
+    // rare enough for the engine to skip between candidates, which makes this
+    // gate roughly ten times cheaper than re-running JWT_RE itself, and
+    // dropping a required segment can only widen what it accepts.
+    "\\.[A-Za-z0-9_-]{1,16384}\\.[A-Za-z0-9_-]{8}"
+  ].join("|"),
+  "i"
+);
+function mightContainRedactableSecret(value) {
+  return REDACTION_TRIGGER_RE.test(value);
+}
+function redactSecretLikeString(value) {
+  if (!mightContainRedactableSecret(value)) return value;
+  const serializedRedacted = value.replace(
+    SERIALIZED_SECRET_FIELD_RE,
+    `"$1":"${SECRET_REDACTION_PLACEHOLDER}"`
+  );
+  const trimmed = serializedRedacted.trim();
+  if (/^https?:\/\/\S+$/i.test(trimmed)) {
+    if (/^https?:\/\/[^/?#@]+@/i.test(trimmed) || SENSITIVE_URL_PARAM_RE.test(trimmed)) {
+      return SECRET_REDACTION_PLACEHOLDER;
+    }
+    if (!URL_SECRET_VALUE_RE.test(serializedRedacted)) {
+      return serializedRedacted;
     }
   }
-  if (["gt", "gte", "lt", "lte"].includes(op) && (value === null || typeof value === "boolean"))
-    fail(`Run event ${op} requires a string or number.`);
-  return value;
+  return serializedRedacted.replace(PRIVATE_KEY_RE, SECRET_REDACTION_PLACEHOLDER).replace(BEARER_TOKEN_RE, `Bearer ${SECRET_REDACTION_PLACEHOLDER}`).replace(BASIC_CREDENTIAL_RE, `Basic ${SECRET_REDACTION_PLACEHOLDER}`).replace(JWT_RE, redactTokenUnlessEmail).replace(COMMON_SECRET_RE, redactTokenUnlessEmail).replace(GENERIC_PREFIXED_SECRET_RE, redactTokenUnlessEmail).replace(GENERIC_SECRET_ASSIGNMENT_RE, SECRET_REDACTION_PLACEHOLDER).replace(HIGH_ENTROPY_ASSIGNMENT_RE, (match) => {
+    const separator = match.includes("=") ? "=" : ":";
+    const [key] = match.split(separator, 1);
+    return `${key.trim()}${separator}${SECRET_REDACTION_PLACEHOLDER}`;
+  });
 }
-function comparison(field, op, value) {
-  if (!OPERATORS.includes(op))
-    fail(`Unsupported run event operator: ${op}. Use ${OPERATORS.join(", ")}.`);
-  if (op === "exists") {
-    if (typeof value !== "boolean")
-      fail("Run event exists requires a boolean.");
-    return { field, op, value };
-  }
-  if (op === "in") {
-    if (!Array.isArray(value) || value.length < 1 || value.length > 32)
-      fail("Run event in requires between 1 and 32 scalars.");
-    return { field, op, value: value.map((item) => scalar(field, item, "eq")) };
+function createSecretRedactionContext(initialValues = []) {
+  const exactSecrets = /* @__PURE__ */ new Set();
+  const exactSecretMatchers = /* @__PURE__ */ new Map();
+  function register(value) {
+    if (value.length > 0) exactSecrets.add(value);
   }
-  return {
-    field,
-    op,
-    value: scalar(field, value, op)
-  };
-}
-function admitObject(input, depth = 0, budget = { count: 0 }) {
-  if (depth > MAX_DEPTH) fail("Run event where exceeds depth 8.");
-  if (!object(input) || !Object.keys(input).length)
-    fail("Run event where requires a nonempty object.");
-  const terms = [];
-  const fieldTerms = (raw, filter) => {
-    const field = validateRunEventField(raw);
-    const operators = object(filter) ? Object.entries(filter) : [["eq", filter]];
-    if (!operators.length)
-      fail(`Run event ${field} has an empty operator object.`);
-    for (const [op, value] of operators) {
-      if (++budget.count > MAX_PREDICATES)
-        fail("Run event where exceeds 64 predicates.");
-      terms.push(comparison(field, op, value));
+  function matchersForSecret(secret) {
+    const cached = exactSecretMatchers.get(secret);
+    if (cached) return cached;
+    const literals = [secret];
+    try {
+      const encoded = encodeURIComponent(secret);
+      if (encoded !== secret) literals.push(encoded);
+    } catch {
     }
-  };
-  for (const [key, filter] of Object.entries(input)) {
-    if (key === "and" || key === "or") {
-      if (!Array.isArray(filter) || filter.length < 1 || filter.length > MAX_PREDICATES)
-        fail(`Run event ${key} requires a nonempty bounded array.`);
-      const children = filter.map(
-        (item) => admitObject(item, depth + 1, budget)
-      );
-      terms.push(key === "and" ? { and: children } : { or: children });
-    } else if (key === "context") {
-      if (!object(filter) || !Object.keys(filter).length)
-        fail("Run event context requires flat scalar fields.");
-      for (const [contextKey, value] of Object.entries(filter))
-        fieldTerms(`context.${contextKey}`, value);
-    } else fieldTerms(key, filter);
+    const built = literals.map((literal) => ({
+      literal,
+      matcher: new RegExp(escapeRegExp(literal), "g")
+    }));
+    exactSecretMatchers.set(secret, built);
+    return built;
   }
-  return terms.length === 1 ? terms[0] : { and: terms };
-}
-function compact(predicate) {
-  if ("and" in predicate) {
-    const merged = {};
-    for (const term of predicate.and) {
-      const child = compact(term);
-      for (const [key, value] of Object.entries(child)) {
-        if (key === "and") return { and: predicate.and.map(compact) };
-        if (key === "context") {
-          const context = merged.context ?? {};
-          for (const [name, filter2] of Object.entries(value)) {
-            if (Object.prototype.hasOwnProperty.call(context, name)) {
-              const combined = combineFilters(context[name], filter2);
-              if (!combined) return { and: predicate.and.map(compact) };
-              context[name] = combined;
-            } else context[name] = filter2;
-          }
-          merged.context = context;
-        } else if (Object.prototype.hasOwnProperty.call(merged, key)) {
-          const combined = key === "or" ? void 0 : combineFilters(merged[key], value);
-          if (!combined) return { and: predicate.and.map(compact) };
-          merged[key] = combined;
-        } else merged[key] = value;
+  for (const value of initialValues) register(value);
+  function containsRegisteredSecret(value, {
+    includeEncoded = false,
+    minimumLength = 1
+  } = {}) {
+    for (const secret of exactSecrets) {
+      if (secret.length < minimumLength) continue;
+      if (value.includes(secret)) return true;
+      if (includeEncoded) {
+        try {
+          const encoded = encodeURIComponent(secret);
+          if (encoded !== secret && value.includes(encoded)) return true;
+        } catch {
+        }
       }
     }
-    return merged;
+    return false;
   }
-  if ("or" in predicate) return { or: predicate.or.map(compact) };
-  const filter = predicate.op === "eq" ? predicate.value : { [predicate.op]: predicate.value };
-  if (predicate.field.startsWith("context."))
