deepline 0.3.461 → 0.3.463

package/dist/bundling-sources/shared_libs/play-runtime/test-runtime-seams.ts

@@ -85,6 +85,11 @@ const RUNTIME_TEST_POLICY_WORK_BUDGET_KEYS = new Set([
 
 const MAX_RUNTIME_TEST_POLICY_MS = 10 * 60_000;
 const MAX_RUNTIME_TEST_POLICY_YIELD_LIMIT = 1_000_000;
+/**
+ * A heartbeat is also the runner's cancellation channel, so silence blinds it
+ * too. A drill may hold that, but only briefly.
+ */
+export const MAX_RUNNER_HEARTBEAT_SILENCE_MS = 10 * 60_000;
 
 function testRuntimeSeamsEnabled(): boolean {
   return process.env.DEEPLINE_TEST_RUNTIME_SEAMS === '1';
@@ -143,6 +148,14 @@ function parseRuntimeTestFaultHeader(
         error: `Runtime test fault "${name}" count must be 1.`,
       };
     }
+    if (
+      name === 'runner_heartbeat_silence_ms' &&
+      total > MAX_RUNNER_HEARTBEAT_SILENCE_MS
+    ) {
+      return {
+        error: `Runtime test fault "${name}" must be at most ${MAX_RUNNER_HEARTBEAT_SILENCE_MS}ms.`,
+      };
+    }
     faults.set(name, total);
   }
   return faults;
@@ -189,6 +202,33 @@ export function shouldInjectModalSandboxCreateResourceExhausted(input: {
   );
 }
 
+/**
+ * How long a detached runner's watchdog withholds heartbeats, or 0 for never.
+ *
+ * Like the Modal fault, the header is admitted only through
+ * `parseRuntimeTestFaultCounts` and this is the second production guard: a
+ * persisted historical header can never silence a live runner. It reads the
+ * Preview marker as well because the Fly worker image sets NODE_ENV=production
+ * everywhere, so `getRuntimeEnv()` is `prod` on a Preview worker too. Only the
+ * Preview worker config sets that marker. Each attempt is silenced, because a
+ * failed sandbox start can make the attempt that reaches customer code a later
+ * one.
+ */
+export function resolveRunnerHeartbeatSilenceMs(
+  runtimeTestFaultHeader: string | null | undefined,
+): number {
+  if (
+    getRuntimeEnv() === 'prod' &&
+    process.env.DEEPLINE_RUNTIME_ENVIRONMENT !== 'preview'
+  ) {
+    return 0;
+  }
+  return recognizedRuntimeTestFaultCount(
+    runtimeTestFaultHeader,
+    'runner_heartbeat_silence_ms',
+  );
+}
+
 export function runtimeSheetPageTailRowsContainTarget(
   rows: readonly unknown[],
 ): boolean {

package/dist/bundling-sources/shared_libs/play-runtime/tool-call/index.ts

@@ -30,6 +30,12 @@ export {
   type NativeBatchToolCallJob,
   type NativeBatchToolCallMember,
 } from './native-batch';
+export {
+  createMappedToolCallJob,
+  type MappedToolCallDependencies,
+  type MappedToolCallJob,
+  type MappedToolCallMember,
+} from './mapped-calls';
 export {
   createAlwaysFreshToolCallAdapter,
   type AlwaysFreshToolCall,

