deepline 0.3.469 → 0.3.471

package/dist/bundling-sources/sdk/src/client-core.ts

@@ -2072,6 +2072,11 @@ export type TargetBillingPlan = {
     | 'legacy-growth-v1';
   name: string;
   recurring_price_usd: number;
+  /**
+   * The first month's fee for switching to this plan when a first-month
+   * discount is offered; null or absent means the list price.
+   */
+  first_month_price_usd?: number | null;
   interval: 'month' | 'year';
   included_credits: number;
   /** Offered benefit terms; omitted by older API deployments. */

package/dist/bundling-sources/sdk/src/index.ts

@@ -331,6 +331,7 @@ export type {
   PlayRunActionPackage,
   PlayRunDatasetActions,
   PlayRunPackage,
+  PlayRunRateLimited,
   PlayActivityObservation,
   PlayActivityState,
   PlayActivityTarget,

package/dist/bundling-sources/sdk/src/plays/run-request.ts

@@ -453,6 +453,7 @@ export function normalizePlayRunStart(
     ...(runPackage.run.dashboardUrl
       ? { dashboardUrl: runPackage.run.dashboardUrl }
       : {}),
+    ...(runPackage.rateLimited ? { rateLimited: runPackage.rateLimited } : {}),
     ...(isTerminalPlayRunLifecycleStatus(status)
       ? raw.finalStatusView === 'full' && raw.runId === runPackage.run.id
         ? { finalStatus: raw, finalStatusView: 'full' as const }

package/dist/bundling-sources/sdk/src/release.ts

@@ -205,7 +205,7 @@ export const SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: '0.3.469',
+  version: '0.3.471',
   updateSummary: {
     introducedIn: '0.3.90',
     summary:

package/dist/bundling-sources/sdk/src/types.ts

@@ -847,6 +847,22 @@ export type PlayRunDatasetActions = {
   };
 };
 
+/**
+ * Present when no run started because the Play's `rateLimit` window is held.
+ * The response then describes `latestRunId`, an earlier run, not a new one.
+ */
+export interface PlayRunRateLimited {
+  code: 'PLAY_RUN_RATE_LIMITED';
+  latestRunId: string;
+  /** ISO time the latest run started its window. */
+  latestRunStartedAt: string;
+  /** ISO time the next run can start. */
+  nextAllowedAt: string;
+  everySeconds: number;
+  /** One-line explanation to show the caller. */
+  message: string;
+}
+
 /**
  * Compact canonical run package for SDK/CLI consumers: stable metadata,
  * output handles and follow-up actions without dashboard internals.
@@ -856,6 +872,8 @@ export interface PlayRunPackage {
   schemaVersion: 1;
   /** Package discriminator. */
   kind: 'play_run';
+  /** Set when this package is the latest run returned instead of a new one. */
+  rateLimited?: PlayRunRateLimited;
   /** Retained return structure with dataset references, not flattened output previews. */
   result?: unknown;
   /** Full-only values are omitted as a whole, never replaced with partial authored data. */
@@ -1266,6 +1284,8 @@ export interface RerunPlayRunResult {
    * servers.
    */
   deduplicated?: boolean;
+  /** Set when no rerun started; `runId` is then the Play's latest run. */
+  rateLimited?: PlayRunRateLimited;
   next: { inspect: string; input: string };
 }
 
@@ -1902,6 +1922,8 @@ export interface PlayRunStart {
   finalStatusView?: 'full';
   /** Canonical compact run package returned by current SDK/API responses. */
   package?: PlayRunPackage;
+  /** Set when no run started; `workflowId` is then the Play's latest run. */
+  rateLimited?: PlayRunRateLimited;
 }
 