-    return { context: { [predicate.field.slice(8)]: filter } };
-  return { [predicate.field]: filter };
-}
-function combineFilters(left, right) {
-  const first = object(left) ? left : { eq: left };
-  const second = object(right) ? right : { eq: right };
-  if (Object.keys(first).some(
-    (key) => Object.prototype.hasOwnProperty.call(second, key)
-  ))
-    return void 0;
-  return { ...first, ...second };
-}
-function canonical(predicate) {
-  if ("field" in predicate) return predicate;
-  const operator = "and" in predicate ? "and" : "or";
-  const source = "and" in predicate ? predicate.and : predicate.or;
-  const terms = source.map(canonical).flatMap((term) => {
-    if (operator === "and" && "and" in term) return term.and;
-    if (operator === "or" && "or" in term) return term.or;
-    return [term];
-  });
-  terms.sort((a, b) => JSON.stringify(a).localeCompare(JSON.stringify(b)));
-  const unique = terms.filter(
-    (term, i) => i === 0 || JSON.stringify(term) !== JSON.stringify(terms[i - 1])
-  );
-  if (unique.length === 1) return unique[0];
-  return operator === "and" ? { and: unique } : { or: unique };
-}
-function parseDsl(input) {
-  let position = 0;
-  let count = 0;
-  const skip = () => {
-    while (/\s/.test(input[position] ?? "") && position < input.length)
-      position++;
-  };
-  const take = (token) => {
-    skip();
-    if (input.startsWith(token, position)) {
-      position += token.length;
-      return true;
+  function matchesRegisteredSecret(value) {
+    return exactSecrets.has(value);
+  }
+  function redactRegisteredSecrets(value) {
+    if (exactSecrets.size === 0) return value;
+    let output = value;
+    for (const secret of exactSecrets) {
+      for (const { literal, matcher } of matchersForSecret(secret)) {
+        if (!output.includes(literal)) continue;
+        matcher.lastIndex = 0;
+        output = output.replace(matcher, SECRET_REDACTION_PLACEHOLDER);
+      }
     }
-    return false;
-  };
-  const json = () => {
-    skip();
-    const start = position;
-    if (input[position] === '"') {
-      position++;
-      let closed = false;
-      while (position < input.length) {
-        const char = input[position++];
-        if (char === "\\") position++;
-        else if (char === '"') {
-          closed = true;
-          break;
-        }
+    return output;
+  }
+  function redactString(value) {
+    const output = redactRegisteredSecrets(value);
+    return redactSecretLikeString(output);
+  }
+  function redact(value) {
+    if (typeof value === "string") return redactString(value);
+    if (Array.isArray(value)) {
+      let changed = false;
+      const next = new Array(value.length);
+      for (let index = 0; index < value.length; index += 1) {
+        const entry = value[index];
+        const redacted = redact(entry);
+        next[index] = redacted;
+        if (redacted !== entry) changed = true;
       }
-      if (!closed) fail("Run event DSL has an unterminated JSON string.");
-    } else {
-      const match = /^(?:true|false|null|-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?)/.exec(
-        input.slice(position)
-      );
-      if (!match)
-        fail("Run event DSL requires a JSON quoted string or scalar.");
-      position += match[0].length;
-    }
-    try {
-      return JSON.parse(input.slice(start, position));
-    } catch {
-      fail("Run event DSL requires valid JSON scalars.");
-    }
-  };
-  const term = (depth) => {
-    if (depth > MAX_DEPTH) fail("Run event where exceeds depth 8.");
-    if (take("(")) {
-      const nested = or(depth + 1);
-      if (!take(")")) fail("Run event DSL is missing a closing parenthesis.");
-      return nested;
+      return changed ? next : value;
     }
-    skip();
-    const match = /^(?:\$\.)?[A-Za-z_][A-Za-z0-9_.]*/.exec(
-      input.slice(position)
-    );
-    if (!match) fail("Run event DSL requires a supported field.");
-    position += match[0].length;
-    const field = validateRunEventField(match[0]);
-    if (++count > MAX_PREDICATES)
-      fail("Run event where exceeds 64 predicates.");
-    skip();
-    const operation = /^(==|!=|>=|<=|>|<|\b(?:eq|ne|gte|gt|lte|lt|in|exists)\b)/.exec(
-      input.slice(position)
-    );
-    if (!operation) {
-      const token = /^(?:[=!<>~]+|[A-Za-z_]+)/.exec(input.slice(position))?.[0] ?? input[position] ?? "<end>";
-      if (token === "=") {
-        const corrected = `${input.slice(0, position)}==${input.slice(position + 1)}`;
-        fail(
-          `Run event DSL does not support "=" at character ${position + 1}. For equality, replace this "=" with "==": ${JSON.stringify(corrected)}.`
-        );
+    if (value && typeof value === "object") {
+      const prototype = Object.getPrototypeOf(value);