package/dist/bundling-sources/shared_libs/play-runtime/tool-call/mapped-calls.ts

@@ -0,0 +1,171 @@
+import { dispatchBoundedSettled } from '../bounded-dispatch';
+import { toolExecutionMetadataForOutcome } from '../tool-execution-outcome';
+import {
+  cloneToolExecuteResultWithExecution,
+  type ToolExecuteResult,
+} from '../tool-result';
+import type { ToolResultReceipts } from './contract';
+import type {
+  ToolCallReceiptCohortJob,
+  ToolCallReceiptCohortMember,
+} from './receipt-cohort';
+
+export type MappedToolCallMember<Request> = ToolCallReceiptCohortMember & {
+  cacheKey: string;
+  receiptKey: string;
+  /** Runtime transport and row fields belong to their Adapters. */
+  request: Request;
+};
+
+export type MappedToolCallJob<Request> = {
+  call(input: {
+    owner: { runId: string; attempt: number };
+    members: readonly MappedToolCallMember<Request>[];
+  }): Promise<{ successfulMemberIds: string[] }>;
+};
+
+export type MappedToolCallDependencies<Request> = {
+  receiptCohort: ToolCallReceiptCohortJob;
+  admission: {
+    parallelism(): Promise<number>;
+    assertDispatchAllowed(): void;
+  };
+  execution: {
+    call(input: {
+      member: MappedToolCallMember<Request>;
+      receipts: ToolResultReceipts;
+      retainToolSlot(release: () => void): void;
+    }): Promise<ToolExecuteResult>;
+  };
+  delivery: {
+    complete(input: {
+      member: MappedToolCallMember<Request>;
+      result: ToolExecuteResult;
+      source: 'cache' | 'owner';
+    }): Promise<void>;
+    fail(input: {
+      member: MappedToolCallMember<Request>;
+      error: unknown;
+    }): Promise<void>;
+  };
+};
+
+/**
+ * Deliver receipt-backed scalar map calls independently. The Job owns result
+ * presentation and transient member/slot release; its Projection retains IDs
+ * only. Native batches and always-fresh calls have separate Jobs.
+ */
+export function createMappedToolCallJob<Request>(
+  dependencies: MappedToolCallDependencies<Request>,
+): MappedToolCallJob<Request> {
+  return {
+    async call({ owner, members }) {
+      if (members.length === 0) return { successfulMemberIds: [] };
+      const cohort = await dependencies.receiptCohort.acquire({
+        owner,
+        members: members.map(
+          ({
+            request: _request,
+            cacheKey: _cacheKey,
+            receiptKey: _receiptKey,
+            ...receipt
+          }) => receipt,
+        ),
+      });
+      const successfulMemberIds: string[] = [];
+      const cached: Promise<void>[] = [];
+      const owned: Array<{
+        member: MappedToolCallMember<Request>;
+        receipts: ToolResultReceipts;
+      }> = [];
+      const deliver = async (
+        member: MappedToolCallMember<Request>,
+        result: ToolExecuteResult,
+        source: 'cache' | 'owner',
+      ) => {
+        const presented = cloneToolExecuteResultWithExecution(result, {
+          ...toolExecutionMetadataForOutcome({
+            kind: source === 'owner' ? 'live' : source,
+            cacheKey: member.cacheKey,
+            receiptKey: member.receiptKey,
+            ...(source === 'owner'
+              ? {}
+              : { attachedToReceiptKey: member.receiptKey }),
+          }),
+          resultReceiptKey: member.resultReceiptKey,
+        });
+        await dependencies.delivery.complete({
+          member,
+          result: presented,
+          source,
+        });
+        successfulMemberIds.push(member.memberId);
+      };
+
+      // Presence is separate from value: JavaScript permits throw undefined.
+      let failure: { error: unknown } | undefined;
+      try {
+        for (const member of members) {
+          const state = cohort.member(member.memberId);
+          if (state.kind === 'completed') {
+            const delivery = deliver(
+              member,
+              state.result,
+              state.source,
+            ).finally(() => {
+              cohort.releaseDeliveredMember(member.memberId);
+            });
+            // Observe immediately; parallelism/setup can await or fail before
+            // the final join. Keep the original rejecting promise for custody.
+            void delivery.catch(() => undefined);
+            cached.push(delivery);
+          } else if (state.kind === 'owned') {
+            owned.push({ member, receipts: state.receipts });
+          } else {
+            throw new Error(
+              'A completed-result cache cannot own a pending invocation.',
+            );
+          }
+        }
+        const width = await dependencies.admission.parallelism();
+        const dispatched = await dispatchBoundedSettled(
+          owned,
+          width,
+          async ({ member, receipts }) => {
+            let releaseToolSlot: () => void = () => undefined;
+            try {
+              dependencies.admission.assertDispatchAllowed();
+              const result = await dependencies.execution.call({
+                member,
+                receipts,
+                retainToolSlot: (release) => {
+                  releaseToolSlot = release;
+                },
+              });
+              await deliver(member, result, 'owner');
+            } catch (error) {
+              await dependencies.delivery.fail({ member, error });
+            } finally {
+              try {
+                cohort.releaseDeliveredMember(member.memberId);
+              } finally {
+                releaseToolSlot();
+              }
+            }
+          },
+        );
+        const rejected = dispatched.find((entry) => 'error' in entry);
+        if (rejected) failure = { error: rejected.error };
+      } catch (error) {
+        failure = { error };
+      }
+      // All exits join deliveries already started, including setup failures.
+      for (const result of await Promise.allSettled(cached)) {
+        if (result.status === 'rejected' && !failure)
+          failure = { error: result.reason };
+      }
+      if (failure) throw failure.error;
+      return { successfulMemberIds };
+    },
+  };
+}