 /**

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -15565,7 +15565,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       this.steps.push(step);
     }
     this.log(
-      `ctx.runPlayAsync(${normalizedKey}): admitted ${resolvedName} as ${launched.runId}`,
+      launched.rateLimited
+        ? `ctx.runPlayAsync(${normalizedKey}): ${launched.rateLimited.message}`
+        : `ctx.runPlayAsync(${normalizedKey}): admitted ${resolvedName} as ${launched.runId}`,
     );
     return launched;
   }

package/dist/bundling-sources/shared_libs/play-runtime/play-admission-outcome.ts

@@ -40,6 +40,14 @@ export const PLAY_RUN_LAUNCH_CONFLICT = 'PLAY_RUN_LAUNCH_CONFLICT' as const;
 export const PLAY_RUNTIME_CALLBACK_UNCONFIGURED =
   'PLAY_RUNTIME_CALLBACK_UNCONFIGURED' as const;
 
+/**
+ * The Play's declared `rateLimit` already started a run in the current
+ * window. The source is settled as skipped: no Run, no retry, not a DLQ item.
+ */
+export const PLAY_RUN_RATE_LIMITED = 'PLAY_RUN_RATE_LIMITED' as const;
+
+export type PlayAdmissionSkippedCode = typeof PLAY_RUN_RATE_LIMITED;
+
 export type PlayAdmissionBlockedCode =
   | typeof PLAY_ADMISSION_PAYLOAD_UNREADABLE
   | typeof PLAY_SECRET_UNAVAILABLE
@@ -63,6 +71,12 @@ export type PlayAdmissionFailure =
       disposition: 'blocked';
       code: PlayAdmissionBlockedCode;
       message: string;
+    }
+  | {
+      /** Settle the source terminally without a Run; nothing to repair or retry. */
+      disposition: 'skipped';
+      code: PlayAdmissionSkippedCode;
+      message: string;
     };
 
 const TERMINAL_PRE_ADMISSION_CODES = new Set<PlayAdmissionBlockedCode>([
@@ -87,18 +101,23 @@ function blocked(code: PlayAdmissionBlockedCode): PlayAdmissionFailure {
   };
 }
 
+const PLAY_RUN_RATE_LIMITED_MESSAGE =
+  "Rate limited: this Play's rateLimit already started a run in the current window, so this delivery started no run. It is not retried.";
+
 /**
- * The customer-facing reason for a blocked source. A deferred batch settles by
+ * The customer-facing reason for a blocked or skipped source. A deferred batch settles by
  * code alone, so the reason must be derivable from the stable code.
  */
 export function playAdmissionBlockedMessage(code: string): string {
-  return code === PLAY_SECRET_UNAVAILABLE
-        ? 'The Play configuration is unavailable. Repair it, then retry this delivery.'
-        : code === PLAY_RUN_LAUNCH_CONFLICT
-          ? 'This run identity is already bound to a different launch. Repair the trigger identity before retrying this delivery.'
-          : code === PLAY_RUNTIME_CALLBACK_UNCONFIGURED
-            ? 'This deployment has no public runtime callback URL, so Play workers cannot report progress. Configure the callback (local dev: start the dev tunnel), then retry this delivery.'
-            : 'This delivery needs attention before it can be retried.';
+  return code === PLAY_RUN_RATE_LIMITED
+    ? PLAY_RUN_RATE_LIMITED_MESSAGE
+    : code === PLAY_SECRET_UNAVAILABLE
+      ? 'The Play configuration is unavailable. Repair it, then retry this delivery.'
+      : code === PLAY_RUN_LAUNCH_CONFLICT
+        ? 'This run identity is already bound to a different launch. Repair the trigger identity before retrying this delivery.'
+        : code === PLAY_RUNTIME_CALLBACK_UNCONFIGURED
+          ? 'This deployment has no public runtime callback URL, so Play workers cannot report progress. Configure the callback (local dev: start the dev tunnel), then retry this delivery.'
+          : 'This delivery needs attention before it can be retried.';
 }
 