+      let changed = prototype !== Object.prototype && prototype !== null;
+      const source = value;
+      const keys = Object.keys(source);
+      const redactedValues = new Array(keys.length);
+      for (let index = 0; index < keys.length; index += 1) {
+        const key = keys[index];
+        const entry = source[key];
+        const redacted = isSensitiveFieldName(key) ? SECRET_REDACTION_PLACEHOLDER : redact(entry);
+        redactedValues[index] = redacted;
+        if (redacted !== entry) changed = true;
       }
-      fail(
-        `Run event DSL does not support ${JSON.stringify(token)} after ${JSON.stringify(match[0])} at character ${position + 1}. Use ==, !=, >, >=, <, <=, in or exists.`
+      if (!changed) return value;
+      return Object.fromEntries(
+        keys.map((key, index) => [key, redactedValues[index]])
       );
     }
-    position += operation[0].length;
-    const symbols = {
-      "==": "eq",
-      "!=": "ne",
-      ">=": "gte",
-      "<=": "lte",
-      ">": "gt",
-      "<": "lt"
-    };
-    const op = symbols[operation[0]] ?? operation[0];
-    if (op === "in") {
-      if (!take("[")) fail("Run event DSL in requires a JSON scalar array.");
-      const values = [];
-      if (!take("]")) {
-        do {
-          values.push(json());
-          if (values.length > 32)
-            fail("Run event in requires between 1 and 32 scalars.");
-        } while (take(","));
-        if (!take("]")) fail("Run event DSL in requires a closing bracket.");
-      }
-      return comparison(field, op, values);
+    return value;
+  }
+  function redactKnownSecrets(value) {
+    if (typeof value === "string") return redactRegisteredSecrets(value);
+    if (Array.isArray(value)) {
+      return value.map((entry) => redactKnownSecrets(entry));
     }
-    return comparison(field, op, json());
-  };
-  const and = (depth) => {
-    const terms = [term(depth)];
-    while (take("&&")) terms.push(term(depth));
-    return terms.length === 1 ? terms[0] : { and: terms };
+    if (value && typeof value === "object") {
+      return Object.fromEntries(
+        Object.entries(value).map(([key, entry]) => [
+          key,
+          redactKnownSecrets(entry)
+        ])
+      );
+    }
+    return value;
+  }
+  return {
+    register,
+    containsRegisteredSecret,
+    matchesRegisteredSecret,
+    redactRegisteredSecrets,
+    redactString,
+    redactKnownSecrets,
+    redact
   };
-  const or = (depth) => {
-    const terms = [and(depth)];
-    while (take("||")) terms.push(and(depth));
-    return terms.length === 1 ? terms[0] : { or: terms };
+}
+
+// ../play-runtime/output-size-limits.ts
+var TERMINAL_RUN_RESULT_MAX_BYTES = 6 * 1024 * 1024;
+var LEDGER_TERMINAL_RESULT_MAX_BYTES = 256 * 1024;
+var CUSTOMER_OUTPUT_VALUE_MAX_BYTES = 5 * 1024 * 1024;
+var CUSTOMER_OUTPUT_TOTAL_MAX_BYTES = 5 * 1024 * 1024;
+var RUNTIME_RECEIPT_OUTPUT_MAX_BYTES = 10 * 1024 * 1024;
+var RUNTIME_RECEIPT_COMPLETION_BUFFER_MAX_BYTES = 32 * 1024 * 1024;
+var RUNTIME_RECEIPT_CONTROL_BUFFER_MAX_BYTES = 2 * 1024 * 1024;
+var RUNNER_TERMINAL_PUSH_MAX_BODY_BYTES = 16 * 1024 * 1024;
+var RUNTIME_RECEIPT_GATEWAY_BATCH_MAX_BYTES = 12 * 1024 * 1024;
+var RUNTIME_RECEIPT_WRITER_TARGET_BATCH_BYTES = 8 * 1024 * 1024;
+var RUNNER_POST_TERMINAL_DIAGNOSTIC_MAX_BYTES = 64 * 1024;
+var JSON_SIZE_LIMIT_REACHED = Symbol("JSON_SIZE_LIMIT_REACHED");
+
+// ../play-runtime/ledger-safe-payload.ts
+var ledgerIngressRedactor = createSecretRedactionContext();
+
+// ../play-runtime/docflow-node-io.ts
+var utf8Encoder = new TextEncoder();
+var PLAY_DATASET_BRAND = Symbol.for("deepline.play.dataset");
+
+// ../play-data-plane/runtime-sheet-orm.ts
+var RUNTIME_SHEET_CELL_META_COLUMN = {
+  name: "_cell_meta",
+  dataType: "jsonb",
+  nullable: "NO",
+  defaultSql: "'{}'::jsonb"
+};
+var RUNTIME_SHEET_COLUMN_CONTRACTS = [
+  {
+    name: "_key",
+    sqlType: "text",
+    dataType: "text",
+    nullable: "NO",
+    defaultSql: null,
+    repairable: false,
+    requiresDefault: false
+  },
+  {
+    name: "_status",
+    sqlType: "text NOT NULL",
+    dataType: "text",
+    nullable: "NO",
+    defaultSql: null,
+    repairable: false,
+    requiresDefault: false
+  },
+  {
+    name: "_run_id",
+    sqlType: "text",
+    dataType: "text",
+    nullable: "YES",
+    defaultSql: null,
+    repairable: true,
+    requiresDefault: false
+  },
+  {
+    name: "_error",
+    sqlType: "text",
+    dataType: "text",
+    nullable: "YES",
+    defaultSql: null,
+    repairable: true,
+    requiresDefault: false
+  },
+  {
+    name: "_stage",
+    sqlType: "text",
+    dataType: "text",
+    nullable: "YES",
+    defaultSql: null,
+    repairable: true,
+    requiresDefault: false
+  },
+  {
+    name: "_provider",
+    sqlType: "text",