package/dist/bundling-sources/shared_libs/play-runtime/tool-call/receipt-cohort.ts

@@ -92,6 +92,8 @@ export type ToolCallReceiptCohortMemberState =
 
 export type ToolCallReceiptCohort = {
   member(memberId: string): ToolCallReceiptCohortMemberState;
+  /** Drop this cohort's result reference after its consumer owns delivery. */
+  releaseDeliveredMember(memberId: string): 'released' | 'not_completed';
   complete(
     input: Array<{ memberId: string; result: ToolExecuteResult }>,
   ): Promise<Map<string, ToolExecuteResult>>;
@@ -254,6 +256,7 @@ export function createToolCallReceiptCohortJob(input: {
           if (settlement.status === 'stored') {
             for (const entry of matching) {
               owned.delete(entry.member.memberId);
+              if (!states.has(entry.member.memberId)) continue;
               states.set(entry.member.memberId, {
                 kind: 'completed',
                 result: entry.result,
@@ -396,10 +399,22 @@ export function createToolCallReceiptCohortJob(input: {
           const state = states.get(memberId);
           if (!state)
             throw new Error(
-              `Unknown Tool Call Receipt Cohort member ${memberId}.`,
+              normalized.has(memberId)
+                ? `Tool Call Receipt Cohort member ${memberId} was released after delivery.`
+                : `Unknown Tool Call Receipt Cohort member ${memberId}.`,
             );
           return state;
         },
+        releaseDeliveredMember(memberId) {
+          if (!normalized.has(memberId))
+            throw new Error(
+              `Unknown Tool Call Receipt Cohort member ${memberId}.`,
+            );
+          const state = states.get(memberId);
+          if (state && state.kind !== 'completed') return 'not_completed';
+          states.delete(memberId);
+          return 'released';
+        },
         complete: publish,
         async fail(entries) {
           for (const entry of entries) {

package/dist/bundling-sources/shared_libs/play-runtime/tool-execute-retry-policy.ts

@@ -1,3 +1,4 @@
+import { RUNNER_GATEWAY_CONNECTION_RETRY_BUDGET_MS } from './runtime-constants';
 import {
   isHardBillingToolHttpError,
   isHtmlErrorBody,
@@ -73,6 +74,12 @@ export const TOOL_EXECUTE_RUNTIME_SCHEDULER_CAPACITY_MAX_ATTEMPTS = 65;
 export const TOOL_EXECUTE_PROVIDER_PACING_WAIT_MAX_ATTEMPTS = 65;
 export const TOOL_EXECUTE_TRANSPORT_MAX_ATTEMPTS = 3;
 export const TOOL_EXECUTE_TRANSPORT_RETRY_DELAY_MS = 1_000;
+// A sandbox lost new connections for about 97 seconds on 2026-10-30, and each
+// attempt spends a 10-second connect timeout, so three attempts cannot cover it.
+// Daytona network cuts then lasted up to 621 seconds, so the window covers the
+// whole cut. Nothing was sent, so waiting is always safe.
+export const TOOL_EXECUTE_CONNECT_RETRY_WINDOW_MS =
+  RUNNER_GATEWAY_CONNECTION_RETRY_BUDGET_MS;
 export const TOOL_EXECUTE_RETRY_DELAY_FALLBACK_MS = 1_000;
 export const TOOL_EXECUTE_RETRY_DELAY_MAX_MS = 5_000;
 export const TOOL_EXECUTE_RATE_LIMIT_RETRY_DELAY_MAX_MS = 30_000;
@@ -392,22 +399,25 @@ function isConcurrencyBackpressureResponse(input: {
   );
 }
 