 /**
@@ -135,6 +154,13 @@ export function classifyPlayAdmissionFailure(
     return blocked(PLAY_SECRET_UNAVAILABLE);
   }
   const code = stableErrorCode(error);
+  if (code === PLAY_RUN_RATE_LIMITED) {
+    return {
+      disposition: 'skipped',
+      code,
+      message: PLAY_RUN_RATE_LIMITED_MESSAGE,
+    };
+  }
   if (
     code !== null &&
     TERMINAL_PRE_ADMISSION_CODES.has(code as PlayAdmissionBlockedCode)

package/dist/bundling-sources/shared_libs/play-runtime/play-runs/admission/postgres-adapter.ts

@@ -21,6 +21,8 @@ import { emitPlayRunLaunchConflictTelemetry } from '../../runtime-telemetry';
 export function createPostgresPlayRunAdmissionPorts(input: {
   client: PostgresSchedulerQueryClient;
   schema?: string;
+  /** The admitting app will immediately attempt its leased local projection. */
+  reserveCreatedProjection?: boolean;
 }): PlayRunAdmissionPorts {
   const options = input.schema ? { schema: input.schema } : undefined;
   return {
@@ -35,6 +37,7 @@ export function createPostgresPlayRunAdmissionPorts(input: {
             options,
             admission.queueName,
             admission.recoverExistingTask === true,
+            { reserveCreatedProjection: input.reserveCreatedProjection },
           );
         } catch (error) {
           if (isLaunchConflict(error)) {

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/absurd.ts

@@ -453,6 +453,9 @@ export function createAbsurdSchedulerBackend(
                   createPostgresPlayRunAdmissionPorts({
                     client,
                     schema: normalizedSchedulerOptions.schema,
+                    reserveCreatedProjection: Boolean(
+                      process.env.VERCEL?.trim(),
+                    ),
                   }),
                 ).admit({
                   launch: input,

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/postgres.ts

@@ -5007,6 +5007,7 @@ export async function submitPostgresAbsurdPlayRun(
   options: Pick<PostgresSchedulerOptions, 'schema'> | undefined,
   queueName: string,
   recoverExistingTask = false,
+  projection?: { reserveCreatedProjection?: boolean },
 ): Promise<{
   taskId: string | null;
   runCreated: boolean;
@@ -5030,6 +5031,7 @@ export async function submitPostgresAbsurdPlayRun(
       queueName,
       ...task,
       recoverExistingTask,
+      reserveCreatedProjection: projection?.reserveCreatedProjection === true,
     },
   );
   const taskId = submitted.absurdTaskId;
@@ -5125,6 +5127,7 @@ async function submitPostgresSchedulerRunTransaction(
     params: unknown;
     options: unknown;
     recoverExistingTask?: boolean;
+    reserveCreatedProjection?: boolean;
   },
   /**
    * Set only on the single re-admission after the current build proved the
@@ -5138,6 +5141,11 @@ async function submitPostgresSchedulerRunTransaction(
   taskRecoveryRequired: boolean;
 }> {
   const requestedInput = input;
+  const createdProjectionLease =
+    absurdTask?.reserveCreatedProjection === true &&
+    input.requiresRunCreatedProjection === true
+      ? postgresSchedulerInlineCreatedProjectionLease(input.runId)
+      : null;
   // Persist the ABI with every new launch. Null is reserved for genuinely
   // historic rows already in storage, where readers interpret it as legacy.
   input = {
@@ -5445,7 +5453,8 @@ async function submitPostgresSchedulerRunTransaction(
         -- durable run, its task, and the launch envelope together. Persist the
         -- causal run.created fact here; projection is deliberately async.
         INSERT INTO ${tableName('outbox', options)} (
-          event_id, run_id, event_type, payload_json, created_at
+          event_id, run_id, event_type, payload_json, created_at,
+          lease_owner, lease_expires_at
         )
         SELECT
           'run-created:' || run_insert.run_id,
@@ -5498,7 +5507,9 @@ async function submitPostgresSchedulerRunTransaction(
           )) || CASE WHEN launch_payload.launch_json ? 'retainedPipelineGraph'
             THEN jsonb_build_object('retainedPipelineGraph', launch_payload.launch_json -> 'retainedPipelineGraph')
             ELSE '{}'::jsonb END,
-          ${causalOutboxCreatedAt('run_insert.run_id', options)}
+          ${causalOutboxCreatedAt('run_insert.run_id', options)},
+          ${createdProjectionLease ? escapeLiteral(createdProjectionLease.leaseOwner) : 'NULL::text'},
+          ${createdProjectionLease ? `now() + interval '${createdProjectionLease.leaseSeconds} seconds'` : 'NULL::timestamptz'}
         FROM run_insert
         CROSS JOIN launch_payload
         -- Old Vercel launchers do not carry the immutable admission envelope.
@@ -6319,6 +6330,32 @@ function cronOccurrenceLaunch(input: {
   });
 }
 