+    dataType: "text",
+    nullable: "YES",
+    defaultSql: null,
+    repairable: true,
+    requiresDefault: false
+  },
+  {
+    name: "_input_index",
+    sqlType: "bigint",
+    dataType: "bigint",
+    nullable: "YES",
+    defaultSql: null,
+    repairable: true,
+    requiresDefault: false
+  },
+  {
+    name: "_attempt_id",
+    sqlType: "text",
+    dataType: "text",
+    nullable: "YES",
+    defaultSql: null,
+    repairable: true,
+    requiresDefault: false
+  },
+  {
+    name: "_attempt_owner_run_id",
+    sqlType: "text",
+    dataType: "text",
+    nullable: "YES",
+    defaultSql: null,
+    repairable: true,
+    requiresDefault: false
+  },
+  {
+    name: "_attempt_expires_at",
+    sqlType: "timestamptz",
+    dataType: "timestamp with time zone",
+    nullable: "YES",
+    defaultSql: null,
+    repairable: true,
+    requiresDefault: false
+  },
+  {
+    name: "_attempt_seq",
+    sqlType: "integer",
+    dataType: "integer",
+    nullable: "YES",
+    defaultSql: null,
+    repairable: true,
+    requiresDefault: false
+  },
+  {
+    name: "_write_version",
+    sqlType: "bigint NOT NULL DEFAULT 0",
+    dataType: "bigint",
+    nullable: "NO",
+    defaultSql: "0",
+    repairable: true,
+    requiresDefault: true
+  },
+  {
+    name: "_writer_run_id",
+    sqlType: "text",
+    dataType: "text",
+    nullable: "YES",
+    defaultSql: null,
+    repairable: true,
+    requiresDefault: false
+  },
+  {
+    name: "_created_at",
+    sqlType: "timestamptz NOT NULL DEFAULT now()",
+    dataType: "timestamp with time zone",
+    nullable: "NO",
+    defaultSql: "now()",
+    repairable: true,
+    requiresDefault: true
+  },
+  {
+    name: "_updated_at",
+    sqlType: "timestamptz NOT NULL DEFAULT now()",
+    dataType: "timestamp with time zone",
+    nullable: "NO",
+    defaultSql: "now()",
+    repairable: true,
+    requiresDefault: true
+  },
+  {
+    name: "_version",
+    sqlType: "bigint NOT NULL",
+    dataType: "bigint",
+    nullable: "NO",
+    defaultSql: null,
+    defaultKind: "version_sequence",
+    repairable: true,
+    requiresDefault: true
+  },
+  {
+    ...RUNTIME_SHEET_CELL_META_COLUMN,
+    sqlType: `jsonb NOT NULL DEFAULT ${RUNTIME_SHEET_CELL_META_COLUMN.defaultSql}`,
+    repairable: true,
+    requiresDefault: true
+  }
+];
+var RUNTIME_SHEET_ATTEMPT_COLUMNS = RUNTIME_SHEET_COLUMN_CONTRACTS.filter(
+  (column) => column.name.startsWith("_attempt_")
+).map((column) => column.name);
+var RUNTIME_SHEET_WRITE_VERSION_COLUMNS = RUNTIME_SHEET_COLUMN_CONTRACTS.filter(
+  (column) => column.name === "_write_version" || column.name === "_writer_run_id"
+).map((column) => column.name);
+var RUNTIME_SHEET_TIMESTAMP_COLUMNS = RUNTIME_SHEET_COLUMN_CONTRACTS.filter(
+  (column) => column.name === "_created_at" || column.name === "_updated_at"
+).map((column) => column.name);
+var RUNTIME_SHEET_SYSTEM_COLUMNS = new Set(
+  RUNTIME_SHEET_COLUMN_CONTRACTS.map((column) => column.name)
+);
+var RUNTIME_SHEET_REPAIRABLE_COLUMNS = RUNTIME_SHEET_COLUMN_CONTRACTS.filter(
+  (column) => column.repairable
+);
+
+// ../play-runtime/run-ledger.ts
+var TERMINAL_STATUS_BY_EVENT_TYPE = {
+  [RUN_EVENT_KIND.runCompleted]: "completed",
+  [RUN_EVENT_KIND.runFailed]: "failed",
+  [RUN_EVENT_KIND.runCancelled]: "cancelled"
+};
+
+// ../play-runtime/run-snapshot-stream.ts
+function isTerminalPlayRunLiveStatus(status) {
+  return isTerminalPlayRunLifecycleStatus(status);
+}
+function makeRunStreamEvent(input) {
+  return {
+    ...input,
+    scope: "play",
+    at: input.at ?? (/* @__PURE__ */ new Date()).toISOString()
   };
-  const result = or(0);
-  skip();
-  if (position !== input.length)
-    fail(`Run event DSL has unsupported input at position ${position}.`);
-  return result;
 }
-function parseRunEventWhere(input) {
-  bounded(input);
-  const where = compact(
-    canonical(typeof input === "string" ? parseDsl(input) : admitObject(input))
+var EMPTY_PLAY_RUN_STREAM_DIFF_STATE = {
+  runSignature: "",
+  snapshotSignature: "",
+  stepStatusSignature: "",
+  stepProgressSignature: "",
+  lastLogSeq: 0
+};
+function getSnapshotCursor(snapshot) {
+  return String(snapshot.updatedAt ?? Date.now());
+}
+function getRunSignature(snapshot) {
+  return [snapshot.runId, snapshot.status, snapshot.updatedAt ?? 0].join(":");
+}
+function getStepStatusSignature(snapshot) {
+  return snapshot.nodeStates.map(
+    (state) => [
+      state.nodeId,
+      state.status,
+      state.artifactTableNamespace ?? "",
+      state.startedAt ?? "",
+      state.completedAt ?? "",
+      state.progress?.startedAt ?? "",
+      state.progress?.completedAt ?? "",
+      state.updatedAt ?? "",
+      state.progress?.updatedAt ?? ""
+    ].join(":")
+  ).join("|");
+}
+function getStepProgressSignature(snapshot) {