-function isCredentialDispatchRefusalResponse(input: {
+function isPreDispatchRateRefusalResponse(input: {
   status: number;
   bodyText: string;
   executionFenced?: boolean;
 }): boolean {
-  // Fenced gateway attempts have their own qualified redelivery contract.
-  // This exemption is only for the ordinary execute route's released charge.
-  if (input.status !== 429 || input.executionFenced === true) return false;
+  if (input.status !== 429) return false;
   const body = parseJsonObject(input.bodyText);
   return (
     body?.code === 'RATE_LIMIT' &&
     body.failure_origin === 'deepline_rate_limit' &&
     body.error_category === 'rate_limit' &&
-    body.rate_limit_bucket_scope === 'credential_shared' &&
-    body.rate_limit_kind === 'requests_per_second' &&
-    body.provider_request_dispatched === false
+    body.provider_request_dispatched === false &&
+    // Workspace tool admission precedes billing for both execute paths.
+    // Credential refusals release a charge and retain their unfenced contract.
+    ((body.rate_limit_bucket_scope === 'customer_tool' &&
+      body.rate_limit_kind === 'requests_per_minute') ||
+      (input.executionFenced !== true &&
+        body.rate_limit_bucket_scope === 'credential_shared' &&
+        body.rate_limit_kind === 'requests_per_second'))
   );
 }
 
@@ -416,10 +426,14 @@ function isRuntimeSchedulerCapacityResponse(input: {
   bodyText: string;
 }): boolean {
   // This is a scheduler pre-admission outcome. Do not extend this exemption to
-  // generic 503s: they can arrive after a non-idempotent provider call.
+  // generic 503s: they can arrive after a non-idempotent provider call. The
+  // relay's routing failure qualifies only with its explicit no-dispatch proof.
+  if (input.status !== 503) return false;
+  const body = parseJsonObject(input.bodyText);
   return (
-    input.status === 503 &&
-    parseJsonObject(input.bodyText)?.code === 'scheduler_capacity'
+    body?.code === 'scheduler_capacity' ||
+    (body?.code === 'RUNTIME_SCHEDULER_UNAVAILABLE' &&
+      body.provider_request_dispatched === false)
   );
 }
 
@@ -626,6 +640,18 @@ function decideToolExecuteHttpRetry(input: {
   };
 }
 
+/** The next wait after a connection failed to open, or null once the window closes. */
+export function toolExecuteConnectRetryDelayMs(input: {
+  failures: number;
+  elapsedMs: number;
+}): number | null {
+  if (input.elapsedMs >= TOOL_EXECUTE_CONNECT_RETRY_WINDOW_MS) return null;
+  return Math.min(
+    TOOL_EXECUTE_RETRY_DELAY_MAX_MS,
+    TOOL_EXECUTE_TRANSPORT_RETRY_DELAY_MS * input.failures,
+  );
+}
+
 export function createToolExecuteHttpFailureAttemptTracker(): ToolExecuteHttpFailureAttemptTracker {
   const attemptsByReason: Record<
     ToolExecuteHttpRetryDecision['reason'],
@@ -745,7 +771,7 @@ export function classifyToolExecuteHttpFailure(input: {
   const concurrencyBackpressure = isConcurrencyBackpressureResponse(input);
   const runtimeSchedulerCapacity = isRuntimeSchedulerCapacityResponse(input);
   const providerPacingWait = isProviderPacingWaitResponse(input);
-  const credentialDispatchRefusal = isCredentialDispatchRefusalResponse(input);
+  const preDispatchRateRefusal = isPreDispatchRateRefusalResponse(input);
   const edgeGatewayFailure = isEdgeGatewayFailureResponse(input);
   const executionFenced = input.executionFenced === true;
   const explicitRetryable = readExplicitToolHttpRetryability(input);
@@ -964,6 +990,6 @@ export function classifyToolExecuteHttpFailure(input: {
       runtimeSchedulerCapacity ||
       concurrencyBackpressure ||
       providerPacingWait ||
-      credentialDispatchRefusal,
+      preDispatchRateRefusal,
   };
 }