+function cronSuccessorDueAtMs(schedule: PostgresSchedulerCronSchedule): number {
+  let successorDueAtMs: number;
+  try {
+    successorDueAtMs = advanceWorkflowCronSchedule(
+      schedule.cron,
+      Math.max(Date.now(), schedule.dueAtMs),
+      schedule.timezone,
+    );
+  } catch (error) {
+    throw new PostgresSchedulerCronScheduleConfigurationError(
+      `Cron schedule "${schedule.scheduleId}" has an invalid pinned expression or timezone: ${
+        error instanceof Error ? error.message : String(error)
+      }`,
+    );
+  }
+  if (
+    !Number.isSafeInteger(successorDueAtMs) ||
+    successorDueAtMs <= schedule.dueAtMs
+  ) {
+    throw new PostgresSchedulerCronScheduleConfigurationError(
+      `Cron schedule "${schedule.scheduleId}" did not produce a future successor occurrence.`,
+    );
+  }
+  return successorDueAtMs;
+}
+
 export type FirePostgresSchedulerCronScheduleInput = {
   scheduleId: string;
   generation: number;
@@ -6377,28 +6414,7 @@ export async function firePostgresSchedulerCronSchedule(
   ) {
     return { status: 'superseded' };
   }
-  let successorDueAtMs: number;
-  try {
-    successorDueAtMs = advanceWorkflowCronSchedule(
-      schedule.cron,
-      Math.max(Date.now(), schedule.dueAtMs),
-      schedule.timezone,
-    );
-  } catch (error) {
-    throw new PostgresSchedulerCronScheduleConfigurationError(
-      `Cron schedule "${schedule.scheduleId}" has an invalid pinned expression or timezone: ${
-        error instanceof Error ? error.message : String(error)
-      }`,
-    );
-  }
-  if (
-    !Number.isSafeInteger(successorDueAtMs) ||
-    successorDueAtMs <= schedule.dueAtMs
-  ) {
-    throw new PostgresSchedulerCronScheduleConfigurationError(
-      `Cron schedule "${schedule.scheduleId}" did not produce a future successor occurrence.`,
-    );
-  }
+  const successorDueAtMs = cronSuccessorDueAtMs(schedule);
   const launch = cronOccurrenceLaunch({
     schedule,
     launch: input.launch,
@@ -6713,6 +6729,110 @@ export async function firePostgresSchedulerCronSchedule(
   return { status: 'superseded' };
 }
 