+  return JSON.stringify(
+    snapshot.nodeStates.map((state) => [
+      state.nodeId,
+      projectPlayStepProgressCounters(state.progress ?? {}),
+      state.progress?.artifactTableNamespace ?? "",
+      state.progress?.startedAt ?? "",
+      state.progress?.completedAt ?? "",
+      state.progress?.updatedAt ?? "",
+      state.progress?.message ?? ""
+    ])
   );
-  bounded(where);
-  return where;
 }
-function normalizeRunEventQueryTimestamp(value) {
-  let extraMicros = "";
-  if (typeof value === "string") {
-    const timestamp = /^[+-]?\d{4,6}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.(\d{1,6}))?(?:Z|[+-]\d{2}:\d{2})$/.exec(
-      value
-    );
-    if (!timestamp)
-      fail(
-        "Run event time bounds require an ISO timestamp with a timezone and at most six fractional digits."
-      );
-    extraMicros = (timestamp[1] ?? "").padEnd(6, "0").slice(3);
+function getSnapshotSignature(snapshot) {
+  return JSON.stringify(snapshot);
+}
+function resolvePlayRunLogGap(snapshot, lastLogSeq) {
+  if (snapshot.totalLogCount <= lastLogSeq) {
+    return null;
   }
-  const date = new Date(value);
-  if (!Number.isFinite(date.getTime()))
-    fail("Run event time bound is invalid.");
-  const canonical2 = date.toISOString();
-  return /[1-9]/.test(extraMicros) ? canonical2.replace(/Z$/, `${extraMicros}Z`) : canonical2;
+  const tailFirstSeq = snapshot.totalLogCount - snapshot.logs.length + 1;
+  if (lastLogSeq + 1 >= tailFirstSeq) {
+    return null;
+  }
+  return {
+    missingCount: tailFirstSeq - 1 - lastLogSeq,
+    tailFirstSeq
+  };
 }
-function timestampMicros(value) {
-  const fraction = /\.(\d+)Z$/.exec(value)?.[1] ?? "";
-  return BigInt(Date.parse(value)) * BigInt(1e3) + BigInt(fraction.padEnd(6, "0").slice(3));
+function diffLogLines(input) {
+  const { logs, totalLogCount } = input.snapshot;
+  if (input.snapshot.logsUnavailable) {
+    return {
+      lines: [],
+      lastLogSeq: input.lastLogSeq,
+      firstSeq: null
+    };
+  }
+  if (totalLogCount <= input.lastLogSeq) {
+    return { lines: [], lastLogSeq: input.lastLogSeq, firstSeq: null };
+  }
+  const tailFirstSeq = totalLogCount - logs.length + 1;
+  if (input.lastLogSeq + 1 >= tailFirstSeq) {
+    return {
+      lines: logs.slice(input.lastLogSeq + 1 - tailFirstSeq),
+      lastLogSeq: totalLogCount,
+      firstSeq: input.lastLogSeq + 1
+    };
+  }
+  const missingCount = tailFirstSeq - 1 - input.lastLogSeq;
+  return {
+    lines: [
+      `[watch] ${missingCount} log lines not retained in the live window; full logs via runs logs`,
+      ...logs
+    ],
+    lastLogSeq: totalLogCount,
+    firstSeq: null
+  };
 }
-function time(value, nowMs, fallback) {
-  if (value === void 0) value = fallback;
-  let timestamp;
-  if (typeof value === "number") timestamp = value;
-  else if (typeof value === "string") {
-    const relative = /^(\d+(?:\.\d+)?)(ms|s|m|h|d)$/.exec(value);
-    if (relative) {
-      const units = {
-        ms: 1,
-        s: 1e3,
-        m: 6e4,
-        h: 36e5,
-        d: 864e5
-      };
-      timestamp = nowMs - Number(relative[1]) * units[relative[2]];
-    } else {
-      return normalizeRunEventQueryTimestamp(value);
+function diffPlayRunStreamEvents(input) {
+  const { snapshot, streamId, previous } = input;
+  const cursor = getSnapshotCursor(snapshot);
+  const logDiff = diffLogLines({
+    snapshot,
+    lastLogSeq: previous.lastLogSeq
+  });
+  const next = {
+    runSignature: getRunSignature(snapshot),
+    stepStatusSignature: getStepStatusSignature(snapshot),
+    stepProgressSignature: getStepProgressSignature(snapshot),
+    snapshotSignature: getSnapshotSignature(snapshot),
+    lastLogSeq: logDiff.lastLogSeq
+  };
+  const events = [];
+  if (next.stepStatusSignature !== previous.stepStatusSignature) {
+    for (const state of snapshot.nodeStates) {
+      if (state.status === "idle") {
+        continue;
+      }
+      const persistedStartedAt = state.startedAt ?? state.progress?.startedAt ?? null;
+      const persistedCompletedAt = state.completedAt ?? state.progress?.completedAt ?? null;
+      events.push(
+        makeRunStreamEvent({
+          cursor,
+          streamId,
+          type: "play.step.status",
+          payload: {
+            runId: snapshot.runId,
+            stepId: state.nodeId,
+            status: state.status,
+            artifactTableNamespace: state.artifactTableNamespace ?? null,
+            ...resolveTimingWindow({
+              startedAt: persistedStartedAt,
+              completedAt: persistedCompletedAt,
+              updatedAt: state.updatedAt ?? state.progress?.updatedAt ?? snapshot.updatedAt ?? null
+            })
+          }
+        })
+      );
     }
-  } else fail("Run event time bounds require a timestamp or duration.");