package/dist/bundling-sources/shared_libs/play-runtime/tool-result.ts

@@ -60,6 +60,7 @@ import {
 import {
   normalizeTableNamespace,
   sha256Hex,
+  stableStringify,
 } from '../plays/row-identity';
 import { listNameFromDeclaredPath } from './tool-result-paths';
 import {
@@ -1275,10 +1276,10 @@ function buildTargets(
   const declaredTargetPaths = new Map<string, readonly string[]>();
   const semanticStatusTargets = new Set<string>();
   for (const [target, descriptor] of Object.entries(extractors ?? {})) {
-    // Normal scalar getters are total: a declared but absent value reads null.
-    // Semantic status getters stay absent when their provider status did not
-    // resolve; manufacturing an "unknown" status would blur no signal with an
-    // observed provider verdict.
+    // Declared getters are total: a declared but absent value reads null.
+    // Semantic status getters never borrow a sibling key or manufacture an
+    // "unknown" status, which would blur no signal with an observed provider
+    // verdict; an unresolved status reads null like any other miss.
     const isSemanticStatus =
       descriptor.emailStatus !== undefined ||
       descriptor.transforms?.some((transform) =>
@@ -1287,7 +1288,7 @@ function buildTargets(
         ),
       ) === true;
     if (isSemanticStatus) semanticStatusTargets.add(target);
-    else declaredTargetPaths.set(target, descriptor.paths);
+    declaredTargetPaths.set(target, descriptor.paths);
     const emailStatusTarget = buildEmailStatusTarget(result, descriptor);
     if (emailStatusTarget) {
       targets[target] = emailStatusTarget;
@@ -1447,8 +1448,18 @@ function applySerializedTargetValues(
   targetValues: Record<string, ToolResultTargetMetadata> | undefined,
 ): ToolExecuteResult {
   if (!targetValues || Object.keys(targetValues).length === 0) return result;
-  result._metadata.targets = targetValues;
-  result.extractedValues = buildExtractedAccessors(targetValues);
+  // Receipts saved before status getters were total omit an unresolved
+  // status. Keep every declared getter callable on replay: a target the
+  // receipt did not save reads null, never a value recomputed here.
+  const targets: Record<string, ToolResultTargetMetadata> = {};
+  for (const [target, rebuilt] of Object.entries(result._metadata.targets)) {
+    if (!Object.prototype.hasOwnProperty.call(targetValues, target)) {
+      targets[target] = { path: rebuilt.path, value: null };
+    }
+  }
+  Object.assign(targets, targetValues);
+  result._metadata.targets = targets;
+  result.extractedValues = buildExtractedAccessors(targets);
   return result;
 }
 
@@ -2492,8 +2503,9 @@ export function cloneToolExecuteResultWithExecution<TResult>(
   value: ToolExecuteResult<TResult>,
   execution: ToolResultExecutionMetadata,
 ): ToolExecuteResult<TResult> {
-  return deserializeToolExecuteResult({
-    ...serializeToolExecuteResult(value),
+  const serialized = serializeToolExecuteResult(value);
+  const cloned = deserializeToolExecuteResult({
+    ...serialized,
     execution: {
       ...execution,
       ...(!execution.resultReceiptKey &&
@@ -2502,6 +2514,18 @@ export function cloneToolExecuteResultWithExecution<TResult>(
         : {}),
     },
   }) as ToolExecuteResult<TResult>;
+  const relayReference = relayPublishedResultReferences.get(value);
+  // The immutable relay body includes execution metadata. A presentation-only
+  // clone may reuse it only if replaying that body preserves the exact stored
+  // projection; another call's receipt identity must retain its own value.
+  if (
+    relayReference &&
+    stableStringify(serialized.execution) ===
+      stableStringify(cloned._metadata.execution)
+  ) {
+    relayPublishedResultReferences.set(cloned, relayReference);
+  }
+  return cloned;
 }
 