+/**
+ * Advance a cron cursor past an occurrence that deliberately starts no Run (a
+ * Play's `rateLimit` window is held). Under the same schedule lock and fences
+ * as `firePostgresSchedulerCronSchedule`, it spawns only the successor timer,
+ * so the schedule keeps ticking. A replay after commit is `superseded`.
+ */
+export async function skipPostgresSchedulerCronOccurrence(
+  client: PostgresSchedulerQueryClient,
+  input: Pick<
+    FirePostgresSchedulerCronScheduleInput,
+    'scheduleId' | 'generation' | 'fireGeneration' | 'dueAtMs' | 'queueName'
+  >,
+  options?: Pick<PostgresSchedulerOptions, 'schema'>,
+): Promise<
+  { status: 'skipped'; successorDueAtMs: number } | { status: 'superseded' }
+> {
+  assertPostgresSchedulerCronScheduleInput(input);
+  const schedule = await readPostgresSchedulerCronSchedule(
+    client,
+    input.scheduleId,
+    options,
+  );
+  if (
+    !schedule ||
+    schedule.state !== 'active' ||
+    schedule.generation !== input.generation ||
+    schedule.dueAtMs !== input.dueAtMs ||
+    schedule.currentFireGeneration !== input.fireGeneration
+  ) {
+    return { status: 'superseded' };
+  }
+  const successorDueAtMs = cronSuccessorDueAtMs(schedule);
+  const successorTask = buildAbsurdCronFireTask({
+    scheduleId: schedule.scheduleId,
+    generation: schedule.generation,
+    fireGeneration: 1,
+    dueAtMs: successorDueAtMs,
+    schedulerSchema:
+      options?.schema ?? schedule.sourcePin.schedulerSchema ?? null,
+    orgId: schedule.sourcePin.orgId,
+  });
+  const result = await client.query<{ advanced: boolean }>(
+    `
+      WITH schedule_lock AS MATERIALIZED (
+        SELECT pg_advisory_xact_lock(
+          ${POSTGRES_SCHEDULER_RELEASE_ADMISSION_LOCK_NAMESPACE},
+          ${quoteIdent(schemaName(options))}.runtime_release_admission_lock_id(
+            'cron-schedule:' || $1::text
+          )
+        )
+      ), matching_schedule AS MATERIALIZED (
+        SELECT schedule.schedule_id
+        FROM schedule_lock
+        JOIN ${tableName(POSTGRES_SCHEDULER_CRON_SCHEDULES_TABLE, options)} AS schedule
+          ON schedule.schedule_id = $1::text
+        WHERE schedule.generation = $2::bigint
+          AND schedule.state = 'active'
+          AND schedule.current_due_at = to_timestamp($3::double precision / 1000.0)
+          AND schedule.current_fire_generation = $4::bigint
+        FOR UPDATE
+      ), successor_task_spawn AS MATERIALIZED (
+        SELECT spawned.task_id::text AS task_id
+        FROM matching_schedule
+        CROSS JOIN LATERAL absurd.spawn_task(
+          $6::text,
+          $7::text,
+          $8::jsonb,
+          $9::jsonb
+        ) AS spawned
+      ), schedule_advance AS (
+        UPDATE ${tableName(POSTGRES_SCHEDULER_CRON_SCHEDULES_TABLE, options)} AS schedule
+        SET current_due_at = to_timestamp($5::double precision / 1000.0),
+            current_fire_task_id = (SELECT task_id FROM successor_task_spawn),
+            current_fire_generation = 1,
+            current_fire_queue_name = $6::text,
+            last_fired_at = clock_timestamp(),
+            updated_at = now()
+        WHERE schedule.schedule_id = $1::text
+          AND schedule.generation = $2::bigint
+          AND schedule.state = 'active'
+          AND schedule.current_due_at = to_timestamp($3::double precision / 1000.0)
+          AND schedule.current_fire_generation = $4::bigint
+          AND EXISTS (SELECT 1 FROM successor_task_spawn)
+        RETURNING schedule.schedule_id
+      )
+      SELECT EXISTS (SELECT 1 FROM schedule_advance) AS advanced
+    `,
+    [
+      schedule.scheduleId,
+      schedule.generation,
+      schedule.dueAtMs,
+      schedule.currentFireGeneration,
+      successorDueAtMs,
+      input.queueName,
+      successorTask.taskName,
+      stringifyPostgresJson(successorTask.params),
+      stringifyPostgresJson(successorTask.options),
+    ],
+  );
+  return result.rows[0]?.advanced === true
+    ? { status: 'skipped', successorDueAtMs }
+    : { status: 'superseded' };
+}
+
 /** Fence a malformed/invalid timer so it cannot repeatedly consume workers. */
 export async function blockPostgresSchedulerCronSchedule(
   client: PostgresSchedulerQueryClient,
@@ -22182,6 +22302,29 @@ export function postgresSchedulerCancellationOutboxLease(runId: string): {
   };
 }
 