-  return normalizeRunEventQueryTimestamp(timestamp);
-}
-function exact(value, name) {
-  if (typeof value !== "string" || !value.trim() || value.length > 256)
-    fail(
-      `Run event ${name} requires a nonempty string of at most 256 characters.`
+  }
+  if (next.stepProgressSignature !== previous.stepProgressSignature) {
+    for (const state of snapshot.nodeStates) {
+      if (!state.progress) {
+        continue;
+      }
+      events.push(
+        makeRunStreamEvent({
+          cursor: String(
+            state.progress.updatedAt ?? snapshot.updatedAt ?? Date.now()
+          ),
+          streamId,
+          type: "play.step.progress",
+          payload: {
+            runId: snapshot.runId,
+            stepId: state.nodeId,
+            ...projectPlayStepProgressCounters(state.progress),
+            message: state.progress.message,
+            artifactTableNamespace: state.progress.artifactTableNamespace ?? state.artifactTableNamespace ?? null,
+            ...resolveTimingWindow({
+              startedAt: state.startedAt ?? state.progress.startedAt ?? null,
+              completedAt: state.completedAt ?? state.progress.completedAt ?? null,
+              updatedAt: state.progress.updatedAt ?? snapshot.updatedAt ?? null
+            })
+          }
+        })
+      );
+    }
+  }
+  if (logDiff.lines.length > 0) {
+    events.push(
+      makeRunStreamEvent({
+        cursor,
+        streamId,
+        type: "play.run.log",
+        payload: {
+          runId: snapshot.runId,
+          lines: logDiff.lines,
+          source: "worker",
+          ...logDiff.firstSeq !== null ? { firstSeq: logDiff.firstSeq } : {},
+          totalLogCount: snapshot.totalLogCount
+        }
+      })
     );
-  return value;
-}
-var CRITERIA_KEYS = [
-  "since",
-  "until",
-  "where",
-  "runId",
-  "stepId",
-  "minLevel",
-  "text",
-  "playName",
-  "kind"
-];
-function normalizeRunEventQuery(criteria, nowMs = Date.now()) {
-  if (!object(criteria)) fail("Run event criteria requires an object.");
-  bounded(criteria, RUN_EVENT_QUERY_MAX_REQUEST_BYTES);
-  for (const key of Object.keys(criteria)) {
-    if (!CRITERIA_KEYS.includes(key))
-      fail(`Unsupported run event criterion: ${key}.`);
   }
-  const until = time(criteria.until, nowMs, nowMs);
-  const since = time(criteria.since, nowMs, Date.parse(until) - 36e5);
-  if (timestampMicros(since) >= timestampMicros(until) || timestampMicros(until) - timestampMicros(since) > BigInt(RUN_EVENT_QUERY_RETENTION_MS) * BigInt(1e3))
-    fail("Run event query requires a window of at most seven days.");
-  const query = { since, until };
-  if (criteria.where !== void 0)
-    query.where = parseRunEventWhere(criteria.where);
-  for (const name of ["runId", "stepId", "playName", "kind"]) {
-    if (criteria[name] !== void 0) query[name] = exact(criteria[name], name);
+  if (next.snapshotSignature !== previous.snapshotSignature) {
+    const enrichedNodeStates = snapshot.nodeStates.map((state) => {
+      const timing = resolveTimingWindow({
+        startedAt: state.startedAt ?? state.progress?.startedAt ?? null,
+        completedAt: state.completedAt ?? state.progress?.completedAt ?? null,
+        updatedAt: state.updatedAt ?? state.progress?.updatedAt ?? snapshot.updatedAt ?? null
+      });
+      return {
+        ...state,
+        ...timing,
+        progress: state.progress ? {
+          ...state.progress,
+          ...resolveTimingWindow({
+            startedAt: state.progress.startedAt ?? state.startedAt ?? null,
+            completedAt: state.progress.completedAt ?? state.completedAt ?? null,
+            updatedAt: state.progress.updatedAt ?? state.updatedAt ?? snapshot.updatedAt ?? null
+          })
+        } : state.progress
+      };
+    });
+    events.push(
+      makeRunStreamEvent({
+        cursor,
+        streamId,
+        type: "play.run.snapshot",
+        payload: { ...snapshot, nodeStates: enrichedNodeStates }
+      })
+    );
   }
-  if (criteria.minLevel !== void 0) {
-    if (!RUN_LOG_LEVELS.includes(criteria.minLevel))
-      fail("Run event minLevel requires debug, info, warn or error.");
-    query.minLevel = criteria.minLevel;
+  if (next.runSignature !== previous.runSignature) {
+    events.push(
+      makeRunStreamEvent({
+        cursor,
+        streamId,
+        type: "play.run.status",
+        payload: {
+          runId: snapshot.runId,
+          status: snapshot.status,
+          updatedAt: snapshot.updatedAt,
+          ...snapshot.activity ? { activity: snapshot.activity } : {}
+        }
+      })
+    );
   }
-  if (criteria.text !== void 0) {
-    if (typeof criteria.text !== "string" || !criteria.text.length || new TextEncoder().encode(criteria.text).length > 1024)