 /**

package/dist/bundling-sources/shared_libs/play-runtime/transport-error-diagnostics.ts

@@ -30,6 +30,34 @@ export function transportGatewayOriginForDiagnostic(url: string): string {
   }
 }
 
+/**
+ * True only for failures that cannot happen once a socket exists, so no byte of
+ * the HTTP request was written. Replaying one needs no idempotency proof. A
+ * dual-stack host reports an AggregateError with `syscall` only on each entry,
+ * and one entry that lacks the proof leaves the whole failure ambiguous.
+ */
+export function transportFailureProvesRequestNeverSent(
+  error: unknown,
+  depth = 0,
+): boolean {
+  const value = asErrorLike(error);
+  // Rate-state wraps the fetch failure twice before the AggregateError entries.
+  if (!value || depth > 6) return false;
+  if (
+    value.code === 'UND_ERR_CONNECT_TIMEOUT' ||
+    value.syscall === 'connect' ||
+    value.syscall === 'getaddrinfo'
+  ) {
+    return true;
+  }
+  if (Array.isArray(value.errors) && value.errors.length > 0) {
+    return value.errors.every((entry) =>
+      transportFailureProvesRequestNeverSent(entry, depth + 1),
+    );
+  }
+  return transportFailureProvesRequestNeverSent(value.cause, depth + 1);
+}
+
 /**
  * Make a small, secret-redacted transport diagnostic that can safely cross the
  * runner -> gateway -> durable run-log boundary. Keep stacks in process logs:

package/dist/bundling-sources/shared_libs/play-runtime/work-receipt-storage-contract.ts

@@ -16,14 +16,64 @@ export const WORK_RECEIPT_KEY_FORMAT = {
 /** Reserved scalar admission fact, distinct from customer-authored work output. */
 export const RUNTIME_SHEET_WRITE_INTENT_RECEIPT_KIND =
   'runtime-sheet-write-intent';
+export const RUNTIME_ARRAY_INPUT_BEGIN_RECEIPT_KIND =
+  'runtime-array-input-begin';
+export const RUNTIME_ARRAY_INPUT_PAGE_RECEIPT_KIND = 'runtime-array-input-page';
+export const RUNTIME_ARRAY_INPUT_SEAL_RECEIPT_KIND = 'runtime-array-input-seal';
+export const RUNTIME_ARRAY_INPUT_RUN_GUARD_RECEIPT_KIND =
+  'runtime-array-input-run-guard';
+
+export const INTERNAL_WORK_RECEIPT_KINDS = [
+  RUNTIME_SHEET_WRITE_INTENT_RECEIPT_KIND,
+  RUNTIME_ARRAY_INPUT_BEGIN_RECEIPT_KIND,
+  RUNTIME_ARRAY_INPUT_PAGE_RECEIPT_KIND,
+  RUNTIME_ARRAY_INPUT_SEAL_RECEIPT_KIND,
+  RUNTIME_ARRAY_INPUT_RUN_GUARD_RECEIPT_KIND,
+] as const;
+
+const INTERNAL_WORK_RECEIPT_KEY_PREFIXES = INTERNAL_WORK_RECEIPT_KINDS.map(
+  (kind) => encodeURIComponent(`["${kind}",`),
+);
+
+/** Internal facts have dedicated fenced writers, never generic cache writers. */
+export function isInternalWorkReceiptKey(key: string): boolean {
+  if (!key.startsWith(`${WORK_RECEIPT_KEY_FORMAT.prefix}:`)) return false;
+  const parts = key.split(WORK_RECEIPT_KEY_FORMAT.separator);
+  if (
+    parts.length !== 4 ||
+    !INTERNAL_WORK_RECEIPT_KEY_PREFIXES.some((prefix) =>
+      parts[3]!.startsWith(prefix),
+    )
+  ) {
+    return false;
+  }
+  try {
+    const value: unknown = JSON.parse(decodeURIComponent(parts[3]!));
+    return (
+      Array.isArray(value) &&
+      INTERNAL_WORK_RECEIPT_KINDS.some((kind) => value[0] === kind)
+    );
+  } catch {
+    return false;
+  }
+}
+
+export function assertWorkReceiptKeyMutable(key: string): void {
+  if (isInternalWorkReceiptKey(key)) {
+    throw new Error(
+      'Internal runtime facts cannot be mutated through generic work receipt operations.',
+    );
+  }
+}
 