+/**
+ * The admitting app can project its own run.created without an HTTP round trip.
+ * Reserve that first delivery in the admission commit, before NOTIFY lets the
+ * remote projector race it. An app lost before delivery leaves at most this
+ * short lease; ordinary inline claims retain their existing deadline/release.
+ * This is delivery ownership only, never execution admission or authority.
+ */
+export function postgresSchedulerInlineCreatedProjectionLease(runId: string): {
+  leaseOwner: string;
+  leaseSeconds: number;
+} {
+  const normalizedRunId = runId.trim();
+  if (!normalizedRunId) {
+    throw new Error('Inline created projection requires a run id.');
+  }
+  return {
+    leaseOwner: `run-created-inline:${createHash('sha256')
+      .update(normalizedRunId)
+      .digest('hex')}`,
+    leaseSeconds: 2,
+  };
+}
+
 export type RunLedgerOutboxDispatchInput = {
   /** App-owned transport; launch authority and routing still come from the lease. */
   appRuntimeFetch?: typeof fetch;
@@ -22842,14 +22985,12 @@ async function dispatchRunLedgerOutboxBatchWithScope(
       // The caller's deadline elapsed while this checkout was queued. Its
       // attempt is already abandoned, so taking a lease now could only keep
       // the durable projector off the row until that lease expires. Claim
-      // nothing: the row stays pending and unleased for its next owner.
-      if (claimInvocations > 1 && abandonedHeadEventId) {
-        // An earlier invocation's COMMIT may have reached the server before
-        // its connection failed, so this owner can already hold the named
-        // head. Hand it back here, fenced to this owner; returning empty
-        // would leave that lease with nobody to release it. After a rolled
-        // back invocation it matches no row. A failure propagates, so the
-        // attempt is never reported as settled.
+      // nothing, and hand back any initial reservation of the named head.
+      if (abandonedHeadEventId) {
+        // Admission may already have reserved this head, even on the first
+        // checkout. A retried checkout can also follow an ambiguous COMMIT.
+        // Release only this owner's lease; an absent or replaced owner is a
+        // no-op. Failure propagates so the attempt cannot report settlement.
         await releasePostgresSchedulerOutboxLease(
           client,
           [abandonedHeadEventId],

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/run-ledger-outbox-recovery.ts

@@ -14,6 +14,7 @@ import {
   postgresSchedulerNotifyChannel,
   readPostgresSchedulerOutboxAdmissionHints,
   readPostgresSchedulerOutboxNextDueAt,
+  postgresSchedulerInlineCreatedProjectionLease,
   type PostgresSchedulerOptions,
   type PostgresSchedulerOutboxProjectionResult,
   type RunLedgerOutboxDeliveredRow,
@@ -1060,6 +1061,8 @@ export async function deliverRunCreatedOutboxEventInline(input: {
     {
       runId,
       headEventId: `run-created:${runId}`,
+      leaseOwner:
+        postgresSchedulerInlineCreatedProjectionLease(runId).leaseOwner,
       limit: 1,
       leaseSeconds: RUN_CREATED_INLINE_DELIVERY_LEASE_SECONDS,
       tokenAuthority: input.tokenAuthority,

package/dist/bundling-sources/shared_libs/plays/authoring-contract.ts

@@ -795,6 +795,7 @@ export const PLAY_AUTHORING_BINDING_FIELDS = {
     'compatibility',
     'cron',
     'inline',
+    'rateLimit',
     'runtime',
     'secrets',
     'sqlListeners',
@@ -864,6 +865,14 @@ export type PlayAuthoringBindings<TInput = Record<string, unknown>> = {
     timeout?: string;
     size?: 'standard';
   };
+  /**
+   * Start at most one run of this Play per window, whatever started it.
+   * Inside the window a caller gets the latest run, marked rate limited;
+   * webhook, cron, and listener starts are skipped and never retried.
+   */
+  rateLimit?: {
+    every: string;
+  };
   webhook?: {
     hmac?: {
       algorithm?: 'sha256';
@@ -1291,6 +1300,11 @@ export type PlayRunId = string & {
  */
 export type AsyncPlayRunRef = Readonly<{
   runId: PlayRunId;
+  /**
+   * Set when the child's `rateLimit` window was held: no child started and
+   * `runId` is that Play's latest run.
+   */
+  rateLimited?: { latestRunId: string; nextAllowedAt: string; message: string };
 }>;
 