-      fail("Run event text requires between 1 and 1024 bytes.");
-    query.text = criteria.text;
+  return { events, next };
+}
+
+// src/runs/watch-polling.ts
+var RUN_WATCH_POLL_INTERVAL_MS = 2e3;
+function waitForNextPoll(ms, signal) {
+  if (signal?.aborted) {
+    return Promise.resolve(false);
   }
-  return query;
+  return new Promise((resolve) => {
+    const finish = (elapsed) => {
+      clearTimeout(timeout);
+      signal?.removeEventListener("abort", onAbort);
+      resolve(elapsed);
+    };
+    const onAbort = () => finish(false);
+    const timeout = setTimeout(() => finish(true), ms);
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
 }
-function normalizeRunEventOperationRequest(input, nowMs = Date.now()) {
-  bounded(input, RUN_EVENT_QUERY_MAX_REQUEST_BYTES);
-  if (!object(input)) fail("Run event operation requires an object.");
-  const operation = input.operation;
-  if (!["list", "count", "summarize", "fields"].includes(String(operation)))
-    fail("Run event operation requires list, count, summarize or fields.");
-  if (input.resource !== "logs" && input.resource !== "events")
-    fail("Run event resource requires logs or events.");
-  const allowed = [
-    "operation",
-    "resource",
-    "runId",
-    ...operation === "fields" ? [] : CRITERIA_KEYS,
-    ...operation === "list" ? ["limit", "cursor", "includePayloads"] : operation === "summarize" ? ["groupBy", "measures", "limit", "cursor"] : []
-  ];
-  for (const key of Object.keys(input)) {
-    if (!allowed.includes(key))
-      fail(`Run event ${operation} does not support ${key}.`);
+function readSnapshotResponse(response, runId) {
+  if (!response || typeof response !== "object" || Array.isArray(response)) {
+    throw new Error("Run watch returned an invalid snapshot response.");
   }
-  const base = {
-    operation,
-    resource: input.resource,
-    ...input.runId === void 0 ? {} : { runId: exact(input.runId, "runId") }
-  };
-  if (operation === "fields") return base;
-  if (input.resource === "logs" && !base.runId)
-    fail("Run event logs require runId.");
-  if (input.cursor !== void 0 && (typeof input.cursor !== "string" || !input.cursor.length || input.cursor.length > RUN_EVENT_QUERY_MAX_CURSOR_BYTES))
-    fail("Run event cursor is invalid.");
-  const rawCriteria = Object.fromEntries(
-    Object.entries(input).filter(
-      ([key]) => CRITERIA_KEYS.includes(key) && (key !== "runId" || input.resource === "events")
-    )
-  );
-  const query = normalizeRunEventQuery(
-    input.cursor === void 0 ? rawCriteria : { ...rawCriteria, since: nowMs - 36e5, until: nowMs },
-    nowMs
-  );
-  const criteria = { ...query };
-  if (input.cursor !== void 0) {
-    if (input.since === void 0) delete criteria.since;
-    else criteria.since = time(input.since, nowMs, nowMs - 36e5);
-    if (input.until === void 0) delete criteria.until;
-    else criteria.until = time(input.until, nowMs, nowMs);
+  const record = response;
+  const snapshot = record.snapshot;
+  if (record.runId !== runId || !snapshot || typeof snapshot !== "object" || Array.isArray(snapshot) || snapshot.runId !== runId || typeof snapshot.status !== "string" || !Array.isArray(snapshot.logs) || !snapshot.logs.every(
+    (line) => typeof line === "string"
+  ) || typeof snapshot.totalLogCount !== "number" || !Array.isArray(snapshot.nodeStates)) {
+    throw new Error(`Run watch returned an invalid snapshot for ${runId}.`);
   }
-  if (operation === "count")
-    return { ...base, ...criteria };
-  const limit = input.limit ?? (input.includePayloads === true ? 10 : 50);
-  if (!Number.isSafeInteger(limit) || limit < 1 || limit > RUN_EVENT_QUERY_MAX_LIMIT)
-    fail("Run event limit must be between 1 and 200.");
-  const page = {
-    limit,
-    ...input.cursor === void 0 ? {} : { cursor: input.cursor }
-  };
-  if (operation === "list") {
-    if (input.includePayloads !== void 0 && typeof input.includePayloads !== "boolean")
-      fail("Run event includePayloads requires a boolean.");
-    if (input.includePayloads === true && limit > RUN_EVENT_QUERY_MAX_PAYLOAD_LIMIT)
-      fail("Run event payload pages cannot exceed 10 rows.");
-    return {
-      ...base,
-      ...criteria,
-      ...page,
-      ...input.includePayloads === void 0 ? {} : { includePayloads: input.includePayloads }
-    };
+  return { runId, snapshot };
+}
+async function backfillRotatedLogTail(input) {
+  if (!input.previous.runSignature || input.snapshot.logsUnavailable) {
+    return input.snapshot;
   }
-  if (!Array.isArray(input.groupBy) || input.groupBy.length > 4)
-    fail("Run event groupBy requires at most four fields.");
-  const groupBy = input.groupBy.map(validateRunEventField);
-  if (new Set(groupBy).size !== groupBy.length)