-/** Keep internal sheet admission facts out of customer work-output projections. */
+/** Keep internal runtime facts out of customer work-output projections. */
 export function workReceiptOutputPredicateSql(keyColumn = 'k'): string {
   const keySql = `convert_from(${keyColumn}, 'UTF8')`;
-  const intentPrefix = encodeURIComponent(
-    `["${RUNTIME_SHEET_WRITE_INTENT_RECEIPT_KIND}",`,
-  );
-  return `NOT (starts_with(${keySql}, '${WORK_RECEIPT_KEY_FORMAT.prefix}${WORK_RECEIPT_KEY_FORMAT.separator}') AND starts_with(split_part(${keySql}, '${WORK_RECEIPT_KEY_FORMAT.separator}', 4), '${intentPrefix}'))`;
+  const internalPrefixes = INTERNAL_WORK_RECEIPT_KEY_PREFIXES.map(
+    (prefix) =>
+      `starts_with(split_part(${keySql}, '${WORK_RECEIPT_KEY_FORMAT.separator}', 4), '${prefix}')`,
+  ).join(' OR ');
+  return `NOT (starts_with(${keySql}, '${WORK_RECEIPT_KEY_FORMAT.prefix}${WORK_RECEIPT_KEY_FORMAT.separator}') AND (${internalPrefixes}))`;
 }
 
 export const WORK_RECEIPT_STATUS_CODE = {

package/dist/bundling-sources/shared_libs/plays/authoring-contract.ts

@@ -136,6 +136,12 @@ export const PLAY_AUTHORING_CONTRACT_CHANGELOG =
  * execution-boundary guarantee.
  */
 export const PLAY_AUTHORING_RUNTIME_CAPABILITIES = [
+  {
+    capability: 'Hosted pages',
+    surface: '`deepline.pages.write`',
+    contract:
+      'A write replaces the whole page and must set `public`. The first write sets who can see the page. A later write can make a public page private but never a private page public; that takes `deepline pages set-public <name>`, and `deepline plays check` warns when code asks for it. A completed write is safe to repeat.',
+  },
   {
     capability: 'Durable external I/O',
     surface:
@@ -1481,6 +1487,28 @@ export const PLAY_AUTHORING_STATIC_FETCH_KEY_HINT =
   `${PLAY_AUTHORING_DOCUMENTATION.staticCallKeys.workaround} Do not compute the key.` as const;
 
 /** The complete customer-authored `ctx` Interface shared by every Adapter. */
+export type PlayAuthoringPageWriteOptions = {
+  /**
+   * Who can see the page. Taken from the first write. A later write cannot make
+   * a private page public: run `deepline pages set-public <name>` for that.
+   */
+  public: boolean;
+  /** Replaces the page's whole content. A non-string is stored as JSON. */
+  content: unknown;
+  /** Defaults to text, JSON, or binary according to `content`. */
+  contentType?: string;
+  description?: string;
+};
+
+export type PlayAuthoringPageWriteResult = {
+  name: string;
+  url: string;
+  /** Who can actually see the page after this write. */
+  public: boolean;
+  created: boolean;
+  warnings: string[];
+};
+
 export interface PlayAuthoringRuntimeContext<
   TListGetter extends 'dataset' | 'array' = 'dataset',
 > {
@@ -1493,6 +1521,17 @@ export interface PlayAuthoringRuntimeContext<
     entitlements(): Promise<BillingEntitlements>;
   };
 