 export type PlayAuthoringAsyncCallOptions = Readonly<{
@@ -2934,6 +2948,24 @@ export const PLAY_AUTHORING_FIELD_REGISTRY = {
     errorMessage:
       'runtime.timeout must be a static duration such as "90m" or "2h".',
   },
+  'rateLimit.every': {
+    schema: Type.String({ pattern: '^\\d+\\s*[smh]$' }),
+    fixtures: {
+      valid: '5m',
+      invalid: '5 minutes',
+      absent: undefined,
+      unresolved: { expression: 'every' },
+      edition1: '5m',
+    },
+    referenceType: 'string',
+    required: false,
+    resolution: 'static-required',
+    issueCode: 'play_authoring_binding_invalid',
+    description:
+      'Start at most one run per window, such as 30s, 5m, or 1h (10s to 24h).',
+    errorMessage:
+      'rateLimit.every must be a static duration from "10s" to "24h", such as "5m".',
+  },
   'runtime.size': {
     schema: Type.Literal('standard'),
     fixtures: {
@@ -3251,6 +3283,8 @@ export type AdmittedPlayAuthoringContract = {
   bindings: PlayAuthoringBindingsSnapshot | null;
   billingLimit: { maxCreditsPerRun: number } | null;
   runtimeLimit: PlaySandboxRuntimeLimits;
+  /** Absent on artifacts admitted before `rateLimit` existed: unlimited. */
+  rateLimit?: { everySeconds: number };
   allowedSecrets: string[];
 };
 
@@ -3396,6 +3430,7 @@ export const PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   `  inline?: ${cloudReferenceType('inline')};`,
   `  billing?: { maxCreditsPerRun?: ${cloudReferenceType('billing.maxCreditsPerRun')} };`,
   `  runtime?: { timeout?: ${cloudReferenceType('runtime.timeout')}; size?: ${cloudReferenceType('runtime.size')} };`,
+  `  rateLimit?: { every: ${cloudReferenceType('rateLimit.every')} };`,
   `  webhook?: { hmac?: { algorithm?: ${cloudReferenceType('bindings.webhook.hmac.algorithm')}; header?: ${cloudReferenceType('bindings.webhook.hmac.header')}; signaturePrefix?: ${cloudReferenceType('bindings.webhook.hmac.signaturePrefix')}; secretEnv: ${cloudReferenceType('bindings.webhook.hmac.secretEnv')} }; auth?: { type: ${cloudReferenceType('bindings.webhook.auth.type')}; headerFamily: ${cloudReferenceType('bindings.webhook.auth.headerFamily')}; signingSecrets: readonly ${cloudReferenceType('bindings.webhook.auth.signingSecrets[]')}[]; toleranceSeconds?: ${cloudReferenceType('bindings.webhook.auth.toleranceSeconds')} } };`,
   `  cron?: { schedule: ${cloudReferenceType('bindings.cron.schedule')}; timezone?: ${cloudReferenceType('bindings.cron.timezone')}; input?: PlayCronInput<TInput> };`,
   '  sqlListeners?: readonly SqlListenerDeclaration[];',
@@ -3420,7 +3455,7 @@ export const PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   `export type PlayAsyncCallOptions = { description: ${cloudReferenceType('ctx.runPlayAsync.options.description')} };`,
   'declare const PLAY_RUN_ID_BRAND: unique symbol;',
   "export type PlayRunId = string & { readonly [PLAY_RUN_ID_BRAND]: 'PlayRunId' };",
-  'export type AsyncPlayRunRef = Readonly<{ runId: PlayRunId }>;',
+  'export type AsyncPlayRunRef = Readonly<{ runId: PlayRunId; rateLimited?: { latestRunId: string; nextAllowedAt: string; message: string } }>;',
   `export type RuntimeStepOptions = { semanticKey?: ${cloudReferenceType('ctx.step.semanticKey')}; staleAfterSeconds?: ${cloudReferenceType('ctx.step.staleAfterSeconds')} };`,
   `export type FetchOptions = { staleAfterSeconds?: ${cloudReferenceType('ctx.fetch.staleAfterSeconds')}; transient?: boolean };`,
   "export type CallFreshnessMetadata = { requestedStaleAfterSeconds: number | null; effectiveStaleAfterSeconds: number | null; source: 'executed' | 'operation_recovery' | 'reusable_result' | 'live_observation'; resultAgeMs: number; completedAt: number; operationReceiptKey?: string; unavailableReason?: string };",