-    fail("Run event groupBy fields must be distinct.");
-  const rawMeasures = input.measures ?? [{ op: "count" }];
-  if (!Array.isArray(rawMeasures) || rawMeasures.length < 1 || rawMeasures.length > 8)
-    fail("Run event measures require between 1 and 8 entries.");
-  const names = /* @__PURE__ */ new Set();
-  const measures = rawMeasures.map((measure) => {
-    if (!object(measure) || measure.op !== "count" && measure.op !== "sum")
-      fail("Run event measures support count and sum.");
-    for (const key of Object.keys(measure)) {
-      if (!["op", "as", ...measure.op === "sum" ? ["field"] : []].includes(key))
-        fail(`Unsupported run event measure option: ${key}.`);
+  const gap = resolvePlayRunLogGap(input.snapshot, input.previous.lastLogSeq);
+  if (!gap) {
+    return input.snapshot;
+  }
+  const lines = [];
+  let cursor = input.previous.lastLogSeq;
+  const targetSeq = gap.tailFirstSeq - 1;
+  while (cursor < targetSeq) {
+    const limit = Math.min(1e3, targetSeq - cursor);
+    const page = await input.http.get(
+      `/api/v2/runs/${encodeURIComponent(input.runId)}/logs?afterSeq=${cursor}&limit=${limit}`,
+      { signal: input.signal }
+    );
+    if (!page || !Array.isArray(page.entries) || page.entries.length === 0) {
+      return input.snapshot;
     }
-    const field = measure.op === "sum" ? validateRunEventField(measure.field) : void 0;
-    if (field && !field.startsWith("context.") && RUN_EVENT_QUERY_FIELD_CATALOG[field].type !== "number")
-      fail(`Run event sum requires a numeric field: ${field}.`);
-    const name = measure.as ?? (field ? `sum_${field.replaceAll(".", "_")}` : "count");
-    if (typeof name !== "string" || !/^[A-Za-z_][A-Za-z0-9_]{0,63}$/.test(name) || names.has(name))
-      fail("Run event measure names must be distinct identifiers.");
-    names.add(name);
-    return field ? { op: "sum", field, as: name } : { op: "count", as: name };
-  });
-  return {
-    ...base,
-    ...criteria,
-    ...page,
-    groupBy,
-    measures
-  };
+    for (const entry of page.entries) {
+      if (!entry || entry.seq !== cursor + 1 || typeof entry.line !== "string") {
+        return input.snapshot;
+      }
+      lines.push(entry.line);
+      cursor = entry.seq;
+    }
+  }
+  if (cursor !== targetSeq) {
+    return input.snapshot;
+  }
+  return { ...input.snapshot, logs: [...lines, ...input.snapshot.logs] };
 }
-
-// src/types.ts
-function isStopAllPlayRunsDryRunResult(result) {
-  return "dryRun" in result && result.dryRun === true;
+async function* watchRunEvents(options) {
+  const { http, runId, signal } = options;
+  const path = `/api/v2/runs/${encodeURIComponent(runId)}?watchSnapshot=true`;
+  const streamId = `play-run-watch:${runId}`;
+  const pollIntervalMs = options.pollIntervalMs ?? RUN_WATCH_POLL_INTERVAL_MS;
+  let previous = EMPTY_PLAY_RUN_STREAM_DIFF_STATE;
+  let consecutiveFailures = 0;
+  let outageNoticeSent = false;
+  while (!signal?.aborted) {
+    const pollStartedAt = Date.now();
+    let snapshot;
+    try {
+      const response = await http.get(path, { signal });
+      snapshot = await backfillRotatedLogTail({
+        http,
+        runId,
+        snapshot: readSnapshotResponse(response, runId).snapshot,
+        previous,
+        signal
+      });
+    } catch (error) {
+      if (signal?.aborted) {
+        return;
+      }
+      if (!isTransientPlayRunReadError(error)) {
+        throw error;
+      }
+      consecutiveFailures += 1;
+      const reason = error instanceof Error ? error.message : String(error);
+      if (!outageNoticeSent) {
+        options.onRetry?.({
+          attempt: consecutiveFailures,
+          delayMs: pollIntervalMs,
+          reason
+        });
+        options.onNotice?.(
+          `[watch] run snapshot request failed; retrying every ${pollIntervalMs / 1e3}s (${reason})`
+        );
+        outageNoticeSent = true;
+      }
+      const remaining2 = Math.max(
+        0,
+        pollIntervalMs - (Date.now() - pollStartedAt)
+      );
+      if (!await waitForNextPoll(remaining2, signal)) {
+        return;
+      }
+      continue;
+    }
+    if (outageNoticeSent) {
+      options.onNotice?.("[watch] run snapshot polling recovered");
+      outageNoticeSent = false;
+    }
+    consecutiveFailures = 0;
+    const diff = diffPlayRunStreamEvents({
+      streamId,
+      snapshot,
+      previous
+    });
+    previous = diff.next;
+    for (const event of diff.events) {
+      yield event;
+    }
+    if (isTerminalPlayRunLiveStatus(snapshot.status)) {
+      return;
+    }
+    const remaining = Math.max(
+      0,
+      pollIntervalMs - (Date.now() - pollStartedAt)
+    );
+    if (!await waitForNextPoll(remaining, signal)) {
+      return;
+    }
+  }
 }
 
 // ../play-runtime/runtime-environment.ts