+  pages: {
+    /**
+     * Replace a named page in this workspace and return its URL.
+     * @sdkReference runtime 181 deepline.pages.write(name, options)
+     */
+    write(
+      name: string,
+      options: PlayAuthoringPageWriteOptions,
+    ): Promise<PlayAuthoringPageWriteResult>;
+  };
+
   /**
    * Load a staged CSV file as a durable dataset handle.
    * @sdkReference runtime 040 deepline.csv(path, options)
@@ -3416,9 +3455,10 @@ export const PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   '};',
   'export type PlayReferenceLike<TInput extends Record<string, unknown> = Record<string, unknown>> = ({ readonly playName: string; readonly name?: string } | { readonly name: string; readonly playName?: string }) & { readonly __inputType?: TInput };',
   'export type BillingBenefitValues = { quickenrichUnlimited: { enabled: boolean; requestsPerMinute: number }; peopleSearch: { enabled: boolean; requestsPerMinute: number; profilesPerMonth: number; overageCreditsPerProfile?: number } };',
-  "export type BillingEntitlements = { org_id: string; as_of: number; plan: { sku: string; name: string; catalog_revision: string | null; included_credits: number; interval: 'month' | 'year' | null } | null; benefits: { quickenrichUnlimited?: { status: 'active' | 'past_due'; value: BillingBenefitValues['quickenrichUnlimited']; expiresAt?: number }; peopleSearch?: { status: 'active'; value: BillingBenefitValues['peopleSearch']; expiresAt?: number; usage: { month: string; periodStartsAt?: number; resetsAt?: number; resetsOn?: 'calendar_month' | 'billing_cycle'; limit: number; consumed: number; remaining: number } } }; effective_limits: { quickenrichUnlimited?: { baseline: number; effective: number; source: 'plan' | 'override'; override_expires_at?: number } } };",
+  "export type BillingEntitlements = { org_id: string; as_of: number; plan: { sku: string; name: string; catalog_revision: string | null; included_credits: number; interval: 'month' | 'year' | null } | null; benefits: { quickenrichUnlimited?: { status: 'active' | 'past_due'; value: BillingBenefitValues['quickenrichUnlimited']; expiresAt?: number }; peopleSearch?: { status: 'active'; value: BillingBenefitValues['peopleSearch']; expiresAt?: number; usage: { month: string; periodStartsAt?: number; resetsAt?: number; resetsOn?: 'calendar_month' | 'billing_cycle'; limit: number; consumed: number; remaining: number } }; includedStorage?: { status: 'active'; usage: { limit: number; consumed: number; remaining: number; measuredDay: string; overageCharged: boolean } } }; effective_limits: { quickenrichUnlimited?: { baseline: number; effective: number; source: 'plan' | 'override'; override_expires_at?: number } } };",
   'export interface DeeplinePlayRuntimeContext {',
   '  billing: { entitlements(): Promise<BillingEntitlements> };',
+  '  pages: { write(name: string, options: { public: boolean; content: unknown; contentType?: string; description?: string }): Promise<{ name: string; url: string; public: boolean; created: boolean; warnings: string[] }> };',
   '  csv<T = Record<string, unknown>>(path: string | CsvInput<T & object>, options?: CsvOptions): Promise<PlayDataset<T>>;',
   '  dataset<TSource extends PlayDatasetInput<object>>(key: string, items: TSource): DatasetBuilder<PlayDatasetRow<TSource> & object, PlayDatasetRow<TSource> & object>;',
   '  map<TSource extends PlayDatasetInput<object>>(key: string, items: TSource, options?: DatasetDefinitionOptions<PlayDatasetRow<TSource> & object>): never;',

package/dist/bundling-sources/shared_libs/plays/contracts.ts

@@ -31,6 +31,10 @@ export type PlayRuntimeFeature =
 export const PLAY_ARTIFACT_VERSION = CURRENT_PLAY_ARTIFACT_CONTRACT_VERSION;
 
 export type PlayContractCompatibilitySnapshot = {
+  /** App-injected optional diagnostic reader support, never an execution or version gate. */
+  terminalRuntimePerformanceSupported?: boolean;
+  /** App-injected reader support for optional nested body diagnostics, never an execution gate. */
+  terminalRuntimeBodyAdmissionSupported?: boolean;
   /** Historical marker. Nothing admits, gates, or branches on it. */
   apiVersion?: number;
   artifactVersion: number;