package/dist/cli/auth-2MMOFS3O.js

@@ -0,0 +1,41 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+var _chunkCR2F3JZNjs = require('./chunk-CR2F3JZN.js');
+require('./chunk-YRM5TPXL.js');
+require('./chunk-MLQJVAVS.js');
+require('./chunk-DK5Y5BD3.js');
+require('./chunk-ALJJRZNJ.js');
+require('./chunk-XNYIZMNQ.js');
+require('./chunk-DIAWYWT5.js');
+require('./chunk-G6RQXAJ2.js');
+require('./chunk-OG64RBAC.js');
+require('./chunk-COGTRVWW.js');
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+exports.EXIT_WORKSPACE_MISMATCH = _chunkCR2F3JZNjs.EXIT_WORKSPACE_MISMATCH; exports.authStatusLine = _chunkCR2F3JZNjs.authStatusLine; exports.clearPendingClaim = _chunkCR2F3JZNjs.clearPendingClaim; exports.clearSatisfiedPendingClaim = _chunkCR2F3JZNjs.clearSatisfiedPendingClaim; exports.handleRegister = _chunkCR2F3JZNjs.handleRegister; exports.handleStatus = _chunkCR2F3JZNjs.handleStatus; exports.handleWait = _chunkCR2F3JZNjs.handleWait; exports.httpJson = _chunkCR2F3JZNjs.httpJson; exports.readPendingAuthClaim = _chunkCR2F3JZNjs.readPendingAuthClaim; exports.readStatusBanner = _chunkCR2F3JZNjs.readStatusBanner; exports.registerAuthCommands = _chunkCR2F3JZNjs.registerAuthCommands; exports.reportSetupCompleted = _chunkCR2F3JZNjs.reportSetupCompleted; exports.resolvePendingAuthClaimForResume = _chunkCR2F3JZNjs.resolvePendingAuthClaimForResume; exports.statusBannerLine = _chunkCR2F3JZNjs.statusBannerLine;

package/dist/cli/{auth-HHMOHWIF.mjs → auth-MUCIXHJF.mjs}

@@ -13,14 +13,14 @@ import {
   reportSetupCompleted,
   resolvePendingAuthClaimForResume,
   statusBannerLine
-} from "./chunk-YCIQYY5F.mjs";
-import "./chunk-PAY27R7P.mjs";
-import "./chunk-UI2UC3OD.mjs";
-import "./chunk-DI3K3PJE.mjs";
+} from "./chunk-2KBRY5CA.mjs";
+import "./chunk-OYHCMKZM.mjs";
+import "./chunk-FVGT5EBA.mjs";
+import "./chunk-ZMJOSD7R.mjs";
 import "./chunk-4QF2K7TM.mjs";
 import "./chunk-DLIRSHV6.mjs";
 import "./chunk-HBL4PM5Q.mjs";
-import "./chunk-WFI46NX4.mjs";
+import "./chunk-3PT2HJKC.mjs";
 import "./chunk-WZYKRD7T.mjs";
 import "./chunk-KRD6H754.mjs";
 export {